A DDoS Attack Tracing and Defense Method Based on SDN

Abstract

This invention discloses an SDN-based method for tracing and defending against DDoS attacks. The method involves an SDN switch collecting and statistically analyzing traffic data and reporting it to the SDN controller. The SDN controller uses the statistical data to detect DDoS attacks, constructs a source tree based on the detection results, and issues defense commands and statistical data collection commands to the SDN switch. This allows for layered tracing and defense against attacks involving IP address spoofing. This scheme uses the victim's IP address and the MAC address of the attack flow's source device interface obtained from attack detection, leveraging the global network topology of the SDN controller to construct a source path and achieve real-time defense. This avoids additional overhead under normal network conditions, effectively reduces the impact on legitimate communication, and can effectively trace and defend against DDoS attacks involving IP address spoofing.

Description

Technical Field

[0001] This invention relates to a method for tracing and defending against DDoS attacks based on SDN, belonging to the field of network security technology. Background Art

[0002] DDoS attacks involve sending a massive number of attack packets with spoofed source IP addresses within a short period of time. These packets deplete the victim's underlying resources, hindering their availability. Furthermore, these attacks often employ IP address spoofing techniques to conceal the attack's origin. On one hand, DDoS attacks can directly cause website downtime, server crashes, and excessive bandwidth or memory consumption, resulting in significant losses for the victim, such as damage to their reputation and financial losses. On the other hand, attacks with spoofed source IP addresses render blacklist defenses ineffective, while whitelist defenses can significantly impact legitimate user access. Considering that implementing defensive measures near the victim could disrupt a large amount of legitimate communication, accurate tracking of the attack source is crucial for effective defense while minimizing network impact.

[0003] Attack attribution is a method of identifying the source of data packets by tracing their paths. In recent years, some scholars have proposed using attack attribution to defend against DDoS attacks involving IP address spoofing. These methods can be broadly categorized into packet tagging-based attack attribution schemes and repeater log-based schemes. Both schemes record information related to the data packet transmission path either within the data packet itself or in the repeater. A common characteristic is that they rely on continuous recording under normal network conditions for attribution; that is, regardless of whether an attack is currently occurring in the network, the repeater continuously performs the same operations on the data packets. However, high-speed networks handle massive amounts of data packets, and even selective manipulation of these packets incurs significant overhead in normal network communication.

[0004] (1) Attack tracing scheme based on packet tagging

[0005] This scheme records a special marker containing path information at a specific location in the transmitted data packet to track the attacker. The tracing process involves two steps: packet marking and path reconstruction. Packet marking is performed by a repeater on the network; when a packet is forwarded by a repeater, information related to that repeater is written to a specific location on the packet. Path reconstruction is performed at the victim's end; a specific algorithm identifies and reassembles the marked information in the data packet to ultimately reconstruct the attack path. This scheme requires modification to the functionality of packet protocol header fields, potentially involving protocol changes, making its practical application difficult. Furthermore, with the rapid development of the internet, the number of transmitted data packets is increasing daily, placing higher demands on the processing capacity of repeaters. When repeater performance is mismatched, it can significantly impact network performance.

[0006] (2) Attack tracing scheme based on repeater logs

[0007] This scheme records forwarded data packet information within routers and other repeaters, and reconstructs the path by querying the logs. The tracing process involves two steps: log recording and log querying. The recorded logs typically contain key path-related information such as the source and destination addresses of the data packets, though this varies depending on the specific scheme. The log tracing query is initiated by the victim, retrieving the repeater logs along the path from the victim's end until the attack path is reconstructed. This scheme requires significant storage space and processing resources, making it challenging to apply in networks with massive data transmission volumes. Furthermore, the log query operation during tracing introduces additional overhead to the communication channel, impacting normal network communication.

[0008] Regardless of whether an attack exists in the current network, both existing schemes involve the same continuous operation of the repeater on the data packets. However, in high-speed networks, the massive number of data packets causes significant additional overhead even in normal network communication. The current difficulties can be summarized as follows: (1) Existing schemes rely on continuous recording under normal network conditions for tracing, which brings additional overhead to normal communication and affects network performance; (2) Existing schemes may involve protocol changes, which are difficult to implement in practice; (3) As the number of data packets transmitted in high-speed networks increases daily, existing schemes place higher demands on the performance of the repeater. When the repeater performance is mismatched, it will affect normal network communication. Summary of the Invention

[0009] To address the aforementioned issues, this invention discloses an SDN-based method for DDoS attack tracing and defense. First, the SDN switch collects, samples, and extracts features from traffic, and reports the statistical data to the SDN controller. Second, the SDN controller inputs the statistical data into a machine learning model for DDoS attack detection. Based on the detected victim IP address, the MAC address of the attack flow's source device interface, and the SDN switch that reported the statistical data, it generates a current node and adds it to the tracing tree, then executes defense operations. The node to which the attack flow is directed in the tracing tree is considered a forward node. If the forward node is not the root node, the SDN switch of the forward node performs a defense disarming operation to reduce the impact of defense measures on legitimate access. A statistical data collection command is issued to the switch corresponding to the MAC address of the attack flow's source device interface, and the system waits for the statistical data to be reported. Finally, the SDN switch executing the statistical data collection command repeats the first step, thereby tracing the attack source layer by layer and achieving defense. In Software Defined Networking (SDN), the control plane is logically centralized on the network controller, which can easily configure the network and identify the entry point of a flow. Therefore, this scheme, based on SDN, uses SDN switches to collect and statistically analyze traffic data and report it to the SDN controller. The SDN controller uses the statistical data to detect DDoS attacks, constructs a source tree based on the detection results, and issues defense commands and statistical data collection commands to the SDN switches, performing layer-by-layer tracing and defense against attacks involving IP address spoofing. First, the SDN switches collect, sample, and extract features from the traffic, and then report the statistical data to the SDN controller. Secondly, the SDN controller inputs statistical data into a machine learning model for DDoS attack detection. Based on the detected victim IP address, the MAC address of the attack flow's source device interface, and the SDN switch reporting the statistical data, it generates a current node and adds it to the source tree, then executes defense operations. The node to which the attack flow originates at the current node in the source tree is considered a forward node. If the forward node is not the root node, the SDN switch of the forward node performs a defense disarming operation, reducing the impact of defense measures on legitimate access. A statistical data collection command is issued to the switch corresponding to the MAC address of the attack flow's source device interface, and the controller waits for the statistical data to be reported. Finally, the SDN switch executing the statistical data collection command repeats the first step, thus tracing the attack back to its source layer by layer and achieving defense. This scheme uses the victim IP address and the MAC address of the attack flow's source device interface obtained from attack detection, leverages the global network topology of the SDN controller to construct a source tracing path and achieve real-time defense, avoiding additional overhead under normal network conditions, effectively reducing the impact on legitimate communication, and enabling source tracing and effective defense against DDoS attacks involving IP address spoofing.

[0010] In order to achieve the purpose of this invention, the specific technical steps of this solution are as follows: A method for tracing and defending against DDoS attacks based on SDN, the method includes the following steps: Step (1) The administrator sets up the devices to be protected in the network, deploys a periodic statistical data collection module at the SDN switch directly connected to it, and reports the statistical data to the SDN controller.

[0011] Step (2) The SDN controller inputs statistical data into the machine learning model to detect DDoS attacks. When an attack is detected, the attack tracing module is triggered and a new tracing tree is created, constructing the tracing path from the root node to the leaf node.

[0012] Step (3) The SDN controller generates the current node based on the victim's IP address and the MAC address of the attack flow source device interface obtained from the attack detection, as well as the SDN switch that reported the statistical data. The attack flow destination node at the current node in the tracing tree is considered as the forward node. The current node is added to the tracing tree as a child node of the forward node. The controller also issues a defense command to the current node switch. The current node switch performs the defense operation according to the command.

[0013] Step (4) If the forward node is not the root node, the SDN controller issues a defense release command to the forward node switch for the traffic that has been defended. The forward node switch performs the defense release operation according to the command to reduce the impact of the defense measures on legitimate access.

[0014] Step (5) The SDN controller considers the SDN switch corresponding to the attack flow source node as a back-end node switch, sends a statistical data collection instruction to the back-end node switch and waits for the statistical data to be reported. The back-end node switch collects and reports the statistical data to the SDN controller.

[0015] Step (6) The SDN controller inputs the statistical data into the machine learning model to detect DDoS attacks and obtains the information required for attack tracing at the current node switch, namely the victim's IP address and the MAC address of the interface of the attack flow source device.

[0016] Step (7) repeats steps (3) to (6). If the backward node switch in step (5) does not exist, and the attack source is not in the current control domain, it means that the attack tracing has been executed to the edge of the current control domain. The attack tracing in the current control domain has been completed, and the subsequent tracing is continued by the controller of the adjacent control domain. If the attack source is in the current control domain, it means that the attack tracing has been executed to the SDN switch directly connected to the attack source. The attack tracing on the attack path has been completed. The tracing ends when all attack tracing on all paths is completed.

[0017] Furthermore, in step (1), the steps of the statistical data collection module are as follows:

[0018] (1.1) The administrator can choose the devices to be protected in the network according to the needs. These devices may be important servers, etc., and a periodic statistical data collection module can be deployed at the SDN switch directly connected to them.

[0019] (1.2) The statistical data collection module collects the current traffic at the switch and performs system sampling on the traffic. The system sampling selects the starting point and determines the length of the sampling interval according to a determined function. This method uses Secure Hash Algorithm 1 (SHA-1) as the hash function h and the input parameter r to randomly generate the starting point h(r) of the system sampling. The SHA-1 hash function converts the input data into a fixed-length hash value and processes the data by bit operations and loop operations to achieve the uniqueness and irreversibility of the data. The sampling rate k is used to set the sampling interval, and one is selected every k data packets.

[0020] (1.3) The statistical data collection module performs feature extraction on the data sampled in (1.2). The data structure used is the Count-Min Sketch structure. Sketch is a compact data structure used to record approximate information of elements in a data stream. It maps the elements in the data stream to a limited memory space and uses a set of statistical counters to record the frequency of occurrence or other relevant information of each element. Count-Min Sketch is one of the most classic structures in Sketch. It uses a two-dimensional counter array with w columns and r rows to record the approximate size information of the data stream. It uses multiple hash functions and counts multiple counters, which can accurately estimate the size of the data stream within a very small error range. Using the Count-Min Sketch structure, the address pair consisting of the destination IP address and the source MAC address of the data packet is used as the key value of the Count-Min Sketch structure. In the Count-Min Sketch, the hash function FarmHash is used to perform hash operation on the key value and map the hash value to the corresponding counting bucket position in the Count-Min Sketch. When the number of data packets mapped to the counting bucket by the key value exceeds the saturation threshold, the corresponding features are extracted and statistical data is generated.

[0021] (1.4) The SDN switch reports the statistical data to all controlled SDN controllers. When the switch is a boundary switch of multiple control domains, it reports to each controlled switch respectively.

[0022] Furthermore, in step (2), the steps of attack detection and creation of the source tree are as follows:

[0023] (2.1) The attack detection method systematically samples the traffic data of the public dataset during the offline training phase, extracts the composite feature vector through the Count-Min Sketch technique, then labels the feature vector, uses the labeled features to train the attack classifier, and uses supervised machine learning algorithms such as random forest algorithm and decision tree algorithm to train the model based on the labeled training set to obtain the machine learning model.

[0024] (2.2) The SDN controller inputs the statistical data into the machine learning model that has been trained offline in (2.1), and returns the attack detection results as the victim IP address and the MAC address of the source device interface of the current attack flow;

[0025] (2.3) When an attack is detected, the attack tracing module is triggered and a new tracing tree is created. The tracing tree uses a tree data structure. The root node records the victim's IP address, and the non-root nodes record the MAC addresses of the switches and attack flow source devices on the tracing path. The tracing path is constructed from the root node to the leaf node.

[0026] Furthermore, in step (3), the steps of generating the current node, adding it to the source tree, and performing defense operations are as follows:

[0027] (3.1) The SDN controller generates the current node based on the victim's IP address and the MAC address of the device interface from which the attack flow originates, obtained from the attack detection, and the SDN switch that reports the statistical data.

[0028] (3.2) Query the source tree for the leaf node containing the MAC address of the current node's switch port. If the leaf node exists, then the node is the destination of the attack flow and is considered a forward node. Otherwise, the root node is considered a forward node, and the current node is added to the source tree as a child node of the forward node.

[0029] (3.3) The SDN controller issues a blocking flow table to the current node switch based on the victim IP address and the MAC address of the attack flow source device interface obtained from the attack detection. The flow table uses the victim IP address and the MAC address of the attack flow source device interface as the flow matching rules.

[0030] (3.4) The current node switch modifies the flow table according to the issued blocking command to achieve attack defense.

[0031] Furthermore, in step (4), the steps for removing the defense of the forward node are as follows:

[0032] (4.1) If the forward node is not the root node, issue a flow table to the forward node switch to remove the defense. The issued flow table uses the victim's IP address and the MAC address of the attack flow source device interface recorded in the forward node as the flow matching rule. Otherwise, skip this step and step (4.2).

[0033] (4.2) The forward node switch modifies the flow table according to the issued allow command to realize the defense removal.

[0034] Furthermore, in step (5), the step of issuing statistical data collection instructions to the backward nodes is as follows:

[0035] (5.1) Based on the MAC address of the source device interface of the attack flow obtained by the attack detection, the SDN controller queries the SDN switch corresponding to the MAC address in the controller network topology. It considers the switch to be a back-end node switch. When the back-end node switch exists, it sends a statistical data collection instruction to the switch and waits for the statistical data to be reported. Otherwise, it skips this step, step (5.2) and step (6).

[0036] (5.2) The downstream node switch collects statistical data and reports it to the SDN controller according to the statistical data collection instructions issued by the SDN controller.

[0037] Furthermore, in step (6), the SDN controller inputs statistical data into the machine learning model for DDoS attack detection, using the same attack detection method as in steps (2.1) and (2.2).

[0038] Furthermore, in step (7), the steps of repeating steps (3) to (6) until the tracing is completed are as follows:

[0039] (7.1) In a large SDN network, multiple controllers are needed to manage the entire network. The total number of controllers depends on the size and requirements of the network. The number of SDN controllers involved in attack tracing varies from a few to a dozen. For each SDN controller involved, repeat steps (3) to (6).

[0040] (7.2) For a certain SDN controller, if the backward node switch in step (5) does not exist, if the attack source is not in the current control domain, it means that the attack tracing has been executed to the edge of the current control domain and the attack tracing in the current control domain has been completed. The subsequent tracing is continued by the controller of the adjacent control domain. If the attack source is in the current control domain, it means that the attack tracing has been executed to the SDN switch directly connected to the attack source and the attack tracing on the attack path has been completed. The tracing ends when all attack tracing on all paths is completed.

[0041] Compared with the prior art, the technical solution of the present invention has the following advantages:

[0042] (1) This invention proposes a method for tracing and defending against DDoS attacks based on SDN. It can trace the source of attacks with IP address spoofing layer by layer through the interaction between SDN switches and SDN controllers. It is applicable to scenarios and tasks such as tracing the source of DDoS attacks with IP address spoofing and real-time defense.

[0043] (2) This invention collects and statistically analyzes traffic data through an SDN switch and reports it to the SDN controller. Then, the SDN controller performs attack detection. Based on the victim's IP address and the MAC address of the attack flow source device interface obtained by the detection, the attack path at the current node is obtained. The global network topology is used to issue corresponding flow table and statistical data collection instructions to construct a complete tracing path. Compared with the attack tracing scheme based on packet tagging and the attack tracing scheme based on forwarder logs, which rely on continuous recording, the attack tracing of this invention only runs when the attack occurs. It does not require modification of existing protocols and will not occupy a large amount of storage space and processing resources of the forwarder, thus avoiding additional overhead in normal network conditions.

[0044] (3) This invention combines attack tracing with attack defense. Each layer of attack tracing is completed, and corresponding attack defense measures are implemented. The attack tracing process is coordinated with corresponding attack defense measures. Compared to traditional attack tracing and defense methods, this avoids the lag of attack defense after attack tracing, providing stronger real-time defense capabilities and enabling rapid response to DDoS attacks, providing faster and more efficient protection for the devices to be protected. Simultaneously, each layer of attack tracing is completed, and the forward switch is deactivated. This ensures effective defense against DDoS attacks while maintaining normal network traffic forwarding, reducing the impact of attack defense measures on legitimate access, and protecting the normal network environment.

[0045] (4) This invention uses the MAC address of the attack flow source device interface obtained by detection to construct the source tracing path. Through the design of the reporting method of the boundary SDN switch, it is applicable to single SDN controller and multi-SDN controller scenarios. It can be flexibly deployed according to the network scenario, further expanding the application field of attack source tracing and making it easier to deploy in various real network environments. Attached Figure Description

[0046] Figure 1 A system framework diagram for attack tracing and defense schemes based on SDN for DDoS attacks;

[0047] Figure 2 This is a schematic diagram of the network topology and source tree for an example. Detailed Implementation

[0048] The technical solutions provided by the present invention will be described in detail below with reference to specific embodiments. It should be understood that the following specific embodiments are only used to illustrate the present invention and are not intended to limit the scope of the present invention.

[0049] Example: This invention provides a method for tracing and defending against DDoS attacks based on SDN. The network topology of the example is as follows. Figure 2 As shown, the network topology includes hosts H1-H7, SDN controllers C1-C2, and SDN switches S1-S7. S1-S4 are controlled by C1, and S4-S7 are controlled by C2. That is, S4 is the boundary switch between the two control domains. The host and switch ports are designated P. In this embodiment, the victim is H1, and the attackers are H2, H6, and H7. The steps include:

[0050] Step (1) The administrator configures the devices to be protected in the network, deploys a periodic statistical data collection module at the SDN switch directly connected to it, and reports the statistical data to the SDN controller;

[0051] In one embodiment of the present invention, the steps of the statistical data collection module are as follows:

[0052] (1.1) The administrator sets H1 as the device to be protected and deploys a periodic statistical data collection module at S1, which is directly connected to H1;

[0053] (1.2) The statistical data collection module collects the traffic of S1 and performs system sampling on the traffic;

[0054] (1.3) The statistical data collection module extracts features from the data after systematic sampling in (1.2) and generates statistical data;

[0055] (1.4) S1 will report the statistical data to C1.

[0056] Step (2) The SDN controller inputs statistical data into the machine learning model to detect DDoS attacks. When an attack is detected, the attack tracing module is triggered and a new tracing tree is created, constructing the tracing path from the root node to the leaf node.

[0057] In one embodiment of the present invention, the steps of attack detection and creation of a source tree are as follows:

[0058] (2.1) The attack detection method trains the model in the offline training phase to obtain the machine learning model;

[0059] (2.2) C1 inputs the statistical data into the machine learning model that has been trained offline in (2.1) and returns the IP address of H1, the MAC address of S2P1 and the MAC address of S3P1;

[0060] (2.3) At this point, an attack is detected, triggering the attack tracing module to create a new tracing tree. The tracing tree uses a tree data structure, with the root node recording the IP address of H1. H1 Non-root nodes record the MAC addresses of the switches and attack flow source devices on the tracing path, and the tracing path is constructed from the root node to the leaf node.

[0061] Step (3) The SDN controller generates the current node based on the victim's IP address and the MAC address of the attack flow source device interface obtained from the attack detection, as well as the SDN switch that reported the statistical data. It considers the node to which the attack flow went in the source tree as the forward node, adds the current node as a child node of the forward node to the source tree, and issues a defense command to the current node switch. The current node switch performs the defense operation according to the command.

[0062] In one embodiment of the present invention, the steps of generating the current node, adding it to the source tree, and performing defense operations are as follows:

[0063] (3.1) C1 generates the current node based on the IP address of H1, the MAC address of S2P1, and the MAC address of S3P1 obtained from the attack detection, as well as the statistical data reported by S1. <S1,MAC S2P1 >、 <S1,MAC S3P1 >;

[0064] (3.2) In the source tree, search for a leaf node containing the MAC address of port S1. Since this leaf node does not exist, consider the root node as the forward node, and then... <S1,MAC S2P1 >、 <S1,MAC S3P1 >Add the child node of the root node to the source tree;

[0065] (3.3) C1 issues a blocking flow table to S1 to achieve defense based on the IP address of H1, the MAC address of S2P1 and the MAC address of S3P1 obtained from the attack detection. The target IP address in the flow matching rules of the flow table is the IP address of H1, and the source MAC address is the MAC address of S2P1 and the MAC address of S3P1.

[0066] (3.4) S1 modifies the flow table according to the issued blocking instruction to achieve attack defense.

[0067] Step (4) If the forward node is not the root node, the SDN controller issues a defense release command to the forward node switch for the traffic that has been defended. The forward node switch performs the defense release operation according to the command to reduce the impact of the defense measures on legitimate access.

[0068] In one embodiment of the present invention, the step of removing the defense for the forward node is as follows:

[0069] (4.1) Since the forward node is the root node, skip this step and step (4.2);

[0070] (4.2) Skip this step.

[0071] Step (5) The SDN controller considers the SDN switch corresponding to the attack flow source node as a back-end node switch, sends a statistical data collection instruction to the back-end node switch and waits for the statistical data to be reported. The back-end node switch collects and reports the statistical data to the SDN controller.

[0072] In one embodiment of the present invention, the step of issuing a statistical data collection instruction to the backward node is as follows:

[0073] (5.1) Based on the MAC addresses of S2P1 and S3P1 obtained from the attack detection, C1 queries the SDN switches corresponding to the MAC addresses in the controller network topology. The switches are S2 and S3. C1 considers S2 and S3 to be back-end node switches, sends statistical data collection instructions to S2 and S3 and waits for the statistical data to be reported.

[0074] (5.2) S2 and S3 collect statistical data according to the statistical data collection instructions issued by C1 and report it to C1.

[0075] Step (6) The SDN controller inputs the statistical data into the machine learning model to detect DDoS attacks and obtains the information required for attack tracing at the current node switch, namely the victim's IP address and the MAC address of the interface of the attack flow source device.

[0076] In one embodiment of the present invention, C1 inputs the statistical data reported by S2 and S3 into a machine learning model for DDoS attack detection, using the same attack detection method as in steps (2.1) and (2.2).

[0077] Step (7) repeats steps (3) to (6). If the backward node switch in step (5) does not exist, and the attack source is not in the current control domain, it means that the attack tracing has been executed to the edge of the current control domain. The attack tracing in the current control domain has been completed, and subsequent tracing is continued by the controller of the adjacent control domain. If the attack source is in the current control domain, it means that the attack tracing has been executed to the SDN switch directly connected to the attack source, and the attack tracing is completed.

[0078] In one embodiment of the present invention, the steps (3) to (6) are repeated until the tracing is completed as follows:

[0079] (7.1) For the statistical data reported by S2, C1 generates the current node based on the IP address of H1 and the MAC address of H2P1 obtained from the attack detection, as well as the statistical data reported by S2. <S2,MACH2P1 Similarly, for the statistical data reported by S3, the current node is generated. <S3,MAC S4P1 >; Search the source tree for leaf nodes containing the MAC address of port S2, i.e. <S1,MAC S2P1 If the attack flow is >, then that node is the target node, and it is considered a forward node. Then the current node is... <S2,MAC H2P1 >As the forward node <S1,MAC S2P1 The child nodes of the node are added to the source tree, and the current node is added similarly. <S3,MAC S4P1 >As a forward node <S1,MAC S3P1 > The child node is added to the source tree; C1 issues a blocking flow table to S2 to implement defense. In the flow matching rules of this flow table, the target IP address is the IP address of H1 and the source MAC address is the MAC address of H2P1. Similarly, a blocking flow table is issued to S3; S2 and S3 modify the flow table according to the issued blocking instructions to implement attack defense; due to the forward node <S1,MAC S2P1 If it is not the root node, then issue a flow table to S1 to disable the defense. The flow matching rules in this flow table specify the destination IP address as the IP address of H1 and the source MAC address as the MAC address of S2P1. Similarly, for forward nodes... <S1,MAC S3P1 The defense disarming operation is executed. S1 modifies the flow table according to the issued allow command, thus disarming the defense. C1, based on the MAC address of H2P1 obtained from attack detection, queries the controller network topology and finds that the corresponding SDN switch for that MAC address does not exist. The attack tracing is then executed to S2, which is directly connected to the attacker H2. The attack tracing along this attack path is now complete. C1, based on the MAC address of S4P1 obtained from attack detection, queries the controller network topology and finds that the MAC address corresponds to S4. It considers S4 to be a downstream node switch and issues a statistical data collection command to S4, waiting for the statistical data to be reported. S4 then executes the statistical data report issued by C1. Collect instructions and collect statistical data. Since S4 is the boundary switch between network 1 and network 2, S4 reports statistical data to C1 and C2 respectively. C1 and C2 input the statistical data reported by S4 into the machine learning model for DDoS attack detection. The remaining repeated process is similar to the above process. In particular, when S4 executes step (5.1), the MAC address of S5P1 cannot be found in the network topology, so it is assumed that the back-end node switch of S4 does not exist. S4 skips steps (5.2) and (6). When S4 reports statistical data to C2, the attack tracing module is triggered again at C2. C2 continues to perform attack tracing in the control domain.

[0080] (7.2) For C1, attackers H6 and H7 are not in C1's control domain. When S4 executes step (5), the backward node switch does not exist. At this time, the attack tracing is executed to the edge of C1's control domain. C1 has completed the attack tracing within its control domain. The subsequent tracing is executed by C2. For attacker H2, who is in C1's control domain, when S2 executes step (5), the backward node switch does not exist. The attack tracing is executed to S2, which is directly connected to attacker H2. The attack tracing on this path is completed. For C2, attackers H6 and H7 are in C2's control domain. When S6 and S7 execute step (5), the backward node switch does not exist. The attack tracing is executed to S6 and S7, which are directly connected to attackers H6 and H7. At this time, the attack tracing on all paths is completed.

[0081] The technical means disclosed in this invention are not limited to those disclosed in the above embodiments, but also include technical solutions composed of any combination of the above technical features. It should be noted that those skilled in the art can make various improvements and modifications without departing from the principles of this invention, and these improvements and modifications are also considered within the scope of protection of this invention.

Claims

1. A method for tracing and defending against DDoS attacks based on SDN, characterized in that, The method includes the following steps: Step (1) The administrator configures the devices to be protected in the network, deploys a periodic statistical data collection module at the SDN switch directly connected to it, and reports the statistical data to the SDN controller; Step (2) The SDN controller inputs statistical data into the machine learning model to detect DDoS attacks. When an attack is detected, the attack tracing module is triggered and a new tracing tree is created, constructing the tracing path from the root node to the leaf node. Step (3) The SDN controller generates the current node based on the victim's IP address and the MAC address of the attack flow source device interface obtained from the attack detection, as well as the SDN switch that reported the statistical data. The attack flow destination node at the current node in the source tree is considered as the forward node. The current node is added to the source tree as a child node of the forward node. The controller also issues a defense command to the current node switch. The current node switch performs the defense operation according to the command. Step (4) If the forward node is not the root node, the SDN controller issues a defense release command to the forward node switch for the traffic that has been defended. The forward node switch performs the defense release operation according to the command to reduce the impact of the defense measures on legitimate access. Step (5) The SDN controller considers the SDN switch corresponding to the attack flow source node as a back-end node switch, sends a statistical data collection instruction to the back-end node switch and waits for the statistical data to be reported. The back-end node switch collects and reports the statistical data to the SDN controller. Step (6) The SDN controller inputs the statistical data into the machine learning model to detect DDoS attacks and obtains the information required for attack tracing at the current node switch, namely the victim's IP address and the MAC address of the interface of the attack flow source device. Step (7) Repeat steps (3) to (6). If the backward node switch in step (5) does not exist, if the attack source is not in the current control domain, it means that the attack tracing has been executed to the edge of the current control domain and the attack tracing in the current control domain has been completed. Subsequent tracing will be executed by the controller of the adjacent control domain. If the attack source is in the current control domain, it means that the attack tracing has been executed to the SDN switch directly connected to the attack source and the attack tracing has been completed. Specifically, step (2) includes the following sub-steps: (2.1) The attack detection method systematically samples the traffic data of the public dataset during the offline training stage, extracts the composite feature vector through the Count-Min Sketch technique, then labels the feature vector, uses the labeled features to train the attack classifier, and uses supervised machine learning algorithms such as random forest algorithm and decision tree algorithm to train the model based on the labeled training set to obtain the machine learning model. (2.2) The SDN controller inputs the statistical data into the machine learning model that has been trained offline in (2.1), and returns the attack detection results as the victim IP address and the MAC address of the source device interface of the current attack flow; (2.3) When an attack is detected, the attack tracing module is triggered and a new tracing tree is created. The tracing tree uses a tree data structure. The root node records the victim's IP address, and the non-root nodes record the MAC addresses of the switch and the source device interface of the attack flow on the tracing path. The tracing path is constructed from the root node to the leaf node. Step (3) specifically includes the following sub-steps: (3.1) The SDN controller generates the current node based on the victim's IP address and the MAC address of the device interface from which the attack flow originates, obtained from the attack detection, and the SDN switch that reports the statistical data; (3.2) Query the source tree for the leaf node containing the MAC address of the current node's switch port. If the leaf node exists, then the node is the destination of the attack flow and is considered a forward node. Otherwise, the root node is considered a forward node, and the current node is added to the source tree as a child node of the forward node. (3.3) The SDN controller issues a blocking flow table to the current node switch based on the victim IP address and the MAC address of the attack flow source device interface obtained from the attack detection. The flow table uses the victim IP address and the MAC address of the attack flow source device interface as the flow matching rules. (3.4) The current node switch modifies the flow table according to the issued blocking command to achieve attack defense.

2. The method for tracing and defending against DDoS attacks based on SDN according to claim 1, characterized in that, Step (1) specifically includes the following sub-steps: (1.1) The administrator selects the devices to be protected in the network according to the needs. If they are important servers, a periodic statistical data collection module is deployed at the SDN switch directly connected to them. (1.2) The statistical data collection module collects the current traffic at the switch and performs system sampling on the traffic. The system sampling selects the starting point and determines the length of the sampling interval according to a determined function. This method uses Secure Hash Algorithm 1 (SHA-1) as the hash function h and the input parameter r to randomly generate the starting point h(r) of the system sampling. SHA-1 converts the input data into a fixed-length hash value and processes the data by bit operations and loop operations to achieve the uniqueness and irreversibility of the data. The sampling rate k is used to set the sampling interval, and one is selected every k data packets. (1.3) The statistical data collection module performs feature extraction on the data sampled in (1.2). The data structure used is the Count-Min Sketch structure. Sketch is a compact data structure used to record approximate information of elements in a data stream. It maps the elements in the data stream to a limited memory space and uses a set of statistical counters to record the frequency of occurrence or other relevant information of each element. Count-Min Sketch is one of the most classic structures in Sketch. It uses a two-dimensional counter array with w columns and r rows to record the approximate size information of the data stream. It uses multiple hash functions and counts multiple counters, which can accurately estimate the size of the data stream within a very small error range. Using the Count-Min Sketch structure, the address pair consisting of the destination IP address and the source MAC address of the data packet is used as the key value of the Count-Min Sketch structure. In Count-Min Sketch, the hash function FarmHash is used to perform hash operation on the key value and map the hash value to the corresponding counting bucket position in Count-Min Sketch. When the number of data packets mapped to the counting bucket by the key value exceeds the saturation threshold, the corresponding features are extracted and statistical data is generated. (1.4) The SDN switch reports the statistical data to all the controlled SDN controllers. When the switch is a boundary switch of multiple control domains, it reports to each of the controlled switches respectively.

3. The method for tracing and defending against DDoS attacks based on SDN according to claim 1, characterized in that, Step (4) specifically includes the following sub-steps: (4.1) If the forward node is not the root node, issue a flow table to the forward node switch to remove the defense. The issued flow table uses the victim's IP address and the MAC address of the attack flow source device interface recorded in the forward node as the flow matching rule. Otherwise, skip this step and step (4.2). (4.2) The forward node switch modifies the flow table according to the issued allow command to realize the defense removal.

4. The method for tracing and defending against DDoS attacks based on SDN according to claim 1, characterized in that, Step (5) specifically includes the following sub-steps: (5.1) Based on the MAC address of the source device interface of the attack flow obtained by the attack detection, the SDN controller queries the SDN switch corresponding to the MAC address in the controller network topology. It considers the switch to be a back-end node switch. When the back-end node switch exists, it sends a statistical data collection instruction to the switch and waits for the statistical data to be reported. Otherwise, it skips this step, step (5.2) and step (6). (5.2) The downstream node switch collects statistical data and reports it to the SDN controller according to the statistical data collection instructions issued by the SDN controller.

5. The method for tracing and defending against DDoS attacks based on SDN according to claim 1, characterized in that, In step (6), the SDN controller inputs statistical data into the machine learning model for DDoS attack detection, using the same attack detection method as in steps (2.1) and (2.2).

6. The method for tracing and defending against DDoS attacks based on SDN according to claim 1, characterized in that, Step (7) specifically includes the following sub-steps: (7.1) In a large SDN network, multiple controllers are needed to manage the entire network. The total number of controllers depends on the size and requirements of the network. The number of SDN controllers involved in attack tracing varies from a few to a dozen. For each SDN controller involved, repeat steps (3) to (6). (7.2) For any SDN controller, if the backward node switch in step (5) does not exist, if the attack source is not in the current control domain, it means that the attack tracing has been executed to the edge of the current control domain and the attack tracing in the current control domain has been completed. The subsequent tracing will be executed by the controller of the adjacent control domain. If the attack source is in the current control domain, it means that the attack tracing has been executed to the SDN switch directly connected to the attack source and the attack tracing on the attack path has been completed. The tracing ends when all attack tracing on all paths is completed.

Images