SDN环境下基于Renyi熵的低速率分布式拒绝攻击的检测

Detection of Low Rate DDoS Attacks Based on Renyi Entropy in SDN Environment

针对现在对低速率分布式拒绝攻击的研究不足,提出了一种在软件定义网络(SDN)环境下,利用Renyi熵来检测L-DDoS的方法.该方法首先在控制器上收集PACKET_IN数据包,然后基于目的 IP来计算Renyi熵,最后通过设定一定的阈值来检测异常流量.实验结果表明:相比于利用香农熵的检测方法,该方法通过调整一定目的 IP熵的阶数可以检测L-DDoS攻击流量从而降低误警率.

At present,since the research of the L-DDoS attack is not too much,a method of detecting L-DDoS using Renyi entropy based on a software defined network( SDN) was proposed. Firstly,PACKET_IN data packets were collected on controller,and then the Renyi entropy was calculated based on destination IP. Finally setting a threshold was used to detect abnormal traffic. The experimental results showed that compared with the Shannon entropy detection method,this method can detect the L-DDoS attack traffic and reduce the false alarm rate by adjusting the number of orders.