SDN (Software Defined Network) controller and security protection method thereof for realizing network monitoring and active and passive combination

Abstract

The invention provides a security protection method for realizing network monitoring and active and passive combination by an SDN (Software Defined Network) controller, which comprises the following steps: the SDN controller receives flow data acquired by each SDN switch, and detects abnormal flow according to each flow data; when abnormal traffic exists, triggering a corresponding flow table to adjust a forwarding path of each piece of traffic data so as to allow normal traffic data to pass through; performing IP address hopping on normal traffic by using a moving target defense strategy; wherein the flow table comprises an MAC layer flow table and an IP layer flow table; when IP address hopping is carried out on normal traffic, the used IP address is generated by a pseudo-random function in Python. By implementing the method, a continuous and dynamic transformation strategy can be provided to reverse the current situation of attack and defense asymmetry, and the attack threshold is improved.

Description

Technical Field

[0001] The present invention relates to the technical field of communication networks, and in particular to an SDN controller and a security protection method thereof for realizing network monitoring and active-passive combination. Background Art

[0002] As the scale of the network continues to expand, the network structure and functions become more and more complex, network traffic is growing explosively, and various new network applications are emerging, which brings severe challenges to the monitoring and management of traditional network architecture. The problem of tight coupling between control function and forwarding function in traditional network equipment makes it difficult to solve the compatibility and scalability of the network. The transmission of massive information has caused a sharp increase in network management costs, including the need for network status, fault perception and rapid repair. Therefore, the traditional network architecture is obviously unable to meet the needs of the current network environment and urgently needs to be changed.

[0003] As one of the emerging network architectures, SDN (Software Defined Network) is of great significance in simplifying network monitoring and diagnosis. Compared with traditional networks, SDN has more methods for network status monitoring and performance monitoring. Its separation of control and forwarding and unified interface make it possible to develop a universal network monitoring solution. The core idea of ​​SDN is to separate the control plane from the data plane, so that the control plane focuses on configuring forwarding logic, while the data plane focuses on actual data forwarding. Therefore, the SDN controller can easily perceive network devices, obtain a full network view, and monitor the status information of various network devices.

[0004] With the popularity of high-bandwidth networks, the possibility of individuals and organizations launching cyber attacks has increased, and the network security situation is very serious. By compensating for the coupling weakness between traffic measurement and anomaly detection, SDN networks can integrate traffic collection, anomaly detection, and security defense processes without the need for additional network equipment. However, traditional passive defense technologies such as intrusion detection and firewalls can no longer effectively combat new types of network attacks. Attackers exploit weaknesses in the network to launch attacks, while defenders can only defend against known vulnerabilities, resulting in the current Internet dilemma of "strong offense and weak defense."

[0005] Therefore, it is necessary to deploy a continuous and dynamic transformation strategy on the SDN controller to reverse the current asymmetric situation between attack and defense and raise the threshold of attack. Summary of the invention

[0006] The technical problem to be solved by the embodiments of the present invention is to provide an SDN controller and a security protection method for realizing network monitoring and active-passive combination thereof, which can provide continuous and dynamic transformation strategies to reverse the current asymmetric attack and defense situation and raise the threshold of attack.

[0007] In order to solve the above technical problems, an embodiment of the present invention provides a security protection method for an SDN controller to realize network monitoring and active and passive combination, which is implemented on an SDN controller interconnected with multiple SDN switches. The method includes the following steps:

[0008] Receive the traffic data collected by each SDN switch, and detect whether abnormal traffic data exists according to the traffic data collected by each SDN switch;

[0009] When abnormal traffic data is detected, a corresponding flow table is triggered to adjust the forwarding path of each traffic data to allow normal traffic data to pass; wherein the flow table includes a MAC layer flow table and an IP layer flow table;

[0010] A preset mobile target defense strategy is used to perform IP address hopping on normal traffic data that is allowed to pass; wherein, when the normal traffic performs IP address hopping, the IP address used is generated by a pseudo-random function in Python.

[0011] The specific steps of detecting whether abnormal traffic exists according to the traffic data collected by each SDN switch include:

[0012] In the traffic data collected by each SDN switch, feature data associated with the DDoS / IDS attack traffic is extracted, and the extracted feature data is imported into the trained DDoS classification model or / and the IDS classification model, and further based on the classification result, it is determined whether abnormal traffic data exists; wherein, if the classification result output by the DDoS classification model or / and the IDS classification model is not empty, it is determined that the abnormal traffic data exists; conversely, if the classification results output by the DDoS classification model and the IDS classification model are both empty, it is determined that the abnormal traffic data does not exist.

[0013] Among them, the DDoS classification model is constructed by one of the models of LGBM, XGBoost, Random Forest and AdaBoost, and is trained by the soft voting method in ensemble learning; the IDS classification model is constructed by one of the models of DNN, CNN and LSTM, and is trained by scikit-learn and Keras libraries.

[0014] The MAC layer flow table is triggered by executing the following steps, specifically:

[0015] Periodically determining the uplink and downlink communication rates of the ports connected between the SDN controller and each SDN switch at a period of 5 seconds;

[0016] The flow ratio of the ports connected between the SDN controller and each SDN switch in each cycle is calculated by the formula ratio=tx / (rx+tx); wherein tx is the downlink communication rate; rx is the uplink communication rate;

[0017] Based on the flow ratio of the ports connected between the SDN controller and each SDN switch in each cycle, the average flow ratio of the ports connected between the SDN controller and each SDN switch in each time period is calculated with every 60 seconds as a time period, and when it is determined that the average value calculated in any time period is less than a preset threshold, the MAC layer flow table is triggered.

[0018] The IP layer flow table is triggered by executing the following steps, specifically:

[0019] The proportion of normal traffic data in the predetermined total is counted, and when it is determined that the counted proportion is less than the preset percentage, the IP layer flow table is triggered.

[0020] Wherein, the method further comprises:

[0021] Use Spring Boot and Vue framework to visualize the traffic data collected by each SDN switch.

[0022] Wherein, the visual monitoring includes port flow monitoring and global flow monitoring; Wherein,

[0023] The port traffic monitoring is used to allow the user to view the number of data packets received and transmitted and the number of traffic bytes under the specified port name, and provide visual chart information in the form of a line chart or / and a pie chart;

[0024] The global traffic monitoring is used to collect traffic data of all SDN switches and display it to users after processing and aggregation.

[0025] An embodiment of the present invention further provides an SDN controller, which is interconnected with a plurality of SDN switches, including:

[0026] A flow data receiving and detecting unit, used to receive the flow data collected by each SDN switch, and detect whether abnormal flow data exists according to the flow data collected by each SDN switch;

[0027] An abnormal traffic data interception unit is used to trigger a corresponding flow table to adjust the forwarding path of each traffic data when abnormal traffic data is detected, so as to allow normal traffic data to pass; wherein the flow table includes a MAC layer flow table and an IP layer flow table;

[0028] The mobile target defense unit is used to use a preset mobile target defense strategy to perform IP address hopping on normal traffic data allowed to pass; wherein, when the normal traffic performs IP address hopping, the IP address used is generated by a pseudo-random function in Python.

[0029] Among them, it also includes:

[0030] The traffic data visualization monitoring unit is used to visualize the traffic data collected by each SDN switch using the Spring Boot and Vue framework.

[0031] Wherein, the visual monitoring includes port flow monitoring and global flow monitoring; Wherein,

[0032] The port traffic monitoring is used to allow the user to view the number of data packets received and transmitted and the number of traffic bytes under the specified port name, and provide visual chart information in the form of a line chart or / and a pie chart;

[0033] The global traffic monitoring is used to collect traffic data of all SDN switches and display it to users after processing and aggregation.

[0034] Implementing the embodiments of the present invention has the following beneficial effects:

[0035] The present invention utilizes a variety of machine learning and deep learning algorithms (DNN, CNN, LSTM, LGBM, XGBoost) to identify abnormal traffic through the traffic data collected by each SDN switch, thereby improving the passive anomaly detection capability. At the same time, the mobile target defense strategy formed by the MTD technology and SDN characteristics is used to perform IP address hopping on normal traffic data allowed to pass, so that attackers need to spend great efforts and costs in the attack reconnaissance and preparation stages, effectively improving the active defense capability of the network environment. Therefore, it is possible to provide a continuous and dynamic transformation strategy to reverse the current asymmetric attack and defense situation and raise the attack threshold. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, without paying creative labor, other drawings obtained based on these drawings still belong to the scope of the present invention.

[0037] Figure 1 A flow chart of a security protection method for implementing network monitoring and active-passive combination by an SDN controller provided in an embodiment of the present invention;

[0038] Figure 2 A connection diagram of multiple SDN switches and an SDN controller interconnected in a security protection method for implementing network monitoring and active and passive combination by an SDN controller provided by an embodiment of the present invention;

[0039] Figure 3 A schematic diagram of the structure of an SDN controller provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0040] In order to make the objectives, technical solutions and advantages of the present invention more clear, the present invention will be further described in detail below with reference to the accompanying drawings.

[0041] like Figure 1 As shown in the figure, in an embodiment of the present invention, an SDN controller implements a security protection method for network monitoring and active and passive combination, which is implemented on an SDN controller interconnected with multiple SDN switches (such as Figure 2 The method comprises the following steps:

[0042] Step S1, receiving the traffic data collected by each SDN switch, and detecting whether abnormal traffic data exists according to the traffic data collected by each SDN switch;

[0043] Step S2: when abnormal traffic data is detected, trigger the corresponding flow table to adjust the forwarding path of each traffic data to allow normal traffic data to pass; wherein the flow table includes a MAC layer flow table and an IP layer flow table;

[0044] Step S3: Use the preset mobile target defense strategy to perform IP address hopping on normal traffic data that is allowed to pass; wherein, when the normal traffic performs IP address hopping, the IP address used is generated by a pseudo-random function in Python.

[0045] The specific process is as follows: in step S1, first, a SDN scenario is constructed by building a topology using the Mininet network simulator; wherein, an SDN controller and multiple OpenFlow switches are created in Mininet, and these switches will be used to simulate forwarding devices in the SDN network.

[0046] Secondly, let the SDN controller periodically (for example, once every 5 seconds) collect the traffic data from each SDN switch. The traffic data includes but is not limited to communication port, data size, source and destination address, protocol type, etc.

[0047] Finally, let the SDN controller detect whether abnormal traffic exists based on the traffic data collected by each SDN switch. The specific steps are as follows:

[0048] (1) From the traffic data collected by each SDN switch, feature data associated with DDoS / IDS attack traffic is extracted; at this time, 45 feature data are extracted, and the specific parameters are shown in Table 1.

[0049] Table 1

[0050]

[0051]

[0052] (2) Importing the extracted feature data into a trained DDoS classification model or / and an IDS classification model, and further determining whether abnormal traffic data exists based on the classification results; wherein, if the classification results output by the DDoS classification model or / and the IDS classification model are not empty, it is determined that the abnormal traffic data exists; conversely, if the classification results output by the DDoS classification model and the IDS classification model are both empty, it is determined that the abnormal traffic data does not exist.

[0053] It should be noted that for the DDoS classification model, the training data was not standardized in order to make the model as real-time as possible during the testing phase. In order to improve the robustness and generalization ability of the model and reduce the error rate of the model, the soft voting method in ensemble learning was used to train the model. At this time, the DDoS classification model was constructed by one of the models of LGBM, XGBoost, Random Forest and AdaBoost.

[0054] For the IDS classification model, the training data is first preprocessed, including filling missing values ​​and encoding categorical data, and the training data is standardized to improve the model training effect. In the specific training part of the IDS classification model, scikit-learn and Keras libraries are mainly used to train the model. At this time, the IDS classification model is constructed by one of the models of DNN, CNN and LSTM.

[0055] The final selected model parameters are as follows:

[0056] 1. In the DNN model, the number of hidden layers is 5, and the specific settings are 500, 500, 200, 100, 50;

[0057] 2. In the CNN model, a one-dimensional CNN is used, with three convolutional layers. The filters of the convolutional layers are 128, 64, and 32 respectively, and the convolution kernel size is 3. Each convolutional layer is followed by a pooling layer of size 2, and finally connected to two hidden layers with sizes of 100 and 50 respectively, and an output layer of size 2;

[0058] 3. In the LSTM model, there are 3 LSTM layers with 16, 16, and 8 units respectively, followed by an output layer of size 2. The Adam optimizer is used in all three models.

[0059] It should be noted that the specific training process of the DDoS classification model and the IDS classification model is implemented using common technical means in this field, which will not be repeated here.

[0060] In step S2, a corresponding flow table is issued according to the classification result output by the DDoS classification model or / and the IDS classification model in step S1 to block abnormal traffic data and allow normal traffic data to pass.

[0061] At this time, the MAC layer flow table is triggered by executing the following steps:

[0062] The uplink and downlink communication rates of the ports connected between the SDN controller and each SDN switch are periodically determined every 5 seconds.

[0063] The flow ratio of the ports connected between the SDN controller and each SDN switch in each cycle is calculated by the formula ratio=tx / (rx+tx); where tx is the downlink communication rate; rx is the uplink communication rate;

[0064] Based on the traffic ratio of the ports connected between the SDN controller and each SDN switch in each cycle, the average traffic ratio of the ports connected between the SDN controller and each SDN switch in each time period is calculated with every 60 seconds as a time period. When it is determined that the average value calculated in any time period is less than a preset threshold (such as 0.04), the MAC layer flow table is triggered.

[0065] At this time, the IP laminar flow table is triggered by executing the following steps, specifically: counting the proportion of normal traffic data in the predetermined total, and when it is determined that the counted proportion is less than the preset percentage, triggering the IP laminar flow table.

[0066] It should be noted that the two modes of defense, active and passive, are distinguished by the triggering mode, specifically active triggering or manual triggering. When manually triggered, the attack flow information is cached to files, and the administrator queries these files through the console to identify the attacked host and choose whether to send the flow table for suppression.

[0067] In step S3, by using MTD technology and SDN network characteristics, the IP address is changed for coordinated hopping, and the IP address hopping can be performed for a variety of normal traffic data (such as ICMP, TCP, UDP, etc.). This technology creates a highly unpredictable network environment, which requires attackers to pay great efforts and costs in the attack reconnaissance and preparation stages, effectively improving the system's active defense capabilities and making it difficult for attackers to obtain and use detailed information on network resources in advance. At this time, the IP address used is generated by a pseudo-random function in Python, which ensures the randomness and complexity of the transformation, and further enhances the system's ability to resist potential threats.

[0068] It is understandable that the mobile target defense strategy technology confuses attackers by frequently changing the IP addresses of both communicating parties, making it difficult for them to accurately track the real host information. For example, the source IP address of the data packet sent by a host A is converted from 122.0.0.1 to IP_convert1, and the destination IP address is converted from 123.0.0.5 to IP_convert2. IP_convert1 and IP_convert2 are both generated by pseudo-random functions in Python.

[0069] In the embodiment of the present invention, the SDN controller is used to implement global monitoring of network topology and various performance parameters, quickly obtain global network data, and timely discover network topology changes and fault location, thereby improving the utilization efficiency of network resources. In order to enhance the active defense capability of the system.

[0070] Therefore, the method further includes: using Spring Boot and Vue framework to visualize the traffic data collected by each SDN switch, realizing dynamic traffic monitoring, static resource monitoring and visualization of flow tables, thereby reducing the workload of operation and maintenance personnel.

[0071] At this time, visual monitoring includes port traffic monitoring and global traffic monitoring, that is, dynamic traffic monitoring; among them, port traffic monitoring is used to allow users to view the number of data packets received and transmitted under the specified port name and the number of traffic bytes, and provide visual chart information in the form of line graphs and / or pie charts; global traffic monitoring is used to collect traffic data from all SDN switches and display it to users after processing and aggregation.

[0072] It should be noted that static resource monitoring regularly collects static resources in the network and displays them graphically to users. These static resources include SDN switch device information, flow table information, etc., and display important indicator data specified by users.

[0073] The flow table is sent down through a graphical interface. The present invention provides various basic information of the OpenFlow switch flow table and sends the flow table to the switch through the REST API. This function greatly reduces the workload of operation and maintenance personnel.

[0074] like Figure 3 As shown, in an embodiment of the present invention, an SDN controller is provided, which is interconnected with multiple SDN switches, including:

[0075] The flow data receiving and detecting unit 110 is used to receive the flow data collected by each SDN switch, and detect whether abnormal flow data exists according to the flow data collected by each SDN switch;

[0076] The abnormal traffic data interception unit 120 is used to trigger the corresponding flow table to adjust the forwarding path of each traffic data to allow normal traffic data to pass when abnormal traffic data is detected; wherein the flow table includes a MAC layer flow table and an IP layer flow table;

[0077] The mobile target defense unit 130 is used to use a preset mobile target defense strategy to perform IP address hopping on normal traffic data allowed to pass; wherein, when the normal traffic performs IP address hopping, the IP address used is generated by a pseudo-random function in Python.

[0078] Among them, it also includes:

[0079] The traffic data visualization monitoring unit is used to visualize the traffic data collected by each SDN switch using the Spring Boot and Vue framework.

[0080] Wherein, the visual monitoring includes port flow monitoring and global flow monitoring; Wherein,

[0081] The port traffic monitoring is used to allow the user to view the number of data packets received and transmitted and the number of traffic bytes under the specified port name, and provide visual chart information in the form of a line chart or / and a pie chart;

[0082] The global traffic monitoring is used to collect traffic data of all SDN switches and display it to users after processing and aggregation.

[0083] Implementing the embodiments of the present invention has the following beneficial effects:

[0084] The present invention utilizes a variety of machine learning and deep learning algorithms (DNN, CNN, LSTM, LGBM, XGBoost) to identify abnormal traffic through the traffic data collected by each SDN switch, thereby improving the passive anomaly detection capability. At the same time, the mobile target defense strategy formed by the MTD technology and SDN characteristics is used to perform IP address hopping on normal traffic data allowed to pass, so that attackers need to spend great efforts and costs in the attack reconnaissance and preparation stages, effectively improving the active defense capability of the network environment. Therefore, it is possible to provide a continuous and dynamic transformation strategy to reverse the current asymmetric attack and defense situation and raise the attack threshold.

[0085] It is worth noting that in the above-mentioned device embodiment, the various device units included are only divided according to functional logic, but are not limited to the above-mentioned division, as long as the corresponding functions can be realized; in addition, the specific names of the various functional units are only for the convenience of distinguishing each other, and are not used to limit the scope of protection of the present invention.

[0086] A person skilled in the art can understand that all or part of the steps in the above-mentioned embodiment method can be completed by instructing related hardware through a program, and the program can be stored in a computer-readable storage medium, such as ROM / RAM, disk, CD-ROM, etc.

[0087] The above disclosure is only the preferred embodiment of the present invention, which certainly cannot be used to limit the scope of the present invention. Therefore, equivalent changes made according to the claims of the present invention are still within the scope of the present invention.

Claims

1. A security protection method for realizing network monitoring and active-passive combination by an SDN controller, characterized in that: The method is implemented on an SDN controller interconnected with a plurality of SDN switches, and comprises the following steps: Receive the traffic data collected by each SDN switch, and detect whether abnormal traffic data exists according to the traffic data collected by each SDN switch; When abnormal traffic data is detected, a corresponding flow table is triggered to adjust the forwarding path of each traffic data to allow normal traffic data to pass; wherein the flow table includes a MAC layer flow table and an IP layer flow table; A preset mobile target defense strategy is used to perform IP address hopping on normal traffic data that is allowed to pass; wherein, when the normal traffic performs IP address hopping, the IP address used is generated by a pseudo-random function in Python.

2. The SDN controller according to claim 1 realizes the security protection method of combining network monitoring with active and passive functions, characterized in that: The specific steps of detecting whether abnormal traffic exists according to the traffic data collected by each SDN switch include: In the traffic data collected by each SDN switch, feature data associated with the DDoS / IDS attack traffic is extracted, and the extracted feature data is imported into the trained DDoS classification model or / and the IDS classification model, and further based on the classification result, it is determined whether abnormal traffic data exists; wherein, if the classification result output by the DDoS classification model or / and the IDS classification model is not empty, it is determined that the abnormal traffic data exists; conversely, if the classification results output by the DDoS classification model and the IDS classification model are both empty, it is determined that the abnormal traffic data does not exist.

3. The SDN controller according to claim 2 realizes the security protection method of combining network monitoring with active and passive functions, characterized in that: The DDoS classification model is constructed by one of the models of LGBM, XGBoost, Random Forest and AdaBoost, and is trained by the soft voting method in ensemble learning; the IDS classification model is constructed by one of the models of DNN, CNN and LSTM, and is trained by the scikit-learn and Keras libraries.

4. The SDN controller according to claim 1 realizes the security protection method of combining network monitoring with active and passive functions, characterized in that: The MAC layer flow table is triggered by executing the following steps, specifically: Periodically determining the uplink and downlink communication rates of the ports connected between the SDN controller and each SDN switch at a period of 5 seconds; The flow ratio of the ports connected between the SDN controller and each SDN switch in each cycle is calculated by the formula ratio=tx / (rx+tx); wherein tx is the downlink communication rate; rx is the uplink communication rate; Based on the flow ratio of the ports connected between the SDN controller and each SDN switch in each cycle, the average flow ratio of the ports connected between the SDN controller and each SDN switch in each time period is calculated with every 60 seconds as a time period, and when it is determined that the average value calculated in any time period is less than a preset threshold, the MAC layer flow table is triggered.

5. The SDN controller according to claim 1 realizes the security protection method of combining network monitoring with active and passive functions, characterized in that: The IP layer flow table is triggered by executing the following steps, specifically: The proportion of normal traffic data in the predetermined total is counted, and when it is determined that the counted proportion is less than the preset percentage, the IP layer flow table is triggered.

6. The SDN controller according to claim 1 realizes the security protection method of combining network monitoring with active and passive functions, characterized in that: The method further comprises: Use Spring Boot and Vue framework to visualize the traffic data collected by each SDN switch.

7. The SDN controller according to claim 6 realizes the security protection method of combining network monitoring with active and passive functions, characterized in that: The visual monitoring includes port traffic monitoring and global traffic monitoring; wherein, The port traffic monitoring is used to allow the user to view the number of data packets received and transmitted and the number of traffic bytes under the specified port name, and provide visual chart information in the form of a line chart or / and a pie chart; The global traffic monitoring is used to collect traffic data of all SDN switches and display it to users after processing and aggregation.

8. An SDN controller, characterized in that: It is interconnected with multiple SDN switches, including: A flow data receiving and detecting unit, used to receive the flow data collected by each SDN switch, and detect whether abnormal flow data exists according to the flow data collected by each SDN switch; An abnormal traffic data interception unit is used to trigger a corresponding flow table to adjust the forwarding path of each traffic data when abnormal traffic data is detected, so as to allow normal traffic data to pass; wherein the flow table includes a MAC layer flow table and an IP layer flow table; The mobile target defense unit is used to use a preset mobile target defense strategy to perform IP address hopping on normal traffic data allowed to pass; wherein, when the normal traffic performs IP address hopping, the IP address used is generated by a pseudo-random function in Python.

9. The SDN controller according to claim 8, characterized in that: Also includes: The traffic data visualization monitoring unit is used to visualize the traffic data collected by each SDN switch using the Spring Boot and Vue framework.

10. The SDN controller according to claim 9, characterized in that: The visual monitoring includes port traffic monitoring and global traffic monitoring; wherein, The port traffic monitoring is used to allow the user to view the number of data packets received and transmitted and the number of traffic bytes under the specified port name, and provide visual chart information in the form of a line chart or / and a pie chart; The global traffic monitoring is used to collect traffic data of all SDN switches and display it to users after processing and aggregation.

Images