一种针对SDN架构网络的DoS攻击的防御策略

发布时间：2018-08-02 12:06

【摘要】：与传统网络不同,软件定义网络的思想是将网络中的控制与转发相分离。网络中的交换机不再负责网络的控制,只负责网络的转发,而网络的控制则交由集中化的控制器负责。这种架构可以方便的对网络进行统一的配置和管理,实现了网络可编程,有利于新型网络业务的部署,也有利于传统网络威胁的防御。但是由于软件定义网络技术当前还不够成熟,因此它也面临着不少的安全威胁。针对于SDN网络控制器的DoS攻击就是这些安全威胁的一种。这种独特的DoS攻击巧妙的利用了软件定义网络控制器与交换机之间通信机制的漏洞。制造一系列有针对性的攻击流量对控制器本身进行攻击,最终导致控制器瘫痪,新的流表项无法被部署到交换机上,使整个网络受到巨大的影响。由于软件定义网络的研究还处于较为初级的阶段,而学者或是研究机构的目光都集中于传统网络的改善方面,因此当前相应的防御策略的研究相对较少。本文通过对软件定义网络架构以及OpenFlow协议的细致分析,讲述了针对于控制器的DoS攻击原理。而后介绍了一种针对这种DoS攻击的检测和防御策略。在攻击检测上,创新性的将差分方差检测方法应用在了控制层流量检测上;在攻击防御上创新性的运用了一种基于用户行为分析的检测机制并将其与交换机限流策略相结合,从而实现了针对这种新型DoS攻击的检测和防御。最后,针对上述检测防御策略结合OpenDayLight控制器,对检测策略与防御策略进行了仿真和验证。
[Abstract]:Different from the traditional network, the idea of software defining the network is to separate the control from the forwarding in the network. The switch in the network is no longer responsible for the control of the network, but only responsible for the forwarding of the network, while the control of the network is assigned to the centralized controller. This architecture can easily configure and manage the network, realize network programmable, facilitate the deployment of new network services, and also facilitate the defense of traditional network threats. However, the software definition network technology is not mature, so it also faces a lot of security threats. The DoS attack against SDN network controller is one of these security threats. This unique DoS attack cleverly exploits the vulnerability of software-defined communication mechanisms between network controllers and switches. A series of targeted attack traffic attack the controller itself, resulting in the controller paralysis, the new flow table items can not be deployed to the switch, so that the entire network is greatly affected. Because the research of software definition network is still in the primary stage, and scholars or research institutions focus on the improvement of the traditional network, the research on the corresponding defense strategy is relatively rare. Based on the detailed analysis of the software definition network architecture and the OpenFlow protocol, this paper describes the DoS attack principle for the controller. Then a detection and defense strategy against this DoS attack is introduced. In attack detection, the differential variance detection method is innovatively applied to control layer flow detection, and an innovative detection mechanism based on user behavior analysis is used in attack defense and combined with switch current limiting strategy. Thus, the detection and defense against this new DoS attack are realized. Finally, the detection strategy and defense strategy are simulated and verified by combining the above detection and defense strategies with OpenDayLight controller.
【学位授予单位】：北京邮电大学
【学位级别】：硕士
【学位授予年份】：2017
【分类号】：TP393.08

【相似文献】