TWI737506B - SYSTEM AND METHOD FOR IPv6 TRAFFIC DETECTION AND DEFENSE BASED ON SOFTWARE-DEFINED NETWORK - Google Patents

Abstract

A system and method for IPv6 traffic based on software-defined network (SDN). The method includes: pre-storing default rules by a SDN switch; receiving a IPv6 packet from a user device by the SDN switch; forwarding, by the SDN switch, traffic from the user device to a target server or a honeypot server in response to the IPv6 packet being matching with the default rules; forwarding, by the SDN switch, the traffic to a sandbox server in response to the IPv6 packet not being matched with the default rules, and generating corresponding mirror traffic, where in the mirror traffic include current traffic; and determining if the current traffic is abnormal, indicating the SDN switch to forward the traffic to the target server in response to the traffic is normal, and indicating the SDN switch to block the traffic or forward the traffic to the honeypot server in response to the traffic is abnormal by the system.

Description

IPv6 traffic detection and defense system and method based on software-defined network

The present invention relates to an IPv6 traffic detection and defense system and method based on a software-defined network (SDN).

With the rapid development of Internet technology, it has also led to an endless stream of network attacks, which has made network security more and more important. Today's network is a static network architecture. This architecture allows attackers to detect the vulnerabilities of their target servers for a long time, so it is a passive defense in terms of security protection. For example, monitoring can be used to detect attack traffic, repair insecure vulnerabilities, or add network security protection equipment to resist attacks. However, these methods can often be cracked by the attacker, and once the attack is successful, the attacker may even put a backdoor program into the target server. In this way, even after the vulnerability is patched, the attacker can still infiltrate the server through the backdoor. Therefore, network administrators need to maintain security equipment and servers for a long time to protect system security. Based on the above, the static network architecture is unable to withstand modern intelligence and network attacks with huge traffic. In response to the diversified information security threats of the future network, the upgrade and innovation of information security protection measures must accelerate the development. Detection and defense is one of the core issues facing current network security. How to design a more complete edge network security protection mechanism, detect and identify malicious attack traffic, and then provide differentiated security services is the goal of future network and information security development.

In view of the rapid development and popularization of IPv6, more and more attention has been paid to the security issues of IPv6. The detection and defense of abnormal traffic in the IPv6 environment has become an important research topic for future network management. At present, the equipment for detecting and preventing abnormal behaviors in IPv6 networks is mainly intrusion detection system (Intrusion Detection System, IDS) and firewall (Firewall). The firewall mainly performs access control for known IPv6 address targets or communication protocol service types, but it cannot effectively determine whether the IPv6 packets passing through the firewall are abnormal. The current IDS is mainly based on two methods: misuse detection (Misuse) and anomaly detection (Anomaly). Traditional IDS is mostly based on misuse detection technology and uses a signature based method to identify malicious IPv6 network attacks. In addition to considering the IDS's ability to support IPv6 feature rules, the use of this type of IDS also requires the administrator to constantly update the feature database to cope with attacks from variant malicious programs. It is also an inevitable shortcoming. Although IDS using anomaly detection technology can be used to detect new IPv4 or specific types of attack traffic, it is difficult to formulate corresponding IPv6 attack judgment modes and detection conditions due to the differences in the communication protocol itself. Changes in IPv6 protocol type, address space, address format or mask format have also led to a significant increase in the complexity of detecting abnormal IPv6 traffic. For IPv6 specific attacks (for example: IPv6 Extension Header Attacks, ICMPv6 DoS, etc.), the detection and defense capabilities are also obviously insufficient. In addition, regardless of the ability of IDS or firewalls to support IPv6, their detection and defense deployments are designed to resist malicious traffic through artificial rules. Therefore, managers need to invest a lot of time to update and maintain detection rules. There may be many blind spots that have not been considered in the formulation of detection rules, which may cause vulnerabilities, and allow attackers to use the rules or human negligence to change the detection rules. Of malicious traffic to avoid detection, increasing network security risks. It can be seen that there are still many shortcomings in the above-mentioned customary methods, which are not a good design and need to be improved urgently.

The invention provides a software-defined network-based IPv6 traffic detection and defense system and method, which can strengthen the capability of IPv6 network security defense.

The purpose of the present invention is to provide a system and method for detecting and defending against IPv6 malicious attacks in a software-defined network (SDN)/network function virtualization (Network Function Virtualization, NFV) intelligent network environment. Service feature engineering, using machine learning classification technology to strengthen IDS to identify IPv6 attacks, and improve the accuracy and ability of IPv6 abnormal traffic detection and judgment. Based on SDN/NFV intelligent network technology, it realizes the mobile defense (Mobile Threat Defense, MTD) mechanism and strengthens the capability of IPv6 network security defense.

The present invention provides an IPv6 traffic detection and defense system based on a software-defined network, which includes a sandbox server, a target server, a honeypot server, a detection and defense device, and an SDN switch. The SDN switch is coupled to the sandbox server, the target server, the honeypot server, and the detection device, and pre-stores preset rules. The SDN switch receives IPv6 packets from the user terminal, and the SDN switch responds to the IPv6 packets and The preset rule matches and forwards the traffic from the user terminal to one of the target server and the honeypot server, where the SDN switch forwards the traffic to the sandbox server in response to the IPv6 packet does not match the preset rule And generate a mirrored traffic corresponding to the traffic. The mirrored traffic includes the current traffic. The detection device obtains the mirrored traffic from the SDN switch, determines whether the current traffic is abnormal, and responds to the current traffic as normal. Instruct the SDN switch to forward the traffic to the target server, and instruct the switch to block the traffic or forward the traffic to the honeypot server in response to the current traffic being abnormal.

In an embodiment of the present invention, the above-mentioned mirrored traffic further includes historical traffic data, wherein the historical traffic data includes a plurality of marked packets, and the detection device is configured to execute: delete non-compliant IPv6 from the plurality of marked packets Format the marked packet to obtain the first marked packet; convert the format of the first marked packet from the IPv6 format to the NetFlow format, where the first marked packet contains multiple characteristic values; standardize the multiple characteristic values of the first marked packet to generate A first standardized marking packet, wherein the first standardized marking packet includes a plurality of standardized characteristic values corresponding to the plurality of characteristic values; feature extraction is performed on the first standardized marking packet to select at least one standardized characteristic from the plurality of standardized characteristic values Value; training a machine learning model according to at least one standardized characteristic value; and judging whether the current traffic is abnormal according to the machine learning model.

In an embodiment of the present invention, the above-mentioned multiple features include a first feature value, and in response to the first feature value corresponding to the categorical feature, the detection and defense device converts the first feature value into the first feature value in the multiple categories. A classification, and a first vector is generated according to the first classification, where the first vector is a standardized first eigenvalue corresponding to the first eigenvalue among the plurality of standardized eigenvalues, and the first vector contains the first eigenvalues corresponding to the multiple classifications respectively. Multiple elements, where multiple elements include the first element corresponding to the first category and other elements, where the first element is 1, and the other elements are 0, and the detection and defense device responds to the first feature value corresponding to the numerical feature The first feature value is normalized to 0 to 1 to generate a standardized first feature value.

In an embodiment of the present invention, the multiple feature values described above include a feature value set corresponding to a numerical feature, wherein the feature value set includes a first feature value and a second feature value, and the feature value is a feature in response to the second feature value. For the largest one in the value set, the detection and defense device divides the first characteristic value by the second characteristic value to normalize the first characteristic value to 0 to 1.

In an embodiment of the present invention, the aforementioned detection and prevention device adds a first rule to the preset rule in response to instructing the SDN switch to forward traffic to the target server, wherein the first rule instructs the SDN switch to be from the user The terminal's data is forwarded to the target server.

In an embodiment of the present invention, the aforementioned detection and prevention device adds a second rule to the preset rule in response to instructing the SDN switch to block IPv6 traffic, wherein the second rule instructs the SDN switch to block IPv6 users from Information about the terminal.

In an embodiment of the present invention, the aforementioned detection and prevention device adds a third rule to the preset rule in response to instructing the SDN switch to forward traffic to the honeypot server, wherein the third rule instructs the SDN switch to send traffic from The data of the user terminal is forwarded to the honeypot server.

In an embodiment of the present invention, the aforementioned detection and prevention device is configured to perform: in response to determining that the current traffic is abnormal, determining whether the traffic related to the current traffic is greater than the traffic threshold; and instructing the SDN in response to the traffic being greater than the traffic threshold The switch blocks the traffic; in response to the traffic being less than or equal to the traffic threshold, it is determined whether the user terminal corresponding to the current traffic matches the IPv6 blacklist pre-stored in the detection device; and in response to the user terminal matching the blacklist. The SDN switch forwards the traffic to the honeypot server.

In an embodiment of the present invention, after the aforementioned detection and prevention device determines whether the current traffic is abnormal, the SDN switch updates the preset rule according to the current traffic.

The invention provides a software-defined network-based IPv6 traffic detection and defense method, including: an SDN switch is coupled to a sandbox server, a target server, a honeypot server, and a detection and defense device, and the SDN switch is Pre-stored preset rules; the SDN switch receives the packet from the user terminal; the SDN switch forwards the traffic from the user terminal to one of the target server and the honeypot server in response to the IPv6 packet matching the preset rule One; The SDN switch forwards the traffic to the sandbox server in response to the IPv6 packets do not match the preset rules, and generates a mirrored traffic corresponding to the traffic, where the mirrored traffic includes the current traffic; and The anti-device obtains mirrored traffic from the SDN switch, determines whether the current traffic is abnormal, and instructs the SDN switch to forward the traffic to the target server in response to the current traffic being normal, and responds to the current traffic being abnormal. Instruct the SDN switch to block the traffic or forward the traffic to the honeypot server.

In the IPv6 environment, how to accurately identify and judge IPv6 abnormal traffic based on information such as characteristics and behavior patterns in IPv6 traffic flow is the focus of the development of IPv6 attack detection. The present invention recognizes unknown IPv6 traffic through machine learning. In this way, there is no need to manually formulate detection rules. Machine learning can learn to identify legal and malicious traffic through a large number of known IPv6 traffic, and this method can solve the loopholes caused by man-made rules and reduce the manpower required to maintain detection rules. Machine learning mainly uses statistical methods to summarize and establish normal patterns, and then uses algorithms such as classification or regression prediction to construct IPv6 classification attack behaviors based on the relationship between the characteristics and the labels of the samples of the data set. The model is used as the basis for identification. In addition to detecting IPv6 attacks through machine learning, a new type of defense strategy is also needed to effectively defend against IPv6 network attacks. The present invention adopts the defense strategy of mobile target defense, which can transfer the attacker's IPv6 malicious traffic through a dynamic network structure to achieve defense. At present, there are many researches using relay nodes or proxy servers to achieve mobile target defense. However, once the attacker collects attacks and masters the exact target server information, this defense mechanism will also collapse.

In the future 5G all-IP network era, SDN/NFV is regarded as the most forward-looking technology. With its Programmable and Virtualized network functions, it is an intelligent network. The basis of development. In the future, the design of IPv6 network security architecture will evolve in the direction of programmability and virtualization. How to combine SDN/NFV technology to achieve IPv6 mobile defense and develop an innovative IPv6 network security service model is also the future of IPv6 defense technology research and development. Focus. The present invention provides an IPv6 network security system that integrates IDS feature recognition and machine learning classification technology to improve the accuracy of IPv6 abnormal traffic detection. In addition, the system uses SDN/NFV to implement a mobile defense mechanism, which can strengthen the capability of IPv6 network security defense.

FIG. 1 illustrates a schematic diagram of an SDN-based IPv6 traffic detection and defense system 10 and a user terminal 20 according to an embodiment of the present invention. The IPv6 traffic reconnaissance and defense system 10 may include a reconnaissance and defense device 100, an SDN switch 200, a sandbox server 300, a target server 400, and a honeypot server 500.

The SDN switch 200 is, for example, an OpenFlow switch, which can use the OpenFlow IPv6 matched Filed format and rules to forward IPv6 traffic. The SDN switch 200 can establish a software-defined network. An external terminal network device can access the software-defined network by connecting with the SDN switch 200. The SDN switch 200 may include at least a transceiver circuit, an analog-to-digital (A/D)/digital-to-analog (D/A) converter, a processing circuit, an optional memory circuit or one or more antenna units, but the present invention does not Limited to this. The SDN switch 200 can be communicatively connected to the detection and defense device 100, the sandbox server 300, the target server 400, the honeypot server 500, and the user terminal 20. The SDN switch 200 may pre-store preset rules. When traffic passes through the SDN switch 200, the SDN switch 200 can manage the forwarding path of the traffic through preset rules.

The sandbox server 300 is used to process unknown IPv6 traffic, and provides a test environment for the traffic, so that the traffic in the sandbox server 300 does not affect the target server 400. The sandbox server 300 may have a processing unit (such as CPU central processing unit but not limited to this), a communication unit (such as various communication interfaces, Ethernet, mobile or WiFi wireless, etc., but not limited to this), and storage Units (for example: removable random access memory, flash memory, hard disk, etc. but not limited to these) and other necessary components for running the sandbox server 300.

The target server 400 is used to serve normal user terminals. Since the software used to serve the user terminal is mainly stored in the target server 400, the target server 400 is the main protection target of the IPv6 traffic detection and defense system 10. The detection and prevention device 100 of the present invention can prevent malicious IPv6 traffic from invading the target server 400. The target server 400 may have a processing unit (such as a CPU central processing unit but not limited to this), a communication unit (such as various communication interfaces, Ethernet, mobile or WiFi wireless, etc., but not limited to this), and a storage unit (For example: removable random access memory, flash memory, hard disk, etc. but not limited thereto) and other necessary components for running the target server 400.

The honeypot server 500 is used to guide the IPv6 attacker's traffic, so that the malicious traffic cannot directly attack the target server 400. The honeypot server 500 may have a processing unit (such as CPU central processing unit but not limited to this), a communication unit (such as various communication interfaces, Ethernet, mobile or WiFi wireless, etc., but not limited to this), and storage Units (for example: removable random access memory, flash memory, hard disk, etc. but not limited to these) and other necessary components for running the honeypot server 500.

The user terminal 20 may include (but is not limited to) a desktop computer, a notebook computer, a network computer, a telephone device, a pager, a camera, a TV, a handheld game console, and other client electronic devices that use IP as the communication protocol. However, the present invention is not limited to this. The user terminal 20 may at least include a transceiver circuit, an analog-to-digital (A/D)/digital-to-analog (D/A) converter, a processing circuit, an optional memory circuit or one or more antenna units, but the present invention is not limited to this.

The detection and defense device 100 can be used to configure the SDN switch 200 to manage the IPv6 traffic forwarding path in the software-defined network. In this embodiment, the detection and defense device 100 can determine the nature of the IPv6 traffic from the user terminal 20, so as to direct the traffic or data from the user terminal 20 to the sandbox server 300, the target server 400, and the honeypot server. One of 500 devices. FIG. 2 illustrates a schematic diagram of the detection and defense device 100 according to an embodiment of the present invention. The detection and defense device 100 may include a controller 110, a storage medium 120 and a transceiver 130.

The controller 110 is, for example, an SDN programmable controller, a central processing unit (CPU), or other programmable general-purpose or special-purpose micro control unit (MCU), microprocessor (Microprocessor), digital signal processor (DSP), programmable controller, application specific integrated circuit (ASIC), graphics processing unit (GPU), image signal processing Image signal processor (ISP), image processing unit (IPU), arithmetic logic unit (ALU), complex programmable logic device (CPLD), on-site programmable logic Field programmable gate array (FPGA) or other similar elements or a combination of the above elements. The controller 110 may be coupled to the storage medium 120 and the transceiver 130, and access and execute a plurality of modules and various application programs stored in the storage medium 120.

The storage medium 120 is, for example, any type of fixed or removable random access memory (RAM), read-only memory (ROM), or flash memory. , Hard disk drive (HDD), solid state drive (solid state drive, SSD) or similar components or a combination of the above components, which are used to store multiple modules or various application programs that can be executed by the controller 110. The storage medium 120 can store multiple functional modules including the capture and classification module 121, the feature engineering module 122, the analysis module 123, and the mobile defense module 124, the functions of which will be described later. In an embodiment, the storage medium 120 may pre-store and record an IPv6 blacklist of one or more IPv6 user terminals.

The transceiver 130 transmits and receives signals through a communication interface (for example, Ethernet, mobile or WiFi wireless, etc.) in a wireless or wired manner. The detection and defense device 100 may be communicatively connected to the switch 200 through the transceiver 130.

Fig. 3 shows a flow chart of an SDN-based IPv6 traffic detection and defense method according to an embodiment of the present invention. In step S301, the SDN switch 200 may receive an IPv6 packet from the user terminal 20. In step S302, the SDN switch 200 may determine whether the IPv6 packet matches a preset rule pre-stored in the SDN switch 200. If the IPv6 packet matches the preset rule, it means that the user terminal 20 transmitting the IPv6 packet is not unknown to the switch 200. Accordingly, the flow proceeds to step S303.

In step S303, the SDN switch 200 may forward the traffic from the user terminal 20 to the target server 400 or the honeypot server 500. Specifically, the SDN switch 200 can determine whether the user terminal 20 is a malicious IPv6 user or a non-malicious IPv6 user based on the IPv6 packet from the user terminal 20 and a preset rule. If the user terminal 20 belongs to a malicious user, the SDN switch 200 forwards the traffic from the user terminal 20 to the honeypot server 500. If the user terminal 20 belongs to a non-malicious user, the SDN switch 200 forwards the traffic from the user terminal 20 to the target server 400. On the other hand, if the IPv6 packet does not match the preset rule, it means that the user terminal 20 transmitting the IPv6 packet is unknown to the SDN switch 200. Accordingly, the flow proceeds to step S304.

In step S304, the SDN switch 200 can forward the traffic from the user terminal 20 to the sandbox server 300, and copy the traffic to generate a corresponding mirrored traffic. Then, the SDN switch 200 can transmit the mirroring traffic to the detection and defense device 100. The detection and defense device 100 can receive mirrored traffic through the transceiver 130, where the mirrored traffic can include historical traffic data and current traffic.

In step S305, the analysis module 123 of the detection and defense device 100 can determine whether the current traffic is abnormal. If the current traffic is normal, step S306 is entered. If the current traffic is abnormal, step S307 is entered. Specifically, the analysis module 123 of the detection and defense device 100 can determine whether the current traffic is abnormal according to a machine learning model trained from historical traffic data.

In step S306, the mobile defense module 124 of the detection and defense device 100 may send a command to the switch 200 through the transceiver 130 to instruct the switch 200 to forward the traffic from the user terminal 20 to the target server 400.

In step S307, the analysis module 123 of the detection and defense device 100 can determine whether the traffic related to the current traffic is greater than the traffic threshold. If the flow rate is greater than the flow rate threshold, step S308 is entered. If the flow rate is less than or equal to the flow rate threshold, step S309 is entered.

In step S308, the mobile defense module 124 of the detection and defense device 100 may send a command to the switch 200 through the transceiver 130 to instruct the SDN switch 200 to block traffic from the user terminal 20. In this way, a large number of abnormal traffic can be prevented from affecting the operation of the software-defined network.

In step S309, the analysis module 123 of the detection and protection device 100 can determine whether the user terminal 20 corresponding to the current traffic matches the IPv6 blacklist pre-stored in the detection and protection device 100. If the user terminal 20 matches the IPv6 blacklist, step S310 is entered. If the user terminal 20 does not match the IPv6 blacklist, step S311 is entered.

In step S310, the mobile defense module 124 of the detection and defense device 100 may send a command to the SDN switch 200 through the transceiver 130 to instruct the SDN switch 200 to forward the traffic from the user terminal 20 to the honeypot server 500. Since the detection and prevention device 100 already knows that the user terminal 20 is a malicious IPv6 user terminal, the detection and prevention device 100 can direct the user terminal 20 to the honeypot server 500, so that the user of the user terminal 20 can focus on attacking the honeypot The server 500, and the target server 400 is ignored.

In step S311, the mobile defense module 124 of the detection and defense device 100 may send a command to the SDN switch 200 through the transceiver 130 to instruct the switch 200 to forward the traffic from the user terminal 20 to the target server 400.

In step S312, the mobile defense module 124 of the detection and defense device 100 may send a command to the SDN switch 200 through the transceiver 130 to instruct the SDN switch 200 to update the preset rules according to the current traffic. Specifically, the mobile defense module 124 of the detection and defense device 100 may instruct the SDN switch 200 to forward the traffic from the user terminal 20 to the target server 400 (as shown in step S306), and then instruct the SDN through the transceiver 130. The switch 200 adds the first rule to the preset rule. The first rule may instruct the SDN switch 200 to forward future traffic or data from the user terminal 20 to the target server 400. In addition, the mobile defense module 124 can instruct the SDN switch 200 to add the second rule to the preset via the transceiver 130 in response to instructing the SDN switch 200 to block traffic from the user terminal 20 (as shown in step S308). Set the rules. The second rule may instruct the SDN switch 200 to block future traffic or data from the user terminal 20. Furthermore, the mobile defense module 124 may instruct the SDN switch 200 to forward the traffic from the user terminal 20 to the honeypot server 500 (as shown in step S310) and instruct the SDN switch 200 through the transceiver 130 to transfer Three rules are added to the default rules. The third rule may instruct the switch 200 to forward future traffic or data from the user terminal 20 to the honeypot server 500. In one embodiment, the mobile defense module 124 can read the source IPv6 address in the obtained traffic or data to determine whether the source of the traffic or data is the user terminal 20.

The analysis module 123 of the detection and defense device 100 can determine whether the current traffic is abnormal according to the machine learning model. Fig. 4 shows a flowchart of training a machine learning model according to an embodiment of the present invention. In step S401, the capture and classification module 121 of the detection and defense device 100 can obtain the mirrored traffic corresponding to the user terminal 20, where the mirrored traffic may include historical traffic data. The historical traffic data may include a plurality of marked packets, and each marked packet may include characteristic information of whether the marked packet is an abnormal IPv6 packet.

In step S402, the capture and classification module 121 of the detection device 100 can delete the marked packets that do not conform to the IPv6 format from the plurality of marked packets to obtain a set of marked packets for training the machine learning model. In other words, each marked packet in the marked packet set can conform to the IPv6 format.

In step S403, the capture and classification module 121 of the detection and defense device 100 can convert the format of each of the marked packet sets from the IPv6 format to the NetFlow format, wherein each of the marked packet sets may include multiple features Value, wherein the multiple feature values can respectively correspond to category features or numeric features, such as source IPv6 address (Source IPv6 Address), destination IPv6 address, source port number (Source IPv6 Address) Port Number, Destination Port Number, Next Hop Address, NetFlow Duration, Time at Start of Flow, Time at End of Flow), Transmission Control Protocol (TCP) flag (TCP Flag), Transport Layer Protocol Number (Transport Layer Protocol Number), Internet protocol (IP) type of service (IP Type of Service), Packet Count or Bytes Count, etc., the present invention is not limited to this.

In step S404, the feature engineering module 122 of the detection and defense device 100 can standardize the feature value of each of the marked packet sets, thereby generating a standardized marked packet set. Each standardized marked packet in the set of standardized marked packets may include a plurality of standardized characteristic values corresponding to the plurality of characteristic values, respectively.

FIG. 5 shows a flowchart of normalizing feature values by the feature engineering module 122 according to an embodiment of the present invention. The feature engineering module 122 can normalize the feature value to generate a standardized feature value. In step S501, the feature engineering module 122 may determine that the feature value to be standardized corresponds to a categorical feature (for example: IPv6 address, TCP/UDP transmission protocol) or a numerical feature (for example: 100, 200, or 500). If the feature value corresponds to the categorical feature, step S502 is entered. If the feature value corresponds to a numerical feature, step S504 is entered.

In step S502, the feature engineering module 122 can convert the feature value into one of a plurality of categories according to the pre-stored mapping table, where the category can be presented in the form of text. Table 1 is an example of the feature value of the categorical feature "IPv6 address" and the classification corresponding to the feature value. Table 1 Characteristic value (IPv6 address) Classification FE80::5480:E980:1000:201A linklocal 2001:0:68:1234::2 global 02::1 multicast

In step S503, the feature engineering module 122 of the detection and defense device 100 can generate a vector corresponding to the feature value according to the classification, where the vector is the standardized feature value. In an embodiment, the vector may include a plurality of elements corresponding to a plurality of categories, and the plurality of elements may include elements corresponding to the feature value and other elements. The feature engineering module 122 can set the element corresponding to the feature value to "1", and set other elements to "0". Table 2 is an example of the classification and the vector generated according to the classification. In Table 2, the first element of the vector corresponds to the category "linklocal", the second element of the vector corresponds to the category "global", and the third element of the vector corresponds to the category "multicast". Table 2 Classification Vector (normalized eigenvalues) linklocal [1,0,0] global [0,1,0] multicast [0,0,1]

In step S504, the feature engineering module 122 of the detection and defense device 100 may normalize the feature value (ie, the feature value corresponding to the numerical feature) to 0 to 1, so as to generate a standardized feature value. In an embodiment, the plurality of characteristic values may include a characteristic value set corresponding to a numerical characteristic, wherein the characteristic value set may include a first characteristic value and a second characteristic value. The feature engineering module 122 may divide the first feature value by the second feature value in response to the second feature value being the largest one in the feature value set, thereby normalizing the first feature value to 0 to 1. In addition, the feature engineering module 122 can normalize the second feature value to 1. Table 3 is an example of the characteristic values of several numerical characteristics of the marked packet and the standardized characteristic values generated by normalizing the characteristic values. It can be seen from Table 3 that the feature value of numerical feature #3 is greater than the feature values of other numerical features. Therefore, the feature engineering module 122 can divide the feature value of each numeric feature by the feature value of numeric feature #3 to normalize each feature value to 0 to 1. table 3 Numerical feature number Eigenvalues Standardized eigenvalues #1 120 0.24 #2 200 0.4 #3 500 1 #4 80 0.16 #5 250 0.5

Returning to FIG. 4, after obtaining the standardized labeled packet set, in step S405, the feature engineering module 122 may perform feature extraction on each of the standardized labeled packet sets to obtain multiple features from each standardized labeled packet. At least one standardized feature value used for training the machine learning model is selected from the values.

In step S406, the feature engineering module 122 may train a machine learning model according to at least one standardized feature value. For example, the feature engineering module 122 can train the machine based on algorithms such as Decision Tree (DT), K Nearest Neighbor (KNN), or Deep Neural Networks (DNN). Learning model, the present invention is not limited to this.

The intelligent network IPv6 traffic detection and defense system and method provided by the present invention have the following benefits and advantages when compared with other conventional technologies:

The invention can analyze and discriminate malicious traffic on user-side IPv6 traffic through advanced IPv6 detection and prevention technology, can effectively identify normal and abnormal IPv6 traffic, and can strengthen the detection and prevention efficiency of IPv6 information security threats in combination with MTD mobile defense mechanism. application.

The invention can provide IPv6 traffic characteristic engineering processing capability to establish IPv6 traffic data set to generate classification model. The invention can convert unknown IPv6 traffic flow to an IPv6 traffic classification model for classification, and can be used as a development basis for IPv6 machine learning.

The invention can use machine learning classification technology to strengthen IDS identification and detection of IPv6 attacks, can provide multiple IPv6 attack traffic judgment conditions, analyze abnormal packets, abnormal traffic, and abnormal users, and strengthen the ability to identify abnormal IPv6 traffic.

The invention can realize the replacement and change of IPv6 traffic flow by the MTD mobile defense mechanism through SDN/NFV technology, and can effectively block malicious IPv6 traffic or direct the honeypot server to suspicious IPv6 packets/abnormal users to further analyze IPv6 attack information. Service types and modes, and strengthen the security protection capabilities of the IPv6 network environment.

10: IPv6 traffic detection and defense system 100: Reconnaissance Device 110: Controller 120: storage media 121: Capture classification module 122: Feature Engineering Module 123: Analysis Module 124: Mobile Defense Module 130: Transceiver 20: User terminal 200: Software-defined network switch 300: Sandbox server 400: target server 500: Honeypot server S301, S302, S303, S304, S305, S306, S307, S308, S309, S310, S311, S312, S401, S402, S403, S404, S405, S406, S501, S502, S503, S504: steps

Fig. 1 illustrates a schematic diagram of an SDN-based IPv6 traffic detection and defense system and a user terminal according to an embodiment of the present invention. Fig. 2 illustrates a schematic diagram of a detection and defense device according to an embodiment of the present invention. Fig. 3 illustrates a flow chart of an SDN-based IPv6 traffic detection and prevention method according to an embodiment of the present invention. Fig. 4 shows a flowchart of training a machine learning model according to an embodiment of the present invention. FIG. 5 shows a flowchart of normalizing feature values by a feature engineering module according to an embodiment of the present invention.

S301, S302, S303, S304, S305, S306, S307, S308, S309, S310, S311, S312: steps

Claims (10)

A software-defined network-based IPv6 traffic detection and defense system, including: a sandbox server; a target server; a honeypot server; a detection and defense device; and a software-defined network switch, coupled to the sandbox server , The target server, the honeypot server, and the detection device, and pre-stored preset rules, wherein the software-defined network switch receives IPv6 packets from the user terminal, and the software-defined network The switch forwards the traffic from the user terminal to one of the target server and the honeypot server in response to the IPv6 packet matching the preset rule, wherein the software-defined network The road switch forwards the traffic to the sandbox server in response to that the IPv6 packet does not match the preset rule, and generates a mirrored traffic corresponding to the traffic, wherein the mirrored traffic The service includes current traffic, wherein the detection and defense device obtains the mirrored traffic from the software-defined network switch, determines whether the current traffic is abnormal, and instructs the current traffic to be normal in response to the current traffic. The software-defined network switch forwards the traffic to the target server, and in response to the current traffic being abnormal, instructs the software-defined network switch to block the traffic or block all the traffic. The traffic is forwarded to the honeypot server, wherein the mirror traffic further includes historical traffic data, and the historical traffic The data includes a plurality of marked packets, wherein the detection device is configured to execute: delete marked packets that do not conform to the IPv6 format from the plurality of marked packets to obtain a first marked packet; and change the format of the first marked packet Converting from the IPv6 format to the NetFlow format, wherein the first marked packet includes a plurality of characteristic values. The IPv6 traffic detection and prevention system according to claim 1, wherein the detection and prevention device is configured to execute: normalize the plurality of characteristic values of the first marked packet to generate a first standardized marked packet, wherein The first standardized mark packet includes a plurality of standardized feature values respectively corresponding to the plurality of feature values; feature extraction is performed on the first standardized mark packet to select at least one standardized feature from the plurality of standardized feature values Value; training a machine learning model according to the at least one standardized characteristic value; and judging whether the current traffic is abnormal according to the machine learning model. The IPv6 traffic detection and defense system according to claim 2, wherein the plurality of characteristic values includes a first characteristic value, and the detection and prevention device responds to the first characteristic value corresponding to a categorical characteristic, and converts the The first feature value is converted into a first category of a plurality of categories, and a first vector is generated according to the first category, wherein the first vector is one of the plurality of standardized feature values corresponding to the first feature A normalized first feature value of the value, wherein the first vector includes a plurality of elements corresponding to the plurality of categories, wherein the plurality of elements includes the first element corresponding to the first category and other elements, Which said The first element is 1, and the other elements are 0, wherein the detection and defense device normalizes the first feature value to 0 to 1 in response to the first feature value corresponding to a numeric feature to generate The normalized first characteristic value. The IPv6 traffic detection and defense system according to claim 3, wherein the plurality of characteristic values includes a characteristic value set corresponding to a numerical characteristic, wherein the characteristic value set includes the first characteristic value and the second characteristic value , Wherein in response to the second characteristic value being the largest one in the characteristic value set, the detection device divides the first characteristic value by the second characteristic value to normalize the first characteristic value Converted to 0 to 1. The IPv6 traffic detection and prevention system according to claim 1, wherein the detection and prevention device adds a first rule to all in response to instructing the software-defined network switch to forward the traffic to the target server In the preset rule, the first rule instructs the software-defined network switch to forward the data from the user terminal to the target server. The IPv6 traffic detection and prevention system according to claim 1, wherein the detection and prevention device adds a second rule to the preset rule in response to instructing the software-defined network switch to block the traffic , Wherein the second rule instructs the software-defined network switch to block data from the user terminal. The IPv6 traffic detection and prevention system according to claim 1, wherein the detection and prevention device adds a third rule to the honeypot server in response to instructing the software-defined network switch to forward the traffic to the honeypot server In the preset rule, the third rule Instruct the software-defined network switch to forward the data from the user terminal to the honeypot server. The IPv6 traffic detection and prevention system according to claim 1, wherein the detection and prevention device is configured to execute: in response to determining that the current traffic is abnormal, determine whether the traffic related to the current traffic is greater than a flow threshold ; In response to the traffic being greater than the traffic threshold, instruct the software-defined network switch to block the traffic; in response to the traffic being less than or equal to the traffic threshold, it is determined that the traffic corresponds to the current traffic Whether the user terminal matches the IPv6 blacklist pre-stored in the detection and defense device; and instructing the software-defined network switch to forward the traffic in response to the user terminal matching the IPv6 blacklist To the honeypot server. The IPv6 traffic detection and prevention system according to claim 1, wherein after the detection and prevention device determines whether the current traffic is abnormal, the software-defined network switch updates the prediction according to the current traffic. Set rules. A software-defined network-based IPv6 traffic detection and defense method includes: a software-defined network switch is coupled to a sandbox server, a target server, a honeypot server, and a detection and defense device, and the software Defining the pre-stored preset rules of the network switch; the software-defined network switch receives IPv6 packets from the user terminal; The software-defined network switch forwards the traffic from the user terminal to one of the target server and the honeypot server in response to the IPv6 packet matching the preset rule ; By the software-defined network switch in response to the IPv6 packet does not match the preset rules, the traffic is forwarded to the sandbox server, and a mirror image corresponding to the traffic is generated The mirrored traffic includes current traffic and historical traffic data, wherein the historical traffic data includes a plurality of marked packets; the detection device obtains the mirrored image from the software-defined network switch Traffic, determining whether the current traffic is abnormal, instructing the software-defined network switch to forward the traffic to the target server in response to the current traffic being normal, and responding to the The current traffic is abnormal, and the software-defined network switch is instructed to block the traffic or forward the traffic to the honeypot server; the detection device sends the multiple marked packets Deleting a marked packet that does not conform to the IPv6 format to obtain a first marked packet; and the detection and prevention device converts the format of the first marked packet from the IPv6 format to the NetFlow format, wherein the first marked packet includes multiple Eigenvalues.

Images