Ldos attack detection and mitigation method based on programmable data plane
Patent Information
- Application Number
- CN202410141234.1
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- Filing Date
- 2024-02-01
- Publication Date
- 2026-10-16
- Estimated Expiration
- 2044-02-01
AI Technical Summary
[0005]在目前针对LDoS攻击的研究中，大部分研究部署在传统网络环境或SDN环境中，这些研究提出的方法在部署后，想要修改模型就必须停止转发过程，因此灵活性较差
[0013] The LDoS attack detection and mitigation method based on the programmable data plane offers good flexibility and scalability, while also providing high accuracy and low latency. It can accurately identify LDoS attacks in a network environment and implement targeted mitigation based on the specific attack type, enabling rapid recovery of legitimate traffic. Furthermore, this method can run on all programmable switches that support the P4 language, requiring no additional equipment support.
Smart Images
Figure CN117938526B_ABST
Abstract
Description
Technical Field
[0001] This invention belongs to the field of computer network security, specifically relating to a method for detecting and mitigating LDoS attacks based on a programmable data plane. Background Technology
[0002] Software-defined networking (SDN) centralizes and simplifies network management by centralizing the control plane logic. However, decoupling the control plane from the data plane introduces new security challenges. Denial-of-Service (DoS) attacks are among the most common attacks against SDN. These attacks target controllers or servers, preventing them from providing services to clients and thus disrupting the network. Low-rate Denial-of-Service (LDoS) attacks are a specific type of DoS attack that primarily targets the Transmission Control Protocol (TCP). They periodically send bursts of high-rate traffic to preempt link bandwidth, causing TCP packets to be repeatedly dropped. Upon detecting packet loss and timeouts, TCP's congestion control mechanism is triggered, forcing the victim host to reduce its packet sending rate. The periodic attacks consistently limit the victim host's throughput to a very low level, severely impacting network transmission efficiency.
[0003] As SDN's limitations in achieving protocol independence and underlying object independence became apparent, researchers proposed a new generation of SDN (NG-SDN) based on SDN. It supports programmable data planes, achieving protocol and underlying object independence. Users can customize packet processing and forwarding logic, and can process packets at line rates. Due to its full programmability and strong scalability, NG-SDN is bringing new possibilities to networks.
[0004] Among NG-SDN programming languages, P4 (Programming Protocol-Independent Packet Processors) stands out. It is a domain-specific language that allows users to customize header protocols, metadata, packet processing logic, protocol processing procedures, and packet forwarding processes, and provides a rich set of tools for user use. In a P4 user program, developers first construct a parser module to parse the packet header protocol, then construct ingress and egress pipeline modules to operate on the packets before and after forwarding, respectively, and finally construct a deparser module to reassemble the packet header back into the packet. During the operation, developers can use tools such as counters and registers for counting and reading, and use the digest tool to communicate between the data plane and the control plane. As a primary data plane programming language, P4 has been updated several times since its inception, proposing various architectures. Currently, vendors such as Intel, Cisco, and Barefoot provide programmable devices that support P4. This indicates that P4 is gaining popularity among researchers and network vendors.
[0005] Most current research on LDoS attacks is deployed in traditional network or SDN environments. The methods proposed in these studies require stopping the forwarding process to modify the model after deployment, resulting in poor flexibility. Because they cannot achieve device independence, these methods are difficult to deploy on different types of devices, leading to a lack of portability. Furthermore, these methods require multiple communications between the data plane and control plane during runtime, introducing unavoidable time delays. Finally, most of these methods only consider using UDP packets to launch LDoS attacks when building threat models, which cannot simulate real-world attack scenarios.
[0006] This invention proposes an LDoS attack detection and mitigation method based on a programmable data plane. This method is entirely deployed on the programmable data plane, enabling real-time monitoring of traffic flowing through programmable switches and the detection and mitigation of LDoS attacks. The method consists of four parts: feature analysis and extraction, classification tree training and mapping, attack detection, attacker location, and attack mitigation. Feature analysis and extraction collects traffic information arriving at the switch from the data plane and uses a sliding window to extract traffic features for attack detection. Classification tree training and mapping collects the extracted features, creates a dataset, and inputs it into a machine learning training model to construct a classification tree for attack detection. The trained classification tree is then mapped to a match-action table supported by the programmable switch and deployed to the data plane as the classification model for attack detection. Attack detection inputs the traffic features collected in feature analysis and extraction into the classification tree model, classifying traffic into three categories: legitimate traffic, UDP-based LDoS attack traffic, and TCP-based LDoS attack traffic, thus completing attack detection. Attacker location and mitigation are based on the type of LDoS attack detected, selecting the appropriate location method: if a UDP-based LDoS attack is detected, a location method involving burst traffic and detection during quiet periods is used; if a TCP-based LDoS attack is detected, a location method involving calculating the difference between sent and received packets is used. After attacker location is completed, all data packets from the attacker are dropped to achieve attack mitigation. Summary of the Invention
[0007] To address the shortcomings of current LDoS attack detection and mitigation methods, a programmable data plane-based LDoS attack detection and mitigation method is proposed. This method is fully deployed on the programmable data plane, offering good flexibility and scalability, while also achieving high accuracy and low latency.
[0008] The technical solution adopted by the present invention to achieve the above objectives is as follows: the LDoS attack detection and mitigation method mainly includes four steps: feature analysis and extraction, training and mapping of classification trees, attack detection, attacker location and attack mitigation.
[0009] 1. Feature Analysis and Extraction. The feature analysis and extraction module of the LDoS attack detection and mitigation method based on the programmable data plane selects features for extraction based on the characteristics of different traffic types to distinguish between legitimate and malicious traffic. The following are the traffic characteristics during an LDoS attack: UDP transmission rate: When an LDoS attack based on UDP packets occurs, the attacker will repeatedly send high-rate UDP pulses to the link, causing the average transmission rate of UDP packets to increase; when an LDoS attack based on TCP packets occurs, since the attacker only sends TCP packets, the average UDP transmission rate will not change significantly. TCP transmission rate: When an LDoS attack occurs, the transmission of legitimate hosts is blocked, and the TCP transmission rate is severely reduced. TCP fluctuation level: When an LDoS attack occurs, legitimate hosts repeatedly enter the slow start state, causing TCP traffic to fluctuate significantly. Based on the above characteristics, feature analysis and extraction employs a sliding window method. Each large window time slice contains n small window time slices. After each small window time slice, the large window moves forward by one small window time slice, and the traffic information in the large window time slice is updated accordingly. Based on the traffic information, the following features are calculated and extracted to distinguish legitimate traffic from LDoS attack traffic: (1) UDP packet transmission rate. When a UDP-based LDoS attack occurs, the UDP packet transmission rate increases significantly. Therefore, this feature is used to distinguish between UDP-based and TCP-based LDoS attacks. To calculate this feature, simply subtract the number of UDP packets recorded in the first window from the number recorded in the last small window within the large window. The specific formula is as follows: udp_pkt_rate=udp_pkt_num[n]-udp_pkt_num[1], Where udp_pkt_num[n] is the number of UDP packets recorded in the nth small window, and udp_pkt_num[1] is similar; (2) TCP byte transmission rate. When an LDoS attack occurs, the average TCP byte transmission rate drops sharply. Therefore, this feature is used to distinguish legitimate traffic from LDoS attack traffic. To calculate this feature, simply subtract the number of TCP bytes recorded in the first window from the number of TCP bytes recorded in the last small window within the large window. The specific formula is as follows: tcp_byte_rate=tcp_byte_num[n]-tcp_num[1], Where tcp_byte_num[n] is the number of TCP bytes recorded in the nth small window, and tcp_byte_num[1] is similar; (3) TCP Fluctuation Coefficient: When an LDoS attack occurs, the TCP transmission rate fluctuates significantly. Therefore, this feature is used to distinguish between legitimate traffic and attack traffic. When calculating this feature, the TCP byte transmission rate is calculated in each small window to approximate the instantaneous transmission rate. Then, the absolute value of the difference between each approximate instantaneous transmission rate and the TCP byte transmission rate calculated in (2) is added to obtain the TCP fluctuation coefficient within that large window. The calculation method is as follows: Where i is an integer in the range of 1 to n, tcp_rate[i] is the TCP byte transmission rate calculated in the i-th small window, and tcp_byte_rate is the TCP byte transmission rate calculated in the large window.
[0010] 2. Training and Mapping of the Classification Tree. To train the classification tree for attack detection, three features calculated during feature analysis and extraction need to be collected in large windows, and the windows are labeled according to the current traffic type within each large window. After collecting sufficient features and traffic types, a dataset is created and input into the machine learning training model to construct the classification tree for attack detection. After training, to deploy the classification tree to the programmable data plane, it needs to be mapped to the match-action table supported by the programmable switch as follows: (1) The node to be mapped is a branch node. The branch node of the classification tree will compare the splitting feature corresponding to the node with the threshold stored in the node: if the feature value is greater than the threshold, it will enter the right child node of the node, otherwise it will enter the left child node of the node. According to the above characteristics, when mapping branch nodes, the key value is the node label, and the action is determined by the splitting feature corresponding to the branch node: if the splitting feature of the branch node is feature x, then the action is to compare the feature x extracted in step 1 with the threshold θ stored in the node. If it is greater than the threshold θ, it will enter the right child node of the current node, otherwise it will enter the left child node of the current node; (2) The nodes to be mapped are leaf nodes. The leaf nodes of the classification tree are where the classification process ends, and their task is to pass the classification results stored in the nodes to the content to be classified. Therefore, when mapping leaf nodes, the key value to be matched is the node label, and the action is the classification action, that is, assigning the traffic type corresponding to the leaf node to the traffic in the current large window.
[0011] 3. Attack Detection. The traffic features collected in step 1 are mapped to a classification tree model in the programmable data plane. The classification tree divides the traffic into three categories: legitimate traffic, LDoS attack traffic based on UDP packets, and LDoS attack traffic based on TCP packets.
[0012] 4. Attacker Location and Mitigation. After obtaining the attack detection results, if the detection result indicates an LDoS attack has occurred, the corresponding attacker location plan is selected based on the attack type (UDP packet-based LDoS attack or TCP packet-based LDoS attack): (1) If a UDP packet-based LDoS attack is detected, a method of detecting burst traffic and silent periods is adopted. After a fixed time slice t, the number of packets from a certain IP is judged. If it exceeds the large threshold α or is lower than the small threshold β, it is counted respectively. α and β are determined according to the time slice length t and the average UDP packet transmission rate. If the number of packets from a certain IP exceeds the large threshold α and is lower than the small threshold β multiple times within a time slice, it indicates that the data from this IP has both burst traffic and silent periods, and it is judged as an LDoS attacker based on UDP packets; (2) If a TCP packet-based LDoS attack is detected, the location method is adopted by calculating the difference between sent and received packets. TCP packet-based LDoS attackers cannot establish bidirectional TCP connections and will only send packets without receiving packets. For each IP, the number of packets sent and received is recorded in the register, and the difference between the number of sent and received packets is calculated. If the number of packets sent by an IP minus the number of received packets is greater than a predetermined threshold γ, it is determined that it only sends packets without receiving packets and is judged as a TCP packet-based LDoS attacker. After locating the attacker, all data packets from the attacker are dropped to reduce and eventually eliminate the impact of the LDoS attack on the network, thus completing the attack mitigation operation. Beneficial effects
[0013] The LDoS attack detection and mitigation method based on the programmable data plane offers good flexibility and scalability, while also providing high accuracy and low latency. It can accurately identify LDoS attacks in a network environment and implement targeted mitigation based on the specific attack type, enabling rapid recovery of legitimate traffic. Furthermore, this method can run on all programmable switches that support the P4 language, requiring no additional equipment support. Attached Figure Description
[0014] Figure 1 This is a schematic diagram illustrating the working process of an LDoS attack detection and mitigation method based on a programmable data plane.
[0015] Figure 2 This is a diagram illustrating the principle of an LDoS attack.
[0016] Figure 3 This is a schematic diagram of the classification tree mapping method. Detailed Implementation
[0017] The invention will be further described below with reference to the accompanying drawings.
[0018] like Figure 1As shown, the LDoS attack detection and mitigation method based on the programmable data plane mainly includes five steps: feature analysis and extraction (①), training and mapping of classification trees (②), attack detection (③), and attacker location and attack mitigation (④).
[0019] Feature analysis and extraction: Based on the differences between legitimate traffic and LDoS attack traffic, the characteristics of traffic during an LDoS attack were analyzed to select the features to be extracted. After analysis, UDP packet transmission rate, TCP byte transmission rate, and TCP fluctuation coefficient were selected as the features to be extracted, and a sliding window method was used for feature extraction.
[0020] The training and mapping of the classification tree involves collecting traffic features through the switch in windows and labeling these windows according to the current traffic type. These features and labels are then collected in large quantities to create a dataset, which is fed into a machine learning training model to construct a classification tree for attack detection. Finally, the classification tree is mapped to a match-action table supported by the programmable switch, thus deploying the classification tree onto the programmable data plane.
[0021] The attack detection process inputs the extracted features into a classification tree to provide the final classification result, which is the traffic type within the current large window.
[0022] Attacker location and mitigation: The attack detection results are read, and when an LDoS attack occurs, the corresponding attack location method is selected based on the attack type. After attacker location is completed, all data packets from the attacker are dropped to mitigate the attack.
[0023] Figure 2 This diagram illustrates the principle of an LDoS attack, where the horizontal axis represents time and the vertical axis represents transmission rate. The target of an LDoS attack is the bottleneck link, i.e., the link with the lowest bandwidth among all links; the bandwidth of the bottleneck link is called the bottleneck bandwidth. When an LDoS attack occurs, the attacker sends UDP or TCP packets at a rate R (in Mbps) for the first L seconds of a T-second period, remaining silent for the remaining TL seconds. By repeatedly sending high-rate pulses, the attacker periodically occupies the bandwidth of the bottleneck link, forcing the switches at both ends of the link to drop packets. This also triggers TCP's congestion control mechanism, limiting the sending rate of legitimate TCP hosts and severely reducing the TCP transmission rate. Furthermore, due to the relatively long silence time TL, the attacker's average attack rate is low, making LDoS attacks difficult to detect.
[0024] Figure 3 This is a schematic diagram of the classification tree mapping method. The upper part is an example classification tree used for illustration, and the lower part is the matching-action table after the example classification tree is mapped. In a classification tree, each branch node has a self-identifying label, a feature field representing the node's splitting feature, a threshold field representing the comparison threshold, and two child node labels. During classification, the classification tree extracts the feature corresponding to the feature field and compares it with the threshold. If it is greater than the threshold, it moves to the right child node; otherwise, it moves to the left child node. Therefore, when mapping branch nodes to the matching-action table, the key is the current node label, and the action is related to the node's feature field, comparing the feature corresponding to the feature field with the threshold. The parameters are the threshold, the left child node label, and the right child node label. When the action is executed, the feature of the current large window traffic is compared with the threshold. If it is greater than the threshold, the current node label is assigned to the right child node label; otherwise, it is assigned to the left child node label, thus completing the node transfer. For example: Figure 3 When node 1 is mapped to the match-action table, the key value to be matched is node number 1, and the action is to compare the TCP byte transmission rate with the threshold. The parameters are the threshold 1000000, the left child node number 2, and the right child node number 3. In the classification tree, each leaf node also has a label that identifies itself, but the other fields only have a type field, used to indicate the type corresponding to that leaf node. During classification, the classification tree directly assigns the type corresponding to the leaf node to the object to be classified. Therefore, when mapping a leaf node to the match-action table, the key is the current node label, the action is the classification, and the parameter is the type. When the action is executed, the type stored in the leaf node is assigned to the current large window traffic, thus completing the traffic classification. For example: Figure 3 When node 2 is mapped to the match-action table, the key value to be matched is node number 2, and the action is category. That is, type 0 is assigned to the traffic of the current large window.
Claims
1. A method for detecting and mitigating LDoS attacks based on a programmable data plane, characterized in that, LDoS attacks are slow denial-of-service attacks. The LDoS attack detection and mitigation method is fully deployed on the programmable data plane. It uses machine learning methods and flow-level analysis to detect and mitigate LDoS attacks. The method for detecting and mitigating LDoS attacks includes the following steps: Step 1, Feature Analysis and Extraction: The feature extraction module of the LDoS attack detection and mitigation method based on the programmable data plane selects features for extraction according to the characteristics of different traffic types. The following are the traffic characteristics when an attack occurs: UDP transmission rate: When an LDoS attack based on UDP packets occurs, the attacker will repeatedly send high-rate UDP pulses to the link, causing the average transmission rate of UDP packets to increase; when an LDoS attack based on TCP packets occurs, since the attacker only sends TCP packets, the average UDP transmission rate will not change significantly. TCP transmission rate: When an LDoS attack occurs, the transmission of legitimate hosts is blocked, and the TCP transmission rate is severely reduced. TCP fluctuation level: When an LDoS attack occurs, legitimate hosts repeatedly enter the slow start state, causing TCP traffic to fluctuate significantly. Based on the above characteristics, the feature extraction module selected the following features for extraction to distinguish between normal traffic and attack traffic: UDP packet transmission rate: Used to distinguish between LDoS attacks based on UDP packets and those based on TCP packets. When a UDP-based LDoS attack occurs, the UDP packet transmission rate will increase significantly. TCP byte transfer rate: Used to distinguish between legitimate traffic and attack traffic. When an LDoS attack occurs, the average TCP byte transfer rate will drop sharply. TCP volatility coefficient: Used to distinguish between legitimate traffic and attack traffic. When an LDoS attack occurs, the TCP transmission rate will fluctuate significantly. Step 2, Training and Mapping of the Classification Tree: Collect the features extracted in Step 1 to create a dataset, input it into the machine learning training model, and construct a classification tree for attack detection; After training is complete, the classification tree is mapped to the match-action table supported by the programmable switch, thereby deploying it to the data plane as a classification model for attack detection. Step 3, Attack Detection: Input the traffic features collected in Step 1 into the classification tree model. The classification tree divides the traffic into the following three categories: legitimate traffic, LDoS attack traffic based on UDP packets, and LDoS attack traffic based on TCP packets. Step 4, Attacker Location and Mitigation: After completing the attack detection, select the corresponding attacker location and mitigation methods based on the detection results: (1) If an LDoS attack based on UDP packets is detected, the location method of detecting burst traffic and silent periods is adopted. After a fixed time slice t, the number of packets from a certain IP is judged. If it exceeds the large threshold α or is lower than the small threshold β, it is counted. α and β are calculated based on the time slice length t. If the number of packets from a certain IP exceeds the large threshold α and is lower than the small threshold β multiple times within a time slice, it means that the data from this IP has both burst traffic and silent periods, and it is judged as an LDoS attacker based on UDP packets. (2) If a TCP packet-based LDoS attack is detected, the location method is adopted by calculating the difference between sent and received packets. TCP packet-based LDoS attackers cannot establish bidirectional TCP connections and will only send packets without receiving packets. For each IP, the number of packets sent and received is recorded in the register, and the difference between the number of sent and received packets is calculated. If the number of packets sent by an IP minus the number of received packets is greater than a predetermined threshold γ, it is determined that it only sends packets without receiving packets and is judged as a TCP packet-based LDoS attacker.
2. The LDoS attack detection and mitigation method according to claim 1, characterized in that, In step 1, a sliding window method is used to extract features. Each large window time slice contains n small window time slices. After each small window time slice, the large window moves forward by one small window time slice, and the traffic information in the large window time slice is updated. The features in step 1 are then calculated based on the traffic information. The calculation method is as follows: The method for calculating the UDP packet transmission rate is as follows: udp_pkt_rate=udp_pkt_num[n]-udp_pkt_num[1], Where udp_pkt_num[n] is the number of UDP packets recorded in the nth small window, and udp_pkt_num[1] is similar; The method for calculating TCP byte transmission rate is as follows: tcp_byte_rate=tcp_byte_num[n]-tcp_num[1], Where tcp_byte_num[n] is the number of TCP bytes recorded in the nth small window, and tcp_byte_num[1] is similar; The method for calculating the TCP fluctuation coefficient is as follows: Where i is an integer in the range of 1 to n, tcp_rate[i] is the TCP byte transmission rate calculated in the i-th small window, and tcp_byte_rate is the TCP byte transmission rate calculated in the large window.
3. The LDoS attack detection and mitigation method according to claim 1, characterized in that, The mapping methods for the classification tree in step 2 vary depending on the node type, as follows: (1) Branch node: When mapping a branch node, the key value is the node label, and the action is determined by the splitting feature corresponding to the branch node: if the splitting feature of the branch node is feature x, then the action is to compare the feature x extracted in step 1 with the threshold θ stored in the node. If it is greater than the threshold θ, then enter the right child node of the current node; otherwise, enter the left child node of the current node. (2) Leaf node: When mapping leaf nodes, the key value to be matched is the node label, and the action is the category action, that is, the traffic type corresponding to the leaf node is assigned to the traffic in the current large window.