基于OpenFlow与sFlow的DDoS攻击防御方法

DDoS Defense Method Based on OpenFlow and sFlow

分布式拒绝服务(DDoS)攻击是目前比较流行的网络攻击,其破坏力大并且难以防范追踪,对互联网安全造成了极大的威胁。针对此问题提出了一种基于OpenFlow与sFlow的入侵检测方法,通过sFlow采样技术实时检测网络流量,依据网络正常流量设定流量阈值,并通过对超过阈值的异常流量进行攻击检测、判断攻击流,最终使用OpenFlow协议阻断攻击源。该方法可以在几秒内自动检测、处理多种DDoS攻击。实验结果表明,与现有方案对比,该方法能够实时检测并阻止DDoS攻击,有效降低网络资源消耗。

The distributed denial of service attack (DDoS) have widely spread in network,which may cause the network or service unavailable and difficult to defend and trace,and lead to threats for Internet security.This paper proposes the method of intrusion detection based on OpenFlow and sFlow.In this method,the sFlow sampling technique is used to monitor the flow,and the threshold is set based on normal traffic flow;then the attack detection is performed for abnormal traffic flow of threshold to judge the attack flow;At last,the OpenFlow protocol is used to interrupt the attack sources.This method can automatically detect and process multiple DDoS attacks in several soconds.The experimental results show that compared with other existing solutions,this method can monitor the attack in runtime and reduce network resource consumption effectively.