闫 巧,龚庆祥,于 非.软件定义网络中的分布式拒绝服务攻击抑制模型[J].深圳大学学报理工版,2017,34(No.6(551-660)):562-569.[doi:10.3724/SP.J.1249.2017.06562]
Yan Qiao,Gong Qingxiang,and Yu Fei.The inhibition model of DDoS attacks in SDN networks[J].Journal of Shenzhen University Science and Engineering,2017,34(No.6(551-660)):562-569.[doi:10.3724/SP.J.1249.2017.06562]
点击复制
软件定义网络中的分布式拒绝服务攻击抑制模型
闫 巧,龚庆祥,于 非

深圳大学计算机与软件学院,广东深圳 518060

通信系统; 软件定义网络; OpenFlow协议; 分布式拒绝服务攻击; 模糊综合评判决策模型

The inhibition model of DDoS attacks in SDN networks
Yan Qiao, Gong Qingxiang, and Yu Fei

Yan Qiao, Gong Qingxiang, and Yu FeiCollege of Computer Science and Software Engineering, Shenzhen University, Shenzhen 518060, Guangdong Province, P.R.China

communication system; software defined networking; OpenFlow protocol; distributed denial of service attack attacks; fuzzy synthetic evaluation decision-making model

DOI: 10.3724/SP.J.1249.2017.06562

备注

针对软件定义网络(software defined networking, SDN)中控制器受到分布式拒绝服务(distributed denial of service, DDoS)攻击致使SDN网络可能面临单点失效的威胁,提出抑制SDN网络中DDoS攻击的模型.该模型主要是在SDN应用层上扩展DDoS检测模块和MSlot(multiple timeslot)算法模块.在DDoS攻击检测上,DDoS检测模块采用模糊综合评判决策模型,通过综合多个流特征指标实时检测DDoS的发生,并使用DDoS综合评判分数描述DDoS攻击的强度.在应对DDoS攻击流策略上,MSlot算法模块根据检测结果采取相应的时间片分配策略,确保SDN网络在DDoS攻击下可有效保护合法用户的通信.为测试DDoS抑制模型,通过仿真模拟不同攻击强度的DDoS攻击.结果表明,在SDN网络中,相比某些基于单因素评判指标的DDoS攻击检测算法,采用模糊综合评判决策模型在检测率和精确度上更有优势; 在DDoS攻击时,MSlot算法模块根据检测结果采取相应的时间片分配策略相比某些只使用多个逻辑队列轮询机制的SDN控制器调度算法可更有效地保护合法用户的通信质量.

In software defined networking(SDN), the controller may suffer from distributed denial of service(DDoS)attack, which may cause the threat of single point of failure. In this paper, a model is proposed to defend against DDoS attacks in SDN. In the model, DDoS detection module and multiple timeslot(MSlot)algorithm module are extended in the application layer. For DDoS attack detection, DDoS detection module is based on fuzzy synthetic evaluation decision-making model. It can detect the occurrence of DDoS in real time according to the multiple flow characteristic indexes and use the DDoS comprehensive evaluation scores to describe the strength of DDoS attack. For the strategy of defeating DDoS attacks, MSlot algorithm module is designed to decide when applying the time slice allocation strategy to get the detection result from DDoS detection module. The strategy can effectively protect the communication of legitimate users under the DDoS attacks. In order to test the model, we simulate DDoS attacks with different intensities. The results from different intensities of DDoS attacks show that in SDN networks, compared with some other DDoS attacks detection algorithms based on single flow characteristic index, ‘DDoS detection module' has better detection rate and accuracy by using the fuzzy comprehensive evaluation decision model. Compared with some other SDN controller scheduling algorithms which only use multiple logical queue and polling mechanism, the communication quality of legitimate users can be protected more effectively by MSlot algorithm module.

·