SDN中交换机控制代理拒绝服务攻击研究  

Research on Switch Control Agent Denial-of-Service Attack in SDN

作　　者：邓书华 卢泽斌 李正发 高协平 DENG Shuhua;LU Zebin;LI Zhengfa;GAO Xieping(The MOE Key Laboratory of Intelligent Computing and Information Processing,Xiangtan University,Xiangtan,Hunan 411105,China;College of Information Engineering,Xiangtan University,Xiangtan,Hunan 411105,China)

机构地区：[1]湘潭大学智能计算与信息处理教育部重点实验室,湖南湘潭411105 [2]湘潭大学信息工程学院,湖南湘潭411105

出　　处：《计算机工程》2019年第10期176-182,共7页Computer Engineering

基　　金：国家自然科学基金(61771415);赛尔网络下一代互联网技术创新项目(NGII20160408)

摘　　要：针对软件定义网络(SDN)交换机控制代理吞吐量有限的不足,提出一种交换机控制代理拒绝服务攻击方法。为保护SDN交换机控制代理资源,设计层次化多阈值的攻击检测方案,通过计算SDN交换机及交换机各端口所关联的Packet-In消息的速率,并将其与给定的阈值进行比较来检测攻击。实验结果表明,该方法可实时检测交换机控制代理拒绝服务攻击,与同类攻击检测方法相比,不仅能够识别攻击流量,定位攻击发生的位置,而且不需要改变网络架构。Aiming at the shortcomings of limited throughput of Software Defined Networking(SDN)switch control agent,a switch control agent denial-of-service attack method is proposed.To protect the SDN switch control agent resources,a hierarchical multi-threshold attack detection scheme is designed to detect attacks by calculating the rate of Packet-In messages associated with each port of the SDN switch and comparing it with a given threshold.Experimental results show that the algorithm can detect the switch control agent denial-of-service attacks in real time.Compared with the similar attack detection method,the proposed method can not only identify the attack traffic,but also locate the location of the attacks without changing the network architecture.

关 键 词：软件定义网络 OpenFlow交换机 拒绝服务攻击 控制代理 网络架构 

分 类 号：TP391[自动化与计算机技术—计算机应用技术]