SDN环境下DDoS攻击检测和缓解系统①沈浩桐,魏松杰(南京理工大学计算机科学与工程学院,南京210094)通信作者:魏松杰,E-mail:swei@njust.edu.cn摘要:分布式拒绝服务攻击(distributeddenialofservice,DDoS)是网络安全领域的一大威胁.作为新型网络架构,软件定义网络(softwaredefinednetworking,SDN)的逻辑集中和可编程性为抵御DDoS攻击提供了新的思路.本文设计并实现了一个轻量级的SDN环境下的DDoS攻击检测和缓解系统.该系统使用熵值检测方法,并通过动态阈值进行异常判断.若异常,系统将使用更精确的决策树模型进行检测.最后,控制器通过计算流的包对称率确定攻击源,并下发阻塞流表项.实验结果表明,该系统能够及时响应DDoS攻击,具有较高的检测成功率,并能够有效遏制攻击.关键词:软件定义网络;分布式拒绝服务攻击;检测;缓解;决策树;熵值引用格式:沈浩桐,魏松杰.SDN环境下DDoS攻击检测和缓解系统.计算机系统应用,2023,32(8):133–139.http://www.c-s-a.org.cn/1003-3254/9206.htmlDDoSAttackDetectionandMitigationSysteminSDNEnvironmentSHENHao-Tong,WEISong-Jie(SchoolofComputerScienceandEngineering,NanjingUniversityofScienceandTechnology,Nanjing210094,China)Abstract:Distributeddenialofservice(DDoS)attackisamajorthreatinthefieldofnetworksecurity.Asanewtypeofnetworkarchitecture,thelogiccentralizationandprogrammabilityofsoftwaredefinednetworking(SDN)providenewideasfordefendingagainstDDoSattacks.ThisstudydesignsandimplementsalightweightDDoSattackdetectionandmitigationsysteminSDN.Thesystemusestheentropydetectionmethodandjudgestheabnormalitythroughthedynamicthreshold.Ifthedynamicthresholdisabnormal,thesystemwilluseamoreaccuratedecisiontreemodelfordetection.Finally,thecontrollerdeterminestheattacksourcebycalculatingthepacketsymmetryrateoftheflowanddeliverstheblockingflowentry.TheexperimentalresultsshowthatthesystemcanrespondtoDDoSattacksintime.Ithasahighdetectionsuccessrateandcaneffectivelycontainattacks.Keywords:softwaredefinednetworking(SDN);distributeddenialofservice(DDoS);detection;mitigation;decisiontree;entropyDDoS攻击易于实施,利用有限的资源即可在网络中发起不对称攻击.攻击者通过控制大量主机发送无用数据包来淹没受害者的带宽或攻击其可用资源,从而阻止合法...
