A large-scale host vulnerability identification and attack response simulation method based on SDN

Abstract

The application relates to the technical field of network security, and discloses a large-scale host vulnerability identification and attack response simulation method based on SDN, which comprises the following steps: step 1, creating a network topology through a Mininet script; step 2, in an SDN network environment, using a JSON format to configure vulnerability attributes of hosts; step 3, based on the host vulnerability identification, selecting a corresponding attack strategy and executing a simulated attack, and through an SDN controller, monitoring network traffic and host states in real time, identifying abnormal behaviors and triggering a response mechanism. In the application, the vulnerability attributes of each host node are configured in a JSON format, and the centralized analysis capability of the SDN controller is utilized, so that an attacker can detect and locate target hosts based on specific vulnerability characteristics, thereby significantly improving the simulation capability of a network security simulation environment to a real attack scene, and solving the limitation that a traditional method is difficult to reflect vulnerability details.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a large-scale host vulnerability identification and attack response simulation method based on SDN. Background Art

[0002] Existing network security and attack response simulation technologies primarily focus on network-level traffic management, routing optimization, and rule-based security protection strategies. Traditionally, simulation platforms typically use predefined network topologies and traffic patterns, combined with static protection rules, to simulate attacker behavior and test the network's defense capabilities. For example, hard-coded rules are used to control the transmission path of data packets, or traffic generation tools such as iperf are used to simulate scenarios such as denial of service attacks. Furthermore, some methods incorporate software-defined networking (SDN) technology to manage network traffic through centralized controllers, supporting dynamic configuration of switches and routers to enhance network monitoring and scheduling capabilities. These technologies have been widely used in small and medium-sized network environments and can implement basic attack simulation and response testing.

[0003] However, the limitation of existing technologies is that they pay less attention to the security attribute identification at the host level, especially the accurate description and dynamic simulation of vulnerabilities. Traditional simulation methods usually rely on simplified attack models and static rules, and cannot accurately reflect the multi-dimensional characteristics of complex vulnerabilities (such as vulnerability type, impact range, exploitability, etc. in CVE descriptions), resulting in a large gap between attack simulation and real-world scenarios. For example, when simulating attacks against specific CVE vulnerabilities, traditional methods find it difficult to adjust attack paths or strategies based on the specific security attributes of the host, limiting in-depth analysis of the vulnerability exploitation process. In addition, traditional simulation platforms mostly use fixed network topologies and traffic patterns, which are difficult to adapt to the complexity and dynamics of large-scale networks (such as hundreds or thousands of nodes). As the number of nodes increases, the accuracy of their management and simulation decreases significantly. This makes the existing methods exhibit the disadvantages of insufficient scalability and poor authenticity when dealing with host vulnerability identification, attack response and resource scheduling problems in large-scale networks. Summary of the Invention

[0004] To remedy the above shortcomings, the present invention provides an SDN-based large-scale host vulnerability identification and attack response simulation method, aiming to improve the problem that traditional simulation methods usually rely on simplified attack models and static rules and cannot accurately reflect the multi-dimensional characteristics of complex vulnerabilities.

[0005] In a first aspect, the present invention provides the following technical solution: a large-scale host vulnerability identification and attack response simulation method based on SDN, comprising the following steps:

[0006] Step 1: Create a network topology using the Mininet script. The network topology includes hosts, switches, and controllers. The SDN controller is used to centrally manage traffic and node status in the network topology. The network performance in actual scenarios is simulated by setting the topology type, bandwidth, and latency parameters.

[0007] Step 2: In the SDN network environment, vulnerability attributes are configured for the host using JSON format. The vulnerability attributes include vulnerability number, hazard level, impact scope, and remediation suggestions. Scripts are used to quickly edit and batch assign host vulnerability attributes, enabling automated vulnerability identification and generating topology nodes that identify vulnerability information.

[0008] Step 3: Based on the host vulnerability identification, select the corresponding attack strategy and execute a simulated attack. The SDN controller monitors the network traffic and host status in real time, identifies abnormal behavior and triggers a response mechanism. The response mechanism includes traffic restriction, host isolation and data flow rerouting based on OpenFlow rules to simulate the defense mechanism in network attacks.

[0009] Preferably, the network topology created in step 1 supports tree, mesh or ring topology types, and the SDN controller communicates with the switch via the OpenFlow protocol to perform flexible scheduling and real-time monitoring of network traffic. The method is applied to large-scale network environments, supports simulation of hundreds to thousands of host nodes, and improves simulation efficiency and system scalability through centralized management.

[0010] Preferably, the JSON format vulnerability attributes in step 2 also include vulnerability type, affected software version and attack conditions. The SDN controller parses the JSON vulnerability attributes of the host node through the vulnerability scanning module, extracts vulnerability feature information, and formulates an attack plan based on the vulnerability feature information. The attack plan includes target host selection and attack method determination.

[0011] Preferably, the attack strategy in step 3 includes one or more of host vulnerability exploitation attacks and denial of service attacks, and each attack type supports configuration of different attack intensity, frequency and duration; after identifying abnormal behavior, the SDN controller automatically adjusts network traffic according to a preset defense strategy, and the defense strategy includes enabling traffic filtering, adding firewall rules or activating an intrusion detection and prevention system to mitigate the impact of the attack and ensure network security.

[0012] Preferably, the SDN controller interacts with hosts in real time. Upon detecting a host vulnerability, the SDN controller pushes vulnerability remediation recommendations to the affected hosts and collaborates with an external vulnerability management system to generate a remediation strategy. Traffic scheduling and policy adjustments are used to reduce the load on the attacked hosts. Detailed vulnerability and attack logs are generated, including vulnerability identification information, attack behavior records, and response details, to support subsequent analysis and optimization.

[0013] Preferably, it also supports the external interface module to connect with the external vulnerability database to automatically synchronize vulnerability information, and dynamically configure the host vulnerability attributes and monitor the simulation effect in real time through a graphical interface.

[0014] Preferably, the SDN controller dynamically adjusts the network's resource allocation strategy by monitoring network traffic and attack characteristics in real time, including adjusting traffic routing and restricting resource access of affected hosts, to simulate a real attack response process and prevent the continued impact of the attack.

[0015] In a second aspect, the present invention provides the following technical solution: a large-scale host vulnerability identification and attack response simulation system based on SDN, comprising:

[0016] The network topology building module is used to create a network topology including hosts, switches, and controllers through Mininet scripts, and simulate actual network performance by setting topology type, bandwidth, and latency parameters;

[0017] The vulnerability identification module is used to configure vulnerability attributes for hosts using JSON format, including vulnerability number, hazard level, impact scope, and remediation suggestions. It supports rapid editing and batch assignment of vulnerabilities.

[0018] An attack simulation module is used to select an attack strategy based on the host vulnerability identification and execute a simulated attack, wherein the attack strategy includes an exploit attack and a denial of service attack;

[0019] The monitoring and response module is used to monitor network traffic and host status in real time through the SDN controller, identify abnormal behavior, and trigger response mechanisms including traffic restriction, host isolation, and data flow rerouting;

[0020] The repair and logging module is used to automatically push repair suggestions and generate repair strategies after detecting host vulnerabilities, automatically configure and repair vulnerable hosts through network topology, and generate logs including vulnerability identification information, attack behavior records, and response measures details.

[0021] In the third aspect, the invention provides the following technical solution: a computer device comprising a memory, a processor, and a computer program stored on the memory and executable on the processor; when the processor executes the computer program, the above-mentioned SDN-based large-scale host vulnerability identification and attack response simulation method is implemented.

[0022] In a fourth aspect, the present invention provides the following technical solution: a readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the above-mentioned SDN-based large-scale host vulnerability identification and attack response simulation method.

[0023] The present invention has the following beneficial effects:

[0024] 1. In the present invention, by configuring vulnerability attributes in JSON format (such as vulnerability number, hazard level, and impact range) for each host node and leveraging the centralized parsing capabilities of the SDN controller, attackers are supported to detect and locate target hosts based on specific vulnerability characteristics. Compared with traditional static rules or simplified models, this method can accurately reproduce the exploitation process of complex vulnerabilities (such as the multidimensional characteristics described in CVE) and quickly respond to attacks through real-time monitoring and dynamic adjustments (such as traffic restriction and host isolation). This significantly improves the network security simulation environment's ability to simulate real attack scenarios and overcomes the limitation of traditional methods that are difficult to reflect vulnerability details.

[0025] 2. In the present invention, in large-scale networks (such as hundreds to thousands of host nodes), this method utilizes the centralized control characteristics of SDN, builds a flexible network topology through Mininet scripts, and supports batch allocation and rapid editing of vulnerability attributes; compared with traditional simulation methods that are limited by the processing capabilities of small and medium-sized networks, this method can maintain simulation efficiency and management accuracy when the number of nodes increases significantly through standardized vulnerability identification and dynamic resource scheduling (such as data flow rerouting), providing technical support for the study of attack behaviors and defense strategies in complex networks.

[0026] 3. In the present invention, the network traffic and host status are monitored in real time through the SDN controller, and various response mechanisms (such as traffic filtering and adding firewall rules) are triggered after abnormal behavior is detected, thereby achieving a rapid response to attacks. Traditional methods mostly rely on fixed rules and are difficult to adapt to changing attack methods. However, this method can quickly mitigate the impact and restore network functions when an attack occurs by dynamically adjusting resource allocation strategies (such as bandwidth limitation or route switching), reflecting the ability to adapt to complex attack scenarios.

[0027] 4. In the present invention, after a host vulnerability is detected, repair suggestions are automatically pushed through the SDN controller and automated configuration (such as software updates or port closures) is executed, while detailed vulnerability and attack logs (including attack types, response measures, etc.) are generated. Compared with traditional manual repairs or simulation methods that lack records, this function reduces the time cost of manual intervention and provides a data basis for subsequent security analysis and policy optimization, thereby improving the maintainability and traceability of the system. BRIEF DESCRIPTION OF THE DRAWINGS

[0028] Figure 1 This is a flowchart of the implementation of an SDN-based large-scale host vulnerability identification and attack response simulation method proposed by the present invention;

[0029] Figure 2 This is a schematic diagram of host attribute description in a simulated DDoS attack scenario of a large-scale host vulnerability identification and attack response simulation method based on SDN proposed by the present invention;

[0030] Figure 3 This is a schematic diagram of the operation of extracting host bandwidth attribute items from a traffic monitoring script of the SDN-based large-scale host vulnerability identification and attack response simulation method proposed by the present invention;

[0031] Figure 4 This is a schematic diagram of abnormal behavior of a host downtime caused by a DDoS attack using the SDN-based large-scale host vulnerability identification and attack response simulation method proposed by the present invention;

[0032] Figure 5 This is an implementation architecture diagram of an SDN-based architecture proposed by the present invention that uses JSON vulnerability attributes to complete attack response simulation. DETAILED DESCRIPTION

[0033] The following will clearly and completely describe the technical solutions in the embodiments of the present invention with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. All other embodiments obtained by ordinary technicians in this field based on the embodiments of the present invention without making any creative efforts shall fall within the scope of protection of the present invention.

[0034] Example 1

[0035] Reference Figure 1-Figure 5 In a first embodiment of the present invention, the present invention provides a large-scale host vulnerability identification and attack response simulation method based on SDN, comprising the following steps:

[0036] Step 1: Create a network topology using the Mininet script. The network topology includes hosts, switches, and controllers. The SDN controller is used to centrally manage traffic and node status in the network topology. The network performance in actual scenarios is simulated by setting the topology type, bandwidth, and latency parameters.

[0037] Step 2: In the SDN network environment, vulnerability attributes are configured for the host using JSON format. The vulnerability attributes include vulnerability number, hazard level, impact scope, and remediation suggestions. Scripts are used to quickly edit and batch assign host vulnerability attributes, enabling automated vulnerability identification and generating topology nodes that identify vulnerability information.

[0038] Step 3: Based on the host vulnerability identification, select the corresponding attack strategy and execute a simulated attack. The SDN controller monitors the network traffic and host status in real time, identifies abnormal behavior and triggers a response mechanism. The response mechanism includes traffic restriction, host isolation and data flow rerouting based on OpenFlow rules to simulate the defense mechanism in network attacks.

[0039] Specifically, in step 1, the Mininet script is written in Python and defines the network topology by calling the Topo class in the Mininet library. For example, a tree topology (TreeTopo, depth 3, fan-out 10) with 100 host nodes is created. Each host is assigned a unique IP address (e.g., 192.168.1.1 to 192.168.1.100). The switch implements OpenFlow 1.3 protocol support using the OVSSwitch class. Bandwidth parameters can be set from 10 Mbps to 1 Gbps, and latency parameters can be configured from 1 ms to 100 ms using the tc command to simulate enterprise network or data center environments. The SDN controller can be Ryu, ONOS, or Floodlight. For example, when using the Ryu controller, flow table rules are configured through the REST API to achieve precise control of traffic flow on each switch port. In real-world simulations, background traffic can be introduced (e.g., using iperf to generate TCP / UDP data streams) to maintain a network load of 50%-80% to simulate a real-world operating environment. In step 2, vulnerability attributes in JSON format are generated through a script. For example, a host node's vulnerability configuration is {"vuln_id":"CVE-2023-1234","severity":"High","impact":"Remote Code Execution","fix":"Upgrade to v2.1.3"}. If batch allocation is supported, vulnerability data can be imported into 1,000 host nodes using the Python json module. Vulnerability editing is performed through a graphical interface, allowing users to manually enter information. After editing, the information is synchronized to the SDN controller database in real time. In step 3, the attack strategy is selected based on the vulnerability type. For example, an attack targeting CVE-2023-1234 uses the Metasploit framework to generate a payload, and the attack frequency can be set to 10 times per second for 30 seconds. The SDN controller collects traffic data through the sFlow protocol with a sampling rate of 1 / 1000. When abnormal behavior (such as a sudden increase in traffic to 90% of the bandwidth) triggers an alarm, it automatically executes traffic restriction rules (limiting to 20% of the original traffic). Host isolation is achieved by deleting the corresponding table entry in the switch flow table, and data flow rerouting is adjusted to the backup link by calculating the shortest path (such as the Dijkstra algorithm).

[0040] The network topology created in step 1 supports tree, mesh, or ring topologies. The SDN controller communicates with the switch through the OpenFlow protocol to flexibly schedule and monitor network traffic in real time. This method is applied to large-scale network environments, supports the simulation of hundreds to thousands of host nodes, and improves simulation efficiency and system scalability through centralized management.

[0041] Specifically, in a tree topology implementation, a backbone switch connects to 10 sub-switches, each of which connects to 10 hosts, for a total of 100 nodes. The topology depth is 2, making it suitable for simulating hierarchical networks. A mesh topology can be designed as a 5x5 matrix with 25 switches, each connected to 4 hosts, for a total of 100 nodes, suitable for distributed environments. A ring topology connects 10 switches in series, each connected to 10 hosts, suitable for testing loop scenarios. In OpenFlow protocol communication, the controller sends 10 flow table rules per second to the switch. Each rule contains a match field (such as source IP address and destination port) and an action field (such as forward or drop). The rules are stored in the switch's TCAM, which supports 100,000 rules. An example of flexible scheduling includes raising the priority of traffic from host A to host B to the highest (DSCP value 46) to ensure latency below 5ms. Real-time monitoring detects topology changes through the controller's periodic LLDP messages (every 5 seconds) and uses SNMP to collect switch port statistics (such as packet loss rate and bandwidth utilization). In terms of large-scale network support, the simulation environment can be expanded to 2,000 host nodes. Through sharding management (each 500 nodes is a group), the controller load is reduced and the simulation efficiency is improved by 30%. The system scalability is reflected in the support for dynamic addition of hosts (implemented through the CLI command net.addHost()). New nodes do not require a network restart and take about 1 second.

[0042] The JSON-formatted vulnerability attributes in step 2 also include the vulnerability type, affected software version, and attack conditions. The SDN controller parses the JSON vulnerability attributes of the host node through the vulnerability scanning module, extracts vulnerability feature information, and formulates an attack plan based on the vulnerability feature information. The attack plan includes target host selection and attack method determination.

[0043] Specifically, in the JSON vulnerability attributes, vulnerability types include buffer overflow, SQL injection, etc., for example {"type":"buffer overflow","affected_version":"Apache2.4.39","condition":"unverified input length"}. The data is stored in MongoDB, and the controller queries through RESTfulAPI. The size of each record is about 1KB. The vulnerability scanning module uses open source tools such as OpenVAS. The scanning cycle is set to 10 minutes. It takes about 2 hours to cover 1,000 hosts. After the scan results generate an XML report, the Python script parses the vulnerability characteristics (such as the severity level is divided into four levels: low, medium, high, and emergency). During the attack plan formulation, the controller matches the Exploit-DB database according to the vulnerability number (such as CVE-2021-3456), selects the corresponding attack script (such as a buffer overflow attack implemented in Python), and the target host is locked by IP address (such as 192.168.1.10). After the attack method is determined, attack traffic (such as 1,000 malformed data packets) is generated, and the attack arrival rate is verified to be over 95% through the switch port mirroring function. The parsing process supports multi-threaded processing, with each thread processing 50 host nodes, and the parsing time is shortened to less than 30 seconds.

[0044] The attack strategies in step 3 include one or more attacks targeting host vulnerabilities and denial of service attacks. Each attack type supports configuration of different attack intensity, frequency, and duration. After identifying abnormal behavior, the SDN controller automatically adjusts network traffic according to preset defense strategies. Defense strategies include enabling traffic filtering, adding firewall rules, or activating intrusion detection and prevention systems to mitigate the impact of attacks and ensure network security.

[0045] Specifically, in the attack example, targeting the buffer overflow vulnerability, the attack script injects 500 bytes of overlong data, triggering the target host service crash, with a success rate of 90%; the denial of service attack uses the hping3 tool to send 100,000 SYN packets per second for 5 minutes, causing the target host bandwidth to occupy 100%; the cross-site scripting attack constructs malicious HTTP requests (such as <script>alert('XSS')< / script>) tests the web service at a frequency of 50 times per second; the malware propagation simulates the WannaCry worm, which propagates through the SMB protocol vulnerability (CVE-2017-0144), infecting one host every 10 seconds. In the defense strategy, traffic filtering rules are based on matching the five-tuple (source IP, destination IP, protocol, source port, destination port). After discarding abnormal traffic, the bandwidth is restored to 80% of the normal level; firewall rules are added through the controller API, such as ryu.ofproto.oxm_fields.match_ip_proto(6) to limit TCP traffic; the IDS / IPS system integrates Snort, and the detection rules cover 5000 attack signatures, with a false alarm rate of less than 5%. After activation, it can block 90% of known attack traffic. The entire defense process is automated, with a response time of less than 1 second.

[0046] It also includes real-time interaction between the SDN controller and the host. After detecting a host vulnerability, it automatically pushes vulnerability repair suggestions and generates a repair strategy. It repairs the vulnerable host through automatic configuration of the network topology and tracks the host status in real time during the repair process. At the same time, it generates detailed vulnerability and attack logs. The logs include vulnerability identification information, attack behavior records and response measures details to support subsequent analysis and optimization.

[0047] Specifically, real-time interaction is achieved through a heartbeat mechanism between the controller and the host, sending a ping request every 5 seconds. If the host response delay exceeds 500ms, vulnerability detection is triggered. Repair recommendations are pushed in JSON format, for example, {"vuln_id":"CVE-2022-5678","fix":"Install patch KB12345"}, and distributed to the target host via the SSH protocol (batch processing of 100 hosts takes approximately 20 seconds). Automated repair strategies include updating software versions and closing vulnerable ports (such as port 445). The repair process is executed through scripts with a success rate of 95%. Real-time tracking uses the top command to monitor host CPU and memory usage, and status snapshots are recorded after anomalies are recovered. The log generation module records data every minute. The log file format is CSV, containing fields such as timestamp, host IP address, vulnerability ID, attack type, response measures, and repair status. The size of a single attack log is approximately 500KB and can be imported into subsequent analysis tools (such as Wireshark). During optimization, machine learning models (such as random forests) can be used to predict potential attack paths with an accuracy of 85%.

[0048] It also supports external interface modules to connect with external vulnerability databases for automatic synchronization of vulnerability information, and dynamically configures host vulnerability attributes and monitors simulation effects in real time through a graphical interface.

[0049] Specifically, the external interface module is developed based on the Flask framework, providing a RESTful API (such as / api / vuln_sync), connecting to the CVE database (such as NVD), and synchronizing vulnerability data every 24 hours. A single synchronization of about 100,000 records takes about 15 minutes. The network topology construction module is based on Mininet version 2.3.0. Through the Miniedit visual interface, it supports the rapid creation of a grid topology containing up to 500 hosts. Users can use Miniedit to intuitively design the network structure and flexibly configure the connections between hosts, switches, and controllers. The monitoring effect display includes a traffic curve graph (drawn based on Pyplot, refreshed once per second) and a host status heat map. Users can run the control script and view the response log. The interface supports concurrent access by multiple users and supports up to 50 users operating at the same time.

[0050] The SDN controller monitors network traffic and attack characteristics in real time and dynamically adjusts the network's resource allocation strategy, including adjusting traffic routing and restricting resource access of affected hosts, to simulate a real attack response process and prevent the continued impact of the attack.

[0051] Specifically, real-time monitoring is achieved through the controller's built-in traffic analysis module, which collects 1,000 data packets per second. The analysis indicators include bandwidth usage (in Mbps), packet loss rate (in %), and latency (in ms). If the bandwidth suddenly increases to more than 90%, it is determined to be an attack. During the resource allocation strategy adjustment, traffic routing uses the OSPF protocol to calculate a new path. For example, switching traffic from link A (full bandwidth) to link B (30% bandwidth usage), the switch takes about 300ms; resource limitation uses the tc command to set a bandwidth cap. After the limit, the target host traffic is reduced to 5Mbps to prevent downtime. Prevention of continuous impact includes regular checks on the host's survival status (through ARP requests, once every 10 seconds). If an anomaly is found (such as the host being offline), the service is automatically restarted. The entire process simulates the emergency response of a real enterprise network, with a success rate of 98%.

[0052] Example 2:

[0053] Reference Figure 1 In a second embodiment of the present invention, the present invention provides a large-scale host vulnerability identification and attack response simulation system based on SDN, including:

[0054] The network topology building module is used to create a network topology including hosts, switches, and controllers through Mininet scripts, and simulate actual network performance by setting topology type, bandwidth, and latency parameters;

[0055] The vulnerability identification module is used to configure vulnerability attributes for hosts using JSON format, including vulnerability number, hazard level, impact scope, and remediation suggestions. It supports rapid editing and batch assignment of vulnerabilities.

[0056] Attack simulation module, used to select attack strategies based on host vulnerability identification and execute simulated attacks. Attack strategies include exploit attacks and denial of service attacks.

[0057] The monitoring and response module is used to monitor network traffic and host status in real time through the SDN controller, identify abnormal behavior, and trigger response mechanisms including traffic restriction, host isolation, and data flow rerouting;

[0058] The repair and logging module is used to automatically push repair suggestions and generate repair strategies after detecting host vulnerabilities, automatically configure and repair vulnerable hosts through network topology, and generate logs including vulnerability identification information, attack behavior records, and response measures details.

[0059] Specifically, the network topology construction module is based on Mininet version 2.3.0, supports the creation of a grid topology with 500 hosts, with bandwidth parameters ranging from 1Mbps to 10Gbps and a latency range of 0.1ms to 500ms. It runs on the Ubuntu 20.04 system and occupies approximately 2GB of memory. The vulnerability identification module is developed using Python 3.8, and JSON files are stored on the local disk (approximately 2KB per host file). It supports importing the NVD database format, and batch allocation is processed through multi-threading (50 hosts per thread), which takes about 10 seconds. The attack simulation module integrates Metasploit and hping3. Attack types include SYN flooding (100,000 packets per second) and SQL injection (100 requests per second). The CPU occupancy is approximately 30% during runtime. The monitoring and response module, based on the Ryu controller, monitors traffic 10 times per second. Responses are issued via OpenFlow 1.3 flow tables. For example, flow entries are deleted (flow_mod(del)) when isolating a host and new entries are added (flow_mod(add)) when rerouting. Response latency is less than 100ms. The repair and logging module batch executes repair commands via SSH. Logs are stored in a SQLite database. Each record includes a timestamp, IP address, and attack details. A single simulation generates approximately 1MB of logs, which can be exported to JSON format for external analysis.

[0060] Example 3

[0061] The third embodiment of the present invention is based on the same inventive concept. The present invention proposes a computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, it implements the steps of the SDN-based large-scale host vulnerability identification and attack response simulation method of the above embodiment.

[0062] Example 4

[0063] The fourth embodiment of the present invention is based on the same inventive concept. The present invention proposes a computer device, the terminal including: a processor and a memory; the processor and the memory communicate with each other; the memory is used to store instructions; the processor is used to execute the instructions in the memory, and execute the SDN-based large-scale host vulnerability identification and attack response simulation method of the above embodiment.

[0064] It should be understood that various parts of the present invention can be implemented using hardware, software, firmware, or a combination thereof. In the above-described embodiments, multiple steps or methods can be implemented using software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented using hardware, as in another embodiment, any one of the following technologies known in the art or a combination thereof can be used: a discrete logic circuit having a logic gate circuit for implementing a logic function on a data signal, an application-specific integrated circuit having a suitable combination of logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc.

[0065] Finally, it should be noted that the above is only a preferred embodiment of the present invention and is not intended to limit the present invention. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art can still modify the technical solutions described in the aforementioned embodiments or make equivalent substitutions for some of the technical features therein. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. A large-scale host vulnerability identification and attack response simulation method based on SDN, characterized in that: The following steps are involved: Step 1: Create a network topology using the Mininet script. The network topology includes hosts, switches, and controllers. The SDN controller is used to centrally manage traffic and node status in the network topology. The network performance in actual scenarios is simulated by setting the topology type, bandwidth, and latency parameters. Step 2: In the SDN network environment, vulnerability attributes are configured for the host using JSON format. The vulnerability attributes include vulnerability number, hazard level, impact scope, and remediation suggestions. Scripts are used to quickly edit and batch assign host vulnerability attributes, enabling automated vulnerability identification and generating topology nodes that identify vulnerability information. Step 3: Based on the host vulnerability identification, select the corresponding attack strategy and execute a simulated attack. The SDN controller monitors the network traffic and host status in real time, identifies abnormal behavior and triggers a response mechanism. The response mechanism includes traffic restriction, host isolation and data flow rerouting based on OpenFlow rules to simulate the defense mechanism in network attacks.

2. The SDN-based large-scale host vulnerability identification and attack response simulation method according to claim 1 is characterized in that: The network topology created in step 1 supports tree, mesh, or ring topology types. The SDN controller communicates with the switch via the OpenFlow protocol to flexibly schedule and monitor network traffic in real time. The method is applied to large-scale network environments, supports simulation of hundreds to thousands of host nodes, and improves simulation efficiency and system scalability through centralized management.

3. The SDN-based large-scale host vulnerability identification and attack response simulation method according to claim 1 is characterized in that: The JSON format vulnerability attributes in step 2 also include vulnerability type, affected software version, and attack conditions. The SDN controller parses the JSON vulnerability attributes of the host node through the vulnerability scanning module, extracts vulnerability feature information, and formulates an attack plan based on the vulnerability feature information. The attack plan includes target host selection and attack method determination.

4. The SDN-based large-scale host vulnerability identification and attack response simulation method according to claim 1 is characterized in that: The attack strategy in step 3 includes one or more attacks targeting host vulnerabilities and denial of service attacks. Each attack type supports configuration of different attack intensity, frequency, and duration. After identifying abnormal behavior, the SDN controller automatically adjusts network traffic according to preset defense strategies, which include enabling traffic filtering, adding firewall rules, or activating intrusion detection and prevention systems to mitigate the impact of attacks and ensure network security.

5. The SDN-based large-scale host vulnerability identification and attack response simulation method according to claim 1 is characterized in that: It also includes real-time interaction between the SDN controller and the host. After detecting a host vulnerability, the SDN controller pushes vulnerability remediation suggestions to the affected host and collaborates with the external vulnerability management system to generate a remediation strategy. Through traffic scheduling and policy adjustment, the load on the attacked host is reduced, and detailed vulnerability and attack logs are generated. The logs include vulnerability identification information, attack behavior records, and response measures details to support subsequent analysis and optimization.

6. The SDN-based large-scale host vulnerability identification and attack response simulation method according to claim 1, characterized in that: It also supports external interface modules to connect with external vulnerability databases for automatic synchronization of vulnerability information, and dynamically configures host vulnerability attributes and monitors simulation effects in real time through a graphical interface.

7. The SDN-based large-scale host vulnerability identification and attack response simulation method according to claim 1, characterized in that: The SDN controller dynamically adjusts the network's resource allocation strategy by monitoring network traffic and attack characteristics in real time, including adjusting traffic routing and restricting resource access of affected hosts, to simulate a real attack response process and prevent the continued impact of the attack.

8. A large-scale host vulnerability identification and attack response simulation system based on SDN, characterized by: The SDN-based large-scale host vulnerability identification and attack response simulation method according to any one of claims 1 to 7 comprises: The network topology building module is used to create a network topology including hosts, switches, and controllers through Mininet scripts, and simulate actual network performance by setting topology type, bandwidth, and latency parameters; The vulnerability identification module is used to configure vulnerability attributes for hosts using JSON format, including vulnerability number, hazard level, impact scope, and remediation suggestions. It supports rapid editing and batch assignment of vulnerabilities. An attack simulation module is used to select an attack strategy based on the host vulnerability identification and execute a simulated attack, wherein the attack strategy includes an exploit attack and a denial of service attack; The monitoring and response module is used to monitor network traffic and host status in real time through the SDN controller, identify abnormal behavior, and trigger response mechanisms including traffic restriction, host isolation, and data flow rerouting; The repair and logging module is used to automatically push repair suggestions and generate repair strategies after detecting host vulnerabilities, automatically configure and repair vulnerable hosts through network topology, and generate logs including vulnerability identification information, attack behavior records, and response measures details.

9. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the computer program, the SDN-based large-scale host vulnerability identification and attack response simulation method according to any one of claims 1 to 7 is implemented.

10. A readable storage medium, characterized in that: The readable storage medium stores a computer program, which, when executed by a processor, implements the SDN-based large-scale host vulnerability identification and attack response simulation method according to any one of claims 1 to 7.

Images