摘要： 区别于常规的分布式拒绝服务攻击，利用僵尸网络发动的Crossfire攻击具有低速率不可区分的特性，这导致常规入侵检测系统难以防御此类攻击。针对该问题，设计一种检测防御Crossfire攻击的方法。该方法基于软件定义网络，首先利用网络瓶颈选择算法筛选出易受攻击的网络瓶颈节点与链路，在此基础上部署虚拟节点预防Crossfire攻击，虚拟节点应答可疑探测流，扰乱攻击者的攻击视图从而隐藏物理拓扑的网络瓶颈，并在此过程基于随机森林和双阈值自编码器检测僵尸网络，最后通过慢开始防御策略和局部快速重路由方法以达到防御Crossfire攻击的目的。实验在软件定义网络环境下进行，虚拟节点的部署能够使得瓶颈节点指标明显降低，方法所提的僵尸网络检测模型在精度以及召回率等方面相较于传统随机森林分类模型提高了近5%，防御方法能够在10秒内达到缓解Crossfire攻击的效果。实验结果表明，对比其他方法，所提方法能有效检测缓解此类攻击，且在此过程中基本不会影响到合法流量在物理拓扑中的正常转发。

Abstract: Different from conventional DDoS, Crossfire attacks launched by botnets are low-speed indistinguishable, which makes it difficult for conventional intrusion detection systems to defend against such attacks. To solve this problem, a method of detecting and defending Crossfire attacks is designed. This method is based on Software Defined Network (SDN). Firstly, the network bottleneck selection algorithm is used to screen out vulnerable network bottleneck nodes and links. On this basis, deploy virtual nodes to prevent Crossfire attacks. Virtual nodes respond to the suspicious probe flow, distort the attacker's attack view, and hide the network bottleneck of the physical topology. In this process, the botnet is detected based on random forest and double-threshold autoencoder. Finally, the slow start defense strategy and local fast reroute method are adopted to defend against Crossfire attacks. The experiment is carried out in the SDN environment. The deployment of virtual nodes could significantly reduce the bottleneck node index. The botnet detection model proposed by the method is nearly 5% higher than the traditional random forest classification model in terms of precision and recall. The defense method can alleviate Crossfire attacks within 10 seconds. Experimental results show that compared with other methods, the proposed method can effectively detect and mitigate such attacks in the SDN environment, and the normal forwarding of legitimate traffic in the physical topology is basically not affected in this process.