面向SDN网络安全防护的DDoS攻击检测溯源系统设计与应用研究

Design and Application Research of DDoS Attack Detection Traceability System for SDN Network Security Protection

随着计算机网络的快速发展,针对网络的攻击也越来越多。如何获取攻击特征信息,从而达到营造绿色网络的目的是当前研究的热点。为了解决此问题,研究构建了基于软件定义网络(Software Defined Network,SDN)的分布式拒绝服务攻击(Distributed Denial of Service,DDoS)检测溯源模型。研究首先对DDoS的攻击进行了检测,然后构建了溯源模型,最后溯源模型的性能进行了分析。结果表明,有溯源模块的CPU占用率平均值比无溯源模块的低10.81%;SDN分别比DSR、SRE精密度和查全率高出21.78%、31.34%和18.52%、21.17%;在单攻击源溯源中平均耗时46 ms,在多攻击源溯源中同样能完成溯源工作。验证了模式方法不但能够很好地降低检测对资源的消耗,同时还能够增大溯源系统的稳定性和找到攻击源头的可能性。为DDoS攻击检测和溯源的研究提供了新的思路。

With the rapid development of computer networks,there are more and more attacks against them.How to obtain the information of attack characteristics so as to achieve the purpose of creating a green network is a hot topic of current research.To solve this problem,the study constructs a distributed denial of service(DDoS) attack detection traceability model based on Software Defined Network(SDN).Through simulation experiments,the presence or absence of the traceability module,different functions,and the processing of single and multiple attack sources are utilized.The results show that the average CPU occupation rate with the traceability module is 10.81% lower than that without the traceability module;SDN is 21.78%,31.34% and 18.52%,21.17% higher than DSR and SRE in terms of precision and check-all rate,respectively;the average time spent in single-attack source traceability is 46ms,and the traceability work can be completed in multi-attack source traceability as well.It is verified that the pattern method can not only reduce the consumption of resources for detection,but also increase the stability of the traceability system and the possibility of finding the source of attacks.It provides a new idea for the research of DDoS attack detection and tracing.