一种基于SDN架构的海量DDOS攻击解决方案研究

Research on a Solution of Massive DDOS Attack Based on SDN Architecture

本文介绍了一种基于SDN架构的低成本、高性能的海量DDOS攻击解决方案,目前DDOS攻击呈现愈演愈烈的趋势,尤其是IDC内的部分SP频繁遭受天文数字般的DDOS攻击,本方案采用SDN+BGP FLOWSPEC技术,提供一种经济、有效的海量DDOS攻击防护解决方案,对异常攻击流量进行精确控制和丢弃,保护正常流量不受影响。本方案基于开源的Open Day Light SDN架构实施自主开发,构建了一个集中式的异常流量处置控制平台,平台中的SDN控制器一方面解读分析由现网异常流量监测设备所提供的DDOS攻击信息,另一方面通过BGP FLOWSPEC协议,向全网路由设备下发相应的路由策略,实现对DDOS攻击流量的抑制和过滤。

This paper introduces a solution of low cost and high performance SDN architecture of massive DDOS attack based on the current DDOS attacks is growing,especially in the part of SP IDC frequently suffered astronomical DDOS attacks,the program uses SDN＋BGP FLOWSPEC technology to provide massive DDOS attack protection an economical and effective solution for precise control and disposal of abnormal attack traffic,protect the normal traffic is not affected. The program developed implementation of open source Open Day Light SDN architecture,constructed a centralized disposal of abnormal traffic control platform,SDN controller platform on the one hand analysis provided by the network traffic anomaly monitoring equipment DDOS attack information,on the other hand through the BGP FLOWSPEC protocol,routing strategy corresponding to send the whole network equipment,realize the suppression and filtering of DDOS attack traffic.