A hybrid DDoS attack mitigation method based on SDN data plane

Abstract

This invention discloses a hybrid DDoS attack mitigation method based on an SDN data plane. By building a programmable data plane, traffic data is collected and analyzed in real time at the data layer. By comparing characteristic thresholds and change thresholds set at the data plane, this method enables early identification and filtering of both normal-speed and slow-speed DDoS attacks. Simultaneously, based on real-time traffic characteristics and filtering results, classification algorithms and statistical methods are applied to dynamically update filtering thresholds to ensure accurate threshold identification. This invention significantly reduces communication overhead between the data and control planes, improves the real-time performance and accuracy of hybrid DDoS attack detection, and thus enhances the security and defense capabilities of the SDN network architecture.

Description

Technical Field

[0001] The present invention belongs to the field of network security technology, relates to the field of SDN network security defense technology, and specifically relates to a DDoS hybrid attack mitigation method based on the SDN data plane. Background Art

[0002] By unbundling the tightly coupled data and control layers of traditional networks, SDN has greatly enhanced network scalability and usability, fundamentally driving innovative network development. However, this architecture also faces more complex security challenges. The core of the SDN architecture lies in the SDN controller. A compromise of this core directly results in the inability of the data layer to forward data, paralyzing the network. One of the most vulnerable attacks to SDN is the distributed denial of service (DDoS) attack. This attack floods network resources with traffic, overwhelming switches with limited processing power and unable to handle normal traffic, rendering them unable to provide services. Regular-rate DDoS attack traffic is relatively easy to identify and filter due to its distinct characteristics and mature technology. However, low-rate DDoS attack traffic, due to its low traffic rate and less distinct characteristics, can easily be misidentified as normal traffic and released into the system. Existing defense frameworks generally only protect against regular-rate DDoS attacks and are ineffective against low-rate DDoS attacks or mixed attacks that combine both. Therefore, research on the identification and prevention of mixed DDoS attacks in SDN is highly beneficial for promoting the further development of SDN network technology. Summary of the Invention

[0003] The purpose of the present invention is to address the deficiencies of the existing technology and provide a DDoS hybrid attack mitigation method based on the SDN data plane.

[0004] The objective of the present invention is achieved through the following technical solution: a method for mitigating DDoS hybrid attacks based on an SDN data plane, the method comprising the following steps:

[0005] (1) Use the P4 language to customize the data plane and start the P4 switch. The specific steps are as follows:

[0006] (1.1) Compile and run the data plane to generate a data plane description file;

[0007] (1.2) Start the P4 switch and import the description file, including the packet processing mode, traffic characteristics to be collected, characteristic threshold, change threshold, and flow table matching action settings;

[0008] (2) Collect traffic information on the data plane, calculate the characteristic values ​​of each data packet, and process them into comprehensive characteristic values ​​et and change characteristic values ​​ec;

[0009] (3) Based on the collected traffic feature data, traffic filtering is performed by comparing the feature threshold and change threshold set on the data plane. The specific steps are as follows:

[0010] (3.1) Compare et with the characteristic threshold μ1 to identify the normal-speed DDoS attack on the traffic;

[0011] (3.2) Compare ec and the change threshold μ2 to identify low-rate DDoS attacks on traffic;

[0012] (3.3) Determine whether the corresponding characteristic value in step (3.1) or step (3.2) is higher than μ1 or μ2; if so, the traffic with the corresponding characteristic value is marked as attack traffic and directly dropped on the data plane without performing flow table lookup and forwarding operations; otherwise, normal traffic is forwarded based on the matching flow table entry;

[0013] (4) Update the data plane feature threshold and change threshold. The specific steps are as follows:

[0014] (4.1) On the control plane, based on the filtering results of real-time traffic, retrain the classifier and update μ1;

[0015] (4.2) On the control plane, μ2 is updated based on the entropy change of real-time traffic and the filtering results.

[0016] Furthermore, in the step (1.2), the characteristic information collected includes source IP growth rate, average number of flow packets, source port growth rate, flow table entry growth rate, congestion ratio, flow table matching success rate and destination port growth rate.

[0017] Furthermore, in step (2), the characteristic values ​​of the data packets are used to calculate the characteristic values ​​et or ec according to formula (1):

[0018]

[0019] Where E represents the eigenvalue et or ec to be calculated, e i represents the i-th characteristic value of the data packet, η i It represents the calculation weight corresponding to the eigenvalue.

[0020] Furthermore, in step (3), both the feature threshold μ1 and the change threshold μ2 are stored using a Bloom filter on the data plane.

[0021] Furthermore, in the step (4.1), the classification algorithms used by the classifier include decision tree, neural network, random forest, Boosting and its variants.

[0022] Compared with the existing technology, the beneficial effect of the present invention is that it collects and analyzes traffic data in real time on the data plane based on the custom data packet capability of the programmable data plane, and dynamically calculates characteristic thresholds based on classification algorithms and statistical methods. By comparing real-time traffic characteristic values ​​and characteristic thresholds, it can achieve rapid identification and early filtering of DDoS normal-speed and slow-speed attacks, which can greatly reduce the communication overhead between the data plane and the control plane, and improve the real-time and accuracy of DDoS hybrid attack detection, thereby improving the security defense capabilities of the SDN network architecture. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] Figure 1 It is a schematic diagram of the method of the present invention. DETAILED DESCRIPTION

[0024] The present invention will be described in detail below with reference to the accompanying drawings. Unless there is any conflict, the features of the following embodiments and implementations may be combined with each other.

[0025] This paper provides a hybrid DDoS attack mitigation method based on an SDN programmable data plane. By building a programmable data plane, traffic characteristics are acquired in real time at the data layer and compared with characteristic thresholds and change thresholds set in the data plane. This method enables early identification and filtering of both normal-speed and slow-speed DDoS attacks. Furthermore, based on real-time traffic characteristics and filtering results, classification algorithms and statistical methods are used to dynamically update filtering thresholds to ensure accurate threshold identification.

[0026] like Figure 1 As shown in the figure, a DDoS hybrid attack mitigation method based on the SDN data plane of the present invention specifically includes the following steps:

[0027] (1) Use the P4 language to customize the data plane and start the P4 switch. The specific steps are as follows:

[0028] (1.1) Compile and run the data plane to generate a data plane description file;

[0029] (1.2) Start the P4 switch and import the description file, including the packet processing method, traffic characteristics to be collected, characteristic thresholds, change thresholds, flow table matching actions, and other settings;

[0030] (2) Collect traffic information on the data plane, calculate the characteristic values ​​of each data packet, and process them into comprehensive characteristic values ​​et and change characteristic values ​​ec;

[0031] (3) Based on the collected traffic feature data, traffic filtering is performed by comparing the feature threshold and change threshold set on the data plane. The specific steps are as follows:

[0032] (3.1) Compare et with the characteristic threshold μ1 to identify the normal-speed DDoS attack on the traffic;

[0033] (3.2) Compare ec and the change threshold μ2 to identify low-rate DDoS attacks on traffic;

[0034] (3.3) Determine whether the corresponding characteristic value in step (3.1) or step (3.2) is higher than μ1 or μ2; if so, the traffic with the corresponding characteristic value is marked as attack traffic and directly discarded on the data plane without performing flow table lookup and forwarding operations; otherwise, normal traffic is forwarded based on the matching flow table entry.

[0035] (4) Update the data plane feature threshold and change threshold. The specific steps are as follows:

[0036] (4.1) On the control plane, based on the filtering results of real-time traffic, retrain the classifier and update μ1;

[0037] (4.2) On the control plane, update μ2 based on the entropy change of real-time traffic and the filtering results;

[0038] Furthermore, in the step (1.2), the characteristic information collected includes source IP growth rate, average number of flow packets, source port growth rate, flow table entry growth rate, congestion ratio, flow table matching success rate, and destination port growth rate;

[0039] Furthermore, in step (2), the characteristic values ​​of the data packets are used to calculate the characteristic values ​​et or ec according to formula (1):

[0040]

[0041] Where E represents the eigenvalue et or ec to be calculated, e i represents the i-th characteristic value of the data packet, η i It represents the calculation weight corresponding to the eigenvalue, and the optimal value of each weight is determined according to the feature selection algorithm, and it satisfies

[0042] The features involved in calculating the comprehensive characteristic value are source IP growth rate, average number of flow packets, source port growth rate, flow table item growth rate, convection ratio, flow table matching success rate and destination port growth rate. At this time, N=7, et=E; the features involved in calculating the change characteristic value are source IP growth rate, source port growth rate, destination port growth rate and flow table item growth rate. At this time, N=4, ec=E.

[0043] Furthermore, in step (3), both the feature threshold μ1 and the change threshold μ2 are stored using a Bloom filter on the data plane.

[0044] Furthermore, in the step (4.1), the classification algorithm used by the classifier can be a decision tree, a neural network, a random forest, a Boosting algorithm and its variants.

[0045] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

[0046] The above embodiments are intended only to illustrate the design concepts and features of the present invention. Their purpose is to enable those skilled in the art to understand the contents of the present invention and implement them accordingly. The scope of protection of the present invention is not limited to the above embodiments. Therefore, any equivalent changes or modifications made based on the principles and design concepts disclosed in the present invention are within the scope of protection of the present invention.

Claims

1. A DDoS hybrid attack mitigation method based on SDN data plane, characterized in that: The steps include: (1) Use the P4 language to customize the data plane and start the P4 switch. The specific steps are as follows: (1.1) Compile and run the data plane to generate a data plane description file; (1.2) Start the P4 switch and import the description file, including the packet processing mode, traffic characteristics to be collected, characteristic threshold, change threshold, and flow table matching action settings; (2) Collect traffic information on the data plane, calculate the characteristic values ​​of each data packet, and process them into comprehensive characteristic values ​​et and change characteristic values ​​ec; (3) Based on the collected traffic feature data, traffic filtering is performed by comparing the feature threshold and change threshold set on the data plane. The specific steps are as follows: (3.1) Compare et with the characteristic threshold μ1 to identify the normal-speed DDoS attack on the traffic; (3.2) Compare ec and the change threshold μ2 to identify low-rate DDoS attacks on traffic; (3.3) Determine whether the corresponding characteristic value in step (3.1) or step (3.2) is higher than μ1 or μ2; if so, the traffic with the corresponding characteristic value is marked as attack traffic and directly dropped on the data plane without performing flow table lookup and forwarding operations; otherwise, normal traffic is forwarded based on the matching flow table entry; (4) Update the data plane feature threshold and change threshold. The specific steps are as follows: (4.1) On the control plane, based on the filtering results of real-time traffic, retrain the classifier and update μ1; (4.2) On the control plane, μ2 is updated based on the entropy change of real-time traffic and the filtering results.

2. The method for mitigating hybrid DDoS attacks based on the SDN data plane according to claim 1, wherein: In the step (1.2), the collected characteristic information includes source IP growth rate, average number of flow packets, source port growth rate, flow table entry growth rate, congestion ratio, flow table matching success rate and destination port growth rate.

3. The method for mitigating hybrid DDoS attacks based on the SDN data plane according to claim 1, wherein: In step (2), the characteristic values ​​of the data packets are used to calculate the characteristic values ​​et or ec according to formula (1): Where E represents the eigenvalue et or ec to be calculated, e i represents the i-th characteristic value of the data packet, η i It represents the calculation weight corresponding to the eigenvalue.

4. The method for mitigating hybrid DDoS attacks based on the SDN data plane according to claim 1, wherein: In step (3), both the feature threshold μ1 and the change threshold μ2 are stored using a Bloom filter on the data plane.

5. The method for mitigating hybrid DDoS attacks based on the SDN data plane according to claim 1, wherein: In the step (4.1), the classification algorithms used by the classifier include decision tree, neural network, random forest, Boosting and its variants.

Images