软件定义网络异常流量抑制方法仿真研究  

Simulation Research on Software-Defined Network Abnormal Traffic Suppression Method

作　　者：袁志[1] 向雄[1] YUAN Zhi;XIANG Xiong(South China Institute of Software Engineering. GU,Guangdong Guangzhou 510990,China)

机构地区：[1]广州大学华软软件学院

出　　处：《计算机仿真》2019年第7期265-268,327,共5页Computer Simulation

基　　金：广东高校省级重点平台和重大科研项目(2015KTSCX177;2016KTSCX188)

摘　　要：软件定义网络异常流量抑制方法在网络异常检测领域中的研究具重要意义。针对当前方法网络异常流量抑制准确性差的问题,提出基于自适应参数的网络异常流量抑制方法。在网络数据样本集中引入目标函数,计算软件定义网络的线性函数,得到正规化系数,利用源域和目标域的实际数据计算源域与目标域之间的最大均值差,建立软件定义网络攻击模型。在此基础上,通过时间序列来分析软件定义网络的状态,并计算时间序列无穷大时其对数的似然比统计量,将似然比统计量与阈值作比较,判断网络流量检测均值是否偏移,引入报警阈值,得到网络流异常流量函数表达式,计算网络流量平均值的统计值,分析网络流量均值与报警阈值之间的关系,利用调节参数调节流量均值和报警阈值,最终实现了软件定义网络异常流量的抑制。实验结果表明,提出方法在对软件定义网络异常流量抑制时,能够准确的抑制网络异常流量,并且抑制时间较短,具有时效性。At present, the accuracy of abnormal traffic suppression is poor. This paper presents a network abnormal traffic suppression method based on adaptive parameters. Firstly, the objective function was introduced into the network data sample set and the linear function of software-defined network was calculated to obtain the normalization coefficient. Secondly, the actual data of source domain and target domain was used to calculate the maximum mean difference between the source domain and the target domain and establish a attack model of software-defined network. On this basis, the time series was used to analyze the state of software-defined network, and then likelihood ratio statistic of logarithm was calculated when time series was infinity. Moreover, the likelihood ratio statistic was compared with the threshold to determine whether the shifting of network traffic mean was occurred. In addition, the alarm threshold was introduced to get the expression of the abnormal flow function. Meanwhile, the statistical value of mean value of network traffic was calculated and the relationship between the mean value of network traffic and the alarm threshold was analyzed. Finally, the flow mean and the alarm threshold were adjusted by adjusting parameters, and thus to achieve the suppression of abnormal traffic in software-defined network. Simulation results show that the proposed method can accurately suppress the abnormal traffic in network. Meanwhile, this method has short suppression time and timeliness.

关 键 词：软件定义 网络异常 流量 抑制 

分 类 号：TP939.07[自动化与计算机技术]