SDN Controller DDoS Mitigation via Centralized Traffic Diversion
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In backbone networks without obvious convergence nodes, existing DDoS attack prevention methods require cleaning devices to divert attack traffic through multiple routing and forwarding nodes, leading to increased network resource occupation and reduced security due to the lack of a centralized point for traffic diversion.
Innovation Solution
An SDN-based method that involves a controller delivering traffic statistics collection instructions to packet forwarding devices to collect and summarize traffic data, determining if it exceeds a threshold, and implementing DDoS prevention policies such as black-hole routing, traffic limiting, or dynamic diversion to a cleaning device to mitigate attacks effectively.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a cleaning device is deployed for a specific IP address in a backbone network without obvious convergence nodes, then the cleaning device can be positioned at a traffic convergence node connected to the protected host, but the attack traffic still needs to pass through multiple routing and forwarding nodes to reach the cleaning device, occupying network resources and increasing network impact
Solution Approach 1:
The patent introduces an SDN controller as an intermediary that centralizes the decision-making process for traffic diversion. The controller receives traffic statistics from multiple forwarding devices, determines whether DDoS attacks are occurring, and then directs attack traffic to the cleaning device. This intermediary role eliminates the need for attack traffic to traverse multiple routing nodes, as the controller can immediately redirect suspicious traffic to the cleaning device, thereby reducing network resource occupation while maintaining security.
Solution Approach 2:
The patent transitions from a traditional distributed traffic management approach to a centralized SDN control plane. By separating the control plane (SDN controller) from the data plane (forwarding devices), the system gains a new dimension for traffic management. The controller can globally view traffic statistics from multiple forwarding devices and make centralized diversion decisions, allowing attack traffic to be redirected through an optimized path directly to the cleaning device rather than following traditional multi-hop routing paths.
2Measurement precision
If traffic statistics collection is performed by multiple forwarding devices and summarized by the controller, then global traffic flow information can be obtained for accurate DDoS detection, but the system complexity and communication overhead between devices and controller increase
Solution Approach 1:
The patent divides the traffic monitoring function into two segments: forwarding devices that collect local traffic statistics and an SDN controller that performs global summarization and analysis. Each forwarding device independently monitors traffic flowing through it and reports statistics to the controller. This segmentation allows the system to maintain high detection accuracy by aggregating data from multiple points while keeping individual device complexity low, as each forwarding device only needs to perform basic local monitoring rather than complex global analysis.
Solution Approach 2:
The SDN controller acts as an intermediary that receives traffic statistics from multiple forwarding devices, summarizes the data, and performs centralized DDoS detection. This intermediary approach consolidates the complex analysis function at the controller level, allowing forwarding devices to remain relatively simple. The controller aggregates traffic flow information from multiple sources to achieve global visibility and accurate attack detection without requiring each individual forwarding device to handle complex analysis tasks.
Data Source
AI summary
A software defined networking (SDN)-based distributed denial of service (DDoS) attack prevention method, an apparatus, and a system, where a controller delivers a traffic statistics collection instruction to a first packet forwarding device. The traffic statistics collection instruction instructs the first packet forwarding device to perform traffic statistics collection, and carries a destination Internet Protocol (IP) address. The controller collects statistical data reported by the first packet forwarding device, obtains, according to the statistical data, a statistical value of global traffic flowing to the destination IP address, and delivers a DDoS prevention policy to a second packet forwarding device based on a determining result that the statistical value of the global traffic exceeds the preset threshold. Correspondingly, the second packet forwarding device receives the DDoS prevention policy from the controller, and performs, according to the DDoS prevention policy, prevention process on the traffic flowing to the destination IP address.