计算机工程 ›› 2019, Vol. 45 ›› Issue (10): 176-182.doi: 10.19678/j.issn.1000-3428.0052435

• 安全技术 • 上一篇    下一篇

SDN中交换机控制代理拒绝服务攻击研究

邓书华a, 卢泽斌a, 李正发a, 高协平a,b   

  1. 湘潭大学 a. 智能计算与信息处理教育部重点实验室;b. 信息工程学院, 湖南 湘潭 411105
  • 收稿日期:2018-08-17 修回日期:2018-10-25 出版日期:2019-10-15 发布日期:2018-11-01
  • 作者简介:邓书华(1991-),男,博士研究生,主研方向为软件定义网络安全;卢泽斌,博士研究生;李正发,硕士研究生;高协平,教授、博士生导师。
  • 基金项目:
    国家自然科学基金(61771415);赛尔网络下一代互联网技术创新项目(NGII20160408)。

Research on Switch Control Agent Denial-of-Service Attack in SDN

DENG Shuhuaa, LU Zebina, LI Zhengfaa, GAO Xiepinga,b   

  1. a. The MOE Key Laboratory of Intelligent Computing and Information Processing;b. College of Information Engineering, Xiangtan University, Xiangtan, Hunan 411105, China
  • Received:2018-08-17 Revised:2018-10-25 Online:2019-10-15 Published:2018-11-01

摘要: 针对软件定义网络(SDN)交换机控制代理吞吐量有限的不足,提出一种交换机控制代理拒绝服务攻击方法。为保护SDN交换机控制代理资源,设计层次化多阈值的攻击检测方案,通过计算SDN交换机及交换机各端口所关联的Packet-In消息的速率,并将其与给定的阈值进行比较来检测攻击。实验结果表明,该方法可实时检测交换机控制代理拒绝服务攻击,与同类攻击检测方法相比,不仅能够识别攻击流量,定位攻击发生的位置,而且不需要改变网络架构。

关键词: 软件定义网络, OpenFlow交换机, 拒绝服务攻击, 控制代理, 网络架构

Abstract: Aiming at the shortcomings of limited throughput of Software Defined Networking(SDN) switch control agent,a switch control agent denial-of-service attack method is proposed.To protect the SDN switch control agent resources,a hierarchical multi-threshold attack detection scheme is designed to detect attacks by calculating the rate of Packet-In messages associated with each port of the SDN switch and comparing it with a given threshold.Experimental results show that the algorithm can detect the switch control agent denial-of-service attacks in real time.Compared with the similar attack detection method,the proposed method can not only identify the attack traffic,but also locate the location of the attacks without changing the network architecture.

Key words: Software-Defined Networking(SDN), OpenFlow switch, denial-of-service attack, control agent, network architecture

中图分类号: