收稿日期:20220908作者简介:侯泽鹏(1993-),男,工程师,主要从事网络信息安全、信息通信的研究工作。SDN中基于Renyi交叉熵和RMSprop算法的双层DDoS识别模型侯泽鹏,赵炜,王尧,付强(国网河北省电力有限公司信息通信分公司,河北石家庄050000)摘要:针对软件定义网络(SDN)中存在的DDoS攻击,提出了基于Renyi交叉熵和RMSprop算法的DDoS识别模型。首先,引入计算双向流比例作为检测模块的初检方法,降低常态化监控负荷的同时,能够及时发现异常流量;然后,引入Renyi交叉熵算法作为识别模块流量特征相似性定值计算方法,有效扩大异常与正常流量数据间的信息距离,对DDoS初期小流量攻击,可以更早地识别;最后,识别模块引入RMSprop算法计算当前网络阈值,可以吸收瞬时突变,进一步提升识别准确性。实验结果表明,该模型具备时间开销低、识别成功率高的特点,可以有效地增加SDN的安全性。关键词:软件定义网络;分布式拒绝服务;Renyi交叉熵;RMSprop算法;网络安全中图分类号:TP393.0;TM711文献标志码:B文章编号:10019898(2023)03007906Multi-levelDDoSIdentificationModelBasedonRenyiCross-entropyandRMSpropAlgorithminSDNHOUZepeng,ZHAOWei,WANDYao,FUQiang(InformationandCommunicationBranchofStateGridHebeiElectricPowerCo.,Ltd.,Shijiazhuang050000,China)Abstract:AimingattheDDosattackinSoftwareDefinedNetwork(SDN),aDDosrecognitionmodelbasedonRenyicrossen-tropyandtheRMSprop(RootMeanSquareProp)algorithmisproposed.Themodelisdividedintotwo-layermodules:Thefirstmoduleintroducesthebidirectionalflowratioastheinitialdetectionmethodoftheearlywarningmodule,whichcantimelyde-tectabnormaltrafficintimewhilereducingthenormalmonitoringload.TheidentificationmoduleemplaystheRenyicrossen-tropyalgorithmasthesimilaritycalculationmethodfortrafficcharacteristics.Thiseffectivelyincreasestheinformationdistancebetweenabnormalandnormaltrafficdata,andcanidentifytheinitiallow-trafficattacksofDDoSearlier.Meanwhile,RMSpropalgorithmisintroducedintotheidentificationmoduletocalculatethecurrentnetworkthreshold,whichcanabsorbinstantaneousmutationandfurtherimprovetheidentificationaccuracy.Theexperimentalresultsshowthatthemodelhasthecharacteristicsoflowtimecostandhighrecognitionsuccessrate,whichcaneffectivelyincreaset...
