基于端口跳变的SDN网络防御技术  

Port hopping based SDN network defense technology

作　　者：唐秀存[1] 张连成 史晓敏[1] 徐良华[1] Tang Xiucun;Zhang Liancheng;Shi Xiaomin;Xu Lianghua(Jiangnan Institute of Computing Technology, Wuxi Jiangsu 214083 , China;State Key Laboratory of Mathematical Engineering & Advanced Computing, Zhengzhou 450001 , China)

机构地区：[1]江南计算技术研究所,江苏无锡214083 [2]数学工程与先进计算国家重点实验室,郑州450001

出　　处：《计算机应用研究》2016年第10期3083-3087,共5页Application Research of Computers

基　　金：国家青年自然科学基金资助项目(61402525;61402526);国家"863"计划资助项目(2012AA012902)

摘　　要：端口跳变是移动目标防御典型技术,通过持续改变服务端口来隐藏服务标志和迷惑攻击者。利用SDN逻辑集中控制与网络可编程特性,提出基于端口跳变的SDN网络防御技术。使用SDN控制器承担服务端的端口跳变功能,不但可以减轻服务端负载,而且能提前检测过滤恶意数据包,并能抵御内部攻击者。理论分析与实验结果表明,所提技术对SDN控制器负载增加较少,可有效抵御Do S攻击。Port hopping was a typical technology of m oving target defense, which constantly changed service port number to hide service identifications and confused potential attackers. Using SDN logically centralized control and network program mable features, this paper proposed a po rt hopping based SDN netw ork defense tech nolog y, which utilized SDN controlle r to im plement port hopping function . This proposed technology not on ly cou ld reduce protected server5 s load caused by port hoppin g , but also could detect and early filte r m a licio us packets. At the same tim e , i t cou ld defend against in te rn a l attackers.T h eoretical analysis and experim ental results show th a t this proposed technology can effectively resist DoS attack w ith o u t addingm uch load on SDN c o n tro lle r in SDN.

关 键 词：软件定义网络 拒绝服务攻击 端口跳变 移动目标防御 控制器 时间戳反馈 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]