CN111885092A - An edge node DDoS attack detection method, processing method and SDN - Google Patents

Abstract

The invention provides a DDoS attack detection method, processing method and SDN of an edge node. The detection method includes: receiving a request message flow sent by a puppet machine within a predetermined time period; calculating each request message flow according to the request message flow In this paper, the entropy value of the destination port corresponding to each destination IP address and the entropy value of the source port; according to the entropy value of the destination port corresponding to each destination IP address and the entropy value of the source port, the edge node corresponding to the destination IP address is judged Whether there is a DDoS attack. The detection method, processing method and SDN can solve the problem in the prior art that the DDoS attack behavior cannot be detected because the edge network is vulnerable to DDoS attacks and there is no DDoS physical cleaning device.

Description

An edge node DDoS attack detection method, processing method and SDN

technical field

The invention relates to the technical field of network attack defense, in particular to a DDoS attack detection method, processing method and SDN of an edge node.

Background technique

Distributed Denial of Service (DDoS) attack is currently the main attack method that threatens network security. This type of attack is controlled by hackers to send a large number of false packets to the victim host, thereby causing network congestion or the victim host. collapse. As service providers in edge networks, edge nodes are vulnerable to Distributed Denial of Service (DDoS) attacks, resulting in service interruption. In addition, there is usually no very expensive DDoS physical cleaning equipment in the edge network, so how to detect the DDoS attack behavior against the edge node in the edge network with a small cost becomes very critical and necessary.

SUMMARY OF THE INVENTION

The technical problem to be solved by the present invention is aimed at the above-mentioned deficiencies of the prior art, and provides a DDoS attack detection method, processing method and SDN of an edge node to solve the problem that the edge network is vulnerable to DDoS attack in the prior art, and there is no DDoS attack in the prior art. DDoS physical cleaning of the device leads to the problem that DDoS attacks cannot be detected.

In a first aspect, an embodiment of the present invention provides a method for detecting a DDoS attack on an edge node, which is applied to a software-defined network (SDN), and the method includes:

Receive the request message stream sent by the puppet machine within a predetermined time period;

Calculate the entropy value of the destination port corresponding to each destination IP address in each request message and the entropy value of the source port according to the request message flow;

According to the entropy value of the destination port corresponding to each destination IP address and the entropy value of the source port, it is determined whether the edge node corresponding to the destination IP address has a DDoS attack.

Preferably, before the step of receiving the request message stream sent by the puppet machine within a predetermined time period, the method further includes:

When the start time of the predetermined time period arrives, the flow entry of the switch is cleared.

Preferably, while receiving the request message stream sent by the puppet machine within a predetermined time period, the method further includes:

Analyze each request message in the received request message flow, and obtain the quadruple information of each request message, wherein the quadruple information includes: source IP address, destination IP address, source port and destination port;

The quadruple information of each request message is stored in a preset database.

Preferably, calculating the entropy value of the destination port and the entropy value of the source port corresponding to each destination IP address in each request packet according to the request packet flow, including:

Acquiring all quadruple information of each request message in the preset database;

The entropy value of the destination port and the entropy value of the source port corresponding to each destination IP address in the preset database are calculated according to the quadruple information.

Preferably, according to the entropy value of the destination port corresponding to each destination IP address and the entropy value of the source port, judging whether the edge node corresponding to the destination IP address has a DDoS attack, including:

If the entropy value of the destination port corresponding to the destination IP address is less than the first threshold, and the entropy value of the source port is greater than the second threshold, it is determined that the edge node corresponding to the destination IP address has a DDoS attack;

If the entropy value of the destination port corresponding to the destination IP address is less than the first threshold, and the entropy value of the source port is less than the second threshold, it is determined that the edge node corresponding to the destination IP address does not have a DDoS attack.

In a second aspect, an embodiment of the present invention provides a method for processing a DDoS attack on an edge node, which is applied to a software-defined network (SDN), and the method includes:

Using the edge node DDoS attack detection method described in the first aspect to determine whether the edge node corresponding to each destination IP address has a DDoS attack;

If it is judged that there is a DDoS attack, the request message matching the destination IP address, source IP address and destination port is discarded;

If it is determined that there is no DDoS attack on the edge node, the request packet whose destination IP address, source IP address and destination port match are forwarded.

Preferably, if it is judged that there is a DDoS attack on the edge node, the request packets matching the destination IP address, source IP address and destination port are discarded, including:

The controller in the SDN generates a flow table corresponding to the edge node, where the flow table is used to instruct the switch in the SDN to discard the request packet matching the destination IP address, source IP address and destination port, and the flow The priority of the table is set to the highest priority;

The flow table is delivered to the switch in the SDN, so that the switch preferentially matches the flow table and discards it when receiving a request message matching the destination IP address, source IP address and destination port.

In a third aspect, an embodiment of the present invention provides an SDN, including:

a receiving module, used for receiving the request message stream sent by the puppet machine within a predetermined time period;

A computing module, connected with the receiving module, is used to calculate the entropy value of the destination port and the entropy value of the source port corresponding to each destination IP address in each request message according to the request message flow;

A judging module, connected with the computing module, is used for judging whether the edge node corresponding to the destination IP address has a DDoS attack according to the entropy value of the destination port corresponding to each destination IP address and the entropy value of the source port.

Preferably, it also includes:

The flow entry clearing module is configured to clear the flow entry of the switch when the start time of the predetermined time period arrives.

Preferably, it also includes:

a first processing module, connected with the judgment module, for discarding the request message matching the destination IP address, the source IP address and the destination port when the judgment module judges that the edge node has a DDoS attack;

The second processing module is connected to the judging module, and is configured to forward the request message matching the destination IP address, the source IP address and the destination port when the judging module judges that the edge node does not have a DDoS attack.

The DDoS attack detection method, processing method, and SDN of an edge node provided by the embodiments of the present invention utilize the SDN in the edge network to receive the request message flow sent by the puppet machine within a predetermined period of time, and calculate each request message in each request message. The entropy value of the destination port corresponding to the destination IP address and the entropy value of the source port can detect the DDoS attack behavior against the edge node port by means of information entropy, thereby solving the problem that the edge network is vulnerable to DDoS attack in the prior art, and does not There is a problem that DDoS attacks cannot be detected due to physical DDoS cleaning of devices.

Description of drawings

1 is a flowchart of a DDoS attack detection method according to Embodiment 1 of the present invention;

2 is a flowchart of a method for processing a DDoS attack according to Embodiment 2 of the present invention;

FIG. 3 is a structural diagram of an SDN according to Embodiment 3 of the present invention.

Detailed ways

It should be noted that the embodiments in the present application and the features of the embodiments may be combined with each other in the case of no conflict. The present application will be described in detail below with reference to the accompanying drawings and in conjunction with the embodiments.

In order to make those skilled in the art better understand the solutions of the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings in the embodiments of the present application. Obviously, the described embodiments are only The embodiments are part of the present application, but not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative work shall fall within the scope of protection of the present application.

Example 1:

This embodiment provides a method for detecting a DDoS attack on an edge node, which is applied in a software defined network (Software Defined Network, SDN). As shown in FIG. 1 , the method includes:

Step S102: Receive a request message stream sent by the puppet machine within a predetermined time period;

In this embodiment, both the edge node and the puppet machine are located in the edge network, the edge network adopts the SDN architecture, the SDN includes a controller and at least one switch, the edge node is a server node in the edge network, and the client in the edge network is After hacking and manipulation, it becomes a puppet machine, the edge node and the puppet machine are connected to the switch in the SDN, and the puppet machine sends a request message to the SDN, and the request message includes a normal request message and a DDoS attack message.

It should be noted that in an SDN network, the switch is only responsible for forwarding according to the forwarding logic of the controller, and the forwarding logic of the controller is deployed on the switch in the form of a flow table. The switch sends a default flow table. The content of the flow table is to upload the received request message to the controller. The priority of this flow table is relatively low. When the request message reaches the switch, the switch will match the flow table. If there is no match, the request message will be uploaded to the controller for processing according to this default flow table.

Optionally, before the step of receiving the request message stream sent by the puppet machine within a predetermined time period, the method may further include:

When the start time of the predetermined time period arrives, the flow table entry of the switch is cleared.

In this embodiment, in order to prevent the switch from directly forwarding a flow entry that matches an attacked edge node because there is a flow entry in the current flow table without uploading it to the controller, at the beginning of the predetermined time period When it arrives, the flow entry of the switch is cleared, thereby further ensuring the comprehensiveness of detection. After clearing the flow entry, the switch only has the default flow entry, that is, uploading all received request packets to the controller for processing.

Optionally, while receiving the request message stream sent by the puppet machine within a predetermined time period, the method may further include:

Analyze each request message in the received request message flow, and obtain the quadruple information of each request message, where the quadruple information includes: source IP address, destination IP address, source port and destination port;

Save the quadruple information of each request message to the preset database.

In this embodiment, when the start time of the predetermined time period arrives, such as at time t0, the controller clears the switch flow table entry, and starts the following steps:

Step A: the controller receives the request message sent by the switch;

In this example, it is assumed that the puppet machine h1 sends a request packet flow to the SDN network, and the request packet includes two types of packets: a normal request packet sent to the edge node h2 and a DDoS attack packet sent to the edge node h3 , after the switch receives the host request message, it matches the default flow entry of the switch and uploads it to the controller in turn.

Step B: The controller parses the message and stores the quadruple (source IP address, destination IP address, source port, and destination port) information of the request message into the preset database DB. The entries of the DB can be as shown in Table 1:

Table 1

source IP address destination IP address source port destination port IP-h1 IP-h2 Port-h1 Port-h2 IP-h1 IP-h3 fake Port0 Port-h3

Step C: The controller sends the request message to the switch through the message forwarding procedure, and executes the normal forwarding process.

When the end time of the predetermined time period comes, for example, at time t1, the entry of the DB in the predetermined time period t may be as shown in Table 2, where t=t1-t0.

Table 2

source IP destination IP source port destination port IP-h1 IP-h2 Port-h1 Port-h2 IP-h1 IP-h3 fake Port0 Port-h3 ... ... ... ... IP-h1 IP-h3 Fake Portn Port-h3

Step S104: Calculate the entropy value of the destination port and the entropy value of the source port corresponding to each destination IP address in each request message according to the request message flow.

Optionally, calculating the entropy value of the destination port and the entropy value of the source port corresponding to each destination IP address in each request packet according to the request packet flow, may include:

Obtain all quadruple information of each request message in the preset database;

The entropy value of the destination port and the entropy value of the source port corresponding to each destination IP address in the preset database are calculated according to the quadruple information.

Among them, the calculation formula of the entropy value can be as follows:

H(x)=E[I(x _i )]=E[log(2,1/P(x _i ))]=-∑P(x _i )log(2,P(x _i ))(i= 1,2,..n)

Among them, x represents a random variable, which corresponds to the set of all possible outputs, which is defined as a symbol set, and the output of a random variable is represented by x. P(x) represents the output probability function. The greater the uncertainty of the variable, the greater the entropy. Taking Table 2 as an example, the entropy value of edge node H3 is log(2,n), and the entropy value of edge node H4 is 0.

Step S106: Determine whether the edge node corresponding to the destination IP address has a DDoS attack according to the entropy value of the destination port corresponding to each destination IP address and the entropy value of the source port.

During the research and practice of the prior art, the inventor found that the DDoS attack behavior is that the destination port of the puppet machine to send the request message is fixed and the source port is random, that is, the entropy value H4 of the destination port is less than the set first port. Threshold k4, the entropy value H3 of the source port is greater than the set second threshold k3. Therefore, according to the entropy value of the destination port corresponding to each destination IP address and the entropy value of the source port, it can be determined whether the edge node corresponding to the destination IP address has a DDoS attack.

Optionally, according to the entropy value of the destination port corresponding to each destination IP address and the entropy value of the source port, determine whether the edge node corresponding to the destination IP address has a DDoS attack, which may include:

If the entropy value of the destination port corresponding to the destination IP address is less than the first threshold, and the entropy value of the source port is greater than the second threshold, it is determined that the edge node corresponding to the destination IP address has a DDoS attack;

If the entropy value of the destination port corresponding to the destination IP address is less than the first threshold, and the entropy value of the source port is less than the second threshold, it is determined that the edge node corresponding to the destination IP address does not have a DDoS attack.

In this embodiment, as shown in Table 2, if the SDN controller can obtain by comparison, when the destination IP is h2, H4<k4 and H3<k3, and when the destination IP is h3, H4<k4 and H3>k3, it is determined that the A DDoS attack occurs on the network against the designated port Port-h3 of the edge node h3, which overloads the edge node.

The method for detecting a DDoS attack on an edge node provided by this embodiment uses SDN in the edge network to receive the request message flow sent by the puppet machine within a predetermined period of time, and calculates the destination corresponding to each destination IP address in each request message. The entropy value of the port and the entropy value of the source port can detect the DDoS attack behavior against the edge node port by means of information entropy, thus solving the problem in the prior art that the edge network is vulnerable to DDoS attacks and there is no DDoS physical cleaning device. The problem that leads to the inability to detect DDoS attack behavior.

Example 2:

As shown in FIG. 2 , this embodiment provides a DDoS attack processing method, which is applied to a software-defined network SDN. The method includes:

Step S202: adopt the DDoS attack detection method of the edge node as described in Embodiment 1 to determine whether the edge node corresponding to each destination IP address has a DDoS attack;

Step S204: if it is judged that there is a DDoS attack, the request message matching the destination IP address, source IP address and destination port is discarded;

Step S206 : if it is determined that there is no DDoS attack on the edge node, forward the request packet whose destination IP address, source IP address and destination port match.

Optionally, if it is determined that there is a DDoS attack on the edge node, the request packets matching the destination IP address, source IP address and destination port are discarded, which may include:

The controller in the SDN generates the flow table corresponding to the edge node. The flow table is used to instruct the switch in the SDN to discard the request packets matching the destination IP address, source IP address and destination port. The priority of the flow table is set to the highest priority class;

Distribute the flow table to the switch in the SDN, so that the switch will preferentially match the flow table and discard it when it receives a request packet that matches the destination IP address, source IP address, and destination port.

During the research and practice of the prior art, the inventor found that the existing DDoS attack processing methods usually limit the speed of the switch port connected to the puppet machine when detecting DDoS attack behavior in the network. Although the propagation of DDoS packets in the network is avoided, the normal services of the puppet machine will be interrupted. For example, when host h1 normally accesses server h2 in the network, it is attacked by hackers and becomes a puppet machine, and sends a large number of false requests to server h3, resulting in a DDoS attack that overloads the server. When the SDN controller detects a DDoS attack, it will All packets sent by h1 are discarded or the rate is limited, so that h1 cannot continue to access the network normally.

In this embodiment, if the SDN controller determines that a DDoS attack occurs on the designated port Port-h3 of the edge node h3 and overloads the edge node, the SDN controller reads and generates a triplet (source IP= IP-h1, destination IP=IP-h3, destination port=Port-h3). The SDN controller sends a flow table to the switch. The flow table rule is set to match the triplet and the operation of discarding packets is performed. The priority of the flow table is set to be higher than that of all current flow tables of the switch.

After the above operations, the puppet machine h1 sends a request message to the SDN network again. The request message includes two types of messages: a normal request message sent to the server host h2 and a DDoS attack message sent to the server host h3. DDoS attack packets destined for h3 preferentially match the set flow table rules, and the switch discards the packets. The normal request packets sent to h2 are matched to the default flow table, uploaded to the controller, and forwarded normally according to the controller logic.

In the DDoS attack processing method provided by the embodiment of the present invention, the DDoS attack message is filtered through the flow table, so that the normal network access of the puppet machine is prevented from being affected. At the same time, by using SDN in the edge network to receive the request message flow sent by the puppet machine within a predetermined period of time, and calculating the entropy value of the destination port corresponding to each destination IP address in each request message and the entropy value of the source port, The DDoS attack behavior against the edge node port can be detected by means of information entropy, thereby solving the problem that the DDoS attack behavior cannot be detected in the prior art because the edge network is vulnerable to DDoS attacks and there is no DDoS physical cleaning device.

Example 3:

As shown in FIG. 3 , this embodiment provides an SDN, including:

The receiving module 30 is used for receiving the request message stream sent by the puppet machine within a predetermined time period;

The computing module 32 is connected with the receiving module 30, and is used to calculate the entropy value of the destination port corresponding to each destination IP address in each request message and the entropy value of the source port according to the request message flow;

The judgment module 34 is connected to the calculation module 32, and is used for judging whether the edge node corresponding to the destination IP address has a DDoS attack according to the entropy value of the destination port corresponding to each destination IP address and the entropy value of the source port.

Preferably, it can also include:

The flow entry clearing module is used for clearing the flow entry of the switch when the start time of the predetermined time period comes.

Preferably, it can also include:

The first processing module, connected with the judgment module 34, is used for discarding the request message matched with the destination IP address, the source IP address and the destination port when the judgment module judges that the edge node has a DDoS attack;

The second processing module is connected to the judging module 34, and is used for forwarding the request message matching the destination IP address, the source IP address and the destination port when the judging module judges that there is no DDoS attack on the edge node.

The SDN provided in Embodiment 3 uses the SDN in the edge network to receive the request message stream sent by the puppet machine within a predetermined time period, and calculates the entropy value of the destination port corresponding to each destination IP address in each request message and the source. The entropy value of the port can detect the DDoS attack behavior against the edge node port by means of information entropy, thereby solving the problem that the DDoS attack behavior cannot be detected in the existing technology because the edge network is vulnerable to DDoS attacks and there is no DDoS physical cleaning device. The problem.

It can be understood that the above embodiments are only exemplary embodiments adopted to illustrate the principle of the present invention, but the present invention is not limited thereto. For those skilled in the art, without departing from the spirit and essence of the present invention, various modifications and improvements can be made, and these modifications and improvements are also regarded as the protection scope of the present invention.

Claims (10)

1. A DDoS attack detection method of an edge node is applied to a Software Defined Network (SDN), and comprises the following steps:

receiving a request message stream sent by a puppet machine in a predetermined time period;

calculating the entropy value of a destination port and the entropy value of a source port corresponding to each destination IP address in each request message according to the request message flow;

and judging whether the edge node corresponding to the destination IP address has DDoS attack according to the entropy value of the destination port corresponding to each destination IP address and the entropy value of the source port.

2. The method of claim 1, wherein before the step of receiving the request packet stream sent by the puppet machine within a predetermined time period, the method further comprises:

and when the starting time of the preset time period comes, clearing the flow table entry of the switch.

3. The method of claim 2, wherein, while receiving the request packet stream sent by the puppet machine within a predetermined time period, the method further comprises:

analyzing each request message in the received request message stream to obtain quadruple information of each request message, wherein the quadruple information comprises: a source IP address, a destination IP address, a source port, and a destination port;

and storing the quadruple information of each request message into a preset database.

4. The method of claim 3, wherein the calculating the entropy of the destination port and the entropy of the source port corresponding to each destination IP address in each request packet according to the request packet flow comprises:

acquiring all four-tuple information of each request message in the preset database;

and calculating the entropy value of a destination port and the entropy value of a source port corresponding to each destination IP address in the preset database according to the quadruple information.

5. The method of claim 4, wherein the determining whether the DDoS attack exists on the edge node corresponding to the destination IP address according to the entropy of the destination port and the entropy of the source port corresponding to each destination IP address comprises:

if the entropy value of a destination port corresponding to a destination IP address is smaller than a first threshold value and the entropy value of a source port is larger than a second threshold value, judging that a DDoS attack exists on an edge node corresponding to the destination IP address;

and if the entropy value of the destination port corresponding to the destination IP address is smaller than a first threshold value and the entropy value of the source port is smaller than a second threshold value, judging that the edge node corresponding to the destination IP address does not have DDoS attack.

6. A DDoS attack processing method of an edge node is applied to a Software Defined Network (SDN), and comprises the following steps:

judging whether the edge node corresponding to each destination IP address has DDoS attack by adopting the DDoS attack detection method of the edge node according to any one of claims 1 to 5;

if DDoS attack exists, discarding the request message matched with the destination IP address, the source IP address and the destination port;

and if the edge node is judged to have no DDoS attack, forwarding the request message matched with the destination IP address, the source IP address and the destination port.

7. The DDoS attack processing method for an edge node according to claim 6, wherein if it is determined that a DDoS attack exists on the edge node, discarding the request packet matching the destination IP address, the source IP address, and the destination port comprises:

a controller in the SDN generates a flow table corresponding to the edge node, wherein the flow table is used for indicating a switch in the SDN to discard a request message matched with the destination IP address, the source IP address and the destination port, and the priority of the flow table is set to be the highest priority;

and issuing the flow table to a switch in the SDN so that the switch preferentially matches the flow table and discards the flow table when receiving a request message matched with the destination IP address, the source IP address and the destination port.

8. An SDN, comprising:

a receiving module, configured to receive a request message stream sent by a puppet machine within a predetermined time period;

a calculating module, connected to the receiving module, configured to calculate, according to the request packet flow, an entropy of a destination port and an entropy of a source port corresponding to each destination IP address in each request packet;

and the judging module is connected with the calculating module and is used for judging whether the DDoS attack exists on the edge node corresponding to the destination IP address or not according to the entropy value of the destination port corresponding to each destination IP address and the entropy value of the source port.

9. The SDN of claim 8, further comprising:

and the flow table entry emptying module is used for emptying the flow table entry of the switch when the starting time of the preset time period arrives.

10. The SDN of claim 8, further comprising:

the first processing module is connected with the judging module and used for discarding the request message matched with the destination IP address, the source IP address and the destination port when the judging module judges that the DDoS attack exists on the edge node;

and the second processing module is connected with the judging module and used for forwarding the request message matched with the destination IP address, the source IP address and the destination port when the judging module judges that the DDoS attack does not exist in the edge node.

Images