A dynamic defense method and system based on an SDN network

Abstract

The application discloses a kind of dynamic defense method and system based on SDN network, it is related to network security technical field field;The method comprises: generating and fusing dynamic defense strategy set, it is converted into the flow table item with matching label and is preloaded to switch;When new flow arrives for the first time, controller generates label based on its packet header information and issues to entry switch, and label is marked on subsequent data packet;Switch in network matches preset flow table item according to the label carried by data packet and executes corresponding action;Based on dynamic risk intermediate centrality index, the performance of key nodes in the network is monitored in real time, when detecting the bottleneck, the global influence of different strategy adjustment actions on the network performance and security efficiency is predicted and evaluated, and the optimal solution is selected for adaptive adjustment, while the decision parameters are continuously optimized through feedback mechanism;The application realizes efficient dynamic defense while effectively guaranteeing the stability and global optimality of network performance.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a dynamic defense method and system based on SDN networks. Background Technology

[0002] In traditional network architectures, well-known attack surfaces, such as IP addresses, routing paths, and network topology, remain relatively static after network deployment. This static, fixed system configuration information, which supports real network communication services, becomes crucial intelligence for potential adversaries to conduct reconnaissance and scanning. Once an attacker obtains accurate configuration information through long-term, covert reconnaissance, they may discover weaknesses or critical points in the defense system, allowing them to precisely select attack targets, weapons, and attack paths, and successfully launch a network attack.

[0003] Dynamic network defense is a network defense technology that confuses or delays adversaries' reconnaissance and attack by dynamically changing the configuration attributes of a network system. It dynamically changes one or more key network configuration attributes, causing potential adversaries to obtain incorrect or outdated intelligence information, thereby increasing the cost of intelligence reconnaissance or causing them to attack the wrong targets, thus protecting network assets.

[0004] Thanks to the decoupling of the data layer and control layer in the SDN network architecture, and the advantage of the SDN controller in centralized global management and control of the network, it is possible to easily and quickly generate and deploy dynamic network defense strategies, thereby realizing dynamic network defense functions.

[0005] In SDN networks, the implementation of all dynamic defense strategies ultimately boils down to the generation and deployment of OpenFlow flow tables. However, numerous studies have found that frequent flow table updates and deployments can negatively impact network performance, for reasons including but not limited to: The increased packet loss rate, average latency, and network fluctuations caused by global routing inconsistencies, the additional time overhead of updating the TCAM (Ternary Content Addressable Memory) storing flow tables, and the limited computing, storage, and bandwidth resources of the SDN controller all contribute to the problem. It is evident that deploying dynamic defense strategies under the SDN architecture will inevitably damage network performance, and the degree of damage is positively correlated with the frequency of flow table distribution and updates.

[0006] Therefore, there is an urgent need for a dynamic defense method and system for SDN networks that can efficiently and smoothly execute dynamic defense without compromising the basic performance of the network, and achieve a high-order balance between security and availability. Summary of the Invention

[0007] The purpose of this invention is to overcome the shortcomings of the prior art and provide a dynamic defense method and system based on SDN networks. It aims to reduce the negative impact of network dynamic defense actions on network performance, thereby achieving a balance between the security of network dynamic defense and system performance. Through steps such as dynamic defense policy generation and policy fusion, hybrid flow table generation and preloading, label generation and flow table matching, and a policy feedback mechanism for dynamic performance monitoring, it achieves efficient network communication and stronger network dynamic security protection.

[0008] To achieve the above objectives, this application proposes a dynamic defense method based on SDN networks, comprising the following steps: Step S1: Generate a dynamic defense strategy set based on network topology and network security threat information, and perform fusion processing on the strategy set to obtain a low-redundancy and conflict-free fused strategy set; Step S2: Convert the fusion strategy set into an OpenFlow flow entry set, insert a matching tag for each flow entry, and preload the flow entry set into the corresponding switch; Step S3: When a Packet-In message for new traffic is received for the first time, a dynamic tag is generated based on the packet header information of the traffic, and the flow table entry carrying the tag is pushed to the ingress switch. The ingress switch then adds the dynamic tag to subsequent data packets and forwards them. Step S4: The intermediate switch preloads the flow table entry corresponding to the matching tag according to the matching tag corresponding to the dynamic tag and performs the corresponding action; Step S5: The egress switch removes the dynamic tag and forwards the data packet to the target host; Step S6: Select a node with high betweenness centrality in the SDN network as a performance monitoring node, and monitor the real-time performance load of the performance monitoring node in the SDN network in real time; wherein, when a performance bottleneck is detected, adjust the dynamic defense strategy according to the monitoring results, and repeat steps S1 to S6.

[0009] As a further solution, the fusion processing of the policy set described in step S1 includes: Each strategy is abstracted into a structured tuple that includes the executing entity, action, and triggering condition; Redundancy strategies are incorporated by using subsets and conditional generalization. A hierarchical arbitration mechanism is adopted to resolve strategic conflicts. The hierarchical arbitration mechanism includes priority of subject, priority of event, priority of time, and priority of negative action.

[0010] As a further solution, the set of preloaded flow table entries mentioned in step S2 includes: Deploy flow table entries only to the switch's idle flow table space; Set a threshold for flow table space occupancy. When the occupancy rate exceeds the threshold, pause the preloading operation.

[0011] As a further solution, generating the dynamic tag in step S3 includes: Extract the five-tuple information from the packet header, the five-tuple including source IP address, destination IP address, source port number, destination port number, and protocol type; Based on the aforementioned quintuple information, a 32-bit hash value is generated using the CRC32 algorithm as the base tag; The basic tags are shifted to obtain dynamic tags; Set a lifecycle for the dynamic tag; wherein, when the lifecycle ends, the corresponding flow table entry is deactivated and a new tag generation process is triggered.

[0012] As a further solution, step S6 involves monitoring the real-time performance load of the performance monitoring node, calculating a comprehensive load index based on a preset formula, and determining whether a performance bottleneck exists; wherein, The formula for calculating the comprehensive load index is as follows: in, Represents the current node Real-time bandwidth usage of the port with the highest bandwidth consumption. Represents total bandwidth capacity. Represents the current node The flow table space usage. Represents the total capacity of the flow table space. , These represent the bandwidth occupancy factor and the flow table occupancy factor, respectively.

[0013] As a further solution, the selection of monitoring high betweenness centrality nodes in step S6 includes: Based on the aforementioned fusion strategy set and SDN network structure, the static betweenness centrality index of each node is calculated. Select the nodes with the highest static betweenness centrality index values ​​(a predetermined proportion) as the initial performance monitoring nodes. Based on preset node update conditions, performance monitoring node updates are triggered; among them, Real-time load data is collected and combined with the static betweenness centrality index to calculate the dynamic risk betweenness centrality index; Select nodes with the highest dynamic risk betweenness centrality index values ​​(a predetermined percentage) to update subsequent performance monitoring nodes.

[0014] As a further solution, the formula for calculating the static betweenness centrality index is as follows: in, and These represent the static betweenness centrality before and after normalization, respectively. This represents the total number of nodes in the SDN network. Represents any pair of nodes ( , The total number of shortest paths between () This indicates that it has passed through nodes. The number of shortest paths; The formula for calculating the dynamic risk betweenness centrality index is as follows: in, This is a real-time link load weighting factor. This is the flow table space impact coefficient, used to adjust the contribution of flow table occupancy to the risk level. For nodes The occupancy rate of the flow table space at time t; The formula for calculating the link load weighting factor is as follows: in, For nodes The degree, i.e., the number of connected links; For nodes A set of connected links, This represents the real-time load of link e at time t. This represents the maximum capacity of link e.

[0015] As a further solution, when adjusting the dynamic defense strategy, the adjustment action is also selected based on the predicted impact value, specifically: Obtain the resource requirements of each dynamic defense strategy and apply them to each performance monitoring node; Based on the dynamic risk betweenness centrality index of each node after the strategy adjustment action, the change in betweenness centrality of the entire network is estimated. ; Based on the critical asset topology coverage of each node after the policy adjustment, the estimated change in overall network security performance is as follows. ; According to the formula Impact(a) = + λ * Calculate the comprehensive impact value Impact(a) of the adjustment action a; where λ is the safety weight coefficient; The adjustment action with the smallest overall impact value is selected as the adjustment action.

[0016] As a further solution, the method also includes a feedback calibration step: Record the actual changes in overall network performance and actual changes in security effectiveness after the strategy adjustment actions are executed; Calculate the estimated change in the total network betweenness center. The actual change in the network betweenness center and the estimated change in the network security performance. The error between the actual change in overall network security effectiveness; Based on the aforementioned error, the dynamic risk betweenness centrality index and the estimated change in the network betweenness centrality are used to calculate the overall network betweenness centrality. and the estimated change in overall network security performance. The parameters are calibrated.

[0017] On the other hand, the present invention also provides a dynamic defense system based on an SDN network, used to implement a dynamic defense method based on an SDN network as described in any of the preceding claims, loaded into the SDN controller of the SDN network, comprising: The dynamic defense strategy generation and fusion module is used to generate and fuse dynamic defense strategy sets; The flow table generation and preloading module is used to convert the fusion policy set into flow table entries with matching tags and preload them to the switch; The tag generation and matching module is used to generate dynamic tags based on data packet characteristics and match the tags with preloaded flow table entries; The dynamic performance monitoring and feedback module is used to monitor network performance and adjust defense strategies based on load.

[0018] Compared with related technologies, the dynamic defense method and system based on SDN networks provided by this invention have the following advantages: 1. This invention decouples policy decision-making from real-time forwarding through a "flow table preloading" and "label triggering" mechanism. Preloading preloads and batches most flow table operations, avoiding frequent flow table delivery delays and controller burden when policies are activated; while label matching enables fast, localized policy execution in the data plane. This makes the "dynamic" nature of dynamic defense primarily manifest at the logical control level, while minimizing the performance impact on the data forwarding path, thus maintaining efficient dynamic defense while ensuring stable network forwarding performance.

[0019] 2. This invention introduces a Dynamic Risk Betweenness Centrality (DRBC) index that integrates topology, real-time load, and policy status. This allows the system to accurately pinpoint the actual comprehensive risk bottleneck nodes in the current network, rather than relying solely on static topology. Combined with a predictive impact assessment model based on this index, the system can simulate the global impact of different adjustment strategies (such as migration and deactivation) on the overall network risk distribution and security performance before performance bottlenecks actually occur, thus proactively selecting the optimal adjustment scheme. This effectively avoids the response lag, local optimization, and resulting network oscillations caused by traditional passive threshold alarms, achieving intelligent balancing in a global sense.

[0020] 3. Through a multi-timescale feedback calibration mechanism, the system can continuously compare the predicted effects of strategy adjustments with the actual results, and use this error to dynamically fine-tune key parameters (such as risk coefficient γ, security weight λ, load weight α / β, etc.) and security coverage model. This enables the system to automatically adapt to changes in network service modes, learn the actual effectiveness of strategies at different nodes, and optimize its own decision-making algorithm, thereby continuously improving decision accuracy in long-term operation and reducing reliance on manual parameter tuning. Attached Figure Description

[0021] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0022] To more clearly illustrate the technical solutions in the embodiments of this application or related technologies, the accompanying drawings used in the description of the embodiments or related technologies will be briefly introduced below. Obviously, those skilled in the art can obtain other drawings based on these drawings without creative effort.

[0023] Figure 1 A schematic diagram illustrating the steps of a dynamic defense method based on an SDN network provided by the present invention; Figure 2 A schematic diagram of a dynamic defense system structure based on an SDN network provided by the present invention; Figure 3 The label generation and matching flowchart provided by this invention; The purpose, features, and advantages of this application will be further explained in conjunction with the embodiments and with reference to the accompanying drawings. Detailed Implementation

[0024] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. The components of the embodiments of the present invention described and shown in the accompanying drawings can generally be arranged and designed in various different configurations.

[0025] Please see Figure 1 This embodiment provides a dynamic defense method based on SDN networks, including the following steps: Step S1: Generate a dynamic defense strategy set based on network topology and network security threat information, and perform fusion processing on the strategy set to obtain a low-redundancy and conflict-free fused strategy set; Step S2: Convert the fusion strategy set into an OpenFlow flow entry set, insert a matching tag for each flow entry, and preload the flow entry set into the corresponding switch; Step S3: When a Packet-In message for new traffic is received for the first time, a dynamic tag is generated based on the packet header information of the traffic, and the flow table entry carrying the tag is pushed to the ingress switch. The ingress switch then adds the dynamic tag to subsequent data packets and forwards them. Step S4: The intermediate switch preloads the flow table entry corresponding to the matching tag according to the matching tag corresponding to the dynamic tag and performs the corresponding action; Step S5: The egress switch removes the dynamic tag and forwards the data packet to the target host; Step S6: Select a node with high betweenness centrality in the SDN network as a performance monitoring node, and monitor the real-time performance load of the performance monitoring node in the SDN network in real time; wherein, when a performance bottleneck is detected, adjust the dynamic defense strategy according to the monitoring results, and repeat steps S1 to S6.

[0026] It should be noted that this embodiment forms an intelligent closed loop through four core steps: First, security policies are dynamically generated and integrated to form a concise and efficient policy set; second, the integrated policies are pre-converted into flow table entries with matching tags and deployed to the switches to achieve policy readiness; subsequently, tags are dynamically generated using the first packet information to guide the data flow to quickly match the pre-set policies during forwarding; finally, the performance load of key network nodes is monitored, and once a bottleneck is detected, dynamic policy adjustment is triggered to ensure that while implementing effective dynamic defense, the overall network performance remains stable and reliable.

[0027] Furthermore, the fusion processing of the policy set described in step S1 includes: Each strategy is abstracted into a structured tuple that includes the executing entity, action, and triggering condition; Redundancy strategies are incorporated by using subsets and conditional generalization. A hierarchical arbitration mechanism is adopted to resolve strategic conflicts. The hierarchical arbitration mechanism includes priority of subject, priority of event, priority of time, and priority of negative action.

[0028] Specifically, in the above technical solution, the strategy generation and fusion in the dynamic defense strategy generation and fusion module can be divided into the following sub-steps: S101: Obtain basic network topology information G(E,V) through the SDN controller, where V={v1, v2, v3, ...} Let {vn} be a finite set of OpenFlow switch nodes in the network, where n is the number of switch nodes, and E = { Let} be the finite set of edges between the nodes of the exchange, and m be the number of edges.

[0029] S102: Based on G(E,V), obtain the intelligence and early warning information set I, I={ }, where k represents the number of early warning intelligence messages. This information mainly comes from two sources: first, automated collection, which involves real-time acquisition of dynamic threat information (e.g., abnormal traffic behavior matching, known attack signature matching, suspicious behavior logs) through intrusion detection systems (IDS) or other security monitoring components deployed in the network; and second, expert input, such as predefined early warnings and risk information provided by security analysts based on external threat intelligence, vulnerability announcements, or situational awareness input.

[0030] S103: Generate dynamic defense strategies based on the network topology G and intelligence information I in S101 and S102. This represents the mapping from network topology and intelligence information to dynamic defense strategies, where π represents the specific set of dynamic defense strategies generated as a result. This set of strategies... It is a set of executable action instructions, which mainly realizes the deployment and execution of dynamic network defense strategies through the centralized management and control function of the network controller in network G.

[0031] S104: In the strategy set Based on this, the strategy sets are merged, and conflicts and contradictions between different strategies are eliminated. The specific steps include the following: First, each strategy in the strategy set is abstracted into a structured tuple: {Execution subject, action, triggering condition}, and attributes such as effective time, priority, and scope are added as additional attributes.

[0032] Secondly, a subset of redundant strategies is merged with conditional generalization to form a fusion strategy set.

[0033] Finally, a tiered arbitration mechanism is adopted to resolve conflicts, implementing conflict resolution and arbitration according to a four-level structure of priority for the subject, the event, the time, and the negative action.

[0034] Ultimately, this results in a set of executable fusion strategies with low redundancy and no conflicts.

[0035] Furthermore, the set of preloaded flow table entries mentioned in step S2 includes: Deploy flow table entries only to the switch's idle flow table space; Set a threshold for flow table space occupancy. When the occupancy rate exceeds the threshold, pause the preloading operation.

[0036] Specifically, the flow table generation and preloading mechanism in the flow table generation and preloading module includes the following sub-steps: S201: Generation of fused flow tables. Based on the fusion strategy set obtained in step S1, it is converted into the corresponding flow table entry set according to the OpenFlow protocol version format.

[0037] S202: Insert a pre-defined matching tag for each policy flow table entry as a trigger to enable the policy. For details on the tag generation and design principles, please refer to step S3.

[0038] S203: Use the SDN controller to push the set of flow table entries obtained in the above steps to the corresponding switch and install them using the idle space. Here, in order to pursue the high efficiency of flow table space utilization, an idle deployment strategy is adopted (deploy only to the idle space and do not replace the active flow table). At the same time, in order to prevent flow table overflow, the flow table space occupancy threshold is set to 80%. When the flow table occupancy exceeds this threshold, the flow table preloading operation is suspended.

[0039] Furthermore, generating the dynamic tag in step S3 includes: Extract the five-tuple information from the packet header, the five-tuple including source IP address, destination IP address, source port number, destination port number, and protocol type; Based on the aforementioned quintuple information, a 32-bit hash value is generated using the CRC32 algorithm as the base tag; The basic tags are shifted to obtain dynamic tags; Set a lifecycle for the dynamic tag; wherein, when the lifecycle ends, the corresponding flow table entry is deactivated and a new tag generation process is triggered.

[0040] Specifically, the tag generation and matching module dynamically extracts data packet feature information, generates and processes tags, and performs flow table matching. The basic workflow is as follows: Figure 3 As shown, its specific implementation mainly includes the following sub-steps: S301: For packets entering the network (ingress switch) for the first time, the switch requests a flow table match from the SDN controller via a PacketIn message. The SDN controller dynamically extracts the packet header information based on the first packet data, mainly including key information such as source IP address, destination IP address, port, and protocol, and generates dynamic tags through a tag generation mechanism (see S304 for details). The controller pushes the flow table containing the tags for the data flow to the ingress switch. The ingress switch modifies the packet fields to tag the traffic according to the flow table and then forwards or drops the data.

[0041] At the same time, a timeout reset mechanism is set for the label. When the label lifecycle T ends or a label is manually updated, the corresponding flow table is deactivated, and the PacketIn message is triggered again to request the controller to add the new label to the matching flow table.

[0042] S302: Intermediate switches in the network operate on the received data packets according to the flow table rules preloaded in step S2: for tagged data packets, they forward, discard, or modify the tags and forward the packets according to the tags; for untagged data packets, they perform matching and forwarding operations according to the packet header information.

[0043] S303: At the egress switch, the labels in the data packets are stripped according to the flow table rules and forwarded to the corresponding host port.

[0044] S304: This sub-step primarily generates a unique label based on the packet header information as a trigger for policy activation. First, the packet header 5-tuple is extracted as input: in, The source IP address The destination IP address For the source port number, The destination port number, For the purpose of the agreement.

[0045] Secondly, the relatively simple and mature CRC32 (32-bit Cyclic Redundancy Check) algorithm is used as the master hash to generate the base tag, and the base tag is shifted to achieve bit mixing, thereby reducing the probability of hash collision, and finally a 32-bit tag is obtained.

[0046] Furthermore, the main function of the dynamic performance monitoring and feedback module is to further ensure the communication service performance of the network system by implementing performance monitoring on network bottleneck nodes, thereby limiting the negative performance impact of dynamic defense actions to an acceptable range. This module is implemented by detecting abnormal performance events through real-time dynamic monitoring of network performance and tracing back to the dynamic defense strategy generation and deployment phases. By adjusting the activation method of the dynamic defense strategy, network performance is regulated, forming a dynamic closed-loop performance feedback and assurance mechanism.

[0047] The monitored indicators mainly include two dimensions: bandwidth utilization and flow table utilization. The former represents the busyness of the link (port) and characterizes the packet forwarding load; the latter characterizes the utilization of the switch's core resource flow table space. The formula for calculating the comprehensive load indicator is as follows: in, Represents the current node Real-time bandwidth usage of the port with the highest bandwidth consumption. Represents total bandwidth capacity. Represents the current node The flow table space usage. Represents the total capacity of the flow table space. , These represent the bandwidth occupancy factor and the flow table occupancy factor, respectively.

[0048] , These represent the bandwidth occupancy factor and the flow table occupancy factor, respectively, indicating different priorities for bandwidth occupancy and flow table occupancy. (By default...) =1, =1.2 indicates that flow table load is given higher priority to prevent flow table overflows that could cause greater damage to network performance. This value can also be changed based on the specific application's sensitivity to network bandwidth and the flow table space occupied by dynamic defense strategies. , The value is used to improve the accuracy and sensitivity of network performance monitoring.

[0049] Furthermore, based on the network topology G(E, V) in step S1, the betweenness centrality value of each node is calculated, and some nodes with high betweenness centrality are selected as monitoring nodes.

[0050] Betweenness centrality refers to the number of times a node appears on the shortest path between all source and destination node pairs in the network topology. It describes the situation of the node as an intermediary node between source and destination nodes in the network topology. The higher the betweenness centrality, the more obvious the "bridge" role of the node in the network.

[0051] To reduce the overhead of performance monitoring, performance monitoring is implemented at some nodes with high betweenness centrality. This can reflect the load of network performance bottlenecks and is more sensitive to global network performance fluctuations.

[0052] Therefore, the selection of monitoring high betweenness centrality nodes in step S6 includes: calculating the static betweenness centrality index of each node based on the fusion strategy set and SDN network structure; and selecting the nodes with the highest static betweenness centrality index values ​​by a predetermined proportion as the initial performance monitoring nodes.

[0053] The above-described solution, using static betweenness centrality, is sufficient to reflect the load conditions of network performance bottlenecks. However, there is still room for improvement: while using static network topology betweenness centrality to select monitoring points, the core of dynamic defense lies in the fact that network states (load, policies) are time-varying. A topology central node may not be a bottleneck under light load, while an edge node may become a hotspot due to dense policy deployment. Static selection can lead to inaccurate monitoring and resource misallocation.

[0054] Therefore, this embodiment, based on the above, further triggers the performance monitoring node update based on preset node update conditions (such as timed updates, or updates when the real-time load changes drastically); wherein, real-time load is collected and combined with the static betweenness centrality index to calculate the dynamic risk betweenness centrality index; the nodes with the highest dynamic risk betweenness centrality index values ​​are selected to update the subsequent performance monitoring nodes.

[0055] Furthermore, this embodiment proposes the following improvement scheme with deep continuity: This scheme goes beyond static indicator monitoring and constructs a dynamic, predictive, and adaptive closed-loop performance control system. The core of this system is to couple and dynamically optimize the network topology, real-time load, and defense strategy effects.

[0056] Specifically, the formula for calculating the static betweenness centrality index is as follows: in, and These represent the static betweenness centrality before and after normalization, respectively. This represents the total number of nodes in the SDN network. Represents any pair of nodes ( , The total number of shortest paths between () This indicates that it has passed through nodes. The number of shortest paths; More specifically, this embodiment moves from "static structural centrality" to "dynamic risk betweenness": it not only considers the structural importance of a node in the network topology (static betweenness centrality), but more importantly, it combines real-time performance load and the deployment status of security policies to calculate the "risk betweenness" of a node at the current moment, accurately locating the truly high-risk bottleneck nodes.

[0057] The formula for calculating the dynamic risk betweenness centrality index is as follows: in, This is a real-time link load weighting factor. For the flow surface space influence coefficient (e.g.) =0.5), used to adjust the contribution of flow table occupancy to the risk level. For nodes The occupancy rate of the flow table space at time t; The formula for calculating the link load weighting factor is as follows: in, For nodes The degree, i.e., the number of connected links; For nodes A set of connected links, This represents the real-time load of link e at time t. The maximum capacity of link e is given; the squared term is used to amplify the impact of high-load links.

[0058] Execution details: The controller periodically (e.g., every 5 seconds) collects the overall network link utilization and the flow table occupancy rate of each switch, and calculates the DRBC of each node. The N nodes with the highest DRBC values ​​exceeding the dynamic threshold are selected as the current risk bottleneck node set for focused monitoring and policy pre-adjustment.

[0059] Based on this, this embodiment further selects an adjustment action according to the predicted impact value when adjusting the dynamic defense strategy, specifically as follows: Obtain the resource requirements of each dynamic defense strategy and apply them to each performance monitoring node; Based on the dynamic risk betweenness centrality index of each node after the strategy adjustment action, the change in betweenness centrality of the entire network is estimated. ; Based on the critical asset topology coverage of each node after the policy adjustment, the estimated change in overall network security performance is as follows. ; According to the formula Impact(a) = + λ * Calculate the comprehensive impact value Impact(a) of the adjustment action a; where λ is the safety weight coefficient; The adjustment action with the smallest overall impact value is selected as the adjustment action.

[0060] It should be noted that this embodiment relies on traditional machine learning or time series prediction, but is a lightweight estimation method based on deterministic inference of the current network state, policy configuration and topology relationship. It can achieve impact assessment and avoid the computational complexity of prediction models. Its core idea is that the load change caused by policy adjustment can be calculated directly based on the resource consumption characteristics of the policy itself and the state of the target node, without the need to predict future traffic.

[0061] Specifically, we define the resource consumption vector for strategy π. Each dynamic defense strategy π has its known and relatively fixed resource requirements, which can be quantified as follows: in, This indicates the number of flow table entries used by this strategy. This indicates the additional bandwidth overhead introduced after the strategy is implemented (such as packet header encapsulation and the extra hops introduced by rerouting). The processing overhead (normalized value) of this policy on the switch CPU can be obtained through offline testing, policy configuration files, or historical statistics.

[0062] Suppose that policy π is transferred from node Migrate to node Then, a function can be defined to directly affect the node load of the migration operation. For the source node : For the target node : in, It is a node Resource pressure coefficient: This coefficient reflects the current resource stress level of the target node. The higher the load of the node, the greater the marginal impact of the new strategy.

[0063] According to the DRBC formula, changes in node load directly affect its ω(t) factor. We can directly calculate the adjusted DRBC value: For any node The DRBC value after load change is: in Recalculate based on the adjusted link load: If the node is a source or destination node, its link load is directly ± ; If a policy migration results in a path change, the link load of all nodes along the new path will change. Calculate and estimate the change in the betweenness center of the entire network. In practice, since policy migrations typically only affect a limited number of nodes (source node, target node, and nodes along the path), computations can be performed only on these nodes.

[0064] Changes in overall network security effectiveness The core idea of ​​the topology coverage estimation method is to estimate the loss of security value based on the coverage of the policy on the topology and the accessibility to critical assets, rather than predicting difficult-to-quantify indicators such as attack detection time.

[0065] Specific implementation steps and formulas: Define the set of key assets A in the network: Each asset a∈A has its importance weight. (e.g., 1-10, set by the administrator).

[0066] Define the security coverage S(π) of strategy π: Policy π protects specific source-destination pairs, specific protocols, or specific paths. The coverage of strategy π is defined as the set of critical asset access paths it can protect. Specific calculations: in This refers to the protection coverage of strategy π for asset a: Define the security value function V(v, π) for a node location: Policy π, when deployed on different nodes, exhibits varying levels of security coverage. The security value of policy π on node v is defined as follows: Where τ(v,π) is the topological position coefficient of node v for policy π: This reflects the topological centrality of node v relative to the protected assets: the more central the location (the shorter the average distance to each asset), the higher the security value of the executed strategy.

[0067] Changes in security performance during computational strategy migration: Transfer strategy π from node node Migrate to node : If we want to deactivate strategy π: Therefore, the instantaneous impact estimation method based on state deduction in this embodiment provides sufficiently accurate decision support while maintaining lightweightness, realizes "predictive regulation without relying on prediction models", and also provides a quantitative basis for parameter updates for subsequent feedback calibration.

[0068] Specifically, the method further includes a feedback calibration step: Record the actual changes in overall network performance and actual changes in security effectiveness after the strategy adjustment actions are executed; Calculate the estimated change in the total network betweenness center. The actual change in the network betweenness center and the estimated change in the network security performance. The error between the actual change in overall network security effectiveness; Based on the aforementioned error, the dynamic risk betweenness centrality index and the estimated change in the network betweenness centrality are used to calculate the overall network betweenness centrality. and the estimated change in overall network security performance. The parameters are calibrated.

[0069] This embodiment introduces a multi-level, multi-timescale feedback calibration mechanism, enabling the system to continuously optimize the accuracy of the prediction model and reduce evaluation errors; adaptively adjust the trade-off between performance and security; learn the actual effects of dynamic learning strategies at different nodes; improve decision quality, and achieve truly intelligent dynamic defense. This mechanism in this embodiment transforms a static evaluation model into a self-evolving intelligent system that continuously improves decision-making accuracy as runtime increases.

[0070] Example 2 Please see Figure 2 This embodiment also provides a dynamic defense system based on an SDN network, used to implement the dynamic defense method based on an SDN network as described in any of the preceding embodiments, loaded into the SDN controller of the SDN network, including: The dynamic defense strategy generation and fusion module is used to generate and fuse dynamic defense strategy sets; The flow table generation and preloading module is used to convert the fusion policy set into flow table entries with matching tags and preload them to the switch; The tag generation and matching module is used to generate dynamic tags based on data packet characteristics and match the tags with preloaded flow table entries; The dynamic performance monitoring and feedback module is used to monitor network performance and adjust defense strategies based on load.

[0071] Specifically, the system consists of four core modules working together: The dynamic defense strategy generation and fusion module is responsible for integrating and resolving conflicts among strategies; the flow table generation and preloading module transforms strategies into flow table entries with matching tags and pre-deploys them; the tag generation and matching module realizes the dynamic generation of data flow tags and rapid strategy matching; and the dynamic performance monitoring and feedback module monitors key network nodes in real time and intelligently adjusts defense strategies based on performance feedback. These four modules form an organic closed loop, jointly achieving the technical effect of dynamically changing defense configurations in SDN networks while ensuring stable network performance.

[0072] The above are only some embodiments of this application and do not limit the patent scope of this application. All equivalent structural transformations made under the technical concept of this application and using the content of this application specification and drawings, or direct / indirect applications in other related technical fields, are included in the patent protection scope of this application.

Claims

1. A dynamic defense method based on SDN networks, characterized in that, Includes the following steps: Step S1: Generate a dynamic defense strategy set based on network topology and network security threat information, and perform fusion processing on the strategy set to obtain a low-redundancy and conflict-free fused strategy set; Step S2: Convert the fusion strategy set into an OpenFlow flow entry set, insert a matching tag for each flow entry, and preload the flow entry set into the corresponding switch. Specifically, use the SDN controller to push the flow entry set to the corresponding switch and install it using the available space. Step S3: When a Packet-In message for new traffic is received for the first time, a dynamic tag is generated based on the packet header information of the traffic, and the flow table entry carrying the dynamic tag is pushed to the ingress switch. The ingress switch then adds the dynamic tag to subsequent data packets and forwards them. Step S4: The intermediate switch performs corresponding actions based on the matching tag corresponding to the dynamic tag and the flow table entry corresponding to the matching tag; Step S5: The egress switch removes the dynamic tag and forwards the data packet to the target host; Step S6: Select a node with high betweenness centrality in the SDN network as a performance monitoring node, and monitor the real-time performance load of the performance monitoring node in the SDN network in real time; wherein, when a performance bottleneck is detected, adjust the dynamic defense strategy according to the monitoring results, and repeat steps S1 to S6. The selection of the monitoring high betweenness centrality node includes: Based on the aforementioned fusion strategy set and SDN network structure, the static betweenness centrality index of each node is calculated. Select the nodes with the highest static betweenness centrality index values ​​(a predetermined proportion) as the initial performance monitoring nodes. Based on preset node update conditions, performance monitoring node updates are triggered; among them, Real-time load data is collected and combined with the static betweenness centrality index to calculate the dynamic risk betweenness centrality index; Select nodes with the highest dynamic risk betweenness centrality index values ​​(a predetermined percentage) to update subsequent performance monitoring nodes.

2. The dynamic defense method based on SDN network according to claim 1, characterized in that, The fusion processing of the policy set described in step S1 includes: Each strategy is abstracted into a structured tuple that includes the executing entity, action, and triggering condition; Redundancy strategies are incorporated by using subsets and conditional generalization. A hierarchical arbitration mechanism is adopted to resolve strategic conflicts. The hierarchical arbitration mechanism includes priority of subject, priority of event, priority of time, and priority of negative action.

3. The dynamic defense method based on SDN network according to claim 1, characterized in that, The set of preloaded flow table entries mentioned in step S2 includes: Deploy flow table entries only to the switch's idle flow table space; Set a threshold for flow table space occupancy. When the occupancy rate exceeds the threshold, pause the preloading operation.

4. The dynamic defense method based on SDN network according to claim 1, characterized in that, Step S3, generating the dynamic tag, includes: Extract the five-tuple information from the packet header, the five-tuple including source IP address, destination IP address, source port number, destination port number, and protocol type; Based on the aforementioned quintuple information, a 32-bit hash value is generated using the CRC32 algorithm as the base tag; The basic tags are shifted to obtain dynamic tags; Set a lifecycle for the dynamic tag; wherein, when the lifecycle ends, the corresponding flow table entry is deactivated and a new tag generation process is triggered.

5. The dynamic defense method based on SDN network according to claim 1, characterized in that, In step S6, the real-time performance load of the performance monitoring node is monitored, a comprehensive load index is calculated based on a preset formula, and it is determined whether a performance bottleneck exists; wherein, The formula for calculating the comprehensive load index is as follows: in, Represents the current node Real-time bandwidth usage of the port with the highest bandwidth consumption. Represents total bandwidth capacity. Represents the current node The flow table space usage. Represents the total capacity of the flow table space. , These represent the bandwidth occupancy factor and the flow table occupancy factor, respectively.

6. The dynamic defense method based on SDN network according to claim 1, characterized in that, The formula for calculating the static betweenness centrality index is as follows: in, and These represent the static betweenness centrality before and after normalization, respectively. This represents the total number of nodes in the SDN network. Represents any pair of nodes ( , The total number of shortest paths between () This indicates that it has passed through nodes. The number of shortest paths; The formula for calculating the dynamic risk betweenness centrality index is as follows: in, This is a real-time link load weighting factor. This is the flow table space impact coefficient, used to adjust the contribution of flow table occupancy to the risk level. For nodes The occupancy rate of the flow table space at time t; The formula for calculating the link load weighting factor is as follows: in, For nodes The degree, i.e., the number of connected links; For nodes A set of connected links, Let e ​​be the real-time load of link e at time t. This represents the maximum capacity of link e.

7. The dynamic defense method based on SDN network according to claim 6, characterized in that, When adjusting the dynamic defense strategy, the adjustment action is also selected based on the predicted impact value, specifically: Obtain the resource requirements of each dynamic defense strategy and apply them to each performance monitoring node; Based on the dynamic risk betweenness centrality index of each node after the strategy adjustment action, the change in betweenness centrality of the entire network is estimated. ; Based on the critical asset topology coverage of each node after the policy adjustment, the estimated change in overall network security performance is as follows. ; According to the formula Impact(a) = + λ * Calculate the comprehensive impact value Impact(a) of the adjustment action a; where λ is the safety weight coefficient; The adjustment action with the smallest overall impact value is selected as the adjustment action.

8. The dynamic defense method based on SDN network according to claim 7, characterized in that, The method also includes a feedback calibration step: Record the actual changes in overall network performance and actual changes in security effectiveness after the strategy adjustment actions are executed; Calculate the estimated change in the total network betweenness center. The actual change in the network betweenness center and the estimated change in the network security performance. The error between the actual change in overall network security effectiveness; Based on the aforementioned error, the dynamic risk betweenness centrality index and the estimated change in the network betweenness centrality are used to calculate the overall network betweenness centrality. and the estimated change in overall network security performance. The parameters are calibrated.

9. A dynamic defense system based on an SDN network, used to implement the dynamic defense method based on an SDN network as described in any one of claims 1 to 8, characterized in that, The SDN controller loaded in the SDN network includes: The dynamic defense strategy generation and fusion module is used to generate and fuse dynamic defense strategy sets; The flow table generation and preloading module is used to convert the fusion policy set into flow table entries with matching tags and preload them to the switch; The tag generation and matching module is used to generate dynamic tags based on data packet characteristics and match the tags with preloaded flow table entries; The dynamic performance monitoring and feedback module is used to monitor network performance and adjust defense strategies based on load.

Images