SDN网络架构下应用层DDos攻击分类及检测方法研究

Research on the classification and detection methods of application layer DDos attacks under SDN network architecture

DDoS攻击手段主要是针传输层的TCP-SYN、UDP,以及网络层的ICMP泛洪等,早期DDos的攻击很容易就被更先进的检测技术、如机器学习和深度学习技术检测出来,于是就出现了更复杂和针对性更强的DDoS攻击,即应用层攻击。本文将SDN架构中的各种组件在遭受DDoS攻击后按受到攻击的影响范围和攻击强度进行分类,同时使用轻量化工具Mininet构建模拟测试环境,应用AdaBoost机器学习模型,通过对数据流的分析,区分正常和恶意的数据流量,进一步提高检测的准确率,对SDN网络架构全面实现自动化防御具有现实意义。

DDoS attacks are mainly targeted at TCP-SYN and UDP at the transport layer,and ICMP flooding at the network layer,etc.Early DDos attacks are easily detected by more advanced detection techniques such as machine learning and deep learning techniques,and thus more sophisticated and targeted DDoS attacks,i.e.,application layer attacks,emerge.In this paper,various components in the SDN architecture are classified according to the scope of impact and attack intensity after being subjected to DDoS attacks,while a simulation test environment is constructed using the lightweight tool Mininet,and the AdaBoosting machine learning model is applied to further improve the accuracy of detection by distinguishing normal and malicious data traffic through the analysis of data flows,which is useful for the SDN network.It is of practical significance to fully realize automated defense for SDN network architecture.