基于组策略的SDN多粒度流量检测系统

发布时间：2018-09-05 17:29

【摘要】：为提升软件定义网络(SDN)的网络控制力和安全性,通常利用SDN集中管控及流表控制特性开发大量安全应用,但此类安全应用实现功能单一、防护粒度粗,无法对整个网络形成综合防护。针对该问题,设计多粒度流量检测系统。借鉴组策略(GBP)的分组思想对基础设施层进行分组管理,基于模块链实现安全检测功能由硬件设备向软件服务的转型,定义安全检测模块的概念并将其划分为统计型检测、关联匹配型检测以及正则匹配型检测3类模块。利用GBP生成模块链,由模块链调动不同的安全检测模块组合,从而实现多粒度安全检测。通过实验验证了该系统在SDN环境下的可用性,并表明其具有检测粒度细、可扩展性好等特点。
[Abstract]:In order to enhance the network control and security of (SDN) defined by software, a large number of security applications are usually developed by using the characteristics of SDN centralized control and flow table control, but this kind of security application has a single function and coarse protection granularity. There is no comprehensive protection for the entire network. To solve this problem, a multi-granularity flow detection system is designed. The group management of infrastructure layer is carried out by using the group policy (GBP) 's grouping idea. Based on the module chain, the security detection function is transformed from hardware to software service, and the concept of security detection module is defined and divided into statistical detection. Correlation matching detection and regular matching detection are three kinds of modules. The module chain is generated by GBP, and different security detection modules are mobilized by the module chain to realize multi-granularity security detection. The availability of the system in SDN environment is verified by experiments, and it is shown that the system has fine detection granularity and good expansibility.
【作者单位】：武汉大学空天信息安全与可信计算教育部重点实验室;武汉大学软件工程国家重点实验室;湖北省人民检察院检察技术信息处;
【基金】：国家自然科学基金(61572380) 最高人民检察院技术信息研究中心中央级公益性科研院所基本科研业务费专项资金(JBKY20150620)
【分类号】：TP393.0

【相似文献】