SDN self-protection system based on Renyi entropy

Pu ZHAO; Wentao ZHAO; Zhangjie FU; Qiang LIU

doi:10.11959/j.issn.2096-109x.2021049

您当前的位置：

首页 >

文章列表页 >

SDN self-protection system based on Renyi entropy

TopicⅡ: SDN and cloud computing security | 更新时间：2024-06-03

- SDN self-protection system based on Renyi entropy
- Chinese Journal of Network and Information Security Vol. 7, Issue 3, Pages: 85-94(2021)
- 作者机构：
  
  1. 国防科技大学计算机学院，湖南长沙 410073
  2. 南京信息工程大学计算机与软件学院，江苏南京 210044
- 作者简介：
- 基金信息：
- DOI：10.11959/j.issn.2096-109x.2021049
  CLC： TP393
- Online First：2021-06，
  
  Published：15 June 2021
- 稿件说明：
移动端阅览
Pu ZHAO, Wentao ZHAO, Zhangjie FU, et al. SDN self-protection system based on Renyi entropy[J]. Chinese Journal of Network and Information Security, 2021, 7(3): 85-94.
DOI：

Pu ZHAO, Wentao ZHAO, Zhangjie FU, et al. SDN self-protection system based on Renyi entropy[J]. Chinese Journal of Network and Information Security, 2021, 7(3): 85-94. DOI： 10.11959/j.issn.2096-109x.2021049.

摘要

针对SDN架构下的常见网络异常行为，提出了一套基于Renyi熵的SDN自主防护系统，该系统可实现网络异常行为检测、诊断及防御。系统无须引入第三方测量设备，直接利用OpenFlow交换机流表信息。首先，通过计算和检测特征熵值，实现异常网络行为的检测。然后，进一步分析OpenFlow流表信息，实现异常行为的诊断。最后，实施防御控制措施，建立一套黑名单机制，将产生异常行为的主机加入黑名单，并阻塞相应的异常流量。为了验证系统的有效性，在Floodlight控制器上开发了原型。Mininet上的仿真实验表明，系统能够有效检测、诊断及防御网络中常见的异常行为，且具有较低的部署成本，增强了SDN的安全性。

Abstract

Aiming at the abnormal behaviors in SDN architecture

a self-protection system based on Renyi entropy that implemented a set of detection

diagnosis and defense method of SDN abnormal behaviors was proposed.The system did not need to introduce the third-party measurement equipment

and directly used the flow table information of OpenFlow switches.Firstly

the abnormal network behavior was detected by calculating the characteristic entropy.Then

the information of the OpenFlow flow table was further analyzed to realize the diagnosis of abnormal behavior.Finally

a blacklist mechanism was established.And the system added the hosts with abnormal behavior to the blacklist and blocked the corresponding abnormal traffic.In order to verify the effectiveness of the system

a prototype was developed on the Floodlight controller.The simulation results on Mininet show that the system can effectively detect

diagnose and defend the abnormal behaviors.The system has low deployment cost

which enhances the security of SDN.

关键词

Keywords

references

BRAGA R , MOTA E , PASSITO A . Lightweight DDoS flooding attack detection using NOX/OpenFlow [C ] // The 35th Annual IEEE Conference on Local Computer Networks . 2010 .

BEHAL S , SINGH J . Detection and mitigation of DDoS attacks in SDN:a comprehensive review,research challenges and future directions [J ] . Computer Science Review , 2020 , 37 : 1 - 25 .

MCKEOWN N , ANDERSON T , BALAKRISHNAN H , et al . OpenFlow:enabling innovation in campus networks [J ] . ACM Sigcomm Computer Communication Review , 2008 , 38 ( 2 ): 69 - 74 .

ZHAO P , ZHAO W , LIU Q . Multi-objective link-separation multipath selection using k max-min for software-defined MANET [C ] // 2019 15th International Conference on Mobile Ad-Hoc and Sensor Networks (MSN) . 2019 : 253 - 258 .

SALMAN O , ELHAJJ I H , KAYSSI A , et al . A review on machine learning-based approaches for Internet traffic classification [J ] . Annals of Telecommunications , 2020 : 1 - 38 .

WILLIAMS N , ZANDER S , ARMITAGE G . A preliminary performance comparison of five machine learning algorithms for practical IP traffic flow classification [J ] . ACM SIGCOMM Computer Communication Review , 2006 , 36 ( 5 ): 5 - 16 .

LAKHINA A , CROVELLA M , DIOT C . Mining anomalies using traffic feature distributions [C ] // ACM Sigcomm Conference on Applications . 2005 :217.

FIADINO P D , DALCONZO A , SCHIAVONE M , et al . Challenging entropy-based anomaly detection and diagnosis in cellular networks [J ] . ACM Sigcomm Computer Communication Review , 2015 , 45 ( 4 ): 87 - 88 .

TIMCENKO V V , IBRAHIM J , GAJIN S . The hybrid machine learning support for entropy based network traffic anomaly detection [C ] // ICIST 2019 . 2019 : 144 - 149 .

IBRAHIM J , TIMCENKO V V , GAJIN S . A comprehensive flow-based anomaly detection architecture using entropy calculation and machine learning classification [C ] // ICIST 2019 . 2019 : 138 - 143 .

SHUKLA A S , MAURYA R . Entropy-based anomaly detection in a network [J ] . Wireless Personal Communications , 2018 , 99 : 1487 - 1501 .

SCHAEFFER-FILHO A , MAUTHE A , HUTCHISON D , et al . PReSET:a toolset for the evaluation of network resilience strategies [C ] // IFIP/IEEE International Symposium on Integrated Network Management . 2013 .

STONE-GROSS B , COVA M , GILBERT B , et al . Analysis of a Botnet Takeover [J ] . IEEE Security ＆ Privacy , 2011 , 9 ( 1 ): 64 - 72 .

WANG Q , CHEN Z , CHEN C , et al . On the robustness of the botnet topology formed by worm infection [C ] // Global Telecommunications Conference . 2010 .

周佳骏 , 汪婷婷 . 基于计算机网络对抗的 Agobot 实例分析 [J ] . 网络安全技术与应用 , 2013 ,( 7 ): 86 - 88 .

ZHOU J J , WANG T T . Instance analysis of Agobot based on computer network operations [J ] . Network Security Technology ＆ Application , 2013 ,( 7 ): 86 - 88 .

李世杰 , 倪洪 . 面向DDoS防御设备安全性测试的Scapy应用 [J ] . 网络安全技术与应用 , 2020 ,( 1 ): 20 - 22 .

LI S J , NI H . Scapy application for DDoS defense equipment se curity test [J ] . Network Security Technology and Application , 2020 ,( 1 ): 20 - 22 .

KAUR K , SINGH J , GHUMMAN N S . Mininet as Software Defined Networking Testing Platform [C ] // International Conference on Communiction,Computing ＆ Systems . 2014 .

Views

789

下载量

CSCD

Alert me when the article has been cited

提交

Tools

Publicity Resources

Efficient and safe software defined network topology discovery protocol

Research progress on dynamic hopping technology for network layer

Low failure recovery cost controller placement strategy in software defined networks

Multidimensional detection and dynamic defense method for link flooding attack

Design and implementation of the controller scheduling-time in SDN

Related Author

Pengcheng ZHAO

Yongpu GU

Junqing YU

Dong LI

Guozhen CHENG

Shumin HUO

Jinglei TAN

Jie NIU

Related Institution

Network and Computation Center, Huazhong University of Science and Technology

School of Cyber Science and Engineering, Huazhong University of Science and Technology

Information Engineering University

Unit 61212 of the Chinese People's Liberation Army

⁰