一种针对基于OpenFlow的SDN网络中控制层面的DoS攻击研究

Research on DoS Attacks Against Control Level in OpenFlow-based SDN

针对OpenFlow协议报文交换机制里所有非数据报文均需要通过PACKET_IN报文上传控制器的弱点,提出一种不停查询未知转发地址从而造成SDN网络控制层面资源耗尽的新型DoS攻击方式,同时基于SDN网络可编程性提出检测攻击与降低网络时延的解决策略。首先通过SDN控制器北向应用接口,使用Defense4ALL应用中自定义功能,针对DoS攻击特性检测网络中恶意流量。然后利用控制器动态配置特性,实时更新交换机配置文件,改变网络转发策略,从而减轻攻击对整个网络造成的影响。实验仿真表明,在大规模高速攻击中,该方法的检测成功率接近100%,在攻击源较少的慢速攻击中检测成功率低于80%,整体网络延迟降低10ms以上。所提出的解决策略可以有效减少针对控制平面的DoS攻击对整个网络的干扰。

Based on OpenFlow protocol message exchange mechanism, all non-data packets need uploading by PACKET_IN message. Thus, a new DoS attack on the control plane was proposed. It uses non-stop forwarding unknown address packages to deplete resources in control plane. And a solution strategy was proposed to detect attacks and reduce network latency based on the programmability of SDN network. First, through SDN controller north application interface, Defense4ALL application was used to detect malicious traffic by characteristic of DoS attacks. Then by using the controller feature of dynamical configuration, switch configuration file was updated in real-time, and network forwarding policy was changed. Thereby it could reduce the damage caused by the attack on the entire network. The simulation shows that the success rate of this detection method closes to 100 %. But in slow-speed less-source attack detection success rate is less than 80%. The overall network latency is reduced by 10ms or more. The proposed solution strategy can effectively reduce the interference of the DoS attacks against control level for entire network.