Method and system for detecting and defending control plane topology attack of software defined network

Abstract

The invention discloses a control plane topology attack detection defense method and system for a software defined network, and the method comprises the steps: receiving an incoming Packet-In message of the software defined network, and filtering and processing an LLDP message and an ARP message; detecting whether an associated port of a link or a host to be added in the message is occupied, if the associated port is occupied, intercepting the link or the host to be added, forming port-port pair information by ports occupied by the link, recording the port-port pair information into a conflict link port table, and recording the port information occupied by the host into a conflict host port table; and performing link identification and defense based on the conflict link port table, and performing host identification and defense based on the conflict host port table. The invention aims to realize real-time detection, interception and elimination of the forged link and the host in the network environment of the software defined network.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a control plane topology attack detection and defense method and system for a software-defined network. Background Art

[0002] Software-Defined Networking (SDN) is a network management architecture that is different from traditional networks. It separates the control and data planes in the network and makes the network control and management by a logically centralized network controller, which brings higher programmability and flexibility to the network. In the SDN architecture, the network controller formulates data forwarding strategies based on the control plane network topology, and the data plane is responsible for forwarding data packets according to these strategies. Only when the topology of the two is consistent, the network can be used to achieve the desired results. Figure 1 Only when the control plane is aligned can the data plane accurately execute the instructions issued by the control plane, ensuring that data packets are transmitted in the network along the expected path, thereby ensuring network connectivity and the normal development of various services.

[0003] Currently, most SDN controllers use the OpenFlow Discovery Protocol (OFDP) as the standard mechanism for discovering network topology in the control plane. OFDP is based on the Link Level Discovery Protocol (LLDP) frame format defined in the LLDP protocol. The controller sends LLDP packets to each switch port and then infers the link status based on the information returned by adjacent switches. However, this mechanism is inherently insecure and suffers from serious vulnerabilities. It lacks message source verification and integrity checks. Attackers can easily inject forged LLDP packets and tamper with the controller's control plane's network topology view.

[0004] The first existing security defense approach is to propose the secure OFDP (Secure OpenFlow Discovery Protocol, sOFDP), based on the OFDP protocol. This protocol uses built-in security features and mechanisms to ensure consistency between the control and data plane topology views. However, protocol updates struggle to gain widespread acceptance and adoption quickly, resulting in an extremely slow rollout. Numerous compatibility issues must be addressed, making rapid integration into existing network architectures difficult. For many network equipment manufacturers, accepting and adopting new protocols requires significant investment in manpower, material resources, and financial resources to upgrade and retrofit existing products. In the absence of sufficient market momentum, manufacturers tend to adopt new protocols with caution.

[0005] The second existing security defense approach primarily utilizes reserved TLVs in the LLDP frame format, adding a cryptographic Hash-Based Message Authentication Code (HMAC) to provide packet authentication and integrity protection, thus preventing forged link attacks. However, host discovery in the control plane topology view does not rely on LLDP packets. This means the controller cannot use the HMAC in LLDP to determine whether a host's location in the control plane topology view is forged. Host discovery in the control plane topology view is primarily accomplished through ARP messages.

[0006] The third existing security defense approach employs a static defense strategy, requiring manual configuration and management of host locations and link information upfront. This strategy is then manually verified and modified whenever any changes (additions or deletions) occur in the data plane network topology, thereby maintaining synchronization with the control plane network topology view. However, dynamic changes in network topology are common, and the extensive use of static configuration in SDN networks impairs the controller's ability to handle dynamic network changes. Furthermore, manual management is cumbersome, error-prone, and unscalable in practice. This security defense approach clearly lacks appeal.

[0007] The difficulty in solving the above problems and defects lies in the need to consider the following three issues at the same time: 1) The newly proposed technologies and methods should be mainly implemented and applied on the network controller side, and need to have good versatility and compatibility, and try to avoid modifications to related protocols, especially when it comes to implementation in physical network equipment from different manufacturers; 2) The newly proposed technologies and methods should simultaneously defend against link forgery and host forgery attacks; 3) The newly proposed technologies and methods adapt to the characteristics of dynamic network changes. In addition, the newly proposed technologies and methods must also have good ease of use and flexibility, and be able to achieve network-free start-stop switching when facing different application scenarios. To this end, it is necessary to meet the following requirements: 1) When enabled, it can detect and remove existing forged links and hosts in the control plane network view; 2) During operation, it can detect and resist all topological attacks against the control plane network view without affecting the normal operation of the SDN network; 3) When disabled, it can release the occupied resources in a timely manner, no longer restrict any changes to the control plane network view, and reduce the performance overhead of the controller.

[0008] The significance of addressing these issues and shortcomings lies in the fact that in SDN networks, controllers use the control plane network topology to formulate network control and management policies. A reliable and accurate network topology view is crucial. As a crucial step in the dynamic synchronization of the data and control plane network topology views, topology attack detection and prevention ensures accurate synchronization and is fundamental to achieving efficient network resource allocation, intelligent network management, and normal network operation. Therefore, the development of control plane topology attack detection and prevention technologies tailored to real-world, complex network scenarios is crucial to the advancement of SDN network security technology. Summary of the Invention

[0009] The technical problem to be solved by the present invention is as follows: In response to the above-mentioned problems in the prior art, a control plane topology attack detection and defense method and system for a software-defined network are provided. The present invention aims to achieve real-time detection, interception and removal of forged links and hosts in the network environment of a software-defined network.

[0010] In order to solve the above technical problems, the technical solution adopted by the present invention is: A method for detecting and defending against control plane topology attacks in a software-defined network comprises the following steps: S101, receiving an incoming Packet-In message, filtering and processing the LLDP message and ARP message: by comparing with the network topology of the existing control plane, detecting whether the associated port of the link or host to be added in the message is occupied, if occupied, intercepting the link or host to be added, recording the port-port pair information of the occupied ports of the link in the conflicting link port table, and recording the port information of the occupied ports of the host in the conflicting host port table; S102, link identification and defense based on the conflict link port table: traverse the port-port pair information in the conflict link port table, measure the degree of mutual dependence of the two ports by calculating the port mutual information value, identify the conflict link corresponding to the port-port pair with a mutual dependence higher than a preset threshold as a normal link, and remove it from the conflict link port table; identify the conflict link corresponding to the port-port pair with a low degree of mutual dependence as a fake link, remove it from the conflict link port table, and simultaneously delete the fake link in the control plane network topology; perform host identification and defense based on the conflict host port table: traverse the port information in the conflict host port table, verify the host status by sending an ARP request of the corresponding host from the port, identify the conflict host that receives an ARP response from the port as a normal host, and remove it from the conflict host port table; identify the conflict host that does not receive an ARP response from the port as a fake host, remove it from the conflict host port table, and delete the fake host in the control plane network topology.

[0011] Optionally, in step S101, processing the LLDP message includes: S201, obtaining the link in the LLDP message If the link If the link already exists in the existing network, the LLDP message is directly released, and the process ends and exits. If it does not exist in the existing network, jump to step S202; S202, obtaining a link Port and ; S203, query port or Are there any associated links in the existing network? or If the port Related links or port Related links , then jump to step S204; otherwise query the port or Is there an associated host in the existing network? If there is no associated host , then allow the LLDP message to pass, end and exit; otherwise jump to step S205; S204, determining associated links For a fake link, if the port Related links , then determine the associated link For conflicting links, and The information of the composed port pair is added to the conflicting port table; if the port Related links , then determine the associated link For conflicting links, and Add the information of the composed port pair to the conflicting port table; query the port or Is there an associated host in the existing network? If there is no associated host Then intercept the LLDP message, end and exit; otherwise jump to step S205; S205, determine the associated host For conflicting hosts, if the port There is an associated host , then the port and associated hosts Add to the conflicting host port table; if the port There is an associated host , then the port and associated hosts Add the host port to the conflicting table, intercept LLDP messages, and exit.

[0012] Optionally, in step S101, processing the ARP message includes: S301, obtain the host in the ARP message If the host If the host already exists in the existing network, it will directly release the ARP message, end and exit; if the host If it does not exist in the existing network, jump to step S302; S302, obtain the host Associated ports in the network topology ; S303, query port Is there any associated link in the existing network? If so, Then determine the host Forged host and associated links For conflicting links, set the port and associated links Port The composed port pair is added to the conflicting link port table; S304, query port Is there an associated host in the existing network? If the port There is an associated host , then determine the host To forge a host, associate the host For conflicting hosts, change the port and associated hosts Add to the conflicting host port table, intercept ARP messages, end and exit; if the port If no associated host exists, the ARP message is allowed to pass.

[0013] Optionally, in step S102, the function expression for calculating the port mutual information value of two ports is: , in, For port 、 The port mutual information value, is the mutual information value, and Port Received and sent message vectors, and Port Received and sent message vectors, and Port vectors of bytes received and sent, and Port The received and sent byte vectors, the message vector is composed of a plurality of consecutive message reception / sending numbers, the byte vector is composed of a plurality of consecutive byte reception / sending numbers, and the calculation function expression of the mutual information value is; , in, Represents a message vector 、 The mutual information value of and Message vectors 、 The covariance matrix of is a matrix The determinant of .

[0014] Optionally, in step S102, link identification and defense based on the conflicting link port table includes: S401, obtaining the minimum data length for calculating the configured port mutual information value , port mutual information value judgment threshold T, identification cycle interval ; S402, obtaining the configured conflict link port table length , initialize the loop variable ; S403, obtain the conflicting link port table i conflicting links Two ports and , get the length of the corresponding nine-tuple array , the nine-tuple array includes the loop variable i ,port Received and sent message vectors and ports Received and sent message vectors and ports Byte vectors and ports to send and receive Byte vectors received and sent; S404, if If established, further judgment Is it established? If If it is established, it is determined that there is a next conflict link, and the loop variable Add 1, jump to step S403, if If not, go to step S410; If not, jump to step S405; S405, get the latest in the nine-tuple array Nine-tuple data are normalized to form a nine-tuple data set DS; S406, obtaining the port from the nine-tuple data set DS Received message vector and ports Sent message vector , and calculate the port Received message vector and ports Sent message vector The mutual information value between them is taken as the first mutual information value; the port is obtained from the nine-tuple data set DS The sent message vector and ports Received message vector , computing port The sent message vector and ports Received message vector The mutual information value between is taken as the second mutual information value; the port is obtained from the nine-tuple data set DS Received byte vector Vectors and Ports Vector of bytes sent , and calculate the port Received byte vector Vectors and Ports Vector of bytes sent The mutual information value between them is used as the third mutual information value; the port is obtained from the nine-tuple data set DS Vector of bytes sent and ports Vector of the number of bytes received , and calculate the port Vector of bytes sent and ports Vector of the number of bytes received The mutual information value between them is taken as the fourth mutual information value; S407, taking the minimum value of the first mutual information value, the second mutual information value, the third mutual information value, and the fourth mutual information value as the port and ports The port mutual information value of S408, if the port and ports The port mutual information value is less than the preset threshold If it does not hold, the link is determined If the link is normal, it is only deleted from the conflicting link port table; otherwise, the link is determined to be To forge a link, delete it from the conflicting link port table and simultaneously delete it from the existing network topology; S409, judgment Is it established? If If it is established, it is determined that there is a next conflict link, and the loop variable Add 1, jump to step S403, if If not, jump to step S410; S410, waiting for a preset identification cycle interval Then, jump to step S402.

[0015] Optionally, in step S102, performing host identification and defense based on the conflicting host port table includes: S501, obtain the configured identification cycle interval Maximum number of host identification times ; S502, obtain the configured conflicting host port table length , set the loop variable ; S503, obtain the conflicting host port table Conflicting hosts H, associated ports and the number of identifications of the conflicting host H ; S504, if If not, the conflicting host H is determined to be a forged host, and it is deleted from the conflicting host port table and the existing network topology at the same time, and the process jumps to step S506; otherwise, the process jumps to step S505; S505, construct host ARP request message and from port Send out, and further determine whether the host has received it within the specified time If the host receives an ARP response within the specified time, If the host H receives an ARP response from the host, it is determined that the host H is a normal host, and it is only deleted from the conflicting host port table, and the process goes to step S506; if the host H is not received within the specified time, the host H is judged to be a normal host, and it is only deleted from the conflicting host port table, and the process goes to step S506; ARP response, then the number of host H's identification Add 1; S506, judgment Is it established? If If it is established, it is determined that there is a next conflicting host, and the loop variable Add 1, jump to step S503, if If not, wait for an identification cycle interval Then, execute step S502.

[0016] In addition, the present invention also provides a control plane topology attack detection and defense system for applying the control plane topology attack detection and defense method for software-defined networks, comprising: The conflict detection program module is used to receive incoming Packet-In messages, filter and process LLDP messages and ARP messages: by comparing with the network topology of the existing control plane, it detects whether the associated port of the link or host to be added in the message is occupied. If occupied, it intercepts the link or host to be added, records the port-port pair information of the ports occupied by the link in the conflict link port table, and records the port information occupied by the host in the conflict host port table; A forged identification and processing program module is used to perform link identification and defense based on a conflicting link port table and host identification and defense based on a conflicting host port table: traverse the port-port pair information in the conflicting link port table, measure the degree of mutual dependence of the two ports by calculating the port mutual information value of the two ports, identify the conflicting links corresponding to the port-port pairs with a mutual dependence higher than a preset threshold as normal links, and remove them from the conflicting link port table; identify the conflicting links corresponding to the port-port pairs with a low degree of mutual dependence as forged links, remove them from the conflicting link port table, and simultaneously delete the forged links in the control plane network topology; traverse the port information in the conflicting host port table, verify the host status by sending an ARP request of the corresponding host from the port, identify the conflicting host that receives an ARP response from the port as a normal host, and remove it from the conflicting host port table; identify the conflicting host that does not receive an ARP response from the port as a forged host, remove it from the conflicting host port table, and delete the forged host in the control plane network topology.

[0017] In addition, the present invention also provides a control plane topology attack detection and defense system for a software-defined network, comprising a microprocessor and a memory connected to each other, wherein the microprocessor is programmed or configured to execute the control plane topology attack detection and defense method for the software-defined network.

[0018] In addition, the present invention also provides a computer-readable storage medium, which stores a computer program or instruction, and the computer program or instruction is programmed or configured to execute the control plane topology attack detection and defense method of the software-defined network through a processor.

[0019] In addition, the present invention also provides a computer program product, including a computer program or instructions, which are programmed or configured to execute the control plane topology attack detection and defense method of the software-defined network through a processor.

[0020] Compared with the existing technology, the present invention can mainly achieve the following beneficial effects: the present invention realizes the detection and defense capabilities of topology attacks on the SDN network control plane by processing LLDP and ARP messages, and collecting port statistical data for forgery identification. The present invention realizes centralized deployment on the controller side, which is easy to maintain; there is no need to modify the southbound protocol, and it has good versatility and compatibility; it can defend against link forgery and host forgery attacks at the same time, meeting high security requirements; and it can achieve seamless start and stop for different application scenarios. When enabled, it can detect and clear forged links / hosts that existed before activation; after activation, it can continuously resist topology attacks without affecting the normal needs of dynamic changes in the network; after deactivation, it can release occupied resources in a timely manner, reduce the performance overhead of the controller, and has good reliability, flexibility and scalability. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] Figure 1 Schematic diagram of the basic process of the method of the embodiment of the present invention.

[0022] Figure 2 The figure is a flow chart of filtering and processing LLDP messages and ARP messages in an embodiment of the present invention.

[0023] Figure 3 The figure is a flow chart of link identification and defense based on a conflicting link port table in an embodiment of the present invention.

[0024] Figure 4 The figure is a flow chart of link identification and defense based on the conflicting host port table in an embodiment of the present invention.

[0025] Figure 5 Schematic diagram of the system structure in an embodiment of the present invention. DETAILED DESCRIPTION

[0026] In order to enable those skilled in the art to better understand the technical solution of the present invention, the technical solution of the present invention will be further described in detail below with reference to the accompanying drawings in the embodiments of the present invention.

[0027] like Figure 1 As shown, the control plane topology attack detection and defense method for software-defined networks in this embodiment includes the following steps: S101 receives incoming Packet-In messages, filters and processes LLDP (Link Layer Discovery Protocol) and ARP (Address Resolution Protocol) messages. By comparing the messages with the existing control plane network topology, the system detects whether the ports associated with the link or host to be added are occupied. If so, the link or host to be added is intercepted, and the occupied ports are recorded in the conflicting link port table as port-port pairs. The occupied ports are recorded in the conflicting host port table. Packet-In messages are interactive messages between the data plane (switch) and the control plane (controller) in the software-defined networking (SDN) architecture. When a switch cannot process a data packet independently, it sends the packet to the controller via a Packet-In message for further processing. S102, link identification and defense based on the conflict link port table: traverse the port-port pair information in the conflict link port table, measure the degree of mutual dependence of the two ports by calculating the port mutual information value, identify the conflict link corresponding to the port-port pair with a mutual dependence higher than a preset threshold as a normal link, and remove it from the conflict link port table; identify the conflict link corresponding to the port-port pair with a low degree of mutual dependence as a fake link, remove it from the conflict link port table, and simultaneously delete the fake link in the control plane network topology; perform host identification and defense based on the conflict host port table: traverse the port information in the conflict host port table, verify the host status by sending an ARP request of the corresponding host from the port, identify the conflict host that receives an ARP response from the port as a normal host, and remove it from the conflict host port table; identify the conflict host that does not receive an ARP response from the port as a fake host, remove it from the conflict host port table, and delete the fake host in the control plane network topology.

[0028] like Figure 2 As shown, in step S101 of this embodiment, processing the LLDP message includes: S201, obtaining the link in the LLDP message If the link If the link already exists in the existing network, the LLDP message is directly released, and the process ends and exits. If it does not exist in the existing network, jump to step S202; S202, obtaining a link Port and ; S203, query port or Are there any associated links in the existing network? or If the port Related links or port Related links , then jump to step S204; otherwise query the port or Is there an associated host in the existing network? If there is no associated host , then allow the LLDP message to pass, end and exit; otherwise jump to step S205; S204, determining associated links For a fake link, if the port Related links , then determine the associated link For conflicting links, and The information of the composed port pair is added to the conflicting port table; if the port Related links , then determine the associated link For conflicting links, and Add the information of the composed port pair to the conflicting port table; query the port or Is there an associated host in the existing network? If there is no associated host Then intercept the LLDP message, end and exit; otherwise jump to step S205; S205, determine the associated host For conflicting hosts, if the port There is an associated host , then the port and associated hosts Add to the conflicting host port table; if the port There is an associated host , then the port and associated hosts Add the host port to the conflicting table, intercept LLDP messages, and exit.

[0029] like Figure 2 As shown, in step S101 of this embodiment, processing the ARP message includes: S301, obtain the host in the ARP message If the host If the host already exists in the existing network, it will directly release the ARP message, end and exit; if the host If it does not exist in the existing network, jump to step S302; S302, obtain the host Associated ports in the network topology ; S303, query port Is there any associated link in the existing network? If so, Then determine the host Forged host and associated links For conflicting links, set the port and associated links Port The composed port pair is added to the conflicting link port table; S304, query port Is there an associated host in the existing network? If the port There is an associated host , then determine the host To forge a host, associate the host For conflicting hosts, change the port and associated hosts Add to the conflicting host port table, intercept ARP messages, end and exit; if the port If no associated host exists, the ARP message is allowed to pass.

[0030] In step S102 of this embodiment, the function expression for calculating the port mutual information value of two ports is: , in, For port 、 The port mutual information value, is the mutual information value, and Port Received and sent message vectors, and Port Received and sent message vectors, and Port vectors of bytes received and sent, and Port The byte vectors received and sent, the message vector is composed of the number of consecutive messages received / sent, and the byte vector is composed of the number of consecutive bytes received / sent. MI (mutual information value) measures how much information two random variables share, that is, determines the random variable Postrandom variable Therefore, MI is often used to measure the degree to which the uncertainty of two variables is reduced. and A strong indicator of dependence between variables, an MI value of 0 indicates independence, and a value of 1 indicates perfect correlation. and , then the calculation function expression of the mutual information value is; , in, Represents a message vector 、 The mutual information value of and Message vectors 、 The covariance matrix of is a matrix The determinant of the normal link port. and There is a strong dependency between the data. In theory, The number of packets received / sent and the number of bytes received / sent are equal to The number of packets and bytes sent / received is calculated based on the number of packets and bytes sent / received. In reality, due to factors such as data transmission delay and packet loss on the link, the data between the two ports is not strictly equal, but the strong dependence between them still holds. However, this dependence obviously does not exist between the two ports of a forged link. Therefore, using MI to calculate the degree of dependence between the corresponding statistical data of the two ports can effectively identify the link status (normal or forged).

[0031] like Figure 3 As shown, in step S102 of this embodiment, link identification and defense based on the conflicting link port table include: S401, obtaining the minimum data length for calculating the configured port mutual information value , port mutual information value judgment threshold T, identification cycle interval ; S402, obtaining the configured conflict link port table length , initialize the loop variable ; S403, obtain the conflicting link port table i conflicting links Two ports and , get the length of the corresponding nine-tuple array , the nine-tuple array includes the loop variable i ,port Received and sent message vectors and ports Received and sent message vectors and ports Byte vectors and ports to send and receive Byte vectors received and sent; S404, if If established, further judgment Is it established? If If it is established, it is determined that there is a next conflict link, and the loop variable Add 1, jump to step S403, if If not, go to step S410; If not, jump to step S405; S405, get the latest in the nine-tuple array Nine-tuple data are normalized to form a nine-tuple data set DS; S406, obtaining the port from the nine-tuple data set DS Received message vector and ports Sent message vector , and calculate the port Received message vector and ports Sent message vector The mutual information value between them is taken as the first mutual information value; the port is obtained from the nine-tuple data set DS The sent message vector and ports Received message vector , computing port The sent message vector and ports Received message vector The mutual information value between is taken as the second mutual information value; the port is obtained from the nine-tuple data set DS Received byte vector Vectors and Ports Vector of bytes sent , and calculate the port Received byte vector Vectors and Ports Vector of bytes sent The mutual information value between them is used as the third mutual information value; the port is obtained from the nine-tuple data set DS Vector of bytes sent and ports Vector of the number of bytes received , and calculate the port Vector of bytes sent and ports Vector of the number of bytes received The mutual information value between them is taken as the fourth mutual information value; S407, taking the minimum value of the first mutual information value, the second mutual information value, the third mutual information value, and the fourth mutual information value as the port and ports The port mutual information value of S408, if the port and ports The port mutual information value is less than the preset threshold If it does not hold, the link is determined If the link is normal, it is only deleted from the conflicting link port table; otherwise, the link is determined to be To forge a link, delete it from the conflicting link port table and simultaneously delete it from the existing network topology; S409, judgment Is it established? If If it is established, it is determined that there is a next conflict link, and the loop variable Add 1, jump to step S403, if If not, jump to step S410; S410, waiting for a preset identification cycle interval Then, jump to step S402.

[0032] like Figure 4 As shown, in step S102 of this embodiment, host identification and defense based on the conflicting host port table includes: S501, obtain the configured identification cycle interval Maximum number of host identification times ; S502, obtain the configured conflicting host port table length , set the loop variable ; S503, obtain the conflicting host port table Conflicting hosts H, associated ports and the number of identifications of the conflicting host H ; S504, if If not, the conflicting host H is determined to be a forged host, and it is deleted from the conflicting host port table and the existing network topology at the same time, and the process jumps to step S506; otherwise, the process jumps to step S505; S505, construct host ARP request message and from port Send out, and further determine whether the host has received it within the specified time If the host receives an ARP response within the specified time, If the host H receives an ARP response from the host, it is determined that the host H is a normal host, and it is only deleted from the conflicting host port table, and the process goes to step S506; if the host H is not received within the specified time, the host H is judged to be a normal host, and it is only deleted from the conflicting host port table, and the process goes to step S506; ARP response, then the number of host H's identification Add 1; S506, judgment Is it established? If If it is established, it is determined that there is a next conflicting host, and the loop variable Add 1, jump to step S503, if If not, wait for an identification cycle interval Then, execute step S502.

[0033] In summary, the method of this embodiment realizes the detection and defense capability of topology attacks on the control plane of the SDN network by processing LLDP and ARP messages and collecting port statistics for forgery identification. The present invention realizes centralized deployment on the controller side and is easy to maintain; it does not require modification of the southbound protocol and has good versatility and compatibility; it can simultaneously defend against link forgery and host forgery attacks and meet high security requirements; it can achieve seamless start and stop for different application scenarios. When enabled, it can detect and clear forged links / hosts that existed before activation; after activation, it can continuously resist topology attacks without affecting the normal needs of dynamic changes in the network; after deactivation, it can release occupied resources in a timely manner, reduce the performance overhead of the controller, and has good reliability, flexibility and scalability.

[0034] like Figure 5 As shown, this embodiment also provides a control plane topology attack detection and defense system for applying the control plane topology attack detection and defense method of the software-defined network, including: The conflict detection program module is used to receive incoming Packet-In messages, filter and process LLDP messages and ARP messages: by comparing with the network topology of the existing control plane, it detects whether the associated port of the link or host to be added in the message is occupied. If occupied, it intercepts the link or host to be added, records the port-port pair information of the ports occupied by the link in the conflict link port table, and records the port information occupied by the host in the conflict host port table; A forged identification and processing program module is used to perform link identification and defense based on a conflicting link port table and host identification and defense based on a conflicting host port table: traverse the port-port pair information in the conflicting link port table, measure the degree of mutual dependence of the two ports by calculating the port mutual information value of the two ports, identify the conflicting links corresponding to the port-port pairs with a mutual dependence higher than a preset threshold as normal links, and remove them from the conflicting link port table; identify the conflicting links corresponding to the port-port pairs with a low degree of mutual dependence as forged links, remove them from the conflicting link port table, and simultaneously delete the forged links in the control plane network topology; traverse the port information in the conflicting host port table, verify the host status by sending an ARP request of the corresponding host from the port, identify the conflicting host that receives an ARP response from the port as a normal host, and remove it from the conflicting host port table; identify the conflicting host that does not receive an ARP response from the port as a forged host, remove it from the conflicting host port table, and delete the forged host in the control plane network topology.

[0035] like Figure 5 As shown, this embodiment also includes a data acquisition program module. The data acquisition program module is used to periodically obtain conflicting port information from the counterfeit identification and processing program module, regularly collect statistical data on the conflicting ports, and transmit the collected data back to the counterfeit identification and processing program module. Specifically, the data acquisition program module periodically traverses all conflicting ports from the conflicting link port table of the counterfeit identification and processing program module, obtains the current received / sent packets and received / sent bytes of the conflicting ports from the SDN switch via the southbound protocol, and transmits the collected data back to the counterfeit identification and processing program module.

[0036] In this embodiment, the conflict detection program module is responsible for processing the LLDP and ARP messages received by the SDN controller, and detecting whether the port information of the link or host to be added conflicts with the existing network topology. When a conflict is detected, the link or host to be added is intercepted, and the conflicting port information is passed to the forged identification and processing program module, so as to update the conflict link port table and the conflict host port table through the forged identification and processing program module. The conflict detection program module detects whether the associated port of the link or host to be added is occupied in the existing control plane network topology. If occupied, the link or host to be added is intercepted, and the port-port pair information composed of the ports occupied by the link is passed to the conflict link port table of the forged identification and processing program module, and the port information occupied by the host is passed to the conflict host port table of the forged identification and processing program module; The counterfeit identification and processing program module receives the conflict port information output by the conflict detection program module and the conflict port statistics output by the data acquisition program module, and saves them to the conflict link port table or the conflict host port table. It periodically analyzes whether the ports in the conflict port table are abnormal, identifies the conflict link / host corresponding to the normal port as a normal link / host, and simply removes it from the conflict port table; identifies the conflict link / host corresponding to the abnormal port as a counterfeit link / host, removes it from the conflict port table, and simultaneously deletes the counterfeit link / host in the existing network topology. Specifically, the counterfeit identification and processing program module receives the output information of the conflict detection program module and the data acquisition program module, and is used to update the conflict link port table, the conflict host port table, and the port statistics. For the link, it traverses the port-port pair information in the conflict link port table and measures the degree of mutual dependence by calculating the mutual information (MI) value of the two ports. The conflicting links corresponding to port-port pairs with a high degree of mutual dependence are identified as normal links and are simply removed from the conflicting link port table. The conflicting links corresponding to port-port pairs with a low degree of mutual dependence are identified as forged links and are removed from the conflicting link port table while simultaneously deleting the forged links from the control plane network topology. For hosts, the port information in the conflicting host port table is traversed and the host status is verified by sending an ARP request for the corresponding host from the port. The conflicting host that receives an ARP response from the port is identified as a normal host and is simply removed from the conflicting host port table. The conflicting host that does not receive an ARP response from the port is identified as a forged host and is removed from the conflicting host port table while simultaneously deleting the forged host from the control plane network topology.

[0037] The working process of the control plane topology attack detection and defense system in this embodiment is as follows: 1) Module initialization. During the initialization phase of system startup, the data acquisition program module initializes the acquisition cycle interval. etc.; forge identification and processing program module to complete the creation of conflict link / host port table and initialize identification cycle interval , minimum statistical data length , link identification threshold , Maximum host identification times Then, the conflict detection program module completes a conflict detection task on the existing control plane network topology, aiming to find conflicting links / hosts that already existed in the control plane network topology before startup; 2) Conflicting link / host detection. The basic principle of conflict detection is that a network device port can only be connected to one link or one host at the same time. The basic idea of ​​conflict detection is to determine whether the port associated with the newly added link / host is occupied in the existing network topology. During the operation of the method, the conflict detection program module processes the LLDP and ARP messages received by the controller, and detects whether the link / host information carried in the message conflicts with the port of the existing control plane network topology. If no conflict occurs, the message is allowed to pass; if a conflict occurs, the link / host information carried in the message is considered to be forged, the message is intercepted and subsequent processing is rejected. At the same time, the link associated with the relevant port in the existing control plane network topology is marked as a conflicting link and added to the conflicting link port table; the host associated with the relevant port is marked as a conflicting host and added to the conflicting host port table; 3) Conflict port data collection. During the method run, the data collection program module At intervals, collect port-port pair statistics in the conflict link port table, including port Number of received messages , Number of sent messages , Number of bytes received , Number of bytes sent and ports Number of received messages , Number of sent messages , Number of bytes received , Number of bytes sent , forming nine-tuple data: , in The data subscript index, that is, the loop variable The value of 4) Forged link identification and processing. During system operation, the forged link identification and processing module At intervals, the conflicting links in the conflicting link port table are regularly identified as forged links. If a link is identified as a normal link, it is simply removed from the conflicting link port table. If a link is identified as a forged link, it is removed from the conflicting link port table and the forged link is simultaneously deleted from the existing control plane network topology. 5) Forged host identification and processing. During system operation, the forged identification and processing program module At intervals, the conflicting host in the conflicting host port table is regularly identified as a forged host. If it is identified as a normal host, it is simply removed from the conflicting host port table. If it is identified as a forged host, it is removed from the conflicting host port table and the forged host is deleted from the existing control plane network topology. 6) Resource Release. During system shutdown, the conflict detection module stops processing LLDP and ARP messages, the data collection module stops data collection, the forgery identification and handling module stops forgery identification, and the conflicting link / host port table is cleared. Each module releases occupied memory space and stops consuming resources.

[0038] Among them, the module initialization in step 1) includes: 1.1): Initialize the parameter values, including the acquisition cycle interval , Forgery identification cycle interval , minimum statistical data length , link identification threshold , Maximum host identification times etc. Among them The interval period should be greater than Interval period; 1.2): Create a conflict link port table to store the port-port pair information of the conflict link. Each port pair information contains three data items: port 、 And a nine-tuple array consisting of two-port statistical data. The array is used to store nine-tuple data, each data is divided into 9 items, the first item is the subscript index; items 2-5 are stored Information, respectively, port The number of packets received / sent and the number of bytes received / sent; items 6-9 store Information, respectively, port The number of packets received / sent and the number of bytes received / sent; 1.3): Create a conflicting host port table to store the port information of the conflicting host. Each piece of information contains three data items, namely, port , host ID , recognition times 1.4): Traverse each port of all SDN switches in the current network and check whether their port states conflict. Specifically, if a port has no associated links or hosts, or only one associated link or one associated host, the port state is considered normal. If a port has two or more associated links, two or more associated hosts, or both, the port state is considered conflicting. All associated links / hosts for that port are then added to the conflicting link / host port table.

[0039] The conflict link / host detection in step 2) includes: receiving the LLDP message, obtaining the link information in the message ,if If it already exists in the existing network, it will exit directly; if If it does not exist, get the link port and First, query Is there any associated link in the existing network? If so, , then it is believed that To forge a link, intercept LLDP messages and assume For conflicting links, and The information of the composed port pair is added to the conflict link port table; secondly, query Is there an associated host in the existing network? If so, , then it is believed that To forge a link, intercept LLDP messages and assume For conflicting hosts, and Add to the conflicting host port table. Similarly, port Repeat the above steps. If and If there are no associated links or hosts, the LLDP message will be released and the controller will complete the Add the link; receive the ARP message and obtain the host information in the message ,if If it already exists in the existing network, it will exit directly; if If it does not exist, get the associated port First, query Is there any associated link in the existing network? If so, , then it is believed that To forge a host, intercept ARP messages and think For conflicting links, and The information of the composed port pair is added to the conflict link port table; secondly, query Is there an associated host in the existing network? If so, , then it is believed that To forge a host, intercept ARP messages and think For conflicting hosts, and Add to the conflicting host port table. If Associated ports If there is no associated link / host, the ARP message is released and the controller will complete the In port Add the host on .

[0040] The conflict port data collection in step 3) includes: 3.1): setting the subscript index ; 3.2): Get the conflicting link port table Two ports of a conflicting link and , get the length of the corresponding nine-tuple array , here The subscript index value of the last nine-tuple data in the nine-tuple array; 3.3): Collection and The number of packets received / sent and the number of bytes received / sent at the current moment form a nine-tuple data: ; 3.4): Save the nine-tuple data to the The tail of the nine-tuple array of conflicting links; 3.5): If the next conflicting link exists in the table, assign and return to step 3.2), otherwise go to step 3.6); 3.6): Wait for one acquisition cycle interval Then, go back to step 3.1).

[0041] Step 4) in the forged link identification and processing includes: 4.1): Setting the subscript index ; 4.2): Get the first conflicting links, whose two ports are and , the length of the nine-tuple array is , here is the subscript index value of the last nine-tuple data in the nine-tuple array; 4.3): If , indicating that the current nine-tuple data volume is insufficient for link forgery identification, more data needs to be collected, and the current conflicting link is temporarily skipped. If the next conflicting link exists in the table, the value is assigned and go back to step 4.2), otherwise go to step 4.12); 4.4): If , indicating that the current nine-tuple data volume is sufficient, link forgery identification can be performed, and the nine-tuple array is intercepted. The value range is of total Nine-tuple data (i.e. the latest ), forming a nine-tuple dataset for forgery identification: ; 4.5): Get the port from the nine-tuple dataset The number of received messages is normalized to form a received message vector: , Get the port The number of sent messages is normalized to form a sent message vector: , The vector and Substitute into the formula to calculate: ; 4.6:) Get the port from the nine-tuple dataset The number of sent messages is normalized to form a sent message vector: , Get the port The number of received messages is normalized to form a received message vector: , The vector and Substitute into the formula to calculate: ; 4.7): Get the port from the nine-tuple dataset The number of received bytes is normalized to form the received byte vector: , Get the port The number of bytes sent is normalized to form the sent byte vector: , The vector and Substitute into the formula to calculate: ; 4.8): Get the port from the nine-tuple dataset The number of bytes sent is normalized to form the sent byte vector: , Get the port The number of received bytes is normalized to form the received byte vector: , The vector and Substitute into the formula to calculate: ; 4.9): Computing port and The port mutual information value , the formula is as follows: , 4.10): Comparison and link identification threshold ,if , the link is considered a normal link and is only removed from the conflicting link port table; if , then the link is considered a forged link, and it is removed from the conflict link port table and the forged link is deleted from the existing control plane network topology at the same time; 4.11): If the next conflict link exists in the table, assign and return to step 4.2), otherwise go to step 4.12); 4.12): wait for an identification cycle interval Then, go back to step 4.1); Step 5) in the forged host identification and processing includes: 5.1): Setting the subscript index ; 5.2): Get the conflicting host port table Conflicting hosts H, associated ports and recognition times ; 5.3): If , indicating that the maximum number of host identification times has been exceeded, and it is considered To forge a host, remove it from the conflicting host port table and simultaneously delete the forged host in the existing control plane network topology. If the next conflicting host exists in the table, assign and return to step 5.2), otherwise go to step 5.5); 5.4): If , then construct the host ARP request and from port If the host receives the If the ARP response is received, H is considered to be a normal host and is removed from the conflicting host port table. Otherwise, If the next conflicting host exists in the table, assign And return to step 5.2, otherwise go to step 5.5; 5.5): Wait for an identification cycle interval Then, go back to step 5.1).

[0042] In summary, the control plane topology attack detection and defense system of this embodiment realizes the detection and defense capability of the SDN network control plane topology attack by processing LLDP and ARP messages and collecting port statistics data for forgery identification. The present invention realizes centralized deployment on the controller side, which is easy to maintain; it does not require modification of the southbound protocol and has good versatility and compatibility; it can simultaneously defend against link forgery and host forgery attacks, meeting high security requirements; and it can be started and stopped seamlessly for different application scenarios. When enabled, it can detect and clear forged links / hosts that existed before activation; after activation, it can continuously resist topology attacks without affecting the normal needs of dynamic changes in the network; after deactivation, it can release the occupied resources in time, reduce the performance overhead of the controller, and has good reliability, flexibility and scalability.

[0043] In addition, this embodiment also provides a control plane topology attack detection and defense system for a software-defined network, including a microprocessor and a memory connected to each other, wherein the microprocessor is programmed or configured to execute the control plane topology attack detection and defense method for the software-defined network.

[0044] In addition, this embodiment also provides a computer-readable storage medium, which stores a computer program or instruction, and the computer program or instruction is programmed or configured to execute the control plane topology attack detection and defense method of the software-defined network through a processor.

[0045] In addition, this embodiment also provides a computer program product, including a computer program or instructions, which are programmed or configured to execute the control plane topology attack detection and defense method of the software-defined network through a processor.

[0046] Those skilled in the art should understand that the technical solution provided by the present invention may be in the form of a method, a system, or a computer program product. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware aspects. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-readable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code. The present invention is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present invention. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of processes and / or boxes in the flowchart and / or block diagram, may be implemented by computer program instructions. These computer program instructions may be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the functions described in the process. Figure 1 a process or multiple processes and / or boxes Figure 1 These computer program instructions can also be stored in a computer-readable memory that can guide a computer or other programmable data processing device to work in a specific way, so that the instructions stored in the computer-readable memory produce a product including the instruction device, which implements the function specified in the process. Figure 1 a process or multiple processes and / or boxes Figure 1These computer program instructions can also be loaded onto a computer or other programmable data processing device, so that a series of operation steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process in the process. Figure 1 a process or multiple processes and / or boxes Figure 1 The steps for the function specified in one or more boxes.

[0047] The above description is merely a preferred embodiment of the present invention. The scope of protection of the present invention is not limited to the above embodiment. All technical solutions based on the concept of the present invention are within the scope of protection of the present invention. It should be noted that for those skilled in the art, various improvements and modifications that do not depart from the principles of the present invention should also be considered within the scope of protection of the present invention.

Claims

1. A method for detecting and defending against control plane topology attacks in a software-defined network, characterized in that: The steps include: S101, receiving an incoming Packet-In message, filtering and processing the LLDP message and ARP message: by comparing with the network topology of the existing control plane, detecting whether the associated port of the link or host to be added in the message is occupied, if occupied, intercepting the link or host to be added, recording the port-port pair information of the occupied ports of the link in the conflicting link port table, and recording the port information of the occupied ports of the host in the conflicting host port table; S102, performing link identification and defense based on the conflicting link port table: traversing the port-port pair information in the conflicting link port table, measuring the degree of mutual dependence between the two ports by calculating the port mutual information value, identifying the conflicting links corresponding to the port-port pairs with a mutual dependence higher than a preset threshold as normal links, and removing only these links from the conflicting link port table; identifying the conflicting links corresponding to the port-port pairs with a low degree of mutual dependence as forged links, removing them from the conflicting link port table, and simultaneously deleting the forged links from the control plane network topology; Host identification and defense based on the conflicting host port table: traverse the port information in the conflicting host port table, verify the host status by sending ARP requests to the corresponding host from the port, identify the conflicting host that receives an ARP response from the port as a normal host, and simply remove it from the conflicting host port table; The conflicting host that does not receive an ARP response from the port is identified as a forged host, removed from the conflicting host port table, and deleted from the control plane network topology.

2. The control plane topology attack detection and defense method for software-defined networks according to claim 1, characterized in that: In step S101, processing the LLDP message includes: S201, obtaining the link in the LLDP message , if the link If the link already exists in the existing network, the LLDP message is directly released, and the process ends and exits. If it does not exist in the existing network, jump to step S202; S202, obtaining a link Port and ; S203, query port or Are there any associated links in the existing network? or If the port Related links or port Related links , then jump to step S204; otherwise query the port or Is there an associated host in the existing network? If there is no associated host , then allow the LLDP message to pass, end and exit; otherwise jump to step S205; S204, determining associated links For a fake link, if the port Related links , then determine the associated link For conflicting links, and The information of the composed port pair is added to the conflicting port table; if the port Related links , then determine the associated link For conflicting links, and Add the information of the composed port pair to the conflicting port table; query the port or Is there an associated host in the existing network? If there is no associated host Then intercept the LLDP message, end and exit; otherwise jump to step S205; S205, determine the associated host For conflicting hosts, if the port There is an associated host , then the port and associated hosts Add to the conflicting host port table; if the port There is an associated host , then the port and associated hosts Add the host port to the conflicting table, intercept LLDP messages, and exit.

3. The control plane topology attack detection and defense method for software-defined networks according to claim 1, characterized in that: In step S101, processing the ARP message includes: S301, obtain the host in the ARP message If the host If the host already exists in the existing network, it will directly release the ARP message, end and exit; if the host If it does not exist in the existing network, jump to step S302; S302, obtain the host Associated ports in the network topology ; S303, query port Is there any associated link in the existing network? If so, Then determine the host Forged host and associated links For conflicting links, set the port and associated links Port The composed port pair is added to the conflicting link port table; S304, query port Is there an associated host in the existing network? If the port There is an associated host , then determine the host To forge a host, associate the host For conflicting hosts, change the port and associated hosts Add to the conflicting host port table, intercept ARP messages, end and exit; if the port If no associated host exists, the ARP message is allowed to pass.

4. The control plane topology attack detection and defense method for software-defined networks according to claim 1, characterized in that: In step S102, the function expression for calculating the port mutual information value of two ports is: ， in, For port 、 The port mutual information value, is the mutual information value, and Port Received and sent message vectors, and Port Received and sent message vectors, and Port vectors of bytes received and sent, and Port The received and sent byte vectors, the message vector is composed of a plurality of consecutive message reception / sending numbers, the byte vector is composed of a plurality of consecutive byte reception / sending numbers, and the calculation function expression of the mutual information value is; ， in, Represents a message vector 、 The mutual information value of and Message vectors 、 The covariance matrix of is a matrix The determinant of .

5. The control plane topology attack detection and defense method for software-defined networks according to claim 1, characterized in that: In step S102, link identification and defense based on the conflicting link port table include: S401, obtaining the minimum data length for calculating the configured port mutual information value , port mutual information value judgment threshold T, identification cycle interval ; S402, obtaining the configured conflict link port table length , initialize the loop variable ; S403, obtain the conflicting link port table i conflicting links Two ports and , get the length of the corresponding nine-tuple array , the nine-tuple array includes the loop variable i ,port Received and sent message vectors and ports Received and sent message vectors and ports Byte vectors and ports to send and receive Byte vectors received and sent; S404, if If established, further judgment Is it established? If If it is established, it is determined that there is a next conflict link, and the loop variable Add 1, jump to step S403, if If not, jump to step S410. If not, jump to step S405; S405, get the latest in the nine-tuple array Nine-tuple data are normalized to form a nine-tuple data set DS; S406, obtaining the port from the nine-tuple data set DS Received message vector and ports Sent message vector , and calculate the port Received message vector and ports Sent message vector The mutual information value between them is taken as the first mutual information value; the port is obtained from the nine-tuple data set DS The sent message vector and ports Received message vector , computing port The sent message vector and ports Received message vector The mutual information value between is taken as the second mutual information value; the port is obtained from the nine-tuple data set DS Received byte vector Vectors and Ports Vector of bytes sent , and calculate the port Received byte vector Vectors and Ports Vector of bytes sent The mutual information value between them is used as the third mutual information value; the port is obtained from the nine-tuple data set DS Vector of bytes sent and ports Vector of the number of bytes received , and calculate the port Vector of bytes sent and ports Vector of the number of bytes received The mutual information value between them is taken as the fourth mutual information value; S407, taking the minimum value of the first mutual information value, the second mutual information value, the third mutual information value, and the fourth mutual information value as the port and ports The port mutual information value of S408, if the port and ports The port mutual information value is less than the preset threshold If it does not hold, the link is determined If the link is normal, it is only deleted from the conflicting link port table; otherwise, the link is determined to be To forge a link, delete it from the conflicting link port table and simultaneously delete it from the existing network topology; S409, judgment Is it established? If If it is established, it is determined that there is a next conflict link, and the loop variable Add 1, jump to step S403, if If not, jump to step S410; S410, waiting for a preset identification cycle interval Then, jump to step S402.

6. The control plane topology attack detection and defense method for software-defined networks according to claim 1, characterized in that: In step S102, host identification and defense based on the conflicting host port table include: S501, obtain the configured identification cycle interval Maximum number of host identification times ; S502, obtain the configured conflicting host port table length , set the loop variable ; S503, obtain the conflicting host port table Conflicting hosts H, associated ports and the number of identifications of the conflicting host H ; S504, if If not, the conflicting host H is determined to be a forged host, and it is deleted from the conflicting host port table and the existing network topology at the same time, and the process jumps to step S506; otherwise, the process jumps to step S505; S505, construct host ARP request message and from port Send out, and further determine whether the host has received it within the specified time If the host receives an ARP response within the specified time, If the host H receives an ARP response from the host, it is determined that the host H is a normal host, and it is only deleted from the conflicting host port table, and the process goes to step S506; if the host H is not received within the specified time, the host H is judged to be a normal host, and it is only deleted from the conflicting host port table, and the process goes to step S506; ARP response, then the host H's identification times Add 1; S506, judgment Is it established? If If it is established, it is determined that there is a next conflicting host, and the loop variable Add 1, jump to step S503, if If not, wait for an identification cycle interval Then, execute step S502.

7. A control plane topology attack detection and defense system for a software-defined network using the control plane topology attack detection and defense method according to any one of claims 1 to 6, characterized in that: include: The conflict detection program module is used to receive incoming Packet-In messages, filter and process LLDP messages and ARP messages: by comparing with the network topology of the existing control plane, it detects whether the associated port of the link or host to be added in the message is occupied. If occupied, it intercepts the link or host to be added, records the port-port pair information of the ports occupied by the link in the conflict link port table, and records the port information occupied by the host in the conflict host port table; A forgery identification and processing program module is used to perform link identification and defense based on the conflicting link port table and host identification and defense based on the conflicting host port table: traverse the port-port pair information in the conflicting link port table, measure the degree of mutual dependence between the two ports by calculating the port mutual information value, identify the conflicting links corresponding to the port-port pairs with a mutual dependence higher than a preset threshold as normal links, and remove them from the conflicting link port table; identify the conflicting links corresponding to the port-port pairs with a low degree of mutual dependence as forged links, remove them from the conflicting link port table, and simultaneously delete the forged links in the control plane network topology; Traverse the port information in the conflicting host port table, verify the host status by sending the corresponding host ARP request from the port, identify the conflicting host that receives the ARP response from the port as a normal host, and simply remove it from the conflicting host port table; The conflicting host that does not receive an ARP response from the port is identified as a forged host, removed from the conflicting host port table, and deleted from the control plane network topology.

8. A control plane topology attack detection and defense system for a software-defined network, comprising a microprocessor and a memory connected to each other, characterized in that: The microprocessor is programmed or configured to execute the control plane topology attack detection and defense method for software-defined networks according to any one of claims 1 to 6.

9. A computer-readable storage medium having a computer program or instruction stored therein, characterized in that: The computer program or instruction is programmed or configured to execute the control plane topology attack detection and defense method for a software-defined network according to any one of claims 1 to 6 through a processor.

10. A computer program product comprising a computer program or instructions, characterized in that The computer program or instruction is programmed or configured to execute the control plane topology attack detection and defense method for a software-defined network according to any one of claims 1 to 6 through a processor.

Images