基于软件定义网络的云平台入侵防御方案设计与实现

发布时间：2019-03-03 10:47

【摘要】：针对传统的入侵防御系统是串联在网络环境中,处理能力有限且易造成网络拥塞的问题,面向云计算应用,设计了一种基于软件定义网络(SDN)的入侵防御方案。首先,在Open Stack平台中集成了SDN控制器。然后,利用控制器的可编程特性,设计了入侵检测和控制器的联动机制,实现了入侵防御功能。联动机制实现原理是在入侵检测系统检测到入侵时把入侵信息传给控制器,控制器下发安全策略到虚拟交换机,达到过滤入侵流量、动态阻止入侵行为的目的。最后,通过实验将所提方案与传统入侵防御方案相比较,对比分析结果表明,相比传统方案能成功检测85%入侵(攻击速率为12 000 packet/s),所提方案的入侵检测效率在90%以上(攻击效率为40 000 packet/s),可以用于提高云环境下入侵防御的检测效率。
[Abstract]:Aiming at the problem that the traditional intrusion prevention system is connected in the network environment, the processing ability is limited and it is easy to cause network congestion. A software-defined network (SDN)-based intrusion prevention scheme is designed for cloud computing applications. Firstly, the SDN controller is integrated into the Open Stack platform. Then, the linkage mechanism between intrusion detection and controller is designed based on the programmable characteristic of the controller, and the intrusion prevention function is realized. The principle of linkage mechanism is to transmit the intrusion information to the controller when the intrusion detection system detects the intrusion. The controller sends the security policy to the virtual switch to filter the intrusion traffic and dynamically stop the intrusion behavior. Finally, the experimental results show that the proposed scheme can detect 85% intrusion successfully (the attack rate is 12 000 packet/s) compared with the traditional intrusion prevention scheme, and the analysis results show that the proposed scheme can detect 85% intrusion successfully (attack rate is 12 000 packet/s) compared with the traditional intrusion prevention scheme. The intrusion detection efficiency of the proposed scheme is more than 90% (attack efficiency is 40 000 packet/s), which can be used to improve the detection efficiency of intrusion prevention in cloud environment.
【作者单位】：北京电子科技学院通信工程系;西安电子科技大学通信工程学院;
【基金】：国家863计划项目(2015AA017202) 国家发改委信息安全专项(发改办高技[2015]289号)~~
【分类号】：TP393.08

【相似文献】