软件定义网络流表溢出脆弱性分析及防御方法

发布时间：2018-07-17 16:58

【摘要】：软件定义网络交换机非常有限的流表容量使其存在严重的流表溢出脆弱性问题,为此利用软件定义网络易于管理路由规则的新特性,提出一种基于装箱优化的路由聚合算法,并进一步提出了流表溢出攻击的防御方法。采用传统的基于基数树的路由聚合算法产生初步聚合后的流表项节点,将其划分为包含不同数量节点的若干个流表项规则组,并基于装箱优化问题求解得到每个流表项规则组的新转发地址,再将转发地址修改后的流表项规则进行二次聚合,从而有效减少交换机流表中的流表项数量,达到防御流表溢出攻击的效果。实验结果表明:流表聚合率达到了54.9%,优于传统的基于基数树的路由聚合算法,并使得达成流表溢出攻击的攻击数据包数增加了125.8%;该方法可显著增加流表溢出攻击的实现难度,有效缓解流表溢出脆弱性问题,提升软件定义网络对该类攻击的防御能力。
[Abstract]:Because of the very limited flow table capacity of the software-defined network switch, there is a serious problem of flow table overflow vulnerability. In this paper, a new routing aggregation algorithm based on packing optimization is proposed, which is easy to manage the routing rules in the software-defined network. Furthermore, the defense method of stream table overflow attack is put forward. The traditional routing aggregation algorithm based on cardinality tree is used to generate the primary aggregated flow table item nodes, which are divided into several rule groups of flow table items with different number of nodes. Based on the packing optimization problem, the new forwarding address of each stream table item rule group is obtained, and then the stream table item rule after the forwarding address is modified is aggregated twice, thus effectively reducing the number of flow table items in the flow table of the switch. Achieve the effect of defending against stream table overflow attack. The experimental results show that the aggregation rate of stream table is 54.9, which is superior to the traditional routing aggregation algorithm based on cardinality tree, and makes the number of attack packets increasing 125.8%, which can increase the difficulty of implementing stream table overflow attack. It can effectively alleviate the vulnerability of stream table overflow and enhance the ability of software defined network to defend against this kind of attack.
【作者单位】：西安交通大学智能网络与网络安全教育部重点实验室;
【基金】：国家自然科学基金资助项目(61572397) 陕西省自然科学基础研究计划资助项目(2016JM6066)
【分类号】：TP393.0

【相似文献】