A slow DoS attack detection and mitigation method based on similarity degree

Abstract

The application discloses a slow DoS attack detection and mitigation method based on similarity degree and belongs to the network security field. The method comprises the following steps: collecting aggregated flow data through a controller, combining a dynamic threshold to determine whether the network state is abnormal; if the network state is abnormal, collecting six characteristics of the flow, inputting the six characteristics into a machine learning classifier to determine whether a slow DoS attack occurs; if the attack occurs, calculating three norms of each flow sequence and the aggregated flow sequence in real time, scoring the suspicious degree of each IP, and if the suspicious score of a certain IP exceeds a preset threshold, determining that the IP is an attack source and blocking the IP. The method can be actually deployed on an SDN controller, realizes real-time detection and mitigation of slow DoS attacks, has high detection accuracy, low false positive rate and low false negative rate, and is therefore applicable to detecting and mitigating slow DoS attacks in SDNs.

Description

TECHNICAL FIELD

[0001] The present application belongs to the field of computer network security, and particularly relates to a slow DoS attack detection and mitigation method based on similarity degree. BACKGROUND

[0002] Software Defined Network (SDN) is an architecture that mainly uses software applications to achieve centralized control of the network. In SDN, engineers do not have to contact various switches in the network, but adjust the traffic from a central console. No matter what the specific connection between servers and devices is, the centralized SDN controller will guide the switch to provide network services wherever needed. Although SDN has many advantages that traditional networks cannot match, such as saving a lot of operating costs, enhancing flexibility and agility, and improving network performance, it still has problems such as scalability, reliability and security that traditional networks have.

[0003] Slow Denial of Service (DoS) attack is a periodic and stealthy attack. This attack takes advantage of the vulnerability of TCP congestion control mechanism and uses only a small amount of attack data to launch periodic attacks on the network. Its average attack rate is usually much lower than the network bandwidth. Therefore, slow DoS attack has strong concealment, making its detection and mitigation a challenge, and SDN is also a victim of slow DoS attack. Due to the centralized control of SDN, once slow DoS attack gradually causes the controller to overload and crash, the entire network will be affected. Therefore, it is of great significance and challenge to detect and mitigate slow DoS attack in SDN.

[0004] The present application proposes a slow DoS attack detection and mitigation method based on similarity degree in view of the security risks of slow DoS attack faced by SDN. This method monitors network traffic fluctuations in real time by calculating the average fluctuation length AFL of the aggregated traffic sequence in each window, and uses a dynamic threshold to measure network anomalies. Once the threshold is exceeded, six features of network traffic are collected to detect two types (TCP-based and UDP-based) of slow DoS attacks. Once the attack is detected, the similarity between the traffic sequence of each IP and the aggregated traffic is measured, the L1 norm, L2 norm and L∞ norm are calculated, a blacklist is created, and the suspicious degree is scored. When the suspicious degree exceeds the preset threshold, all packets from the attack source will be discarded to achieve the mitigation effect. Experiments show that this method can be practically deployed in the SDN controller and has good performance in detecting and mitigating slow DoS attacks, with high detection accuracy and fast overall response time. Therefore, this method can be universally applied to detect and mitigate slow DoS attacks in SDN. SUMMARY

[0005] Aiming at the slow DoS attack security risks faced in SDN, a slow DoS attack detection and mitigation method based on similarity degree is proposed. The method can be actually deployed on the controller, has high detection accuracy, low false positive rate and false negative rate, and can effectively mitigate slow DoS attacks. Therefore, the detection method can be universally applied to detect and mitigate slow DoS attacks in SDN.

[0006] The technical scheme adopted by the present application to achieve the above-mentioned target is that a slow DoS attack detection and mitigation method based on similarity degree mainly includes three steps: network state monitoring, attack detection and judgment, and attack mitigation implementation.

[0007] 1. Network state monitoring. The controller of the software defined network is used for data collection, the network aggregated traffic is collected in real time, the average fluctuation length AFL of the aggregated traffic in each window is monitored, and the dynamic threshold TH is used to judge whether the network is abnormal, and the calculation methods of AFL and TH are as follows:

[0008]

[0009] TH i =β1*TH i-4 +β2*TH i-3 +β3*TH i-2 +β4*TH i-1 +β5*AFL i

[0010] Wherein, T is the aggregated traffic sequence, n is the sequence size, β1-β5 are weight factors, which gradually increase and add up to 1, TH i-4 -TH i-1 is the threshold value in the past four windows, and AFL i is the AFL in the current window.

[0011] 2. Attack detection and judgment. Real-time collection of traffic sequence data, including aggregated traffic data, TCP traffic data and UDP traffic data; Real-time statistics of six features of the traffic sequence in each window, including peak group similarity coefficient of aggregated traffic, average flow rate, average fluctuation length, inner Rome index and average packet size of TCP traffic, and Renyi entropy of packet number of UDP traffic; Finally, the features are input into the trained machine learning classifier, and the detection result is output; Wherein, the calculation of the peak group similarity coefficient needs to count the number of peaks in each window, calculate the peak height, peak similarity and peak area of each peak, calculate the peak height similarity coefficient PHSC, peak symmetry similarity coefficient PSSC and peak area similarity coefficient PASC of each window, and finally calculate PSC; The calculation methods of PHSC, PSSC, PASC and PSC are as follows:

[0012]

[0013]

[0014]

[0015] PSC = a * PHSC + b * PSSC + (1-a-b) * PASC

[0016] where, ph i , ps i , pa i are the peak height, peak symmetry and peak area of the i-th peak in a window, respectively, are the average of the peak height, peak symmetry and peak area of all peaks in a window, respectively, n is the number of peaks, and m is the calculation step, which is 2; a and b are balance factors, which fully consider the influence of the peak height, peak symmetry and peak area on the peak similarity.

[0017] 3. Attack mitigation implementation. The traffic sequence of each IP and the aggregated traffic sequence are collected in real time, the L1 norm, L2 norm and L∞ norm of each traffic sequence and the aggregated traffic sequence are calculated to measure the similarity between the single traffic sequence and the aggregated traffic sequence, then the suspicious degree of the IP is scored, if two of the three norms are the smallest, the IP is given 0.5 points, if all the three norms are the smallest, the IP is given 1 point, and the IP and its suspicious score are added to the blacklist, if the IP already exists in the blacklist, the suspicious score is accumulated; when the suspicious score of an IP is greater than a predefined threshold, the IP is identified as an attack source, the controller issues a flow rule to block the attack source, and the IP is removed from the blacklist.

[0018] Beneficial effects

[0019] The slow DoS attack in the SDN can fully compatible with the SDN environment and the OpenFlow protocol, and can be actually deployed on the SDN controller, and has high detection accuracy, low false positive rate and low false negative rate, and can effectively alleviate the slow DoS attack. Therefore, the method can be universally applied to detect and alleviate the slow DoS attack in the SDN. BRIEF DESCRIPTION OF DRAWINGS

[0020] Figure 1The figure is a slow DoS attack diagram. The attack model contains three parameters: attack period (AT), attack length (AL) and attack rate (AR). AT is the interval of each burst pulse. There is usually only one burst pulse in each period, and the attack remains silent at other times. AL is the duration of each burst pulse. The attack length should not be too long, otherwise its concealment will be seriously lost. The attack length should not be too short, otherwise it will be difficult to trigger the TCP congestion control mechanism, resulting in attack failure. AR is the rate of each burst pulse sent. AL*AR represents the strength of the attack, the greater the attack strength, the more significant the attack effect, but the concealment will also be lost.

[0021] Figure 2 The figure is a peak group diagram. Among them, sequences BAC, GHF, FIJ and JMK can be regarded as four peaks. Taking sequence BAC as an example, the peak height is the vertical height PH from point A to point B in the figure, the peak symmetry is calculated by DE / EC, and the peak area is the area of triangle ABC.

[0022] Figure 3 The figure is a comparison diagram of six characteristics of normal network and slow DoS attack network, including peak group similarity coefficient of aggregated traffic, average flow rate, average fluctuation length, TCP traffic innerome index and average packet size, and Renyi entropy of UDP traffic packet number. As shown in the figure, the normal network can be distinguished from the two types of slow DoS attacks by the six characteristic values.

[0023] Figure 4 The figure is a flowchart of a slow DoS attack detection and mitigation method based on similarity degree. DETAILED DESCRIPTION

[0024] The application will be further described below in combination with the drawings.

[0025] As shown in the figure, the slow DoS attack detection and mitigation method mainly includes three steps: network state monitoring, attack detection and judgment, and attack mitigation implementation. Figure 4

[0026] 1. Network state monitoring. This method is based on SDN controller Ryu and network simulator Mininet, and uses the controller of software defined network to collect data and collect network aggregated traffic in real time.

[0027] Because the configurations of different network environments are different, we use the Min-Max Scaling method to map the original sequence data to [0, 1] before calculating AFL, so as to realize the equal proportion scaling of original data and eliminate the negative influence of difference on the accuracy of reflecting sequence fluctuation trend of characteristics, and the calculation method is as follows:

[0028] ​

[0029] where T is the normalized sequence data, and T is the original traffic sequence. MMS

[0030] A sliding window is used to establish the detection window, which contains the aggregated traffic data of the last 10 sampling intervals by sliding back 1 sampling interval each time. The average fluctuation length AFL of the aggregated traffic in each window is calculated as follows:

[0031]

[0032] where T is the aggregated traffic sequence, and n is the sequence size.

[0033] After calculating the average fluctuation length, the dynamic threshold is calculated, that is:

[0034] TH i = β1*TH i-4 + β2*TH i-3 + β3*TH i-2 + β4*TH i-1 + β5*AFL i

[0035] where β1-β5 are weight factors, gradually increasing, and the sum is equal to 1, TH i-4 - TH i-1 is the threshold in the past four windows, and AFL i is the AFL in the current window.

[0036] If the AFL value of the current window exceeds the dynamic threshold at this time, the attack detection judgment step is performed.

[0037] 2. Attack detection judgment. The attack detection judgment includes the following three steps:

[0038] A. Real-time collection of traffic sequence data, including aggregated traffic data, TCP traffic data and UDP traffic data;

[0039] B. Real-time statistics of six features of traffic sequence in each window, including peak cluster similarity coefficient of aggregated traffic, average flow rate, average fluctuation length, inner Rome index and average packet size of TCP traffic, and Renyi entropy of packet number of UDP traffic, Figure 3 shows the comparison of the six features between normal network and slow DoS attack network, as follows:

[0040] Peak cluster similarity coefficient (PSC): represents the similarity of all peaks in each window. Its calculation method specifically includes the following four steps:

[0041] ​a. Calculate the number of peaks in a window. As shown in Fig. 1, a peak is a flow sequence in three consecutive sampling points, showing a peak shape. Take sequence BAC as an example, A is the peak tip, B and C are the peak bottom, and the heights of A, B and C are denoted as HA, HB and HC, respectively. If HA> HB, HA> HC, and HA-min(HB, HC)> BD*10% (bandwidth is the bandwidth), the sequence is a peak. Figure 2

[0042] b. Calculate the peak height, peak symmetry and peak area of each peak. The peak height is the vertical distance from the peak tip to the smaller peak bottom, the peak symmetry is the symmetry of sequence BA and BC about point B, and the peak area is the area of triangle ABC.

[0043] c. Calculate the peak height similarity coefficient PHSC, the peak symmetry similarity coefficient PSSC and the peak area similarity coefficient PASC of all peaks in a window, which are calculated as follows:

[0044]

[0045]

[0046]

[0047] wherein, ph i , ps i , pa i are the peak height, the peak symmetry and the peak area of the ith peak in a window, respectively, are the average values of the peak height, the peak symmetry and the peak area of all peaks in a window, respectively, n is the number of peaks, and m is the calculation step length, which is 2.

[0048] d. Calculate the peak cluster similarity coefficient PSC in a window, which is calculated as follows:

[0049] PSC = a*PHSC + b*PSSC + (1-a-b)*PASC

[0050] wherein, a and b are balance factors, which sufficiently consider the influence of the peak height, the peak symmetry and the peak area on the peak similarity.

[0051] Average flow rate (ATS): the average value of the aggregated flow rate. Slow DoS attacks will cause severe fluctuations in the aggregated flow. Therefore, the average value of the aggregated flow rate under attack will be lower than that under normal state.

[0052] Average fluctuation length (AFL): the average fluctuation length of the aggregated flow. It has been discussed in step 1 and will not be repeated here.

[0053] ​The Nerume Index (NI): An index that considers the average and maximum TCP traffic. Under a slow UDP-based DoS attack, TCP traffic gradually decreases to a very low level, while under a slow TCP-based DoS attack, TCP traffic fluctuates dramatically. Therefore, the distribution of TCP traffic under attack differs from that under normal conditions. Thus, we can use the NI of TCP traffic to distinguish between attack and normal states. Its calculation is as follows:

[0054]

[0055] in, The average TCP traffic, max(T) TCP () represents the maximum TCP traffic.

[0056] Average Packet Size (APS): The average packet size of TCP traffic. Under both types of slow DoS attacks, the average speed and number of packets in TCP traffic decrease. Therefore, the APS of TCP traffic is also a valuable characteristic. It is calculated as follows:

[0057]

[0058] Renyi entropy (RE): The degree of orderliness of UDP packets. Attacks can cause sequences to become disordered, therefore Renyi entropy is used as a feature. It is calculated as follows:

[0059]

[0060] Where α is set to 2, and P is the sequence of UDP packet counts.

[0061] C. Input the above six features into the trained machine learning classifier, output the detection result, and if the detection is an attack, then proceed with the attack mitigation implementation steps.

[0062] 3. Attack mitigation implementation. Attack mitigation implementation includes the following three steps:

[0063] A. Real-time collection of traffic sequences and aggregated traffic sequences for each IP address; calculation of the L1 norm, L2 norm, and L∞ norm of each traffic sequence and the aggregated traffic sequence to measure the similarity between individual traffic sequences and the aggregated traffic sequences. The calculation method is as follows:

[0064]

[0065] Here, setting N and n to 1, 2, and ∞ yields the L1 norm, L2 norm, and L∞ norm, respectively, where m is the sequence length and k represents the k-th data point in the sequence.

[0066] B. Score the suspicious degree of each IP, if two of the three norms are the smallest, then add 0.5 points to the IP, if all the three norms are the smallest, then add 1 point to the IP, and add the IP and its suspicious score to the blacklist, if the IP already exists in the blacklist, then accumulate the suspicious score.

[0067] When the suspicious score of an IP is greater than a predefined threshold, then the IP is identified as an attack source, the controller issues a flow rule to block the attack source, and removes the IP from the blacklist.

Claims

1. A method for detecting and mitigating slow DoS attacks based on similarity, the method comprising the following steps: Step 1, Network Status Monitoring: Data is collected using the controller of the software-defined network. Aggregated network traffic is collected in real time, the average fluctuation length (AFL) of aggregated traffic within each window is monitored and normalized, and then the dynamic threshold (TH) is used to determine whether the network is abnormal. Step 2, Attack Detection and Judgment: Attack detection and judgment includes the following three steps: Step 2.1: Collect traffic sequence data in real time, including aggregated traffic data, TCP traffic data, and UDP traffic data; Step 2.2: Real-time statistics of six characteristics of the traffic sequence within each window, including the peak similarity coefficient, average flow rate and average fluctuation length of aggregated traffic, the Neromé index and average packet size of TCP traffic, and the Renyi entropy of the number of packets of UDP traffic. Step 2.3: Input the features into the trained machine learning classifier and output the detection results; Step 3, Attack Mitigation Implementation: Attack mitigation implementation includes the following three steps: Step 3.1: Collect the traffic sequence and aggregated traffic sequence of each IP in real time, calculate the L1 norm, L2 norm and L∞ norm of each traffic sequence and the aggregated traffic sequence, and measure the similarity between the single traffic sequence and the aggregated traffic sequence. Step 3.2: Score the suspiciousness of each IP. If two of the three norms are the smallest, add 0.5 points to the IP. If all three norms are the smallest, add 1 point to the IP. Add the IP and its suspiciousness score to the blacklist. If the IP is already in the blacklist, accumulate the suspiciousness score. Step 3.3: When the suspicious score of an IP is greater than the predefined threshold, the IP is identified as an attack source. The controller issues flow rules to block the attack source and removes the IP from the blacklist.

2. The slow DoS attack detection and mitigation method as claimed in claim 1, wherein, The window in step 1 is a sliding window. The sliding window slides backward by one sampling interval at a time to include aggregated traffic data from the most recent 10 sampling intervals. To adapt to various network configurations, the traffic sequence is normalized using the max-min normalization method before calculating the average fluctuation length. The calculation methods for max-min normalization, average fluctuation length (AFL), and dynamic threshold (TH) are as follows: TH i = β1*TH i-4 + β2*TH i-3 + β3*TH i-2 + β4*TH i-1 + β5*AFL i Among them, T MMS The sequence is normalized, T is the aggregated flow sequence, n is the sequence size, β1-β5 are weighting factors that gradually increase and add up to 1, TH i-4 -TH i-1 The threshold for the past four windows, AFL i This refers to the AFL within the current window.

3. The slow DoS attack detection and mitigation method as claimed in claim 1, wherein, The calculation of the peak group similarity coefficient PSC in step 2.2 includes four steps: Step a: Calculate the number of peaks within a window. A peak is a flow sequence within three consecutive sampling points A, B, and C, which is peak-shaped. A is the peak tip, and B and C are the peak bases. The heights of the three points A, B, and C are called HA, HB, and HC, respectively. If HA > HB, HA > HC, and HA - min(HB, HC) > BD * 10%, where BD is the bandwidth, then the sequence is called a peak. Step b: Calculate the peak height, peak symmetry, and peak area of ​​each peak; the peak height is the vertical distance from the peak tip to the smaller peak base, the peak symmetry is the symmetry between sequence BA and BC about point B, and the peak area is the area of ​​triangle ABC. Step c: Calculate the peak height similarity coefficient (PHSC), peak symmetry similarity coefficient (PSSC), and peak area similarity coefficient (PASC) for all peaks within a window. The calculation method is as follows: where ph, ps, pa are the peak height, peak symmetry and peak area of the i-th peak in a window, respectively, i i i where ph, ps, pa are the peak height, peak symmetry and peak area of the i-th peak in a window, respectively, where ph, ps, pa are the peak height, peak symmetry and peak area of the i-th peak in a window, respectively, n is the number of peaks, and m is the calculation step, which is 2.​​ Step d: Calculate the peak group similarity coefficient (PSC) within a window. The calculation method is as follows: PSC=α*PHSC+β*PSSC+(1-α-β)*PASC Among them, α and β are balance factors that fully consider the influence of peak height, peak symmetry and peak area on peak similarity.

4. The slow DoS attack detection and mitigation method as claimed in claim 1, wherein, In step 3.1, the L1 norm, L2 norm, and L∞ norm are calculated as follows: Here, N and n are set to 1, 2, and ∞, respectively, to obtain the L1 norm, L2 norm, and L∞ norm. m is the sequence length, and k represents the k-th data in the sequence.

Images