SDN (Software Defined Network) low-speed flow table overflow attack active defense method based on time hopping
By dynamically adjusted the timeout and smooth adjustment mechanism of the SDN stream meter item, it solved the problem of insufficient defense of the SDN system in low -speed flow overflow attacks, and realized the rapid response of abnormal traffic and the balance of resource utilization.
Patent Information
- Application Number
- CN202411505652.0
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-10-28
- Publication Date
- 2025-01-28
AI Technical Summary
The existing SDN system is difficult to effectively defend against low-speed flow table overflow attacks, and the existing detection methods have problems of insufficient generalization capabilities and time delay.
By monitoring the Packet_in event rate, dynamically adjust the timeout of the flow table, combined with the weighted moving average method of the index to make smooth adjustment to prevent the flow meter from overflowing, and reset the default timeout time when the network traffic is restored.
Effectively respond to the overflow of low -speed flow meters, reduce the occupation of stream meter resources, improve the anti -attack capacity of the controller, avoid waste of resources, and ensure the continuous and stable operation of the network.
Smart Images
Figure CN119382974A_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the field of network security, and in particular to an active defense method for SDN low-speed flow table overflow attacks based on time hopping. Background Art
[0002] SDN switches are data plane devices without management functions. They rely on instructions (also called flow table entries) from a centralized controller in the control plane to manage flows. SDN switches use flow tables to store flow table entries to match and process traffic. A flow table consists of multiple flow table entries, and each flow table entry consists of multiple fields, such as source IP address, destination IP address, source port number, destination port number, etc. When a packet arrives at an SDN switch, the switch matches the packet with the flow table entries in the flow table. If a match is found, the packet is processed according to the action specified in the flow table entry. Otherwise, the packet is forwarded to the SDN controller to obtain a new flow table entry based on the network policy.
[0003] The SDN controller assigns a timeout to each flow table entry, dynamically adjusts the life cycle of the flow table entry, and optimizes the use of the flow table space. Although this timeout setting optimizes the use of the flow table space, there are still certain security vulnerabilities that may be exploited by attackers. If attackers understand the capacity limit of the flow table and the timeout setting of each flow table entry, they can carefully design data packets so that each data packet triggers the installation of new flow rules. When the flow table entry has not expired, the attacker fills the flow table space by sending a sufficient number of attack data packets and sends the same data packet again before each flow table entry is about to expire. By sending attack data packets periodically in this way, the attacker can occupy the flow table resources for a long time, thereby achieving a low-speed flow table overflow attack.
[0004] Since the current mainstream SDN controllers have a unified static setting for the effective time of all flow table entries in terms of granularity, type, and duration, attackers can easily detect changes in the round-trip delay of the link by continuously sending ICMP packets, thereby inferring the effective time of the flow table entries. In addition, the flow table capacity can also be combined and detected by the front-end mixed detection method to obtain accurate capacity information. Therefore, attackers can easily synchronize the attack cycle with the effective time of the flow table entries. This attack method is covert and highly destructive, posing a severe challenge to the security of SDN.
[0005] Existing flow table overflow attack detection schemes generally use machine learning algorithms to identify potential attack activities by analyzing traffic characteristics. However, since the long flow characteristics in low-speed flow table overflow attacks are similar to the data flows of sensor devices in the Internet of Things (IoT) environment, and the short flow characteristics in the attack are similar to the short-lived data flows (also known as "rat flows") commonly seen in the network, detection methods that rely on machine learning models face challenges in generalization. In addition, another type of detection method identifies low-speed flow table overflow attacks by monitoring the overall characteristic changes of the network after being attacked. Although this method can improve detection accuracy, it usually has a time delay, which limits its effectiveness in attack warning and makes it mainly used for attack mitigation rather than prevention. Current defense strategies mainly focus on optimizing resource management to deal with flow table overflow caused by burst traffic. However, these resource management-based strategies often perform poorly against persistent and hidden low-speed flow table overflow attacks. Summary of the invention
[0006] The purpose of the present invention is to provide an active defense method for SDN low-speed flow table overflow attacks based on time hopping in view of the deficiencies of the prior art. This method can quickly respond to attacks and adjust network policies while consuming CPU resources lightly, effectively enhancing the security of the SDN system and its defense capability against low-speed flow table overflow attacks.
[0007] The technical solution for achieving the purpose of the present invention is:
[0008] An active defense method for SDN low-speed flow table overflow attack based on time jump includes the following steps: 1) the controller monitors the packet_in event rate: the controller continuously monitors the rate of the packet_in event, and if the rate of a packet_in event is greater than 0, the controller dynamically adjusts the timeout time of the issued flow table entry according to the monitored rate;
[0009] 2) Calculation of attacker detection timeout: Based on the real-time measured rate of packet_in events, reversely calculate the default timeout T measured by the attacker. a , according to T a ,The controller can dynamically adjust the timeout of flow table entries and formulate corresponding defense measures;
[0010] 3) Calculate the adjusted flow entry timeout: The controller calculates the default timeout T measured by the attacker in step 2) a , set the idle timeout of the flow entry to less than T a The value of is the adjusted flow table entry timeout time, which reduces the effectiveness of the flow table entry during the attack period, thereby reducing the occupancy rate of the flow table and preventing the flow table from overflowing.
[0011] 4) Smoothly adjust the flow entry timeout: According to the adjusted flow entry timeout in step 3), apply the exponentially weighted moving average method according to the currently calculated flow entry timeout T new Timeout time T of the previous round of flow entries last , calculate a final flow entry timeout T that makes the transition smoother out , to avoid excessive fluctuations in the timeout adjustment and make the adjustment process smoother;
[0012] 5) Reset the default flow entry timeout: If the packet_in event rate in the controller remains at 0 for a period of time, the flow entry timeout is reset to the default value. This effectively ensures that after the network traffic returns to normal, the flow entry timeout returns to a normal level that can ensure normal traffic processing. At the same time, it avoids the situation where the flow entry timeout is too low due to the secondary impact of a low-speed flow table overflow attack, thereby better maintaining the stability and security of the network.
[0013] Furthermore, the controller monitors and records the number of occurrences of packet_in events per second, which is recorded as R.
[0014] Furthermore, the inferred calculation process of the timeout time detected by the attacker is expressed as:
[0015] T a =C / R
[0016] Where C is the flow table capacity of the switch, R is the number of packet_in events per second, and T a Indicates the default timeout period for attacker detection.
[0017] Furthermore, the calculation formula of the adjusted flow entry timeout is expressed as:
[0018] T d =T a ·ε
[0019] Where T d is the adjusted flow entry timeout, T a It represents the default timeout period detected by the attacker, and ε is a decay coefficient in the range of (0,1).
[0020] Furthermore, the calculation formula for smoothly adjusting the flow entry timeout period is expressed as:
[0021] T out =α*T new +(1-α)*T last
[0022] Where T outis the flow entry timeout time that should be adjusted in the end, T new Indicates the current calculated flow entry timeout that should be adjusted, T last is the timeout period of the flow entry adjusted in the previous round, and α is the weighting coefficient, which is usually set to a value between 0 and 1.
[0023] Beneficial effects of this technical solution:
[0024] This technical solution mainly dynamically adjusts the flow table item timeout time through the change of the Packet-in event rate, which can effectively deal with low-speed flow table overflow attacks and avoid the exhaustion of flow table resources. The dynamic adjustment mechanism enables the controller to shorten the flow table item timeout time in time when an attack occurs, reduce resource usage, and improve the controller's anti-attack ability. Secondly, when the network traffic returns to normal, the mechanism of resetting the default timeout time ensures that the timeout time of the flow table item is restored to the most appropriate level, avoiding unnecessary waste of resources. At the same time, this technical solution can also prevent the impact of secondary attacks after a low-speed flow table overflow attack, and ensure the continuous and stable operation of the network. On the whole, this solution improves the adaptability and defense capabilities of the network controller to abnormal traffic, and achieves a balance between resource utilization and security.
[0025] This method can quickly respond to attacks and adjust network policies while consuming CPU resources lightly, effectively enhancing the security of the SDN system and its defense capabilities against low-speed flow table overflow attacks. BRIEF DESCRIPTION OF THE DRAWINGS
[0026] Figure 1 It is an overall flow chart of the embodiment;
[0027] Figure 2 Schematic diagram of the attack data packet sending process of the low-speed flow table overflow attack in the embodiment;
[0028] Figure 3 The graph of the change of flow table occupancy rate when the controller adopts the default timeout time and the timeout time strategy dynamically adjusted based on the packet_in rate to deal with the attack in the embodiment;
[0029] Figure 4 The graph is a CPU occupancy rate change curve of the controller when the embodiment adopts the strategy of dynamically adjusting the timeout period based on the packet_in rate to deal with the attack. DETAILED DESCRIPTION
[0030] The content of the present invention is further described below in conjunction with the drawings and embodiments, but the present invention is not limited thereto.
[0031] Example:
[0032] Reference Figure 1, an active defense method for SDN low-speed flow table overflow attack based on time hopping, comprising the following steps:
[0033] 1) The controller monitors the packet_in event rate: The controller continuously monitors the packet_in event rate. If the packet_in event rate is greater than 0, the controller dynamically adjusts the timeout period of the issued flow table entry based on the monitored rate.
[0034] Specifically, this example uses the eventlet module to implement asynchronous monitoring processing to start a new coroutine and periodically check the rate of packet_in events in the coroutine, so that the controller application main program can continue to execute without being blocked by the monitored coroutine. In this example, the number of packet_in events that appear is set to be checked periodically every 1 second, denoted as R;
[0035] 2) Calculation of attacker detection timeout: Based on the real-time measured rate of packet_in events, reversely calculate the default timeout T measured by the attacker. a , according to T a ,The controller can dynamically adjust the timeout of flow table entries and formulate corresponding defense measures;
[0036] Since the attacker of a low-speed flow table overflow attack always needs to first detect the switch capacity and flow table entry timeout of the attacked network and calculate the minimum attack packet sending rate that can overflow the flow table, and then continue to overflow the flow table by periodically sending attack packets. Assume that the attacker evenly distributes the attack packets in each cycle, such as Figure 2 As shown, the number of attack packets sent per second R can be calculated using the formula R = C / T a Calculate, where C is the flow table capacity of the switch, T a In this example, the number of packet_in events that occur in the monitoring controller per second is used to replace the number of attack packets R sent by the attacker per second. At this time, the formula T a =C / R Calculate the timeout time T detected by the attacker a ;
[0037] 3) Calculate the adjusted flow entry timeout: The controller calculates the default timeout T measured by the attacker in step 2) a , set the idle timeout of the flow entry to less than T a The value of is the adjusted flow table entry timeout time, which reduces the effectiveness of the flow table entry during the attack period, thereby reducing the occupancy rate of the flow table and preventing the flow table from overflowing.
[0038] The calculation formula for the adjusted flow entry timeout is expressed as:
[0039] T d =T a ·ε
[0040] Where T d is the flow entry timeout time that should be adjusted, T a Indicates the default timeout value detected by the attacker. ε is a decay coefficient with a range of (0,1). In this example, ε is 0.5. If the monitored packet_in rate is 0, the timeout remains set to the default value of 5s.
[0041] 4) Smoothly adjust the flow entry timeout: According to the adjusted flow entry timeout in step 3), apply the exponentially weighted moving average method according to the currently calculated flow entry timeout T new Timeout time T of the previous round of flow entries last , calculate a final flow entry timeout T that makes the transition smoother out , to avoid excessive fluctuations in the timeout adjustment and make the adjustment process smoother;
[0042] The calculation formula for smoothly adjusting the flow entry timeout is expressed as:
[0043] T out =α*T new +(1-α)*T last
[0044] Where T out is the flow entry timeout time that should be adjusted in the end, T new Indicates the current calculated flow entry timeout that should be adjusted, T last is the timeout time of the flow table item adjusted in the last round, α is the weighting coefficient, which is usually set to a value between 0 and 1. In this example, α is 0.5. In addition, in this example, the source code of the openvswitch switch is modified to make the timeout time of the flow table item sent by the ryu controller accurate to the millisecond level. In this example, the timeout time of the flow table item finally output after adjustment is accurate to the 0.1s level. Such high-precision adjustment not only helps to control the life cycle of the flow table item more finely, but also can more effectively deal with low-speed flow table overflow attacks. At the same time, this smooth adjustment method can effectively alleviate the sharp changes in the timeout time caused by traffic mutations, thereby improving the stability and response speed of the controller.
[0045] 5) Reset the default flow entry timeout: If the packet_in event rate in the controller remains at 0 for a period of time, the flow entry timeout is reset to the default value. This effectively ensures that after the network traffic returns to normal, the flow entry timeout returns to a normal level that can ensure normal traffic processing. At the same time, it avoids the situation where the flow entry timeout is too low due to the secondary impact of a low-speed flow table overflow attack, thereby better maintaining the stability and security of the network.
[0046] This example implements dynamic adjustment of the flow table entry timeout in the coroutine that monitors the packet_in event rate to cope with potential multiple low-speed flow table overflow attacks. The coroutine loops every 1 second. If the packet_in event rate is zero during this cycle, the reset flag no_packet is incremented. When no_packet reaches the preset threshold (set to 2 in this example), the controller resets the flow table entry timeout to the default value of 5 seconds to restore normal status. The core of this mechanism is that when the packet_in rate increases again, the controller can respond quickly and adjust the timeout, thereby preventing another attack within a short period of time after the first attack stops. By dynamically adjusting the flow table entry timeout, while ensuring normal communication, it effectively resists multiple low-speed flow table overflow attacks and enhances the robustness of the network.
[0047] This example verifies the performance of the method in this example by comparing the occupancy rate of the flow table in the switch when the defense is not enabled and when the defense is enabled. Figure 3 The curves of flow table occupancy changes during a low-speed flow table overflow attack are shown under two different settings, namely, the controller uses the default timeout setting and the flow table entry timeout strategy based on the packet_in rate to dynamically adjust the flow table entry timeout. The results show that under the default settings, the flow table occupancy will gradually rise to 100%. However, when the dynamic adjustment strategy based on the packet_in rate is adopted, in the face of a low-speed flow table overflow attack, the flow table occupancy will quickly rise to 60% in the early stage, and then quickly drop to about 10%, and fluctuate slightly in the range of 10% to 20% during the subsequent attack. This shows that the dynamic adjustment strategy based on the packet_in rate can effectively maintain the flow table occupancy at a low level during the entire LDoS attack process, showing an excellent defense effect.
[0048] In addition, this example also evaluates the resource consumption of this method by measuring the controller CPU usage. Figure 4 As shown in the figure, during the attack, the controller CPU usage of this method fluctuates mainly between 15% and 30%, indicating that its resource consumption is at a lightweight level. In summary, the method proposed in this example not only performs well in defending against LDoS attacks, but also has relatively light resource consumption.
Claims
1. An active defense method for SDN low-speed flow table overflow attack based on time hopping, characterized in that: The steps include: 1) The controller monitors the packet_in event rate: The controller continuously monitors the packet_in event rate. If the rate of a packet_in event is greater than 0, the controller dynamically adjusts the timeout of the issued flow table entry based on the monitored rate. 2) Calculation of attacker detection timeout: Based on the real-time measured rate of packet_in events, reversely calculate the default timeout T measured by the attacker. a , based on the calculated T a ,The controller can dynamically adjust the timeout of flow table entries and formulate corresponding defense measures; 3) Calculate the adjusted flow entry timeout: The controller calculates the default timeout T measured by the attacker in step 2) a , set the idle timeout of the flow entry to less than T a The value of is the adjusted flow table entry timeout time, which reduces the effectiveness of the flow table entry during the attack period, thereby reducing the occupancy rate of the flow table and preventing the flow table from overflowing. 4) Smoothly adjust the flow entry timeout: According to the adjusted flow entry timeout in step 3), apply the exponentially weighted moving average method according to the currently calculated flow entry timeout T new Timeout time T of the previous round of flow entries last , calculate a final over-smoothing flow entry timeout T out , avoid excessive fluctuations in the timeout adjustment and make the adjustment process smooth; 5) Reset the default flow entry timeout: If the packet_in event rate in the controller remains at 0 for a period of time, reset the flow entry timeout to the default value to ensure that after the network traffic returns to normal, the flow entry timeout returns to a normal level that can ensure normal traffic processing. At the same time, avoid the situation where the flow entry timeout is too low due to the secondary impact of a low-speed flow table overflow attack, thereby maintaining the stability and security of the network.
2. According to the time-hopping-based SDN low-speed flow table overflow attack active defense method of claim 1, it is characterized in that: In the step 1), the controller monitors and records the number of times packet_in events occur per second, which is recorded as R.
3. According to the time-hopping-based SDN low-speed flow table overflow attack active defense method of claim 1, it is characterized in that: The inferred calculation process of the attacker's detection timeout in step 2) is expressed as: T a =C / R Where C is the flow table capacity of the switch, R is the number of packet_in events per second, and T a Indicates the default timeout period for attacker detection.
4. The active defense method for SDN low-speed flow table overflow attack based on time hopping according to claim 1 is characterized in that: The calculation formula of the flow entry timeout time adjusted in step 3) is expressed as: T d =T a ·ε Where T d is the adjusted flow entry timeout, T a It represents the default timeout period detected by the attacker, and ε is a decay coefficient in the range of (0,1).
5. The active defense method for SDN low-speed flow table overflow attack based on time hopping according to claim 1 is characterized in that: The calculation formula for smoothly adjusting the flow entry timeout in step 4) is expressed as: T out =α*T new +(1-a)*T last Where T out is the flow entry timeout time that should be adjusted in the end, T new Indicates the current calculated flow entry timeout that should be adjusted, T last is the timeout period of the flow entry adjusted in the previous round, and α is the weighting coefficient, which is set to a value between 0 and 1.