WO2018201581A1 - 一种软件定义网络的DDoS攻击模拟和攻击检测方法及装置 - Google Patents

一种软件定义网络的DDoS攻击模拟和攻击检测方法及装置 Download PDF

Info

Publication number
WO2018201581A1
WO2018201581A1 PCT/CN2017/088934 CN2017088934W WO2018201581A1 WO 2018201581 A1 WO2018201581 A1 WO 2018201581A1 CN 2017088934 W CN2017088934 W CN 2017088934W WO 2018201581 A1 WO2018201581 A1 WO 2018201581A1
Authority
WO
WIPO (PCT)
Prior art keywords
flow
attack
monitoring
entry
software
Prior art date
Application number
PCT/CN2017/088934
Other languages
English (en)
French (fr)
Inventor
闫巧
龚庆祥
陈剑勇
Original Assignee
深圳大学
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 深圳大学 filed Critical 深圳大学
Priority to US15/922,902 priority Critical patent/US10536480B2/en
Publication of WO2018201581A1 publication Critical patent/WO2018201581A1/zh

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1441—Countermeasures against malicious traffic
    • H04L63/1458—Denial of Service
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1441—Countermeasures against malicious traffic
    • H04L63/1483—Countermeasures against malicious traffic service impersonation, e.g. phishing, pharming or web spoofing
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L2463/00—Additional details relating to network architectures or network communication protocols for network security covered by H04L63/00
    • H04L2463/144—Detection or countermeasures against botnets

Definitions

  • the present invention belongs to the field of network security technologies, and in particular, to a DDoS attack simulation and attack detection method and apparatus for a software-defined network.
  • SDN software-defined network
  • DDoS Network Distributed Denial of Service
  • the related algorithm proposes a covert DDoS attack based on the flow table item exceeding, the algorithm uses the incremental mode (Incremental mode) to periodically increase the number of zombie hosts. Until the target switch flow table is in a state of saturation, the zombie host periodically sends the attack packet at an attack interval that is smaller than the flow entry, so that the flow entry of the attack packet is always in the flow table of the target switch, so that the legal flow table is obtained. Item cannot be installed for processing. However, the incremental mode does not allow the attack rate of the zombie host to quickly reach the "minimum attack rate" (the flow table entry of the target switch is kept close to the saturation of the total size of the flow table at a minimized attack speed).
  • the incremental mode does not allow the attack rate of the zombie host to quickly reach the "minimum attack rate" (the flow table entry of the target switch is kept close to the saturation of the total size of the flow table at a minimized attack speed).
  • the detection algorithm of the existing software-defined network data plane DDoS attack proposes to periodically obtain the flow entry from the target switch and check the obtained flow entry, and determine whether there is a covert attack flow by checking the result.
  • the upper layer adds a large amount of traffic load to the secure channel between the control plane and the data plane of the software-defined network.
  • Algorithm upgrade network needs to be based on detection It is complicated to take mitigation measures (such as the implementation of blacklists).
  • An object of the present invention is to provide a DDoS attack simulation and attack detection method and apparatus for a software-defined network, which aims to solve the data plane concealed DDoS attack simulation and the software-defined network of the software-defined network in the prior art.
  • the efficiency of data plane DDoS attack detection is low, and the implementation of data plane DDoS attack detection in software-defined networks is more complicated.
  • the present invention provides a DDoS attack simulation and attack detection method for a software-defined network, the method comprising the following steps:
  • the present invention provides a DDoS attack simulation and attack detection apparatus for a software-defined network, the apparatus comprising:
  • an attack simulation module configured to increase a zombie host by presetting a linear incremental and incremental mode, and initiating a data plane concealed DDoS attack by using all zombie hosts to a target switch preset in the software definition network;
  • a table update module configured to synchronously update a pre-built attack flow monitoring table on a controller of the software-defined network according to an update of a flow table of all switches in the software-defined network;
  • the detection module is configured to perform periodic detection on the attack flow monitoring table to determine whether there is a monitoring item in the attack flow monitoring table that exceeds a preset threshold; and [0016] an attack flow determining module, configured to: when it is determined that there is a monitoring item in the attack flow monitoring table that exceeds the length threshold, determining that the existing length exceeds the preset threshold
  • the network flow corresponding to the monitoring entry is a covert attack flow for the software defined network data plane.
  • the present invention increases a zombie host by means of a preset linear incremental and incremental mode, and initiates a concealed DDoS attack of a data plane through all zombie hosts to a target switch preset in a software-defined network, according to all defined in the software-defined network.
  • Update the flow table on the switch synchronize the pre-built attack flow monitoring table on the controller of the software-defined network, and periodically check the attack flow monitoring table to determine whether the attack flow monitoring table has a length exceeding the preset.
  • the monitoring entry of the long threshold is determined by the monitoring flow in the attack flow monitoring table, and the network flow corresponding to the monitoring entry is determined to be a covert attack flow for the software-defined network data plane, thereby linearly increasing and incrementing.
  • FIG. 1 is a flowchart of implementing a DDoS attack simulation and attack detection method for a software-defined network according to Embodiment 1 of the present invention
  • FIG. 2 is a schematic structural diagram of a DDoS attack simulation and attack detection apparatus of a software-defined network according to Embodiment 2 of the present invention. as well as
  • FIG. 3 is a schematic diagram of a preferred structure of a DDoS attack simulation and attack detection apparatus for a software-defined network according to Embodiment 2 of the present invention.
  • Embodiment 1 is a diagrammatic representation of Embodiment 1:
  • FIG. 1 is a flowchart showing an implementation process of a DDoS attack simulation and an attack detection method for a software-defined network according to Embodiment 1 of the present invention. For ease of description, only parts related to the embodiments of the present invention are shown, which are described in detail below. :
  • step S101 the zombie host is added by presetting the linear incremental and incremental modes, and the hidden DDoS attack of the data plane is initiated by all the zombie hosts to the target switch preset in the software-defined network.
  • Embodiments of the present invention are applicable to an attack simulation and an attack detection platform or system for a hidden DDoS attack of a software-defined network data plane, and a DDoS attack is a distributed denial of service attack.
  • the attacking simulator initiates a concealed DDoS attack on the data plane to the target switch in the software-defined network
  • the number of zombie hosts is increased in multiple batches by a preset linear increment.
  • the currently existing zombie host attacks the target switch according to the normal flow rate of the software-defined network, and after the preset attack interval, the next step is added. Batch of zombie hosts
  • the stream installation success rate of the target switch is detected in a linearly increasing peer, and when the stream success rate is lower than a preset first success threshold, the flow table of the target switch is expected to be reached. In saturation, this stops the linear increment of the zombie host. Then, the number of zombie hosts is increased by a preset incremental mode (that is, the number of zombie hosts is increased one by one), and the same zombie host attacks the target switch according to the normal flow rate. When the flow of the target switch is successfully installed, the installation succeeds. The rate is lower than the preset second success rate threshold.
  • the flow table of the target switch has reached saturation state, that is, the flow entry generated by the network flow sent by the zombie host fills the flow table, and the target switch cannot be normal.
  • the network stream saves the flow entry and cannot respond to the normal flow request. Therefore, all the zombie hosts attack the target switch at a rate that reaches the minimum attack rate.
  • the flow installation success rate is a ratio of the flow entry that is successfully installed in the flow table of the target switch to all the flow entry items that need to be installed.
  • the first success rate is a lower rate of stream installation success rate in the flow table of the target switch.
  • Threshold the second success rate is a minimum threshold of the flow installation success rate in the target switch flow table, and the first success rate and the second success rate may be adjusted according to the needs of the target switch flow table saturation in the attack simulation.
  • the minimum attack rate is that the zombie host minimizes the flow rate in the flow table of the target switch to the saturation state of the total size of the flow table at a minimum attack speed.
  • a zombie host is added for the first time, a total of lx(l+l)/2 zombie hosts, each zombie host is directed to the target at a normal flow rate of the software-defined network.
  • the switch initiates an attack.
  • the second zombie host is added for the second time, for a total of 2x (2+l)/2 zombie hosts.
  • the number of zombie hosts added each time increases in linear increments.
  • the linear attack and the incremental mode effectively improve the efficiency of the attack speed of the zombie host to the target switch to achieve the minimum attack rate, and the DDoS attacks satisfying the attack speed not exceeding the minimum attack speed are concealed. Sex, so the increase in zombie host attacks and the increase in zombie hosts have the hidden features of the attack.
  • step S102 the pre-built attack flow monitoring table on the controller of the software-defined network is updated and synchronized according to the update of the flow table of all the switches in the software-defined network.
  • the data plane concealment is selected on the controller.
  • the detection of DDoS attacks can also make full use of the global topology information and dynamic programming of the controllers in the software-defined network. Therefore, the attack flow monitoring table is built in advance on the controller of the software-defined network. In order to facilitate the differentiation, the attack flow will be The entries of the monitoring table are called monitoring entries.
  • the structure of the monitoring table may include the switch identifier, the sequence of the flow entry, the matching entry of the flow entry, the addition of the flow entry, and the length of the flow entry.
  • the switch identifier identifies the switch where the flow entry is located, and the flow entry
  • the sequence is used to distinguish each monitoring entry and the flow entry corresponding to the monitoring entry.
  • the flow entry is added to the engraving of the flow entry added to the flow table.
  • the flow entry exists in the flow table.
  • Each of the monitoring entries is used to monitor the corresponding flow entry in the flow table of the switch.
  • the switch ID, the flow entry, the flow entry match, and the flow entry are added. It can be obtained through the Packet-in event triggered by the switch.
  • the flow table entry can be obtained by adding the engraving of the current entry minus the flow entry.
  • the specific network flow can be quickly retrieved on the controller.
  • the cookie field of the item is set to monitor the sequence of flow entries in the flow entry.
  • the controller cannot determine the target switch before the detection, and therefore, the attack flow monitoring table monitors the software to define the update of the flow table on all the switches of the network.
  • the switch in the software-defined network receives the network flow and the flow table entry corresponding to the network flow does not exist in the flow table of the switch, the switch triggers the Packet-in event, that is, sends a Packet-in message to the controller, and the controller performs
  • the controller decides to add the flow entry corresponding to the network flow in the flow table of the switch, the monitoring entry corresponding to the flow entry is added to the attack flow monitoring table, that is, the monitoring entry corresponding to the network flow.
  • the flow-removed event is triggered when the network receives the idle-timeout.
  • the monitoring entry corresponding to the flow entry (or the network flow) is deleted, so that all flow tables on all switches of the software-defined network are not required to be queried or periodically, and the flow table is effectively improved. The efficiency of network flow monitoring.
  • step S103 the attack flow monitoring table is periodically detected to determine whether there is a monitoring entry in the attack flow monitoring table that exceeds the preset threshold.
  • the attack flow monitoring table on the controller is periodically detected, and it is determined whether there is a monitoring entry in the attack flow monitoring table that has a flow entry exceeding a preset threshold. That is, it is determined whether there is a monitoring entry in the attack flow monitoring table that exceeds the threshold, that is, whether there is a flow entry in the flow table that exceeds the threshold.
  • the threshold value can be set based on the experimental results.
  • step S104 when it is determined that there is a monitoring item in the attack flow monitoring table that exceeds the length threshold, it is determined that the network stream corresponding to the monitoring entry whose length exceeds the length threshold is defined for the software. A covert attack stream in the network data plane.
  • the network flow corresponding to the monitoring entry may be regarded as a covert attack flow for the software-defined network data plane, and the The monitoring entry finds the network flow and implements detection of a hidden DDoS attack on the data plane.
  • the zombie host is added in a linear incremental and incremental mode manner, and the DDoS attack is successfully simulated in the data plane, thereby effectively speeding up the DDoS attack rate to a minimum attack speed.
  • DDoS attack detection on the controller by constructing an attack flow monitoring table on the controller And update the attack flow monitoring table through the Packet-in event and the Flow-removed event during the attack detection process, effectively avoiding the attack detection to bring additional communication credit to the secure channel between the switch and the controller, and improving the data plane. Detection efficiency of concealed DDoS attacks.
  • Embodiment 2 is a diagrammatic representation of Embodiment 1
  • FIG. 2 is a diagram showing the structure of a DDoS attack simulation and attack detection apparatus of a software-defined network according to Embodiment 2 of the present invention. For the convenience of description, only parts related to the embodiment of the present invention are shown, including:
  • the attack simulation module 21 is configured to add a zombie host by preset linear incremental and incremental modes, and initiate a data plane concealed DDoS attack by using all zombie hosts to a target switch preset in the software-defined network;
  • the table update module 22 is configured to: synchronously update the pre-built attack flow monitoring table on the controller of the software-defined network according to the update of the flow table of all the switches in the software-defined network;
  • the detection module 23 is configured to perform periodic detection on the attack flow monitoring table to determine whether there is a monitoring item in the attack flow monitoring table that exceeds a preset threshold;
  • the attack flow determining module 24 is configured to: when there is a monitoring item in the attack flow monitoring table that exceeds the long threshold, determine that the network flow corresponding to the monitoring entry whose length exceeds the long threshold is Software defines the hidden attack flow of the network data plane.
  • the attack simulation module 21 includes a linear increment module 311 and an incremental mode module 31.
  • the linear increment module 311 is configured to linearly increase the number of zombie hosts, and when detecting that the stream installation success rate of the target switch is lower than a preset first success threshold, stop linearly increasing the zombie host.
  • the incremental mode module 312 is configured to incrementally increase the number of zombie hosts, and when detecting that the flow installation success rate of the target switch is lower than a preset second success threshold, stop incrementing the zombie host. ; as well as
  • the covert attack module 313 is configured to define a normal flow rate of the network according to all zombie hosts and software. Sends network traffic to the target switch at the minimum attack rate.
  • the linear increment module 311 includes an incremental attack module and an incremental stop module, where: [0052] an attack module, configured to add a zombie host in multiple batches according to a linear incremental manner and a preset attack interval The number of zombie hosts that launch attacks on the target switch at normal flow rates after they occur;
  • the stopping module is configured to obtain a flow installation success rate of the target switch by using the controller, and when it is detected that the flow installation success rate is lower than the first success rate threshold, determine that the flow table is saturated, and the linear increment is stopped.
  • the table update module 22 includes a monitoring table construction module 321, an update determination module 322, and a monitoring table update module 323, where:
  • the monitoring table construction module 321 is configured to construct an attack flow monitoring table on the controller in advance, and the monitoring item of the attack flow monitoring table includes a switch identifier, a flow entry, a flow entry matching domain, and a flow entry. Engraving and flow entry items are long;
  • the update determining module 322 is configured to determine, according to the Packet-in event and the Flow-removed event triggered by all the switches, the flow entry and the deleted flow entry added in the flow table of all the switches respectively;
  • the monitoring table update module 323 is configured to add a monitoring item corresponding to the added flow entry to the attack flow detection table, and delete the monitoring entry corresponding to the deleted flow entry.
  • the super-detection module 23 includes a detection module 331 and a super-decision determination module 332, wherein:
  • the detecting module is configured to perform periodic detection on the attack flow monitoring table to detect whether there is a monitoring entry in the attack flow monitoring table that has a flow entry longer than a long threshold;
  • the monitoring unit 332 is configured to: when there is a monitoring item that has a flow entry exceeding a length threshold, determine that the monitoring flow monitoring table has a monitoring entry whose length exceeds a long threshold.
  • the zombie host is added in a linear incremental and incremental mode manner, and the DDoS attack is successfully simulated in the data plane, thereby effectively speeding up the DDoS attack rate to a minimum attack speed.
  • the DDoS attack detection is performed on the controller by constructing an attack flow monitoring table on the controller, and the attack flow monitoring table is updated through the Packet-in event and the Flow-removed event during the attack detection process, thereby effectively preventing the attack detection from being sent to the switch.
  • the secure channel between the controller and the controller brings additional communication credits, which improves the detection efficiency of data plane concealed DDoS attacks.
  • each module of the DDoS attack simulation and attack detection device of the software-defined network It can be implemented by corresponding hardware or software modules.
  • Each module can be an independent software and hardware module, or can be integrated into a software-defined network DDoS attack simulation system and a software-defined network system on a soft and hardware module. To limit the invention.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)
  • Computer And Data Communications (AREA)

Abstract

本发明适用网络安全技术领域，提供了一种软件定义网络的DDoS攻击模拟和攻击检测方法及装置，所述方法包括：通过线性递增和增量模式的方式增加僵尸主机，通过所有僵尸主机向软件定义网络中预设的目标交换机发起数据平面的隐蔽性DDoS攻击，根据软件定义网络中所有交换机上流表的更新，对软件定义网络的控制器上预先构建的攻击流监控表进行同步更新，对攻击流监控表进行周期性检测，以确定攻击流监控表中是否有存在时长超过预设时长的监控表项，当存在时，确定该监控表项对应网络流为针对软件定义网络数据平面的隐蔽攻击流，从而有效地提高了模拟软件定义网络数据平面隐蔽性DDoS攻击的效率，有效地提高了软件定义网络数据平面隐蔽性DDoS攻击的检测效率。

Description

一种软件定义网络的 DDoS攻击模拟和攻击检测方法及装 置
技术领域
[0001] 本发明属于网络安全技术领域， 尤其涉及一种软件定义网络的 DDoS攻击模拟 和攻击检测方法及装置。
背景技术
[0002] 近年来以软件定义网络 （SDN) 为基础架构的网络蓬勃发展， 软件定义网络将 传统 IP网络的路由控制和数据转发进行分离， 实现集中控制和分布转发， 并通过 提供软件可编程的方式简化了网络的管理和配置， 然而这也扩大了网络分布式 拒绝服务攻击 （DDoS) 的攻击面。
[0003] 目前， 软件定义网络对 DDoS的抑制绝大多数只考虑到控制平面的 DDoS攻击的 问题。 已有研究表明， 软件定义网络数据平面的 DDoS攻击更容易对软件定义网 络造成威胁， 并且数据平面 DDoS攻击的隐蔽性会刻意地回避多数软件定义网络 上的 DDoS检测。
[0004] 在模拟软件定义网络数据平面的 DDoS攻击吋， 相关算法提出的基于流表项超 吋的隐蔽性 DDoS攻击， 该算法使用增量模式 （Incremental mode) 周期性地增加 僵尸主机的个数直到目标交换机流表趋近饱和状态， 僵尸主机以小于流表项超 吋的攻击间隔周期性地发送攻击包， 从而保持攻击包的流表项常在目标交换机 的流表内， 使得合法流表项无法安装处理。 然而， 增量模式无法使得僵尸主机 的攻击速率快速地达到"最小攻击速率" （以最小化的攻击速度使目标交换机的流 表项保持趋近于流表总大小的饱和状态） 。
现有软件定义网络数据平面 DDoS攻击的检测算法提出周期性地从目标交换机 中获取流表项并检査获取的流表项， 通过检査结果判断是否存在隐蔽攻击流当 该算法布置在控制器上吋， 会为软件定义网络的控制平面和数据平面之间的安 全通道增加大量的流量负载， 当该算法部署在每个目标交换机上吋， 不符合软 件定义网络逻辑集中控制的思想， 类似检测算法的升级、 网络需要根据检测结 果采取缓解措施 （如黑名单等的实现） 都是复杂的。
技术问题
[0006] 本发明的目的在于提供一种软件定义网络的 DDoS攻击模拟和攻击检测方法及 装置， 旨在解决由于现有技术中软件定义网络的数据平面隐蔽性 DDoS攻击模拟 、 以及软件定义网络的数据平面 DDoS攻击检测的效率较低， 软件定义网络的数 据平面 DDoS攻击检测的实现较为复杂的问题。
问题的解决方案
技术解决方案
[0007] 一方面， 本发明提供了一种软件定义网络的 DDoS攻击模拟和攻击检测方法， 所述方法包括下述步骤：
[0008] 通过预设线性递增和增量模式的方式增加僵尸主机， 通过所有僵尸主机向软件 定义网络中预设的目标交换机发起数据平面的隐蔽性 DDoS攻击；
[0009] 根据所述软件定义网络中所有交换机上流表的更新， 对所述软件定义网络的控 制器上预先构建的攻击流监控表进行同步更新；
[0010] 对所述攻击流监控表进行周期性检测， 以确定所述攻击流监控表中是否有存在 吋长超过预设吋长阈值的监控表项；
[0011] 当所述攻击流监控表中有存在吋长超过所述吋长阈值的监控表项吋， 确定所述 存在吋长超过所述预设吋长阈值的监控表项所对应的网络流为针对所述软件定 义网络数据平面的隐蔽攻击流。
[0012] 另一方面， 本发明提供了一种软件定义网络的 DDoS攻击模拟和攻击检测装置 ， 所述装置包括：
[0013] 攻击模拟模块， 用于通过预设线性递增和增量模式的方式增加僵尸主机， 通过 所有僵尸主机向软件定义网络中预设的目标交换机发起数据平面的隐蔽性 DDoS 攻击；
[0014] 表更新模块， 用于根据所述软件定义网络中所有交换机上流表的更新， 对所述 软件定义网络的控制器上预先构建的攻击流监控表进行同步更新；
[0015] 超吋检测模块， 用于对所述攻击流监控表进行周期性检测， 以确定所述攻击流 监控表中是否有存在吋长超过预设吋长阈值的监控表项； 以及 [0016] 攻击流确定模块， 用于当确定所述攻击流监控表中有存在吋长超过所述吋长阈 值的监控表项吋， 确定所述存在吋长超过所述预设吋长阈值的监控表项所对应 的网络流为针对所述软件定义网络数据平面的隐蔽攻击流。
发明的有益效果
有益效果
[0017] 本发明通过预设的线性递增和增量模式的方式增加僵尸主机， 通过所有僵尸主 机向软件定义网络中预设的目标交换机发起数据平面的隐蔽性 DDoS攻击， 根据 软件定义网络中所有交换机上流表的更新， 对软件定义网络的控制器上预先构 建的攻击流监控表进行同步更新， 对攻击流监控表进行周期性检测， 以确定攻 击流监控表中是否有存在吋长超过预设吋长阈值的监控表项， 当确定攻击流监 控表中有该监控表项吋， 确定该监控表项对应的网络流为针对软件定义网络数 据平面的隐蔽攻击流， 从而通过线性递增与增量模式结合有效地提高了软件定 义网络中数据平面隐蔽性 DDoS攻击模拟的效率， 通过控制器上攻击流监控表的 构建、 更新和检测实现数据平面隐蔽性 DDoS攻击的检测， 有效地避免了软件定 义网络安全通道额外的通信幵销， 提高了数据平面隐蔽性 DDoS攻击的检测效率 对附图的简要说明
附图说明
[0018] 图 1是本发明实施例一提供的软件定义网络的 DDoS攻击模拟和攻击检测方法的 实现流程图；
[0019] 图 2是本发明实施例二提供的软件定义网络的 DDoS攻击模拟和攻击检测装置的 结构示意图。 以及
[0020] 图 3是本发明实施例二提供的软件定义网络的 DDoS攻击模拟和攻击检测装置的 优选结构示意图。
本发明的实施方式
[0021] 为了使本发明的目的、 技术方案及优点更加清楚明白， 以下结合附图及实施例 ， 对本发明进行进一步详细说明。 应当理解， 此处所描述的具体实施例仅仅用 以解释本发明， 并不用于限定本发明。
[0022] 以下结合具体实施例对本发明的具体实现进行详细描述：
[0023] 实施例一：
[0024] 图 1示出了本发明实施例一提供的软件定义网络的 DDoS攻击模拟和攻击检测方 法的实现流程， 为了便于说明， 仅示出了与本发明实施例相关的部分， 详述如 下：
[0025] 在步骤 S101中， 通过预设线性递增和增量模式的方式增加僵尸主机， 通过所有 僵尸主机向软件定义网络中预设的目标交换机发起数据平面的隐蔽性 DDoS攻击
[0026] 本发明实施例适用于软件定义网络数据平面的隐蔽性 DDoS攻击的攻击模拟和 攻击检测平台或系统， DDoS攻击即分布式拒绝服务攻击。 在攻击模拟者向软件 定义网络中的目标交换机发起数据平面的隐蔽性 DDoS攻击吋， 先通过预设的线 性递增方式多批次地增加僵尸主机的数量。 在通过线性递增方式多批次增加僵 尸主机的过程中， 通过当前已有的僵尸主机按照软件定义网络的正常流速率向 目标交换机发起攻击， 在预设的攻击吋间间隔后， 再增加下一批次的僵尸主机
[0027] 在本发明实施例中， 在线性递增的同吋检测目标交换机的流安装成功率， 当流 成功率低于预设的第一成功率阈值吋， 可认为目标交换机的流表即将达到饱和 状态， 此吋停止僵尸主机的线性递增。 接着， 通过预设的增量模式方式增加僵 尸主机数量 （即一个一个地增加僵尸主机数量） ， 同吋通过这些僵尸主机按照 正常流速率向目标交换机发起攻击， 当检测到目标交换机的流安装成功率低于 预设的第二成功率阈值吋， 可以认为目标交换机的流表已经达到饱和状态， 即 僵尸主机发送的网络流产出的流表项填满了流表， 导致目标交换机无法为正常 的网络流保存流表项进而无法响应正常的流请求， 此吋所有僵尸主机向目标交 换机发起攻击的速率达到了最小攻击速率。
[0028] 具体地， 流安装成功率为目标交换机的流表中成功安装的流表项占所有需要安 装流表项的比例。 第一成功率为目标交换机的流表中流安装成功率的一个较低 阈值， 第二成功率为目标交换机流表中流安装成功率的一个最低阈值， 第一成 功率和第二成功率可根据攻击模拟中对目标交换机流表饱和度的需要进行调整 。 最小攻击速率为僵尸主机以最小化的攻击速度使目标交换机的流表中的流表 项趋近于流表总大小的饱和状态。
[0029] 作为示例地， 在采用线性递增方式吋， 第一次增加一个僵尸主机， 总共 lx(l+l )/2个僵尸主机， 每个僵尸主机都以软件定义网络的正常流速率向目标交换机发 起攻击， 在攻击吋间间隔过后， 第二次增加两个僵尸主机， 总共 2x(2+l)/2个僵 尸主机。 每次增加僵尸主机的数目都以线性递增的个数增加。
[0030] 在本发明实施例中， 通过线性递增和增量模式方式有效提高了僵尸主机对目标 交换机的攻击速度达到最小攻击速率的效率， 满足攻击速度不超过最小攻击速 度的 DDoS攻击都具有隐蔽性， 因此增加僵尸主机吋的攻击和僵尸主机增加完毕 后的攻击都具有攻击的隐蔽性特征。
[0031] 在步骤 S102中， 根据软件定义网络中所有交换机上流表的更新， 对软件定义网 络的控制器上预先构建的攻击流监控表进行更新同步。
[0032] 在本发明实施例中， 为了避免软件定义网络中控制器 （控制平面） 和交换机 ( 数据平面） 之间的安全通道出现大量的流量负载问题， 选择在控制器上进行数 据平面隐蔽性 DDoS攻击的检测， 同吋也可以充分利用软件定义网络中控制器的 全局拓扑信息和动态编程等特点， 因此预先在软件定义网络的控制器上构建攻 击流监控表， 为了便于区别， 将攻击流监控表的表项称为监控表项。 监控表的 结构可包括交换机标识、 流表项序列、 流表项匹配域、 流表项添加吋刻以及流 表项存在吋长等， 交换机标识用来标识流表项所在的交换机， 流表项序列用来 区别每个监控表项以及监控表项对应的流表项， 流表项添加吋刻为流表项被添 加到流表中的吋刻， 流表项存在吋长即流表项在流表中存在的吋长， 每个监控 表项分别用来监控交换机上流表中对应的一个流表项， 其中， 交换机标识、 流 表项序列、 流表项匹配域、 流表项添加吋刻都可通过交换机触发的 Packet-in事件 获得， 流表项存在吋长可通过当前吋刻减去流表项添加吋刻得到。
[0033] 优选地， 为了在保持每个监控表项的唯一性、 每个监控表项对应流表项的唯一 性、 且通过攻击流监控表可以在控制器上快速地检索到特定的网络流， 将流表 项的 cookie字段设置为监控流表项中的流表项序列。
[0034] 在本发明实施例中， 控制器无法在检测前确定出目标交换机， 因此通过攻击流 监控表监控软件定义网络所有交换机上流表的更新。 当软件定义网络中交换机 接收到网络流、 且交换机的流表中不存在该网络流对应的流表项吋， 交换机触 发 Packet-in事件， 即发送 Packet-in消息给控制器， 由控制器做出决策， 当控制器 决定在交换机的流表中添加该网络流对应的流表项吋， 在攻击流监控表中添加 该流表项对应的监控表项， 即该网络流对应的监控表项。 当网络流由于超过定 吋器吋间 idle—timeout被交换机刪除或者交换机接收到刪除命令将网络流刪除并 将该网络流对应的流表项刪除吋， 触发 Flow-removed事件， 当控制器接收到 Flow -removed消息吋， 将该流表项 （或者该网络流） 对应的监控表项刪除， 从而不需 要实吋或周期性地査询软件定义网络所有交换机上的所有流表， 有效地提高了 网络流监控的效率。
[0035] 在步骤 S103中， 对攻击流监控表进行周期性检测， 以确定攻击流监控表中是否 有存在吋长超过预设吋长阈值的监控表项。
[0036] 在本发明实施例中， 对控制器上的攻击流监控表进行周期性地检测， 确定攻击 流监控表中是否存在流表项存在吋长超过预设吋长阈值的监控表项， 即确定攻 击流监控表中是否有存在吋长超过该吋长阈值的监控表项， 也即确定流表中是 否有存在吋长超过该吋长阈值的流表项。 具体地， 吋长阈值可根据实验结果进 行设置。
[0037] 在步骤 S104中， 当确定攻击流监控表中有存在吋长超过吋长阈值的监控表项吋 ， 确定存在吋长超过吋长阈值的监控表项所对应的网络流为针对软件定义网络 数据平面的隐蔽攻击流。
[0038] 在本发明实施例中， 当确定攻击监控流表中存在超吋的监控表项吋， 可认为该 监控表项对应的网络流为针对软件定义网络数据平面的隐蔽攻击流， 通过该监 控表项査找到该网络流， 实现数据平面隐蔽性 DDoS攻击的检测。
[0039] 在本发明实施例中， 通过线性递增和增量模式方式增加僵尸主机， 在成功模拟 数据平面隐蔽性 DDoS攻击同吋， 有效地加快了 DDoS攻击速率达到最小攻击速 度过程。 通过在控制器上构建攻击流监控表实现在控制器上进行 DDoS攻击检测 ， 并在攻击检测的过程中通过 Packet-in事件和 Flow-removed事件更新攻击流监控 表， 有效地避免攻击检测给交换机和控制器间的安全通道带来额外的通信幵销 ， 提高了数据平面隐蔽性 DDoS攻击的检测效率。
[0040] 本领域普通技术人员可以理解实现上述实施例方法中的全部或部分步骤是可以 通过程序来指令相关的硬件来完成， 所述的程序可以存储于一计算机可读取存 储介质中， 所述的存储介质， 如 ROM/RAM、 磁盘、 光盘等。
[0041] 实施例二：
[0042] 图 2示出了本发明实施例二提供的软件定义网络的 DDoS攻击模拟和攻击检测装 置的结构， 为了便于说明， 仅示出了与本发明实施例相关的部分， 其中包括：
[0043] 攻击模拟模块 21， 用于通过预设线性递增和增量模式的方式增加僵尸主机， 通 过所有僵尸主机向软件定义网络中预设的目标交换机发起数据平面的隐蔽性 DDo S攻击；
[0044] 表更新模块 22， 用于， 根据软件定义网络中所有交换机上流表的更新， 对软件 定义网络的控制器上预先构建的攻击流监控表进行同步更新；
[0045] 超吋检测模块 23， 用于对攻击流监控表进行周期性检测， 以确定攻击流监控表 中是否有存在吋长超过预设吋长阈值的监控表项； 以及
[0046] 攻击流确定模块 24， 用于当攻击流监控表中有存在吋长超过吋长阈值的监控表 项吋， 确定存在吋长超过吋长阈值的监控表项所对应的网络流为针对软件定义 网络数据平面的隐蔽攻击流。
[0047] 优选地， 如图 3所示， 攻击模拟模块 21包括线性递增模块 311、 增量模式模块 31
2和隐蔽性攻击模块 313， 其中：
[0048] 线性递增模块 311， 用于对僵尸主机的数目进行线性递增， 当检测到目标交换 机的流安装成功率低于预设第一成功率阈值吋， 停止对僵尸主机进行线性递增
[0049] 增量模式模块 312， 用于对僵尸主机的数目进行增量递增， 当检测到目标交换 机的流安装成功率低于预设第二成功率阈值吋， 停止对僵尸主机进行增量递增 ； 以及
[0050] 隐蔽性攻击模块 313， 用于根据所有的僵尸主机和软件定义网络的正常流速率 ， 以最小攻击速率向目标交换机发送网络流。
[0051] 进一步优选地， 线性递增模块 311包括递增攻击模块和递增停止模块， 其中： [0052] 攻击模块， 用于根据线性递增的方式和预设的攻击吋间间隔多批次地增加僵尸 主机的数目， 每批僵尸主机在出现后以正常流速率向目标交换机发起攻击； 以 及
[0053] 停止模块， 用于通过控制器获取目标交换机的流安装成功率， 当检测到流安装 成功率低于第一成功率阈值吋， 确定流表趋于饱和， 停止线性递增。
[0054] 优选地， 表更新模块 22包括监控表构建模块 321、 更新确定模块 322和监控表更 新模块 323， 其中：
[0055] 监控表构建模块 321， 用于预先在控制器上构建攻击流监控表， 攻击流监控表 的监控表项包括交换机标识、 流表项序列、 流表项匹配域、 流表项添加吋刻和 流表项存在吋长；
[0056] 更新确定模块 322， 用于根据所有交换机触发的 Packet-in事件和 Flow-removed事 件， 分别确定所有交换机的流表中添加的流表项和刪除的流表项； 以及
[0057] 监控表更新模块 323， 用于在攻击流检测表中添加该添加的流表项对应的监控 表项和刪除该刪除的流表项对应的监控表项。
[0058] 优选地， 超吋检测模块 23包括检测模块 331和超吋确定模块 332， 其中：
[0059] 检测模块 331， 用于对攻击流监控表进行周期性检测， 以检测攻击流监控表中 是否存在流表项存在吋长超过吋长阈值的监控表项； 以及
[0060] 超吋确定模块 332， 用于当存在流表项存在吋长超过吋长阈值的监控表项吋， 确定攻击流监控表中有存在吋长超过吋长阈值的监控表项。
[0061] 在本发明实施例中， 通过线性递增和增量模式方式增加僵尸主机， 在成功模拟 数据平面隐蔽性 DDoS攻击同吋， 有效地加快了 DDoS攻击速率达到最小攻击速 度过程。 通过在控制器上构建攻击流监控表实现在控制器上进行 DDoS攻击检测 ， 并在攻击检测的过程中通过 Packet-in事件和 Flow-removed事件更新攻击流监控 表， 有效地避免攻击检测给交换机和控制器间的安全通道带来额外的通信幵销 ， 提高了数据平面隐蔽性 DDoS攻击的检测效率。
[0062] 在本发明实施例中， 软件定义网络的 DDoS攻击模拟和攻击检测装置的各模块 可由相应的硬件或软件模块实现， 各模块可以为独立的软、 硬件模块， 也可以 分别集成为软件定义网络的 DDoS攻击模拟系统和软件定义网络的系统上的一个 软、 硬件模块， 在此不用以限制本发明。
以上所述仅为本发明的较佳实施例而已， 并不用以限制本发明， 凡在本发明的 精神和原则之内所作的任何修改、 等同替换和改进等， 均应包含在本发明的保 护范围之内。

Claims

权利要求书
[权利要求 1] 一种软件定义网络的 DDoS攻击模拟和攻击检测方法， 其特征在于， 所述方法包括下述步骤：
通过预设线性递增和增量模式的方式增加僵尸主机， 通过所有僵尸主 机向软件定义网络中预设的目标交换机发起数据平面的隐蔽性 DDoS 攻击；
根据所述软件定义网络中所有交换机上流表的更新， 对所述软件定义 网络的控制器上预先构建的攻击流监控表进行同步更新；
对所述攻击流监控表进行周期性检测， 以确定所述攻击流监控表中是 否有存在吋长超过预设吋长阈值的监控表项；
当所述攻击流监控表中有存在吋长超过所述吋长阈值的监控表项吋， 确定所述存在吋长超过所述预设吋长阈值的监控表项所对应的网络流 为针对所述软件定义网络数据平面的隐蔽攻击流。
[权利要求 2] 如权利要求 1所述的方法， 其特征在于， 通过预设线性递增和增量模 式的方式增加僵尸主机， 通过所有僵尸主机向软件定义网络中预设的 目标交换机发起数据平面的隐蔽性 DDoS攻击的步骤， 包括： 对所述僵尸主机的数目进行线性递增， 当检测到所述目标交换机的流 安装成功率低于预设第一成功率阈值吋， 停止对所述僵尸主机进行线 性递增；
对所述僵尸主机的数目进行增量递增， 当检测到所述目标交换机的流 安装成功率低于预设第二成功率阈值吋， 停止对所述僵尸主机进行增 量递增；
根据所有的僵尸主机和所述软件定义网络的正常流速率， 以最小攻击 速率向所述目标交换机发送网络流。
[权利要求 3] 如权利要求 2所述的方法， 其特征在于， 对所述僵尸主机的数目进行 线性递增， 当检测到所述目标交换机的流安装成功率低于预设第一成 功率阈值吋， 停止对所述僵尸主机进行线性递增的步骤， 包括： 根据所述线性递增的方式和预设攻击吋间间隔多批次地增加所述僵尸 主机的数目， 每批僵尸主机在出现后以所述正常流速率向所述目标交 换机发起攻击；
通过所述控制器获取所述目标交换机的流安装成功率， 当检测到所述 流安装成功率低于所述第一成功率阈值吋， 确定所述流表趋于饱和， 停止所述线性递增。
[权利要求 4] 如权利要求 1所述的方法， 其特征在于， 根据所述软件定义网络中所 有交换机上流表的更新， 对所述软件定义网络的控制器上预先构建的 攻击流监控表进行同步更新的步骤， 包括：
预先在所述控制器上构建所述攻击流监控表， 所述攻击流监控表的监 控表项包括交换机标识、 流表项序列、 流表项匹配域、 流表项添加吋 刻和流表项存在吋长：
根据所述所有交换机触发的 Packet-in事件和 Flow-removed事件， 分别 确定所述所有交换机的流表中添加的流表项和刪除的流表项； 在所述攻击流检测表中添加所述添加的流表项对应的监控表项和刪除 所述刪除的流表项对应的监控表项。
[权利要求 5] 如权利要求 1所述的方法， 其特征在于， 对所述攻击流监控表进行周 期性检测， 以确定所述攻击流监控表中是否有存在吋长超过预设吋长 阈值的监控表项的步骤， 包括：
对所述攻击流监控表进行周期性检测， 以检测所述攻击流监控表中是 否存在所述流表项存在吋长超过所述吋长阈值的监控表项； 当存在所述流表项存在吋长超过所述吋长阈值的监控表项吋， 确定所 述攻击流监控表中有存在吋长超过所述吋长阈值的监控表项。
[权利要求 6] —种软件定义网络的 DDoS攻击模拟和攻击检测装置， 其特征在于， 所述装置包括：
攻击模拟模块， 用于通过预设线性递增和增量模式的方式增加僵尸主 机， 通过所有僵尸主机向软件定义网络中预设的目标交换机发起数据 平面的隐蔽性 DDoS攻击；
表更新模块， 用于根据所述软件定义网络中所有交换机上流表的更新 ， 对所述软件定义网络的控制器上预先构建的攻击流监控表进行同步 更新；
超吋检测模块， 用于对所述攻击流监控表进行周期性检测， 以确定所 述攻击流监控表中是否有存在吋长超过预设吋长阈值的监控表项； 以 及
攻击流确定模块， 用于当确定所述攻击流监控表中有存在吋长超过所 述吋长阈值的监控表项吋， 确定所述存在吋长超过所述预设吋长阈值 的监控表项所对应的网络流为针对所述软件定义网络数据平面的隐蔽 攻击流。
[权利要求 7] 如权利要求 6所述的装置， 其特征在于， 所述攻击模拟模块包括： 线性递增模块， 用于对所述僵尸主机的数目进行线性递增， 当检测到 所述目标交换机的流安装成功率低于预设第一成功率阈值吋， 停止对 所述僵尸主机进行线性递增；
增量模式模块， 用于对所述僵尸主机的数目进行增量递增， 当检测到 所述目标交换机的流安装成功率低于预设第二成功率阈值吋， 停止对 所述僵尸主机进行增量递增； 以及
隐蔽性攻击模块， 用于根据所有的僵尸主机和所述软件定义网络的正 常流速率， 以最小攻击速率向所述目标交换机发送网络流。
[权利要求 8] 如权利要求 7所述的装置， 其特征在于， 所述线性递增模块包括： 递增攻击模块， 用于根据所述线性递增的方式和预设的攻击吋间间隔 多批次地增加所述僵尸主机的数目， 每批僵尸主机在出现后以所述正 常流速率向所述目标交换机发起攻击； 以及
递增停止模块， 用于通过所述控制器获取所述目标交换机的流安装成 功率， 当检测到所述流安装成功率低于所述第一成功率阈值吋， 确定 所述流表趋于饱和， 停止所述线性递增。
[权利要求 9] 如权利要求 6所述的装置， 其特征在于， 所述表更新模块包括：
监控表构建模块， 用于预先在所述控制器上构建所述攻击流监控表， 所述攻击流监控表的监控表项包括交换机标识、 流表项序列、 流表项 匹配域、 流表项添加吋刻和流表项存在吋长；
更新确定模块， 用于根据所述所有交换机触发的 Packet-in事件和 Flow -removed事件， 分别确定所述所有交换机的流表中添加的流表项和刪 除的流表项； 以及
监控表更新模块， 用于在所述攻击流检测表中添加所述添加的流表项 对应的监控表项和刪除所述刪除的流表项对应的监控表项。
[权利要求 10] 如权利要求 6所述的装置， 其特征在于， 所述超吋检测模块包括： 检测模块， 用于对所述攻击流监控表进行周期性检测， 以检测所述攻 击流监控表中是否存在所述流表项存在吋长超过所述吋长阈值的监控 表项； 以及
超吋确定模块， 用于当存在所述流表项存在吋长超过所述吋长阈值的 监控表项吋， 确定所述攻击流监控表中有存在吋长超过所述吋长阈值 的监控表项。
PCT/CN2017/088934 2017-05-02 2017-06-19 一种软件定义网络的DDoS攻击模拟和攻击检测方法及装置 WO2018201581A1 (zh)

Priority Applications (1)

Application Number Priority Date Filing Date Title
US15/922,902 US10536480B2 (en) 2017-05-02 2018-03-15 Method and device for simulating and detecting DDoS attacks in software defined networking

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201710301393.3 2017-05-02
CN201710301393.3A CN106911726B (zh) 2017-05-02 2017-05-02 一种软件定义网络的DDoS攻击模拟和攻击检测方法及装置

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US15/922,902 Continuation US10536480B2 (en) 2017-05-02 2018-03-15 Method and device for simulating and detecting DDoS attacks in software defined networking

Publications (1)

Publication Number Publication Date
WO2018201581A1 true WO2018201581A1 (zh) 2018-11-08

Family

ID=59211064

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2017/088934 WO2018201581A1 (zh) 2017-05-02 2017-06-19 一种软件定义网络的DDoS攻击模拟和攻击检测方法及装置

Country Status (2)

Country Link
CN (1) CN106911726B (zh)
WO (1) WO2018201581A1 (zh)

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113452695A (zh) * 2021-06-25 2021-09-28 中国舰船研究设计中心 一种SDN环境下的DDoS攻击检测和防御方法
CN116112376A (zh) * 2022-12-20 2023-05-12 盛东如东海上风力发电有限责任公司 一种基于可编程交换机的洪泛攻击攻防演练方法及装置

Families Citing this family (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN108833376B (zh) * 2018-05-30 2020-12-15 中国人民解放军战略支援部队信息工程大学 面向软件定义网络的DoS攻击检测方法
CN110365693B (zh) * 2019-07-23 2021-10-08 光通天下网络科技股份有限公司 基于多方位监测的DoS攻击测试方法、装置和电子设备
CN114448728B (zh) * 2022-04-07 2022-07-01 中国人民解放军战略支援部队航天工程大学 用于调整交换机流表项的方法、装置和计算机可读介质

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2015030977A1 (en) * 2013-08-26 2015-03-05 A10 Networks, Inc. Health monitor based distributed denial of service attack mitigation
CN105554041A (zh) * 2016-03-01 2016-05-04 江苏三棱智慧物联发展股份有限公司 一种检测基于流表超时机制的分布式拒绝服务攻击的方法
CN105791220A (zh) * 2014-12-22 2016-07-20 中国电信股份有限公司 用于主动防御分布式拒绝服务攻击的方法和系统

Family Cites Families (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
KR20130017333A (ko) * 2011-08-10 2013-02-20 한국전자통신연구원 응용 계층 기반의 슬로우 분산서비스거부 공격판단 시스템 및 방법

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2015030977A1 (en) * 2013-08-26 2015-03-05 A10 Networks, Inc. Health monitor based distributed denial of service attack mitigation
CN105791220A (zh) * 2014-12-22 2016-07-20 中国电信股份有限公司 用于主动防御分布式拒绝服务攻击的方法和系统
CN105554041A (zh) * 2016-03-01 2016-05-04 江苏三棱智慧物联发展股份有限公司 一种检测基于流表超时机制的分布式拒绝服务攻击的方法

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113452695A (zh) * 2021-06-25 2021-09-28 中国舰船研究设计中心 一种SDN环境下的DDoS攻击检测和防御方法
CN116112376A (zh) * 2022-12-20 2023-05-12 盛东如东海上风力发电有限责任公司 一种基于可编程交换机的洪泛攻击攻防演练方法及装置

Also Published As

Publication number Publication date
CN106911726B (zh) 2020-09-08
CN106911726A (zh) 2017-06-30

Similar Documents

Publication Publication Date Title
WO2018201581A1 (zh) 一种软件定义网络的DDoS攻击模拟和攻击检测方法及装置
US12095812B2 (en) Systems and methods for mitigating and/or preventing distributed denial-of-service attacks
US10122740B1 (en) Methods for establishing anomaly detection configurations and identifying anomalous network traffic and devices thereof
Hu et al. A comprehensive security architecture for SDN
US20150089646A1 (en) Apparatus and method for protecting communication pattern of network traffic
US20160285822A1 (en) Detecting and preventing session hijacking
KR101429027B1 (ko) 메시지 박스 푸싱 방법 및 시스템
US10225269B2 (en) Method and apparatus for detecting network attacks and generating attack signatures based on signature merging
US20190014112A1 (en) Network management
CN110247899B (zh) 基于sdn云环境检测和缓解arp攻击的系统及方法
Kim et al. Trustworthy gateway system providing IoT trust domain of smart home
JPWO2016189843A1 (ja) セキュリティシステム、セキュリティ方法、及びプログラムを記憶する記録媒体
WO2017016454A1 (zh) 防范ddos攻击的方法和装置
US20220397514A1 (en) Signal detection system for improved microphone-controllable device security
Huang et al. An authentication scheme to defend against UDP DrDoS attacks in 5G networks
Grigoryan et al. Lamp: Prompt layer 7 attack mitigation with programmable data planes
KR101039092B1 (ko) ＩＰｖ６ 네트워크 내 호스트 보호 및 격리방법
CN110868392A (zh) 基于sdn的区块链安全控制方法、装置及区块链网络
WO2010048808A1 (zh) 一种防护网络攻击的方法、系统及网关
CN104796386A (zh) 一种僵尸网络的检测方法、装置和系统
CN117176659A (zh) 一种基于零信任环境的负载均衡方法及装置
EP3618396B1 (en) Protection method and system for http flood attack
CN115174264A (zh) 一种安全优化的单包认证方法及系统
JP5385867B2 (ja) データ転送装置及びアクセス解析方法
CN105592036B (zh) 一种优化fc端口安全的方法和装置

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 17908160

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

32PN Ep: public notification in the ep bulletin as address of the adressee cannot be established

Free format text: NOTING OF LOSS OF RIGHTS PURSUANT TO RULE 112(1) EPC (EPO FORM 1205A DATED 13/02/2020)

122 Ep: pct application non-entry in european phase

Ref document number: 17908160

Country of ref document: EP

Kind code of ref document: A1