SDN-oriented doS attack shunting and filtering method and system

Abstract

This invention discloses a DoS attack offloading and filtering method and system for SDN, comprising at least a normalized monitoring module, a traffic offloading module, and a traffic scrubbing module. The low-overhead normalized DoS attack monitoring module monitors whether the controller is under a DoS attack. The traffic offloading module reduces the link pressure between the controller and the victim switch. The traffic scrubbing module includes a two-stage scrubbing and filtering process, incorporating multi-threshold triggered multi-priority queues to filter Packet-In traffic destined for the controller, reducing the controller's processing overhead and minimizing the issuance of invalid flow tables. This invention operates with low overhead under normal conditions and effectively offloads and scrubs traffic after an attack, achieving the goals of reducing controller pressure and preventing the switch from being filled with invalid flow tables.

Description

Technical Field

[0001] This invention belongs to the field of communication technology and mainly relates to a DoS attack diversion and filtering method and system for SDN. Background Technology

[0002] Software-defined networking (SDN) is a novel network architecture based on a layered approach, dividing the network into a control plane and a data plane. A centralized controller acts as the control center, distributing flow tables to surrounding switches. However, SDN controllers also face numerous security threats, such as DoS attacks from the data plane. Once the controller's computing and service resources are exhausted by attack traffic, the network's overall performance will be significantly degraded, making it unable to promptly handle normal traffic service requests.

[0003] Currently, DoS attacks targeting controllers primarily involve attackers forging some or all fields of data packets, making them unable to match any flow table rules in the switch. These table misses then cause the switch to send a large number of Packet-In packets to the controller, which consume the communication bandwidth between the control plane and the data plane, as well as the controller's computing and storage resources.

[0004] Therefore, how to effectively monitor network operation status with low overhead and alleviate channel and controller pressure after a DoS attack is a technical problem that urgently needs to be solved by those skilled in the art in response to DoS attacks on SDN. Summary of the Invention

[0005] This invention addresses the problem of excessive controller resource overhead in existing SDN technologies when subjected to DoS attacks. It provides a DoS attack offloading and filtering method and system for SDN, comprising at least a normalized monitoring module, a traffic offloading module, and a traffic scrubbing module. The low-overhead normalized DoS attack monitoring module monitors whether the controller is under a DoS attack. The traffic offloading module reduces the link pressure between the controller and the victim switch. The traffic scrubbing module includes a two-stage scrubbing and filtering process, incorporating multi-threshold triggered multi-priority queues to filter Packet-In traffic destined for the controller, reducing the controller's processing overhead and minimizing the issuance of invalid flow tables. This invention operates with low overhead under normal conditions and effectively offloads and scrubs traffic after an attack, achieving the goals of reducing controller pressure and preventing switches from being filled with invalid flow tables.

[0006] To achieve the above objectives, the technical solution adopted by this invention is: a DoS attack diversion and filtering system for SDN, comprising at least a routine monitoring module, a traffic diversion module, and a traffic scrubbing module.

[0007] The routine monitoring module: based on the message frequency information, using the number of low-frequency stream entries and the average hit frequency of low-frequency streams as the criteria, monitors whether the monitor is under a DoS attack and switches the system state accordingly.

[0008] The traffic splitting module guides the controller to install different rules for victim switches and non-victim switches. Specifically, the controller installs traffic splitting rules for victim switches and replaces upload rules for non-victim switches, thereby reducing the link pressure between the controller and the victim switches.

[0009] The flow cleaning module includes a two-stage cleaning and filtration process.

[0010] The first-stage cleaning and filtering process includes a multi-priority queue triggered by multiple thresholds. The queue is used to store Packet-In messages to be processed. When the Packet-In frequency reaches a specified threshold, it will be added to the corresponding priority queue. A higher frequency threshold will trigger a priority queue to be added, and the controller will serve it more frequently. When the controller detects that the message has been served, it will skip and discard it directly.

[0011] In the second phase of cleaning and filtering, after the controller retrieves packets from the multi-priority queue for service, it issues normal flow table forwarding rules and flow table rules for monitoring outgoing flows. After the set hard timeout period, the flow table expires, and the switch automatically sends a flow deletion message to the controller. The controller collects the total number of packets and total number of bytes of outgoing flows and uses the SVM classification model to determine whether the traffic is benign. If it is classified as normal traffic, the original flow table rules remain unchanged; if it is classified as DoS attack traffic, the previously issued flow table rules are deleted.

[0012] As an improvement of the present invention, in the normalized monitoring module, all streams with a hit frequency less than a given threshold δ are low-frequency streams, and the average hit frequency of the low-frequency streams is specifically:

[0013]

[0014] Among them, Set low ={flow1,…,flow n} represents the set of low-frequency streams, num low For the number of entries in the low-frequency stream, cnt i For low frequency flow i The number of hits;

[0015] Before performing threshold trigger determination, nwm needs to be checked. low If the number of low-frequency flow trigger entries is less than ε, proceed to the next step; if it is greater than ε, continue with the Set check. flow Whether the threshold is triggered;

[0016] When num low Greater than the minimum number of low-frequency flow trigger entries ε and avgFreq low When the value is less than the first-level threshold θ1, the switch is considered to be under a DoS attack, and the system state is switched to the active state.

[0017] When num low Greater than the minimum number of low-frequency flow trigger entries ε and avgFreq low If the CPU utilization rate of the controller exceeds 80%, and the CPU utilization rate is less than the secondary threshold θ2, it is considered to be under a serious DoS attack, and the system state is switched to a locked state.

[0018] As another improvement of the present invention, the traffic splitting module has the following specific splitting rules: a select group table is used to set a weight for each action bucket. After a flow hits, one action bucket is randomly selected according to the weight to perform the action. The action is to push two layers of MPLS labels onto all packets that do not hit the table. The inner label represents the victim switch number that is being forwarded, and the outer label is the MPLS label of the corresponding path.

[0019] As another improvement of the present invention, in the traffic splitting module, the replacement upload rule is as follows: the match field in the flow table entry matches the BOS bit in the packet header. If the packet header has multiple layers of MPLS labels, the BOS bit is 1, otherwise it is 0. According to the set probability, a certain field value is randomly matched. If a match is found, the Packet-In packet will be uploaded in place of the victim switch.

[0020] As another improvement of the present invention, the first-level threshold θ1 is 3 and the second-level threshold θ2 is 2.2.

[0021] To achieve the above objectives, the present invention also adopts the following technical solution: a DoS attack diversion and filtering method for SDN, characterized by comprising the following steps:

[0022] S1: Every n seconds, record the switch flow table information and the received Packet-In information on the controller, and create entries.

[0023] S2: The number of low-frequency stream entries in this table, num. low With low-frequency average hit frequency avgFreq low As a basis for judgment, if num low Greater than the minimum number of low-frequency flow trigger entries ε and avgFreq low If the value is less than the first-level threshold θ1, the switch is considered to be under a DoS attack, and the system switches from the alert state to the active state, continuing to step S3; if num lowGreater than the minimum number of low-frequency flow trigger entries ε and avgFreq low If the CPU utilization rate of the controller exceeds 80%, and the CPU utilization rate is less than the secondary threshold θ2, it is considered to be under a severe DoS attack, and the system switches to a locked state.

[0024] S3: After detecting a DoS attack, the controller installs traffic splitting rules for the victim switch. The traffic splitting rules use a select group table to set a weight for each action bucket. When a flow hits, one action bucket is randomly selected to execute the action based on the weight. The controller installs alternative upload rules for non-victim switches. The match field in the flow table matches the BOS bit in the packet header. If the packet header has multiple layers of MPLS labels, the BOS bit is 1; otherwise, it is 0. According to the set probability, a certain field value is randomly matched. If a match is found, Packet-In packets will be uploaded in place of the victim switch.

[0025] S4: The controller receives a table miss message from the victim switch and performs a two-stage filtering process, specifically:

[0026] S41: Establish a multi-priority queue triggered by multiple thresholds. The queue is used to store Packet-In messages to be processed. When the Packet-In frequency reaches a specified threshold, it will be added to the corresponding priority queue. A higher frequency threshold will trigger the addition of a priority queue, and the controller will serve it at a higher frequency. When the controller detects that the message has been served, it will skip and discard it directly.

[0027] S42: After the controller retrieves a packet from the multi-priority queue for service, it issues normal flow table forwarding rules and flow table rules for monitoring outgoing flows. After the set hard timeout period, the flow table expires, and the switch automatically sends a flow deletion message to the controller. The controller collects the total number of packets and total number of bytes of the outgoing flow and uses the SVM classification model to determine whether it is benign traffic. If it is classified as normal traffic, the original flow table rules remain unchanged; if it is classified as DoS attack traffic, the previously issued flow table rules are deleted.

[0028] As another improvement of the present invention, in step S2, after the system switches to the blocked state, flow table rules will be issued to discard all table miss packets from a certain port.

[0029] As another improvement of the present invention, in step S42, the criteria for the SVM classification model to determine whether the traffic is benign are: the number of forward flow packets, the number of forward flow bytes, the number of reverse flow packets, and the number of reverse flow bytes.

[0030] Compared with existing technologies, this invention offers the following advantages: By designing a complete system operating state automaton, it monitors DoS attacks with relatively low overhead under normal conditions. Combined with a fault recovery mechanism designed using a patented biomimetic SDN data plane self-healing method, it assists in the diversion of DoS attack traffic. Furthermore, this diversion rule is difficult for attackers to exploit, rendering the diversion ineffective. Finally, a two-stage traffic scrubbing process is designed. First, packet frequency is used for initial screening, and a lazy-delete multi-priority queue is used for service. Packets in high-priority queues are more likely to be benign traffic and are given priority service, reducing the controller's computational resources consumed by attack traffic. The second stage of traffic scrubbing uses SVM for high-precision classification, reducing invalid flow tables in the switches. This technology reduces the impact of DoS attacks on SDN from three aspects: preventing link congestion between the switch and controller, preventing the controller's computational resources from being exhausted by attack traffic, and preventing the switch from being filled with invalid flow tables. This ensures that the controller can promptly serve normal traffic, giving SDN good resistance to DoS attacks and enhancing system stability. Attached Figure Description

[0031] Figure 1 This is a schematic diagram of the DoS attack diversion and filtering system for SDN according to the present invention;

[0032] Figure 2 This is a schematic diagram of the SDN attack traffic diversion strategy in step S3 of the SDN-oriented DoS attack diversion and filtering method of the present invention.

[0033] Figure 3 This is a schematic diagram of the two-stage filtering of SDN traffic in step S4 of the SDN-oriented DoS attack diversion and filtering method of the present invention. Detailed Implementation

[0034] The present invention will be further illustrated below with reference to the accompanying drawings and specific embodiments. It should be understood that the following specific embodiments are for illustrative purposes only and are not intended to limit the scope of the invention.

[0035] Example 1

[0036] DoS attack routing and filtering systems for SDN, such as Figure 1 As shown, it includes at least a routine monitoring module, a traffic diversion module, and a traffic cleaning module. In the routine monitoring module, the switch flow table information is obtained every n seconds, and the Packet-In message information during this period is recorded.

[0037] For each switch, maintain an entry that records the flow hit frequency (i.e., the number of packets with the same destination IP) of the switch in the past n seconds. Packet-In packets generated from packets that did not hit the table are also recorded in this entry according to the same rule.

[0038] This module will determine the number of low-frequency current entries (num) in the table. low With low-frequency average hit frequency avgFreq low As a criterion, all hit frequencies less than a given threshold δ are considered low-frequency flows.

[0039]

[0040] Among them, Set low ={flow1,…,flow n} represents a collection of low-frequency streams, cnt i Indicates low-frequency flow i The number of hits.

[0041] When avgFreq low The smaller the value, the more invalid flow table entries there are in the switch. Furthermore, to avoid triggering a state transition determination due to only a few low-frequency flow tables on the switch, it is necessary to check `num` before performing threshold trigger determination. low Is the number of low-frequency flow trigger entries greater than the minimum number ε, which can be set to 20? If it is less than ε, do not proceed to the next step of the judgment; if it is greater than ε, continue the judgment. flow Whether the threshold is triggered;

[0042] If num low Greater than ε and avgFreq low If the value is less than the first-level threshold θ1, the switch will be considered to be under a DoS attack, and the system state will be switched to the active state. If num low Greater than ε and avgFreq low If the CPU utilization of the controller exceeds 80% and the value is less than the secondary threshold θ2, a severe DoS attack is considered to have occurred. The system state is then switched to a blocked state, and flow table rules are issued to discard all packets from a specific port that do not match the table. This module will switch the system's operating state based on monitoring data. θ1 is set to 3; θ2 is set to 2.2.

[0043] In the traffic splitting module, the controller installs splitting rules for the victim switch using a select group table. Weights can be set for each action bucket. After a flow hits, an action bucket is randomly selected based on the weight to execute an action. This action involves pushing two layers of MPLS labels onto all packets that did not hit the table. The inner label represents the victim switch number being forwarded, and the outer MPLS label is the path-bound label described in patent 202211722148.7, "SDN Data Plane Self-Healing Method Based on Bionic Mechanism," to assist in packet splitting and forwarding.

[0044] Install an alternative upload rule for the non-victim switch. The match field in the flow table entry matches the BOS bit in the packet header. If the packet header has multiple layers of MPLS labels, the BOS bit is 1, otherwise it is 0. According to the set probability, a certain field value is randomly matched. If a match is found, the Packet-In packet will be uploaded in place of the victim switch.

[0045] The two rules mentioned above switch according to the state of the switch under a DoS attack. When the switch is under a DoS attack, the alternative upload rule will be deleted, meaning it will not help other victim switches to upload Packet-In packets.

[0046] The flow cleaning module has a two-stage filtering process, and the first-stage filtering process is as follows:

[0047] After a DoS attack occurs, traffic that is not found in the victim switch's table is diverted. When the controller receives a Packet-In packet, it needs to obtain the victim switch number to which the packet belongs by parsing the MPLS tag in the packet header. Referring to the principle of electrical signal transmission through neuronal synapses, this patent designs a multi-priority queue with lazy deletion characteristics to store Packet-In packets to be processed. It adopts a multi-level triggering mechanism. When the Packet-In frequency reaches a specified threshold, it will be added to the corresponding priority queue, triggering a higher frequency threshold to add to the priority queue. The higher the frequency of the controller's service for it, the higher the priority queue.

[0048] When the controller serves a Packet-In message, it maintains a hash table to store Packet-In messages that have already been served. When serving messages for other priority queues, if the controller detects that the message has already been served, it can skip and discard it directly, thus implementing the lazy deletion feature.

[0049] The two-stage filtering process is as follows: After the controller retrieves packets from the multi-priority queue for service, it issues normal flow table forwarding rules and flow table rules for monitoring outgoing flows. Outgoing flows refer to flows from the destination host to the source address host. A hard timeout of n seconds is set for the flow table rules for monitoring outgoing flows. After n seconds, the flow table expires, and the switch automatically sends a flow deletion message to the controller. The controller can then collect the total number of packets and bytes of outgoing flows. Finally, the pre-trained SVM classification model determines whether the traffic is benign based on four features (number of forward flow packets, number of forward flow bytes, number of outgoing flow packets, and number of outgoing flow bytes). If the traffic is classified as normal, the original flow table rules remain unchanged. If the traffic is classified as DoS attack traffic, the previously issued flow table rules are deleted.

[0050] In this system, the system operation status is switched through the normal monitoring module. The traffic diversion module and the traffic cleaning module only start to operate after the controller is detected to be under attack. By designing a complete workflow state transition model to deal with DoS attacks, DoS attacks can be detected and filtered with low overhead.

[0051] Example 2

[0052] A method for DoS attack offloading and filtering oriented towards SDN, the method includes the following:

[0053] S1. Every n seconds, record the switch flow table information and the received Packet-In information on the controller.

[0054] S2. Switch the system state according to the message frequency information, based on the number of low-frequency stream entries (num) in this table. low With low-frequency average hit frequency avgFreq low As a basis for judgment, if num low Greater than ε and avgFreq low If the value is less than the first-level threshold θ1, the switch is considered to be under a DoS attack, and the system switches from a vigilant state to an active state. If num low Greater than ε and avgFreq low If the CPU utilization rate of the controller exceeds 80% and the value is less than the secondary threshold θ2, it is considered to be under a serious DoS attack. The controller will switch to a blocked state and issue flow table rules to discard all packets that do not match the table from a certain port.

[0055] S3. After detecting a DoS attack, the controller installs traffic splitting rules for the victim switch. The traffic splitting rules use a select group table, which can set weights for each action bucket. It installs alternative upload rules for non-victim switches. The match field in the flow table entry matches the BOS bit in the packet header. If the packet header has multiple layers of MPLS labels, the BOS bit is 1; otherwise, it is 0. According to the set probability, it randomly matches a certain field value, such as the last bit of the MAC address. If a match is found, it will upload Packet-In packets in place of the victim switch.

[0056] The two rules mentioned above switch according to the state of the switch under a DoS attack. When the switch is under a DoS attack, the alternative upload rule will be deleted, meaning it will not help other victim switches to upload Packet-In packets.

[0057] like Figure 2 As shown, assuming the attacker sends attack traffic A, B, and C, switch s1 matches and hits the select group table, and then randomly executes one of the action buckets. First, it pushes an MPLS label of 1, indicating that the traffic originated from switch s1. Then, it pushes the corresponding MPLS label for the path, allowing other switches to forward the traffic normally according to the label. The traffic is then forwarded to s2, where s2 randomly matches a field value. If the match is found, it will upload a Packet-In packet instead of the victim switch; otherwise, it continues to forward the traffic according to the surface MPLS label, and then forwards it to switches s3 and s4. The switch at the end of the path will definitely upload the packet instead.

[0058] S4. A table miss message received by the controller from the victim switch, such as... Figure 3 As shown, the flow cleaning module will perform two-stage filtering, which involves two-stage filtering steps.

[0059] S41. The specific process of one stage of the filtering procedure is as follows:

[0060] After a DoS attack occurs, traffic that is not found in the victim switch's table is routed. When the controller receives a Packet-In message, it needs to obtain the victim switch number to which the message belongs by parsing the MPLS label in the message header. When the frequency of messages from a certain victim switch reaches the corresponding priority queue threshold, they are added to the corresponding priority queue. Ideally, the third priority queue will contain the majority of attack traffic, the second priority queue will contain mostly suspicious traffic, and the first priority queue will generally contain benign traffic.

[0061] It should be noted that the same message may trigger all three thresholds, meaning that the same message may exist in all three priority queues. To avoid serving the same message repeatedly, the basic information of the messages that have been served, namely the source and destination addresses, needs to be stored in a hash table. When serving other messages, it is checked whether they have already been served. If they have been served, the message is discarded directly, thus implementing the lazy deletion feature.

[0062] S42, The two-stage filtering process is as follows:

[0063] After the controller retrieves a packet from the multi-priority queue for service, it issues normal flow table forwarding rules to it, and at the same time issues flow table rules for monitoring outgoing flows. Outgoing flows refer to flows sent from the destination host to the source address host. The hard timeout for the flow table rules for monitoring outgoing flows is set to n seconds, such as 5 seconds.

[0064] After n seconds, the flow table expires, and the switch will automatically send a flow deletion message to the controller. The controller can then collect the total number of packets and the total number of bytes of the outgoing flow.

[0065] Finally, the pre-trained SVM classification model determines whether the traffic is benign based on four features (number of forward flow packets, number of forward flow bytes, number of outgoing flow packets, and number of outgoing flow bytes).

[0066] If the traffic is classified as a DoS attack, the previously issued flow table rules will be deleted.

[0067] In summary, the method of this invention solves the problem of excessive controller resource overhead when SDN is subjected to DoS attacks. The traffic diversion rules for DoS attacks reduce the link pressure between the controller and the victim switch. In the two-stage Packet-In packet cleaning step, a multi-threshold triggered multi-priority queue is designed to filter Packet-In traffic destined for the controller, reducing the controller's processing overhead and minimizing the issuance of invalid flow tables. Under normal conditions, this method can operate with low overhead. After an attack, it can effectively divert traffic and perform multi-stage cleaning, thereby reducing controller pressure and preventing the switch from being filled with invalid flow tables.

[0068] It should be noted that the above content merely illustrates the technical concept of the present invention and should not be construed as limiting the scope of protection of the present invention. For those skilled in the art, various improvements and modifications can be made without departing from the principle of the present invention, and all such improvements and modifications fall within the scope of protection of the claims of the present invention.

Claims

1. A SDN oriented DoS attack offloading and filtering system, characterized in that It should include at least a routine monitoring module, a traffic diversion module, and a traffic scrubbing module. The routine monitoring module: based on the message frequency information, using the number of low-frequency stream entries and the average hit frequency of low-frequency streams as the criteria, monitors whether the controller is under a DoS attack and switches the system state accordingly. The traffic splitting module guides the controller to install different rules for victim switches and non-victim switches. Specifically, the controller installs splitting rules for victim switches and alternative upload rules for non-victim switches, thereby reducing the link pressure between the controller and the victim switches. The flow cleaning module includes a two-stage cleaning and filtration process. The first stage of cleaning and filtering includes a multi-priority queue triggered by multiple thresholds. The queue is used to store Packet-In messages to be processed. When the Packet-In frequency reaches a specified threshold, it will be added to the corresponding priority queue. A higher frequency threshold will trigger a priority queue to be added, and the controller will serve it more frequently. When the controller detects that the message has been served, it will skip and discard it directly. In the second phase of cleaning and filtering, after the controller retrieves packets from the multi-priority queue for service, it issues normal flow table forwarding rules and flow table rules for monitoring outgoing flows. After the set hard timeout period, the flow table expires, and the switch automatically sends a flow deletion message to the controller. The controller collects the total number of packets and total number of bytes of outgoing flows and uses the SVM classification model to determine whether the traffic is benign. If it is classified as normal traffic, the original flow table rules remain unchanged; if it is classified as DoS attack traffic, the previously issued flow table rules are deleted.

2. The DoS attack diversion and filtering system for SDN as described in claim 1, characterized in that: The normalization monitoring module, the hit frequency is less than a given threshold are low frequency streams, and the average hit frequency of the low frequency streams is specifically ； in, It is a collection of low-frequency flows. low frequency flow The number of hits; Before performing threshold trigger determination, it is necessary to perform detection. Is it greater than the minimum number of low-frequency current trigger entries? If less than If it is greater than 1, then proceed to the next step of the judgment; if it is greater than 1, then proceed to the next step of the judgment. Then continue to determine Whether the threshold is triggered; when Greater than the minimum number of low-frequency flow trigger entries and Less than the first-level threshold It is believed that the controller has been subjected to a DoS attack, and the system state is switched to the active state; when Greater than and Less than the second-level threshold If the CPU utilization of the controller exceeds 80%, it is considered to be under a serious DoS attack, and the system state is switched to a locked state.

3. The DoS attack diversion and filtering system for SDN as described in claim 2, characterized in that: In the traffic splitting module, the splitting rules are as follows: a select group table is used to set a weight for each action bucket. After a flow hits, one action bucket is randomly selected according to the weight to execute the action. The action is to push two layers of MPLS labels onto all packets that do not hit the table. The inner label represents the victim switch number that is being forwarded, and the outer label is the MPLS label of the corresponding path.

4. The DoS attack diversion and filtering system for SDN as described in claim 2, characterized in that: In the traffic splitting module, the rule for replacing upload is as follows: the match field in the flow table entry matches the BOS bit in the packet header. If the packet header has multiple layers of MPLS labels, the BOS bit is 1; otherwise, it is 0. According to the set probability, a certain field value is randomly matched. If a match is found, the Packet-In packet will be uploaded in place of the victim switch.

5. The DoS attack diversion and filtering system for SDN as described in claim 2, characterized in that: The first-level threshold Secondary threshold 6. A DoS attack offloading and filtering method for SDN, characterized in that, Includes the following steps: S1: Every n seconds, record the switch flow table information and the received Packet-In information on the controller, and create entries. S2: The number of low-frequency stream entries in this table. Average hit frequency of low frequency stream As a basis for judgment, if Greater than and Less than the first-level threshold The system will assume the switch is under a DoS attack, switch from alert to active state, and continue to step S3; if... Greater than and Less than the second-level threshold If the CPU utilization of the controller exceeds 80%, it is considered to be under a serious DoS attack, and the system switches to a locked state. S3: After detecting a DoS attack, the controller installs traffic splitting rules for the victim switch. The traffic splitting rules use a select group table to set a weight for each action bucket. When a flow hits, one action bucket is randomly selected to execute the action based on the weight. The controller installs alternative upload rules for non-victim switches. The match field in the flow table matches the BOS bit in the packet header. If the packet header has multiple layers of MPLS labels, the BOS bit is 1; otherwise, it is 0. According to the set probability, a certain field value is randomly matched. If a match is found, Packet-In packets will be uploaded in place of the victim switch. S4: The controller receives a table miss message from the victim switch and performs a two-stage filtering process, specifically: S41: Establish a multi-priority queue triggered by multiple thresholds. The queue is used to store Packet-In messages to be processed. When the Packet-In frequency reaches a specified threshold, it will be added to the corresponding priority queue. A higher frequency threshold will trigger the addition of a priority queue, and the controller will serve it at a higher frequency. When the controller detects that the message has been served, it will skip and discard it directly. S42: After the controller retrieves a packet from the multi-priority queue for service, it issues normal flow table forwarding rules to it, and at the same time issues flow table rules for monitoring the outgoing flow. After the set hard timeout period, the flow table expires, and the switch will automatically send a flow deletion message to the controller. The controller collects the total number of packets and the total number of bytes of the outgoing flow, and uses the SVM classification model to determine whether it is benign traffic. If it is classified as normal traffic, the original flow table rules remain unchanged. If the traffic is classified as a DoS attack, the previously issued flow table rules will be deleted.

7. The DoS attack diversion and filtering method for SDN as described in claim 6, characterized in that: In step S2, after the system switches to the blocked state, flow table rules will be issued to discard all packets that have not been matched by the table.

8. The DoS attack diversion and filtering method for SDN as described in claim 6, characterized in that: In step S42, the criteria for the SVM classification model to determine whether traffic is benign are: the number of forward flow packets, the number of forward flow bytes, the number of reverse flow packets, and the number of reverse flow bytes.

Images