CN104660582A - Network architecture of software definition of DDoS identification, protection and path optimization - Google Patents
Network architecture of software definition of DDoS identification, protection and path optimization Download PDFInfo
- Publication number
- CN104660582A CN104660582A CN201410785460.XA CN201410785460A CN104660582A CN 104660582 A CN104660582 A CN 104660582A CN 201410785460 A CN201410785460 A CN 201410785460A CN 104660582 A CN104660582 A CN 104660582A
- Authority
- CN
- China
- Prior art keywords
- message
- attack
- layer
- controller
- ids
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
- H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
- H04L63/1416—Event detection, e.g. attack signature detection
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
- H04L63/1441—Countermeasures against malicious traffic
- H04L63/1458—Denial of Service
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L45/00—Routing or path finding of packets in data switching networks
- H04L45/02—Topology update or discovery
- H04L45/021—Ensuring consistency of routing table updates, e.g. by using epoch numbers
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
- H04L63/0227—Filtering policies
- H04L63/0236—Filtering by address, protocol, port number or service, e.g. IP-address or URL
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
- H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
- H04L63/1425—Traffic logging, e.g. anomaly detection
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
- H04L63/1441—Countermeasures against malicious traffic
- H04L63/1466—Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks
Landscapes
- Engineering & Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Computer Hardware Design (AREA)
- Computing Systems (AREA)
- General Engineering & Computer Science (AREA)
- Computer And Data Communications (AREA)
- Data Exchanges In Wide-Area Networks (AREA)
Abstract
The invention discloses an SDN architecture, system and working method fusing DDoS threat filtration with route optimization. The SDN network architecture comprises an application plane, a data plane and a control plane, wherein when any IDS equipment positioned in the data plane detects an attack threat, the data plane informs the application plane of entering an attack type analysis process; the application plane is used for analyzing the attack type and customizing a corresponding attack threat processing strategy according to the attack type; the control plane provides an attack threat processing interface for the application plane and provides an optimal path calculation and/or attack threat identification interface for the data plane. When the network is under the massive DDoS threat, the SDN network architecture can realize the traffic forwarding of route optimization according to the real-time condition of links, quickly and accurately carries out DDoS threat identification and processing response at the same time, and comprehensively ensures the quality of network communication.
Description
Technical field
The present invention relates to network safety filed, particularly relate to that a kind of DDoS identifies, the network architecture of software definition of protection and path optimization.
Background technology
Current, the network extensively connected at a high speed has become the important infrastructure of modern society.But along with the expansion of internet scale, the defect of traditional specifications system also presents day by day.
The report of country's computer network emergence technology process Consultation Center (CNCERT/CC) up-to-date issue shows: activities of hacker is increased, back door, website, phishing, Web malice hang the attacks such as horse in the trend of increasing substantially, and the internet security of country, enterprise is faced with severe challenge.
Wherein, distributed denial of service attack (Distributed Denial of Service, DDoS) remains and affects one of topmost threat of the Internet security of operation.In the past few years, the number of ddos attack, size, type all sharp rise.
Software defined network (Software Defined Network, SDN) have can real-time update routing policy with rule, supports the characteristics such as profound data packet analysis, thus can threaten for the DDoS in complex network ring environment provide rapider network monitoring accurately and defense function.
Summary of the invention
The object of this invention is to provide a kind of network architecture and method of work thereof of software definition, to solve the network security problem that in existing network, a large amount of ddos attack causes, to realize fast, efficiently, all sidedly identify and defending DDoS (Distributed Denial of Service) attacks.
In order to solve the problems of the technologies described above, the invention provides a kind of network architecture of software definition, comprising: application layer, data Layer and key-course; Wherein data Layer, when being arranged in the arbitrary IDS equipment Inspection of data Layer and threatening to attack, notice application layer enters into attack type analysis process; Application layer, for analyzing attack type, and threatens processing policy according to corresponding attack of attack type customization; Key-course, threatens Processing Interface for application layer provides to attack, and provides optimal path computation for data Layer and/or attack threat identification interface.
Preferably, detecting to realize DDoS in IDS equipment, when arbitrary IDS equipment Inspection is to when having the message of ddos attack feature, reporting to application layer; Described application layer is according to reporting information, make the processing policy corresponding with the message with ddos attack feature, then this message is shielded by the controller in key-course or the switch access interface traffic redirect corresponding to this message is filtered to flow cleaning center; Comprise in described IDS equipment: deception packet check module, the deceptive practices of link layer and internetwork layer address are detected; Destroy packet check module, the abnormal behaviour that internetwork layer and transport layer flag bit are arranged is detected; Exception message detection module, detects the formula attack that floods of application layer and transport layer; Successively message is detected by described deception packet check module, destruction packet check module, exception message detection module; And if when arbitrary detection module detects that message exists above-mentioned respective behavior, then this message is proceeded to application layer.
Preferably, described application layer is suitable for having deceptive practices when message, and attacks threat in OpenFlow territory, then shield main frame by controller; Maybe when attack threatens not in OpenFlow territory, then by controller, the switch access interface traffic redirect corresponding to this message is filtered to flow cleaning center; Described application layer is also suitable for having abnormal behaviour when message, then shielded by the flow of controller to attacker or attack main frame; And when message has the formula attack that floods, then described application layer is suitable for being filtered to flow cleaning center by the switch access interface traffic redirect corresponding to this message by controller.
Beneficial effect of the present invention: DDoS is threatened monitoring, threatens the business function module such as protection, routing optimality to be deployed in data Layer, key-course and application layer respectively by the present invention.Network can being made when threatened by extensive DDoS, the traffic forwarding of routing optimality can be realized according to the real time status of link, carry out DDoS threat identification and processing response accurately, full-scope safeguards network communication quality rapidly simultaneously.
Another aspect, the present invention additionally provides a kind of method of work on the basis of the above-mentioned network architecture, to solve the distributed monitoring to ddos attack, is formulating the technical problem of corresponding threat processing policy.
In order to solve the problems of the technologies described above, the network architecture of the present invention method of work, comprise the steps:
Step S100, netinit; Step S200, distributed DDoS threatens monitoring; And step S300, threaten process and/or routing optimality.
Preferably, in order to better realize network configuration, the device in described step S100 involved by netinit comprises: the IDS equipment in data Layer, the controller in key-course and the IDS policy server in application layer; The step of netinit is as follows: step S101, and described IDS policy server and each IDS equipment set up special SSL traffic channel; Step S102, described controller builds network equipment information binding table, and by network equipment information binding table real-time update in each IDS equipment;
Step S104, described controller issues the stream table of mirror policy, is transmitted to IDS equipment corresponding in net territory by all port flow mirror images being loaded with main frame that drags of OF switch; And step S105, described controller issues DDoS threat identification rule to each IDS equipment corresponding in each net territory.
Preferably, in described step S200, distributed DDoS threatens the method for monitoring to comprise: successively to the deceptive practices of link layer and internetwork layer address, internetwork layer and transport layer flag bit arrange abnormal behaviour, and the formula that the floods attack of application layer and transport layer detects; If when arbitrary detection judges that message exists respective behavior in said process, then this message is proceeded to step S300.
Preferably, the method that the deceptive practices of link layer and internetwork layer address detect is comprised: by deception packet check module, deceptive practices are detected, namely first, call network equipment information binding table by deception packet check module; Secondly, by deception packet check module, the type being encapsulated in message in Packet-In message is resolved, to obtain corresponding source, object IP address, MAC Address and to upload No. DPID, switch and the port numbers of this Packet-In message, and above-mentioned each information is compared with the corresponding information in network equipment information binding table respectively; If the above-mentioned information matches in message, then message is carried out next and detect; If the above-mentioned information in message is not mated, then message is proceeded to step S300; Described internetwork layer and transport layer flag bit arrange the method that abnormal behaviour carries out detecting and comprise: arrange abnormal behaviour to flag bit detect by destroying packet check module, namely each flag bit of message is detected, to judge whether each flag bit meets ICP/IP protocol specification; If each flag bit of message meets, then message is proceeded to and carry out next detection; If each flag bit of message does not meet, then message is proceeded to step S300; The method that the formula that the floods attack of described application layer and transport layer is carried out detecting comprises: detected the formula attack of flooding by exception message detection module, namely the Hash table for identifying the formula attack message that floods is built at exception message detection module, and judge whether message has the formula attack that floods according to the threshold values set in this Hash table, and judged result is proceeded to step S300.
Preferably, the method for process and/or routing optimality is threatened to comprise in described step S300:
If message has deceptive practices, and attack threat in OpenFlow territory, then described IDS policy server is suitable for shielding main frame by controller; And threaten not in OpenFlow territory when attacking, then by controller, the switch access interface traffic redirect corresponding to this message is filtered to flow cleaning center; If message has abnormal behaviour, then described IDS policy server is shielded by the flow of controller to attacker or attack main frame; If message has the formula attack that floods, then the switch access interface traffic redirect corresponding to this message is filtered to flow cleaning center by controller by described IDS policy server; And/or go out path optimizing according to link load coefficient calculations, namely the link remaining bandwidth of two adjacent nodes is detected, obtain the load factor of this link, obtaining the optimal path of any two points according to this load factor and initialized network topological diagram, described controller draws corresponding forwarding flow table according to this optimal path and issues each switch.
Preferably, the described IDS policy server shielding transmission program of message and/or the method for main frame comprise:
First, build corresponding Hash table and the setting respective threshold of counting, namely in the unit interval, the first Hash table that deceptive practices are counted is built in described IDS policy server, flag bit arranges the second Hash table that abnormal behaviour carries out counting, and to the 3rd Hash table that the formula attack of flooding counts; Set first, second, third threshold values in first, second, third Hash table simultaneously; Secondly, shielding sends program and/or the main frame of this message, and namely for the behavior of message proceeding to IDS policy server, utilize corresponding Hash table to count, when count value exceedes respective thresholds, shielding sends program and/or the main frame of this message.
Beneficial effect of the present invention: DDoS threatens filtering technique and route-optimization technique to merge by (1) the present invention, when carrying out monitoring, shielding DDOS attack, blocking up of data can't be caused, and by monitoring and threaten process separately, effectively alleviate the burden of control plane, ensure that network is safer, the operation of colleges and universities; (2) ddos attack cannot be forged to address under the invention enables legacy network architectural framework to carry out identifying that the difficult problem with tracing to the source fundamentally is resolved.When there is ddos attack or normal large discharge business in a network, controller based on the real-time perception to network parameters such as link remaining bandwidths, can realize the routing optimality of normal stream amount, significantly promotes the experience of user; (3) process framework of the present invention adopts open-ended modularity design, achieves the efficient detection to DDoS threat and sweetly disposition; (4) each module obtains packet information and adopts independently Interface design, reduces the coupling relevance of intermodule; (5) each module uses the program data structure optimized, and each process sub-process of careful segmentation, improves the high cohesion characteristic of module.
Accompanying drawing explanation
In order to make content of the present invention be more likely to be clearly understood, below basis specific embodiment and by reference to the accompanying drawings, the present invention is further detailed explanation, wherein
Fig. 1 shows the theory diagram of data Layer in software defined network;
Fig. 2 shows the network architecture block diagram of software definition of the present invention;
Fig. 3 shows the structured flowchart of the network architecture of software definition of the present invention;
Fig. 4 shows the theory diagram of ddos attack identification based on SDN framework and guard system;
Fig. 5 shows the workflow diagram of deception packet check module;
Fig. 6 shows the workflow diagram destroying packet check module;
Fig. 7 shows the overhaul flow chart of UDP Floodling;
Fig. 8 shows the overhaul flow chart of ICMP Floodling.
Embodiment
For making the object, technical solutions and advantages of the present invention clearly understand, below in conjunction with embodiment also with reference to accompanying drawing, the present invention is described in more detail.Should be appreciated that, these describe just exemplary, and do not really want to limit the scope of the invention.In addition, in the following description, the description to known features and technology is eliminated, to avoid unnecessarily obscuring concept of the present invention.
Fig. 1 shows the theory diagram of data Layer in software defined network.
As shown in Figure 1, in software defined network (Software Defined Network, SDN) framework, when a message (Packet) arrives switch time, first in switch with stream table mate.If the match is successful, the action executing of just specifying according to stream table forwards rule.If it fails to match, then this message is encapsulated in Packet In message by switch, sends to controller, and this message exists in local cache by switch.Wait controller makes decisions, and how to process this message.
A lot of main frame is had in network, then needing to set up one for All hosts in network is the Hash table of key, be referred to as " in violation of rules and regulations number of times Hash table group ", it comprises: be suitable for the first Hash table counted deception message, be suitable for the second Hash table that destruction message is counted, be suitable for attacking to the formula that floods the 3rd Hash table counted.The violation number of times of record respective hosts, the namely credibility of main frame.
Packet in network is real-time, so need the Hash table of the threat packet counting set up in a kind of unit interval, and a key in the corresponding Hash table of each main frame, corresponding key assignments be record unit interval in the number of threat data bag that sends of the main frame of corresponding keys.Key assignments corresponding for keys all in Hash table must set to 0 in the unit interval " timeslice " by this type of Hash table at first; And often kind of message detected all needs a such table, with regard to such as have detected 100 kinds of messages, just need 100 this type of Hash tables.
And each Hash table must have a corresponding threshold value.As long as one has main frame accumulated counts in analog value in Hash table.Check after counting whether this value exceedes the threshold value of setting.If exceed corresponding threshold value, then the key assignments counting in violation number of times Hash table corresponding record.
Further, the threshold value of each Hash table, the parameters such as Hash table timeslice length all can be regulated by interface.
Such as: the Hash table of main frame is:
Unit interval deception packet counting Hash table
| Host1 | Host2 | Host3 | Host4 | Host5 | Host6 | Host7 | Host8 | …… | Host n |
| 1 | 2 | 2 | 1 | 100 | 2 | 0 | 0 | …… | 0 |
Unit interval destroys packet counting Hash table
| Host1 | Host2 | Host3 | Host4 | Host5 | Host6 | Host7 | Host8 | …… | Host n |
| 1 | 2 | 2 | 1 | 100 | 2 | 0 | 0 | …… | 0 |
Unit interval SYN counts Hash table
| Host1 | Host2 | Host3 | Host4 | Host5 | Host6 | Host7 | Host8 | …… | Host n |
| 1 | 1 | 0 | 1 | 100 | 2 | 0 | 0 | …… | 0 |
Unit interval UDP Flood counts Hash table
| Host1 | Host2 | Host3 | Host4 | Host5 | Host6 | Host7 | Host8 | …… | Host n |
| 1 | 1 | 0 | 1 | 10 | 2 | 0 | 0 | …… | 0 |
Unit interval ICMP Flood counts Hash table
| Host1 | Host2 | Host3 | Host4 | Host5 | Host6 | Host7 | Host8 | …… | Host n |
| 1 | 1 | 0 | 1 | 100 | 2 | 0 | 0 | …… | 0 |
……
Hash tables all is above all unit interval count table, and timeslice counting starts all corresponding key assignments to be set to 0;
Number of times Hash table in violation of rules and regulations
| Host1 | Host2 | Host3 | Host4 | Host5 | Host6 | Host7 | Host8 | …… | Host n |
| 1 | 1 | 0 | 1 | 0 | 2 | 0 | 0 | …… | 0 |
On the basis of foregoing invention principle, the specific implementation process of the present embodiment is as follows.
Embodiment 1
Fig. 2 shows the network architecture block diagram of software definition of the present invention.
As shown in Figure 2, a kind of network architecture of software definition, comprising: application layer, data Layer and key-course; Wherein data Layer, when being arranged in the arbitrary IDS of data Layer (i.e. intrusion detection device) equipment Inspection and threatening to attack, notice application layer enters into attack type analysis process; Application layer, for analyzing attack type, and threatens processing policy according to corresponding attack of attack type customization; Key-course, threatens Processing Interface for application layer provides to attack, and provides optimal path computation for data Layer and/or attack threat identification interface.
Wherein, attack threat to include but not limited to: DDOS attack threatens.
In Fig. 2, application layer threatens processing policy about attack type analysis, attack, the attack monitoring of data Layer, attack threaten shielding and routing optimality, and the attack of key-course threatens process, attack threat identification and optimal path computation to launch in the following embodiments.
Fig. 3 shows the structured flowchart of the network architecture of software definition of the present invention.
As shown in Figure 3, further, when arbitrary IDS equipment Inspection is to when having the message of ddos attack feature, application layer (also can set up SSL traffic channel to report) is reported to; Described application layer is according to reporting information, make the processing policy corresponding with the message with ddos attack feature, then this message is shielded by controller or the switch access interface traffic redirect corresponding to this message is filtered to flow cleaning center.Wherein, ddos attack characterizing definition is: to the deceptive practices of link layer and internetwork layer address, the abnormal behaviour that arranges internetwork layer and transport layer flag bit, and to flood formula attack to application layer and transport layer.
Fig. 4 shows the theory diagram of ddos attack identification based on SDN framework and guard system.
As shown in Figure 4, further, comprise in described IDS equipment:
Deception packet check module, detects the deceptive practices of link layer and internetwork layer address;
Destroy packet check module, the abnormal behaviour that internetwork layer and transport layer flag bit are arranged is detected;
Exception message detection module, detects the formula attack that floods of application layer and transport layer;
Successively message is detected by described deception packet check module, destruction packet check module, exception message detection module; And if when arbitrary detection module detects that message exists above-mentioned respective behavior, then this message is proceeded to application layer.
Further, described application layer is suitable for having deceptive practices when message, and attacks threat in OpenFlow territory, then shield main frame by controller; Maybe when attack threatens not in OpenFlow territory, then by controller, the switch access interface traffic redirect corresponding to this message is filtered to flow cleaning center; Described application layer is also suitable for having abnormal behaviour when message, then shielded by the flow of controller to attacker or attack main frame; And when message has the formula attack that floods, then described application layer is suitable for being filtered to flow cleaning center by the switch access interface traffic redirect corresponding to this message by controller.
The present invention adopts from deception packet check module to destruction packet check module, then to the order that exception message detection module detects successively, wherein, each module obtains packet information and adopts independently Interface design, reduces the coupling relevance of intermodule; And each module uses the program data structure optimized, and each process sub-process of careful segmentation, improves the high cohesion characteristic of module.This detection ordering improves the detection efficiency to message data, and reduces loss.
Fig. 5 shows the workflow diagram of deception packet check module.
As shown in Figure 5, network equipment information binding table is called by described deception packet check module, and the first Hash table being suitable for that packet cheating behavior is counted built in described IDS policy server in the unit interval, and set the first threshold values in this first Hash table; Described deception packet check module, the type of the message be encapsulated in Packet-In message is resolved, to obtain corresponding source, object IP address, MAC Address and to upload No. DPID, switch and the port number information of Packet-In message, and each information is compared with the corresponding information in network equipment information binding table respectively; If the above-mentioned information matches in message, then message is proceeded to and destroy packet check module; If the above-mentioned information in message is not mated, then proceed to described IDS policy server, abandon, and count deceptive practices simultaneously message, when this count value is more than the first threshold values, shielding sends program and/or the main frame of this message.
Concrete, described deception packet check module is used for carrying out first time judgement to message, namely judges whether message is IP spoofing attack message, port spoofing attack message or MAC spoofing attack message.
Concrete steps comprise: parse source, target MAC (Media Access Control) address and switch entrance first in ethernet frames, then parse different messages according to different type of messages.When type of message is IP, ARP, RARP, then parse corresponding source, object IP address then these information to be tabled look-up coupling to the information in network equipment information binding table, if match corresponding information, then give and destroy packet check resume module.If do not mate, then this message is proceeded to the process of IDS policy server; And accumulated counts is carried out to deceptive practices simultaneously, when this count value is more than the first threshold values, shielding sends program and/or the main frame of this message.
Have a device manager module DeviceManagerImpl in Floodlight, when an equipment in a network mobile device time tracking equipment, and according to newly flowing define equipment.
Equipment manager learns equipment from PacketIn request, and from PacketIn message, obtain device network parameter information (information such as source, object IP, MAC, VLAN), is carried out dividing into switch or main frame by equipment by entity classification device.Under default situations, entity classification device uses MAC Address and/or vlan table to show an equipment, mark equipment that these two attributes can be unique.The important information of another one be equipment mounting points (No. DPID of switch and port numbers) (, in an openflow region, an equipment can only have a mounting points, and here openflow region refers to the set of the multiple switches be connected with same Floodlight example.Equipment manager is also provided with expired time for IP address, mounting points, equipment, and last timestamp is as judging the foundation whether they are expired.)
Therefore only need call the IDeviceService that DeviceManagerImpl module provides inside network equipment information binding table module, simultaneously to the monitoring interface of this service interpolation IDeviceListener.
The monitoring interface that wherein IDeviceListener provides has:
ISP: IFloodlightProviderService, IDeviceService
Rely on interface: IFloodlightModule, IDeviceListener
Record in table can refresh the record in binding table in real time according to the low and high level trigger mechanism (low level triggering Port Down extracted by netting twine, and netting twine pulls out the high level of triggering Port Up) of switch.
Traditional ddos attack cannot touch, revise the information of Switch DPID and Switch Port, utilizes this advantage, can detect spoofing attack more flexibly.
Fig. 6 shows the workflow diagram destroying packet check module.
As shown in Figure 6, in described IDS policy server, build being suitable in the unit interval the second Hash table that abnormal behaviour counts is arranged to the flag bit of message, and set the second threshold values in this second Hash table; The each flag bit of described destruction packet check module to message detects, to judge whether each flag bit meets ICP/IP protocol specification; If each flag bit of message meets, then message is proceeded to exception message detection module; If each flag bit of message does not meet, then proceed to described IDS policy server, abandon message, and arrange abnormal behaviour to flag bit simultaneously and count, when this count value is more than the second threshold values, shielding sends program and/or the main frame of this message.
Concrete, described destruction packet check module, judges for carrying out second time to message, namely judges whether message is the attack message with malice flag bit feature.Wherein, the attack message with malice flag bit feature includes but not limited to IP attack message, TCP attack message.Implementation step comprises: detection IP attack message and TCP/UDP attack message wherein being realized to the flag bit of each message, namely identifies whether each flag bit meets ICP/IP protocol specification.If met, just directly transfer to abnormal number packet check resume module.If do not meet, be then judged as attack message, proceed to the process of IDS policy server.
With typical attack such as Tear Drop for row, an offset field and a burst mark (MF) is had in IP packet header, if assailant is arranged to incorrect value offset field, IP fragmentation message just there will be the situation overlapping or disconnect, and target machine system will be collapsed.
In IP heading, have a protocol fields, this field specifies this IP message and carries which kind of agreement.The value of this field is less than 100, if assailant sends to target machine the IP message that a large amount of bands is greater than the protocol fields of 100, the protocol stack in target machine system will be damaged, and is formed and attacks.
Therefore in destruction packet check module, first extract each flag bit of message, then check whether normal.
If normal, then give subsequent module for processing.
If abnormal, then abandon this packet, and to corresponding Hash table rolling counters forward.If when unit interval inside counting device exceedes described second threshold values of setting, then call IDS policy server and corresponding program is shielded and/or directly shields corresponding main frame.
After packet filtering by deception packet check module, the address in the follow-up packet handled by destruction packet check module is all real.Like this, effectively avoid target machine and have received destruction message, may directly cause the protocol stack of target machine to collapse, even target machine directly collapses.
The processing capacity destroying packet check module is roughly similar with deception packet check handling process, and whether normal the flag bit of what difference was that destruction packet check module parses is each message, then detect each flag bit.
If talked about normally, just directly to follow-up exception message detection module process.
If abnormal, then abandon this packet, and to the corresponding Hash table inside counting device counting of host application reference mechanism.If exceed the threshold values of setting, then shield corresponding attacker or directly shield and attack main frame.
The Hash table for identifying the formula attack message that floods is built at described exception message detection module, in described IDS policy server, build the 3rd Hash table being suitable for that the formula attack of flooding is counted in the unit interval, and set the 3rd threshold values in the 3rd Hash table; Described exception message detection module, is suitable for judging whether described message has attack according to the threshold values set in described Hash table; If without attack, then by data distributing; If have attack, then proceed to described IDS policy server, abandon, and count attack simultaneously message, when count value is more than the 3rd threshold values, shielding sends program and/or the main frame of this message.
Concrete, described exception message detection module, judges for carrying out third time to message, namely judges whether message is the formula attack message that floods.
Concrete steps comprise: utilize the identification to building to flood adding up to the respective record in Hash table of formula attack message, and detect whether exceed threshold value, to judge whether the being formula attack message that floods.
Through above-mentioned deception packet check module, the filtering destroying packet check module two modules, the packet of subsequent module for processing belongs to packet under normal circumstances substantially.But, under normal circumstances, also have ddos attack and produce, in the prior art, generally only carry out deception packet check module, destroy packet check module, and in the technical program, in order to avoid ddos attack as much as possible.
Following examples to after carrying out deception packet check module, destroying packet check modular filtration, then shield the embodiment of ddos attack by exception message detection module.This execution mode is for UDP Flooding and ICMP Flooding.
Fig. 7 shows the overhaul flow chart of UDP Floodling.
About UDP Floodling, as shown in Figure 7, utilizing the mechanism of udp protocol without the need to connecting, sending a large amount of UDP message to target machine.Target machine can spend a large amount of time-triggered protocol UDP messages, and these UDP attack messages not only can make the cache overflow depositing UDP message, and can take a large amount of network bandwidths, and target machine (or little) cannot receive legal UDP message.
Because different main frames sends a large amount of UDP message bag to single main frame, so certainly have the situation that udp port takies, so the technical program can receive the unreachable bag of port of an ICMP.
So the technical program can set up a Hash table to All hosts, be used for specially depositing in the unit interval number of times receiving the unreachable bag of ICMP port.If exceed the threshold values of setting, then directly shield corresponding attacker.
Fig. 8 shows the overhaul flow chart of ICMP Floodling.
About ICMP Floodling, as shown in Figure 8, directly unit interval inside counting is carried out for ICMP Flooding.If exceed corresponding threshold values, then direct corresponding shielding is carried out to respective host, although the method is simple, directly effective.
Therefore, exception message detection module, if the type of message detected is exception message type of detection, then carries out corresponding counter detection and whether exceedes threshold value, if do not exceed threshold value, also can be issued by optimum routing policy this packet.If exceeded threshold value, then shield corresponding attacker, or directly corresponding shielding has been carried out to respective host.
When in described deception packet check module, destruction packet check module and exception message detection module, arbitrary module judges that described message is above-mentioned attack message, then this attack message is proceeded to IDS policy server, that is, abandon described message, and shielding sends program and/or the main frame of this message.
When " deception packet check module ", " destroying packet check module " and " exception message detection module " need packet discard or needs to shield threat main frame time.Directly call IDS policy server and carry out corresponding threat process operation.
The concrete implementation step of described IDS policy server comprises:
Abandon described message, namely the step of packet discard comprises as follows:
OpenFlow switch is not matching under corresponding stream expression condition, can this data envelope be contained in Packet In message, this packet exists in local buffer memory by exchange opportunity simultaneously, packet is deposited in the buffer, there is No. ID, a buffer area, this No. ID also can be encapsulated in the buffer_id of Packet In message, by the form of Packet out, the buffer_id simultaneously in Packet out message fills in the buffer area ID (buffer_id in corresponding Packet In message) of the packet that will abandon.
The step of shielding main frame comprises as follows:
OpenFlow protocol streams list structure is as follows:
| Territory, packet header | Counter | Action |
The structure in its middle wrapping head territory is:
IDS policy server comprises the step that application programs carries out shielding and comprises as follows:
Step 1: fill in corresponding matching field in the territory, packet header of stream table, and by arranging Wildcards mask field, obtain shielding attacker or host information.Wherein, as attacker need be shielded, then in territory, stream table packet header, fill in following matching field: IP, MAC, VLAN, Swtich DPID, Swtich Port, protocol type and port numbers thereof etc.As need main frame be shielded, then fill in territory, stream table packet header: the matching fields such as IP, MAC, VLAN, Swtich DPID, Swtich Port.
Step 2: stream is shown action lists and puts sky, realizes the data packet discarding of attacker/main frame.
Step 3: call the record value in each Hash table, calculates stream table time-out erasing time automatically.
Step 4: issue stream table mask program or main frame.
Therefore, the network of the technical program can effectively identify and filtering attack packets.
Optionally, after above-mentioned each module, by issuing of the real-time optimum routing policy of normal message.
Concrete steps are as follows:
First enter step S1 to submit to the topological interface (API) of controller the request of acquisition to, then obtain full mesh topology by step S2.
Then, by carrying out the acquisition of total network links state.First enter step S3, then obtain total network links state by step S10, then calculate total network links remaining bandwidth.
Then be exactly the calculating of real-time optimal path, algorithm adopts classical dijkstra's algorithm, and the weights of algorithm change the inverse of the total network links remaining bandwidth that previous step obtains into, so just can ensure that the path calculated is the most unobstructed, the path that propagation delay time is minimum.(specific algorithm of optimal path is see related content in embodiment 3)
Finally, the optimal path calculated is converted to the real-time optimal path strategy be made up of stream table, issued by step S11.
Step S1 uses topological interface, the api interface that a kind of controller carries, and use LLDP (Link Layer Discovery Protocol) and broadcast packet to find link, then controller calculates network topology automatically.
The topological interface of step S2 controller obtains feedback of request to " full mesh topology acquisition module " topology of " real-time optimal path computation module ".
In step S3, " total network links state acquisition module " files a request to " switch query interface module ", obtains total network links state.Wherein, " switch query interface module " carries on " switch characteristic enquiry module " and " switch status enquiry module " basis at controller and expands, and achieves calculating and the query function of link remaining bandwidth.
Then, " switch query module " sends the broadcast packet of switch property request by step S4 all switches in network.Receive the message of switch characteristic feedback in automatic network again by step S5, parse the curr field inside message, obtain each switch ports themselves current bandwidth B.
Next, this module sends the broadcast packet of switch status request by step S6 all switches in network, comprises port and sends the message status such as bag number, port transmission byte number, port accepts byte number, port accepts bag number.Then, this module receives the message of switch status feedback in automatic network by step S7, parses tx_bytes field, obtains sending byte number N
1, obtain current time t
1.
Next, this module sends the broadcast packet of switch status request by step S8 all switches in network, and then, this module receives the message of switch status feedback in automatic network by S9, and timing stops, and obtains current time t
2.Parse tx_bytes field, obtain sending byte number N
2.
Then can calculate present port remaining bandwidth is: B-(N
2-N
1)/(t
2-t
1).
Then, the remaining bandwidth that the network topology that recycling obtains carries out every bar link calculates:
If the connection between switch and switch, then obtain the remaining bandwidth of the switch ports themselves of this both link ends, the remaining bandwidth of this link is the smaller in two port remaining bandwidths.
If the connection between main frame and switch, then obtain the remaining bandwidth of the switch ports themselves connecting main frame, this link remaining bandwidth is the switch ports themselves remaining bandwidth connecting this main frame.
Step S4 controller sends Feature Request message with the form of broadcast to all switches of the whole network.
Step S5 controller receives switch in automatic network and feeds back to the Feature Reply message of controller.
Step S6 controller sends Stats Request message with the form of broadcast to all switches of the whole network.
Step S7 controller receives switch in automatic network and feeds back to the Stats Reply message of controller.
Step S8 controller sends Stats Request message with the form of broadcast to all switches of the whole network.
Step S9 controller receives switch in automatic network and feeds back to the Stats Reply message of controller.
The link remaining bandwidth information feed back that calculates is given " total network links state acquisition module " by step S10 switch query interface.
Step S11 routing policy issues the real-time optimum routing policy that module calculates, and the stream table calculated is handed down to relevant switch by step S12.
This interface of step S12 is the api interface that controller carries, for issuing the optimum routing policy calculated.
Be defending DDOS attack while by described optimal path strategy, the average transmission time delay of network does not increase sharply.
Embodiment 3
A kind of DDoS that merges in embodiment 1 and embodiment 2 basis threatens the method for work of filtering with the network architecture of the software definition of routing optimality, with by distributed detection and centralized process, effectively alleviate the work load of controller, improve detection efficiency and data transmission rate.
Fusion DDoS of the present invention threatens the method for work of filtering with the network architecture of the software definition of routing optimality, comprises the steps:
Step S100, netinit; Step S200, distributed DDoS threatens monitoring; And step S300, threaten process and/or routing optimality.
Further, the device in described step S100 involved by netinit comprises: the IDS equipment in data Layer, the controller in key-course and the IDS policy server in application layer;
The step of netinit is as follows:
Step S101, described IDS policy server and each IDS equipment set up special SSL traffic channel; Step S102, described controller builds network equipment information binding table, and by network equipment information binding table real-time update in each IDS equipment; Step S104, described controller issues the stream table of mirror policy, is transmitted to IDS equipment corresponding in net territory by all port flow mirror images being loaded with main frame that drags of OF switch; And step S105, described controller issues DDoS threat identification rule to each IDS equipment corresponding in each net territory.
In described step S200, distributed DDoS threatens the method for monitoring to comprise: successively to the deceptive practices of link layer and internetwork layer address, internetwork layer and transport layer flag bit arrange abnormal behaviour, and the formula that the floods attack of application layer and transport layer detects; If when arbitrary detection judges that message exists respective behavior in said process, then this message is proceeded to step S300.
Concrete implementation step comprises:
Step S210, detects the deceptive practices of link layer and internetwork layer address.
Step S220, detects the abnormal behaviour that internetwork layer and transport layer flag bit are arranged.
Step S230, detects the formula that the floods attack of application layer and transport layer.
Step S240, if by message successively by after described step S210, step S220, step S230, when arbitrary step judges that message exists deception, exception, attack, then proceeds to step S300 by described message.
In described step S210, step S211 is comprised the steps: to the method that the deceptive practices of link layer and internetwork layer address detect, call network equipment information binding table by deception packet check module; Step S212, by deception packet check module, the type being encapsulated in message in Packet-In message is resolved, to obtain corresponding source, object IP address, MAC Address and to upload No. DPID, switch and the port numbers of this Packet-In message, and above-mentioned each information is compared with the corresponding information in network equipment information binding table respectively; If the above-mentioned information matches in message, then proceed to step S220 by message; If the above-mentioned information in message is not mated, then message is proceeded to step S300.
Arrange to internetwork layer and transport layer flag bit the method that abnormal behaviour detects in described step S220 to comprise: detect each flag bit of message, to judge whether each flag bit meets ICP/IP protocol specification; If each flag bit of message meets, then message is proceeded to S230; If each flag bit of message does not meet, then message is proceeded to step S300.
In described step S230, step S231 being comprised the steps: to the method that the formula that the floods attack of application layer and transport layer detects, building the Hash table for identifying the formula attack message that floods at exception message detection module; Step S232, judge whether described message is the formula attack message that floods by exception message detection module according to the threshold values set in described Hash table, and judged result is proceeded to step S300, even without attack, then data normally to be issued or by above-mentioned optimal path policy distribution; If have attack, then take corresponding shielding measure.
The method of process and/or routing optimality is threatened to comprise in described step S300:
If message has deceptive practices, and attack threat in OpenFlow territory, then described IDS policy server is suitable for shielding main frame by controller; And threaten not in OpenFlow territory when attacking, then by controller, the switch access interface traffic redirect corresponding to this message is filtered to flow cleaning center;
If message has abnormal behaviour, then described IDS policy server is shielded by the flow of controller to attacker or attack main frame; Concrete implementation step comprises: for destruction message aggression, because IDS equipment have passed deception packet check, so this message address is real when the message of pre-treatment.It is that the stream table of Drop is by attacker or the flow shielding of attacking main frame that IDS policy server only need issue action by the northbound interface of controller.But this is all the decision-making of coarseness, be only applicable to the destruction message aggression that attack packets is a small amount of.
If message has the formula attack that floods, then the switch access interface traffic redirect corresponding to this message is filtered to flow cleaning center by controller by described IDS policy server; Optionally, the safety means of flow cleaning center also can by the result feedback of protection to controller, adjustment network strategy, the Multidimensional protection under realizing SDN and being mixed with legacy network situation.
Further, path optimizing is gone out according to link load coefficient calculations, namely the link remaining bandwidth of two adjacent nodes is detected, obtain the load factor of this link, obtaining the optimal path of any two points according to this load factor and initialized network topological diagram, described controller draws corresponding forwarding flow table according to this optimal path and issues each switch.
The specific algorithm flow process of path optimizing is as follows:
If r
n, (n+1) be the link remaining bandwidth of two adjacent nodes, then its link load coefficient is:
/ * by controller calculate link load coefficient */
U (a, b) for the load factor between any two points and:
If initial network topology figure is G
0, calculate the optimal path between any two points,
Initialize(G
0，G
c，Path){
Get G
0，source，targ et
G
c＝Path＝φ
}/* initialization network topology set and starting point, and empty set */
Initialize U foreach vertex of G
0
The load factor of each node of/* initialization and starting point and */
while(G
c≠G
0){
Select min U (source, x) except x ∈ G
c/ * get minimum U (source, x) */
Update U by x/* according to x upgrade all U*/
Path
index←x
Add x to G
c/ * records x and adds set G
cprevent by iteration U*/
}
Generate optimal Path between source and target
Described IDS policy server shielding sends the program of message and/or the method for main frame comprises:
First, corresponding Hash table and the setting respective threshold of counting is built, namely
In unit interval, build the first Hash table counted deceptive practices in described IDS policy server, flag bit arranges the second Hash table that abnormal behaviour carries out counting, and to the 3rd Hash table that the formula attack of flooding counts;
Set first, second, third threshold values in first, second, third Hash table simultaneously;
Secondly, shielding sends program and/or the main frame of this message, namely
For the behavior of message proceeding to IDS policy server, utilize corresponding Hash table to count, when count value exceedes respective thresholds, shielding sends program and/or the main frame of this message.
Embodiment 4
SDN framework of the present invention and system can define SDNQA (SDN Communication Quality Assurance Strategy) i.e. SDN communication quality guarantee strategies.
Target design and scene dispose dependence test.
Present invention has been dispose and test, prevailing test environment and content measurement as follows:
(1) based on OpenFlow 1.3 agreement, test is equipped with DDoS and is threatened and to filter and communication quality ensures communication between the Floodlight controller of assembly, OF switch, IDS equipment and IDS policy server.
(2) whether test I DS equipment can abnormal aggression flow in real time monitoring network, and reports IDS policy server by SSL traffic channel.
(3) the test I DS policy server information that whether can report according to IDS equipment, makes that process is corresponding attacks the strategy threatened, and is issued by the northbound interface of controller.
(4) whether test controller can according to network real time status, generates and issues the forward-path of real-time optimization, promoting Consumer's Experience.
The concrete deployment of experiment scene., there are two empty nets network area based on centre.Wherein empty net A deploys this SDNQA system, and empty net B not yet disposes, and all there is some ddos attack puppet machines in each void net.
Right side is experiment effect contrast district, comprises a Web server and two subscriber's main stations, wherein Web server runs Tomcat and externally provide Web service, and subscriber's main station A, B are the main frame of access empty net A, B respectively.Left side is attack simulating region, has a ddos attack machine, and the puppet's machine controlled as main control computer in empty net A and empty net B is initiated hybrid-type ddos attack to Web server by attack plane.
Based on above-mentioned experimental situation, verify from the performance of two aspects to SDNQA framework: (1) contrasts the attack frequency that Web server end hybrid-type ddos attack bears; (2) contrast the formula that floods and attack the network average transfer delay caused.
First, flow into situation to Web server end flow to analyze.Puppet's machine that attack plane controls in each void net initiates hybrid-type ddos attack to Web server simultaneously, and its highest frequency is 55Hz, and attacking duration is 100 seconds.Intercept all sequence of data packet of Web server, and isolate the request sequence of each void net, show that empty net A and empty net B institute flow into the request sequence of server respectively, the attack frequency that Web server bears contrasts.
Average transmission rate contrasts, and SDNQA system identifies typical ddos attack fast within 0s ~ 5s time period, and takes filter protection measure within the time period of 0s ~ 40s.After 40s, network traffics are tending towards normal, and test subscriber's host A normally can obtain web-page requests response always.And do not dispose in the void net B of SDNQA system and have a large amount of attack traffic to flow into always, test subscriber's host B cannot obtain web-page requests response.
Secondly, we extract the request sequence of test subscriber's host A and test subscriber's host B from the sequence of data packet intercepted before, the time of delay of the average transmission of statistical data packet from each request sequence, draw the average transmission time delay contrast of two empty nets.
Through routing optimality, the average transfer delay of empty net A is not increased sharply along with the increase of data volume.As can be seen here, SDNQA framework can based on the perception to network real time status, and convection current forward-path is optimized, thus ensures that optimal user is experienced when there is ddos attack or normal large discharge business in a network.
Should be understood that, above-mentioned embodiment of the present invention only for exemplary illustration or explain principle of the present invention, and is not construed as limiting the invention.Therefore, any amendment made when without departing from the spirit and scope of the present invention, equivalent replacement, improvement etc., all should be included within protection scope of the present invention.In addition, claims of the present invention be intended to contain fall into claims scope and border or this scope and border equivalents in whole change and modification.
Claims (9)
1. a network architecture for software definition, is characterized in that, comprising: data Layer, application layer and key-course; Wherein
Data Layer, when being arranged in the arbitrary IDS equipment Inspection of data Layer and threatening to attack, notice application layer enters into attack type analysis process;
Application layer, for analyzing attack type, and threatens processing policy according to corresponding attack of attack type customization;
Key-course, threatens Processing Interface for application layer provides to attack, and provides optimal path computation for data Layer and/or attack threat identification interface.
2. the network architecture of software definition according to claim 1, is characterized in that,
When arbitrary IDS equipment Inspection is to when having the message of ddos attack feature, report to application layer; Described application layer is according to reporting information, make the processing policy corresponding with the message with ddos attack feature, then this message is shielded by the controller in key-course or the switch access interface traffic redirect corresponding to this message is filtered to flow cleaning center;
Comprise in described IDS equipment:
Deception packet check module, detects the deceptive practices of link layer and internetwork layer address;
Destroy packet check module, the abnormal behaviour that internetwork layer and transport layer flag bit are arranged is detected;
Exception message detection module, detects the formula attack that floods of application layer and transport layer;
Successively message is detected by described deception packet check module, destruction packet check module, exception message detection module; And if when arbitrary detection module detects that message exists above-mentioned respective behavior, then this message is proceeded to application layer.
3. the network architecture of software definition according to claim 2, is characterized in that,
Described application layer is suitable for having deceptive practices when message, and attacks threat in OpenFlow territory, then shield main frame by controller; Maybe when attack threatens not in OpenFlow territory, then by controller, the switch access interface traffic redirect corresponding to this message is filtered to flow cleaning center;
Described application layer is also suitable for having abnormal behaviour when message, then shielded by the flow of controller to attacker or attack main frame; And
When message has the formula attack that floods, then described application layer is suitable for being filtered to flow cleaning center by the switch access interface traffic redirect corresponding to this message by controller.
4. a method of work for the network architecture of software definition according to claim 1, comprises the steps:
Step S100, netinit;
Step S200, distributed DDoS threatens monitoring; And
Step S300, threatens process and/or routing optimality.
5. the method for work of the network architecture of software definition according to claim 4, it is characterized in that, the device in described step S100 involved by netinit comprises: the IDS equipment in data Layer, the controller in key-course and the IDS policy server in application layer;
The step of netinit is as follows:
Step S101, described IDS policy server and each IDS equipment set up special SSL traffic channel;
Step S102, described controller builds network equipment information binding table, and by network equipment information binding table real-time update in each IDS equipment;
Step S104, described controller issues the stream table of mirror policy, is transmitted to IDS equipment corresponding in net territory by all port flow mirror images being loaded with main frame that drags of OF switch; And
Step S105, described controller issues DDoS threat identification rule to each IDS equipment corresponding in each net territory.
6. the method for work of the network architecture of the software definition according to claim 4 or 5, is characterized in that, in described step S200, distributed DDoS threatens the method for monitoring to comprise:
Successively to the deceptive practices of link layer and internetwork layer address, internetwork layer and transport layer flag bit arrange abnormal behaviour, and
The formula that the floods attack of application layer and transport layer detects;
If when arbitrary detection judges that message exists respective behavior in said process, then this message is proceeded to step S300.
7. the method for work of the network architecture of software definition according to claim 6, is characterized in that,
The method that the deceptive practices of link layer and internetwork layer address detect is comprised:
By deception packet check module, deceptive practices are detected, namely
First, network equipment information binding table is called by deception packet check module;
Secondly, by deception packet check module, the type being encapsulated in message in Packet-In message is resolved, to obtain corresponding source, object IP address, MAC Address and to upload No. DPID, switch and the port numbers of this Packet-In message, and above-mentioned each information is compared with the corresponding information in network equipment information binding table respectively;
If the above-mentioned information matches in message, then message is carried out next and detect;
If the above-mentioned information in message is not mated, then message is proceeded to step S300;
Described internetwork layer and transport layer flag bit arrange the method that abnormal behaviour carries out detecting and comprise:
Arrange abnormal behaviour by destruction packet check module to flag bit to detect, namely
Each flag bit of message is detected, to judge whether each flag bit meets ICP/IP protocol specification;
If each flag bit of message meets, then message is proceeded to and carry out next detection;
If each flag bit of message does not meet, then message is proceeded to step S300;
The method that the formula that the floods attack of described application layer and transport layer is carried out detecting comprises:
By exception message detection module, the formula attack of flooding is detected, namely
Build the Hash table for identifying the formula attack message that floods at exception message detection module, and judge whether message has the formula attack that floods according to the threshold values set in this Hash table, and judged result is proceeded to step S300.
8. the method for work of the network architecture of software definition according to claim 7, is characterized in that, threatens the method for process and/or routing optimality to comprise in described step S300:
If message has deceptive practices, and attack threat in OpenFlow territory, then described IDS policy server is suitable for shielding main frame by controller; And threaten not in OpenFlow territory when attacking, then by controller, the switch access interface traffic redirect corresponding to this message is filtered to flow cleaning center;
If message has abnormal behaviour, then described IDS policy server is shielded by the flow of controller to attacker or attack main frame;
If message has the formula attack that floods, then the switch access interface traffic redirect corresponding to this message is filtered to flow cleaning center by controller by described IDS policy server; And/or
Path optimizing is gone out according to link load coefficient calculations, namely the link remaining bandwidth of two adjacent nodes is detected, obtain the load factor of this link, obtaining the optimal path of any two points according to this load factor and initialized network topological diagram, described controller draws corresponding forwarding flow table according to this optimal path and issues each switch.
9. the method for work of the network architecture of software definition according to claim 8, is characterized in that, described IDS policy server shielding sends the program of message and/or the method for main frame comprises:
First, corresponding Hash table and the setting respective threshold of counting is built, namely
In unit interval, build the first Hash table counted deceptive practices in described IDS policy server, flag bit arranges the second Hash table that abnormal behaviour carries out counting, and to the 3rd Hash table that the formula attack of flooding counts;
Set first, second, third threshold values in first, second, third Hash table simultaneously;
Secondly, shielding sends program and/or the main frame of this message, namely
For the behavior of message proceeding to IDS policy server, utilize corresponding Hash table to count, when count value exceedes respective thresholds, shielding sends program and/or the main frame of this message.
Priority Applications (3)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201711302096.7A CN107888617A (en) | 2014-12-17 | 2014-12-17 | The method of work of the network architecture of software definition |
| CN201711302083.XA CN107979607A (en) | 2014-12-17 | 2014-12-17 | Suitable for the network architecture and its method of work of the software definition of network security |
| CN201410785460.XA CN104660582B (en) | 2014-12-17 | 2014-12-17 | The network architecture of the software definition of DDoS identifications, protection and path optimization |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201410785460.XA CN104660582B (en) | 2014-12-17 | 2014-12-17 | The network architecture of the software definition of DDoS identifications, protection and path optimization |
Related Child Applications (2)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201711302083.XA Division CN107979607A (en) | 2014-12-17 | 2014-12-17 | Suitable for the network architecture and its method of work of the software definition of network security |
| CN201711302096.7A Division CN107888617A (en) | 2014-12-17 | 2014-12-17 | The method of work of the network architecture of software definition |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN104660582A true CN104660582A (en) | 2015-05-27 |
| CN104660582B CN104660582B (en) | 2018-01-19 |
Family
ID=53251286
Family Applications (3)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201410785460.XA Expired - Fee Related CN104660582B (en) | 2014-12-17 | 2014-12-17 | The network architecture of the software definition of DDoS identifications, protection and path optimization |
| CN201711302096.7A Withdrawn CN107888617A (en) | 2014-12-17 | 2014-12-17 | The method of work of the network architecture of software definition |
| CN201711302083.XA Withdrawn CN107979607A (en) | 2014-12-17 | 2014-12-17 | Suitable for the network architecture and its method of work of the software definition of network security |
Family Applications After (2)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201711302096.7A Withdrawn CN107888617A (en) | 2014-12-17 | 2014-12-17 | The method of work of the network architecture of software definition |
| CN201711302083.XA Withdrawn CN107979607A (en) | 2014-12-17 | 2014-12-17 | Suitable for the network architecture and its method of work of the software definition of network security |
Country Status (1)
| Country | Link |
|---|---|
| CN (3) | CN104660582B (en) |
Cited By (12)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN104539594A (en) * | 2014-12-17 | 2015-04-22 | 南京晓庄学院 | SDN (software defined network) framework, system and working method combining DDoS (distributed denial of service) threat filtering and routing optimization |
| CN105282169A (en) * | 2015-11-04 | 2016-01-27 | 中国电子科技集团公司第四十一研究所 | DDoS attack warning method and system based on SDN controller threshold |
| CN105610854A (en) * | 2016-01-18 | 2016-05-25 | 上海交通大学 | Network-based collaborative defense system |
| WO2017035717A1 (en) * | 2015-08-29 | 2017-03-09 | 华为技术有限公司 | Distributed denial of service attack detection method and associated device |
| CN106559407A (en) * | 2015-11-19 | 2017-04-05 | 国网智能电网研究院 | A kind of Network traffic anomaly monitor system based on SDN |
| CN108289104A (en) * | 2018-02-05 | 2018-07-17 | 重庆邮电大学 | A kind of industry SDN network ddos attack detection with alleviate method |
| CN108322460A (en) * | 2018-01-31 | 2018-07-24 | 海南上德科技有限公司 | A kind of operation system flow monitoring system |
| CN108494805A (en) * | 2018-05-25 | 2018-09-04 | 何林明 | A kind of processing method and processing device of CC attacks |
| CN108881246A (en) * | 2018-06-27 | 2018-11-23 | 中国联合网络通信集团有限公司 | A kind of method and device of vessel safety protection |
| TWI727059B (en) * | 2016-07-15 | 2021-05-11 | 香港商阿里巴巴集團服務有限公司 | Method and device for processing network traffic |
| CN113254989A (en) * | 2021-04-27 | 2021-08-13 | 支付宝(杭州)信息技术有限公司 | Fusion method and device of target data and server |
| CN114268458A (en) * | 2021-11-23 | 2022-04-01 | 贵州电网有限责任公司 | Protection method of safety protection module for terminal public network safety communication |
Families Citing this family (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN109768981B (en) * | 2019-01-20 | 2021-02-02 | 北京工业大学 | Network attack defense method and system based on machine learning under SDN architecture |
| CN111010362B (en) * | 2019-03-20 | 2021-09-21 | 新华三技术有限公司 | Monitoring method and device for abnormal host |
| CN111614610A (en) * | 2020-03-31 | 2020-09-01 | 华南理工大学 | Private block chain network DDoS defense method based on software definition |
Citations (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN102487339A (en) * | 2010-12-01 | 2012-06-06 | 中兴通讯股份有限公司 | Attack preventing method for network equipment and device |
| US20130117847A1 (en) * | 2011-11-07 | 2013-05-09 | William G. Friedman | Streaming Method and System for Processing Network Metadata |
| CN103491095A (en) * | 2013-09-25 | 2014-01-01 | 中国联合网络通信集团有限公司 | Flow cleaning framework and device and flow lead and reinjection method |
| CN103561011A (en) * | 2013-10-28 | 2014-02-05 | 中国科学院信息工程研究所 | Method and system for preventing blind DDoS attacks on SDN controllers |
| CN104023034A (en) * | 2014-06-25 | 2014-09-03 | 武汉大学 | Security defensive system and defensive method based on software-defined network |
-
2014
- 2014-12-17 CN CN201410785460.XA patent/CN104660582B/en not_active Expired - Fee Related
- 2014-12-17 CN CN201711302096.7A patent/CN107888617A/en not_active Withdrawn
- 2014-12-17 CN CN201711302083.XA patent/CN107979607A/en not_active Withdrawn
Patent Citations (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN102487339A (en) * | 2010-12-01 | 2012-06-06 | 中兴通讯股份有限公司 | Attack preventing method for network equipment and device |
| US20130117847A1 (en) * | 2011-11-07 | 2013-05-09 | William G. Friedman | Streaming Method and System for Processing Network Metadata |
| CN103491095A (en) * | 2013-09-25 | 2014-01-01 | 中国联合网络通信集团有限公司 | Flow cleaning framework and device and flow lead and reinjection method |
| CN103561011A (en) * | 2013-10-28 | 2014-02-05 | 中国科学院信息工程研究所 | Method and system for preventing blind DDoS attacks on SDN controllers |
| CN104023034A (en) * | 2014-06-25 | 2014-09-03 | 武汉大学 | Security defensive system and defensive method based on software-defined network |
Cited By (15)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN104539594A (en) * | 2014-12-17 | 2015-04-22 | 南京晓庄学院 | SDN (software defined network) framework, system and working method combining DDoS (distributed denial of service) threat filtering and routing optimization |
| WO2017035717A1 (en) * | 2015-08-29 | 2017-03-09 | 华为技术有限公司 | Distributed denial of service attack detection method and associated device |
| CN105282169A (en) * | 2015-11-04 | 2016-01-27 | 中国电子科技集团公司第四十一研究所 | DDoS attack warning method and system based on SDN controller threshold |
| CN105282169B (en) * | 2015-11-04 | 2018-08-24 | 中国电子科技集团公司第四十一研究所 | Ddos attack method for early warning based on SDN controller threshold values and its system |
| CN106559407A (en) * | 2015-11-19 | 2017-04-05 | 国网智能电网研究院 | A kind of Network traffic anomaly monitor system based on SDN |
| CN105610854B (en) * | 2016-01-18 | 2019-08-06 | 上海交通大学 | A kind of network cooperating system of defense |
| CN105610854A (en) * | 2016-01-18 | 2016-05-25 | 上海交通大学 | Network-based collaborative defense system |
| TWI727059B (en) * | 2016-07-15 | 2021-05-11 | 香港商阿里巴巴集團服務有限公司 | Method and device for processing network traffic |
| CN108322460A (en) * | 2018-01-31 | 2018-07-24 | 海南上德科技有限公司 | A kind of operation system flow monitoring system |
| CN108289104B (en) * | 2018-02-05 | 2020-07-17 | 重庆邮电大学 | Industrial SDN network DDoS attack detection and mitigation method |
| CN108289104A (en) * | 2018-02-05 | 2018-07-17 | 重庆邮电大学 | A kind of industry SDN network ddos attack detection with alleviate method |
| CN108494805A (en) * | 2018-05-25 | 2018-09-04 | 何林明 | A kind of processing method and processing device of CC attacks |
| CN108881246A (en) * | 2018-06-27 | 2018-11-23 | 中国联合网络通信集团有限公司 | A kind of method and device of vessel safety protection |
| CN113254989A (en) * | 2021-04-27 | 2021-08-13 | 支付宝(杭州)信息技术有限公司 | Fusion method and device of target data and server |
| CN114268458A (en) * | 2021-11-23 | 2022-04-01 | 贵州电网有限责任公司 | Protection method of safety protection module for terminal public network safety communication |
Also Published As
| Publication number | Publication date |
|---|---|
| CN107888617A (en) | 2018-04-06 |
| CN104660582B (en) | 2018-01-19 |
| CN107979607A (en) | 2018-05-01 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN104539594A (en) | SDN (software defined network) framework, system and working method combining DDoS (distributed denial of service) threat filtering and routing optimization | |
| CN104660582A (en) | Network architecture of software definition of DDoS identification, protection and path optimization | |
| CN104539625B (en) | Network security defense system based on software definition and working method thereof | |
| CN104539595A (en) | SDN framework integrating threat processing and route optimizing and operating method | |
| CN104378380A (en) | System and method for identifying and preventing DDoS attacks on basis of SDN framework | |
| CN104468636A (en) | SDN structure for DDoS threatening filtering and link reallocating and working method | |
| Xing et al. | Ripple: A programmable, decentralized {Link-Flooding} defense against adaptive adversaries | |
| US11005887B2 (en) | Honeynet method, system and computer program for mitigating link flooding attacks of software defined network | |
| CN101589595B (en) | A containment mechanism for potentially contaminated end systems | |
| US9166990B2 (en) | Distributed denial-of-service signature transmission | |
| CN102801738B (en) | Distributed DoS (Denial of Service) detection method and system on basis of summary matrices | |
| WO2002021278A1 (en) | Coordinated thwarting of denial of service attacks | |
| CN109327426A (en) | A kind of firewall attack defense method | |
| Rengaraju et al. | Detection and prevention of DoS attacks in Software-Defined Cloud networks | |
| CN102263788A (en) | Method and equipment for defending against denial of service (DDoS) attack to multi-service system | |
| CN105871773A (en) | DDoS filtering method based on SDN network architecture | |
| CN105871771A (en) | SDN network architecture aimed at DDoS network attack | |
| CN105871772A (en) | Working method of SDN network architecture aimed at network attack | |
| CN108833430A (en) | A kind of topological guard method of software defined network | |
| Beitollahi et al. | A cooperative mechanism to defense against distributed denial of service attacks | |
| US8281400B1 (en) | Systems and methods for identifying sources of network attacks | |
| Chan et al. | Intrusion detection routers: design, implementation and evaluation using an experimental testbed | |
| Himanshu et al. | A Network Segmentation Architecture for Flow Aggregation and DDoS Mitigation in SDN Using RAPID Flow Rules | |
| RU2791869C1 (en) | Volume ddos attacks protection system and method | |
| Fang et al. | Network Security Situation Evaluation Method for Distributed Denial of Service |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| C06 | Publication | ||
| PB01 | Publication | ||
| C10 | Entry into substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| CB03 | Change of inventor or designer information | ||
| CB03 | Change of inventor or designer information |
Inventor after: Zhang Jiahua Inventor after: Li Chen Inventor after: Wang Jiangping Inventor after: Li Ying Inventor after: Li Shuo Inventor before: Zhang Jiahua Inventor before: Wang Jiangping Inventor before: Li Ying Inventor before: Li Shuo |
|
| GR01 | Patent grant | ||
| GR01 | Patent grant | ||
| CF01 | Termination of patent right due to non-payment of annual fee | ||
| CF01 | Termination of patent right due to non-payment of annual fee |
Granted publication date: 20180119 Termination date: 20181217 |