基于OpenFlow交换机洗牌的DDoS攻击动态防御方法

发布时间：2019-01-28 18:32

【摘要】：网络资源的有限性和网络管理的分散性是传统网络难以解决分布式拒绝服务攻击问题的重要原因。当前的防御方法存在静态性、滞后性的不足,并且难以定位攻击者。针对上述问题,该文提出一种动态防御的方法。利用软件定义网络(SDN)集中控制和动态管理的特性构建OpenFlow交换机洗牌模型,使用贪心算法实现用户-交换机连接的动态映射,通过多轮洗牌区分出用户群中的攻击者和合法用户,对合法用户提供低延迟不间断服务。在开源SDN控制器Ryu上实现原型系统,并在SDN环境下进行测试。性能测试结果表明采用该方法可以通过有限次的洗牌筛选出攻击者,降低DDoS攻击对合法访问的影响;能力测试结果则说明了在由一个控制器组成的环形拓扑结构下该方法的防御效果与攻击流的大小无关,而是仅与攻击者的数目有关。
[Abstract]:The limitation of network resources and the dispersion of network management are the important reasons why traditional networks are difficult to solve the problem of distributed denial of service (DDoS) attacks. The current defense methods are static, lag, and difficult to locate attackers. In view of the above problems, this paper proposes a dynamic defense method. Based on the characteristics of centralized control and dynamic management of network (SDN) defined by software, the shuffling model of OpenFlow switch is constructed, and the dynamic mapping of the connection between users and switches is realized by greedy algorithm. By multiple shuffling, the attackers in the user group are distinguished from the legitimate users, and the low delay uninterrupted service is provided to the legitimate users. The prototype system is implemented on the open source SDN controller Ryu and tested under the SDN environment. The performance test results show that this method can be used to screen out attackers by shuffling for a limited number of times to reduce the impact of DDoS attacks on legitimate access. The capability test results show that the defensive effect of the method is independent of the size of the attack flow, but only related to the number of attackers in a ring topology composed of a controller.
【作者单位】：解放军信息工程大学网络空间安全学院;数学工程与先进计算国家重点实验室;
【基金】：国家863计划项目(2012AA012902) 国家杰出青年科学基金(61402526)~~
【分类号】：TP393.08

【相似文献】