WO2016150253A1 - 基于sdn的ddos攻击防护方法、装置及系统 - Google Patents

基于sdn的ddos攻击防护方法、装置及系统 Download PDF

Info

Publication number
WO2016150253A1
WO2016150253A1 PCT/CN2016/072781 CN2016072781W WO2016150253A1 WO 2016150253 A1 WO2016150253 A1 WO 2016150253A1 CN 2016072781 W CN2016072781 W CN 2016072781W WO 2016150253 A1 WO2016150253 A1 WO 2016150253A1
Authority
WO
WIPO (PCT)
Prior art keywords
packet forwarding
forwarding device
traffic
destination
address
Prior art date
Application number
PCT/CN2016/072781
Other languages
English (en)
French (fr)
Inventor
蒋武
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to EP16767630.3A priority Critical patent/EP3253025B1/en
Publication of WO2016150253A1 publication Critical patent/WO2016150253A1/zh
Priority to US15/711,725 priority patent/US10630719B2/en
Priority to US16/824,036 priority patent/US11394743B2/en

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1441—Countermeasures against malicious traffic
    • H04L63/1458—Denial of Service
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L43/00—Arrangements for monitoring or testing data switching networks
    • H04L43/16—Threshold monitoring
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L45/00—Routing or path finding of packets in data switching networks
    • H04L45/64—Routing or path finding of packets in data switching networks using an overlay routing layer
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
    • H04L63/1425—Traffic logging, e.g. anomaly detection
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/40—Network security protocols
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L43/00—Arrangements for monitoring or testing data switching networks
    • H04L43/08—Monitoring or testing based on specific metrics, e.g. QoS, energy consumption or environmental parameters
    • H04L43/0876—Network utilisation, e.g. volume of load or congestion level
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L45/00—Routing or path finding of packets in data switching networks
    • H04L45/56—Routing software
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
    • H04L63/0227—Filtering policies
    • H04L63/0254—Stateful filtering
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/20—Network architectures or network communication protocols for network security for managing network security; network security policies in general

Definitions

  • the present invention relates to a communication technology, and in particular, to a software-defined network (Software Defined Network, SDN)-based distributed denial of service (DDOS) attack protection method, device and system.
  • SDN Software Defined Network
  • DDOS distributed denial of service
  • FIG. 1 is a schematic diagram of a DDoS attack.
  • the main implementation principle of the DDoS is that an attacker uses a primary or multi-level master host as a springboard to control a large number of infected controlled hosts to form an attack network to implement a large-scale denial of service attack on the victim host.
  • This kind of attack can often amplify the attack effect of a single attacker in the form of a series, which will have a major impact on the victim host and cause serious congestion on the network.
  • the DDoS uses the attack network to initiate an Internet Control Messages Protocol (ICMP) flood attack, Synchronous (Synchronous) flood attack, and User Datagram Protocol (UDP).
  • ICMP Internet Control Messages Protocol
  • Synchronous Synchronous
  • UDP User Datagram Protocol
  • Various forms of attack such as flood attacks, cause the victim host to consume a large amount of processing resources to process these burst requests and fail to respond to legitimate user requests, causing embarrassment.
  • the DDoS protection solution is usually deployed on the network aggregation node, and the DDoS attack traffic aggregated to the node is cleaned by the cleaning device to implement DDoS protection.
  • the network aggregation node may be an interconnection and interworking gateway, a domestic metropolitan area network egress device, and an export device of various data centers.
  • the prior art usually deploys a cleaning device for a specific IP address, that is, aggregates traffic connected to a host having the specific IP address. A cleaning device is deployed on the node.
  • the specific IP address may be set according to the customer's needs and the priority of the client; for example, the client needs to protect an IP address or a segment of an IP address of a server;
  • the node where the traffic is aggregated serves as the node where the cleaning device is deployed.
  • the cleaning device is deployed for a specific IP address
  • the DDoS for the victim host needs to be determined regardless of whether the IP address of the victim host is a specific IP address.
  • the attack traffic is diverted to the cleaning device, so that the traffic of the victim host whose IP address is not a specific IP address needs to be routed to the cleaning device through multiple routing forwarding nodes in the network. Therefore, the network resources of these routing and forwarding nodes are occupied, and the influence range of the DDoS attack on the backbone network is expanded, thereby reducing the security of the network.
  • the invention provides an SDN-based DDOS attack protection method, device and system, which are used for improving network security.
  • a first aspect of the present invention provides a distributed denial of service DDoS attack protection method based on a software-defined network SDN, including:
  • the controller sends a traffic statistics command to the first packet forwarding device, where the traffic statistics command is used to instruct the first packet forwarding device to perform traffic statistics.
  • the traffic statistics instruction carries a destination IP address.
  • the controller collects statistics reported by the first packet forwarding device according to the traffic statistics instruction, where the statistics includes traffic statistics information flowing to the destination IP address;
  • the controller obtains a global traffic statistics value that flows to the destination IP address according to the statistics
  • the global traffic statistics value is used by the controller to collect the statistics reported by the at least two packet forwarding devices, including the first packet forwarding device, to obtain the SDN range. a statistical value of the flow of the internal flow to the destination IP address;
  • the controller determines whether the global traffic statistics exceeds a predetermined threshold, and sends a DDoS protection policy to the second packet forwarding device based on the determination result that the global traffic statistics exceeds a predetermined threshold.
  • the traffic statistics instruction further carries: detecting a start time
  • the detection start time is used to notify the first packet forwarding device of the start time of the traffic statistics, and the traffic statistics are used by the first packet forwarding device to detect a period.
  • the statistics are continuously reported to the controller by the first packet forwarding device in the detection period.
  • the method further includes:
  • the controller determines that the global traffic statistics value does not exceed the predetermined threshold in the at least two consecutive detection periods, and the controller sends a protection cancellation indication message to the second packet forwarding device;
  • the protection elimination indication message is used to instruct the second packet forwarding device to end execution of the DDoS protection policy.
  • the controller sends the information to the second packet forwarding device Before the DDoS protection strategy, it also includes:
  • the controller determines, according to the statistical data, a packet forwarding device that is closest to the attack source on the attack path, and uses the packet forwarding device that is closest to the attack source as the second packet forwarding device.
  • the traffic statistics information that is sent to the destination IP address includes: the first packet The value of the traffic that is sent to the destination IP address on the forwarding device.
  • the controller determines, according to the statistics, the packet forwarding device that is closest to the attack source on the attack path, including:
  • the first attack path is an attack path with the largest flow value in at least one attack path flowing to the destination IP address;
  • the packet forwarding device closest to the attack source is located at the SDN boundary of the source address side of the traffic flowing to the destination IP address on the first attack path.
  • the DDoS protection policy includes any one of the following response policies: a black hole route response policy, and a current limit Response policy, speed limit response policy, drop response policy, local cleaning Response strategy, dynamic drainage cleaning response strategy;
  • the black hole route response policy is used to indicate that the second packet forwarding device performs packet discarding processing on the traffic that flows to the destination IP address by configuring a black hole route.
  • the traffic limiting response policy is used to instruct the second packet forwarding device to perform a traffic limiting process on the traffic that flows to the destination IP address.
  • the speed limit response policy is used to instruct the second packet forwarding device to perform rate limiting processing on the traffic that flows to the destination IP address;
  • the discarding response policy is used to instruct the second packet forwarding device to perform packet discarding processing on the traffic that flows to the destination IP address;
  • the local cleaning response policy is used to instruct the second packet forwarding device to locally perform the cleaning process on the traffic flowing to the destination IP address;
  • the dynamic draining cleaning response policy is used to instruct the second packet forwarding device to send the traffic flowing to the destination IP address to the cleaning device for cleaning processing.
  • the statistics data further includes: a load value of the first packet forwarding device
  • the method includes:
  • the first drainage path is a path with a minimum load between the second packet forwarding device and the cleaning device; the first drainage path includes the second packet forwarding device and the cleaning device;
  • the DDoS protection policy delivered by the controller to the second packet forwarding device is the dynamic drainage cleaning response policy, where the dynamic drainage cleaning response policy includes first drainage path indication information, and the first drainage path indication The information is used to instruct the second packet forwarding device to send the traffic that flows to the destination IP address to the cleaning device through the first drainage path for cleaning processing.
  • a DDoS protection policy to the second packet forwarding device before the controller sends a DDoS protection policy to the second packet forwarding device, include:
  • the controller Determining, by the controller, the second drainage path according to the SDN topology relationship, where the second drainage path is the closest path between the second packet forwarding device and the cleaning device, and the SDN topology
  • the relationship includes a connection relationship between each packet forwarding device and the cleaning device in the SDN;
  • the controller sends a DDoS protection policy to the second packet forwarding device to the dynamic drainage cleaning response policy, where the dynamic drainage cleaning response policy includes second drainage path indication information, and the second drainage path indication information
  • the second packet forwarding device is configured to send the traffic that flows to the destination IP address to the cleaning device by using the second drainage path to perform a cleaning process.
  • a second aspect of the present invention provides a SDN-based DDoS attack protection method, where the method is applied to an SDN system, where the SDN system includes a controller and a packet forwarding device, and the method is forwarded by the packet.
  • Equipment execution including:
  • the traffic statistics instruction carries a destination IP address.
  • the traffic statistics instruction further carries: detecting a start time
  • the detection start time is used to notify the packet forwarding device to perform the traffic statistics start time, and the traffic statistics are continuously performed in a manner of detecting a period, and the statistical data is reported to the detection period.
  • the controller is used to notify the packet forwarding device to perform the traffic statistics start time, and the traffic statistics are continuously performed in a manner of detecting a period, and the statistical data is reported to the detection period.
  • the method further includes:
  • the method further includes:
  • the DDoS protection policy includes any of the following A response strategy: a black hole routing response policy, a current limiting response policy, a rate limiting response policy, a drop response policy, a local cleaning response policy, and a dynamic drainage cleaning response strategy;
  • the black hole route response policy is used to indicate that the packet forwarding device performs packet discarding processing on the traffic that flows to the destination IP address by configuring a black hole route.
  • the traffic limiting response policy is used to indicate that the packet forwarding device performs current limiting processing on the traffic that flows to the destination IP address.
  • the rate limiting response policy is used to instruct the packet forwarding device to perform rate limiting processing on the traffic flowing to the destination IP address;
  • the discarding response policy is used to instruct the packet forwarding device to perform packet discarding processing on the traffic that flows to the destination IP address;
  • the local cleaning response policy is used to indicate that the packet forwarding device locally performs cleaning processing on the traffic flowing to the destination IP address;
  • the dynamic draining cleaning response policy is used to instruct the packet forwarding device to send the traffic flowing to the destination IP address to the cleaning device for cleaning processing;
  • the statistics data further includes: a load value of the first packet forwarding device
  • the dynamic drainage cleaning response policy includes first drainage path indication information, where the first drainage path indication information is used to indicate that the packet forwarding device passes the traffic flowing to the destination IP address through the first drainage
  • the path is sent to the cleaning device for performing a cleaning process;
  • the first drainage path is a path with a minimum load between the packet forwarding device and the cleaning device; and the first drainage path includes the second packet a forwarding device and the cleaning device;
  • the traffic that flows to the destination IP address is sent to the cleaning device through the first drainage path for cleaning processing.
  • the dynamic drainage cleaning response policy includes a second drainage path indication information, and the second drainage path
  • the indication information is used to indicate that the packet forwarding device sends the traffic that flows to the destination IP address to the cleaning device through the second drainage path for cleaning processing;
  • the second drainage path is the The closest path between the packet forwarding device and the cleaning device;
  • the traffic that flows to the destination IP address is sent to the cleaning device through the second drainage path for cleaning processing.
  • a third aspect of the present invention provides a controller comprising:
  • a sending module configured to send a traffic statistics command to the first packet forwarding device, where the traffic statistics command is used to instruct the first packet forwarding device to perform traffic statistics, where the traffic statistics refers to Order to carry the destination IP address;
  • a receiving module configured to collect statistics, reported by the first packet forwarding device, according to the traffic statistics command sent by the sending module, where the statistics includes traffic statistics information that flows to the destination IP address;
  • Processing module for:
  • the global traffic statistics value is used by the controller to collect the statistics reported by the at least two packet forwarding devices, including the first packet forwarding device, to obtain the SDN range. a statistical value of the flow of the internal flow to the destination IP address;
  • the sending module is further configured to send a DDoS protection policy to the second packet forwarding device, based on the determination result that the global traffic statistics value determined by the processing module exceeds a predetermined threshold.
  • the traffic statistics instruction further carries: detecting a start time
  • the detection start time is used to notify the first packet forwarding device to perform the start time of the traffic statistics, and the traffic statistics are continuously executed by the first packet forwarding device in a detection period.
  • the statistical data is reported by the first packet forwarding device to the controller in the detection period;
  • the processing module is further configured to:
  • the sending module is further configured to send a protection to the second packet forwarding device based on a result that the global traffic statistics value does not exceed the predetermined threshold in the at least two consecutive detection periods determined by the processing module Eliminate the indication message;
  • the protection elimination indication message is used to instruct the second packet forwarding device to end execution of the DDoS protection policy.
  • the processing module Before the DDoS protection policy is delivered by the forwarding device, it is also used to:
  • the traffic statistics information that is sent to the destination IP address includes: the first report The value of the traffic flowing to the destination IP address on the forwarding device;
  • the processing module is further configured to determine, according to the statistics, a packet forwarding device that is closest to the attack source on the attack path, specifically:
  • the first attack path is an attack path with the largest flow value in at least one attack path flowing to the destination IP address;
  • the packet forwarding device closest to the attack source is located at the SDN boundary of the source address side of the traffic flowing to the destination IP address on the first attack path.
  • the DDoS protection policy includes any one of the following response policies: black hole routing. Response policy, current limit response policy, speed limit response policy, drop response policy, local cleaning response policy, dynamic drainage cleaning response strategy;
  • the black hole route response policy is used to instruct the second packet forwarding device to perform packet discarding processing on the traffic of the destination IP address by configuring the black hole route.
  • the traffic limiting response policy is used to indicate that the second packet forwarding device performs a traffic limiting process on the traffic that flows to the destination IP address.
  • the speed limit response policy is used to instruct the second packet forwarding device to perform rate limiting processing on traffic flowing to the destination IP address;
  • the discarding response policy is used to instruct the second packet forwarding device to perform packet discarding processing on the traffic flowing to the destination IP address;
  • the local cleaning response policy is used to instruct the second packet forwarding device to locally perform the cleaning process on the traffic flowing to the destination IP address;
  • the dynamic drain cleaning response policy is used to indicate that the second packet forwarding device will flow to the The traffic of the destination IP address is sent to the cleaning device for cleaning.
  • the statistics data further includes: a load value of the first packet forwarding device
  • the processing module is further configured to: before the sending module sends a DDoS protection policy to the second packet forwarding device:
  • the first drainage path is a path with a minimum load between the second packet forwarding device and the cleaning device; the first drainage The path includes the second packet forwarding device and the cleaning device;
  • the DDoS protection policy delivered by the sending module to the second packet forwarding device according to the first drainage path determined by the processing module is the dynamic drainage cleaning response policy, and the dynamic drainage cleaning response policy
  • the first drainage path indication information is used to indicate that the second packet forwarding device sends the traffic that flows to the destination IP address to the Cleaning is performed on the cleaning equipment.
  • the processing module is sent by the sending module to the second packet forwarding device Before the DDoS protection strategy, it was also used to:
  • the sending module sends a DDoS protection policy to the second packet forwarding device as the dynamic drainage cleaning response policy according to the second drainage path determined by the processing module, where the dynamic drainage cleaning response policy includes
  • the second drainage path indication information is used to indicate that the second packet forwarding device sends the traffic that flows to the destination IP address to the cleaning by using the second drainage path. The equipment is cleaned.
  • a fourth aspect of the present invention provides a packet forwarding device, where the packet forwarding device is applied to an SDN system, where the SDN system includes a controller and the packet forwarding device, and the packet forwarding device, include:
  • a receiving module configured to receive a traffic statistics command sent by the controller, where the traffic statistics command is used to instruct the processing module to perform traffic statistics; wherein the traffic statistics command carries a destination IP address;
  • the processing module is configured to collect, according to the traffic statistics instruction received by the receiving module, traffic statistics information that is sent to the destination IP address;
  • a sending module configured to report statistics to the controller according to the traffic statistics that are sent to the destination IP address, where the statistics include the flow to the destination IP address Traffic statistics.
  • the traffic statistics instruction further carries: detecting a start time
  • the detecting start time is used to notify the processing module to perform the start time of the traffic statistics, and the traffic statistics are continuously performed in a manner of detecting a period, and the statistical data is reported to the Controller.
  • the receiving module is reported by the sending module to the controller After the statistics, it is also used to:
  • the processing module is further configured to perform protection processing on the traffic flowing to the destination IP address according to the DDoS protection policy received by the receiving module.
  • the receiving module after receiving the DDoS protection policy sent by the controller, Used for:
  • the processing module is further configured to stop performing protection processing on the traffic flowing to the destination IP address according to the protection cancellation indication message received by the receiving module.
  • the DDoS protection policy includes any of the following A response strategy: a black hole routing response policy, a current limiting response policy, a rate limiting response policy, a drop response policy, a local cleaning response policy, and a dynamic drainage cleaning response strategy;
  • the black hole route response policy is used to instruct the processing module to perform packet discarding processing on the traffic that flows to the destination IP address by configuring a black hole route.
  • the processing module sends the flow to the destination IP address according to the DDoS protection policy.
  • the traffic is subjected to the protection processing.
  • the black hole route is used to discard the traffic destined for the destination IP address according to the black hole routing response policy received by the receiving module.
  • the current limiting response policy is used to instruct the processing module to perform a current limiting process on the traffic that flows to the destination IP address;
  • the processing module performs protection processing on the traffic that flows to the destination IP address according to the DDoS protection policy, specifically: performing, according to the traffic limiting response policy received by the receiving module, the flow to the destination The traffic of the IP address of the ground is subjected to traffic limiting processing;
  • the speed limit response policy is used to instruct the processing module to perform rate limiting processing on the traffic that flows to the destination IP address;
  • the processing module performs protection processing on the traffic that flows to the destination IP address according to the DDoS protection policy, specifically: performing, according to the speed limit response policy received by the receiving module, the flow to the destination The traffic of the IP address of the ground is subjected to rate limiting processing;
  • the discarding response policy is used to instruct the processing module to perform packet discarding processing on the traffic that flows to the destination IP address;
  • the processing module performs protection processing on the traffic that flows to the destination IP address according to the DDoS protection policy, where the flow is directed to the destination according to the discard response policy received by the receiving module.
  • the traffic of the IP address is discarded.
  • the local cleaning response policy is used to instruct the processing module to locally clean the traffic flowing to the destination IP address
  • processing module performs protection processing on the traffic that flows to the destination IP address according to the DDoS protection policy, specifically: locally, according to the local cleaning response policy received by the receiving module, to the flow direction The traffic of the destination IP address is cleaned;
  • the dynamic drain cleaning response policy is used to instruct the processing module to send the flow of the flow to the destination IP address to a cleaning device for cleaning processing;
  • the processing module performs protection processing on the traffic that flows to the destination IP address according to the DDoS protection policy, specifically: indicating, according to the dynamic drainage cleaning response policy received by the receiving module, that the sending module The traffic flowing to the destination IP address is sent to the cleaning device for cleaning processing.
  • the statistics further includes: a load value of the first packet forwarding device;
  • the dynamic drainage cleaning response policy includes first drainage path indication information, where the first drainage path indication information is used to indicate that the traffic of the flow to the destination IP address is sent to the cleaning device through the first drainage path. Performing a cleaning process on the first routing path, where the load path from the packet forwarding device to the cleaning device is the smallest; the first drainage path includes the second packet forwarding device and the cleaning device ;
  • the processing module instructs the sending module to send the traffic that flows to the destination IP address to the cleaning device for cleaning, specifically:
  • the dynamic drainage cleaning response policy includes a second drainage path indication information, and the second drainage path The indication information is used to indicate that the traffic that flows to the destination IP address is sent to the cleaning device through the second drainage path for cleaning processing; the second drainage path is the packet forwarding device to the The path closest to the cleaning device;
  • the processing module instructs the sending module to send the traffic that flows to the destination IP address to the cleaning device for cleaning, specifically:
  • a fifth aspect of the present invention provides an SDN system, including: a controller, a first packet forwarding device, and a second packet forwarding device;
  • controller is configured to:
  • the first packet forwarding device And sending, by the first packet forwarding device, a traffic statistics command, where the traffic statistics command is used to indicate that the first packet forwarding device performs traffic statistics; and the traffic statistics command carries a destination IP address;
  • the global traffic statistics value is used by the controller to collect the statistics reported by the at least two packet forwarding devices, including the first packet forwarding device, to obtain the SDN range. a statistical value of the flow of the internal flow to the destination IP address;
  • the first packet forwarding device is configured to:
  • the second packet forwarding device is configured to:
  • the traffic statistics instruction further carries: detecting a start time
  • the detection start time is used to notify the first packet forwarding device to perform the start time of the traffic statistics, and the traffic statistics are continuously executed by the first packet forwarding device in a detection period.
  • the statistics are reported by the first packet forwarding device to the controller in the detection period.
  • the controller is further configured to:
  • the protection elimination indication message is used to indicate that the second packet forwarding device ends execution of the DDoS protection policy
  • the second packet forwarding device is further configured to:
  • the controller in the second packet Before the DDoS protection policy is delivered by the forwarding device, it is also used to:
  • the traffic statistics information that is sent to the destination IP address includes: the first report The value of the traffic flowing to the destination IP address on the forwarding device;
  • the controller determines, according to the statistics, a packet forwarding device that is closest to the attack source on the attack path, specifically:
  • the first attack path is an attack path with the largest flow value in at least one attack path flowing to the destination IP address;
  • the packet forwarding device closest to the attack source is located at the SDN boundary of the source address side of the traffic flowing to the destination IP address on the first attack path.
  • the DDoS protection policy includes any one of the following response policies: black hole routing Response policy, current limit response policy, speed limit response policy, drop response policy, local cleaning response policy, dynamic drainage cleaning response strategy;
  • the black hole route response policy is used to instruct the second packet forwarding device to perform packet discarding processing on the traffic of the destination IP address by configuring the black hole route.
  • the second packet forwarding device performs protection processing on the traffic that flows to the destination IP address according to the DDoS protection policy, where: the black hole routing response policy is used to flow to the destination IP address according to the black hole routing response policy. Traffic is discarded for packet processing;
  • the traffic limiting response policy is used to indicate that the second packet forwarding device performs a traffic limiting process on the traffic that flows to the destination IP address.
  • the second packet forwarding device flows to the destination IP according to the DDoS protection policy.
  • the traffic of the address is subjected to protection processing, specifically: performing traffic limiting processing on the traffic that flows to the destination IP address according to the traffic limiting response policy;
  • the speed limit response policy is used to instruct the second packet forwarding device to perform rate limiting processing on traffic flowing to the destination IP address;
  • the second packet forwarding device performs protection processing on the traffic that flows to the destination IP address according to the DDoS protection policy, where the traffic that flows to the destination IP address is performed according to the rate limiting response policy.
  • Speed limit processing
  • the discarding response policy is used to instruct the second packet forwarding device to perform packet discarding processing on the traffic flowing to the destination IP address;
  • the second packet forwarding device performs a protection process on the traffic that flows to the destination IP address according to the DDoS protection policy, where the traffic that flows to the destination IP address is reported according to the discard response policy. Discard processing;
  • the local cleaning response policy is used to instruct the second packet forwarding device to locally perform the cleaning process on the traffic flowing to the destination IP address;
  • the second packet forwarding device performs protection processing on the traffic that flows to the destination IP address according to the DDoS protection policy, where the traffic that flows to the destination IP address is performed according to the local cleaning response policy.
  • the dynamic draining cleaning response policy is used to instruct the second packet forwarding device to send traffic that flows to the destination IP address to the cleaning device for cleaning processing;
  • the second packet forwarding device performs protection processing on the traffic that flows to the destination IP address according to the DDoS protection policy, specifically: the traffic that flows to the destination IP address according to the dynamic drainage cleaning response policy. Send to the cleaning device for cleaning.
  • the statistics data further includes: a load value of the first packet forwarding device
  • the controller is further configured to: before the sending the DDoS protection policy to the second packet forwarding device:
  • the first drainage path is a path with a minimum load between the second packet forwarding device and the cleaning device; the first drainage The path includes the second packet forwarding device and the cleaning device;
  • the DDoS protection policy delivered to the second packet forwarding device is the dynamic drainage cleaning
  • the dynamic drainage cleaning response policy includes first drainage path indication information, where the first drainage path indication information is used to indicate that the second packet forwarding device passes the traffic to the destination IP address.
  • the first drainage path is sent to the cleaning device for cleaning processing;
  • the second packet forwarding device performs protection processing on the traffic that flows to the destination IP address according to the DDoS protection policy, specifically:
  • the controller sends the DDoS protection to the second packet forwarding device Before the strategy, it is also used to:
  • the second packet forwarding device sends the traffic that flows to the destination IP address to the cleaning device through the second drainage path for cleaning processing;
  • the second packet forwarding device performs protection processing on the traffic that flows to the destination IP address according to the DDoS protection policy, specifically:
  • a sixth aspect of the present invention provides a controller comprising: a processor, a memory, a transceiver, and a bus;
  • the transceiver includes: a southbound interface unit;
  • the southbound interface unit is configured to:
  • the global traffic statistics value is used by the controller to collect the statistics reported by the at least two packet forwarding devices, including the first packet forwarding device, to obtain the SDN range. a statistical value of the flow of the internal flow to the destination IP address;
  • the southbound interface unit is further configured to send a DDoS protection policy to the second packet forwarding device, based on a determination result that the global traffic statistics value determined by the processor exceeds a predetermined threshold.
  • the memory is configured to store the statistical data and the DDoS protection policy.
  • the traffic statistics instruction further carries: detecting a start time
  • the detection start time is used to notify the first packet forwarding device to perform the start time of the traffic statistics, and the traffic statistics are continuously executed by the first packet forwarding device in a detection period.
  • the statistical data is reported by the first packet forwarding device to the controller in the detection period;
  • the processor is further configured to:
  • the southbound interface unit is further configured to send, according to the result that the global traffic statistics value does not exceed the predetermined threshold, in the at least two consecutive detection periods determined by the processor, to the second packet forwarding device Send protection to eliminate the indication message;
  • the protection elimination indication message is used to instruct the packet forwarding device to end execution of the DDoS protection policy.
  • the processor is in the southbound interface unit to the second Before the DDoS protection policy is delivered by the packet forwarding device, it is also used to:
  • the southbound interface unit is further configured to send a DDoS protection policy to the second packet forwarding device. slightly.
  • the traffic statistics information that is sent to the destination IP address includes: the first report The value of the traffic flowing to the destination IP address on the forwarding device;
  • the processor determines, according to the statistics received by the southbound interface unit, a packet forwarding device that is closest to the attack source on the attack path, specifically:
  • the first attack path is an attack path with the largest flow value in at least one attack path flowing to the destination IP address;
  • the packet forwarding device closest to the attack source is located at the SDN boundary of the source address side of the traffic flowing to the destination IP address on the first attack path.
  • the DDoS protection policy includes any one of the following response policies: black hole routing. Response policy, current limit response policy, speed limit response policy, drop response policy, local cleaning response policy, dynamic drainage cleaning response strategy;
  • the black hole route response policy is used to instruct the second packet forwarding device to perform packet discarding processing on the traffic of the destination IP address by configuring the black hole route.
  • the traffic limiting response policy is used to indicate that the second packet forwarding device performs a traffic limiting process on the traffic that flows to the destination IP address.
  • the speed limit response policy is used to instruct the second packet forwarding device to perform rate limiting processing on traffic flowing to the destination IP address;
  • the discarding response policy is used to instruct the second packet forwarding device to perform packet discarding processing on the traffic flowing to the destination IP address;
  • the local cleaning response policy is used to instruct the second packet forwarding device to locally perform the cleaning process on the traffic flowing to the destination IP address;
  • the dynamic draining cleaning response policy is used to instruct the second packet forwarding device to send traffic that flows to the destination IP address to the cleaning device for cleaning processing.
  • the statistics further includes: a load value of the first packet forwarding device;
  • the processor is further configured to: before the southbound interface unit sends the DDoS protection policy to the second packet forwarding device:
  • the first drainage path is a path with a minimum load between the second packet forwarding device and the cleaning device; the first drainage path includes the second packet forwarding device and the cleaning device;
  • the DDoS protection policy sent by the southbound interface unit to the second packet forwarding device according to the first routing path determined by the processor is a dynamic drainage cleaning response policy, and the dynamic drainage cleaning response policy
  • the first drainage path indication information is used to indicate that the second packet forwarding device sends the traffic that flows to the destination IP address to the Cleaning is performed on the cleaning equipment.
  • the processor in the southbound interface unit, to the second packet forwarding device Before issuing the DDoS protection policy, it is also used to:
  • the southbound interface unit sends a DDoS protection policy to the second packet forwarding device as a dynamic drainage cleaning response policy according to the second drainage path determined by the processor, where the dynamic drainage cleaning response policy includes
  • the second drainage path indication information is used to indicate that the second packet forwarding device sends the traffic that flows to the destination IP address to the cleaning by using the second drainage path. The equipment is cleaned.
  • a seventh aspect of the present invention provides a packet forwarding device, where the packet forwarding device is applied to an SDN system, where the SDN system includes a controller and the packet forwarding device, and the packet forwarding device, Includes: processor, memory, transceiver, and bus;
  • the transceiver includes: a northbound interface unit;
  • the northbound interface unit is configured to receive a traffic statistics command sent by the controller, where the traffic statistics command is used to instruct the processing module to perform traffic statistics, where the traffic statistics command carries a destination IP address;
  • the processor is configured to collect, according to the traffic statistics instruction received by the northbound interface unit, traffic statistics information flowing to the destination IP address;
  • the northbound interface unit is further configured to report statistics to the controller according to the traffic statistics of the flow to the destination IP address, where the statistics include the flow to the destination Traffic statistics of the local IP address;
  • the memory is configured to store the traffic statistics instruction and the traffic statistics information that is sent to the destination IP address.
  • the traffic statistics instruction further carries: detecting a start time
  • the detection start time is used to notify the processor to start the flow statistics, and the traffic statistics are continuously performed in a manner of detecting a period, and the statistical data is reported to the Controller.
  • the northbound interface unit is further configured to receive after reporting statistics to the controller a DDoS protection policy sent by the controller;
  • the processor is further configured to perform protection processing on the traffic flowing to the destination IP address according to the DDoS protection policy received by the northbound interface unit.
  • the northbound interface unit after receiving the DDoS protection policy sent by the controller, is further configured to:
  • the processor is further configured to stop performing protection processing on the traffic flowing to the destination IP address according to the protection cancellation indication message received by the northbound interface unit.
  • the DDoS protection policy includes the following A response strategy: a black hole routing response policy, a current limiting response policy, a rate limiting response policy, a drop response policy, a local cleaning response policy, and a dynamic drainage cleaning response strategy;
  • the black hole routing response policy is used to instruct the processor to configure a black hole routing pair. And performing packet discarding processing on the traffic that flows to the destination IP address;
  • the processor performs protection processing on the traffic that flows to the destination IP address according to the DDoS protection policy, where the black hole routing response policy is adopted according to the black hole routing response policy received by the northbound interface unit. Packets that are sent to the destination IP address are discarded.
  • the traffic limiting response policy is used to instruct the processor to perform a current limiting process on the traffic that flows to the destination IP address;
  • the processor performs protection processing on the traffic that flows to the destination IP address according to the DDoS protection policy, where the traffic is sent according to the traffic limiting response policy received by the northbound interface unit.
  • the traffic of the destination IP address is subjected to traffic limiting processing;
  • the speed limit response policy is used to instruct the processor to perform rate limiting processing on the traffic that flows to the destination IP address;
  • the discarding response policy is used to instruct the processor to perform packet discarding processing on the traffic that flows to the destination IP address;
  • the processor performs protection processing on the traffic that flows to the destination IP address according to the DDoS protection policy, where the flow is directed to the destination according to the discard response policy received by the northbound interface unit.
  • the traffic of the local IP address is discarded.
  • the local cleaning response policy is used to instruct the processor to locally clean the traffic flowing to the destination IP address
  • the processor performs protection processing on the traffic that flows to the destination IP address according to the DDoS protection policy, where the traffic is locally generated according to the local cleaning response policy received by the northbound interface unit.
  • the traffic of the destination IP address is cleaned;
  • the dynamic drain cleaning response policy is used to instruct the processor to send the flow of the flow to the destination IP address to a cleaning device for cleaning processing
  • the processor performs protection processing on the traffic that flows to the destination IP address according to the DDoS protection policy, specifically: indicating, according to the dynamic drainage cleaning response policy received by the northbound interface unit, the northbound interface The unit sends the flow to the destination IP address Cleaning treatment is performed on the cleaning device.
  • the statistics data further includes: a load value of the first packet forwarding device
  • the dynamic drainage cleaning response policy includes first drainage path indication information, where the first drainage path indication information is used to indicate that the traffic that flows to the destination IP address is sent to the cleaning through the first drainage path.
  • the first drainage path is a path with a minimum load between the packet forwarding device and the cleaning device; the first drainage path includes the second packet forwarding device and the cleaning device;
  • the processor instructing the northbound interface unit to send the traffic that flows to the destination IP address to the cleaning device for cleaning, specifically for:
  • the dynamic drainage cleaning response policy includes a second drainage path indication information, and the second drainage path The indication information is used to indicate that the traffic that flows to the destination IP address is sent to the cleaning device through the second drainage path for cleaning processing; the second drainage path is the packet forwarding device to the The path closest to the cleaning device;
  • the processor instructing the northbound interface unit to send the traffic that flows to the destination IP address to the cleaning device for cleaning, specifically for:
  • the controller sends a traffic statistics command to the first packet forwarding device, where the traffic statistics command is used to indicate the first packet.
  • the forwarding device performs traffic statistics.
  • the traffic statistics command carries a destination IP address.
  • the controller collects statistics reported by the first packet forwarding device according to the traffic statistics instruction, where the statistics include flow to the destination IP address.
  • the second packet forwarding device delivers the DDoS protection policy; correspondingly, the first packet forwarding device receives the traffic statistics command sent by the controller; and collects the flow to the destination according to the traffic statistics instruction.
  • the traffic statistics of the IP address is finally reported to the controller; correspondingly, the second packet forwarding device receives the DDoS protection policy sent by the controller; according to the DDoS protection
  • the policy performs protection processing on the traffic flowing to the destination IP address. It reduces the impact of DDoS attacks on the network and improves network security.
  • Figure 1 is a schematic diagram of a DDoS attack
  • FIG. 2 is a schematic diagram of deployment of a DDoS attack protection system based on an SDN network according to an embodiment of the present invention
  • FIG. 3 is a schematic diagram of deployment of an SDN system according to an embodiment of the present invention.
  • FIG. 4 is a schematic structural diagram of a controller according to an embodiment of the present invention.
  • FIG. 5 is a schematic structural diagram of a packet forwarding device according to an embodiment of the present disclosure.
  • FIG. 6 is a schematic structural diagram of an independent scheduling device according to an embodiment of the present disclosure.
  • FIG. 7 is a schematic structural diagram of a controller according to an embodiment of the present disclosure.
  • FIG. 8 is a schematic structural diagram of another packet forwarding device according to an embodiment of the present disclosure.
  • FIG. 9 is a schematic flowchart of a method for protecting a DDOS attack based on an SDN according to an embodiment of the present invention.
  • FIG. 10 is a schematic flowchart diagram of another SDN-based DDoS attack protection method according to an embodiment of the present disclosure.
  • FIG. 11 is another SDN-based DDoS attack protection method according to an embodiment of the present invention. Schematic diagram of the process
  • FIG. 12 is a schematic flowchart diagram of another SDN-based DDoS attack protection method according to an embodiment of the present disclosure.
  • FIG. 13 is a schematic diagram of an attack path and a recent attack source determination
  • FIG. 14 is a schematic flowchart diagram of another SDN-based DDoS attack protection method according to an embodiment of the present invention.
  • FIG. 15 is a schematic flowchart of another SDN-based DDoS attack protection method according to an embodiment of the present disclosure.
  • FIG. 16 is a schematic flowchart diagram of another SDN-based DDoS attack protection method according to an embodiment of the present disclosure.
  • FIG. 17 is a schematic flowchart of another SDN-based DDoS attack protection method according to an embodiment of the present disclosure.
  • FIG. 18 is a schematic flowchart of another SDN-based DDoS attack protection method according to an embodiment of the present disclosure.
  • 19 is a schematic diagram of a local cleaning process
  • FIG. 20 is a schematic diagram of an interaction process of an SDN-based DDoS attack protection method according to an embodiment of the present invention.
  • FIG. 21 is a schematic diagram of interaction of another DDoS attack protection method based on an SDN network according to an embodiment of the present invention.
  • the invention provides a technical solution for DDoS attack protection based on SDN.
  • the controller in the SDN indicates that the packet forwarding device performs traffic statistics based on the destination IP address.
  • the controller collects statistics of the packet forwarding device and determines whether a network attack occurs. If the attack is determined, the solution provides multiple possible DDoS. Protection method. For example, because SDN supports network topology and state concentration Management, the controller has the ability to perceive the global topology, so the controller can know which packet forwarding devices are used to connect with other networks, that is, which packet forwarding devices are located at the boundary of the SDN; thereby indicating that the SDN border is close to the attack source. The forwarding device limits the traffic of the attack traffic to be discarded or blocked. The controller then directs the suspected attack traffic to the professional cleaning device to clean the suspected attack traffic, thus reducing the impact of the attack traffic on the network.
  • FIG. 2 is a schematic diagram of deployment of a DDoS attack defense system based on an SDN network according to an embodiment of the present invention.
  • the system includes: a message forwarding device, a controller, and a cleaning device.
  • the controller communicates with the packet forwarding device and the cleaning device through the southbound interface.
  • the southbound interface can be the OpenFlow protocol, the Forwarding and Control Element Separation (ForCES) protocol, and the path calculation. Path Computation Element-Communication Protocol (PCE-P) protocol.
  • the controller may have a controller scheduling function, and the controller scheduling function is used to control and schedule the packet forwarding device in the entire SDN, including link discovery and topology management. , strategy formulation, table delivery and other functions.
  • the controller scheduling function may be separately set on a separate scheduling device, for example, one controller is elected as a primary controller among multiple controllers, and the primary controller is It can be used as the independent scheduling device, and the main controller communicates with each controller through the east-west interface.
  • the main controller is responsible for generating and maintaining status information of the sub-controller, the packet forwarding device, and the cleaning device in the entire network. In case of failure, one of the other sub-controllers of the cluster is elected as the new primary controller.
  • the cluster of the controller is transparent to the packet forwarding device and the cleaning device.
  • the packet forwarding device and the cleaning device do not need to care which command is sent by the controller, and When it sends a packet to the controller, it can maintain the operation mode of the previous single controller, thus ensuring the logical concentration of the controller.
  • the east-west interface for communication and contact between multiple controllers and scheduling devices does not have a clear definition standard.
  • existing mature cluster technologies such as server cluster technology, can be used to implement communication between east-west interfaces. .
  • the controller may load the DDoS control program, and the controller executes the DDoS control program to implement the related configuration of the DDoS protection solution.
  • the DDoS control program may also be loaded on other user devices, and the user passes the application of the user device. Calling the DDoS control program, the user device executes the DDoS control program and interacts with the controller to implement the above DDOS control.
  • the controller communicates with the user equipment through the northbound interface of the controller.
  • the protocol formulation of the northbound interface can have multiple solutions based on different requirements.
  • the REST Application Programming Interface is a commonly used form of northbound interface.
  • the packet forwarding device can be a repeater or a device such as a switch, a router, or a firewall in a traditional network.
  • the packet forwarding device has a traffic monitoring function and a cleaning function.
  • the traffic monitoring function of the packet forwarding device is configured to monitor, according to the traffic statistics command sent by the controller, the traffic flowing through the packet forwarding device, where the traffic statistics command carries the destination IP address, where the destination IP address can be An IP address or a segment of an IP address of a server to be protected; and the traffic monitoring function of the packet forwarding device detects the traffic statistics flowing to the destination IP address and reports the statistics to the controller.
  • the cleaning function of the packet forwarding device is used to clean the suspected attack traffic based on the attack protection policy when the attack defense policy is sent by the controller, for example, the DDoS protection policy, and the suspected attack traffic is removed.
  • the packet forwarding device can limit traffic or discard or block traffic; or direct the suspected attack traffic to the cleaning device.
  • the packet forwarding device in the solution provided by the embodiment of the present invention, may be divided into two types according to different functions of different links: the first packet forwarding device and the second packet. Forward the device.
  • the first packet forwarding device has a traffic monitoring function, and all the packet forwarding devices of the SDN system can be used as the first packet forwarding device; the second packet forwarding device has a cleaning function.
  • the controller will instruct the packet forwarding device located on the SDN border close to the attack source to defend the attack traffic.
  • the packet is located near the attack source on the SDN boundary.
  • the device is the second packet forwarding device.
  • the second packet forwarding device also has the traffic monitoring function.
  • the first packet forwarding device and the second packet forwarding device can be the same physical device. Can be different physical devices.
  • the cleaning device is configured to receive the suspected attack traffic diverted by the packet forwarding device, clean the suspected attack traffic, and return the cleaned traffic to the SDN.
  • the advantage of the traffic diversion scheme provided by the embodiment of the present invention is that the controller in the SDN has the functions of link discovery and topology management. Therefore, when the traffic diversion scheme is adopted, the controller is used.
  • the second packet forwarding device can be configured to use the path that has the least impact on the SDN network according to the SDN topology relationship or the statistics, and the suspected attack traffic is drained to the cleaning device. For example, the path closest to the cleaning device is selected for drainage; or the path with smaller load is selected for drainage; thereby reducing the impact of attacks in the prior art due to drainage. That is, the traffic diversion scheme provided by the present invention can be dynamically adjusted at any time based on the link status of the SDN. Therefore, the policy corresponding to the scheme is named as the dynamic drain cleaning response strategy.
  • FIG. 3 is a schematic diagram of deployment of an SDN system according to an embodiment of the present invention.
  • the SDN system includes: a controller, a first packet forwarding device, and a second packet forwarding device;
  • controller is configured to:
  • the first packet forwarding device And sending, by the first packet forwarding device, a traffic statistics command, where the traffic statistics command is used to indicate that the first packet forwarding device performs traffic statistics; and the traffic statistics command carries a destination IP address;
  • the global traffic statistics value is used by the controller to collect the statistics reported by the at least two packet forwarding devices, including the first packet forwarding device, to obtain the SDN range. a statistical value of the flow of the internal flow to the destination IP address;
  • the first packet forwarding device is configured to:
  • the second packet forwarding device is configured to:
  • the SDN system sends a traffic statistics command to the first packet forwarding device by using the controller, where the traffic statistics command is used to instruct the first packet forwarding device to perform traffic statistics;
  • the statistic command carries the destination IP address;
  • the controller collects the statistics reported by the first packet forwarding device according to the traffic statistics instruction, and the statistic data includes traffic statistics information flowing to the destination IP address; Determining, by the statistical data, a global traffic statistics value that is sent to the destination IP address, and determining whether the global traffic statistics value exceeds a predetermined threshold, and based on the determination result that the global traffic statistics value exceeds a predetermined threshold, to the
  • the second packet forwarding device delivers the DDoS protection policy; correspondingly, the first packet forwarding device receives the traffic statistics command sent by the controller; and collects the flow to the destination according to the traffic statistics instruction.
  • the apparatus DDoS protection policy sent by the controller receives; protective treatment of the traffic flowing to the destination IP address according to the DDoS protection policy. It reduces the impact of DDoS attacks on the network and improves network security.
  • the traffic statistics command further carries: detecting a start time
  • the detection start time is used to notify the first packet forwarding device to perform the start time of the traffic statistics, and the traffic statistics are continuously executed by the first packet forwarding device in a detection period.
  • the statistics are reported by the first packet forwarding device to the controller in the detection period.
  • controller needs a mechanism for determining whether the network attack is stopped.
  • One possible implementation manner is:
  • the protection elimination indication message is used to indicate that the second packet forwarding device ends execution of the DDoS protection policy
  • the second packet forwarding device is further configured to:
  • the controller may also send a DDoS protection policy to the packet forwarding device located on the SDN border close to the attack source.
  • a DDoS protection policy is as follows:
  • the controller is further configured to: before the sending the DDoS protection policy to the second packet forwarding device:
  • the traffic statistics information that is sent to the destination IP address includes: a traffic value that flows to the destination IP address on the first packet forwarding device; and the controller determines, according to the statistics,
  • the packet forwarding device closest to the attack source on the attack path is specifically:
  • the first attack path is an attack path with the largest flow value in at least one attack path flowing to the destination IP address;
  • the packet forwarding device closest to the attack source is located at the SDN boundary of the source address side of the traffic flowing to the destination IP address on the first attack path.
  • the DDoS protection policy includes any one of the following response policies: a black hole route response policy, a current limit response policy, a rate limit response policy, a drop response policy, a local cleaning response policy, and a dynamic drain cleaning response policy;
  • a black hole route refers to a routing entry in the Access Control List (ACL) of the packet forwarding device that does not point to any next hop. Similar to normal routing entries, black hole routing also includes matches and actions. A packet matching the match of the blackhole route will be discarded by the packet forwarding device and will not be forwarded to the next hop.
  • the action in the blackhole route can be implemented in multiple ways. For example, the routing device forwards the packet to an illegal IP address or a loopback address with 0.0.0.0 as an example. It can also be implemented through the null0 interface.
  • the null0 is a logical interface on the routing device. The null0 interface is always in the Up state but does not forward any packets.
  • the packet forwarding device forwards the packet to the null0 interface of the packet forwarding device. After receiving the packet, the null0 interface discards the packet. Based on the foregoing features of the black hole route, the controller may configure a corresponding black hole route response policy and send the black hole route response policy to the packet forwarding device, where the black hole route response policy is used to indicate the Second report.
  • the packet forwarding device performs the DDoS attack protection by configuring the black hole route to discard the traffic destined for the destination IP address.
  • the black hole routing response policy may include: a destination IP address, a protocol type supported by the packet, and the like.
  • the second packet forwarding device performs protection processing on the traffic that flows to the destination IP address according to the DDoS protection policy, where the black hole routing response policy is used to perform the traffic flow according to the black hole routing response policy.
  • the traffic of the destination IP address is discarded.
  • the black hole route is configured on the second packet forwarding device to discard the packet, and the complexity of processing the attack traffic can be reduced and the processing efficiency can be improved.
  • the traffic limiting response policy is used to instruct the second packet forwarding device to perform traffic limiting processing on the traffic that flows to the destination IP address.
  • the second packet forwarding device is based on the traffic limiting response policy.
  • the bandwidth for sending and receiving packets is limited, such as the maximum number of bytes sent per second.
  • the traffic limiting response policy may include: a destination IP address, a protocol type supported by the packet, a quintuple information of the packet, and the like; the packet forwarding device may perform the foregoing limitation based on the quintuple information of the packet, for example, for the transmission.
  • TCP Control Protocol
  • UDP User Datagram Protocol
  • the second packet forwarding device performs protection processing on the traffic that flows to the destination IP address according to the DDoS protection policy, where the traffic is sent to the destination IP according to the traffic limiting response policy.
  • the traffic of the address is subjected to current limiting processing;
  • the speed limit response policy is used to indicate that the second packet forwarding device performs rate limiting processing on the traffic that flows to the destination IP address; for example, the second packet forwarding device sets the transceiver bandwidth based on the rate limiting response policy. the size of.
  • the second packet forwarding device performs protection processing on the traffic that flows to the destination IP address according to the DDoS protection policy, where the traffic is sent to the destination IP according to the rate limiting response policy.
  • the rate of the address is processed at a rate limit;
  • the discarding response policy is used to instruct the second packet forwarding device to perform packet discarding processing on the traffic that flows to the destination IP address. Specifically, the second packet forwarding device receives the packet based on the discard response policy. Packets that are suspected of network attack traffic or packets that are suspected of being sent by the network are discarded.
  • the discard response policy may include: a destination IP address, and a packet support association.
  • the quintuple information of the packet type, the packet, and the quintuple information of the packet may include: the TCP information of the packet or the UDP information of the packet, the source port information of the packet, and the destination port information of the packet. Drop packet information, etc.
  • the second packet forwarding device performs protection processing on the traffic that flows to the destination IP address according to the DDoS protection policy, where the traffic is sent to the destination IP address according to the discard response policy. Traffic is discarded for packet processing;
  • the local cleaning response policy is used to indicate that the second packet forwarding device locally performs the cleaning process on the traffic that flows to the destination IP address.
  • the local cleaning response policy is used to indicate the first
  • the second packet forwarding device performs local cleaning on the traffic destined for the destination IP address; the second packet forwarding device locally locates the received packet suspected network attack traffic based on the local cleaning response policy or is suspected of being sent.
  • the packet of the network attack traffic is cleaned.
  • the local cleaning response policy may include: a destination IP address, a protocol type supported by the packet, and a quintuple information of the packet.
  • the second packet forwarding device performs protection processing on the traffic that flows to the destination IP address according to the DDoS protection policy, specifically: locally performing the flow to the destination according to the local cleaning response policy.
  • the traffic of the IP address of the ground is cleaned;
  • the dynamic draining cleaning response policy is used to instruct the second packet forwarding device to send the traffic to the destination IP address to the cleaning device for cleaning processing.
  • the dynamic drainage cleaning response policy may include Destination IP address and drainage path indication information;
  • the second packet forwarding device performs protection processing on the traffic that flows to the destination IP address according to the DDoS protection policy, where the traffic is sent to the destination according to the dynamic drainage cleaning response policy.
  • the traffic of the IP address is sent to the cleaning device for cleaning.
  • the controller needs to determine a path with the least impact on the network to perform traffic drainage.
  • the statistics further include: a load value of the first packet forwarding device
  • the controller is further configured to: before the sending the DDoS protection policy to the second packet forwarding device:
  • a first drainage path Determining, according to the load value of the first packet forwarding device, a first drainage path, where the first drainage path is a path with a minimum load between the second packet forwarding device and the cleaning device; a drainage path includes the second packet forwarding device and the cleaning device;
  • the DDoS protection policy delivered to the second packet forwarding device is the dynamic drainage cleaning response policy, where the dynamic drainage cleaning response policy includes first drainage path indication information, and the first drainage path indication information is used to indicate The second packet forwarding device sends the traffic that flows to the destination IP address to the cleaning device through the first drainage path for cleaning processing;
  • the second packet forwarding device performs protection processing on the traffic that flows to the destination IP address according to the DDoS protection policy, specifically:
  • the controller is further configured to: before the sending the DDoS protection policy to the second packet forwarding device:
  • the second packet forwarding device sends the traffic that flows to the destination IP address to the cleaning device through the second drainage path for cleaning processing;
  • the second packet forwarding device performs protection processing on the traffic that flows to the destination IP address according to the DDoS protection policy, specifically:
  • each node in the DDOS attack protection system based on the SDN network.
  • the controller includes: a processor 10, a memory 11, a transceiver 12, and a bus 13;
  • the transceiver 12 includes: a northbound interface unit 12a, a southbound interface unit 12b, and an east-west interface unit 12c;
  • the processor 10 is configured to execute a DDoS control program to obtain a DDoS protection configuration parameter, and instruct the southbound interface unit 12b to communicate with the packet forwarding device and the cleaning device based on the DDoS protection configuration parameter.
  • the DDoS protection configuration parameter is a destination IP address
  • the processor 10 instructs the southbound interface unit 12b to send a traffic statistics command to the first packet forwarding device, where the traffic statistics are collected.
  • the command carries the destination IP address; the southbound interface unit 12b receives the statistical data sent by the first packet forwarding device, and the statistical data includes traffic statistics information flowing to the destination IP address;
  • DDoS protection configuration parameter can be obtained from the user equipment through the northbound interface unit 12a.
  • the processor 10 obtains the global traffic statistics value that is sent to the destination IP address according to the statistics received by the southbound interface unit 12b; and determines whether the global traffic statistics value exceeds a predetermined threshold;
  • the global traffic statistics value is used by the controller to collect the statistics reported by the at least two packet forwarding devices, including the first packet forwarding device, to obtain the SDN range. a statistical value of the flow of the internal flow to the destination IP address;
  • the processor 10 instructs the southbound interface unit 12b to send a DDoS protection policy to the second packet forwarding device, based on the determination result that the global traffic statistics exceeds a predetermined threshold.
  • the processor 10 directly instructs the southbound interface unit 12b to interact with the packet forwarding device and the cleaning device to implement the related configuration of the DDoS protection solution.
  • the system also includes the independent scheduling device described above, and the processor 10 instructs the east-west interface unit 12c to interact with the independent scheduling device to implement the relevant configuration of the controller scheduling function described above.
  • the northbound interface unit 12a and the east-west interface unit 12c are optional units: for the controller capable of executing the DDoS control program by itself, the northbound interface unit 12a may not be set; for the controller scheduling described above For the function controller, the east-west interface unit 12c may not be provided.
  • the memory 11 is configured to store the DDoS protection configuration parameter, the DDoS control program, the statistics reported by the first packet forwarding device, the DDoS protection policy, and the like, so that the processor 10 makes a call when performing the corresponding operation.
  • the processor is configured to instruct the southbound interface unit to send a traffic statistics command to the first packet forwarding device, where the traffic statistics command is used to instruct the first packet forwarding device to perform traffic statistics.
  • the traffic statistics command carries a destination IP address; the southbound interface The unit receives the statistical data reported by the first packet forwarding device according to the traffic statistics instruction, where the statistical data includes traffic statistics information flowing to the destination IP address, and the processor receives the location according to the southbound interface unit.
  • the processor Determining, by the statistic data, a global traffic statistics value that is sent to the destination IP address, where the global traffic statistics value indicates that the controller forwards at least two packets including the first packet forwarding device After the statistics reported by the device are summarized, the obtained statistics for reflecting the traffic flowing to the destination IP address in the SDN range; the processor determining whether the global traffic statistics exceeds a predetermined threshold, based on the global And the processor indicates that the southbound interface unit sends a DDoS protection policy to the second packet forwarding device. It reduces the impact of DDoS attacks on the network and improves network security.
  • the traffic statistics command further carries: detecting a start time
  • the detection start time is used to notify the first packet forwarding device to perform the start time of the traffic statistics, and the traffic statistics are continuously executed by the first packet forwarding device in a detection period.
  • the statistics are reported by the first packet forwarding device to the controller in the detection period.
  • controller needs a mechanism for determining whether the network attack is stopped.
  • One possible implementation manner is:
  • the processor 10 is further configured to determine that the global traffic statistics value does not exceed the predetermined threshold in at least two detection periods;
  • the southbound interface unit 12b is further configured to forward to the second packet based on a result that the global traffic statistics value does not exceed the predetermined threshold in at least two consecutive detection periods determined by the processor 10.
  • the device sends a protection elimination indication message.
  • the protection elimination indication message is used to instruct the second packet forwarding device to end execution of the DDoS protection policy.
  • the controller may also send a DDoS protection policy to the packet forwarding device located on the SDN border close to the attack source.
  • a DDoS protection policy is as follows:
  • the processor 10 is further configured to determine an attack according to the statistical data received by the southbound interface unit 12b, before the southbound interface unit 12b sends a DDoS protection policy to the second packet forwarding device.
  • a packet forwarding device that is closest to the attack source on the path, and the packet forwarding device that is closest to the attack source is used as the second packet forwarding device.
  • the southbound interface unit 12b is further configured to send DDoS protection to the second packet forwarding device. Strategy.
  • the traffic statistics information of the destination IP address includes: a traffic value that flows to the destination IP address on the first packet forwarding device; and the processor 10 is configured according to the southbound interface.
  • the traffic value of the first packet forwarding device that is received by the unit 12b to the destination IP address determines a first attack path; the first attack path is at least one attack path that flows to the destination IP address.
  • the attack path with the largest flow rate value; the processor 10 determines, according to the first attack path, the packet forwarding device that is closest to the attack source;
  • the packet forwarding device closest to the attack source is located at the SDN boundary of the source address side of the traffic flowing to the destination IP address on the first attack path.
  • the DDoS protection policy includes any one of the following response policies: a black hole route response policy, a current limit response policy, a rate limit response policy, a drop response policy, a local cleaning response policy, and a dynamic drainage cleaning response policy;
  • the next response command is shown as flow direction 3.
  • the controller needs to determine a path with the least impact on the network to perform traffic drainage.
  • the statistics further include: a load value of the first packet forwarding device
  • the processor 10 is configured to determine, according to a load value of the first packet forwarding device, a first drainage path
  • the first drainage path is a path with a minimum load between the second packet forwarding device and the cleaning device; the first drainage path includes the second packet forwarding device and the cleaning device;
  • the southbound interface unit 12b sends a dynamic drainage cleaning response policy to the second packet forwarding device according to the first drainage path determined by the processor 10, where the dynamic drainage cleaning response policy includes the first And the first routing path indication information is sent to the cleaning device by using the first drainage path to instruct the second packet forwarding device to send the traffic to the destination IP address to the cleaning device. Cleaning treatment.
  • the processor 10 is configured to determine a second drainage path according to an SDN topology relationship, where the second drainage path is a path that is closest to the cleaning device between the second packet forwarding device,
  • the SDN topology relationship includes the connection relationship between each packet forwarding device and the cleaning device in the SDN;
  • the southbound interface unit 12b sends a dynamic drainage cleaning response policy to the packet forwarding device according to the second drainage path determined by the processor 10, where the dynamic drainage cleaning response policy includes a second drainage path indication. And the second routing path indication information is sent to the cleaning device by the second packet forwarding device to send the traffic to the destination IP address to the cleaning device for cleaning processing.
  • the secondary controller and the primary controller as an example, wherein the primary controller and the secondary controller cooperate to implement the attack protection scheme, and there are two possible implementations. the way.
  • Manner 1 The master controller obtains the working status of all the sub-controllers, packet forwarding devices, and cleaning devices in the SDN.
  • Each of the secondary controllers periodically interacts with the first packet forwarding device through the southbound interface unit to obtain statistical data, and each secondary controller sends the collected statistical data to the primary controller through the east-west interface unit, and then After the master controller aggregates the statistics, the global traffic statistics are obtained, and the network traffic attack is determined based on the global traffic statistics.
  • the primary controller and the secondary controller negotiate to develop a consistent network attack protection policy, such as a DDoS protection policy, and the secondary controller sends the network attack protection policy to the second packet forwarding device through the southbound interface unit.
  • a consistent network attack protection policy such as a DDoS protection policy
  • the primary controller selects the idle secondary controller to complete the attack protection solution. For example, the primary controller interacts with a secondary controller through the east-west interface unit, and the primary controller instructs the secondary controller to complete the attack protection solution. .
  • the secondary controller periodically obtains statistical data by interacting with the first packet forwarding device through the southbound interface unit, and the secondary controller aggregates the collected statistical data to obtain a global traffic statistics value, and according to the The global traffic statistics are used to determine whether a network attack occurs.
  • the secondary controller sends the network attack defense policy to the second packet forwarding device through the southbound interface unit.
  • FIG. 5 is a schematic structural diagram of a packet forwarding device according to an embodiment of the present invention.
  • the packet forwarding device is the first packet forwarding device in the process of performing traffic statistics, and is in the process of performing a DDoS protection policy.
  • a packet forwarding device referring to FIG. 5, the packet forwarding device includes: a processor 20, a memory 21, a transceiver 22, and a bus 23;
  • the transceiver 22 includes: a northbound interface unit 22a;
  • the packet forwarding device when used as the first packet forwarding device, it has the following functions:
  • the northbound interface unit 22a is connected to the southbound interface unit 12b of the controller for receiving control
  • the traffic statistics command carries the destination IP address, which is used to instruct the processor 20 to perform traffic statistics, and reports related data for the DDoS attack detection, such as statistics, to the controller.
  • the statistics include traffic statistics flowing to the destination IP address;
  • the processor 20 is configured to perform statistics on traffic flowing to the destination IP address according to the traffic statistics command received by the northbound interface unit 22a, and obtain traffic statistics information flowing to the destination IP address.
  • the memory 21 is configured to store related parameters, statistics, and the like of the controller for DDoS attack configuration.
  • the first packet forwarding device receives, by the northbound interface unit, related parameters configured by the controller for the DDoS attack, such as a traffic statistics command, where the traffic statistics command carries a destination IP address, and is used to instruct the processor to perform Traffic statistics; further, the processor collects statistics on traffic flowing to the destination IP address according to the traffic statistics command received by the northbound interface unit, and obtains traffic statistics information that flows to the destination IP address.
  • the northbound interface unit reports relevant data for DDoS attack detection to the controller, such as statistics, where the statistics include traffic statistics flowing to the destination IP address; since the first packet forwarding device is directed to the destination IP address
  • the traffic is sent to the controller, and the statistics are reported to the controller.
  • the controller can determine whether a DDoS attack occurs based on the statistics, and trigger the corresponding DDoS protection policy. This reduces the impact of the DDoS attack on the network and improves the network. safety.
  • the traffic statistics command further carries: detecting a start time
  • the detection start time is used to notify the processor 20 to start the flow statistics, and the flow statistics are continuously performed in a manner of detecting a period, and the statistical data is reported to the detection period. Controller.
  • the packet forwarding device functions as the second packet forwarding device, it has the following functions:
  • the northbound interface unit 22a is further configured to: after reporting statistics to the controller:
  • the processor 20 is further configured to perform protection processing on the traffic flowing to the destination IP address according to the DDoS protection policy received by the northbound interface unit 22a.
  • the second packet forwarding device provided in this embodiment reports to the controller in the northbound interface unit.
  • the DDoS protection policy sent by the controller is received by the northbound interface unit, and the traffic that is sent to the destination IP address is performed by the processor according to the DDoS protection policy received by the northbound interface unit.
  • the protection process implements DDoS protection for traffic to the destination IP address, thereby reducing the impact of DDoS attacks on the network and improving network security.
  • some packet forwarding devices have the functions of the first packet forwarding device and the second packet forwarding device, and the packet forwarding devices are often capable of performing DDoS protection.
  • a packet forwarding device with a maximum protection effect of the policy for example, a packet forwarding device located at an SDN border close to the attack source; and other packet forwarding devices having only the function of the first packet forwarding device, for example, not located at the SDN boundary
  • the packet forwarding device can configure the packet forwarding device in the SDN to have the first packet forwarding device and/or the second packet forwarding according to the specific deployment of the SDN and the specific situation of the network attack.
  • the function of the device is not limited in the embodiment of the present invention.
  • the corresponding function of the second packet forwarding device side is as follows:
  • the northbound interface unit 22a after receiving the DDoS protection policy sent by the controller, is further configured to:
  • the processor 20 is further configured to stop performing protection processing on the traffic flowing to the destination IP address according to the protection cancellation indication message received by the northbound interface unit 22a.
  • the DDoS protection policy includes any one of the following response policies: a black hole route response policy, a current limit response policy, a rate limit response policy, a drop response policy, a local cleaning response policy, and a dynamic drain cleaning response policy;
  • the black hole route response policy is used to instruct the processor 20 to perform packet discarding processing on the traffic that flows to the destination IP address by configuring a black hole route.
  • the processor 20 performs protection processing on the traffic that flows to the destination IP address according to the DDoS protection policy, specifically: adopting a black hole routing pair according to the black hole routing response policy received by the northbound interface unit 22a. And performing packet discarding processing on the traffic that flows to the destination IP address;
  • the traffic limiting response policy is used to instruct the processor 20 to perform a current limiting process on the traffic that flows to the destination IP address;
  • the processor 20 performs protection processing on the traffic that flows to the destination IP address according to the DDoS protection policy, specifically: the flow direction according to the traffic limiting response policy received by the northbound interface unit 22a.
  • the traffic of the destination IP address is subjected to a current limiting process;
  • the speed limit response policy is used to instruct the processor 20 to perform rate limiting processing on the traffic flowing to the destination IP address;
  • the processor 20 performs protection processing on the traffic that flows to the destination IP address according to the DDoS protection policy, specifically: the flow direction according to the speed limit response policy received by the northbound interface unit 22a.
  • the traffic of the destination IP address is subjected to rate limiting processing;
  • the discarding response policy is used to instruct the processor 20 to perform packet discarding processing on the traffic that flows to the destination IP address;
  • the processor 20 performs protection processing on the traffic that flows to the destination IP address according to the DDoS protection policy, specifically: according to the discard response policy received by the northbound interface unit 22a, the flow direction The traffic of the destination IP address is discarded.
  • the local cleaning response policy is used to instruct the processor 20 to locally perform the cleaning process on the traffic flowing to the destination IP address;
  • the processor 20 performs a protection process on the traffic that flows to the destination IP address according to the DDoS protection policy, specifically: the local cleaning response policy according to the local cleaning response policy received by the northbound interface unit 22a. Performing a cleaning process on the traffic flowing to the destination IP address;
  • the dynamic drain cleaning response policy is used to instruct the processor 20 to send the traffic flowing to the destination IP address to the cleaning device for cleaning processing;
  • the processor 20 performs protection processing on the traffic that flows to the destination IP address according to the DDoS protection policy, specifically: indicating, according to the dynamic drainage cleaning response policy received by the northbound interface unit 22a.
  • the northbound interface unit 22a transmits the flow rate to the destination IP address to the cleaning device for cleaning processing.
  • the controller Before the dynamic drainage cleaning response policy is sent by the controller, the controller needs to determine a path with the least impact on the network to perform traffic drainage, and the second packet forwarding device has corresponding functions. as follows:
  • the statistical data further includes: a load value of the first packet forwarding device
  • the dynamic drainage cleaning response policy includes first drainage path indication information, where the first drainage path indication information is used to indicate that the traffic that flows to the destination IP address is sent to the cleaning through the first drainage path.
  • the first drainage path is a path with a minimum load between the packet forwarding device and the cleaning device; the first drainage path includes the second packet forwarding device and the cleaning device;
  • the packet forwarding device is a second packet forwarding device.
  • the processor 20 instructs the northbound interface unit 22a to send the traffic flowing to the destination IP address to the cleaning device for cleaning according to the dynamic drainage cleaning response policy received by the northbound interface unit 22a. Processing, specifically:
  • the northbound interface unit 22a is instructed to send the traffic flowing to the destination IP address to the cleaning device by using the first drainage path. Perform cleaning treatment.
  • the dynamic drainage cleaning response policy includes second drainage path indication information, where the second drainage path indication information is used to indicate that the traffic that flows to the destination IP address is sent to the cleaning through the second drainage path.
  • the second drainage path is a path closest to the distance between the packet forwarding device and the cleaning device;
  • the packet forwarding device is a second packet forwarding device.
  • the processor 20 instructs the northbound interface unit 22a to send the traffic flowing to the destination IP address to the cleaning device for cleaning according to the dynamic drainage cleaning response policy received by the northbound interface unit 22a. Processing, specifically:
  • the northbound interface unit 22a is instructed to send the traffic flowing to the destination IP address to the cleaning device by using the second drainage path. Perform cleaning treatment.
  • FIG. 6 is a schematic structural diagram of an independent scheduling device according to an embodiment of the present invention.
  • the independent scheduling device includes: a processor 30, a memory 31, a transceiver 32, and a bus 33.
  • the transceiver 32 includes: an east-west interface unit 32a;
  • the independent scheduling device may have two possible implementation manners. The following two methods are respectively described.
  • the east-west interface unit 32a of the independent dispatching device is connected to the east-west interface unit 12c of the controller;
  • the processor 30 is configured to send the east-west interface unit 32a to send a traffic statistics command to the controller, so that the controller sends the traffic statistics command to the first packet forwarding device.
  • the controller may send the traffic statistics command to the first packet forwarding device by itself, and does not need to send the traffic statistics command to the controller to the interface unit 32a.
  • the east-west interface unit 32a is further configured to receive statistical data sent by the controller
  • the controller collects the statistics reported by the first packet forwarding device according to the traffic statistics instruction, and sends the statistics to the east-west interface unit 32a of the independent scheduling device.
  • the processor 30 is configured to obtain, according to the statistics received by the east-west interface unit 32a, a global traffic statistics value that is sent to the destination IP address, and determine, according to the global traffic statistics, whether a network attack occurs.
  • the global traffic statistics value is used by the controller to collect the statistics reported by the at least two packet forwarding devices, including the first packet forwarding device, to obtain the SDN range. a statistical value of the flow of the internal flow to the destination IP address;
  • the processor 30 determines the DDoS protection policy by negotiating with the controller through the east-west interface unit 32a, and instructs the controller to send the determined DDoS protection policy to the second packet forwarding device.
  • the east-west interface unit 32a of the independent dispatching device is connected to the east-west interface unit 12c of the controller;
  • the east-west interface unit 32a receives the DDoS protection request message sent by the controller
  • the processor 30 determines a controller for performing the DDoS protection function according to the DDoS protection request message and the controller status information.
  • an independent scheduling device is set to facilitate management of multiple controllers. Therefore, the processor 30 needs to select a controller that satisfies the DDoS protection function based on the controller status information; the controller status information may include information about the processing capability of each controller in the cluster, load status, idle status, etc., and determines that the DDoS is satisfied. Protection function After the controller, the independent scheduling device sends a DDoS protection response message to the controller; the DDoS protection response message includes a DDoS protection execution indication; the controller performs the DDoS protection function according to the DDoS protection execution indication, and the specific function refers to Figure 4 corresponds to the solution of the embodiment.
  • the specific negotiation mechanism of the independent scheduling device and the controller may be different.
  • the traffic statistics information of the flow to the destination IP address includes: the flow direction of the first packet forwarding device.
  • the traffic value of the destination IP address; the independent scheduling device determines the first attack path according to the traffic value flowing to the destination IP address on the first packet forwarding device;
  • the first attack path is a flow direction
  • the attack path with the largest traffic value in the at least one attack path of the destination IP address is determined; and the packet forwarding device closest to the attack source is determined according to the first attack path.
  • the packet forwarding device closest to the attack source is located at the SDN boundary of the source address side of the traffic flowing to the destination IP address on the first attack path.
  • the independent scheduling device instructs the controller to use the packet forwarding device closest to the attack source as the second packet forwarding device, and delivers the DDoS protection policy to the second packet forwarding device; for example, the independent scheduling device is Determining, by using the dynamic drainage cleaning response policy, the first drainage path according to the load value of the first packet forwarding device, where the first drainage path is the second packet forwarding device to the cleaning device The path with the smallest load; the independent scheduling device sends the dynamic drainage cleaning response policy to the controller, where the policy includes first drainage path indication information, and the first drainage path indication information is used to indicate the second
  • the packet forwarding device sends the traffic destined to the destination IP address to the cleaning device through the first drainage path for cleaning processing; for example, after the independent scheduling device determines to use the dynamic drainage cleaning response policy Determining, according to the SDN topology relationship, a second drainage path, where the second drainage path is the second packet forwarding device to the cleaning device The most recent path, the SDN topology relationship includes the connection relationship between each packet forwarding device and the cleaning device
  • FIG. 7 is a schematic structural diagram of a controller according to an embodiment of the present invention.
  • the controller includes: sending Module 40, processing module 41, receiving module 42;
  • the sending module 40 is configured to send a traffic statistics command to the first packet forwarding device, where the traffic statistics command is used to instruct the first packet forwarding device to perform traffic statistics, where the traffic statistics command carries a destination IP address. address;
  • the receiving module 42 is configured to collect statistics reported by the first packet forwarding device according to the traffic statistics instruction, where the statistics includes traffic statistics information that flows to the destination IP address.
  • the processing module 41 is configured to:
  • the global traffic statistics value is used by the controller to collect the statistics reported by the at least two packet forwarding devices, including the first packet forwarding device, to obtain the SDN range. a statistical value of the flow of the internal flow to the destination IP address;
  • the sending module 40 is further configured to send a DDoS protection policy to the second packet forwarding device based on the determination result that the global traffic statistics value determined by the processing module 41 exceeds a predetermined threshold.
  • the processing module instructs the sending module to send a traffic statistics command to the first packet forwarding device, where the traffic statistics command is used to instruct the first packet forwarding device to perform traffic statistics.
  • the traffic statistics command carries a destination IP address
  • the receiving module receives the statistics reported by the first packet forwarding device according to the traffic statistics instruction, where the statistics includes traffic statistics information that flows to the destination IP address.
  • the processing module obtains, according to the statistics received by the receiving module, a global traffic statistics value that is sent to the destination IP address, where the global traffic statistics value indicates that the controller pair includes the first packet forwarding device.
  • the processing module After collecting the statistics reported by the at least two packet forwarding devices, the obtained statistics are used to reflect the traffic flowing to the destination IP address in the SDN range; the processing module determines the global traffic statistics. Whether the predetermined value exceeds a predetermined threshold, and the sending module determines that the global traffic statistics value exceeds a predetermined threshold based on the processing module The result of the judgment, forwarding device issued DDoS protection strategies to the second message. It reduces the impact of DDoS attacks on the network and improves network security.
  • the traffic statistics instruction further carries: the detection start time described above;
  • controller needs a mechanism for determining whether the network attack is stopped.
  • One possible implementation manner is:
  • the processing module 41 is further configured to:
  • the sending module 40 is further configured to send, according to the result that the global traffic statistics value does not exceed the predetermined threshold, in the at least two consecutive detection periods determined by the processing module 41, to the second packet forwarding device. Sending the protection elimination indication message described above;
  • the controller may also send a DDoS protection policy to the packet forwarding device located on the SDN border close to the attack source.
  • a DDoS protection policy is as follows:
  • the traffic statistics information that is sent to the destination IP address includes: a traffic value that flows to the destination IP address on the first packet forwarding device;
  • the processing module 41 is further configured to determine, according to the statistics, a packet forwarding device that is closest to the attack source on the attack path, specifically:
  • the first attack path is at least the flow to the destination IP address The attack path with the largest traffic value in an attack path;
  • the packet forwarding device closest to the attack source is located at the SDN boundary of the source address side of the traffic flowing to the destination IP address on the first attack path.
  • the DDoS protection policy includes any one of the following response policies: a black hole route response policy, a current limit response policy, a rate limit response policy, a drop response policy, a local cleaning response policy, and a dynamic drain cleaning response policy;
  • the controller needs to determine a path with the least impact on the network to perform traffic drainage.
  • the statistics further include: a load value of the first packet forwarding device
  • the processing module 41 is further configured to: before the sending module 40 sends a DDoS protection policy to the second packet forwarding device:
  • the first drainage path is a path with a minimum load between the second packet forwarding device and the cleaning device; the first drainage path includes the second packet forwarding device and the cleaning device;
  • the DDoS protection policy delivered by the sending module 40 to the second packet forwarding device according to the first drainage path determined by the processing module 41 is the dynamic drainage cleaning response policy, and the dynamic drainage cleaning
  • the response policy includes the first drainage path indication information, where the first drainage path indication information is used to instruct the second packet forwarding device to send the traffic of the flow to the destination IP address to the first drainage path to the first drainage path.
  • the cleaning device performs a cleaning process.
  • the processing module 41 is further configured to: before the sending module 40 sends a DDoS protection policy to the second packet forwarding device:
  • the sending module 40 sends a DDoS protection policy to the second packet forwarding device as the dynamic drainage cleaning response policy according to the second drainage path determined by the processing module 41, and the dynamic drainage cleaning response.
  • the policy includes a second drainage path indication information, where the second drainage path indication information is used to indicate that the second packet forwarding device sends the traffic of the flow to the destination IP address to the second drainage path through the second drainage path.
  • the cleaning process is performed on the cleaning device.
  • FIG. 8 is a schematic structural diagram of another packet forwarding device according to an embodiment of the present disclosure.
  • the controller includes: a sending module 50, a processing module 51, and a receiving module 52;
  • the receiving module 52 is configured to receive a traffic statistics command sent by the controller, where the traffic statistics command is used to instruct the processing module 51 to perform traffic statistics; wherein the traffic statistics command carries a destination IP address;
  • the processing module 51 is configured to collect, according to the traffic statistics command received by the receiving module 52, statistics of traffic statistics flowing to the destination IP address.
  • the sending module 50 is configured to report statistical data to the controller according to the traffic statistics information of the flow to the destination IP address, which is calculated by the processing module 51, where the statistical data includes the flow to the destination IP Traffic statistics for the address.
  • the packet forwarding device is the first packet forwarding device.
  • the receiving module receives the traffic statistics command sent by the controller, where the traffic statistics command carries the destination IP address, and is used to instruct the processing module to perform traffic statistics. Further, the processing module flows to the destination according to the traffic statistics command received by the receiving module. The traffic of the IP address is counted, and the traffic statistics flowing to the destination IP address are obtained.
  • the sending module reports the statistics of the traffic to the controller, and the statistics includes the traffic statistics flowing to the destination IP address.
  • the first packet forwarding device performs traffic statistics on the traffic that flows to the destination IP address, and reports the statistics.
  • the controller is configured to enable the controller to determine whether a DDoS attack occurs based on the statistical data, thereby triggering a corresponding DDoS protection policy; thereby reducing the impact of the DDoS attack on the network and improving network security.
  • the traffic statistics instruction further carries: the detection start time described above;
  • the packet forwarding device shown in FIG. 8 when used as the second packet forwarding device, it has the following functions:
  • the receiving module 52 is further configured to: after the sending module 50 reports the statistics to the controller:
  • the processing module 51 is further configured to perform protection processing on the traffic flowing to the destination IP address according to the DDoS protection policy received by the receiving module 52.
  • the second packet forwarding device provided by the embodiment, after the sending module reports the statistical data to the controller, receives the DDoS protection policy sent by the controller by the receiving module, and is received by the processing module according to the receiving module.
  • the DDoS protection policy performs protection against the traffic destined for the destination IP address, and implements DDoS protection against traffic destined for the destination IP address, thereby reducing the impact of the DDoS attack on the network and improving Network security.
  • the corresponding function of the second packet forwarding device side is as follows:
  • the receiving module 52 is further configured to: after receiving the DDoS protection policy sent by the controller:
  • the processing module 51 is further configured to stop performing protection processing on the traffic flowing to the destination IP address according to the protection cancellation indication message received by the receiving module 52.
  • the DDoS protection policy includes any one of the following response policies: black hole routing Policy, current limit response policy, speed limit response policy, drop response policy, local cleaning response policy, dynamic drainage cleaning response strategy;
  • the black hole route response policy is used to instruct the processing module 51 to perform packet discarding processing on the traffic that flows to the destination IP address by configuring a black hole route.
  • the processing module 51 performs protection processing on the traffic that flows to the destination IP address according to the DDoS protection policy, specifically: using a black hole routing solution according to the black hole routing response policy received by the receiving module 52. And performing packet discarding processing on the traffic flowing to the destination IP address;
  • the current limiting response policy is used to instruct the processing module 51 to perform a current limiting process on the traffic that flows to the destination IP address.
  • the processing module 51 performs protection processing on the traffic that flows to the destination IP address according to the DDoS protection policy, specifically: according to the traffic limiting response policy received by the receiving module 52, the flow direction
  • the traffic of the destination IP address is subjected to traffic limiting processing;
  • the speed limit response policy is used to instruct the processing module 51 to perform rate limiting processing on the traffic flowing to the destination IP address;
  • the processing module 51 performs protection processing on the traffic that flows to the destination IP address according to the DDoS protection policy, specifically: according to the speed limit response policy received by the receiving module 52, the flow direction
  • the traffic of the destination IP address is subjected to rate limiting processing;
  • the discarding response policy is used to instruct the processing module 51 to perform packet discarding processing on the traffic that flows to the destination IP address;
  • the processing module 51 performs protection processing on the traffic that flows to the destination IP address according to the DDoS protection policy, specifically: the flow is performed according to the discard response policy received by the receiving module 52.
  • the traffic of the destination IP address is discarded.
  • the local cleaning response policy is used to instruct the processing module 51 to locally perform the cleaning process on the traffic flowing to the destination IP address;
  • the processing module 51 performs protection processing on the traffic that flows to the destination IP address according to the DDoS protection policy, specifically: locally speaking, according to the local cleaning response policy received by the receiving module 52.
  • the traffic flowing to the destination IP address is cleaned;
  • the dynamic draining cleaning response policy is used to instruct the processing module 51 to send the traffic flowing to the destination IP address to the cleaning device for cleaning processing;
  • the processing module 51 performs protection processing on the traffic that flows to the destination IP address according to the DDoS protection policy, specifically: indicating, according to the dynamic drainage cleaning response policy received by the receiving module 52, the sending The module 50 sends the flow to the destination IP address to the cleaning device for cleaning processing.
  • the controller Before the dynamic drainage cleaning response policy is sent by the controller, the controller needs to determine a path with the least impact on the network to perform traffic drainage, and the second packet forwarding device has corresponding functions. as follows:
  • the dynamic drainage cleaning response policy includes first drainage path indication information, where the first drainage path indication information is used to indicate that the traffic that flows to the destination IP address is sent to the cleaning through the first drainage path.
  • the first drainage path is a path with a minimum load between the packet forwarding device and the cleaning device; the first drainage path includes the second packet forwarding device and the cleaning device;
  • the processing module 51 instructs the sending module 50 to send the traffic flowing to the destination IP address to the cleaning device for cleaning processing. Specifically:
  • the sending module 50 instructs the sending module 50 to send the traffic flowing to the destination IP address to the cleaning device through the first drainage path for cleaning. deal with.
  • the dynamic drainage cleaning response policy includes second drainage path indication information, where the second drainage path indication information is used to indicate that the traffic that flows to the destination IP address is sent to the cleaning through the second drainage path.
  • the second drainage path is a path closest to the distance between the packet forwarding device and the cleaning device;
  • the processing module 51 instructs the sending module 50 to send the traffic flowing to the destination IP address to the cleaning device for cleaning processing. Specifically:
  • the sending module 50 instructs the sending module 50 to send the traffic flowing to the destination IP address to the cleaning device through the second drainage path for cleaning. deal with.
  • FIG. 9 is a schematic flowchart of a method for protecting a DDOS attack based on an SDN according to an embodiment of the present invention. Referring to FIG. 9 , the process includes:
  • Step 1 The data traffic arrives at the server according to 1->4->5.
  • Step 2 The controller identifies the packet forwarding device at the SDN boundary.
  • the controller executes the DDoS control program or the application of the user equipment invokes the DDoS control program, the controller sends a traffic statistics command to the packet forwarding device at the SDN boundary.
  • the traffic statistics command is used to instruct the packet forwarding device to perform traffic statistics.
  • the packet forwarding device at the SDN boundary is the first packet forwarding device.
  • the controller can also The packet forwarding device sends a traffic statistics command.
  • the traffic statistics command carries a destination IP address, where the destination IP address is an IP address of the server or a certain IP address segment; the first packet forwarding device starts from a certain time based on the traffic statistics command.
  • the statistics of the traffic to the destination IP address are obtained, and the statistics are obtained.
  • the statistics include traffic statistics of the destination IP address.
  • the controller can query the first packet forwarding device when the statistics period T ends. The statistics.
  • the controller issues the policy and query statistics, for example, the flow direction 3 is shown;
  • Step 3 After receiving the traffic statistics command, the first packet forwarding device establishes a destination IP monitoring table based on the destination IP address, where the table is in the form of a hash table, and includes various statistical items of the destination IP address. .
  • the first packet forwarding device performs statistics on the destination IP address of the forwarded data packet in each statistical period. When the statistics period ends, the controller queries the first packet forwarding device for the statistical data. The first packet forwarding device reports the statistics, for example, the flow direction 2;
  • Step 4 The controller collects statistics of all the first packet forwarding devices in a certain detection period T, and the controller aggregates the traffic statistics flowing to the destination IP address to obtain the flow to the destination IP address.
  • the global traffic statistics value Specifically, the controller may perform a summation operation on the statistics to obtain a global traffic statistics value that flows to the destination IP address.
  • the controller compares the global traffic statistics with a predetermined threshold, and if the predetermined threshold is exceeded, the network attack is considered to occur; if the global traffic statistics continuously exceed the predetermined threshold for several specific periods, the network attack is considered to be eliminated;
  • Step 5 If the network attack occurs, the controller sends a network attack defense policy, such as a DDoS protection policy, to the second packet forwarding device.
  • a network attack defense policy such as a DDoS protection policy
  • the controller may determine a packet forwarding device that is closest to the attack source, The packet forwarding device closest to the attack source is used as the second packet forwarding device.
  • the second packet forwarding device can perform DDoS protection policies such as black hole routing, traffic limiting (speed limit), discarding, local cleaning, dynamic drain cleaning, and local cleaning based on the DDoS protection policy.
  • the local cleaning means that the packet forwarding device performs the DDoS protection cleaning process on the traffic that meets the DDoS protection policy.
  • the dynamic traffic drainage device forwards the traffic that meets the DDoS protection policy to the professional cleaning device for cleaning. The cleaning device is injected back into the SDN.
  • Step 7 After receiving the protection elimination indication message sent by the controller, the second packet forwarding device restores the normal forwarding path of the traffic, closes the drainage, and stops the cleaning process.
  • the traffic statistics performed by the first packet forwarding device for the traffic that flows to the destination IP address are implemented by pipeline processing in the process specified by the OpenFlow protocol.
  • the first packet forwarding device defines the destination IP monitoring table as a flow table. When the destination IP address of a traffic hits the destination IP address in the IP monitoring table, the flow table entry is considered to be hit.
  • a packet forwarding device extracts the information of the traffic data packet and refreshes the statistics of the entry.
  • the first packet forwarding device simultaneously checks whether the monitoring period arrives, and if so, sets the action item to send a log of the statistics of the first packet forwarding device to the controller, and clears The statistics of the first packet forwarding device cache are entered into the next statistical period.
  • the controller and the packet forwarding device in the foregoing SDN are described below through specific embodiments.
  • FIG. 10 is a schematic flowchart of another SDN-based DDoS attack defense method according to an embodiment of the present invention.
  • the method is performed by using the foregoing controller, and the controller may adopt the structure shown in FIG. 4 or FIG.
  • the method includes the following process:
  • Step 100 The controller sends a traffic statistics command to the first packet forwarding device, where the traffic statistics command is used to instruct the first packet forwarding device to perform traffic statistics.
  • the traffic statistics command carries a destination IP address.
  • Step 101 The controller collects statistics reported by the first packet forwarding device according to the traffic statistics instruction, where the statistics includes traffic statistics information that flows to the destination IP address.
  • Step 102 The controller obtains a global traffic statistics value that is sent to the destination IP address according to the statistics.
  • the global traffic statistics value is used by the controller to collect the statistics reported by the at least two packet forwarding devices, including the first packet forwarding device, to obtain the SDN range. a statistical value of the flow of the internal flow to the destination IP address;
  • Step 103 The controller determines whether the global traffic statistics value exceeds a predetermined threshold.
  • Step 104 The controller sends a DDoS protection policy to the second packet forwarding device, based on the determination result that the global traffic statistics exceeds a predetermined threshold.
  • the controller sends a traffic statistics command to the first packet forwarding device, where the traffic statistics command is used to instruct the first packet forwarding device to perform traffic statistics.
  • the traffic statistics command carries a destination IP address, and the controller collects statistics reported by the first packet forwarding device according to the traffic statistics instruction, where the statistics include flow to the destination IP address.
  • the traffic statistics information is obtained by the controller, according to the statistics, a global traffic statistics value that is sent to the destination IP address, where the global traffic statistics value indicates that the controller pair includes the first packet forwarding
  • the obtained statistics are used to reflect the traffic flowing to the destination IP address in the SDN range; the controller determines the global Whether the traffic statistics exceeds a predetermined threshold, and based on the determination result that the global traffic statistics exceeds a predetermined threshold, the second packet is forwarded to the second packet. Issued DDoS protection strategy. It reduces the impact of DDoS attacks on the network and improves network security.
  • the traffic statistics command further carries: detecting a start time
  • the detection start time is used to notify the first packet forwarding device to perform the start time of the traffic statistics, and the traffic statistics are continuously executed by the first packet forwarding device in a detection period.
  • the statistics are reported by the first packet forwarding device to the controller in the detection period.
  • FIG. 11 is a schematic flowchart of another SDN-based DDoS attack protection method according to an embodiment of the present invention.
  • Step 105 The controller determines that the global traffic statistics value does not exceed the predetermined threshold in at least two consecutive detection periods;
  • Step 106 The controller sends a protection cancellation indication message to the second packet forwarding device.
  • the guard elimination indication message is used to indicate that the second packet forwarding device ends execution of the DDoS protection strategy.
  • FIG. 12 is another A flow chart of the SDN-based DDoS attack protection method, referring to FIG. 12, before step 104, further includes:
  • Step 107 The controller determines, according to the statistical data, a packet forwarding device that is closest to the attack source on the attack path, and uses the packet forwarding device that is closest to the attack source as the second packet forwarding device.
  • the traffic statistics that are sent to the destination IP address include: a traffic value that flows to the destination IP address on the first packet forwarding device; a possible implementation manner of step 107 is:
  • the first attack path is an attack path with the largest flow value in at least one attack path flowing to the destination IP address;
  • the packet forwarding device closest to the attack source is located at the SDN boundary of the source address side of the traffic flowing to the destination IP address on the first attack path.
  • FIG. 13 is a schematic diagram of the attack path and the latest attack source determination.
  • the SDN includes: the packet forwarding device A to the G and the controller; wherein the packet forwarding device A is connected to the ISP network 1, and the attack source of the network attack is in the ISP network 1, and the packet forwarding device B and the ISP network 2
  • the packet forwarding device F is connected to the ISP network 3, and the packet forwarding device F is connected to the network where the destination IP is located.
  • the destination IP is the destination IP of the network attack traffic, that is, the IP of the victim host;
  • the packet forwarding device A, the packet forwarding device B, the packet forwarding device E, and the packet forwarding device F are respectively used for other network access SDNs. Therefore, these packet forwarding devices are at the boundary of the SDN.
  • the controller determines the packet forwarding device E closest to the destination IP and the above-mentioned packet forwarding devices at the SDN boundary, due to the SDN.
  • the network attack traffic from the attack source to the destination IP may have multiple paths.
  • the traffic path may be: packet forwarding device A ⁇ packet forwarding device G ⁇ packet forwarding device E, hereinafter referred to as the first attack. Path; packet forwarding device F ⁇ packet forwarding device E, hereinafter referred to as the second attack path; packet forwarding device B ⁇ message forwarding device G ⁇ message forwarding device E, hereinafter referred to as the third attack path;
  • the controller sorts the traffic flow to the destination IP address on each attack path, and determines that the first attack path is the one with the largest traffic.
  • the controller determines the packet forwarding device. A is closest to the source of the attack.
  • the first packet forwarding device and the first packet forwarding device described above are described with reference to FIG.
  • the first packet forwarding device performs traffic statistics according to the traffic statistics command.
  • the packet forwarding devices A to G are The traffic statistics can be performed. Therefore, the packet forwarding device A to G can be used as the first packet forwarding device.
  • the controller determines that the packet forwarding device A is closest to the attack source, the controller forwards the packet to the device A. If the DDoS protection policy is used, the packet forwarding device A is used as the second packet forwarding device. Alternatively, the network attack traffic destined for the destination IP may pass through the packet forwarding devices A, B, and F, respectively. If the DDoS protection policy is delivered to the device, the packet forwarding devices A, B, and F are used as the second packet forwarding device.
  • the DDoS protection policy includes any one of the following response policies: a black hole route response policy, a current limit response policy, a rate limit response policy, a drop response policy, a local cleaning response policy, and a dynamic drain cleaning response policy;
  • the black hole route response policy is used to indicate that the second packet forwarding device performs packet discarding processing on the traffic that flows to the destination IP address by configuring a black hole route.
  • the traffic limiting response policy is used to instruct the second packet forwarding device to perform a traffic limiting process on the traffic that flows to the destination IP address.
  • the speed limit response policy is used to instruct the second packet forwarding device to perform rate limiting processing on the traffic that flows to the destination IP address;
  • the discarding response policy is used to instruct the second packet forwarding device to perform packet discarding processing on the traffic that flows to the destination IP address;
  • the local cleaning response policy is used to instruct the second packet forwarding device to locally perform the cleaning process on the traffic flowing to the destination IP address;
  • the dynamic drain cleaning response policy is used to instruct the second packet forwarding device to send the flow direction
  • the traffic of the destination IP address is sent to the cleaning device for cleaning processing.
  • the controller needs to determine a path with the least impact on the network to perform traffic drainage.
  • FIG. 14 is a schematic flowchart of another SDN-based DDoS attack defense method according to an embodiment of the present invention.
  • the statistics further includes: the first packet.
  • step 104 the method further includes:
  • Step 108 The controller determines a first drainage path according to a load value of the first packet forwarding device.
  • the first drainage path is a path with a minimum load between the second packet forwarding device and the cleaning device; the first drainage path includes the second packet forwarding device and the cleaning device;
  • DDoS protection policy sent by the controller to the second packet forwarding device is the dynamic drainage cleaning response policy
  • the dynamic drainage cleaning response policy includes first drainage path indication information, where the first drainage path indication information is used to indicate that the second packet forwarding device passes the traffic to the destination IP address.
  • the first drainage path is sent to the cleaning device for cleaning processing.
  • FIG. 15 is a schematic flowchart of another SDN-based DDoS attack protection method according to an embodiment of the present invention. Referring to FIG. 15, before step 104, the method further includes:
  • Step 109 The controller determines a second drainage path according to an SDN topology relationship.
  • the second drainage path is a path that is the closest distance between the second packet forwarding device and the cleaning device
  • the SDN topology relationship includes each packet forwarding device in the SDN and the cleaning device. Connection relationship;
  • controller sends a DDoS protection policy to the second packet forwarding device as the dynamic drainage cleaning response policy
  • the dynamic drainage cleaning response policy includes a second drainage path indication information, where the second drainage path indication information is used to indicate that the second packet forwarding device passes the traffic that flows to the destination IP address.
  • the second drainage path is sent to the cleaning device for cleaning processing.
  • the “first drainage path” in the first mode is described.
  • the packet forwarding device F receives the traffic statistics command sent by the controller, and the F is used as the first packet forwarding device to perform traffic statistics. Reporting the statistics to the controller; if the controller sends a dynamic drainage cleaning response policy to the F, the F acts as the second packet forwarding device to perform the dynamic drainage cleaning response policy; the F is connected to the cleaning device;
  • the cleaning response policy includes first drainage path indication information, where the first drainage path indication information is used to indicate that the F sends the traffic to the destination IP address to the cleaning device by using the first drainage path. Perform cleaning treatment. Since the F is directly connected to the cleaning device, it is obvious that the drainage path of the F-cleaning device is the path with the least load between the F and the cleaning device, and the first drainage path includes
  • the cleaning device is connected to the packet forwarding device D
  • the controller sends a dynamic drainage cleaning response policy to the F
  • the F acts as the second packet forwarding device to perform the dynamic drainage cleaning response policy.
  • the traffic is directed to the cleaning device and includes a plurality of possible drainage paths, such as: FEGD-cleaning device; FAGD-cleaning device; the load of the different drainage paths is different, and the packet forwarding device based on the path is used as the first packet.
  • the first drainage path is determined. For example, if the load of the FEGD-cleaning device is the smallest, the first drainage path includes F, E, G, D, and the cleaning device.
  • steps shown in FIG. 14 and FIG. 15 may be implemented in combination with the steps shown in FIG. 10, or may be implemented in combination with the steps shown in FIG. 11 and FIG.
  • FIG. 16 is a schematic flowchart of another SDN-based DDoS attack defense method according to an embodiment of the present invention.
  • the method is applied to an SDN system, where the SDN system includes a controller and a packet forwarding device, and the method execution entity is For the packet forwarding device, the packet forwarding device may adopt the structure shown in FIG. 5 or FIG. 8.
  • the method includes the following process:
  • Step 200 Receive a traffic statistics command sent by the controller, where the traffic statistics command is used to instruct the packet forwarding device to perform traffic statistics.
  • the traffic statistics instruction carries a destination IP address.
  • Step 201 Collect traffic statistics information flowing to the destination IP address according to the traffic statistics instruction.
  • Step 202 Report statistics to the controller, where the statistics include the flow to the Traffic statistics of the destination IP address.
  • the packet forwarding device receives the traffic statistics command sent by the controller, where the traffic statistics command is used to instruct the packet forwarding device to perform traffic statistics.
  • the traffic statistics command carries the destination IP address, and the packet forwarding device collects the traffic statistics of the destination IP address according to the traffic statistics command.
  • the packet forwarding device reports the statistics to the controller.
  • the data includes the traffic statistics flowing to the destination IP address.
  • the packet forwarding device performs traffic statistics on the traffic that flows to the destination IP address, and reports the statistics to the controller, so that the controller can determine whether a DDoS attack occurs based on the statistics, thereby triggering a corresponding DDoS protection policy; It reduces the impact of DDoS attacks on the network and improves network security.
  • the packet forwarding device that performs the foregoing steps 200 to 202 may be defined as the first packet forwarding device according to the foregoing.
  • the traffic statistics command further carries: detecting a start time
  • the detection start time is used to notify the packet forwarding device to perform the traffic statistics start time, and the traffic statistics are continuously performed in a manner of detecting a period, and the statistical data is reported to the detection period.
  • the controller is used to notify the packet forwarding device to perform the traffic statistics start time, and the traffic statistics are continuously performed in a manner of detecting a period, and the statistical data is reported to the detection period.
  • FIG. 17 is a schematic flowchart of another SDN-based DDoS attack protection method according to an embodiment of the present invention. After step 202, the method further includes:
  • Step 203 Receive a DDoS protection policy sent by the controller.
  • Step 204 Perform protection processing on the traffic that flows to the destination IP address according to the DDoS protection policy.
  • FIG. 18 is a schematic flowchart of another SDN-based DDoS attack defense method according to an embodiment of the present invention. After step 204, the method further includes:
  • Step 205 Receive a protection cancellation indication message sent by the controller, where the protection elimination indication message is used to indicate that the packet forwarding device ends executing the DDoS protection policy.
  • Step 206 Stop, according to the protection elimination indication message, performing protection processing on the traffic flowing to the destination IP address.
  • the DDoS protection policy includes any one of the following response policies: a black hole route response policy, a current limit response policy, a rate limit response policy, a drop response policy, a local cleaning response policy, Dynamic drainage cleaning response strategy;
  • the black hole route response policy is used to indicate that the packet forwarding device performs packet discarding processing on the traffic that flows to the destination IP address by configuring a black hole route.
  • a possible implementation of the step 204 is: performing a packet discarding process on the traffic destined for the destination IP address by using a black hole route according to the black hole routing response policy;
  • the traffic limiting response policy is used to indicate that the packet forwarding device performs current limiting processing on the traffic that flows to the destination IP address.
  • a possible implementation of the step 204 is: performing traffic limiting processing on the traffic that flows to the destination IP address according to the traffic limiting response policy;
  • the rate limiting response policy is used to instruct the packet forwarding device to perform rate limiting processing on the traffic flowing to the destination IP address;
  • a possible implementation manner of the step 204 is: performing rate limiting processing on the traffic that flows to the destination IP address according to the rate limiting response policy;
  • the discarding response policy is used to instruct the packet forwarding device to perform packet discarding processing on the traffic that flows to the destination IP address;
  • a possible implementation manner of the step 204 is: performing packet discarding processing on the traffic that flows to the destination IP address according to the discarding response policy;
  • the local cleaning response policy is used to indicate that the packet forwarding device locally performs cleaning processing on the traffic flowing to the destination IP address;
  • a possible implementation of the step 204 is: performing local cleaning processing on the flow to the destination IP address according to the local cleaning response policy;
  • the dynamic draining cleaning response policy is used to instruct the packet forwarding device to send the traffic flowing to the destination IP address to the cleaning device for cleaning processing;
  • a possible implementation of the step 204 is: sending, according to the dynamic drain cleaning response policy, the traffic that flows to the destination IP address to the cleaning device for performing a cleaning process.
  • the controller needs to determine a path with the least impact on the network to perform traffic drainage, in order to cooperate with the controller side to implement network-based impact
  • the scheme of the minimum path for traffic diversion The following describes the method flow that the packet forwarding device needs to perform.
  • the statistical data further includes: a load value of the first packet forwarding device
  • the dynamic drainage cleaning response policy includes first drainage path indication information, where the first drainage path indication information is used to indicate that the packet forwarding device passes the traffic flowing to the destination IP address through the first drainage
  • the path is sent to the cleaning device for performing a cleaning process;
  • the first drainage path is a path with a minimum load between the packet forwarding device and the cleaning device; and the first drainage path includes the second packet a forwarding device and the cleaning device;
  • step 204 is:
  • the traffic that flows to the destination IP address is sent to the cleaning device through the first drainage path for cleaning processing.
  • the dynamic drainage cleaning response policy includes a second drainage path indication information, where the second drainage path indication information is used to indicate that the packet forwarding device passes the traffic flowing to the destination IP address through the second drainage The path is sent to the cleaning device for cleaning processing; the second drainage path is a path closest to the distance between the packet forwarding device and the cleaning device;
  • step 204 is:
  • the traffic that flows to the destination IP address is sent to the cleaning device through the second drainage path for cleaning processing.
  • FIG. 19 is a schematic diagram of a local cleaning processing flow. Referring to FIG. 19, the processing includes processing the data packet classification process:
  • Step 300 it is determined whether the data packet transmission control protocol (Transmission Control Protocol, abbreviated: TCP) protocol;
  • TCP Transmission Control Protocol
  • step 301 If yes, go to step 301, otherwise go to step 308;
  • Step 301 Determine whether the data packet is a Hyper Text Transfer Protocol (HTTP) message
  • step 302 is performed
  • Step 302 Determine whether the data packet is a domain name system (DNS) message
  • step 303 is performed;
  • Step 303 Determine whether the data packet is a TCP fragment packet.
  • step 304 is performed;
  • Step 304 Determine whether the data packet is a Synchronous (Synchronous, short for short) message
  • step 305 is performed;
  • Step 305 Determine whether the data packet is an Acknowledgement (ACK: ACK) packet;
  • step 306 is performed;
  • Step 306 Determine whether the data packet is a Syn-ACK packet.
  • step 307 is performed
  • Step 307 Determine whether the data packet is a reset (RST) packet.
  • Step 308 Determine whether the data packet belongs to a User Datagram Protocol (UDP) protocol;
  • UDP User Datagram Protocol
  • step 309 If yes, go to step 309; otherwise, go back to the step;
  • Step 309 Determine whether the data packet is a DNS query message.
  • step 310 is performed;
  • Step 310 Determine whether the data packet is a DNS response packet.
  • step 311 is performed
  • Step 311 Determine whether the data packet is a Session Initiation Protocol (SIP) packet;
  • SIP Session Initiation Protocol
  • step 312 is performed
  • Step 312 Determine whether the data packet is a UDP fragment packet.
  • the UDP fragment packet processing function is used to clean the data packet; otherwise, the UDP packet is used to clean the data packet.
  • the packet forwarding device that performs the above steps 203 to 206 can be defined as the second packet forwarding device described above according to its function.
  • FIG. 20 is a schematic diagram of an interaction process of an SDN-based DDoS attack defense method according to an embodiment of the present invention. Referring to FIG. 20, the interaction process includes:
  • Step 400 The controller sends a traffic statistics command to the first packet forwarding device.
  • Step 401 The first packet forwarding device collects, according to the traffic statistics instruction, traffic statistics information that is sent to the destination IP address.
  • Step 402 The controller receives the statistical data sent by the first packet forwarding device.
  • Step 403 The controller obtains a global traffic statistics value that flows to the destination IP address according to the statistics.
  • Step 404 The controller determines whether the global traffic statistics exceeds a predetermined threshold.
  • Step 405 The controller sends a DDoS protection policy to the second packet forwarding device, based on the determination result that the global traffic statistics exceeds a predetermined threshold.
  • Step 406 The second packet forwarding device performs protection processing on the traffic that flows to the destination IP address according to the DDoS protection policy.
  • Step 407 The controller determines that the global traffic statistics value does not exceed the predetermined threshold in at least two consecutive detection periods
  • Step 408 The controller sends a protection cancellation indication message to the second packet forwarding device.
  • Step 409 The second packet forwarding device stops performing protection processing on the traffic flowing to the destination IP address according to the protection elimination indication message.
  • FIG. 21 is a schematic diagram of interaction of another DDoS attack defense method based on the SDN network according to the embodiment of the present invention. Referring to FIG. 21, the interaction is performed. Including the following processes:
  • Step 500 The controller sends a traffic statistics command to the packet forwarding device.
  • Step 501 The packet forwarding device sends a traffic statistics command response message to the packet forwarding device.
  • Step 502 The packet forwarding device constructs a destination IP monitoring table to perform traffic monitoring.
  • Step 503 The controller periodically sends a query message.
  • step 503 can also periodically report the statistical data to the packet forwarding device.
  • Step 504 The packet forwarding device sends a response message to the controller, where the response message includes statistical data.
  • Step 505 The controller periodically performs traffic statistics based on the destination IP monitoring to summarize and determine whether the threshold is exceeded. If it exceeds, it determines to enter the DDoS attack start state; if not, it continues to monitor;
  • Step 506 After entering the DDoS attack start state, the controller finds the packet forwarding device that is closest to the attack according to the monitoring result, and sends a DDoS protection policy.
  • Step 507 The packet forwarding device sends a DDoS protection policy response message to the controller.
  • Step 508 The packet forwarding device starts a protection action.
  • Step 509 Enter a DDoS attack start state, and after continuing for multiple cycles, the controller finds that the traffic returns to normal, and determines the attack end state, and continues to monitor the traffic;
  • Step 510 After entering the attack end state, the controller sends a protection cancellation indication message to the responding packet forwarding device.
  • Step 511 The packet forwarding device sends a protection elimination indication response message to the controller.
  • the packet forwarding device constructs a destination IP monitoring table (ddos-group table) based on the destination IP address, and the table adopts a hash table format, and the establishment algorithm uses the destination IP address of the traffic data packet to hit the specified destination IP address. , it is considered that the table is hit, and the packet forwarding device can perform traffic statistics;
  • the field included therein may include the following information:
  • Total number of messages (ULONG ulPacketSum), total number of bytes (ULONG ulByteSum), packet rate (ULONG ulICMPPktRate), ICMP bandwidth (ULONG ulICMPBand), TCP packet rate (ULONG ulTcpPktRate), TCP bandwidth (ULONG ulTcpBand) , UDP packet rate (ULONG ulUdpPktRate), UDP bandwidth (ULONG ulUdpBand);
  • the traffic statistics information includes at least one of the following information: a SYN packet rate (ULONG ulSynPktRate), a bandwidth of the SYN packet (ULONG ulSynBand), and a packet of the ACK packet.
  • the foregoing statistics further include: a load value of the first packet forwarding device: specifically, the implementation of the load value of the first packet forwarding device may be: the throughput of the first packet forwarding device Or, the bandwidth occupancy rate of the first packet forwarding device. Further, the load value of the first packet forwarding device may be set in a field of the traffic statistics information; or may be set in an idle field of the statistics.
  • the controller sends a traffic statistics command to the packet forwarding device.
  • the packet forwarding device sends a traffic statistics command response message to the controller.
  • the OpenFlow protocol may have the following data structure:
  • the interaction message adopting the data structure carries the following fields: a message type field (Type OFPT_ROLE_REQUEST/OFPT_ROLE_REPLY), a destination IP address, a subnet mask, a statistics enable, a statistics period, and a statistics sub-function switch;
  • the field of the destination IP address is 4 bytes; the field of the subnet mask is 4 bytes; the field of the statistics enable is 8 bytes, which is used to indicate that traffic statistics are started or traffic statistics are disabled; It is 8 bytes, which is used to indicate the period of traffic statistics.
  • the time unit can be seconds or other time units that meet the SDN requirements.
  • the field of the statistics sub-function switch is 8 bytes, which is used to indicate the related functions of the statistical traffic. Turn it on or off, enable by bit.
  • the controller collects statistics reported by the packet forwarding device according to the traffic statistics instruction. Specifically, the controller may send a query message to the packet forwarding device, and receive a response message sent by the packet forwarding device, where the response message includes statistical data. Based on the Open Flow protocol, the query message and the reply message can have the following data structure:
  • the query message and the response message in the data structure carry the following fields: a message type field (Type OFPT_ROLE_REQUEST/OFPT_ROLE_REPLY), a destination IP address, a subnet mask, a statistics period, a number of cycles that have been reported and reported, and a flow rate. a collection of statistical information;
  • the field of the destination IP address is 4 bytes; the field of the subnet mask is 4 bytes; the field of the statistics period is 8 bytes, which is used to indicate the period of the traffic statistics, and the time unit can be seconds or other.
  • the time unit that meets the SDN requirement; the field that has been counted and reported in the current cycle is 4 words.
  • the set of traffic statistics includes statistics items included in the packet forwarding device, and each statistical item is included in the data structure according to the name of the statistical variable and the value of the statistical variable.
  • the controller After the network attack is determined, the controller sends a DDoS protection policy to the packet forwarding device.
  • the packet forwarding device sends a DDoS protection policy response message to the controller.
  • the controller After the network attack ends, the controller forwards the packet to the device.
  • the protection forwarding elimination indication message is sent, and the packet forwarding device sends a protection elimination indication response message to the controller.
  • the data structure may have the following data structure:
  • the interaction message adopting the data structure carries the following fields: a message type field (Type OFPT_ROLE_REQUEST/OFPT_ROLE_REPLY), a destination IP address, a subnet mask, an action enable, a type of response action, and a response action parameter set;
  • the field of the destination IP address is 4 bytes; the field of the subnet mask is 4 bytes; the field of the action enable is 8 bytes, which is used to indicate that the action is "on” or "off” state;
  • the field of the response action type is 8 bytes, which includes black hole routing, current limiting (speed limit), discarding, local cleaning, and drain cleaning; the response action parameter set contains parameters related to specific response actions.
  • the aforementioned program can be stored in a computer readable storage medium.
  • the program when executed, performs the steps including the foregoing method embodiments; and the foregoing storage medium includes various media that can store program codes, such as a ROM, a RAM, a magnetic disk, or an optical disk.

Abstract

一种基于SDN的DDOS攻击防护方法、装置及系统，通过控制器向第一报文转发设备下发流量统计指令，流量统计指令指示第一报文转发设备进行流量统计，并携带目的地IP地址；控制器收集第一报文转发设备上报的统计数据，统计数据包含流向目的地IP地址的流量统计信息；控制器根据统计数据，获得流向目的地IP地址的全局流量统计值；并判断全局流量统计值是否超过预定阈值，基于全局流量统计值超过预定阈值的判断结果，向第二报文转发设备下发DDoS防护策略；相应的，第二报文转发设备，接收控制器发送的DDoS防护策略；根据DDoS防护策略对流向目的地IP地址的流量进行防护处理。降低了DDoS攻击对网络的影响范围，提高了网络安全性。

Description

基于SDN的DDOS攻击防护方法、装置及系统
本申请要求于2015年3月24日提交中国专利局、申请号为201510131608.2、发明名称为“基于SDN的DDOS攻击防护方法、装置及系统”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本发明涉及通信技术，尤其涉及一种基于软件定义网络(Software Defined Network,简称：SDN)的分布式拒绝服务(Distributed Denial of Service，简称：DDOS)攻击防护方法、装置及系统。
背景技术
图1为DDoS攻击的示意图。参照图1，DDoS的主要实施原理是攻击者利用一级或多级主控主机做跳板，控制大量受感染的受控主机从而组成攻击网络来对受害主机实施大规模的拒绝服务攻击。这种攻击往往能把单个攻击者的攻击效果以级数形式进行放大，从而对受害主机造成重大影响，对网络也会造成严重拥塞。DDoS利用攻击网络对受害主机发起网间控制报文协议(Internet Control Messages Protocol，简称ICMP)洪水攻击、同步(Synchronous，简称：Syn)洪水攻击、用户数据报协议(User Datagram Protocol，简称：UDP)洪水攻击等多种攻击形式，使得受害主机消耗大量处理资源来处理这些突增请求而无法正常响应合法用户请求，从而造成瘫痪。
现有技术中，DDoS防护方案通常在网络汇聚节点部署清洗设备，通过该清洗设备对汇聚到该节点的DDoS攻击流量进行清洗，从而实现DDoS防护。其中，网络汇聚节点可以为互联互通网关、国内的城域网出口设备、各类数据中心的出口设备等。但是对于无明显网络汇聚节点的主干网，网络中的节点数量较多，此时，现有技术通常针对特定的IP地址部署清洗设备，即在与具有该特定的IP地址的主机连接的流量汇聚的节点上部署清洗设备。其中，特定的IP地址可以是根据客户需求、客户的优先级进行设定的；例如，客户需要保护某个服务器的一个IP地址或一段IP地址段；则将与该服务器连接的 流量汇聚的节点作为部署清洗设备的节点。
对于上述无明显汇聚节点的主干网场景，虽然采用针对特定IP地址部署清洗设备的方式，但是当发生DDoS攻击时，无论受害主机的IP地址是否为特定IP地址，都需要将针对受害主机的DDoS攻击流量引流至该清洗设备，导致IP地址并非特定IP地址的受害主机的流量需要经过网络中的多个路由转发节点才能被引流至该清洗设备。从而占用了这些路由转发节点的网络资源，扩大了DDoS攻击对主干网的影响范围，从而降低了网络的安全性。
发明内容
本发明提供一种基于SDN的DDOS攻击防护方法、装置及系统，用于提高网络安全性。
本发明的第一个方面是提供一种基于软件定义网络SDN的分布式拒绝服务DDoS攻击防护方法，包括：
控制器向第一报文转发设备下发流量统计指令，所述流量统计指令用于指示所述第一报文转发设备进行流量统计；
其中，所述流量统计指令携带目的地IP地址；
所述控制器收集所述第一报文转发设备根据所述流量统计指令上报的统计数据，所述统计数据包含流向所述目的地IP地址的流量统计信息；
所述控制器根据所述统计数据，获得流向所述目的地IP地址的全局流量统计值；
其中，所述全局流量统计值表示所述控制器对包括所述第一报文转发设备在内的至少两个报文转发设备上报的统计数据进行汇总后，获得的用于反映所述SDN范围内流向所述目的地IP地址的流量的统计值；
所述控制器判断所述全局流量统计值是否超过预定阈值，基于所述全局流量统计值超过预定阈值的判断结果，向第二报文转发设备下发DDoS防护策略。
结合第一个方面，在第一方面的第一种可能的实现方式中，所述流量统计指令还携带：检测起始时刻；
其中，所述检测起始时刻用于告知所述第一报文转发设备进行所述流量统计的起始时刻，所述流量统计被所述第一报文转发设备以检测周期的方式 持续执行，所述统计数据被所述第一报文转发设备以所述检测周期上报给所述控制器。
结合第一个方面的第一种可能的实现方式，在第一方面的第二种可能的实现方式中，还包括：
所述控制器确定在至少两个连续的检测周期内所述全局流量统计值未超过所述预定阈值，则所述控制器向所述第二报文转发设备下发防护消除指示消息；
所述防护消除指示消息用于指示所述第二报文转发设备结束执行所述DDoS防护策略。
结合第一个方面或第一个方面的上述任意一种可能的实现方式，在第一方面的第三种可能的实现方式中，在所述控制器向所述第二报文转发设备下发DDoS防护策略之前，还包括：
所述控制器根据所述统计数据，确定攻击路径上距离攻击源最近的报文转发设备，将所述距离攻击源最近的报文转发设备作为所述第二报文转发设备。
结合第一个方面的第三种可能的实现方式，在第一方面的第四种可能的实现方式中，所述流向所述目的地IP地址的流量统计信息，包括：所述第一报文转发设备上流向所述目的地IP地址的流量值；所述控制器根据所述统计数据，确定攻击路径上距离攻击源最近的报文转发设备，包括：
所述控制器根据所述第一报文转发设备上流向所述目的地IP地址的流量值，确定第一攻击路径；
所述第一攻击路径为流向所述目的地IP地址的至少一条攻击路径中流量值最大的攻击路径；
所述控制器根据所述第一攻击路径，确定所述距离攻击源最近的报文转发设备
所述距离攻击源最近的报文转发设备位于所述第一攻击路径上的、所述流向所述目的地IP地址的流量的源地址侧的SDN边界处。
结合第一个方面或第一个方面的上述任意一种可能的实现方式，在第五种可能的实现方式中，所述DDoS防护策略包含如下任意一种响应策略：黑洞路由响应策略、限流响应策略、限速响应策略、丢弃响应策略、本地清洗 响应策略、动态引流清洗响应策略；
其中，所述黑洞路由响应策略用于指示所述第二报文转发设备通过配置黑洞路由对所述流向所述目的地IP地址的流量进行报文丢弃处理；
所述限流响应策略用于指示所述第二报文转发设备对所述流向所述目的地IP地址的流量进行限流处理；
所述限速响应策略用于指示所述第二报文转发设备对所述流向所述目的地IP地址的流量进行限速处理；
所述丢弃响应策略用于指示所述第二报文转发设备对所述流向所述目的地IP地址的流量进行报文丢弃处理；
所述本地清洗响应策略用于指示所述第二报文转发设备在本地对流向所述目的地IP地址的流量进行清洗处理；
所述动态引流清洗响应策略用于指示所述第二报文转发设备将所述流向所述目的地IP地址的流量发送到清洗设备上进行清洗处理。
结合第一个方面的第五种可能的实现方式，在第一个方面的第六种可能的实现方式中，所述统计数据还包含：所述第一报文转发设备的负载值；
在所述控制器向所述第二报文转发设备下发DDoS防护策略之前，包括：
所述控制器根据所述第一报文转发设备的负载值确定第一引流路径；
其中，所述第一引流路径为所述第二报文转发设备至所述清洗设备之间负载最小的路径；所述第一引流路径包含所述第二报文转发设备和所述清洗设备；
所述控制器向所述第二报文转发设备下发的DDoS防护策略为所述动态引流清洗响应策略，所述动态引流清洗响应策略包含第一引流路径指示信息，所述第一引流路径指示信息用于指示所述第二报文转发设备将所述流向所述目的地IP地址的流量通过所述第一引流路径发送到所述清洗设备上进行清洗处理。
结合第一个方面的第五种可能的实现方式，在第一个方面的第七种可能的实现方式中，在所述控制器向所述第二报文转发设备下发DDoS防护策略之前，包括：
所述控制器根据SDN拓扑关系确定第二引流路径，所述第二引流路径为所述第二报文转发设备至所述清洗设备之间距离最近的路径，所述SDN拓扑 关系包含所述SDN中各个报文转发设备以及所述清洗设备的连接关系；
所述控制器向所述第二报文转发设备下发DDoS防护策略为所述动态引流清洗响应策略，所述动态引流清洗响应策略包含第二引流路径指示信息，所述第二引流路径指示信息用于指示所述第二报文转发设备将所述流向所述目的地IP地址的流量通过所述第二引流路径发送到所述清洗设备上进行清洗处理。
本发明的第二个方面是提供一种基于SDN的DDoS攻击防护方法，所述方法应用于SDN系统中，所述SDN系统包括控制器和报文转发设备，所述方法由所述报文转发设备执行，包括：
接收所述控制器发送的流量统计指令，所述流量统计指令用于指示所述报文转发设备进行流量统计；
其中，所述流量统计指令携带目的地IP地址；
根据所述流量统计指令统计流向所述目的地IP地址的流量统计信息；
向所述控制器上报统计数据，所述统计数据包含所述流向所述目的地IP地址的流量统计信息。
结合第二个方面，在第二个方面的第一种可能的实现方式中，所述流量统计指令还携带：检测起始时刻；
其中，所述检测起始时刻用于告知所述报文转发设备进行所述流量统计的起始时刻，以检测周期的方式持续进行所述流量统计，以所述检测周期上报所述统计数据给所述控制器。
结合第二个方面或第二个方面的第一种可能的实现方式，在第二个方面的第二种可能的实现方式中，在所述向所述控制器上报统计数据之后，还包括：
接收所述控制器发送的DDoS防护策略；
根据所述DDoS防护策略对所述流向所述目的地IP地址的流量进行防护处理。
结合第二个方面的第二种可能的实现方式，在第二个方面的第三种可能的实现方式中，在所述接收所述控制器发送的DDoS防护策略之后，还包括：
接收所述控制器发送的防护消除指示消息；所述防护消除指示消息用于指示所述报文转发设备结束执行所述DDoS防护策略；
根据所述防护消除指示消息停止对所述流向所述目的地IP地址的流量进行防护处理。
结合第二个方面的第二种可能的实现方式或第二个方面的第三种可能的实现方式，在第二个方面的第四种可能的实现方式中，所述DDoS防护策略包含如下任意一种响应策略：黑洞路由响应策略、限流响应策略、限速响应策略、丢弃响应策略、本地清洗响应策略、动态引流清洗响应策略；
其中，所述黑洞路由响应策略用于指示所述报文转发设备通过配置黑洞路由对所述流向所述目的地IP地址的流量进行报文丢弃处理；
则所述根据所述DDoS防护策略对所述流向所述目的地IP地址的流量进行防护处理，具体为：根据所述黑洞路由响应策略采用黑洞路由对所述流向所述目的地IP地址的流量进行报文丢弃处理；
所述限流响应策略用于指示所述报文转发设备对所述流向所述目的地IP地址的流量进行限流处理；
则所述根据所述DDoS防护策略对所述流向所述目的地IP地址的流量进行防护处理，具体为：根据所述限流响应策略对所述流向所述目的地IP地址的流量进行限流处理；
所述限速响应策略用于指示所述报文转发设备对所述流向所述目的地IP地址的流量进行限速处理；
则所述根据所述DDoS防护策略对所述流向所述目的地IP地址的流量进行防护处理，具体为：根据所述限速响应策略对所述流向所述目的地IP地址的流量进行限速处理；
所述丢弃响应策略用于指示所述报文转发设备对所述流向所述目的地IP地址的流量进行报文丢弃处理；
则所述根据所述DDoS防护策略对所述流向所述目的地IP地址的流量进行防护处理，具体为：根据所述丢弃响应策略对所述流向所述目的地IP地址的流量进行报文丢弃处理；
所述本地清洗响应策略用于指示所述报文转发设备在本地对所述流向所述目的地IP地址的流量进行清洗处理；
则所述根据所述DDoS防护策略对所述流向所述目的地IP地址的流量进行防护处理，具体为：根据所述本地清洗响应策略在本地对所述流向所述目 的地IP地址的流量进行清洗处理；
所述动态引流清洗响应策略用于指示所述报文转发设备将所述流向所述目的地IP地址的流量发送到清洗设备上进行清洗处理；
则所述根据所述DDoS防护策略对所述流向所述目的地IP地址的流量进行防护处理，具体为：根据所述动态引流清洗响应策略将所述流向所述目的地IP地址的流量发送到清洗设备上进行清洗处理。
结合第二个方面的第四种可能的实现方式，在第二个方面的第五种可能的实现方式中，所述统计数据还包含：所述第一报文转发设备的负载值；
所述动态引流清洗响应策略包含第一引流路径指示信息，所述第一引流路径指示信息用于指示所述报文转发设备将所述流向所述目的地IP地址的流量通过所述第一引流路径发送到所述清洗设备上进行清洗处理；所述第一引流路径为所述报文转发设备至所述清洗设备之间负载最小的路径；所述第一引流路径包含所述第二报文转发设备和所述清洗设备；
则所述根据所述动态引流清洗响应策略将所述流向所述目的地IP地址的流量发送到清洗设备上进行清洗处理，具体为：
根据所述动态引流清洗响应策略，将所述流向所述目的地IP地址的流量通过所述第一引流路径发送到所述清洗设备上进行清洗处理。
结合第二个方面的第四种可能的实现方式，在第二个方面的第六种可能的实现方式中，所述动态引流清洗响应策略包含第二引流路径指示信息，所述第二引流路径指示信息用于指示所述报文转发设备将所述流向所述目的地IP地址的流量通过所述第二引流路径发送到所述清洗设备上进行清洗处理；所述第二引流路径为所述报文转发设备至所述清洗设备之间距离最近的路径；
则所述根据所述动态引流清洗响应策略将所述流向所述目的地IP地址的流量发送到清洗设备上进行清洗处理，具体为：
根据所述动态引流清洗响应策略，将所述流向所述目的地IP地址的流量通过所述第二引流路径发送到所述清洗设备上进行清洗处理。
本发明的第三个方面是提供一种控制器，包括：
发送模块，用于向第一报文转发设备下发流量统计指令，所述流量统计指令用于指示所述第一报文转发设备进行流量统计；其中，所述流量统计指 令携带目的地IP地址；
接收模块，用于收集所述第一报文转发设备根据所述发送模块发送的所述流量统计指令上报的统计数据，所述统计数据包含流向所述目的地IP地址的流量统计信息；
处理模块，用于：
根据所述接收模块接收到的所述统计数据，获得流向所述目的地IP地址的所述全局流量统计值；
其中，所述全局流量统计值表示所述控制器对包括所述第一报文转发设备在内的至少两个报文转发设备上报的统计数据进行汇总后，获得的用于反映所述SDN范围内流向所述目的地IP地址的流量的统计值；
判断所述全局流量统计值是否超过预定阈值；
所述发送模块，还用于基于处理模块确定的全局流量统计值超过预定阈值的判断结果，向第二报文转发设备下发DDoS防护策略。
结合第三个方面，在第三个方面的第一种可能的实现方式中，所述流量统计指令还携带：检测起始时刻；
其中，所述检测起始时刻用于告知所述第一报文转发设备进行所述流量统计的起始时刻，所述流量统计被所述第一报文转发设备以检测周期的方式持续执行，所述统计数据被所述第一报文转发设备以所述检测周期上报给所述控制器；
所述处理模块，还用于：
确定在至少两个连续的检测周期内所述全局流量统计值未超过所述预定阈值；
所述发送模块，还用于基于所述处理模块确定的至少两个连续的检测周期内所述全局流量统计值未超过所述预定阈值的结果，向所述第二报文转发设备下发防护消除指示消息；
所述防护消除指示消息用于指示所述第二报文转发设备结束执行所述DDoS防护策略。
结合第三个方面或第三个方面的第一种可能的实现方式，在第三个方面的第二种可能的实现方式中，所述处理模块，在所述发送模块向所述第二报文转发设备下发DDoS防护策略之前，还用于：
根据所述接收模块接收的所述统计数据，确定攻击路径上距离攻击源最近的报文转发设备，将所述距离攻击源最近的报文转发设备作为所述第二报文转发设备。
结合第三个方面的第二种可能的实现方式，在第三个方面的第三种可能的实现方式中，所述流向所述目的地IP地址的流量统计信息，包括：所述第一报文转发设备上流向所述目的地IP地址的流量值；
所述处理模块，还用于根据所述统计数据，确定攻击路径上距离攻击源最近的报文转发设备，具体为：
根据所述接收模块接收的所述第一报文转发设备上流向所述目的地IP地址的流量值，确定第一攻击路径；
所述第一攻击路径为流向所述目的地IP地址的至少一条攻击路径中流量值最大的攻击路径；
根据所述第一攻击路径，确定所述距离攻击源最近的报文转发设备；
所述距离攻击源最近的报文转发设备位于所述第一攻击路径上的、所述流向所述目的地IP地址的流量的源地址侧的SDN边界处。
结合第三个方面或第三个方面的上述任意一种可能的实现方式，在第三个方面的第四种可能的实现方式中，所述DDoS防护策略包含如下任意一种响应策略：黑洞路由响应策略、限流响应策略、限速响应策略、丢弃响应策略、本地清洗响应策略、动态引流清洗响应策略；
其中，所述黑洞路由响应策略用于指示所述第二报文转发设备通过配置黑洞路由对流向所述目的地IP地址的流量进行报文丢弃处理；
所述限流响应策略用于指示所述第二报文转发设备对流向所述目的地IP地址的流量进行限流处理；
所述限速响应策略用于指示所述第二报文转发设备对流向所述目的地IP地址的流量进行限速处理；
所述丢弃响应策略用于指示所述第二报文转发设备对流向所述目的地IP地址的流量进行报文丢弃处理；
所述本地清洗响应策略用于指示所述第二报文转发设备在本地对流向所述目的地IP地址的流量进行清洗处理；
所述动态引流清洗响应策略用于指示所述第二报文转发设备将流向所述 目的地IP地址的流量发送到清洗设备上进行清洗处理。
结合第三个方面的第四种可能的实现方式，在第三个方面的第五种可能的实现方式中，所述统计数据还包含：所述第一报文转发设备的负载值；
所述处理模块，在所述发送模块向所述第二报文转发设备下发DDoS防护策略之前，还用于：
根据所述第一报文转发设备的负载值确定第一引流路径，所述第一引流路径为所述第二报文转发设备至所述清洗设备之间负载最小的路径；所述第一引流路径包含所述第二报文转发设备和所述清洗设备；
则所述发送模块根据所述处理模块确定的所述第一引流路径，向所述第二报文转发设备下发的DDoS防护策略为所述动态引流清洗响应策略，所述动态引流清洗响应策略包含第一引流路径指示信息，所述第一引流路径指示信息用于指示所述第二报文转发设备将所述流向所述目的地IP地址的流量通过所述第一引流路径发送到所述清洗设备上进行清洗处理。
结合第三个方面的第四种可能的实现方式，在第三个方面的第六种可能的实现方式中，所述处理模块，在所述发送模块向所述第二报文转发设备下发DDoS防护策略之前，还用于：
根据SDN拓扑关系确定第二引流路径，所述第二引流路径为所述第二报文转发设备至所述清洗设备之间距离最近的路径，所述SDN拓扑关系包含所述SDN中各个报文转发设备以及所述清洗设备的连接关系；
则所述发送模块根据所述处理模块确定的所述第二引流路径，向所述第二报文转发设备下发DDoS防护策略为所述动态引流清洗响应策略，所述动态引流清洗响应策略包含第二引流路径指示信息，所述第二引流路径指示信息用于指示所述第二报文转发设备将所述流向所述目的地IP地址的流量通过所述第二引流路径发送到所述清洗设备上进行清洗处理。
本发明的第四个方面是提供一种报文转发设备，所述报文转发设备应用于SDN系统中，所述SDN系统包括控制器和所述报文转发设备，所述报文转发设备，包括：
接收模块，用于接收所述控制器发送的流量统计指令，所述流量统计指令用于指示处理模块进行流量统计；其中，所述流量统计指令携带目的地IP地址；
所述处理模块，用于根据所述接收模块接收的所述流量统计指令统计流向所述目的地IP地址的流量统计信息；
发送模块，用于根据所述处理模块统计的所述流向所述目的地IP地址的流量统计信息，向所述控制器上报统计数据，所述统计数据包含所述流向所述目的地IP地址的流量统计信息。
结合第四个方面，在第四个方面的第一种可能的实现方式中，所述流量统计指令还携带：检测起始时刻；
其中，所述检测起始时刻用于告知所述处理模块进行所述流量统计的起始时刻，以检测周期的方式持续进行所述流量统计，以所述检测周期上报所述统计数据给所述控制器。
结合第四个方面或第四个方面的第一种可能的实现方式，在第四个方面的第二种可能的实现方式中，所述接收模块，在所述发送模块向所述控制器上报统计数据之后，还用于：
接收所述控制器发送的DDoS防护策略；
所述处理模块，还用于根据所述接收模块接收的所述DDoS防护策略，对所述流向所述目的地IP地址的流量进行防护处理。
结合第四个方面的第二种可能的实现方式，在第四个方面的第三种可能的实现方式中，所述接收模块，在所述接收所述控制器发送的DDoS防护策略之后，还用于：
接收所述控制器发送的防护消除指示消息；所述防护消除指示消息用于指示所述处理模块结束执行所述DDoS防护策略；
所述处理模块，还用于根据所述接收模块接收的所述防护消除指示消息停止对所述流向所述目的地IP地址的流量进行防护处理。
结合第四个方面的第一种可能的实现方式或第四个方面的第二种可能的实现方式，在第四个方面的第四种可能的实现方式中，所述DDoS防护策略包含如下任意一种响应策略：黑洞路由响应策略、限流响应策略、限速响应策略、丢弃响应策略、本地清洗响应策略、动态引流清洗响应策略；
其中，所述黑洞路由响应策略用于指示所述处理模块通过配置黑洞路由对所述流向所述目的地IP地址的流量进行报文丢弃处理；
则所述处理模块根据所述DDoS防护策略对所述流向所述目的地IP地址 的流量进行防护处理，具体为：根据所述接收模块接收的所述黑洞路由响应策略采用黑洞路由对所述流向所述目的地IP地址的流量进行报文丢弃处理；
所述限流响应策略用于指示所述处理模块对所述流向所述目的地IP地址的流量进行限流处理；
则所述处理模块根据所述DDoS防护策略对所述流向所述目的地IP地址的流量进行防护处理，具体为：根据所述接收模块接收的所述限流响应策略对所述流向所述目的地IP地址的流量进行限流处理；
所述限速响应策略用于指示所述处理模块对所述流向所述目的地IP地址的流量进行限速处理；
则所述处理模块根据所述DDoS防护策略对所述流向所述目的地IP地址的流量进行防护处理，具体为：根据所述接收模块接收的所述限速响应策略对所述流向所述目的地IP地址的流量进行限速处理；
所述丢弃响应策略用于指示所述处理模块对所述流向所述目的地IP地址的流量进行报文丢弃处理；
则所述处理模块根据所述DDoS防护策略对所述流向所述目的地IP地址的流量进行防护处理，具体为：根据所述接收模块接收的所述丢弃响应策略对所述流向所述目的地IP地址的流量进行报文丢弃处理；
所述本地清洗响应策略用于指示所述处理模块在本地对所述流向所述目的地IP地址的流量进行清洗处理；
则所述处理模块根据所述DDoS防护策略对所述流向所述目的地IP地址的流量进行防护处理，具体为：根据所述接收模块接收的所述本地清洗响应策略在本地对所述流向所述目的地IP地址的流量进行清洗处理；
所述动态引流清洗响应策略用于指示所述处理模块将所述流向所述目的地IP地址的流量发送到清洗设备上进行清洗处理；
则所述处理模块根据所述DDoS防护策略对所述流向所述目的地IP地址的流量进行防护处理，具体为：根据所述接收模块接收的所述动态引流清洗响应策略指示所述发送模块将所述流向所述目的地IP地址的流量发送到所述清洗设备上进行清洗处理。
结合第四个方面的第四种可能的实现方式，在第四个方面的第五种可能的实现方式中，所述统计数据还包含：所述第一报文转发设备的负载值；所 述动态引流清洗响应策略包含第一引流路径指示信息，所述第一引流路径指示信息用于指示将所述流向所述目的地IP地址的流量通过所述第一引流路径发送到所述清洗设备上进行清洗处理；所述第一引流路径为所述报文转发设备至所述清洗设备之间负载最小的路径；所述第一引流路径包含所述第二报文转发设备和所述清洗设备；
则所述处理模块根据所述接收模块接收的所述动态引流清洗响应策略指示所述发送模块将所述流向所述目的地IP地址的流量发送到所述清洗设备上进行清洗处理，具体为：
根据所述接收模块接收的所述动态引流清洗响应策略，指示所述发送模块将所述流向所述目的地IP地址的流量通过所述第一引流路径发送到所述清洗设备上进行清洗处理。
结合第四个方面的第四种可能的实现方式，在第四个方面的第六种可能的实现方式中，所述动态引流清洗响应策略包含第二引流路径指示信息，所述第二引流路径指示信息用于指示将所述流向所述目的地IP地址的流量通过所述第二引流路径发送到所述清洗设备上进行清洗处理；所述第二引流路径为所述报文转发设备至所述清洗设备之间距离最近的路径；
则所述处理模块根据所述接收模块接收的所述动态引流清洗响应策略指示所述发送模块将所述流向所述目的地IP地址的流量发送到所述清洗设备上进行清洗处理，具体为：
根据所述接收模块接收的所述动态引流清洗响应策略，指示所述发送模块将所述流向所述目的地IP地址的流量通过所述第二引流路径发送到所述清洗设备上进行清洗处理。
本发明的第五个方面是提供一种SDN系统，包括：控制器、第一报文转发设备和第二报文转发设备；
其中，所述控制器，用于：
向所述第一报文转发设备下发流量统计指令，所述流量统计指令用于指示所述第一报文转发设备进行流量统计；所述流量统计指令携带目的地IP地址；
收集所述第一报文转发设备根据所述流量统计指令上报的统计数据，所述统计数据包含流向所述目的地IP地址的流量统计信息；
根据所述统计数据，获得流向所述目的地IP地址的全局流量统计值；
其中，所述全局流量统计值表示所述控制器对包括所述第一报文转发设备在内的至少两个报文转发设备上报的统计数据进行汇总后，获得的用于反映所述SDN范围内流向所述目的地IP地址的流量的统计值；
判断所述全局流量统计值是否超过预定阈值，基于所述全局流量统计值超过预定阈值的判断结果，向所述第二报文转发设备下发DDoS防护策略；
所述第一报文转发设备，用于：
接收所述控制器发送的所述流量统计指令；
根据所述流量统计指令统计所述流向所述目的地IP地址的流量统计信息；
向所述控制器上报所述统计数据；
所述第二报文转发设备，用于：
接收所述控制器发送的所述DDoS防护策略；
根据所述DDoS防护策略对所述流向所述目的地IP地址的流量进行防护处理。
结合第五个方面，在第五个方面的第一种可能的实现方式中，所述流量统计指令还携带：检测起始时刻；
其中，所述检测起始时刻用于告知所述第一报文转发设备进行所述流量统计的起始时刻，所述流量统计被所述第一报文转发设备以检测周期的方式持续执行，所述统计数据被所述第一报文转发设备以所述检测周期上报给所述控制器。
结合第五个方面的第一种可能的实现方式，在第五个方面的第二种可能的实现方式中，所述控制器，还用于：
确定在至少两个连续的检测周期内所述全局流量统计值未超过所述预定阈值；
向所述第二报文转发设备下发防护消除指示消息；
所述防护消除指示消息用于指示所述第二报文转发设备结束执行所述DDoS防护策略；
所述第二报文转发设备，还用于：
接收所述防护消除指示消息；
结束执行所述DDoS防护策略。
结合第五个方面或第五个方面的上述任意一种可能的实现方式，在第五个方面的第三种可能的实现方式中，所述控制器，在所述向所述第二报文转发设备下发DDoS防护策略之前，还用于：
根据所述统计数据，确定攻击路径上距离攻击源最近的报文转发设备，将所述距离攻击源最近的报文转发设备作为所述第二报文转发设备。
结合第五个方面的第三种可能的实现方式，在第五个方面的第四种可能的实现方式中，所述流向所述目的地IP地址的流量统计信息，包括：所述第一报文转发设备上流向所述目的地IP地址的流量值；
所述控制器根据所述统计数据，确定攻击路径上距离攻击源最近的报文转发设备，具体为：
根据所述第一报文转发设备上流向所述目的地IP地址的流量值，确定第一攻击路径；
所述第一攻击路径为流向所述目的地IP地址的至少一条攻击路径中流量值最大的攻击路径；
根据所述第一攻击路径，确定所述距离攻击源最近的报文转发设备；
所述距离攻击源最近的报文转发设备位于所述第一攻击路径上的、所述流向所述目的地IP地址的流量的源地址侧的SDN边界处。
结合第五个方面或第五个方面的上述任意一种可能的实现方式，在第五个方面的第五种可能的实现方式中，所述DDoS防护策略包含如下任意一种响应策略：黑洞路由响应策略、限流响应策略、限速响应策略、丢弃响应策略、本地清洗响应策略、动态引流清洗响应策略；
其中，所述黑洞路由响应策略用于指示所述第二报文转发设备通过配置黑洞路由对流向所述目的地IP地址的流量进行报文丢弃处理；
则所述第二报文转发设备根据所述DDoS防护策略对流向所述目的地IP地址的流量进行防护处理，具体为：根据所述黑洞路由响应策略采用黑洞路由对流向所述目的地IP地址的流量进行报文丢弃处理；
所述限流响应策略用于指示所述第二报文转发设备对流向所述目的地IP地址的流量进行限流处理；
则所述第二报文转发设备根据所述DDoS防护策略对流向所述目的地IP 地址的流量进行防护处理，具体为：根据所述限流响应策略对流向所述目的地IP地址的流量进行限流处理；
所述限速响应策略用于指示所述第二报文转发设备对流向所述目的地IP地址的流量进行限速处理；
则所述第二报文转发设备根据所述DDoS防护策略对流向所述目的地IP地址的流量进行防护处理，具体为：根据所述限速响应策略对流向所述目的地IP地址的流量进行限速处理；
所述丢弃响应策略用于指示所述第二报文转发设备对流向所述目的地IP地址的流量进行报文丢弃处理；
则所述第二报文转发设备根据所述DDoS防护策略对流向所述目的地IP地址的流量进行防护处理，具体为：根据所述丢弃响应策略对流向所述目的地IP地址的流量进行报文丢弃处理；
所述本地清洗响应策略用于指示所述第二报文转发设备在本地对流向所述目的地IP地址的流量进行清洗处理；
则所述第二报文转发设备根据所述DDoS防护策略对流向所述目的地IP地址的流量进行防护处理，具体为：根据所述本地清洗响应策略对流向所述目的地IP地址的流量进行清洗处理；
所述动态引流清洗响应策略用于指示所述第二报文转发设备将流向所述目的地IP地址的流量发送到清洗设备上进行清洗处理；
则所述第二报文转发设备根据所述DDoS防护策略对流向所述目的地IP地址的流量进行防护处理，具体为：根据所述动态引流清洗响应策略将流向所述目的地IP地址的流量发送到清洗设备上进行清洗处理。
结合第五个方面的第五种可能的实现方式，在第五个方面的第六种可能的实现方式中，所述统计数据还包含：所述第一报文转发设备的负载值；
所述控制器，在所述向所述第二报文转发设备下发DDoS防护策略之前，还用于：
根据所述第一报文转发设备的负载值确定第一引流路径，所述第一引流路径为所述第二报文转发设备至所述清洗设备之间负载最小的路径；所述第一引流路径包含所述第二报文转发设备和所述清洗设备；
向所述第二报文转发设备下发的DDoS防护策略为所述动态引流清洗响 应策略，所述动态引流清洗响应策略包含第一引流路径指示信息，所述第一引流路径指示信息用于指示所述第二报文转发设备将所述流向所述目的地IP地址的流量通过所述第一引流路径发送到所述清洗设备上进行清洗处理；
所述第二报文转发设备根据所述DDoS防护策略对流向所述目的地IP地址的流量进行防护处理，具体为：
将所述流向所述目的地IP地址的流量通过所述第一引流路径发送到所述清洗设备上进行清洗处理。
结合第五个方面的第五种可能的实现方式，在第五个方面的第七种可能的实现方式中，所述控制器，在所述向所述第二报文转发设备下发DDoS防护策略之前，还用于：
根据SDN拓扑关系确定第二引流路径，所述第二引流路径为所述第二报文转发设备至所述清洗设备之间距离最近的路径，所述SDN拓扑关系包含所述SDN中各个报文转发设备以及所述清洗设备的连接关系；
向所述第二报文转发设备下发DDoS防护策略为所述动态引流清洗响应策略，所述动态引流清洗响应策略包含第二引流路径指示信息，所述第二引流路径指示信息用于指示所述第二报文转发设备将所述流向所述目的地IP地址的流量通过所述第二引流路径发送到所述清洗设备上进行清洗处理；
所述第二报文转发设备根据所述DDoS防护策略对流向所述目的地IP地址的流量进行防护处理，具体为：
将所述流向所述目的地IP地址的流量通过所述第二引流路径发送到所述清洗设备上进行清洗处理。
本发明的第六个方面是提供一种控制器，包括：处理器、存储器、收发器和总线；
其中，所述收发器，包括：南向接口单元；
所述南向接口单元，用于：
向第一报文转发设备下发流量统计指令，所述流量统计指令用于指示所述第一报文转发设备进行流量统计；其中，所述流量统计指令携带目的地IP地址；
收集所述第一报文转发设备根据所述流量统计指令上报的统计数据，所述统计数据包含流向所述目的地IP地址的流量统计信息；
处理器，用于：
根据所述接收模块接收到的所述统计数据，获得流向所述目的地IP地址的所述全局流量统计值；
其中，所述全局流量统计值表示所述控制器对包括所述第一报文转发设备在内的至少两个报文转发设备上报的统计数据进行汇总后，获得的用于反映所述SDN范围内流向所述目的地IP地址的流量的统计值；
判断所述全局流量统计值是否超过预定阈值；
所述南向接口单元，还用于基于处理器确定的全局流量统计值超过预定阈值的判断结果，向第二报文转发设备下发DDoS防护策略；
所述存储器，用于存储所述统计数据、所述DDoS防护策略。
结合第六个方面，在第六个方面的第一种可能的实现方式中，所述流量统计指令还携带：检测起始时刻；
其中，所述检测起始时刻用于告知所述第一报文转发设备进行所述流量统计的起始时刻，所述流量统计被所述第一报文转发设备以检测周期的方式持续执行，所述统计数据被所述第一报文转发设备以所述检测周期上报给所述控制器；
所述处理器，还用于：
确定在至少两个检测周期内所述全局流量统计值未超过所述预定阈值；
所述南向接口单元，还用于基于所述处理器确定的至少两个连续的检测周期内所述全局流量统计值未超过所述预定阈值的结果，向所述第二报文转发设备下发防护消除指示消息；
所述防护消除指示消息用于指示所述报文转发设备结束执行所述DDoS防护策略。
结合第六个方面或第六个方面的第一种可能的实现方式，在第六个方面的第二种可能的实现方式中，所述处理器在所述南向接口单元向所述第二报文转发设备下发DDoS防护策略之前，还用于：
根据所述南向接口单元接收的所述统计数据，确定攻击路径上距离攻击源最近的报文转发设备，将所述距离攻击源最近的报文转发设备作为所述第二报文转发设备。
所述南向接口单元，还用于向所述第二报文转发设备下发DDoS防护策 略。
结合第六个方面的第二种可能的实现方式，在第六个方面的第三种可能的实现方式中，所述流向所述目的地IP地址的流量统计信息，包括：所述第一报文转发设备上流向所述目的地IP地址的流量值；
所述处理器，根据所述南向接口单元接收的所述统计数据，确定攻击路径上距离攻击源最近的报文转发设备，具体为：
根据所述南向接口单元接收的所述第一报文转发设备上流向所述目的地IP地址的流量值，确定第一攻击路径；
所述第一攻击路径为流向所述目的地IP地址的至少一条攻击路径中流量值最大的攻击路径；
根据所述第一攻击路径，确定所述距离攻击源最近的报文转发设备；
所述距离攻击源最近的报文转发设备位于所述第一攻击路径上的、所述流向所述目的地IP地址的流量的源地址侧的SDN边界处。
结合第六个方面或第六个方面的上述任意一种可能的实现方式，在第六个方面的第四种可能的实现方式中，所述DDoS防护策略包含如下任意一种响应策略：黑洞路由响应策略、限流响应策略、限速响应策略、丢弃响应策略、本地清洗响应策略、动态引流清洗响应策略；
其中，所述黑洞路由响应策略用于指示所述第二报文转发设备通过配置黑洞路由对流向所述目的地IP地址的流量进行报文丢弃处理；
所述限流响应策略用于指示所述第二报文转发设备对流向所述目的地IP地址的流量进行限流处理；
所述限速响应策略用于指示所述第二报文转发设备对流向所述目的地IP地址的流量进行限速处理；
所述丢弃响应策略用于指示所述第二报文转发设备对流向所述目的地IP地址的流量进行报文丢弃处理；
所述本地清洗响应策略用于指示所述第二报文转发设备在本地对流向所述目的地IP地址的流量进行清洗处理；
所述动态引流清洗响应策略用于指示所述第二报文转发设备将流向所述目的地IP地址的流量发送到清洗设备上进行清洗处理。
结合第六个方面的第四种可能的实现方式，在第六个方面的第五种可能 的实现方式中，所述统计数据还包含：所述第一报文转发设备的负载值；
所述处理器，在所述南向接口单元向所述第二报文转发设备下发DDoS防护策略之前，还用于：
根据所述第一报文转发设备的负载值确定第一引流路径；
其中，所述第一引流路径为所述第二报文转发设备至所述清洗设备之间负载最小的路径；所述第一引流路径包含所述第二报文转发设备和所述清洗设备；
则所述南向接口单元根据所述处理器确定的所述第一引流路径，向所述第二报文转发设备下发的DDoS防护策略为动态引流清洗响应策略，所述动态引流清洗响应策略包含第一引流路径指示信息，所述第一引流路径指示信息用于指示所述第二报文转发设备将所述流向所述目的地IP地址的流量通过所述第一引流路径发送到所述清洗设备上进行清洗处理。
结合第六个方面的第四种可能的实现方式，在第六个方面的第六种可能的实现方式中，所述处理器，在所述南向接口单元向所述第二报文转发设备下发DDoS防护策略之前，还用于：
根据SDN拓扑关系确定第二引流路径，所述第二引流路径为所述第二报文转发设备至所述清洗设备之间距离最近的路径，所述SDN拓扑关系包含所述SDN中各个报文转发设备以及所述清洗设备的连接关系；
则所述南向接口单元根据所述处理器确定的所述第二引流路径，向所述第二报文转发设备下发DDoS防护策略为动态引流清洗响应策略，所述动态引流清洗响应策略包含第二引流路径指示信息，所述第二引流路径指示信息用于指示所述第二报文转发设备将所述流向所述目的地IP地址的流量通过所述第二引流路径发送到所述清洗设备上进行清洗处理。
本发明的第七个方面是提供一种报文转发设备，所述报文转发设备应用于SDN系统中，所述SDN系统包括控制器和所述报文转发设备，所述报文转发设备，包括：处理器、存储器、收发器和总线；
其中，所述收发器，包括：北向接口单元；
所述北向接口单元，用于接收所述控制器发送的流量统计指令，所述流量统计指令用于指示处理模块进行流量统计；其中，所述流量统计指令携带目的地IP地址；
所述处理器，用于根据所述北向接口单元接收的所述流量统计指令统计流向所述目的地IP地址的流量统计信息；
所述北向接口单元，还用于根据所述处理器统计的所述流向所述目的地IP地址的流量统计信息，向所述控制器上报统计数据，所述统计数据包含所述流向所述目的地IP地址的流量统计信息；
所述存储器，用于存储所述流量统计指令和所述流向所述目的地IP地址的流量统计信息。
结合第七个方面，在第七个方面的第一种可能的实现方式中，所述流量统计指令还携带：检测起始时刻；
其中，所述检测起始时刻用于告知所述处理器进行所述流量统计的起始时刻，以检测周期的方式持续进行所述流量统计，以所述检测周期上报所述统计数据给所述控制器。
结合第七个方面或第七个方面的第一种可能的实现方式，在第二种可能的实现方式中，所述北向接口单元，在向所述控制器上报统计数据之后，还用于接收所述控制器发送的DDoS防护策略；
所述处理器，还用于根据所述北向接口单元接收的所述DDoS防护策略，对所述流向所述目的地IP地址的流量进行防护处理。
结合第七个方面的第二种可能的实现方式，在第七个方面的第三种可能的实现方式中，
所述北向接口单元，在接收所述控制器发送的DDoS防护策略之后，还用于：
接收所述控制器发送的防护消除指示消息；所述防护消除指示消息用于指示所述处理器结束执行所述DDoS防护策略；
所述处理器，还用于根据所述北向接口单元接收的所述防护消除指示消息停止对所述流向所述目的地IP地址的流量进行防护处理。
结合第七个方面的第一种可能的实现方式或第七个方面的第二种可能的实现方式，在第七个方面的第四种可能的实现方式中，所述DDoS防护策略包含如下任意一种响应策略：黑洞路由响应策略、限流响应策略、限速响应策略、丢弃响应策略、本地清洗响应策略、动态引流清洗响应策略；
其中，所述黑洞路由响应策略用于指示所述处理器通过配置黑洞路由对 所述流向所述目的地IP地址的流量进行报文丢弃处理；
则所述处理器根据所述DDoS防护策略对所述流向所述目的地IP地址的流量进行防护处理，具体为：根据所述北向接口单元接收的所述黑洞路由响应策略采用黑洞路由对所述流向所述目的地IP地址的流量进行报文丢弃处理；
所述限流响应策略用于指示所述处理器对所述流向所述目的地IP地址的流量进行限流处理；
则所述处理器根据所述DDoS防护策略对所述流向所述目的地IP地址的流量进行防护处理，具体为：根据所述北向接口单元接收的所述限流响应策略对所述流向所述目的地IP地址的流量进行限流处理；
所述限速响应策略用于指示所述处理器对所述流向所述目的地IP地址的流量进行限速处理；
则所述处理器根据所述DDoS防护策略对所述流向所述目的地IP地址的流量进行防护处理，具体为：根据所述北向接口单元接收的所述限速响应策略对所述流向所述目的地IP地址的流量进行限速处理；
所述丢弃响应策略用于指示所述处理器对所述流向所述目的地IP地址的流量进行报文丢弃处理；
则所述处理器根据所述DDoS防护策略对所述流向所述目的地IP地址的流量进行防护处理，具体为：根据所述北向接口单元接收的所述丢弃响应策略对所述流向所述目的地IP地址的流量进行报文丢弃处理；
所述本地清洗响应策略用于指示所述处理器在本地对所述流向所述目的地IP地址的流量进行清洗处理；
则所述处理器根据所述DDoS防护策略对所述流向所述目的地IP地址的流量进行防护处理，具体为：根据所述北向接口单元接收的所述本地清洗响应策略在本地对所述流向所述目的地IP地址的流量进行清洗处理；
所述动态引流清洗响应策略用于指示所述处理器将所述流向所述目的地IP地址的流量发送到清洗设备上进行清洗处理；
则所述处理器根据所述DDoS防护策略对所述流向所述目的地IP地址的流量进行防护处理，具体为：根据所述北向接口单元接收的所述动态引流清洗响应策略指示所述北向接口单元将所述流向所述目的地IP地址的流量发送 到所述清洗设备上进行清洗处理。
结合第七个方面的第四种可能的实现方式，在第七个方面的第五种可能的实现方式中，所述统计数据还包含：所述第一报文转发设备的负载值；
所述动态引流清洗响应策略包含第一引流路径指示信息，所述第一引流路径指示信息用于指示将所述流向所述目的地IP地址的流量通过所述第一引流路径发送到所述清洗设备上进行清洗处理；所述第一引流路径为所述报文转发设备至所述清洗设备之间负载最小的路径；所述第一引流路径包含所述第二报文转发设备和所述清洗设备；
则所述处理器根据所述北向接口单元接收的所述动态引流清洗响应策略指示所述北向接口单元将所述流向所述目的地IP地址的流量发送到所述清洗设备上进行清洗处理，具体为：
根据所述北向接口单元接收的所述动态引流清洗响应策略，指示所述北向接口单元将所述流向所述目的地IP地址的流量通过所述第一引流路径发送到所述清洗设备上进行清洗处理。
结合第七个方面的第四种可能的实现方式，在第七个方面的第六种可能的实现方式中，所述动态引流清洗响应策略包含第二引流路径指示信息，所述第二引流路径指示信息用于指示将所述流向所述目的地IP地址的流量通过所述第二引流路径发送到所述清洗设备上进行清洗处理；所述第二引流路径为所述报文转发设备至所述清洗设备之间距离最近的路径；
则所述处理器根据所述北向接口单元接收的所述动态引流清洗响应策略指示所述北向接口单元将所述流向所述目的地IP地址的流量发送到所述清洗设备上进行清洗处理，具体为：
根据所述北向接口单元接收的所述动态引流清洗响应策略，指示所述北向接口单元将所述流向所述目的地IP地址的流量通过所述第二引流路径发送到所述清洗设备上进行清洗处理。
本发明实施例提供的基于SDN的DDOS攻击防护方法、装置及系统，通过控制器向所述第一报文转发设备下发流量统计指令，所述流量统计指令用于指示所述第一报文转发设备进行流量统计；所述流量统计指令携带目的地IP地址；控制器收集所述第一报文转发设备根据所述流量统计指令上报的统计数据，所述统计数据包含流向所述目的地IP地址的流量统计信息；控制器 根据所述统计数据，获得流向所述目的地IP地址的全局流量统计值；并判断所述全局流量统计值是否超过预定阈值，基于所述全局流量统计值超过预定阈值的判断结果，向所述第二报文转发设备下发DDoS防护策略；相应的，所述第一报文转发设备接收所述控制器发送的所述流量统计指令；并根据所述流量统计指令统计所述流向所述目的地IP地址的流量统计信息；最终向所述控制器上报所述统计数据；相应的，所述第二报文转发设备，接收所述控制器发送的所述DDoS防护策略；根据所述DDoS防护策略对所述流向所述目的地IP地址的流量进行防护处理。降低了DDoS攻击对网络的影响范围，提高了网络安全性。
附图说明
为了更清楚地说明本发明实施例或现有技术中的技术方案，下面将对实施例或现有技术描述中所需要使用的附图做一简单地介绍，显而易见地，下面描述中的附图是本发明的一些实施例，对于本领域普通技术人员来讲，在不付出创造性劳动性的前提下，还可以根据这些附图获得其他的附图。
图1为DDoS攻击的示意图；
图2为本发明实施例提供的一种基于SDN网络的DDoS攻击防护系统部署示意图；
图3为本发明实施例提供的一种SDN系统的部署示意图；
图4为本发明实施例提供的一种控制器的结构示意图；
图5为本发明实施例提供的一种报文转发设备的结构示意图；
图6为本发明实施例提供的一种独立的调度设备的结构示意图；
图7为本发明实施例提供的一种控制器的结构示意图；
图8为本发明实施例提供的另一种报文转发设备的结构示意图；
图9为本发明实施例提供的一种基于SDN的DDOS攻击防护方法的流程示意图；
图10为本发明实施例提供的另一种基于SDN的DDoS攻击防护方法的流程示意图；
图11为本发明实施例提供的另一种基于SDN的DDoS攻击防护方法的 流程示意图；
图12为本发明实施例提供的另一种基于SDN的DDoS攻击防护方法的流程示意图；
图13为攻击路径及最近攻击源头判定示意图；
图14为本发明实施例提供的另一种基于SDN的DDoS攻击防护方法的流程示意图
图15为本发明实施例提供的另一种基于SDN的DDoS攻击防护方法的流程示意图；
图16为本发明实施例提供的另一种基于SDN的DDoS攻击防护方法的流程示意图；
图17为本发明实施例提供的另一种基于SDN的DDoS攻击防护方法的流程示意图；
图18为本发明实施例提供的另一种基于SDN的DDoS攻击防护方法的流程示意图；
图19为本地清洗处理流程示意图；
图20为本发明实施例提供的一种基于SDN的DDoS攻击防护方法的交互流程示意图；
图21为本发明实施例提供的另一种基于SDN网络的DDoS攻击防护方法的交互示意图。
具体实施方式
为使本发明实施例的目的、技术方案和优点更加清楚，下面将结合本发明实施例中的附图，对本发明实施例中的技术方案进行清楚、完整地描述，显然，所描述的实施例是本发明一部分实施例，而不是全部的实施例。基于本发明中的实施例，本领域普通技术人员在没有做出创造性劳动前提下所获得的所有其他实施例，都属于本发明保护的范围。
本发明提供了一种基于SDN的DDoS攻击防护的技术方案。SDN中的控制器指示报文转发设备进行基于目的IP的流量统计，通过控制器收集报文转发设备的统计数据，并判定是否发生网络攻击；若判断发生攻击，本方案提供多种可能的DDoS防护方式。例如，由于SDN支持网络拓扑、状态的集中 管理，控制器具有感知全局拓扑的能力，因此控制器能够获知哪些报文转发设备用于与其他网络连接，即获知哪些报文转发设备位于SDN的边界；从而指示位于SDN边界靠近攻击源的报文转发设备对攻击流量进行限流或丢弃或阻断，或者，控制器指示将疑似攻击流量引流至专业的清洗设备，对该疑似攻击流量进行清洗，从而降低攻击流量在对网络影响。
图2为本发明实施例提供的一种基于SDN网络的DDoS攻击防护系统部署示意图。参照图2，该系统包括：报文转发设备、控制器、清洗设备。
其中，控制器通过南向接口与报文转发设备及清洗设备进行通信，南向接口可以为Open Flow协议、转发件和控制件的分离(Forwarding and Control Element Separation，简称：ForCES)协议、路径计算件(Path Computation Element-Communication Protocol，简称：PCE-P)协议等。
可选的，当SDN中只有一个控制器时，该控制器可以具有控制器调度功能，控制器调度功能用于对整个SDN中的报文转发设备进行管控与调度，包括链路发现、拓扑管理、策略制定、表项下发等功能。
或者，对于SDN中多个控制器组成的集群，可以将控制器调度功能单独设置在一个独立的调度设备上，例如在多个控制器中选举一个控制器作为主控制器，该主控制器既可以作为该独立的调度设备，由该主控制器通过东西向接口与各个控制器进行通信。该主控制器主要负责生成和维护全网范围内副控制器、报文转发设备及清洗设备的状态信息，一旦出现失效，则从集群的其他副控制器中选举一个成为新的主控制器。并且控制器的集群对报文转发设备及清洗设备是透明的，即在SDN的运行过程中，报文转发设备及清洗设备无需关心其接收的是哪一台控制器发来的命令，同时在其向控制器发送数据包时，能保持之前单一控制器的操作方式，从而保证控制器在逻辑上的集中。目前，用于多个控制器以及调度设备之间沟通和联系的东西向接口还未具有明确的定义标准，通常可以利用现有成熟的集群技术，例如服务器集群技术，来实现东西向接口的通信。
进一步的，控制器可以装载DDoS控制程序，控制器执行DDoS控制程序以实现上述DDoS防护方案的相关配置，可选的，该DDoS控制程序还可以装载在其他用户设备上，用户通过用户设备的应用调用DDoS控制程序，用户设备执行DDoS控制程序，并与控制器进行交互，以实现上述DDOS防 护方案的相关配置。其中，控制器与用户设备通过控制器的北向接口进行通信。需要说明的是，北向接口的协议制定基于不同的需求可以有多种方案。例如应用编程接口(REST Application Programming Interface，简称：REST API)就是一种常用的北向接口形式。部分传统的网络设备厂商在其现有设备上提供了编程接口供业务应用直接调用，也可被视作是北向接口，其目的是在不改变其现有设备架构的条件下提升配置管理灵活性，应对开放协议的竞争。
报文转发设备可以是转发器，也可以为传统网络中的交换机、路由器、防火墙等设备，该报文转发设备具有流量监测功能和清洗功能。
其中，报文转发设备的流量监测功能用于基于控制器下发的流量统计指令对流经该报文转发设备的流量进行监控，该流量统计指令携带目的地IP地址，该目的地IP地址可以为需要保护的某个服务器的一个IP地址或一段IP地址段；而报文转发设备的流量监测功能会检测流向所述目的地IP地址的流量统计信息，并将统计数据上报给控制器。
报文转发设备的清洗功能用于当控制器下发攻击防护策略时，例如DDoS防护策略，基于攻击防护策略对疑似攻击流量进行清洗处理，剔除其中可疑的攻击流量。
另外，基于不同的攻击防护策略，报文转发设备可以进行流量的限流或丢弃或阻断；或者，将疑似攻击流量引流至清洗设备。
需要说明的是，对于本发明实施例提供的方案，在网络攻击防护过程中，基于不同环节的不同功能，可以将报文转发设备划分成两类：第一报文转发设备和第二报文转发设备。
其中，第一报文转发设备具有流量监测功能，SDN系统的全部报文转发设备都可以作为第一报文转发设备；第二报文转发设备具有清洗功能。例如，为了有效的对疑似攻击流量进行防护处理，控制器会指示位于SDN边界靠近攻击源的报文转发设备对攻击流量进行防护处理，对于这种场景，位于SDN边界靠近攻击源的报文转发设备即为上述第二报文转发设备；通常情况下，第二报文转发设备也会具有流量监测功能，即第一报文转发设备和第二报文转发设备可以为同一个实体设备，也可以为不同的实体设备。
清洗设备，用于接收报文转发设备引流的疑似攻击流量，并对该疑似攻击流量进行清洗，并将清洗后的流量回注到SDN中。
需要说明的是，本发明实施例提供的引流方案与现有的引流方案相比，优势在于：由于SDN中控制器具有链路发现和拓扑管理的功能，因此，在采用引流方案时，控制器可以根据SDN拓扑关系或统计数据配置第二报文转发设备采用对SDN网络冲击最小的路径，将疑似攻击流量引流至清洗设备。例如，选择距离清洗设备最近的路径进行引流；或者，选择负载较小的路径进行引流；从而降低了现有技术中由于引流而增加的攻击影响。即，本发明提供的引流方案可以基于SDN的链路状况随时进行动态调整，故在下文中将这种方案对应的策略命名为动态引流清洗响应策略。
进一步的，图3为本发明实施例提供的一种SDN系统的部署示意图，参照图3，该SDN系统，包括：控制器、第一报文转发设备和第二报文转发设备；
其中，所述控制器，用于：
向所述第一报文转发设备下发流量统计指令，所述流量统计指令用于指示所述第一报文转发设备进行流量统计；所述流量统计指令携带目的地IP地址；
收集所述第一报文转发设备根据所述流量统计指令上报的统计数据，所述统计数据包含流向所述目的地IP地址的流量统计信息；
根据所述统计数据，获得流向所述目的地IP地址的全局流量统计值；
其中，所述全局流量统计值表示所述控制器对包括所述第一报文转发设备在内的至少两个报文转发设备上报的统计数据进行汇总后，获得的用于反映所述SDN范围内流向所述目的地IP地址的流量的统计值；
判断所述全局流量统计值是否超过预定阈值，基于所述全局流量统计值超过预定阈值的判断结果，向所述第二报文转发设备下发DDoS防护策略；
所述第一报文转发设备，用于：
接收所述控制器发送的所述流量统计指令；
根据所述流量统计指令统计所述流向所述目的地IP地址的流量统计信息；
向所述控制器上报所述统计数据；
所述第二报文转发设备，用于：
接收所述控制器发送的所述DDoS防护策略；
根据所述DDoS防护策略对所述流向所述目的地IP地址的流量进行防护处理。
本发明实施例提供的SDN系统，通过控制器向所述第一报文转发设备下发流量统计指令，所述流量统计指令用于指示所述第一报文转发设备进行流量统计；所述流量统计指令携带目的地IP地址；控制器收集所述第一报文转发设备根据所述流量统计指令上报的统计数据，所述统计数据包含流向所述目的地IP地址的流量统计信息；控制器根据所述统计数据，获得流向所述目的地IP地址的全局流量统计值；并判断所述全局流量统计值是否超过预定阈值，基于所述全局流量统计值超过预定阈值的判断结果，向所述第二报文转发设备下发DDoS防护策略；相应的，所述第一报文转发设备接收所述控制器发送的所述流量统计指令；并根据所述流量统计指令统计所述流向所述目的地IP地址的流量统计信息；最终向所述控制器上报所述统计数据；相应的，所述第二报文转发设备，接收所述控制器发送的所述DDoS防护策略；根据所述DDoS防护策略对所述流向所述目的地IP地址的流量进行防护处理。降低了DDoS攻击对网络的影响范围，提高了网络安全性。
可选的，所述流量统计指令还携带：检测起始时刻；
其中，所述检测起始时刻用于告知所述第一报文转发设备进行所述流量统计的起始时刻，所述流量统计被所述第一报文转发设备以检测周期的方式持续执行，所述统计数据被所述第一报文转发设备以所述检测周期上报给所述控制器。
进一步的，控制器需要一种判断网络攻击是否停止的机制，一种可能的实现方式为：
确定在至少两个连续的检测周期内所述全局流量统计值未超过所述预定阈值；
向所述第二报文转发设备下发防护消除指示消息；
所述防护消除指示消息用于指示所述第二报文转发设备结束执行所述DDoS防护策略；
所述第二报文转发设备，还用于：
接收所述防护消除指示消息；
结束执行所述DDoS防护策略。
可选的，控制器还可以针对位于SDN边界靠近攻击源的报文转发设备下发DDoS防护策略，一种可能的实现方式为：
所述控制器，在所述向所述第二报文转发设备下发DDoS防护策略之前，还用于：
根据所述统计数据，确定攻击路径上距离攻击源最近的报文转发设备，将所述距离攻击源最近的报文转发设备作为所述第二报文转发设备。
具体的，所述流向所述目的地IP地址的流量统计信息，包括：所述第一报文转发设备上流向所述目的地IP地址的流量值；所述控制器根据所述统计数据，确定攻击路径上距离攻击源最近的报文转发设备，具体为：
根据所述第一报文转发设备上流向所述目的地IP地址的流量值，确定第一攻击路径；
所述第一攻击路径为流向所述目的地IP地址的至少一条攻击路径中流量值最大的攻击路径；
根据所述第一攻击路径，确定所述距离攻击源最近的报文转发设备；
所述距离攻击源最近的报文转发设备位于所述第一攻击路径上的、所述流向所述目的地IP地址的流量的源地址侧的SDN边界处。
可选的，所述DDoS防护策略包含如下任意一种响应策略：黑洞路由响应策略、限流响应策略、限速响应策略、丢弃响应策略、本地清洗响应策略、动态引流清洗响应策略；
具体的，对上述响应策略进行说明。黑洞(black hole)路由指报文转发设备的访问控制列表(Access Control List，简称：ACL)中的不指向任何下一跳的路由表项。与通常的路由表项类似，黑洞路由也包括匹配项和动作。与黑洞路由的匹配项相匹配的报文将被指报文转发设备丢弃，而不会被转发至下一跳。黑洞路由中的动作可以通过多种方式来实现，例如路由设备将报文转发至以0.0.0.0为例的非法IP地址、或回环地址，也可以通过null0接口来实现。该null0为路由设备上的一个逻辑接口，null0接口总是处于“上(Up)”状态，但不转发任何报文。报文转发设备将报文转发至该报文转发设备的null0接口，null0接口接收到报文后，将报文丢弃。基于黑洞路由的上述特点，当发生网络攻击时，控制器可以配置相应的黑洞路由响应策略，并将黑洞路由响应策略下发给报文转发设备，所述黑洞路由响应策略用于指示所述第二报 文转发设备通过配置黑洞路由对流向所述目的地IP地址的流量进行报文丢弃处理，从而实现DDoS攻击防护。具体的，黑洞路由响应策略可以包含：目的地IP地址、报文支持的协议类型等信息。
则所述第二报文转发设备根据所述DDoS防护策略对所述流向所述目的地IP地址的流量进行防护处理，具体为：根据所述黑洞路由响应策略采用黑洞路由对所述流向所述目的地IP地址的流量进行报文丢弃处理；
由于，第二报文转发设备中设置黑洞路由可以实现对报文丢弃，并且无需指明丢弃的原因，可以化简处理攻击流量的复杂度，提高处理效率。
所述限流响应策略用于指示所述第二报文转发设备对所述流向所述目的地IP地址的流量进行限流处理；具体的：第二报文转发设备基于限流响应策略对单位时间内报文的收发带宽进行限制，比如每秒最多发送多少字节的报文。该限流响应策略可以包含：目的地IP地址、报文支持的协议类型、报文的五元组信息等；报文转发设备可以基于报文的五元组信息进行上述限制，例如，针对传输控制协议(Transmission Control Protocol，简称：TCP)报文和/或用户数据报协议(User Datagram Protocol，简称：UDP)报文进行上述限制，针对特定的报文的源端口进行上述限制，针对特定的报文的目的端口进行上述限制，设置特定的速率上限对报文的传输速率进行限制等。
则所述第二报文转发设备根据所述DDoS防护策略对所述流向所述目的地IP地址的流量进行防护处理，具体为：根据所述限流响应策略对所述流向所述目的地IP地址的流量进行限流处理；
所述限速响应策略用于指示所述第二报文转发设备对所述流向所述目的地IP地址的流量进行限速处理；例如，第二报文转发设备基于限速响应策略设置收发带宽的大小。
则所述第二报文转发设备根据所述DDoS防护策略对所述流向所述目的地IP地址的流量进行防护处理，具体为：根据所述限速响应策略对所述流向所述目的地IP地址的流量进行限速处理；
所述丢弃响应策略用于指示所述第二报文转发设备对所述流向所述目的地IP地址的流量进行报文丢弃处理；具体的：第二报文转发设备基于丢弃响应策略对接收到的疑似网络攻击流量的报文或准备发送的疑似网络攻击流量的报文进行丢弃。该丢弃响应策略可以包含：目的地IP地址、报文支持的协 议类型、报文的五元组信息等；该报文的五元组信息可以包含：报文的TCP信息或报文的UDP信息，报文的源端口信息，报文的目的端口信息，坏包(drop packet)信息等。
则所述第二报文转发设备根据所述DDoS防护策略对所述流向所述目的地IP地址的流量进行防护处理，具体为：根据所述丢弃响应策略对所述流向所述目的地IP地址的流量进行报文丢弃处理；
所述本地清洗响应策略用于指示所述第二报文转发设备在本地对所述流向所述目的地IP地址的流量进行清洗处理；具体的，所述本地清洗响应策略用于指示所述第二报文转发设备在本地对流向所述目的地IP地址的流量进行清洗处理；第二报文转发设备基于本地清洗响应策略在本地对接收到的疑似网络攻击流量的报文或准备发送的疑似网络攻击流量的报文进行清洗处理，可选的，该本地清洗响应策略可以包括：目的地IP地址、报文支持的协议类型、报文的五元组信息等；
则所述第二报文转发设备根据所述DDoS防护策略对所述流向所述目的地IP地址的流量进行防护处理，具体为：根据所述本地清洗响应策略在本地对所述流向所述目的地IP地址的流量进行清洗处理；
所述动态引流清洗响应策略用于指示所述第二报文转发设备将所述流向所述目的地IP地址的流量发送到清洗设备上进行清洗处理；可选的，动态引流清洗响应策略可以包含目的地IP地址和引流路径指示信息；
则所述第二报文转发设备根据所述DDoS防护策略对所述流向所述目的地IP地址的流量进行防护处理，具体为：根据所述动态引流清洗响应策略将所述流向所述目的地IP地址的流量发送到清洗设备上进行清洗处理。
对于所述动态引流清洗响应策略，在所述南向接口单元下发动态引流清洗响应策略之前，需要控制器确定一条对网络冲击最小的路径来进行流量的引流，下面给出几种可能的实现方式进行说明：
方式一：所述统计数据还包含：所述第一报文转发设备的负载值；
所述控制器，在所述向所述第二报文转发设备下发DDoS防护策略之前，还用于：
根据所述第一报文转发设备的负载值确定第一引流路径，所述第一引流路径为所述第二报文转发设备至所述清洗设备之间负载最小的路径；所述第 一引流路径包含所述第二报文转发设备和所述清洗设备；
向所述第二报文转发设备下发的DDoS防护策略为所述动态引流清洗响应策略，所述动态引流清洗响应策略包含第一引流路径指示信息，所述第一引流路径指示信息用于指示所述第二报文转发设备将所述流向所述目的地IP地址的流量通过所述第一引流路径发送到所述清洗设备上进行清洗处理；
所述第二报文转发设备根据所述DDoS防护策略对所述流向所述目的地IP地址的流量进行防护处理，具体为：
将所述流向所述目的地IP地址的流量通过所述第一引流路径发送到所述清洗设备上进行清洗处理。
方式二：，所述控制器，在所述向所述第二报文转发设备下发DDoS防护策略之前，还用于：
根据SDN拓扑关系确定第二引流路径，所述第二引流路径为所述第二报文转发设备至所述清洗设备之间距离最近的路径，所述SDN拓扑关系包含所述SDN中各个报文转发设备以及所述清洗设备的连接关系；
向所述第二报文转发设备下发DDoS防护策略为所述动态引流清洗响应策略，所述动态引流清洗响应策略包含第二引流路径指示信息，所述第二引流路径指示信息用于指示所述第二报文转发设备将所述流向所述目的地IP地址的流量通过所述第二引流路径发送到所述清洗设备上进行清洗处理；
所述第二报文转发设备根据所述DDoS防护策略对所述流向所述目的地IP地址的流量进行防护处理，具体为：
将所述流向所述目的地IP地址的流量通过所述第二引流路径发送到所述清洗设备上进行清洗处理。
在图2和图3的基础上，下面分别对基于SDN网络的DDOS攻击防护系统中的各个节点进行说明。
图4为本发明实施例提供的一种控制器的结构示意图，参照图4，该控制器包括：处理器10、存储器11、收发器12和总线13；
其中，收发器12，包括：北向接口单元12a、南向接口单元12b、东西向接口单元12c；
处理器10，用于执行DDoS控制程序获得DDoS防护配置参数，并基于DDoS防护配置参数指示南向接口单元12b与报文转发设备及清洗设备进行交 互，以实现上述DDoS防护方案的相关配置，例如，DDoS防护配置参数为目的地IP地址，处理器10指示该南向接口单元12b向第一报文转发设备下发流量统计指令，该流量统计指令携带目的地IP地址；该南向接口单元12b接收所述第一报文转发设备发送的统计数据，所述统计数据包含流向所述目的地IP地址的流量统计信息；
需要说明的是，DDoS防护配置参数可以通过北向接口单元12a从用户设备处获得。
进一步的，处理器10根据所述南向接口单元12b接收的所述统计数据，获得流向所述目的地IP地址的所述全局流量统计值；判断所述全局流量统计值是否超过预定阈值；
其中，所述全局流量统计值表示所述控制器对包括所述第一报文转发设备在内的至少两个报文转发设备上报的统计数据进行汇总后，获得的用于反映所述SDN范围内流向所述目的地IP地址的流量的统计值；
进一步的，若发生网络攻击，则基于所述全局流量统计值超过预定阈值的判断结果，处理器10指示所述南向接口单元12b向第二报文转发设备发送DDoS防护策略。
可选的，当控制器具有上文所述控制器调度功能时，处理器10直接指示南向接口单元12b与报文转发设备及清洗设备进行交互，以实现上述DDoS防护方案的相关配置；若系统中还包含上文所述独立的调度设备，则处理器10指示东西向接口单元12c与独立的调度设备进行交互，以实现上文所述控制器调度功能的相关配置。需要说明的是，北向接口单元12a和东西向接口单元12c为可选单元：对于能够自行执行DDoS控制程序的控制器来说，可以不设置北向接口单元12a；对于具有上文所述控制器调度功能的控制器来说，可以不设置东西向接口单元12c。
存储器11，用于存储DDoS防护配置参数、DDoS控制程序和第一报文转发设备上报的统计数据、DDoS防护策略等，以便处理器10在进行相应操作时进行调用。
本发明实施例提供的控制器，通过处理器指示南向接口单元向第一报文转发设备下发流量统计指令，所述流量统计指令用于指示所述第一报文转发设备进行流量统计；其中，所述流量统计指令携带目的地IP地址；南向接口 单元接收所述第一报文转发设备根据所述流量统计指令上报的统计数据，所述统计数据包含流向所述目的地IP地址的流量统计信息；处理器根据所述南向接口单元接收的所述统计数据，获得流向所述目的地IP地址的全局流量统计值；其中，所述全局流量统计值表示所述控制器对包括所述第一报文转发设备在内的至少两个报文转发设备上报的统计数据进行汇总后，获得的用于反映所述SDN范围内流向所述目的地IP地址的流量的统计值；处理器判断所述全局流量统计值是否超过预定阈值，基于所述全局流量统计值超过预定阈值的判断结果，处理器指示所述南向接口单元向所述第二报文转发设备下发DDoS防护策略。降低了DDoS攻击对网络的影响范围，提高了网络安全性。
可选的，所述流量统计指令还携带：检测起始时刻；
其中，所述检测起始时刻用于告知所述第一报文转发设备进行所述流量统计的起始时刻，所述流量统计被所述第一报文转发设备以检测周期的方式持续执行，所述统计数据被所述第一报文转发设备以所述检测周期上报给所述控制器。
进一步的，控制器需要一种判断网络攻击是否停止的机制，一种可能的实现方式为：
所述处理器10，还用于确定在至少两个检测周期内所述全局流量统计值未超过所述预定阈值；
所述南向接口单元12b，还用于基于所述处理器10确定的至少两个连续的检测周期内所述全局流量统计值未超过所述预定阈值的结果，向所述第二报文转发设备下发防护消除指示消息；
所述防护消除指示消息用于指示所述第二报文转发设备结束执行所述DDoS防护策略。
可选的，控制器还可以针对位于SDN边界靠近攻击源的报文转发设备下发DDoS防护策略，一种可能的实现方式为：
在所述南向接口单元12b向所述第二报文转发设备下发DDoS防护策略之前，所述处理器10，还用于根据所述南向接口单元12b接收的所述统计数据，确定攻击路径上距离攻击源最近的报文转发设备，将所述距离攻击源最近的报文转发设备作为所述第二报文转发设备。
所述南向接口单元12b，还用于向所述第二报文转发设备下发DDoS防护 策略。
具体的，所述流向所述目的地IP地址的流量统计信息，包括：所述第一报文转发设备上流向所述目的地IP地址的流量值；所述处理器10根据所述南向接口单元12b接收的所述第一报文转发设备上流向所述目的地IP地址的流量值，确定第一攻击路径；所述第一攻击路径为流向所述目的地IP地址的至少一条攻击路径中流量值最大的攻击路径；所述处理器10根据所述第一攻击路径，确定所述距离攻击源最近的报文转发设备；
所述距离攻击源最近的报文转发设备位于所述第一攻击路径上的、所述流向所述目的地IP地址的流量的源地址侧的SDN边界处。
可选的，所述DDoS防护策略包含如下任意一种响应策略：黑洞路由响应策略、限流响应策略、限速响应策略、丢弃响应策略、本地清洗响应策略、动态引流清洗响应策略；控制器发下响应指令如流向3所示。
对于所述动态引流清洗响应策略，在所述南向接口单元12b下发动态引流清洗响应策略之前，需要控制器确定一条对网络冲击最小的路径来进行流量的引流，下面给出几种可能的实现方式进行说明：
方式一：所述统计数据还包含：所述第一报文转发设备的负载值；
所述处理器10，用于根据所述第一报文转发设备的负载值确定第一引流路径；
其中，所述第一引流路径为所述第二报文转发设备至所述清洗设备之间负载最小的路径；所述第一引流路径包含所述第二报文转发设备和所述清洗设备；
则所述南向接口单元12b根据所述处理器10确定的所述第一引流路径，向所述第二报文转发设备下发动态引流清洗响应策略，所述动态引流清洗响应策略包含第一引流路径指示信息，所述第一引流路径指示信息用指示所述第二报文转发设备将所述流向所述目的地IP地址的流量通过所述第一引流路径发送到所述清洗设备上进行清洗处理。
方式二：所述处理器10，用于根据SDN拓扑关系确定第二引流路径，所述第二引流路径为所述第二报文转发设备至所述清洗设备之间距离最近的路径，所述SDN拓扑关系包含所述SDN中各个报文转发设备以及所述清洗设备的连接关系；
所述南向接口单元12b根据所述处理器10确定的所述第二引流路径，向所述报文转发设备下发动态引流清洗响应策略，所述动态引流清洗响应策略包含第二引流路径指示信息，所述第二引流路径指示信息用指示所述第二报文转发设备将所述流向所述目的地IP地址的流量通过所述第二引流路径发送到所述清洗设备上进行清洗处理。
进一步的，对于控制器与独立的调度设备之间的交互，下面以副控制器与主控制器作为示例进行说明，其中主控制器与副控制器协作实现攻击防护方案可以有两种可能的实现方式。
方式一：主控制器获得SDN中全部的副控制器、报文转发设备及清洗设备的工作情况。各个副控制器周期性地通过南向接口单元与第一报文转发设备进行交互获得统计数据，各个副控制器再将采集回来的统计数据通过各自的东西向接口单元发送给主控制器，再由主控制器汇总处理后获得全局流量统计值，并根据该全局流量统计值判断是否发生网络攻击。主控制器与副控制器进行协商制定一致的网络攻击防护策略，例如DDoS防护策略，并由副控制器通过南向接口单元将该网络攻击防护策略统一下发给第二报文转发设备。
方式二：由主控制器选择空闲的副控制器完成攻击防护方案，例如，主控制器通过东西向接口单元与某副控制器进行交互，由主控制器指示该副控制器负责完成攻击防护方案。则该副控制器周期性地通过南向接口单元与第一报文转发设备进行交互获得统计数据，该副控制器再将采集回来的统计数据汇总处理后，获得全局流量统计值，并根据该全局流量统计值判断是否发生网络攻击，并由该副控制器通过南向接口单元将网络攻击防护策略统一下发给第二报文转发设备。
图5为本发明实施例提供的一种报文转发设备的结构示意图，该报文转发设备在流量统计过程中为上述第一报文转发设备，在执行DDoS防护策略的过程中，为上述第二报文转发设备；参照图5，该报文转发设备包括：处理器20、存储器21、收发器22和总线23；
其中，收发器22包括：北向接口单元22a；
首先，当该报文转发设备作为第一报文转发设备时，其具有如下功能：
该北向接口单元22a与控制器的南向接口单元12b连接，用于接收控制 器针对DDoS攻击配置的相关参数，例如流量统计指令，该流量统计指令携带目的地IP地址，用于指示处理器20进行流量统计；向控制器上报针对DDoS攻击检测的相关数据，例如统计数据，该统计数据包含流向所述目的地IP地址的流量统计信息；
处理器20，用于根据所述北向接口单元22a接收的流量统计指令对流向该目的地IP地址的流量进行统计，获得流向所述目的地IP地址的流量统计信息。
存储器21，用于存储控制器针对DDoS攻击配置的相关参数、统计数据等。
本发明实施例提供的第一报文转发设备，通过该北向接口单元接收控制器针对DDoS攻击配置的相关参数，例如流量统计指令，该流量统计指令携带目的地IP地址，用于指示处理器进行流量统计；进一步的，处理器根据所述北向接口单元接收的流量统计指令对流向该目的地IP地址的流量进行统计，获得流向所述目的地IP地址的流量统计信息。北向接口单元向控制器上报针对DDoS攻击检测的相关数据，例如统计数据，该统计数据包含流向所述目的地IP地址的流量统计信息；由于第一报文转发设备针对流向该目的地IP地址的流量进行流量统计，并将统计数据上报给控制器，使得控制器能够基于该统计数据判断是否发生DDoS攻击，从而触发相应的DDoS防护策略；从而降低了DDoS攻击对网络的影响范围，提高了网络安全性。
可选的，所述流量统计指令还携带：检测起始时刻；
其中，所述检测起始时刻用于告知所述处理器20进行所述流量统计的起始时刻，以检测周期的方式持续进行所述流量统计，以所述检测周期上报所述统计数据给所述控制器。
继续参照图5，当该报文转发设备作为第二报文转发设备时，其具有如下功能：
所述北向接口单元22a，在向所述控制器上报统计数据之后，还用于：
接收所述控制器发送的DDoS防护策略；
所述处理器20，还用于根据所述北向接口单元22a接收的所述DDoS防护策略，对所述流向所述目的地IP地址的流量进行防护处理。
本实施例提供的第二报文转发设备，在北向接口单元向所述控制器上报 统计数据之后，通过北向接口单元接收所述控制器发送的DDoS防护策略，并由处理器根据所述北向接口单元接收的所述DDoS防护策略，对所述流向所述目的地IP地址的流量进行防护处理，实现了对流向所述目的地IP地址的流量的DDoS防护，从而降低了DDoS攻击对网络的影响范围，提高了网络安全性。
需要说明的是，对于SDN中的报文转发设备，有一些报文转发设备同时具有第一报文转发设备和第二报文转发设备的功能，这些报文转发设备往往为能够将执行DDoS防护策略的防护效果最大化的报文转发设备，例如，位于SDN边界靠近攻击源的报文转发设备；另一些报文转发设备仅具有第一报文转发设备的功能，例如，并不位于SDN边界的报文转发设备；当然，根据SDN具体的部署和网络攻击发生时的具体情况，控制器可以根据需求配置SDN中的报文转发设备具有第一报文转发设备和/或第二报文转发设备的功能，本发明实施例并不予以限制。
进一步的，对应控制器判断网络攻击是否停止的机制，第二报文转发设备侧相应的功能如下：
所述北向接口单元22a，在接收所述控制器发送的DDoS防护策略之后，还用于：
接收所述控制器发送的防护消除指示消息；所述防护消除指示消息用于指示所述处理器20结束执行所述DDoS防护策略；
所述处理器20，还用于根据所述北向接口单元22a接收的所述防护消除指示消息停止对所述流向所述目的地IP地址的流量进行防护处理。
可选的，所述DDoS防护策略包含如下任意一种响应策略：黑洞路由响应策略、限流响应策略、限速响应策略、丢弃响应策略、本地清洗响应策略、动态引流清洗响应策略；
其中，所述黑洞路由响应策略用于指示所述处理器20通过配置黑洞路由对所述流向所述目的地IP地址的流量进行报文丢弃处理；
则所述处理器20根据所述DDoS防护策略对所述流向所述目的地IP地址的流量进行防护处理，具体为：根据所述北向接口单元22a接收的所述黑洞路由响应策略采用黑洞路由对所述流向所述目的地IP地址的流量进行报文丢弃处理；
所述限流响应策略用于指示所述处理器20对所述流向所述目的地IP地址的流量进行限流处理；
则所述处理器20根据所述DDoS防护策略对所述流向所述目的地IP地址的流量进行防护处理，具体为：根据所述北向接口单元22a接收的所述限流响应策略对所述流向所述目的地IP地址的流量进行限流处理；
所述限速响应策略用于指示所述处理器20对所述流向所述目的地IP地址的流量进行限速处理；
则所述处理器20根据所述DDoS防护策略对所述流向所述目的地IP地址的流量进行防护处理，具体为：根据所述北向接口单元22a接收的所述限速响应策略对所述流向所述目的地IP地址的流量进行限速处理；
所述丢弃响应策略用于指示所述处理器20对所述流向所述目的地IP地址的流量进行报文丢弃处理；
则所述处理器20根据所述DDoS防护策略对所述流向所述目的地IP地址的流量进行防护处理，具体为：根据所述北向接口单元22a接收的所述丢弃响应策略对所述流向所述目的地IP地址的流量进行报文丢弃处理；
所述本地清洗响应策略用于指示所述处理器20在本地对所述流向所述目的地IP地址的流量进行清洗处理；
则所述处理器20根据所述DDoS防护策略对所述流向所述目的地IP地址的流量进行防护处理，具体为：根据所述北向接口单元22a接收的所述本地清洗响应策略在本地对所述流向所述目的地IP地址的流量进行清洗处理；
所述动态引流清洗响应策略用于指示所述处理器20将所述流向所述目的地IP地址的流量发送到清洗设备上进行清洗处理；
则所述处理器20根据所述DDoS防护策略对所述流向所述目的地IP地址的流量进行防护处理，具体为：根据所述北向接口单元22a接收的所述动态引流清洗响应策略指示所述北向接口单元22a将所述流向所述目的地IP地址的流量发送到所述清洗设备上进行清洗处理。
对于所述动态引流清洗响应策略，在所述控制器下发动态引流清洗响应策略之前，需要控制器确定一条对网络冲击最小的路径来进行流量的引流，第二报文转发设备侧相应的功能如下：
方式一：
所述统计数据还包含：所述第一报文转发设备的负载值；
所述动态引流清洗响应策略包含第一引流路径指示信息，所述第一引流路径指示信息用于指示将所述流向所述目的地IP地址的流量通过所述第一引流路径发送到所述清洗设备上进行清洗处理；所述第一引流路径为所述报文转发设备至所述清洗设备之间负载最小的路径；所述第一引流路径包含所述第二报文转发设备和所述清洗设备；
其中，报文转发设备为第二报文转发设备。
则所述处理器20根据所述北向接口单元22a接收的所述动态引流清洗响应策略指示所述北向接口单元22a将所述流向所述目的地IP地址的流量发送到所述清洗设备上进行清洗处理，具体为：
根据所述北向接口单元22a接收的所述动态引流清洗响应策略，指示所述北向接口单元22a将所述流向所述目的地IP地址的流量通过所述第一引流路径发送到所述清洗设备上进行清洗处理。
方式二：
所述动态引流清洗响应策略包含第二引流路径指示信息，所述第二引流路径指示信息用于指示将所述流向所述目的地IP地址的流量通过所述第二引流路径发送到所述清洗设备上进行清洗处理；所述第二引流路径为所述报文转发设备至所述清洗设备之间距离最近的路径；
其中，报文转发设备为第二报文转发设备。
则所述处理器20根据所述北向接口单元22a接收的所述动态引流清洗响应策略指示所述北向接口单元22a将所述流向所述目的地IP地址的流量发送到所述清洗设备上进行清洗处理，具体为：
根据所述北向接口单元22a接收的所述动态引流清洗响应策略，指示所述北向接口单元22a将所述流向所述目的地IP地址的流量通过所述第二引流路径发送到所述清洗设备上进行清洗处理。
图6为本发明实施例提供的一种独立的调度设备的结构示意图，参照图6，该独立的调度设备包括：处理器30、存储器31、收发器32和总线33；
其中,收发器32包括：东西向接口单元32a；
进一步的，该独立的调度设备可以具有两种可能的实现方式，下面分别对两种方式进行说明。
方式一：
该独立的调度设备的东西向接口单元32a与控制器的东西向接口单元12c连接；
处理器30，用于指示东西向接口单元32a向控制器发送流量统计指令，以使控制器向第一报文转发设备下发该流量统计指令；
可选的，也可以由控制器自行向第一报文转发设备下发该流量统计指令，不需要东西向接口单元32a向控制器发送流量统计指令。
东西向接口单元32a，还用于接收控制器发送的统计数据；
具体的，控制器收集所述第一报文转发设备根据所述流量统计指令上报的统计数据，并将所述统计数据发送给独立的调度设备的东西向接口单元32a。
处理器30，用于根据东西向接口单元32a接收的统计数据，获得流向所述目的地IP地址的全局流量统计值；根据该全局流量统计值判断是否发生网络攻击；
其中，所述全局流量统计值表示所述控制器对包括所述第一报文转发设备在内的至少两个报文转发设备上报的统计数据进行汇总后，获得的用于反映所述SDN范围内流向所述目的地IP地址的流量的统计值；
若发生网络攻击，则处理器30通过东西向接口单元32a与控制器协商确定DDoS防护策略，并指示控制器将确定的DDoS防护策略下发给第二报文转发设备；
方式二：
该独立的调度设备的东西向接口单元32a与控制器的东西向接口单元12c连接；
东西向接口单元32a接收控制器发送的DDoS防护请求消息；
处理器30，根据DDoS防护请求消息和控制器状况信息，确定用于执行DDoS防护功能的控制器。
具体的，通常多个控制器组成一个集群时，为了便于管理多个控制器，会设置独立的调度设备。因此，处理器30需要基于控制器状况信息选择满足执行DDoS防护功能的控制器；控制器状况信息可以包含集群中每个控制器的处理能力的信息、负载状况、空闲状况等，确定满足执行DDoS防护功能 的控制器后，独立的调度设备向该控制器发送DDoS防护响应消息；该DDoS防护响应消息包含DDoS防护执行指示；该控制器根据该DDoS防护执行指示，执行DDoS防护功能，具体的功能参照上文图4对应实施例的方案。
对于方式一，具体的：独立的调度设备与控制器的协商机制可以有多种，例如，所述流向所述目的地IP地址的流量统计信息，包括：所述第一报文转发设备上流向所述目的地IP地址的流量值；独立的调度设备根据所述第一报文转发设备上流向所述目的地IP地址的流量值，确定第一攻击路径；所述第一攻击路径为流向所述目的地IP地址的至少一条攻击路径中流量值最大的攻击路径；根据所述第一攻击路径，确定所述距离攻击源最近的报文转发设备。所述距离攻击源最近的报文转发设备位于所述第一攻击路径上的、所述流向所述目的地IP地址的流量的源地址侧的SDN边界处。独立的调度设备指示控制器将所述距离攻击源最近的报文转发设备作为第二报文转发设备，并向该第二报文转发设备下发DDoS防护策略；又例如，独立的调度设备在确定使用动态引流清洗响应策略后，根据所述所述第一报文转发设备的负载值确定第一引流路径，所述第一引流路径为所述第二报文转发设备至所述清洗设备之间负载最小的路径；独立的调度设备向所述控制器下发所述动态引流清洗响应策略，该策略包含第一引流路径指示信息，所述第一引流路径指示信息用于指示所述第二报文转发设备将所述流向所述目的地IP地址的流量通过所述第一引流路径发送到所述清洗设备上进行清洗处理；又例如，独立的调度设备在确定使用动态引流清洗响应策略后，根据SDN拓扑关系确定第二引流路径，所述第二引流路径为所述第二报文转发设备至所述清洗设备之间距离最近的路径，所述SDN拓扑关系包含所述SDN中各个报文转发设备以及所述清洗设备的连接关系；独立的调度设备向控制器下发动态引流清洗响应策略，该策略包含第二引流路径指示信息，所述第二引流路径指示信息用于指示所述第二报文转发设备将所述流向所述目的地IP地址的流量通过所述第二引流路径发送到所述清洗设备上进行清洗处理。当然，独立的调度设备与控制器之间还可以采用多种可能的协商机制，本发明实施例不予限定。
可选的，上文所述控制器还具有另一种可能的实现方式，具体的，图7为本发明实施例提供的一种控制器的结构示意图，参照图7，该控制器包括：发送模块40、处理模块41、接收模块42；
发送模块40，用于向第一报文转发设备下发流量统计指令，所述流量统计指令用于指示所述第一报文转发设备进行流量统计；其中，所述流量统计指令携带目的地IP地址；
接收模块42，用于收集所述第一报文转发设备根据所述流量统计指令上报的统计数据，所述统计数据包含流向所述目的地IP地址的流量统计信息；
处理模块41，用于：
根据所述接收模块42接收的所述统计数据，获得流向所述目的地IP地址的所述全局流量统计值；
其中，所述全局流量统计值表示所述控制器对包括所述第一报文转发设备在内的至少两个报文转发设备上报的统计数据进行汇总后，获得的用于反映所述SDN范围内流向所述目的地IP地址的流量的统计值；
判断所述全局流量统计值是否超过预定阈值；
所述发送模块40，还用于基于处理模块41确定的全局流量统计值超过预定阈值的判断结果，向第二报文转发设备下发DDoS防护策略。
本发明实施例提供的控制器，通过处理模块指示发送模块向第一报文转发设备下发流量统计指令，所述流量统计指令用于指示所述第一报文转发设备进行流量统计；其中，所述流量统计指令携带目的地IP地址；接收模块接收所述第一报文转发设备根据所述流量统计指令上报的统计数据，所述统计数据包含流向所述目的地IP地址的流量统计信息；处理模块根据所述接收模块接收的所述统计数据，获得流向所述目的地IP地址的全局流量统计值其中，所述全局流量统计值表示所述控制器对包括所述第一报文转发设备在内的至少两个报文转发设备上报的统计数据进行汇总后，获得的用于反映所述SDN范围内流向所述目的地IP地址的流量的统计值；处理模块判断所述全局流量统计值是否超过预定阈值，所述发送模块基于处理模块确定的全局流量统计值超过预定阈值的判断结果，向第二报文转发设备下发DDoS防护策略。降低了DDoS攻击对网络的影响范围，提高了网络安全性。
可选的，所述流量统计指令还携带：上文所述检测起始时刻；
进一步的，控制器需要一种判断网络攻击是否停止的机制，一种可能的实现方式为：
所述处理模块41，还用于：
确定在至少两个连续的检测周期内所述全局流量统计值未超过所述预定阈值；
所述发送模块40，还用于基于所述处理模块41确定的至少两个连续的检测周期内所述全局流量统计值未超过所述预定阈值的结果，向所述第二报文转发设备下发上文所述防护消除指示消息；
可选的，控制器还可以针对位于SDN边界靠近攻击源的报文转发设备下发DDoS防护策略，一种可能的实现方式为：
根据所述接收模块42接收的所述统计数据，确定攻击路径上距离攻击源最近的报文转发设备，将所述距离攻击源最近的报文转发设备作为所述第二报文转发设备。
具体的，所述流向所述目的地IP地址的流量统计信息，包括：所述第一报文转发设备上流向所述目的地IP地址的流量值；
所述处理模块41，还用于根据所述统计数据，确定攻击路径上距离攻击源最近的报文转发设备，具体为：
根据所述接收模块42接收的所述第一报文转发设备上流向所述目的地IP地址的流量值，确定第一攻击路径；所述第一攻击路径为流向所述目的地IP地址的至少一条攻击路径中流量值最大的攻击路径；
根据所述第一攻击路径，确定所述距离攻击源最近的报文转发设备；
所述距离攻击源最近的报文转发设备位于所述第一攻击路径上的、所述流向所述目的地IP地址的流量的源地址侧的SDN边界处。
可选的，所述DDoS防护策略包含如下任意一种响应策略：黑洞路由响应策略、限流响应策略、限速响应策略、丢弃响应策略、本地清洗响应策略、动态引流清洗响应策略；
具体的，对于各种响应策略，上进行了详细说明，此处不再赘述。
对于所述动态引流清洗响应策略，在所述控制器下发动态引流清洗响应策略之前，需要控制器确定一条对网络冲击最小的路径来进行流量的引流，下面给出几种可能的实现方式进行说明：
方式一：所述统计数据还包含：所述第一报文转发设备的负载值；
所述处理模块41，在所述发送模块40向所述第二报文转发设备下发DDoS防护策略之前，还用于：
根据所述第一报文转发设备的负载值确定第一引流路径；
所述第一引流路径为所述第二报文转发设备至所述清洗设备之间负载最小的路径；所述第一引流路径包含所述第二报文转发设备和所述清洗设备；
则所述发送模块40根据所述处理模块41确定的所述第一引流路径，向所述第二报文转发设备下发的DDoS防护策略为所述动态引流清洗响应策略，所述动态引流清洗响应策略包含第一引流路径指示信息，所述第一引流路径指示信息用于指示所述第二报文转发设备将所述流向所述目的地IP地址的流量通过所述第一引流路径发送到所述清洗设备上进行清洗处理。
方式二：所述处理模块41，在所述发送模块40向所述第二报文转发设备下发DDoS防护策略之前，还用于：
根据SDN拓扑关系确定第二引流路径，所述第二引流路径为所述第二报文转发设备至所述清洗设备之间距离最近的路径，所述SDN拓扑关系包含所述SDN中各个报文转发设备以及所述清洗设备的连接关系；
则所述发送模块40根据所述处理模块41确定的所述第二引流路径，向所述第二报文转发设备下发DDoS防护策略为所述动态引流清洗响应策略，所述动态引流清洗响应策略包含第二引流路径指示信息，所述第二引流路径指示信息用于指示所述第二报文转发设备将所述流向所述目的地IP地址的流量通过所述第二引流路径发送到所述清洗设备上进行清洗处理。
可选的，上文所述报文转发设备还具有另一种可能的实现方式，具体的，图8为本发明实施例提供的另一种报文转发设备的结构示意图，参照图8，该控制器包括：发送模块50、处理模块51、接收模块52；
接收模块52，用于接收所述控制器发送的流量统计指令，所述流量统计指令用于指示处理模块51进行流量统计；其中，所述流量统计指令携带目的地IP地址；
所述处理模块51，用于根据所述接收模块52接收的所述流量统计指令统计流流向所述目的地IP地址的流量统计信息；
发送模块50，用于根据所述处理模块51统计的所述流向所述目的地IP地址的流量统计信息，向所述控制器上报统计数据，所述统计数据包含所述流向所述目的地IP地址的流量统计信息。
本发明实施例提供的报文转发设备即为上文所述第一报文转发设备，通 过接收模块接收控制器发送的流量统计指令，该流量统计指令携带目的地IP地址，用于指示处理模块进行流量统计；进一步的，处理模块根据所述接收模块接收的流量统计指令对流向该目的地IP地址的流量进行统计，获得流向所述目的地IP地址的流量统计信息。发送模块向控制器上报统计数据，该统计数据包含流向所述目的地IP地址的流量统计信息；由于第一报文转发设备针对流向该目的地IP地址的流量进行流量统计，并将统计数据上报给控制器，使得控制器能够基于该统计数据判断是否发生DDoS攻击，从而触发相应的DDoS防护策略；从而降低了DDoS攻击对网络的影响范围，提高了网络安全性。
可选的，所述流量统计指令还携带：上文所述检测起始时刻；
进一步的，当图8所示报文转发设备作为第二报文转发设备时，其具有如下功能：
所述接收模块52，在所述发送模块50向所述控制器上报统计数据之后，还用于：
接收所述控制器发送的DDoS防护策略；
所述处理模块51，还用于根据所述接收模块52接收的所述DDoS防护策略，对所述流向所述目的地IP地址的流量进行防护处理。
本实施例提供的第二报文转发设备，在发送模块向所述控制器上报统计数据之后，通过接收模块接收所述控制器发送的DDoS防护策略，并由处理模块根据所述接收模块接收的所述DDoS防护策略，对所述流向所述目的地IP地址的流量进行防护处理，实现了对流向所述目的地IP地址的流量的DDoS防护，从而降低了DDoS攻击对网络的影响范围，提高了网络安全性。
进一步的，对应控制器判断网络攻击是否停止的机制，第二报文转发设备侧相应的功能如下：
所述接收模块52，在所述接收所述控制器发送的DDoS防护策略之后，还用于：
接收所述控制器发送的防护消除指示消息；
所述处理模块51，还用于根据所述接收模块52接收的所述防护消除指示消息停止对所述流向所述目的地IP地址的流量进行防护处理。
可选的，所述DDoS防护策略包含如下任意一种响应策略：黑洞路由响 应策略、限流响应策略、限速响应策略、丢弃响应策略、本地清洗响应策略、动态引流清洗响应策略；
其中，所述黑洞路由响应策略用于指示所述处理模块51通过配置黑洞路由对所述流向所述目的地IP地址的流量进行报文丢弃处理；
则所述处理模块51根据所述DDoS防护策略对所述流向所述目的地IP地址的流量进行防护处理，具体为：根据所述接收模块52接收的所述黑洞路由响应策略采用黑洞路由对所述流向所述目的地IP地址的流量进行报文丢弃处理；
所述限流响应策略用于指示所述处理模块51对所述流向所述目的地IP地址的流量进行限流处理；
则所述处理模块51根据所述DDoS防护策略对所述流向所述目的地IP地址的流量进行防护处理，具体为：根据所述接收模块52接收的所述限流响应策略对所述流向所述目的地IP地址的流量进行限流处理；
所述限速响应策略用于指示所述处理模块51对所述流向所述目的地IP地址的流量进行限速处理；
则所述处理模块51根据所述DDoS防护策略对所述流向所述目的地IP地址的流量进行防护处理，具体为：根据所述接收模块52接收的所述限速响应策略对所述流向所述目的地IP地址的流量进行限速处理；
所述丢弃响应策略用于指示所述处理模块51对所述流向所述目的地IP地址的流量进行报文丢弃处理；
则所述处理模块51根据所述DDoS防护策略对所述流向所述目的地IP地址的流量进行防护处理，具体为：根据所述接收模块52接收的所述丢弃响应策略对所述流向所述目的地IP地址的流量进行报文丢弃处理；
所述本地清洗响应策略用于指示所述处理模块51在本地对所述流向所述目的地IP地址的流量进行清洗处理；
则所述处理模块51根据所述DDoS防护策略对所述流向所述目的地IP地址的流量进行防护处理，具体为：根据所述接收模块52接收的所述本地清洗响应策略在本地对所述流向所述目的地IP地址的流量进行清洗处理；
所述动态引流清洗响应策略用于指示所述处理模块51将所述流向所述目的地IP地址的流量发送到清洗设备上进行清洗处理；
则所述处理模块51根据所述DDoS防护策略对所述流向所述目的地IP地址的流量进行防护处理，具体为：根据所述接收模块52接收的所述动态引流清洗响应策略指示所述发送模块50将所述流向所述目的地IP地址的流量发送到所述清洗设备上进行清洗处理。
对于所述动态引流清洗响应策略，在所述控制器下发动态引流清洗响应策略之前，需要控制器确定一条对网络冲击最小的路径来进行流量的引流，第二报文转发设备侧相应的功能如下：
方式一：
所述动态引流清洗响应策略包含第一引流路径指示信息，所述第一引流路径指示信息用于指示将所述流向所述目的地IP地址的流量通过所述第一引流路径发送到所述清洗设备上进行清洗处理；所述第一引流路径为所述报文转发设备至所述清洗设备之间负载最小的路径；所述第一引流路径包含所述第二报文转发设备和所述清洗设备；
则所述处理模块51根据所述接收模块52接收的所述动态引流清洗响应策略指示所述发送模块50将所述流向所述目的地IP地址的流量发送到所述清洗设备上进行清洗处理，具体为：
根据所述接收模块52接收的所述动态引流清洗响应策略，指示所述发送模块50将所述流向所述目的地IP地址的流量通过所述第一引流路径发送到所述清洗设备上进行清洗处理。
方式二：
所述动态引流清洗响应策略包含第二引流路径指示信息，所述第二引流路径指示信息用于指示将所述流向所述目的地IP地址的流量通过所述第二引流路径发送到所述清洗设备上进行清洗处理；所述第二引流路径为所述报文转发设备至所述清洗设备之间距离最近的路径；
则所述处理模块51根据所述接收模块52接收的所述动态引流清洗响应策略指示所述发送模块50将所述流向所述目的地IP地址的流量发送到所述清洗设备上进行清洗处理，具体为：
根据所述接收模块52接收的所述动态引流清洗响应策略，指示所述发送模块50将所述流向所述目的地IP地址的流量通过所述第二引流路径发送到所述清洗设备上进行清洗处理。
在图2至8的基础上，图9为本发明实施例提供的一种基于SDN的DDOS攻击防护方法的流程示意图，参照图9，该流程包括：
步骤1、数据流量正常情况按照1-〉4-〉5到达服务器。
步骤2、控制器识别处于SDN边界的报文转发设备，当控制器执行DDoS控制程序时或用户设备的应用调用DDoS控制程序时，控制器向处于SDN边界的报文转发设备下发流量统计指令，该流量统计指令用于指示所述报文转发设备进行流量统计，此时，处于SDN边界的报文转发设备即为第一报文转发设备；可选的，控制器也可以向SDN内全部的报文转发设备下发流量统计指令。
具体的，该流量统计指令携带目的地IP地址，该目的地IP地址为所述服务器的某个IP地址或某段IP地址段；第一报文转发设备基于该流量统计指令从某个时间开始对流向该目的地IP地址的流量进行统计，获得统计数据，该统计数据包含流向所述目的地IP地址的流量统计信息；控制器在统计周期T结束的时候可以向第一报文转发设备查询该统计数据。控制器下发策略和查询统计结果例如流向3所示；
步骤3、第一报文转发设备收到该流量统计指令后，建立基于该目的地IP地址的目的IP监控表，该表采用哈希表形式，包含了该目的地IP地址的各种统计项目。第一报文转发设备在每个统计周期内对转发的数据报文目的地址为该目的地IP地址的流量进行统计，统计周期结束时，控制器向第一报文转发设备查询该统计数据。第一报文转发设备上报该统计数据例如流向2所示；
步骤4、控制器搜集到所有第一报文转发设备在某检测周期T内的统计数据，控制器对该流向所述目的地IP地址的流量统计信息进行汇总，获得流向该目的地IP地址的全局流量统计值；具体的，控制器可以对统计数据进行求和等运算处理获得流向该目的地IP地址的全局流量统计值。控制器将该全局流量统计值与预定阈值进行比较，如果超过该预定阈值，则认为网络攻击发生；如果持续几个特定周期，该全局流量统计值连续小于该预定阈值，则认为网络攻击消除；
步骤5、若判断网络攻击发生，则控制器向第二报文转发设备下发网络攻击防护策略，例如DDoS防护策略。
进一步的，对于步骤5，控制器可以确定距离攻击源最近的报文转发设备， 将该距离攻击源最近的报文转发设备作为第二报文转发设备。
步骤6、第二报文转发设备接收DDoS防护策略后，可以基于DDoS防护策略进行黑洞路由、限流(限速)、丢弃、本地清洗、动态引流清洗、本地清洗等DDoS防护策略。其中，本地清洗指报文转发设备对符合DDoS防护策略的流量进行DDoS防护清洗处理；动态引流清洗指报文转发设备将符合DDoS防护策略的流量引流至专业清洗设备进行清洗，清洗后的流量由该清洗设备回注到SDN中。
步骤7、第二报文转发设备接收控制器发送的防护消除指示消息后，恢复流量正常转发路径，关闭引流，清洗设备停止清洗处理。
需要说明的是，所述第一报文转发设备针对流向所述目的地IP地址的流量的所进行的流量统计，在OpenFlow协议规定的流程中通过流水线处理实现。具体的：首先，第一报文转发设备定义目的IP监控表为流表，当某个流量的目的IP地址命中IP监控表中的目的地IP地址时，则认为命中该流表表项，第一报文转发设备提取该流量数据报文的信息，刷新该表项的统计结果，通常，统计结果的形式为：第一报文转发设备的统计数值＝第一报文转发设备的统计原数值+数据包个数；第一报文转发设备同时检查监测周期是否到达，若到达，则把动作项(action)设置为发该第一报文转发设备的统计数据的日志给控制器，并清空该第一报文转发设备缓存的统计结果，进入下一个统计周期。
下面通过具体实施例对上述SDN中的控制器和报文转发设备进行说明。
图10为本发明实施例提供的另一种基于SDN的DDoS攻击防护方法的流程示意图，该方法执行主体为上述控制器，该控制器可以采用图4或图7所示的结构，参照图10，该方法包括如下流程：
步骤100、控制器向第一报文转发设备下发流量统计指令，所述流量统计指令用于指示所述第一报文转发设备进行流量统计；
其中，所述流量统计指令携带目的地IP地址。
步骤101、所述控制器收集所述第一报文转发设备根据所述流量统计指令上报的统计数据，所述统计数据包含流向所述目的地IP地址的流量统计信息；
步骤102、所述控制器根据所述统计数据，获得流向所述目的地IP地址的全局流量统计值；
其中，所述全局流量统计值表示所述控制器对包括所述第一报文转发设备在内的至少两个报文转发设备上报的统计数据进行汇总后，获得的用于反映所述SDN范围内流向所述目的地IP地址的流量的统计值；
步骤103、所述控制器判断所述全局流量统计值是否超过预定阈值；
步骤104、所述控制器基于所述全局流量统计值超过预定阈值的判断结果，向第二报文转发设备下发DDoS防护策略。
本发明实施例提供的基于SDN的DDoS攻击防护方法，通过控制器向第一报文转发设备下发流量统计指令，所述流量统计指令用于指示所述第一报文转发设备进行流量统计；其中，所述流量统计指令携带目的地IP地址；所述控制器收集所述第一报文转发设备根据所述流量统计指令上报的统计数据，所述统计数据包含流向所述目的地IP地址的流量统计信息；所述控制器根据所述统计数据，获得流向所述目的地IP地址的全局流量统计值；其中，所述全局流量统计值表示所述控制器对包括所述第一报文转发设备在内的至少两个报文转发设备上报的统计数据进行汇总后，获得的用于反映所述SDN范围内流向所述目的地IP地址的流量的统计值；所述控制器判断所述全局流量统计值是否超过预定阈值，基于所述全局流量统计值超过预定阈值的判断结果，向第二报文转发设备下发DDoS防护策略。降低了DDoS攻击对网络的影响范围，提高了网络安全性。
可选的，所述流量统计指令还携带：检测起始时刻；
其中，所述检测起始时刻用于告知所述第一报文转发设备进行所述流量统计的起始时刻，所述流量统计被所述第一报文转发设备以检测周期的方式持续执行，所述统计数据被所述第一报文转发设备以所述检测周期上报给所述控制器。
进一步的，控制器需要一种判断网络攻击是否停止的机制，具体的，在图10的基础上，图11为本发明实施例提供的另一种基于SDN的DDoS攻击防护方法的流程示意图，参照图11，在步骤104之后，还包括：
步骤105、所述控制器确定在至少两个连续的检测周期内所述全局流量统计值未超过所述预定阈值；
步骤106、所述控制器向所述第二报文转发设备下发防护消除指示消息；
所述防护消除指示消息用于指示所述第二报文转发设备结束执行所述 DDoS防护策略。
可选的，控制器还可以针对位于SDN边界靠近攻击源的报文转发设备下发DDoS防护策略，具体的，具体的，在图10的基础上，图12为本发明实施例提供的另一种基于SDN的DDoS攻击防护方法的流程示意图，参照图12，在步骤104之前，还包括：
步骤107、所述控制器根据所述统计数据，确定攻击路径上距离攻击源最近的报文转发设备，将所述距离攻击源最近的报文转发设备作为所述第二报文转发设备。
进一步的，所述流向所述目的地IP地址的流量统计信息，包括：所述第一报文转发设备上流向所述目的地IP地址的流量值；步骤107的一种可能的实现方式为：
所述控制器根据所述第一报文转发设备上流向所述目的地IP地址的流量值，确定第一攻击路径；
所述第一攻击路径为流向所述目的地IP地址的至少一条攻击路径中流量值最大的攻击路径；
所述控制器根据所述第一攻击路径，确定所述距离攻击源最近的报文转发设备；
所述距离攻击源最近的报文转发设备位于所述第一攻击路径上的、所述流向所述目的地IP地址的流量的源地址侧的SDN边界处。
下面对方式二中“所述控制器根据所述统计数据确定攻击路径上距离攻击源最近的报文转发设备”做进一步说明，图13为攻击路径及最近攻击源头判定示意图，参照图13，其中SDN包括：报文转发设备A至G、控制器；其中，报文转发设备A与ISP网络1连接，并且网络攻击的攻击源处于该ISP网络1中，报文转发设备B与ISP网络2连接，报文转发设备F与ISP网络3连接，报文转发设备F与目的地IP所处的网络连接，该目的地IP为网络攻击的流量的目的地IP，即受害主机的IP；由于报文转发设备A、报文转发设备B、报文转发设备E和报文转发设备F分别用于其他网络接入SDN，因此这些报文转发设备处于SDN的边界。
参照图13，首先，控制器根据SDN的拓扑关系，确定距离目的地IP最近的报文转发设备E和上述几个处于SDN边界的报文转发设备，由于在SDN 中，从攻击源流向目的地IP的网络攻击流量可能存在多种路径，例如，该流量路径可以为：报文转发设备A→报文转发设备G→报文转发设备E，下文简称第一攻击路径；报文转发设备F→报文转发设备E，下文简称第二攻击路径；报文转发设备B→报文转发设备G→报文转发设备E，下文简称第三攻击路径；控制器统计各个攻击路径上流向目的地IP的流量的统计数据，控制器对各个攻击路径上流向目的地IP的流量大小进行排序，确定第一攻击路径为流量最大的攻击路径，则控制器确定报文转发设备A距离攻击源头最近。
继续参照图13，对上文所述第一报文转发设备和第一报文转发设备进行说明。当控制器向第一报文转发设备下发流量统计指令后，第一报文转发设备根据该流量统计指令进行流量统计，对于图13中的报文转发设备，报文转发设备A至G均可以进行流量统计，因此报文转发设备A至G都可以作为第一报文转发设备；进一步的，当控制器确定报文转发设备A距离攻击源头最近后，控制器向报文转发设备A下发DDoS防护策略，则将报文转发设备A作为第二报文转发设备；或者，由于流向目的地IP的网络攻击流量可能分别经过报文转发设备A、B和F，控制器可以分别向报文转发设备A、B和F下发DDoS防护策略，则将报文转发设备A、B和F都作为第二报文转发设备。
可选的，所述DDoS防护策略包含如下任意一种响应策略：黑洞路由响应策略、限流响应策略、限速响应策略、丢弃响应策略、本地清洗响应策略、动态引流清洗响应策略；
其中，所述黑洞路由响应策略用于指示所述第二报文转发设备通过配置黑洞路由对所述流向所述目的地IP地址的流量进行报文丢弃处理；
所述限流响应策略用于指示所述第二报文转发设备对所述流向所述目的地IP地址的流量进行限流处理；
所述限速响应策略用于指示所述第二报文转发设备对所述流向所述目的地IP地址的流量进行限速处理；
所述丢弃响应策略用于指示所述第二报文转发设备对所述流向所述目的地IP地址的流量进行报文丢弃处理；
所述本地清洗响应策略用于指示所述第二报文转发设备在本地对流向所述目的地IP地址的流量进行清洗处理；
所述动态引流清洗响应策略用于指示所述第二报文转发设备将所述流向 所述目的地IP地址的流量发送到清洗设备上进行清洗处理。
对于所述动态引流清洗响应策略，在所述控制器下发动态引流清洗响应策略之前，需要控制器确定一条对网络冲击最小的路径来进行流量的引流，下面给出几种可能的实现方式进行说明。
方式一：在图10的基础上，图14为本发明实施例提供的另一种基于SDN的DDoS攻击防护方法的流程示意图，参照图14，所述统计数据还包含：所述第一报文转发设备的负载值；
进一步的，在步骤104之前，还包括：
步骤108、所述控制器根据所述第一报文转发设备的负载值确定第一引流路径；
所述第一引流路径为所述第二报文转发设备至所述清洗设备之间负载最小的路径；所述第一引流路径包含所述第二报文转发设备和所述清洗设备；
则所述控制器向所述第二报文转发设备下发的DDoS防护策略为所述动态引流清洗响应策略；
具体的，所述动态引流清洗响应策略包含第一引流路径指示信息，所述第一引流路径指示信息用于指示所述第二报文转发设备将所述流向所述目的地IP地址的流量通过所述第一引流路径发送到所述清洗设备上进行清洗处理。
方式二：在图10的基础上，图15为本发明实施例提供的另一种基于SDN的DDoS攻击防护方法的流程示意图，参照图15，在步骤104之前，还包括：
步骤109、所述控制器根据SDN拓扑关系确定第二引流路径；
具体的，所述第二引流路径为所述第二报文转发设备至所述清洗设备之间距离最近的路径，所述SDN拓扑关系包含所述SDN中各个报文转发设备以及所述清洗设备的连接关系；
则所述控制器向所述第二报文转发设备下发DDoS防护策略为所述动态引流清洗响应策略；
具体的，所述动态引流清洗响应策略包含第二引流路径指示信息，所述第二引流路径指示信息用于指示所述第二报文转发设备将所述流向所述目的地IP地址的流量通过所述第二引流路径发送到所述清洗设备上进行清洗处理。
参照图13，对方式一中的“第一引流路径”进行说明：例如，假设报文转发设备F收到控制器发送的流量统计指令，该F作为第一报文转发设备进行流量统计；并将统计数据上报给控制器；若控制器向该F下发动态引流清洗响应策略，则该F作为第二报文转发设备执行该动态引流清洗响应策略；该F与清洗设备连接；由于动态引流清洗响应策略包含第一引流路径指示信息，所述第一引流路径指示信息用于指示该F将所述流向所述目的地IP地址的流量通过所述第一引流路径发送到所述清洗设备上进行清洗处理。由于该F直接与清洗设备连接，显然F-清洗设备的引流路径为该F至所述清洗设备之间负载最小的路径，则第一引流路径包含
又例如，假设清洗设备与报文转发设备D连接，若控制器向该F下发动态引流清洗响应策略，则该F作为第二报文转发设备执行该动态引流清洗响应策略，此时从F将流量引向清洗设备包含多种可能的引流路径，如：F-E-G-D-清洗设备；F-A-G-D-清洗设备等；不同引流路径的负载不一样，控制器基于上述路径的报文转发设备作为第一报文转发设备时上报的统计数据，确定第一引流路径，例如F-E-G-D-清洗设备的负载最小，则第一引流路径包含F、E、G、D和清洗设备。
需要说明的是，图14和图15所示的步骤可以结合图10所示的步骤实现，也可以结合图11和图12所示的步骤实现。
对于上文所示控制器侧的实施例，下面对报文转发设备侧的方法流程进行说明。
图16为本发明实施例提供的另一种基于SDN的DDoS攻击防护方法的流程示意图，所述方法应用于SDN系统中，所述SDN系统包括控制器和报文转发设备，该方法执行主体为上述报文转发设备，该报文转发设备可以采用图5或图8所示的结构，参照图16，该方法包括如下流程：
步骤200、接收所述控制器发送的流量统计指令，所述流量统计指令用于指示所述报文转发设备进行流量统计；
其中，所述流量统计指令携带目的地IP地址；
步骤201、根据所述流量统计指令统计流向所述目的地IP地址的流量统计信息；
步骤202、向所述控制器上报统计数据，所述统计数据包含所述流向所述 目的地IP地址的流量统计信息。
本发明实施例提供的基于SDN的DDoS攻击防护方法，通过报文转发设备接收所述控制器发送的流量统计指令，所述流量统计指令用于指示所述报文转发设备进行流量统计；其中，所述流量统计指令携带目的地IP地址；报文转发设备根据所述流量统计指令统计流向所述目的地IP地址的流量统计信息；报文转发设备向所述控制器上报统计数据，所述统计数据包含所述流向所述目的地IP地址的流量统计信息。由于报文转发设备针对流向该目的地IP地址的流量进行流量统计，并将统计数据上报给控制器，使得控制器能够基于该统计数据判断是否发生DDoS攻击，从而触发相应的DDoS防护策略；从而降低了DDoS攻击对网络的影响范围，提高了网络安全性。
需要说明的是，执行上述步骤200至202的报文转发设备，根据其功能可以被定义为上文所述第一报文转发设备；
可选的，所述流量统计指令还携带：检测起始时刻；
其中，所述检测起始时刻用于告知所述报文转发设备进行所述流量统计的起始时刻，以检测周期的方式持续进行所述流量统计，以所述检测周期上报所述统计数据给所述控制器。
进一步的，当控制器执行判断网络攻击是否停止的机制时，具体的，在图16的基础上，图17为本发明实施例提供的另一种基于SDN的DDoS攻击防护方法的流程示意图，在步骤202之后，还包括：
步骤203、接收所述控制器发送的DDoS防护策略；
步骤204、根据所述DDoS防护策略对所述流向所述目的地IP地址的流量进行防护处理。
在图17的基础上，图18为本发明实施例提供的另一种基于SDN的DDoS攻击防护方法的流程示意图，在步骤204之后，还包括：
步骤205、接收所述控制器发送的防护消除指示消息；所述防护消除指示消息用于指示所述报文转发设备结束执行所述DDoS防护策略；
步骤206、根据所述防护消除指示消息停止对所述流向所述目的地IP地址的流量进行防护处理。
可选的，所述DDoS防护策略包含如下任意一种响应策略：黑洞路由响应策略、限流响应策略、限速响应策略、丢弃响应策略、本地清洗响应策略、 动态引流清洗响应策略；
其中，所述黑洞路由响应策略用于指示所述报文转发设备通过配置黑洞路由对所述流向所述目的地IP地址的流量进行报文丢弃处理；
则步骤204的一种可能的实现方式为：根据所述黑洞路由响应策略采用黑洞路由对所述流向所述目的地IP地址的流量进行报文丢弃处理；
所述限流响应策略用于指示所述报文转发设备对所述流向所述目的地IP地址的流量进行限流处理；
则步骤204的一种可能的实现方式为：根据所述限流响应策略对所述流向所述目的地IP地址的流量进行限流处理；
所述限速响应策略用于指示所述报文转发设备对所述流向所述目的地IP地址的流量进行限速处理；
则步骤204的一种可能的实现方式为：根据所述限速响应策略对所述流向所述目的地IP地址的流量进行限速处理；
所述丢弃响应策略用于指示所述报文转发设备对所述流向所述目的地IP地址的流量进行报文丢弃处理；
则步骤204的一种可能的实现方式为：根据所述丢弃响应策略对所述流向所述目的地IP地址的流量进行报文丢弃处理；
所述本地清洗响应策略用于指示所述报文转发设备在本地对所述流向所述目的地IP地址的流量进行清洗处理；
则步骤204的一种可能的实现方式为：根据所述本地清洗响应策略在本地对所述流向所述目的地IP地址的流量进行清洗处理；
所述动态引流清洗响应策略用于指示所述报文转发设备将所述流向所述目的地IP地址的流量发送到清洗设备上进行清洗处理；
则步骤204的一种可能的实现方式为：根据所述动态引流清洗响应策略将所述流向所述目的地IP地址的流量发送到清洗设备上进行清洗处理。
对于所述动态引流清洗响应策略，在所述控制器下发动态引流清洗响应策略之前，需要控制器确定一条对网络冲击最小的路径来进行流量的引流，为了配合控制器侧实现基于对网络冲击最小的路径进行引流的方案，下面对报文转发设备需要执行的方法流程进行说明。
方式一：
所述统计数据还包含：所述第一报文转发设备的负载值；
所述动态引流清洗响应策略包含第一引流路径指示信息，所述第一引流路径指示信息用于指示所述报文转发设备将所述流向所述目的地IP地址的流量通过所述第一引流路径发送到所述清洗设备上进行清洗处理；所述第一引流路径为所述报文转发设备至所述清洗设备之间负载最小的路径；所述第一引流路径包含所述第二报文转发设备和所述清洗设备；
则步骤204的一种可能的实现方式为：
根据所述动态引流清洗响应策略，将所述流向所述目的地IP地址的流量通过所述第一引流路径发送到所述清洗设备上进行清洗处理。
方式二：
所述动态引流清洗响应策略包含第二引流路径指示信息，所述第二引流路径指示信息用于指示所述报文转发设备将所述流向所述目的地IP地址的流量通过所述第二引流路径发送到所述清洗设备上进行清洗处理；所述第二引流路径为所述报文转发设备至所述清洗设备之间距离最近的路径；
则步骤204的一种可能的实现方式为：
根据所述动态引流清洗响应策略，将所述流向所述目的地IP地址的流量通过所述第二引流路径发送到所述清洗设备上进行清洗处理。
对于本地清洗指示，下面给出一种可能的处理方式，图19为本地清洗处理流程示意图，参照图19，该流程包括对数据报文分类的处理过程：
步骤300、判断数据报文是否属于传输控制协议(Transmission Control Protocol，简称：TCP)协议；
若是则执行步骤301，否则执行步骤308；
步骤301、判断所述数据报文是否是超文本传送协议(Hyper Text Transfer Protocol，简称；HTTP)报文；
若是，则采用HTTP报文处理函数对数据报文进行清洗处理；否则执行步骤302；
步骤302、判断所述数据报文是否是域名系统(Domain Name System，简称：DNS)报文；
若是，则采用DNS报文处理函数对数据报文进行清洗处理；否则执行步骤303；
步骤303、判断所述数据报文是否是TCP分片报文；
若是，则采用TCP分片报文处理函数对数据报文进行清洗处理；否则执行步骤304；
步骤304、判断所述数据报文是否是同步(Synchronous，简称：Syn)报文；
若是，则采用Syn报文处理函数对数据报文进行清洗处理；否则执行步骤305；
步骤305、判断所述数据报文是否是确认(Acknowledgement，简称：ACK)报文；
若是，则采用ACK报文处理函数对数据报文进行清洗处理；否则执行步骤306；
步骤306、判断所述数据报文是否是Syn-ACK报文；
若是，则采用Syn-ACK报文处理函数对数据报文进行清洗处理；否则执行步骤307；
步骤307、判断所述数据报文是否是复位(RST)报文；
若是，则采用复位报文处理函数对数据报文进行清洗处理；否则执行返回步骤；
步骤308、判断所述数据报文是否属于用户数据包协议(User Datagram Protocol，简称：UDP)协议；
若是，则执行步骤309；否则执行返回步骤；
步骤309、判断所述数据报文是否是DNS询问报文；
若是，则采用询问报文处理函数对数据报文进行清洗处理；否则执行步骤310；
步骤310、判断所述数据报文是否是DNS响应报文；
若是，则采用询问报文处理函数对数据报文进行清洗处理；否则执行步骤311；
步骤311、判断所述数据报文是否是会话初始协议(Session Initiation Protocol，简称：SIP)报文；
若是，则采用SIP报文处理函数对数据报文进行清洗处理；否则执行步骤312；
步骤312、判断所述数据报文是否是UDP分片报文；
若是，则采用UDP分片报文处理函数对数据报文进行清洗处理；否则采用UDP报文对所述数据报文进行清洗处理。
需要说明的是，图19所示方案仅为一种可能的实现方案，对于其他能够实现本地清理的处理流程，本实施例不予限定。
需要说明的是，执行上述步骤203至206的报文转发设备，根据其功能可以被定义为上文所述第二报文转发设备。
针对图10至图15对应实施例所示的控制器执行的流程，和图16至图19对应实施例所示的报文转发设备执行的流程，下面通过具体实施例对控制器与报文转发设备之间的交互进行说明，图20为本发明实施例提供的一种基于SDN的DDoS攻击防护方法的交互流程示意图，参照图20，该交互流程包括：
步骤400、控制器向第一报文转发设备下发流量统计指令；
步骤401、第一报文转发设备根据所述流量统计指令统计流向所述目的地IP地址的流量统计信息；
步骤402、控制器接收第一报文转发设备发送的统计数据；
步骤403、所述控制器根据所述统计数据，获得流向所述目的地IP地址的全局流量统计值；
步骤404、所述控制器判断所述全局流量统计值是否超过预定阈值；
步骤405、所述控制器基于所述全局流量统计值超过预定阈值的判断结果，向第二报文转发设备下发DDoS防护策略；
步骤406、第二报文转发设备根据所述DDoS防护策略对所述流向所述目的地IP地址的流量进行防护处理。
步骤407、所述控制器确定在至少两个连续的检测周期内所述全局流量统计值未超过所述预定阈值；
步骤408、所述控制器向所述第二报文转发设备下发防护消除指示消息；
步骤409、第二报文转发设备根据所述防护消除指示消息停止对所述流向所述目的地IP地址的流量进行防护处理。
下面通过具体实施例对控制器与报文转发设备之间的交互进行说明，图21为本发明实施例提供的另一种基于SDN网络的DDoS攻击防护方法的交互示意图，参照图21，该交互包括如下流程：
步骤500、控制器向报文转发设备下发流量统计指令；
步骤501、报文转发设备向报文转发设备发送流量统计指令应答消息；
步骤502、报文转发设备构建目的IP监控表进行流量监控；
步骤503、控制器周期下发查询消息；
需要说明的是，步骤503也可以为报文转发设备周期性主动上报统计数据。
步骤504、报文转发设备向控制器发送应答消息，该应答消息包含统计数据；
步骤505、控制器周期性地进行基于目的IP监控的流量统计信息进行汇总并判断是否超过设定阈值，若超过则判定进入DDoS攻击开始状态；未超过则继续监测；
步骤506、进入DDoS攻击开始状态，则控制器根据监测结果，找到距离攻击最近的报文转发设备，下发DDoS防护策略；
步骤507、报文转发设备向控制器发送DDoS防护策略响应消息；
步骤508、报文转发设备启动防护动作；
步骤509、进入DDoS攻击开始状态，继续多个周期后，控制器发现流量恢复正常，则判定攻击结束状态，继续监控流量；
步骤510、进入攻击结束状态，则控制器向响应的报文转发设备下发防护消除指示消息；
步骤511、报文转发设备向控制器发送防护消除指示响应消息。
下面对于图20或21中交互的消息、信令及信元给出具体的实现方式：
在报文转发设备构建基于上述目的地IP地址的目的IP监控表(ddos-group table)，该表采用哈希表形式，建立算法采用流量数据包的目的地IP地址命中指定的目的地IP地址，则认为命中该表，报文转发设备则可以进行流量统计；
流向所述目的地IP地址的流量统计信息的一种可能的实现方式中，其包含的字段可以包括如下信息：
总报文数(ULONG ulPacketSum)、总字节数(ULONG ulByteSum)、报文包速率(ULONG ulICMPPktRate)、ICMP带宽(ULONG ulICMPBand)、TCP报文包速率(ULONG ulTcpPktRate)、TCP带宽(ULONG ulTcpBand)、UDP报文包速率(ULONG ulUdpPktRate)、UDP带宽(ULONG ulUdpBand)；
可选的，对于各类TCP报文，流量统计信息包含的字段可以包括如下至少一种信息：SYN报文包速率(ULONG ulSynPktRate)、SYN报文的带宽(ULONG ulSynBand)、ACK报文的包速率(ULONG ulAckPktRate)、ACK报文的带宽(ULONG ulAckBand)、SYN/ACK包速率(ULONG ulSynAckPktRate)、SYN/ACK报文的带宽(ULONG ulSynAckBand)、FIN报文包速率(ULONG ulFinPktRate)、FIN报文的带宽(ULONG ulFinBand)、RST报文包速率(ULONG ulRstPktRate)、RST报文的带宽(ULONG ulRstBand)、错误报文的包速率(ULONG ulErrPktRate)、错误报文的带宽(ULONG ulErrBand)、分片报文的包速率(ULONG ulFragPktRate)、分片报文的带宽(ULONG ulFragBand)、HTTP GET报文的包速率(ULONG ulHttpGetPktRate)、HTTP GET报文的带宽(ULONG ulHttpGetBand)、DNS报文的包速率(ULONG ulDnsByteNum)、DNS报文带宽(ULONG ulDnsBand)、流数目(ULONG ulFlowCnt)；
另外，上文统计数据还包含：所述第一报文转发设备的负载值：具体的，该第一报文转发设备的负载值的实现形式可以为：该第一报文转发设备的吞吐量；或者，该第一报文转发设备的带宽占用率等。进一步的，该第一报文转发设备的负载值可以设置在流量统计信息的字段内；也可以设置在统计数据的空闲字段内。
对于控制器与报文转发设备之间交互的消息，下面给出一种可能的实现方式：
控制器向报文转发设备发送流量统计指令，相应的，报文转发设备向控制器发送流量统计指令应答消息，对于这些交互消息，基于Open Flow协议其可以具有如下数据结构：
Figure PCTCN2016072781-appb-000001
Figure PCTCN2016072781-appb-000002
具体的，采用该数据结构的交互消息中携带如下字段：消息类型字段(Type OFPT_ROLE_REQUEST/OFPT_ROLE_REPLY)、目的地IP地址、子网掩码、统计使能、统计周期、统计子功能项开关；
其中，目的地IP地址的字段为4字节；子网掩码的字段为4字节；统计使能的字段为8字节，其用于指示启动流量统计或关闭流量统计；统计周期的字段为8字节，其用于指示流量统计的周期，其时间单位可以为秒或其他符合SDN需求的时间单位；统计子功能项开关的字段为8字节，其用于指示统计流量的相关功能的开启或关闭，按位使能。
所述控制器收集报文转发设备根据流量统计指令上报的统计数据。具体的，控制器可以采用向报文转发设备发送查询消息，并接收报文转发设备发送的应答消息，该应答消息包含统计数据。基于Open Flow协议，查询消息和应答消息可以具有如下数据结构：
Figure PCTCN2016072781-appb-000003
具体的，采用该数据结构的查询消息和应答消息中携带如下字段：消息类型字段(Type OFPT_ROLE_REQUEST/OFPT_ROLE_REPLY)、目的地IP地址、子网掩码、统计周期、当前已经统计上报的周期次数、流量统计信息的集合；
其中，目的地IP地址的字段为4字节；子网掩码的字段为4字节；统计周期的字段为8字节，其用于指示流量统计的周期，其时间单位可以为秒或其他符合SDN需求的时间单位；当前已经统计上报的周期次数的字段为4字 节；流量统计信息的集合包含报文转发设备包含的统计项，各统计项按照统计变量名称和统计变量数值的形式包含在该数据结构中。
在确定网络攻击发生后，控制器会向报文转发设备下发DDoS防护策略、报文转发设备会向控制器发送DDoS防护策略响应消息，当网络攻击结束后，控制器会向报文转发设备下发防护消除指示消息，报文转发设备会向控制器发送防护消除指示响应消息，对于这些交互消息，基于Open Flow协议其可以具有如下数据结构：
Figure PCTCN2016072781-appb-000004
具体的，采用该数据结构的交互消息中携带如下字段：消息类型字段(Type OFPT_ROLE_REQUEST/OFPT_ROLE_REPLY)、目的地IP地址、子网掩码、动作使能、响应动作的类型、响应动作参数集合；
其中，目的地IP地址的字段为4字节；子网掩码的字段为4字节；动作使能的字段为8字节，其用于指示动作为“开启”态或“关闭”态；响应动作的类型的字段为8字节，其包含黑洞路由、限流(限速)、丢弃、本地清洗、引流清洗；响应动作参数集合包含与具体的响应动作相关的参数。
本领域普通技术人员可以理解：实现上述各方法实施例的全部或部分步骤可以通过程序指令相关的硬件来完成。前述的程序可以存储于一计算机可读取存储介质中。该程序在执行时，执行包括上述各方法实施例的步骤；而前述的存储介质包括：ROM、RAM、磁碟或者光盘等各种可以存储程序代码的介质。
最后应说明的是：以上各实施例仅用以说明本发明的技术方案，而非对 其限制；尽管参照前述各实施例对本发明进行了详细的说明，本领域的普通技术人员应当理解：其依然可以对前述各实施例所记载的技术方案进行修改，或者对其中部分或者全部技术特征进行等同替换；而这些修改或者替换，并不使相应技术方案的本质脱离本发明各实施例技术方案的范围。

Claims (26)

  1. 一种基于软件定义网络SDN的分布式拒绝服务DDoS攻击防护方法，其特征在于，包括：
    控制器向第一报文转发设备下发流量统计指令，所述流量统计指令用于指示所述第一报文转发设备进行流量统计；
    其中，所述流量统计指令携带目的地IP地址；
    所述控制器收集所述第一报文转发设备根据所述流量统计指令上报的统计数据，所述统计数据包含流向所述目的地IP地址的流量统计信息；
    所述控制器根据所述统计数据，获得流向所述目的地IP地址的全局流量统计值；
    其中，所述全局流量统计值表示所述控制器对包括所述第一报文转发设备在内的至少两个报文转发设备上报的统计数据进行汇总后，获得的用于反映所述SDN范围内流向所述目的地IP地址的流量的统计值；
    所述控制器判断所述全局流量统计值是否超过预定阈值，基于所述全局流量统计值超过预定阈值的判断结果，向第二报文转发设备下发DDoS防护策略。
  2. 根据权利要求1所述的方法，其特征在于，所述流量统计指令还携带：检测起始时刻；
    其中，所述检测起始时刻用于告知所述第一报文转发设备进行所述流量统计的起始时刻，所述流量统计被所述第一报文转发设备以检测周期的方式持续执行，所述统计数据被所述第一报文转发设备以所述检测周期上报给所述控制器。
  3. 根据权利要求2所述的方法，其特征在于，还包括：
    所述控制器确定在至少两个连续的检测周期内所述全局流量统计值未超过所述预定阈值，则所述控制器向所述第二报文转发设备下发防护消除指示消息；
    所述防护消除指示消息用于指示所述第二报文转发设备结束执行所述DDoS防护策略。
  4. 根据权利要求1-3任意一项所述的方法，其特征在于，在所述控制器向所述第二报文转发设备下发DDoS防护策略之前，还包括：
    所述控制器根据所述统计数据，确定攻击路径上距离攻击源最近的报文转发设备，将所述距离攻击源最近的报文转发设备作为所述第二报文转发设备。
  5. 根据权利要求4所述的方法，其特征在于，所述流向所述目的地IP地址的流量统计信息，包括：所述第一报文转发设备上流向所述目的地IP地址的流量值；
    所述控制器根据所述统计数据，确定攻击路径上距离攻击源最近的报文转发设备，包括：
    所述控制器根据所述第一报文转发设备上流向所述目的地IP地址的流量值，确定第一攻击路径；
    所述第一攻击路径为流向所述目的地IP地址的至少一条攻击路径中流量值最大的攻击路径；
    所述控制器根据所述第一攻击路径，确定所述距离攻击源最近的报文转发设备；
    所述距离攻击源最近的报文转发设备位于所述第一攻击路径上的、所述流向所述目的地IP地址的流量的源地址侧的SDN边界处。
  6. 根据权利要求1-5任意一项所述的方法，其特征在于，所述DDoS防护策略包含如下任意一种响应策略：黑洞路由响应策略、限流响应策略、限速响应策略、丢弃响应策略、本地清洗响应策略、动态引流清洗响应策略；
    其中，所述黑洞路由响应策略用于指示所述第二报文转发设备通过配置黑洞路由对所述流向所述目的地IP地址的流量进行报文丢弃处理；
    所述限流响应策略用于指示所述第二报文转发设备对所述流向所述目的地IP地址的流量进行限流处理；
    所述限速响应策略用于指示所述第二报文转发设备对所述流向所述目的地IP地址的流量进行限速处理；
    所述丢弃响应策略用于指示所述第二报文转发设备对所述流向所述目的地IP地址的流量进行报文丢弃处理；
    所述本地清洗响应策略用于指示所述第二报文转发设备在本地对流向所述目的地IP地址的流量进行清洗处理；
    所述动态引流清洗响应策略用于指示所述第二报文转发设备将所述流向所述目的地IP地址的流量发送到清洗设备上进行清洗处理。
  7. 根据权利要求6所述的方法，其特征在于，所述统计数据还包含：所述第一报文转发设备的负载值；
    在所述控制器向所述第二报文转发设备下发DDoS防护策略之前，包括：
    所述控制器根据所述第一报文转发设备的负载值确定第一引流路径；
    其中，所述第一引流路径为所述第二报文转发设备至所述清洗设备之间负载最小的路径；所述第一引流路径包含所述第二报文转发设备和所述清洗设备；
    所述控制器向所述第二报文转发设备下发的DDoS防护策略为所述动态引流清洗响应策略，所述动态引流清洗响应策略包含第一引流路径指示信息，所述第一引流路径指示信息用于指示所述第二报文转发设备将所述流向所述目的地IP地址的流量通过所述第一引流路径发送到所述清洗设备上进行清洗处理。
  8. 根据权利要求6所述的方法，其特征在于，在所述控制器向所述第二报文转发设备下发DDoS防护策略之前，包括：
    所述控制器根据SDN拓扑关系确定第二引流路径，所述第二引流路径为所述第二报文转发设备至所述清洗设备之间距离最近的路径，所述SDN拓扑关系包含所述SDN中各个报文转发设备以及所述清洗设备的连接关系；
    所述控制器向所述第二报文转发设备下发DDoS防护策略为所述动态引流清洗响应策略，所述动态引流清洗响应策略包含第二引流路径指示信息， 所述第二引流路径指示信息用于指示所述第二报文转发设备将所述流向所述目的地IP地址的流量通过所述第二引流路径发送到所述清洗设备上进行清洗处理。
  9. 一种基于SDN的DDoS攻击防护方法，所述方法应用于SDN系统中，所述SDN系统包括控制器和报文转发设备，所述方法由所述报文转发设备执行，其特征在于，包括：
    接收所述控制器发送的流量统计指令，所述流量统计指令用于指示所述报文转发设备进行流量统计；
    其中，所述流量统计指令携带目的地IP地址；
    根据所述流量统计指令统计流向所述目的地IP地址的流量统计信息；
    向所述控制器上报统计数据，所述统计数据包含所述流向所述目的地IP地址的流量统计信息。
  10. 根据权利要求9所述的方法，其特征在于，所述流量统计指令还携带：检测起始时刻；
    其中，所述检测起始时刻用于告知所述报文转发设备进行所述流量统计的起始时刻，以检测周期的方式持续进行所述流量统计，以所述检测周期上报所述统计数据给所述控制器。
  11. 根据权利要求9或10所述的方法，其特征在于，在所述向所述控制器上报统计数据之后，还包括：
    接收所述控制器发送的DDoS防护策略；
    根据所述DDoS防护策略对所述流向所述目的地IP地址的流量进行防护处理。
  12. 根据权利要求11所述的方法，其特征在于，在所述接收所述控制器发送的DDoS防护策略之后，还包括：
    接收所述控制器发送的防护消除指示消息；所述防护消除指示消息用于指示所述报文转发设备结束执行所述DDoS防护策略；
    根据所述防护消除指示消息停止对所述流向所述目的地IP地址的流量进 行防护处理。
  13. 根据权利要求11或12所述的方法，其特征在于，所述DDoS防护策略包含如下任意一种响应策略：黑洞路由响应策略、限流响应策略、限速响应策略、丢弃响应策略、本地清洗响应策略、动态引流清洗响应策略；
    其中，所述黑洞路由响应策略用于指示所述报文转发设备通过配置黑洞路由对所述流向所述目的地IP地址的流量进行报文丢弃处理；
    则所述根据所述DDoS防护策略对所述流向所述目的地IP地址的流量进行防护处理，具体为：根据所述黑洞路由响应策略采用黑洞路由对所述流向所述目的地IP地址的流量进行报文丢弃处理；
    所述限流响应策略用于指示所述报文转发设备对所述流向所述目的地IP地址的流量进行限流处理；
    则所述根据所述DDoS防护策略对所述流向所述目的地IP地址的流量进行防护处理，具体为：根据所述限流响应策略对所述流向所述目的地IP地址的流量进行限流处理；
    所述限速响应策略用于指示所述报文转发设备对所述流向所述目的地IP地址的流量进行限速处理；
    则所述根据所述DDoS防护策略对所述流向所述目的地IP地址的流量进行防护处理，具体为：根据所述限速响应策略对所述流向所述目的地IP地址的流量进行限速处理；
    所述丢弃响应策略用于指示所述报文转发设备对所述流向所述目的地IP地址的流量进行报文丢弃处理；
    则所述根据所述DDoS防护策略对所述流向所述目的地IP地址的流量进行防护处理，具体为：根据所述丢弃响应策略对所述流向所述目的地IP地址的流量进行报文丢弃处理；
    所述本地清洗响应策略用于指示所述报文转发设备在本地对所述流向所述目的地IP地址的流量进行清洗处理；
    则所述根据所述DDoS防护策略对所述流向所述目的地IP地址的流量进 行防护处理，具体为：根据所述本地清洗响应策略在本地对所述流向所述目的地IP地址的流量进行清洗处理；
    所述动态引流清洗响应策略用于指示所述报文转发设备将所述流向所述目的地IP地址的流量发送到清洗设备上进行清洗处理；
    则所述根据所述DDoS防护策略对所述流向所述目的地IP地址的流量进行防护处理，具体为：根据所述动态引流清洗响应策略将所述流向所述目的地IP地址的流量发送到清洗设备上进行清洗处理。
  14. 根据权利要求13所述的方法，其特征在于，所述统计数据还包含：所述第一报文转发设备的负载值；
    所述动态引流清洗响应策略包含第一引流路径指示信息，所述第一引流路径指示信息用于指示所述报文转发设备将所述流向所述目的地IP地址的流量通过所述第一引流路径发送到所述清洗设备上进行清洗处理；所述第一引流路径为所述报文转发设备至所述清洗设备之间负载最小的路径；所述第一引流路径包含所述第二报文转发设备和所述清洗设备；
    则所述根据所述动态引流清洗响应策略将所述流向所述目的地IP地址的流量发送到清洗设备上进行清洗处理，具体为：
    根据所述动态引流清洗响应策略，将所述流向所述目的地IP地址的流量通过所述第一引流路径发送到所述清洗设备上进行清洗处理。
  15. 根据权利要求13所述的方法，其特征在于，所述动态引流清洗响应策略包含第二引流路径指示信息，所述第二引流路径指示信息用于指示所述报文转发设备将所述流向所述目的地IP地址的流量通过所述第二引流路径发送到所述清洗设备上进行清洗处理；所述第二引流路径为所述报文转发设备至所述清洗设备之间距离最近的路径；
    则所述根据所述动态引流清洗响应策略将所述流向所述目的地IP地址的流量发送到清洗设备上进行清洗处理，具体为：
    根据所述动态引流清洗响应策略，将所述流向所述目的地IP地址的流量通过所述第二引流路径发送到所述清洗设备上进行清洗处理。
  16. 一种控制器，其特征在于，包括：
    发送模块，用于向第一报文转发设备下发流量统计指令，所述流量统计指令用于指示所述第一报文转发设备进行流量统计；其中，所述流量统计指令携带目的地IP地址；
    接收模块，用于收集所述第一报文转发设备根据所述发送模块发送的所述流量统计指令上报的统计数据，所述统计数据包含流向所述目的地IP地址的流量统计信息；
    处理模块，用于：
    根据所述接收模块接收到的所述统计数据，获得流向所述目的地IP地址的所述全局流量统计值；
    其中，所述全局流量统计值表示所述控制器对包括所述第一报文转发设备在内的至少两个报文转发设备上报的统计数据进行汇总后，获得的用于反映所述SDN范围内流向所述目的地IP地址的流量的统计值；
    判断所述全局流量统计值是否超过预定阈值；
    所述发送模块，还用于基于处理模块确定的全局流量统计值超过预定阈值的判断结果，向第二报文转发设备下发DDoS防护策略。
  17. 根据权利要求16所述的控制器，其特征在于，所述流量统计指令还携带：检测起始时刻；
    其中，所述检测起始时刻用于告知所述第一报文转发设备进行所述流量统计的起始时刻，所述流量统计被所述第一报文转发设备以检测周期的方式持续执行，所述统计数据被所述第一报文转发设备以所述检测周期上报给所述控制器；
    所述处理模块，还用于：
    确定在至少两个连续的检测周期内所述全局流量统计值未超过所述预定阈值；
    所述发送模块，还用于基于所述处理模块确定的至少两个连续的检测周期内所述全局流量统计值未超过所述预定阈值的结果，向所述第二报文转发 设备下发防护消除指示消息；
    所述防护消除指示消息用于指示所述第二报文转发设备结束执行所述DDoS防护策略。
  18. 根据权利要求16或17所述的控制器，其特征在于，所述处理模块，在所述发送模块向所述第二报文转发设备下发DDoS防护策略之前，还用于：
    根据所述接收模块接收的所述统计数据，确定攻击路径上距离攻击源最近的报文转发设备，将所述距离攻击源最近的报文转发设备作为所述第二报文转发设备。
  19. 根据权利要求18所述的控制器，其特征在于，所述流向所述目的地IP地址的流量统计信息，包括：所述第一报文转发设备上流向所述目的地IP地址的流量值；
    所述处理模块，还用于根据所述统计数据，确定攻击路径上距离攻击源最近的报文转发设备，具体为：
    根据所述接收模块接收的所述第一报文转发设备上流向所述目的地IP地址的流量值，确定第一攻击路径；所述第一攻击路径为流向所述目的地IP地址的至少一条攻击路径中流量值最大的攻击路径；
    根据所述第一攻击路径，确定所述距离攻击源最近的报文转发设备；
    所述距离攻击源最近的报文转发设备位于所述第一攻击路径上的、所述流向所述目的地IP地址的流量的源地址侧的SDN边界处。
  20. 根据权利要求16或17所述的控制器，其特征在于，所述统计数据还包含：所述第一报文转发设备的负载值；
    所述处理模块，在所述发送模块向所述第二报文转发设备下发DDoS防护策略之前，还用于：
    根据所述第一报文转发设备的负载值确定第一引流路径，所述第一引流路径为所述第二报文转发设备至所述清洗设备之间负载最小的路径；所述第一引流路径包含所述第二报文转发设备和所述清洗设备；
    则所述发送模块根据所述处理模块确定的所述第一引流路径，向所述第 二报文转发设备下发的DDoS防护策略为动态引流清洗响应策略，所述动态引流清洗响应策略包含第一引流路径指示信息，所述第一引流路径指示信息用于指示所述第二报文转发设备将所述流向所述目的地IP地址的流量通过所述第一引流路径发送到所述清洗设备上进行清洗处理。
  21. 根据权利要求16或17所述的控制器，其特征在于，所述处理模块，在所述发送模块向所述第二报文转发设备下发DDoS防护策略之前，还用于：
    根据SDN拓扑关系确定第二引流路径，所述第二引流路径为所述第二报文转发设备至所述清洗设备之间距离最近的路径，所述SDN拓扑关系包含所述SDN中各个报文转发设备以及所述清洗设备的连接关系；
    则所述发送模块根据所述处理模块确定的所述第二引流路径，向所述第二报文转发设备下发DDoS防护策略为动态引流清洗响应策略，所述动态引流清洗响应策略包含第二引流路径指示信息，所述第二引流路径指示信息用于指示所述第二报文转发设备将所述流向所述目的地IP地址的流量通过所述第二引流路径发送到所述清洗设备上进行清洗处理。
  22. 一种报文转发设备，所述报文转发设备应用于SDN系统中，所述SDN系统包括控制器和所述报文转发设备，其特征在于，所述报文转发设备，包括：
    接收模块，用于接收所述控制器发送的流量统计指令，所述流量统计指令用于指示处理模块进行流量统计；其中，所述流量统计指令携带目的地IP地址；
    所述处理模块，用于根据所述接收模块接收的所述流量统计指令统计流向所述目的地IP地址的流量统计信息；
    发送模块，用于根据所述处理模块统计的所述流向所述目的地IP地址的流量统计信息，向所述控制器上报统计数据，所述统计数据包含所述流向所述目的地IP地址的流量统计信息。
  23. 根据权利要求22所述的报文转发设备，其特征在于，所述流量统计指令还携带：检测起始时刻；
    其中，所述检测起始时刻用于告知所述处理模块进行所述流量统计的起始时刻，以检测周期的方式持续进行所述流量统计，以所述检测周期上报所述统计数据给所述控制器。
  24. 根据权利要求22或23所述的报文转发设备，其特征在于，所述接收模块，在所述发送模块向所述控制器上报统计数据之后，还用于：
    接收所述控制器发送的DDoS防护策略；
    所述处理模块，还用于根据所述接收模块接收的所述DDoS防护策略，对所述流向所述目的地IP地址的流量进行防护处理。
  25. 根据权利要求24所述的报文转发设备，其特征在于，所述接收模块，在所述接收所述控制器发送的DDoS防护策略之后，还用于：
    接收所述控制器发送的防护消除指示消息；所述防护消除指示消息用于指示所述处理模块结束执行所述DDoS防护策略；
    所述处理模块，还用于根据所述接收模块接收的所述防护消除指示消息停止对所述流向所述目的地IP地址的流量进行防护处理。
  26. 一种SDN系统，其特征在于，包括：控制器、第一报文转发设备和第二报文转发设备；
    其中，所述控制器，用于：
    向所述第一报文转发设备下发流量统计指令，所述流量统计指令用于指示所述第一报文转发设备进行流量统计；所述流量统计指令携带目的地IP地址；
    收集所述第一报文转发设备根据所述流量统计指令上报的统计数据，所述统计数据包含流向所述目的地IP地址的流量统计信息；
    根据所述统计数据，获得流向所述目的地IP地址的全局流量统计值；
    其中，所述全局流量统计值表示所述控制器对包括所述第一报文转发设备在内的至少两个报文转发设备上报的统计数据进行汇总后，获得的用于反映所述SDN范围内流向所述目的地IP地址的流量的统计值；
    判断所述全局流量统计值是否超过预定阈值，基于所述全局流量统计值 超过预定阈值的判断结果，向所述第二报文转发设备下发DDoS防护策略；
    所述第一报文转发设备，用于：
    接收所述控制器发送的所述流量统计指令；
    根据所述流量统计指令统计所述流向所述目的地IP地址的流量统计信息；
    向所述控制器上报所述统计数据；
    所述第二报文转发设备，用于：
    接收所述控制器发送的所述DDoS防护策略；
    根据所述DDoS防护策略对所述流向所述目的地IP地址的流量进行防护处理。
PCT/CN2016/072781 2015-03-24 2016-01-29 基于sdn的ddos攻击防护方法、装置及系统 WO2016150253A1 (zh)

Priority Applications (3)

Application Number Priority Date Filing Date Title
EP16767630.3A EP3253025B1 (en) 2015-03-24 2016-01-29 Sdn-based ddos attack prevention method, device and system
US15/711,725 US10630719B2 (en) 2015-03-24 2017-09-21 SDN-based DDOS attack prevention method, apparatus, and system
US16/824,036 US11394743B2 (en) 2015-03-24 2020-03-19 SDN-based DDoS attack prevention method, apparatus, and system

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201510131608.2A CN106161333B (zh) 2015-03-24 2015-03-24 基于sdn的ddos攻击防护方法、装置及系统
CN201510131608.2 2015-03-24

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US15/711,725 Continuation US10630719B2 (en) 2015-03-24 2017-09-21 SDN-based DDOS attack prevention method, apparatus, and system

Publications (1)

Publication Number Publication Date
WO2016150253A1 true WO2016150253A1 (zh) 2016-09-29

Family

ID=56977426

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2016/072781 WO2016150253A1 (zh) 2015-03-24 2016-01-29 基于sdn的ddos攻击防护方法、装置及系统

Country Status (4)

Country Link
US (2) US10630719B2 (zh)
EP (1) EP3253025B1 (zh)
CN (2) CN106161333B (zh)
WO (1) WO2016150253A1 (zh)

Cited By (9)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN107181760A (zh) * 2017-07-07 2017-09-19 北京邮电大学 一种分布式近威胁源攻击阻断方法及其装置
CN107438066A (zh) * 2017-06-21 2017-12-05 浙江大学 一种基于SDN控制器的DoS/DDoS攻击防御模块及方法
CN107547567A (zh) * 2017-09-29 2018-01-05 新华三技术有限公司 一种防攻击方法和装置
CN107682326A (zh) * 2017-09-21 2018-02-09 北京邮电大学 一种安全网关联动防护机制、协议及模块
CN109474623A (zh) * 2018-12-25 2019-03-15 杭州迪普科技股份有限公司 网络安全防护及其参数确定方法、装置及设备、介质
CN109962879A (zh) * 2017-12-22 2019-07-02 中国电信股份有限公司 针对分布式反射拒绝服务DRDoS的安全防御方法和控制器
CN111131295A (zh) * 2019-12-30 2020-05-08 北京天融信网络安全技术有限公司 流量防御方法、装置及电子设备
CN113630385A (zh) * 2021-07-13 2021-11-09 电子科技大学 一种sdn网络下dos攻击防控方法及装置
CN115174358A (zh) * 2022-09-08 2022-10-11 浪潮电子信息产业股份有限公司 存储集群接口的监测处理方法、系统、设备及存储介质

Families Citing this family (53)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US10333952B2 (en) * 2015-04-16 2019-06-25 Nec Corporation Online alert ranking and attack scenario reconstruction
US10289841B2 (en) * 2015-04-16 2019-05-14 Nec Corporation Graph-based attack chain discovery in enterprise security systems
US10298607B2 (en) * 2015-04-16 2019-05-21 Nec Corporation Constructing graph models of event correlation in enterprise security systems
CN106302318A (zh) * 2015-05-15 2017-01-04 阿里巴巴集团控股有限公司 一种网站攻击防御方法及装置
CN106817340B (zh) * 2015-11-27 2020-05-08 阿里巴巴集团控股有限公司 预警决策的方法、节点及子系统
WO2017147808A1 (zh) * 2016-03-02 2017-09-08 华为技术有限公司 管理网络设备的方法和装置
CN107347056A (zh) * 2016-05-06 2017-11-14 阿里巴巴集团控股有限公司 一种数据处理方法、装置及系统
CN106506527B (zh) * 2016-12-05 2019-06-21 国云科技股份有限公司 一种防御udp无连接洪水攻击的方法
CN108234404B (zh) 2016-12-15 2020-08-25 腾讯科技（深圳）有限公司 一种DDoS攻击的防御方法、系统及相关设备
CN108270722B (zh) * 2016-12-30 2021-08-24 阿里巴巴集团控股有限公司 一种攻击行为检测方法和装置
CN106657107B (zh) * 2016-12-30 2020-05-12 南京邮电大学 一种SDN中基于信任值的自适应启动的ddos防御方法和系统
US10104000B2 (en) * 2017-01-31 2018-10-16 Hewlett Packard Enterprise Development Lp Reducing control plane overload of a network device
WO2018149557A1 (en) * 2017-02-15 2018-08-23 Maven Wireless Sweden Ab Distributed antenna system providing redundancy
WO2018154001A1 (en) 2017-02-23 2018-08-30 Maven Wireless Sweden Ab Routing aggregated carriers in a das
CN106921666B (zh) * 2017-03-06 2020-10-02 中山大学 一种基于协同理论的DDoS攻击防御系统及方法
CN107231344B (zh) * 2017-05-04 2020-04-03 杭州迪普科技股份有限公司 流量清洗方法和装置
CN107493276B (zh) * 2017-08-08 2020-04-07 北京神州绿盟信息安全科技股份有限公司 一种网络安全防护的方法及装置
US11115435B2 (en) * 2017-08-15 2021-09-07 Level 3 Communications, Llc Local DDOS mitigation announcements in a telecommunications network
CN107360194A (zh) * 2017-09-07 2017-11-17 北京邮电大学 网络攻击的处理方法和装置
CN107872385B (zh) * 2017-10-11 2020-10-23 中国电子科技集团公司第三十研究所 一种sdn网络路由计算与控制方法
CN109889470B (zh) * 2017-12-06 2020-06-26 中国科学院声学研究所 一种基于路由器防御DDoS攻击的方法和系统
US20190182290A1 (en) * 2017-12-07 2019-06-13 Telefonaktiebolaget Lm Ericsson (Publ) Method and system to resolve a distributed denial of service attack through denying radio resource allocation of infected end devices
JP6898846B2 (ja) * 2017-12-28 2021-07-07 株式会社日立製作所 異常原因特定支援システムおよび異常原因特定支援方法
CN110300085B (zh) * 2018-03-22 2022-08-12 北京京东尚科信息技术有限公司 网络攻击的取证方法、装置、系统、统计集群和计算集群
JP6939726B2 (ja) * 2018-07-17 2021-09-22 日本電信電話株式会社 攻撃対処箇所選択装置及び攻撃対処箇所選択方法
CN108881295A (zh) * 2018-07-24 2018-11-23 瑞典爱立信有限公司 用于检测和解决异常路由的方法和网络设备
US11194906B2 (en) * 2018-07-31 2021-12-07 Nec Corporation Automated threat alert triage via data provenance
CN109889550B (zh) * 2019-04-12 2021-02-26 杭州迪普科技股份有限公司 一种DDoS攻击确定方法及装置
JP2021005165A (ja) * 2019-06-25 2021-01-14 株式会社日立製作所 インシデントシナリオ生成装置及びインシデントシナリオ生成システム
CN110445671B (zh) * 2019-06-27 2020-11-27 浪潮思科网络科技有限公司 一种基于sdn的网络流量监控方法
CN111181910B (zh) * 2019-08-12 2021-10-08 腾讯科技（深圳）有限公司 一种分布式拒绝服务攻击的防护方法和相关装置
US11477163B2 (en) * 2019-08-26 2022-10-18 At&T Intellectual Property I, L.P. Scrubbed internet protocol domain for enhanced cloud security
US10880329B1 (en) * 2019-08-26 2020-12-29 Nanning Fugui Precision Industrial Co., Ltd. Method for preventing distributed denial of service attack and related equipment
CN113132339B (zh) * 2020-01-15 2023-04-25 阿里巴巴集团控股有限公司 流量监控方法、装置及电子设备
WO2021046565A2 (en) * 2020-02-27 2021-03-11 Futurewei Technologies, Inc. Pce controlled network reliability
CN114006820B (zh) * 2020-07-28 2023-09-05 中移(苏州)软件技术有限公司 一种传输带宽调整方法及设备、计算机可读存储介质
CN114124419A (zh) * 2020-08-27 2022-03-01 北京秦淮数据有限公司 一种ddos攻击防御方法及装置
CN114338066A (zh) * 2020-09-30 2022-04-12 中移(苏州)软件技术有限公司 一种拒绝服务攻击的防御方法及系统、设备及存储介质
WO2022092788A1 (en) 2020-10-29 2022-05-05 Samsung Electronics Co., Ltd. Methods and system for securing a sdn controller from denial of service attack
CN112583850B (zh) * 2020-12-27 2023-02-24 杭州迪普科技股份有限公司 网络攻击防护方法、装置及系统
CN114826630A (zh) * 2021-01-22 2022-07-29 华为技术有限公司 防护设备中的流量处理方法及防护设备
CN113364797B (zh) * 2021-06-18 2023-02-03 广东省新一代通信与网络创新研究院 一种防ddos攻击的网络系统
CN115589300A (zh) * 2021-06-23 2023-01-10 华为技术有限公司 攻击识别方法、装置及系统、计算机可读存储介质
CN115603922A (zh) * 2021-06-28 2023-01-13 中兴通讯股份有限公司（Cn） 安全防御方法、装置、设备及存储介质
CN113364810B (zh) * 2021-07-02 2022-04-01 东北大学秦皇岛分校 一种链路洪泛攻击检测与防御系统及方法
CN113810398B (zh) * 2021-09-09 2023-09-26 新华三信息安全技术有限公司 一种攻击防护方法、装置、设备及存储介质
CN114244584B (zh) * 2021-12-02 2023-07-25 中盈优创资讯科技有限公司 一种基于网络设备日志实现自动压制和防护的方法及装置
CN115250193B (zh) * 2021-12-22 2024-02-23 长沙理工大学 一种面向SDN网络的DoS攻击检测方法、装置及介质
US11799830B2 (en) 2021-12-29 2023-10-24 Uab 360 It Access control in a mesh network
CN116566628A (zh) * 2022-01-27 2023-08-08 华为技术有限公司 一种攻击防御方法、设备及系统
CN114629694B (zh) * 2022-02-28 2024-01-19 天翼安全科技有限公司 一种分布式拒绝服务DDoS的检测方法及相关装置
CN114826741B (zh) * 2022-04-27 2024-02-09 新华三信息安全技术有限公司 一种攻击监测系统及攻击监测方法
CN115913784B (zh) * 2023-01-05 2023-08-08 阿里巴巴（中国）有限公司 一种网络攻击防御系统、方法、装置及电子设备

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101018156A (zh) * 2007-02-16 2007-08-15 华为技术有限公司 防止带宽型拒绝服务攻击的方法、设备及系统
CN101883078A (zh) * 2009-05-08 2010-11-10 上海清鹤数码科技有限公司 流媒体服务器应用层ddos攻击防御系统及方法
US20130329734A1 (en) * 2012-06-11 2013-12-12 Radware, Ltd. Techniques for providing value-added services in sdn-based networks
CN103685057A (zh) * 2013-12-26 2014-03-26 华为技术有限公司 流量统计方法和装置
US20140283051A1 (en) * 2013-03-14 2014-09-18 Radware, Ltd. System and method thereof for mitigating denial of service attacks in virtual networks

Family Cites Families (29)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7743134B2 (en) * 2000-09-07 2010-06-22 Riverbed Technology, Inc. Thwarting source address spoofing-based denial of service attacks
US7707305B2 (en) * 2000-10-17 2010-04-27 Cisco Technology, Inc. Methods and apparatus for protecting against overload conditions on nodes of a distributed network
US7436770B2 (en) * 2004-01-21 2008-10-14 Alcatel Lucent Metering packet flows for limiting effects of denial of service attacks
US9342339B2 (en) * 2007-11-07 2016-05-17 Brocade Communications Systems, Inc. Method and system for congestion management in a fibre channel network
CN101340276A (zh) * 2008-08-11 2009-01-07 杭州华三通信技术有限公司 防止IPv6数据报文攻击的方法、装置和交换路由设备
CN101827039B (zh) * 2010-06-04 2013-03-20 杭州华三通信技术有限公司 一种负载分担的方法和设备
US8750119B2 (en) * 2010-07-06 2014-06-10 Nicira, Inc. Network control apparatus and method with table mapping engine
CN102143143B (zh) * 2010-10-15 2014-11-05 北京华为数字技术有限公司 一种网络攻击的防护方法、装置及路由器
US20120159634A1 (en) * 2010-12-15 2012-06-21 International Business Machines Corporation Virtual machine migration
US8966622B2 (en) * 2010-12-29 2015-02-24 Amazon Technologies, Inc. Techniques for protecting against denial of service attacks near the source
WO2013105991A2 (en) * 2011-02-17 2013-07-18 Sable Networks, Inc. Methods and systems for detecting and mitigating a high-rate distributed denial of service (ddos) attack
US9185056B2 (en) * 2011-09-20 2015-11-10 Big Switch Networks, Inc. System and methods for controlling network traffic through virtual switches
US9843488B2 (en) * 2011-11-07 2017-12-12 Netflow Logic Corporation Method and system for confident anomaly detection in computer network traffic
US8694995B2 (en) * 2011-12-14 2014-04-08 International Business Machines Corporation Application initiated negotiations for resources meeting a performance parameter in a virtualized computing environment
US20130198845A1 (en) * 2012-01-26 2013-08-01 Kiomars Anvari Monitoring a wireless network for a distributed denial of service attack
US9609017B1 (en) * 2012-02-20 2017-03-28 F5 Networks, Inc. Methods for preventing a distributed denial service attack and devices thereof
US20130219043A1 (en) * 2012-02-20 2013-08-22 Moritz M. Steiner Method and apparatus for automatic migration of application service
US9282116B1 (en) * 2012-09-27 2016-03-08 F5 Networks, Inc. System and method for preventing DOS attacks utilizing invalid transaction statistics
CN103281317B (zh) * 2013-05-09 2016-06-08 浙江师范大学 一种软件定义网络的攻击测试方法
US9172721B2 (en) * 2013-07-16 2015-10-27 Fortinet, Inc. Scalable inline behavioral DDOS attack mitigation
US9294503B2 (en) * 2013-08-26 2016-03-22 A10 Networks, Inc. Health monitor based distributed denial of service attack mitigation
CN103491095B (zh) * 2013-09-25 2016-07-13 中国联合网络通信集团有限公司 流量清洗架构、装置及流量牵引、流量回注方法
CN103561011B (zh) * 2013-10-28 2016-09-07 中国科学院信息工程研究所 一种SDN控制器盲DDoS攻击防护方法及系统
US9172651B2 (en) * 2014-02-14 2015-10-27 Telefonaktiebolaget L M Ericsson (Publ) Denial of service prevention in a software defined network
US20160036837A1 (en) * 2014-08-04 2016-02-04 Microsoft Corporation Detecting attacks on data centers
US9838421B2 (en) * 2014-10-01 2017-12-05 Ciena Corporation Systems and methods utilizing peer measurements to detect and defend against distributed denial of service attacks
CN104410643A (zh) * 2014-12-16 2015-03-11 上海斐讯数据通信技术有限公司 一种sdn控制器基于统计值的防攻击方法
US9460386B2 (en) * 2015-02-05 2016-10-04 International Business Machines Corporation Passage justification scoring for question answering
US9769201B2 (en) * 2015-03-06 2017-09-19 Radware, Ltd. System and method thereof for multi-tiered mitigation of cyber-attacks

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101018156A (zh) * 2007-02-16 2007-08-15 华为技术有限公司 防止带宽型拒绝服务攻击的方法、设备及系统
CN101883078A (zh) * 2009-05-08 2010-11-10 上海清鹤数码科技有限公司 流媒体服务器应用层ddos攻击防御系统及方法
US20130329734A1 (en) * 2012-06-11 2013-12-12 Radware, Ltd. Techniques for providing value-added services in sdn-based networks
US20140283051A1 (en) * 2013-03-14 2014-09-18 Radware, Ltd. System and method thereof for mitigating denial of service attacks in virtual networks
CN103685057A (zh) * 2013-12-26 2014-03-26 华为技术有限公司 流量统计方法和装置

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP3253025A4 *

Cited By (14)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN107438066A (zh) * 2017-06-21 2017-12-05 浙江大学 一种基于SDN控制器的DoS/DDoS攻击防御模块及方法
CN107438066B (zh) * 2017-06-21 2020-04-17 浙江大学 一种基于SDN控制器的DoS/DDoS攻击防御模块及方法
CN107181760A (zh) * 2017-07-07 2017-09-19 北京邮电大学 一种分布式近威胁源攻击阻断方法及其装置
CN107682326A (zh) * 2017-09-21 2018-02-09 北京邮电大学 一种安全网关联动防护机制、协议及模块
CN107682326B (zh) * 2017-09-21 2020-08-07 北京邮电大学 一种安全网关联动防护机制、协议及模块
CN107547567A (zh) * 2017-09-29 2018-01-05 新华三技术有限公司 一种防攻击方法和装置
CN107547567B (zh) * 2017-09-29 2020-04-28 新华三技术有限公司 一种防攻击方法和装置
CN109962879A (zh) * 2017-12-22 2019-07-02 中国电信股份有限公司 针对分布式反射拒绝服务DRDoS的安全防御方法和控制器
CN109474623A (zh) * 2018-12-25 2019-03-15 杭州迪普科技股份有限公司 网络安全防护及其参数确定方法、装置及设备、介质
CN111131295A (zh) * 2019-12-30 2020-05-08 北京天融信网络安全技术有限公司 流量防御方法、装置及电子设备
CN111131295B (zh) * 2019-12-30 2022-03-11 北京天融信网络安全技术有限公司 流量防御方法、装置及电子设备
CN113630385A (zh) * 2021-07-13 2021-11-09 电子科技大学 一种sdn网络下dos攻击防控方法及装置
CN115174358A (zh) * 2022-09-08 2022-10-11 浪潮电子信息产业股份有限公司 存储集群接口的监测处理方法、系统、设备及存储介质
CN115174358B (zh) * 2022-09-08 2023-01-17 浪潮电子信息产业股份有限公司 存储集群接口的监测处理方法、系统、设备及存储介质

Also Published As

Publication number Publication date
CN112615818A (zh) 2021-04-06
CN106161333B (zh) 2021-01-15
US10630719B2 (en) 2020-04-21
EP3253025A4 (en) 2018-01-24
US11394743B2 (en) 2022-07-19
CN112615818B (zh) 2021-12-03
EP3253025B1 (en) 2021-11-24
US20180013787A1 (en) 2018-01-11
CN106161333A (zh) 2016-11-23
US20200220896A1 (en) 2020-07-09
EP3253025A1 (en) 2017-12-06

Similar Documents

Publication Publication Date Title
WO2016150253A1 (zh) 基于sdn的ddos攻击防护方法、装置及系统
CN110113435B (zh) 一种流量清洗的方法和设备
US9258323B1 (en) Distributed filtering for networks
US9935974B2 (en) Hardware-logic based flow collector for distributed denial of service (DDoS) attack mitigation
AU2015255980B2 (en) System and methods for reducing impact of malicious activity on operations of a wide area network
Mirkovic et al. D-WARD: a source-end defense against flooding denial-of-service attacks
Ioannidis et al. Implementing pushback: Router-based defense against DDoS attacks
US7467408B1 (en) Method and apparatus for capturing and filtering datagrams for network security monitoring
US10931711B2 (en) System of defending against HTTP DDoS attack based on SDN and method thereof
WO2017166047A1 (zh) 网络攻击防御策略发送、网络攻击防御的方法和装置
US7818795B1 (en) Per-port protection against denial-of-service and distributed denial-of-service attacks
CA2540802A1 (en) Method and apparatus for traffic control of dynamic denial of service attacks within a communications network
KR20120060655A (ko) 서버 공격을 탐지할 수 있는 라우팅 장치와 라우팅 방법 및 이를 이용한 네트워크
CN101383812A (zh) 基于活动IP记录的IP欺骗DDoS攻击防御方法
Ahmed et al. Filtration model for the detection of malicious traffic in large-scale networks
WO2016177131A1 (zh) 防止dos攻击方法、装置和系统
Mahajan et al. DDoS attack prevention and mitigation techniques-a review
TW201124876A (en) System and method for guarding against dispersive blocking attacks
JP5178573B2 (ja) 通信システムおよび通信方法
Mohammadi et al. Practical extensions to countermeasure dos attacks in software defined networking
JP2006067078A (ja) ネットワークシステムおよび攻撃防御方法
JP2008178100A (ja) コンピュータネットワークをパケットフラッド（ｆｌｏｏｄ）から保護するための方法及びシステム
Kim et al. High-speed router filter for blocking TCP flooding under DDoS attack
JP6934758B2 (ja) パケット中継装置およびパケット中継方法

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 16767630

Country of ref document: EP

Kind code of ref document: A1

REEP Request for entry into the european phase

Ref document number: 2016767630

Country of ref document: EP

NENP Non-entry into the national phase

Ref country code: DE