软件定义网络中的分布式拒绝服务攻击抑制模型

发布时间：2019-05-13 18:24

【摘要】：针对软件定义网络(software defined networking,SDN)中控制器受到分布式拒绝服务(distributed denial of service,DDo S)攻击致使SDN网络可能面临单点失效的威胁,提出抑制SDN网络中DDo S攻击的模型.该模型主要是在SDN应用层上扩展DDo S检测模块和MSlot(multiple timeslot)算法模块.在DDo S攻击检测上,DDo S检测模块采用模糊综合评判决策模型,通过综合多个流特征指标实时检测DDo S的发生,并使用DDo S综合评判分数描述DDo S攻击的强度.在应对DDo S攻击流策略上,MSlot算法模块根据检测结果采取相应的时间片分配策略,确保SDN网络在DDo S攻击下可有效保护合法用户的通信.为测试DDo S抑制模型,通过仿真模拟不同攻击强度的DDo S攻击.结果表明,在SDN网络中,相比某些基于单因素评判指标的DDo S攻击检测算法,采用模糊综合评判决策模型在检测率和精确度上更有优势;在DDo S攻击时,MSlot算法模块根据检测结果采取相应的时间片分配策略相比某些只使用多个逻辑队列轮询机制的SDN控制器调度算法可更有效地保护合法用户的通信质量.
[Abstract]:Aiming at the threat of single point failure caused by distributed denial of service (distributed denial of service,DDo S) attack on controller in software defined network (software defined networking,SDN), a model to suppress DDo S attack in SDN network is proposed. The model mainly extends DDo S detection module and MSlot (multiple timeslot) algorithm module on SDN application layer. In the, DDo S detection module of DDo S attack detection, the fuzzy comprehensive evaluation decision model is used to detect the occurrence of DDo S in real time by synthesizing multiple flow characteristic indexes, and the DDo S comprehensive evaluation score is used to describe the intensity of DDo S attack. In response to DDo S attack flow strategy, MSlot algorithm module adopts the corresponding time slice allocation strategy according to the detection results to ensure that SDN network can effectively protect the communication of legitimate users under DDo S attack. In order to test the DDo S suppression model, DDo S attacks with different attack intensities are simulated by simulation. The results show that the fuzzy comprehensive evaluation decision model has more advantages in detection rate and accuracy than some DDo S attack detection algorithms based on single factor evaluation index in SDN network. In DDo S attack, the MSlot algorithm module adopts the corresponding time slice allocation strategy according to the detection results, compared with some SDN controller scheduling algorithms which only use multiple logical queue polling mechanisms, it can protect the communication quality of legitimate users more effectively.
【作者单位】：深圳大学计算机与软件学院;
【基金】：国家自然科学基金资助项目(61672358)~~
【分类号】：TP393.0

【相似文献】