SDN网络中DDoS放大攻击的防御机制研究

发布时间：2018-04-14 13:11

本文选题：SDN + DDoS放大攻击　；参考：《北京邮电大学》2017年硕士论文

【摘要】：作为常见且危害巨大的一类网络攻击方式,分布式拒绝服务(DistributedDenial of Service,DDoS)放大攻击经常被黑客用来对网络设施进行攻击破坏。而鉴于DNS服务器开放且易被利用的特点,很多黑客常选择使用DNS放大攻击的方式向目标主机发起DDoS放大攻击。针对这类攻击,传统网络中现有的防御思路都是在企业网关入口设置专用的DDoS防御平台进行流量清洗,或是在网络元件端进行流量过滤。这些方式可视性差、灵活性差,或是需要引入第三方专用设备,导致成本变高。作为未来网络新型架构之一,软件定义网络(Software Defined Networks,SDN)也面临着相同的威胁。但SDN架构的可视性和可编程性为攻击防御机制的设计提供了新的思路。结合上述优势,本文在SDN架构下提出一种由三个防御阶段组成的DNS放大攻击防御机制,具体包括攻击初步检测阶段、攻击确认和受害主机保护阶段与傀儡机发现和隔离阶段。1)攻击初步检测阶段。对流经转发层的DNS请求数据包测速来进行攻击的初步检测。接着对其中超速包的源IP通过熵值运算来衡量其集中程度,判断攻击是否可能发生并找出疑似受害主机。2)攻击确认和受害主机保护阶段。充分利用网络可视性和OpenFlow协议灵活性的优势通过分析疑似受害主机端口的DNS请求包和回复包的数量来准确判定攻击是否发生并迅速保护受害主机,同时确保对受害主机正常DNS访问的影响很小。3)傀儡机发现和隔离阶段。通过利用端口信息进行攻击路径回溯的算法精确找出并迅速从网络中隔离傀儡机,使网络流量完全恢复正常。最后,基于Ryu控制器和Mininet仿真平台对整体防御机制进行仿真实验,并对实验结果进行详细分析和评估。仿真实验结果表明防御机制有效且稳定,为SDN网络中DDoS放大攻击的防御研究提供了新的更加灵活的思路。
[Abstract]:As a common and dangerous network attack, distributed denial of Service (DDoS) amplification attacks are often used by hackers to attack and destroy network facilities.However, due to the open and easy to use of DNS server, many hackers often choose to use DNS amplification attack to launch DDoS amplification attack on the target host.In view of this kind of attack, the existing defense thoughts in the traditional network are to set up a dedicated DDoS defense platform to clean the traffic at the entrance of the enterprise gateway, or to filter the traffic at the network component end.Poor visibility, poor flexibility, or the introduction of third-party-specific equipment can lead to higher costs.As one of the new network architecture in the future, Software Defined Networks (SDN) is facing the same threat.However, the visibility and programmability of SDN architecture provide a new idea for the design of attack defense mechanism.Combined with the above advantages, this paper proposes a three-stage DNS amplification attack defense mechanism under the SDN framework, which includes the initial attack detection phase.Attack confirmation and victim protection stage and puppet machine discovery and isolation stage. 1) initial attack detection phase.The initial detection of the attack is carried out on the DNS request packet which flows through the forwarding layer.Then the source IP of overspeed packet is evaluated by entropy operation to determine whether the attack is likely to occur and to find out the phase of attack confirmation and victim host protection.Taking full advantage of network visibility and flexibility of OpenFlow protocol, by analyzing the number of DNS request packets and reply packets of suspected victim host ports, we can accurately determine whether the attack occurred and protect the victim host quickly.Also make sure that the impact on the victim's normal DNS access is minimal. 3) the puppet machine discovery and isolation phase.By using the port information to trace the attack path accurately and quickly isolate the puppet machine from the network the network traffic is completely restored to normal.Finally, the overall defense mechanism is simulated based on Ryu controller and Mininet simulation platform, and the experimental results are analyzed and evaluated in detail.The simulation results show that the defense mechanism is effective and stable, which provides a new and more flexible way to study the defense of DDoS amplification attacks in SDN networks.
【学位授予单位】：北京邮电大学
【学位级别】：硕士
【学位授予年份】：2017
【分类号】：TP393.08

【相似文献】