Bidirectional detection and traceability defense method for LDoS attack in SDN

Abstract

The invention provides a bidirectional detection and traceability defense method for an LDoS attack in an SDN, and relates to the technical field of network security, and the method comprises the steps: obtaining parameters of a switch and a link, so as to preliminarily evaluate a network condition; then slicing, clustering and two-way verification are carried out on the new flow after output end convergence based on the periodic characteristic, the flow characteristic and the attack characteristic of the LDoS attack so as to realize accurate detection of the LDoS attack; positioning the LDoS attack flow according to the attack destination IP and issuing a remission flow table to quickly recover the network; and reversely positioning the LDoS attack host through a traceability algorithm, and implementing port-level traceability defense and continuous monitoring. According to the method, matching verification is carried out on the three-dimensional features of the LDoS attack, and traceability monitoring is combined, so that rapid, accurate and thorough LDoS attack detection and defense are realized, IP spoofing can be effectively dealt with, and a defense program is prevented from being utilized to execute a flow table to overflow the attack.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a two-way detection and source tracing defense method for LDoS attacks in SDN. Background Art

[0002] Denial of service (DoS) attacks have a long history. They mainly use various means to exhaust the target processor, memory, bandwidth and other resources, thereby causing the server to be unable to provide the required services to other normal users. As a variant of DoS attacks, even though the purpose is the same, low-rate denial of service (LDoS) attacks can better hide themselves due to the periodicity of the attack. And because LDoS attacks often exploit vulnerabilities in the transport layer protocol, the negative impact they produce is seen by the attacker as a normal phenomenon that complies with the transport protocol rather than an illegal attack.

[0003] Although the programmability, isolation and centralized control of software-defined networks (SDN) give it a relatively high security factor, it still cannot directly avoid the negative impact of LDoS attacks. Currently, there are often three problems in the detection and defense of LDoS attacks: First, the use of full-scale detection methods during inspections will consume too many resources and may have a negative impact on normal traffic; second, most existing solutions often focus on feature calculations in a single dimension, which requires a large cost to achieve a relatively ideal accuracy rate; third, the delivery of defense flow tables is concentrated on the switches at the bottleneck links and there is no subsequent processing work, which cannot deal with IP spoofing and may be used to implement flow table overflow attacks. Summary of the invention

[0004] In view of the common problems of low detection accuracy, high inspection overhead, weak adaptive ability, unreasonable strategy, incomplete isolation and incomplete consideration in traditional LDoS attack detection and defense methods under SDN, a two-way detection and source tracing defense method for LDoS attacks in SDN is proposed. This method performs progressive matching and verification of different dimensional features of LDoS attacks based on the detected suspected attack cycle and duration to achieve accurate detection of LDoS attacks; the strategy based on outbound convergence can well avoid the negative impact of IP spoofing, and under the joint action of source tracing and isolation, it can achieve more thorough attack traffic isolation for attackers rather than attack flows, so as to achieve the defense purpose and prevent being exploited to implement flow table overflow attacks.

[0005] A bidirectional detection and tracing defense method for LDoS attacks in SDN includes the following steps:

[0006] Step 1: Information collection and targeted inspection;

[0007] Step 1.1: Regularly poll and check the switch and link status, and calculate the increment of the current difference in the number of packets sent and received by the switch compared with the calculation in the previous cycle. Define the switch with the largest increment as the abnormal switch;

[0008] Step 1.2: By tracking the sent sample packets and calculating the periodicity and duration of the phenomenon that the link generates sample packets lost more than 5 times in a row within the detection period, the minimum periodicity and maximum duration of the abnormal packet loss phenomenon are defined as the suspected attack period and the suspected attack duration respectively;

[0009] Step 1.3: Set the incremental difference of the number of packets sent and received by the switch and the periodic degree of abnormal packet loss on the link as alarm features. Based on the multi-threshold single response strategy, if the incremental difference of the number of packets sent and received by the switch and the periodic degree of abnormal packet loss on the link all exceed the set trigger threshold within a detection cycle, an alarm will be issued immediately. If only a single threshold is triggered, after waiting for a new detection cycle to end, an alarm will be issued regardless of whether another threshold is triggered.

[0010] Step 2: Attack determination and threshold correction;

[0011] Step 2.1: Based on the suspected attack period, modify the traffic capture window size to be consistent with the suspected attack period, and use the controller to capture UDP traffic of the abnormal switch;

[0012] Step 2.2: On the premise of preserving the logical relationship in the time dimension, the traffic captured in step 2.1 is merged into multiple new flows according to the different outflow ports, and sliced ​​and binary clustered in order from small to large according to the number of data packets contained in each new flow;

[0013] Step 2.3: Based on the clustering results of step 2.2, determine whether an LDoS attack has occurred according to the bidirectional detection criteria; and modify the trigger threshold in step 1 accordingly based on the result to ensure the effectiveness of the threshold; if an LDoS attack is successfully detected, the threshold that has not been triggered in step 1 is adjusted in a coarse-grained manner, otherwise the threshold that has been triggered in step 1 is adjusted in a fine-grained manner;

[0014] The bidirectional detection criterion specifically comprises the following steps:

[0015] Step 2.3.1, for the two types of slices after clustering, by calculating the average eigenvalue of each category, the slice belonging to the category of slices with higher eigenvalue is defined as an abnormal slice, and the other type of slice is defined as a normal slice;

[0016] Step 2.3.2, connect the slices end to end, and determine whether all abnormal slices are continuous and whether the proportion of abnormal slices in all slices is less than 10% of the proportion of the suspected attack duration determined in step 1 in the suspected attack period;

[0017] Step 2.3.3: If the conditions in step 2.3.2 are met, it is determined that the device has been attacked by LDoS, and the suspected target IP is redefined as the target IP. Otherwise, it is determined that the device has not been attacked by LDoS.

[0018] The slicing and clustering are specifically as follows: first, the destination IP with the largest proportion is defined as the suspected attack destination IP, and the new flow is sliced ​​in the time dimension with a slicing interval of 0.1s. Then, based on the number and proportion of data packets with the destination IP as the suspected attack destination IP in each slice, if these two feature values ​​are significantly different in different slices, that is, the standard deviation is greater than half of the mean, the K-means clustering algorithm is used for binary clustering, otherwise all slices are set as normal slices;

[0019] Step 3: Temporary relief and source isolation;

[0020] Step 3.1: According to the destination IP with the largest proportion in the new flow containing LDoS attack, locate the inbound port, outbound port, and attack destination IP of the LDoS attack flow, and use them as the matching domain of the flow table to send a temporary mitigation flow table to the abnormal switch;

[0021] The mitigation flow table has the highest priority, the matching domain includes the attack inflow port, attack destination IP, UDP protocol type, and the action is discard;

[0022] Step 3.2: The upstream device is located by continuously passing the switch ID to be traced and the port on the switch that sends the largest number of packets that match the attack characteristics to the traceability table. When the upstream device is a host, an isolation flow table is sent to the switch to which the host is connected.

[0023] The isolation flow table has the highest priority, and the matching domain includes the attack inflow port, attack destination IP, and UDP protocol type, and the action is to discard.

[0024] The traceability table is a traceability table containing the mapping relationship between the current switch ID, the input end and the corresponding upstream switch ID, which is constructed based on the link layer discovery protocol packet by detecting the neighboring network topology of the target switch; the corresponding upstream switch ID can be obtained by passing in the current switch ID and the current input end;

[0025] Step 3.3: Delete the temporary mitigation flow table issued in step 3.1;

[0026] Step 4: Continuous monitoring and flow table management; when a host under LDoS attack is isolated, the flow table cookie, attack rate, and abnormal switch ID of the host when it is isolated will be added to the monitoring table, and the trusted number will be set to 0 and the number of recidivisms will be set to 1. Then, the average packet sending rate of the flow table corresponding to the flow table cookie in the previous period will be calculated regularly. If the packet sending rate is lower than half of the rate at the time of recording, the trusted number will be increased by 1, otherwise the trusted number will be set to 0 and the number of recidivisms will be increased by 1; for isolated flow tables with a trusted number between 0 and 18 times the number of recidivisms, the isolated state will be maintained. If the trusted number is between 19 and 24 times the number of recidivisms, the communication restrictions in the corresponding isolated flow table will be lifted and pre-detection will be provided to prevent the host corresponding to this type of flow table from launching LDoS attacks again during this period. For flow tables with a trusted number exceeding 24 times the number of recidivisms, the corresponding flow table will be directly deleted;

[0027] The pre-detection strategy provided in step 4 for the LDoS attack host that has released the communication restrictions will be executed after receiving the warning signal, which specifically includes two steps:

[0028] Step 4.1, query whether there is an entry in the monitoring table that is in a communication-allowed state and whose corresponding abnormal switch ID is consistent with the abnormal switch ID provided in the alarm signal;

[0029] Step 4.2: If it exists, immediately perform a monitoring action on the table entry, that is, calculate its packet sending rate. If the packet sending rate of the host is abnormal, immediately update its trusted times and recidivism times, execute the corresponding flow table strategy and provide feedback.

[0030] The beneficial effects of adopting the above technical solution are:

[0031] The present invention provides a bidirectional detection and source tracing defense method for LDoS attacks in SDN. The method fully utilizes the three-dimensional characteristics of LDoS attacks during detection, has lower comprehensive consumption and higher accuracy without the need for additional equipment and training costs, and a strategy based on outbound convergence can reduce the amount of data processing and reduce misjudgment. The addition of adaptive threshold correction and multi-threshold single response strategy also makes the detection scheme more universal. For complex LDoS attack models including IP spoofing, the adopted source tracing defense strategy can also achieve complete isolation of LDoS attackers. By coordinating with the monitoring strategy, not only the distribution of flow tables used for defense is dispersed, but also the flow table overflow attack can be effectively prevented from being exploited. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] Figure 1 It is an information transmission diagram of an embodiment of the present invention;

[0033] Figure 2 is a flow chart of a method according to an embodiment of the present invention;

[0034] Figure 3 This is a graph showing the incremental difference in the number of packets sent and received by an abnormal switch during information collection and targeted inspection under different LDoS attack parameters in an embodiment of the present invention;

[0035] Figure 4 This is a graph showing the correlation between the number of detections and actual errors in information collection and targeted inspection under different LDoS attack parameters in an embodiment of the present invention;

[0036] in, Figure 4 (a) is the error diagram between the suspected attack period and the actual attack period obtained under different detection times. Figure 4 (b) is the error diagram between the suspected attack duration and the actual attack duration obtained under different detection times;

[0037] Figure 5 A flow comparison diagram of the outlet confluence and the inlet confluence of an embodiment of the present invention;

[0038] Figure 6 This is a diagram showing the remaining percentage of normal TCP traffic in a network when it is attacked by LDoS according to an embodiment of the present invention;

[0039] in Figure 6 (a) is a graph showing the remaining percentage of normal TCP traffic without deploying the present invention. Figure 6 (b) is a graph showing the remaining percentage of normal TCP traffic after the present invention is deployed;

[0040] Figure 7 This is a graph showing the remaining percentage of normal TCP traffic in a network when the network is attacked by LDoS using IP spoofing according to an embodiment of the present invention;

[0041] in Figure 7 (a) is a graph showing the remaining percentage of normal TCP traffic without adopting the source tracing isolation strategy of the present invention. Figure 7 (b) is a graph showing the remaining percentage of normal TCP traffic using the source tracing isolation strategy of the present invention. DETAILED DESCRIPTION

[0042] The specific implementation of the present invention is further described in detail below in conjunction with the accompanying drawings and examples. The following examples are used to illustrate the present invention, but are not intended to limit the scope of the present invention.

[0043] A bidirectional detection and tracing defense method for LDoS attacks in SDN, such as Figure 1 As shown in the figure, the detection and defense method of LDoS attack mainly includes four parts from the functional point of view: targeted inspection, attack adjudication, source tracing and isolation, and continuous monitoring. The triggering conditions and specific processes of each part are as follows: Figure 2 As shown. Specifically including the following steps:

[0044] 1. Targeted inspection. Targeted inspection starts with the switch and link status to conduct preliminary detection of the characteristics of LDoS attacks, such as Figure 3 , Figure 4 As shown, Figure 4 (a) shows the error diagram between the suspected attack period and the actual attack period obtained under different detection times. Figure 4 (b) shows the error diagram between the suspected attack duration and the actual attack duration obtained under different detection times; whether it is the switch status or the link status, it can well reflect the negative impact of the LDoS attack, which is specifically divided into two parts: information collection and targeted inspection, with a total of four steps.

[0045] 1) Use the OpenFlow protocol to periodically send port status query requests to the switch. After receiving the feedback, sum the number of incoming and outgoing packets of each port, and then subtract the absolute value of the difference between the two from the previous calculation result to obtain one of the characteristics of the targeted inspection alarm, Pci x The calculation formula is as follows, where Pki x Pko is the total number of packets received by each port at the xth statistical moment, x is the total number of packets sent from each port at that moment, ΔPk x This is the difference in the number of packets sent and received by the switch.

[0046] ΔPk x =|Pki x -Pko x |

[0047] Pc x =|ΔPk x -ΔPk x-1 |

[0048] 2) Send sample packets at intervals and track them. If the sample packets cannot reach the destination within the specified range, it is considered that the sample packets are lost. If the sample packets are lost five times in a row within a short period of time, and this phenomenon has a certain periodicity, it means that the link may be abnormal. The periodicity is Plc x The calculation formula is as follows, where Q x T is the starting timestamp of the xth packet loss statistics. x This is the estimated period of packet loss.

[0049] T x =Q x+1 -Q x

[0050]

[0051] 3) Based on sample tracking, the suspected attack period SP and the suspected attack duration SD are estimated, where the former is the minimum value in the estimated period set T when Plc is satisfied, and the latter can be estimated by the packet sending interval and the number of packet losses of the sample packets. The specific formula is as follows, where Y is the threshold of the period degree, E x is the timestamp of the xth packet loss, J is the sample packet sending interval, P c is the number of sample packets lost.

[0052]

[0053] SD=Max{(E x -Q x ),(J.P c )}

[0054] 4) If the above Pci x With Plc x If all of them are abnormal, that is, all exceed the set threshold, an alarm will be given immediately; if only one of them is abnormal, an alarm will be given in the next detection cycle regardless of whether the other state is abnormal.

[0055] 2. Attack determination. Attack determination mainly includes two parts: attack determination and threshold correction. Specifically, it can be divided into four steps: data collection, data processing, attack determination, and threshold correction.

[0056] 1) Data collection: Change the capture window size for collecting UDP traffic to the attack period, and collect the required traffic information by sending flow tables: arrival time, inbound port, outbound port, and destination IP.

[0057] 2) Data processing: Based on the arrival time, the data packets are re-converged according to their outflow ports, and each new flow is sliced ​​in 0.1s increments in the time dimension from small to large according to the number of data packets contained. Figure 5 As shown in the figure, due to the limitation of bottleneck link bandwidth, selecting the output end with the least number of UDP packets can often more quickly determine the port through which the attack flow flows, without having to process other irrelevant traffic.

[0058] 3) Attack judgment: In order to accurately determine whether it is under LDoS attack, first define the destination IP with the largest proportion as the suspected attack destination IP, then count the data packets containing the suspected attack destination IP in each slice and calculate the proportion. To determine whether a certain flow contains attack traffic, the following three points must be met: First, the proportion of UDP packets and attack destination IP in the abnormal slice is greater than that in the non-abnormal slice; second, when the slices are connected head to tail, the abnormal slices should be continuous; third, the proportion of abnormal slices should basically match the proportion of continuity, as shown in the following formula, where n is the total number of slices, is the proportion of suspected attack target IPs in the kth slice.

[0059]

[0060] 4) Threshold correction: Based on the ruling results, the two thresholds of targeted inspections will be adjusted accordingly according to the table below.

[0061]

[0062] 3. Source tracing and isolation. Source tracing and isolation requires locating the attacker's reverse flow on the basis of ensuring the rapid recovery of the current network anomaly, and issuing a more accurate isolation flow table nearby to achieve the defense purpose of source tracing and isolation. It is specifically divided into two parts: temporary relief and source tracing and isolation, which includes three steps in total:

[0063] 1) Attack flow positioning: Based on the attack target IP determined in the attack adjudication part, the input end that sends the most data packets that meet this feature is defined as the attack input end. The total number of source IPs of data packets sent from the attack input end to the attack output end and whose destination IP is the attack target IP is counted to see if they basically match the number and proportion of the attack target IPs. If so, the source IP is defined as the attack source IP. Otherwise, it is considered that the attack source IP has not been successfully obtained.

[0064] 2) Temporary mitigation: Set the matching domain according to the attack input end, attack output end, attack destination IP, and attack source IP (if successfully obtained), and send the mitigation flow table with a priority of 65535 and an action of discarding to the current abnormal switch; through mitigation, such as Figure 6 As shown, normal TCP traffic in the network can be quickly restored. Figure 6 (a) shows the remaining percentage of normal TCP traffic without deploying the present invention, Figure 6 (b) shows the remaining percentage of normal TCP traffic after the present invention is deployed;

[0065] 3) Source tracing and isolation: Based on the current switch ID and the attack input end, the corresponding upstream table entry is searched in the source tracing table to determine the upstream switch ID and define it as a new abnormal switch. The flow table with the matching domain as the attack flow feature is sent to the upstream switch to locate the maximum packet sending end as the new attack input end; the above operation is repeated until the upstream switch ID cannot be found, that is, the attack host has been successfully located, and the switch to which it is connected is sent an isolation flow table with a matching domain including the inbound port, the attack destination IP, and the UDP protocol type, so as to achieve complete port-level isolation and delete the temporary relief flow table to achieve the purpose of source tracing defense; Figure 7 As shown, Figure 7 (a) shows the remaining percentage of normal TCP traffic without adopting the source tracing isolation strategy of the present invention. Figure 7(b) shows the remaining percentage of normal TCP traffic using the source tracing isolation strategy of the present invention. Compared with not using source tracing isolation, source tracing isolation can effectively deal with IP spoofing.

[0066] 4. Continuous monitoring. Continuous monitoring aims to continuously monitor the isolated attack hosts to ensure that each existing isolated flow table has practical value and significance. It includes two parts: continuous monitoring and flow table management, a total of four steps:

[0067] 1) Information recording. Whenever an attacking host is isolated, the monitoring part will record the cookie, attack rate, and abnormal switch ID of the isolated flow table into the monitoring table, and set the number of trusted times to 0 and the number of recidivisms to 1 as the basis for subsequent policy adjustments.

[0068] 2) Attack detection. Every time a long period of time passes, the flow table status query command will be used to query the status of the flow table in the monitoring table. Based on the feedback received, the rate of sending data packets during the period is calculated. If the rate is not greater than half of the attack rate during the recording, it is considered that the attacking host did not launch an attack at the last moment, and the corresponding trusted number is increased by one; otherwise, the number of repetitions is increased by one and the trusted number is reset to zero.

[0069] 3) Strategy adjustment. According to the number of trusted times and the number of recidivisms, the present invention divides each attack host into three states: attack state, silent state, and offline state. The flow table strategy corresponding to the host in each state is as follows.

[0070]

[0071] 4) Attack pre-check. In order to prevent attackers from escaping by adjusting policies in continuous monitoring, for offline hosts, when receiving an alert from targeted inspection, this part will immediately perform an attack detection and policy adjustment on all attack hosts that are offline and match the abnormal switch IDs provided by the targeted inspection. If an offline host is found to have committed the offense again, the host will be immediately isolated and subsequent operations will be prevented from being executed to reduce unnecessary consumption.

[0072] The above description is only a preferred embodiment of the present disclosure and an explanation of the technical principles used. Those skilled in the art should understand that the scope of the invention involved in the embodiments of the present disclosure is not limited to the technical solutions formed by a specific combination of the above-mentioned technical features, but should also cover other technical solutions formed by any combination of the above-mentioned technical features or their equivalent features without departing from the above-mentioned inventive concept. For example, the above-mentioned features are replaced with the technical features with similar functions disclosed in the embodiments of the present disclosure (but not limited to) to form a technical solution.

Claims

1. A bidirectional detection and tracing defense method for LDoS attacks in SDN, characterized in that: The following steps are involved: Step 1: Information collection and targeted inspection; Step 2: Attack determination and threshold correction; Step 3: Temporary relief and source isolation; Step 4: Continuous monitoring and flow table management.

2. According to claim 1, a bidirectional detection and tracing defense method for LDoS attacks in SDN is characterized in that: The step 1 specifically comprises the following steps: Step 1.1: Regularly poll the switch and link status, and calculate the increment of the current difference in the number of packets sent and received by the switch compared with the calculation in the previous cycle. Define the switch with the largest increment as the abnormal switch; Step 1.2: By tracking the sent sample packets and calculating the periodicity and duration of the phenomenon that the link generates sample packets lost more than 5 times in a row within the detection period, the minimum periodicity and maximum duration of the abnormal packet loss phenomenon are defined as the suspected attack period and the suspected attack duration respectively; Step 1.3: Set the incremental difference between the number of packets sent and received by the switch and the periodic degree of abnormal packet loss on the link as alarm features. Based on the multi-threshold single response strategy, if the incremental difference between the number of packets sent and received by the switch and the periodic degree of abnormal packet loss on the link all exceed the set trigger threshold within a detection cycle, an alarm will be issued immediately. If only a single threshold is triggered, after waiting for a new detection cycle to end, an alarm will be issued regardless of whether the other threshold is triggered.

3. According to claim 1, a bidirectional detection and tracing defense method for LDoS attacks in SDN is characterized in that: The step 2 specifically includes the following steps: Step 2.1: Based on the suspected attack period, modify the traffic capture window size to be consistent with the suspected attack period, and use the controller to capture UDP traffic of the abnormal switch; Step 2.2: On the premise of preserving the logical relationship in the time dimension, the traffic captured in step 2.1 is merged into multiple new flows according to the different outflow ports, and sliced ​​and binary clustered in order from small to large according to the number of data packets contained in each new flow; Step 2.3: Based on the clustering results of step 2.2, determine whether an LDoS attack has occurred according to the bidirectional detection criteria; and modify the trigger threshold in step 1 accordingly based on the result to ensure the effectiveness of the threshold; if an LDoS attack is successfully detected, the threshold that was not triggered in step 1 is adjusted in a coarse-grained manner, otherwise the threshold that was triggered in step 1 is adjusted in a fine-grained manner.

4. According to claim 3, a bidirectional detection and tracing defense method for LDoS attacks in SDN is characterized in that: The bidirectional detection criteria in step 2.3 specifically include the following steps: Step 2.3.1, for the two types of slices after clustering, by calculating the average eigenvalue of each category, the slice belonging to the category of slices with higher eigenvalue is defined as an abnormal slice, and the other type of slice is defined as a normal slice; Step 2.3.2, connect the slices end to end, and determine whether all abnormal slices are continuous and whether the proportion of abnormal slices in all slices is less than 10% of the proportion of the suspected attack duration determined in step 1 in the suspected attack period; Step 2.3.3: If the conditions in step 2.3.2 are met, it is determined that the attack is under LDoS attack, and the suspected attack target IP is redefined as the attack target IP; otherwise, it is determined that the attack is not under LDoS attack; The slicing and clustering are specifically as follows: first, the destination IP with the largest proportion is defined as the suspected attack destination IP, and the new flow is sliced ​​in the time dimension with a slicing interval of 0.1s. Then, based on the number and proportion of data packets whose destination IP is the suspected attack destination IP in each slice, if these two feature values ​​are significantly different in different slices, that is, the standard deviation is greater than half of the mean, the K-means clustering algorithm is used for binary clustering, otherwise all slices are set to normal slices.

5. According to claim 1, a bidirectional detection and tracing defense method for LDoS attacks in SDN is characterized in that: The step 3 specifically comprises the following steps: Step 3.1: According to the destination IP with the largest proportion in the new flow containing LDoS attack, locate the inbound port, outbound port, and attack destination IP of the LDoS attack flow, and use them as the matching domain of the flow table to send a temporary mitigation flow table to the abnormal switch; The mitigation flow table has the highest priority, the matching domain includes the attack inflow port, attack destination IP, UDP protocol type, and the action is discard; Step 3.2: The upstream device is located by continuously passing the switch ID to be traced and the port on the switch that sends the largest number of packets that match the attack characteristics to the traceability table. When the upstream device is a host, an isolation flow table is sent to the switch to which the host is connected. The isolation flow table has the highest priority, the matching domain includes the attack inflow port, attack destination IP, UDP protocol type, and the action is discard; The traceability table is a traceability table containing the mapping relationship between the current switch ID, the input end and the corresponding upstream switch ID, which is constructed based on the link layer discovery protocol packet by detecting the neighboring network topology of the target switch; the corresponding upstream switch ID can be obtained by passing in the current switch ID and the current input end; Step 3.3: Delete the temporary mitigation flow table issued in step 3.

1.

6. According to claim 1, a bidirectional detection and tracing defense method for LDoS attacks in SDN is characterized in that: The step 4 is specifically as follows: when a host under LDoS attack is isolated, the flow table cookie, attack rate, and abnormal switch ID of the host when it is isolated are first added to the monitoring table, and the trusted number is set to 0 and the number of recidivisms is set to 1. Then, the average packet sending rate of the flow table corresponding to the flow table cookie in the previous period is regularly calculated. If the packet sending rate is lower than half of the rate when recorded, the trusted number is increased by 1, otherwise the trusted number is set to 0 and the number of recidivisms is increased by 1; for isolated flow tables with a trusted number between 0 and 18 times the number of recidivisms, the isolated state will be maintained; if the trusted number is between 19 and 24 times the number of recidivisms, pre-detection will be provided while the communication restrictions in the corresponding isolated flow table are lifted to prevent the host corresponding to this type of flow table from launching an LDoS attack again during this period; for flow tables with a trusted number exceeding 24 times the number of recidivisms, the corresponding flow table will be directly deleted.

7. A bidirectional detection and tracing defense method for LDoS attacks in SDN according to claim 6, characterized in that: The pre-detection strategy provided in step 4 for the LDoS attack host that has released the communication restriction will be executed after receiving the warning signal, which specifically includes two steps: Step 4.1: Check whether there is an entry in the monitoring table that is in a communication-allowed state and whose corresponding abnormal switch ID is consistent with the abnormal switch ID provided in the alarm signal; Step 4.2: If it exists, immediately perform a monitoring action on the table entry, that is, calculate its packet sending rate. If the packet sending rate of the host is abnormal, immediately update its trusted times and recidivism times, execute the corresponding flow table strategy and provide feedback.

Images