SDN中DDoS攻击检测与流表过载防御技术研究

发布时间：2017-12-27 07:33

本文关键词：SDN中DDoS攻击检测与流表过载防御技术研究　出处：《郑州大学》2017年硕士论文　论文类型：学位论文

【摘要】：软件定义网络是一种全新的网络架构,集中控制是其主要优势,同时控制器也成为网络攻击者的新目标。控制器的安全直接影响着整个SDN的安全。提高检测DDoS攻击的精确性和高效性成为了控制器安全性研究的核心问题。同时,软件定义网络中的一个关键缺陷,即流表的大小。在攻击流进入网络后,流表空间的大小则最有可能成为又一新的攻击目标。攻击者会发动流表过载攻击,则攻击流占据流表空间,进而对整个SDN网络造成威胁。为了有效识别DDoS攻击流量,提出了一种SDN环境下基于BP神经网络的DDoS攻击检测方法。该方法获取Open Flow交换机的流表项,分析SDN环境下DDoS攻击特性,提取出与攻击相关的流表匹配成功率、流表项速率等六个重要特征;对提取出来的六个相关特征值的变化进行分析,并采用BPNN算法对训练样本进行分类,实现对DDoS攻击的检测。实验结果表明,该方法不仅能有效地使识别率得到提高,同时也降低了检测时间。通过在软件定义网络环境中的部署,验证了该方法的可行性及高效性。针对流表过载攻击,提出了一种流表空间共享策略,来解决由于Ternary内容可寻址存储器(TCAM)的昂贵和功耗匮乏所造成的有限的流表空间大小,容易被流表过载攻击(转换的DDoS攻击)所禁用的问题。其整合了整个SDN网络中可用的空闲的流表资源,以减轻系统对单个交换机攻击所造成的威胁。通过在部署的SDN网络上进行实验,来验证其可行性。实验结果也表明,该策略可以有效防御流表过载攻击。
[Abstract]:The software definition network is a new network architecture, and centralized control is its main advantage, and the controller is also the new target of the network attacker. The security of the controller is directly affected by the security of the whole SDN. Improving the accuracy and efficiency of detecting DDoS attacks has become the core problem in the research of controller security. At the same time, software defines a key flaw in the network, the size of the flow table. After the attack stream enters the network, the size of the flow table space is most likely to be another new attack target. The attacker will launch a flow table overload attack, then the attack stream takes up the flow table space and then poses a threat to the entire SDN network. In order to effectively identify DDoS attack traffic, a DDoS attack detection method based on BP neural network in SDN environment is proposed. The current method of obtaining Open Flow switch table, analysis characteristics of DDoS under the environment of SDN, extract the associated with the attack flow table matching success rate, flow rate table six important characteristics; change of six related extracted eigenvalues are analyzed, and using BPNN algorithm to classify the training samples for detection of DDoS attack. The experimental results show that the method can not only improve the recognition rate, but also reduce the detection time. The feasibility and efficiency of the method is verified by the deployment in the software defined network environment. According to the flow table overload attack, this paper proposes a table space sharing strategy, to solve the Ternary content addressable memory (TCAM) is expensive and power scarcity caused by the limited flow table space size, easy flow table overload attack (converted DDoS attack) by disabling problem. It integrates the available free stream table resources available throughout the SDN network to mitigate the threat of a system's attack on a single switch. Experiments are carried out on the deployed SDN network to verify its feasibility. The experimental results also show that the strategy can effectively defend the overflow attack of the flow table.
【学位授予单位】：郑州大学
【学位级别】：硕士
【学位授予年份】：2017
【分类号】：TP393.0

【相似文献】