SDN架构下的安全审计系统研究与实现

发布时间：2018-08-17 15:55

【摘要】：为了解决软件定义网络(software defined networking,SDN)架构面临的安全挑战,针对SDN网络架构中的安全审计环节,将传统网络中的安全审计解决方案与SDN网络集中控制的特性相结合,依托Floodlight控制器设计并实现适用于SDN网络环境的安全审计系统,包括安全审计事件的收集、分析、存储、响应等功能.提出一种针对分布式拒绝服务(distributed denial of service,DDo S)攻击的攻击回溯算法对安全审计事件进行追溯,确定出DDo S攻击发起者及僵尸主机集合.同时,采用滑动窗口分割算法从安全审计事件中提取出用户行为序列模式,基于Levenshtein算法计算用户行为序列模式之间的相似度,并根据用户当前行为和历史行为的相似度来判断是否出现可疑的攻击行为.经实验验证,该系统能准确地回溯出DDo S攻击发生时被控的僵尸主机集合及攻击者,并且可以有效地检测出用户攻击行为.
[Abstract]:In order to solve the security challenge faced by the software definition network (software defined network architecture, aiming at the security audit link in the SDN network architecture, the traditional network security audit solution is combined with the characteristics of the centralized control of the SDN network. Based on Floodlight controller, a security audit system suitable for SDN network environment is designed and implemented, including security audit event collection, analysis, storage, response and other functions. An attack backtracking algorithm for distributed denial of service (distributed denial of service) attacks is proposed to trace the security audit events and identify the DDo S attack originators and zombie hosts. At the same time, the sliding window segmentation algorithm is used to extract the user behavior sequence patterns from the security audit events, and the similarity between the user behavior sequence patterns is calculated based on the Levenshtein algorithm. According to the similarity between the user's current behavior and the historical behavior, whether there are suspicious attacks or not is judged. Experimental results show that the system can accurately trace the set of zombie hosts and attackers charged with DDo S attacks, and can effectively detect user attacks.
【作者单位】：北京工业大学计算机学院;可信计算北京市重点实验室;信息安全等级保护关键技术国家工程实验室;
【基金】：北京市自然科学基金资助项目(4162006)
【分类号】：TP393.0

【相似文献】