基于Renyi熵的SDN自主防护系统

赵普; 赵文涛; 付章杰; 刘强

doi:10.11959/j.issn.2096-109x.2021049

您当前的位置：

首页 >

文章列表页 >

基于Renyi熵的SDN自主防护系统

专栏Ⅱ：SDN与云计算安全 | 更新时间：2024-06-03

- 基于Renyi熵的SDN自主防护系统
- SDN self-protection system based on Renyi entropy
- 网络与信息安全学报 2021年7卷第3期页码：85-94
- 作者机构：
  
  1. 国防科技大学计算机学院，湖南长沙 410073
  2. 南京信息工程大学计算机与软件学院，江苏南京 210044
- 作者简介：
  
  [ "赵普（1991- ），男，河南安阳人，国防科技大学硕士生，主要研究方向为软件定义网络安全" ]
  [ "赵文涛（1978- ），男，博士，内蒙古凉城人，国防科技大学教授、博士生导师，主要研究方向为网络性能优化、信息处理和机器学习" ]
  [ "付章杰（1983- ），男，博士，河南南阳人，南京信息工程大学教授、博士生导师，主要研究方向为网络与信息安全等" ]
  [ "刘强（1986- ），男，博士，江西临川人，国防科技大学副教授，主要研究方向为网络安全和机器学习" ]
- 基金信息：
  
  国家自然科学基金;The National Natural Science Foundation of China(U1811462);国家自然科学基金;The National Natural Science Foundation of China(61702539);湖南省自然科学基金;The Natural Science Foundation of Hunan Province(2018JJ3611)
- DOI：10.11959/j.issn.2096-109x.2021049
  中图分类号： TP393
- 网络首发：2021-06，
  
  纸质出版：2021-06-15
- 稿件说明：
移动端阅览
赵普, 赵文涛, 付章杰, 等. 基于Renyi熵的SDN自主防护系统[J]. 网络与信息安全学报, 2021,7(3):85-94.

Pu ZHAO, Wentao ZHAO, Zhangjie FU, et al. SDN self-protection system based on Renyi entropy[J]. Chinese Journal of Network and Information Security, 2021, 7(3): 85-94.
赵普, 赵文涛, 付章杰, 等. 基于Renyi熵的SDN自主防护系统[J]. 网络与信息安全学报, 2021,7(3):85-94. DOI： 10.11959/j.issn.2096-109x.2021049.

Pu ZHAO, Wentao ZHAO, Zhangjie FU, et al. SDN self-protection system based on Renyi entropy[J]. Chinese Journal of Network and Information Security, 2021, 7(3): 85-94. DOI： 10.11959/j.issn.2096-109x.2021049.

摘要

针对SDN架构下的常见网络异常行为，提出了一套基于Renyi熵的SDN自主防护系统，该系统可实现网络异常行为检测、诊断及防御。系统无须引入第三方测量设备，直接利用OpenFlow交换机流表信息。首先，通过计算和检测特征熵值，实现异常网络行为的检测。然后，进一步分析OpenFlow流表信息，实现异常行为的诊断。最后，实施防御控制措施，建立一套黑名单机制，将产生异常行为的主机加入黑名单，并阻塞相应的异常流量。为了验证系统的有效性，在Floodlight控制器上开发了原型。Mininet上的仿真实验表明，系统能够有效检测、诊断及防御网络中常见的异常行为，且具有较低的部署成本，增强了SDN的安全性。

Abstract

Aiming at the abnormal behaviors in SDN architecture

a self-protection system based on Renyi entropy that implemented a set of detection

diagnosis and defense method of SDN abnormal behaviors was proposed.The system did not need to introduce the third-party measurement equipment

and directly used the flow table information of OpenFlow switches.Firstly

the abnormal network behavior was detected by calculating the characteristic entropy.Then

the information of the OpenFlow flow table was further analyzed to realize the diagnosis of abnormal behavior.Finally

a blacklist mechanism was established.And the system added the hosts with abnormal behavior to the blacklist and blocked the corresponding abnormal traffic.In order to verify the effectiveness of the system

a prototype was developed on the Floodlight controller.The simulation results on Mininet show that the system can effectively detect

diagnose and defend the abnormal behaviors.The system has low deployment cost

which enhances the security of SDN.

关键词

Keywords

references

BRAGA R , MOTA E , PASSITO A . Lightweight DDoS flooding attack detection using NOX/OpenFlow [C ] // The 35th Annual IEEE Conference on Local Computer Networks . 2010 .

BEHAL S , SINGH J . Detection and mitigation of DDoS attacks in SDN:a comprehensive review,research challenges and future directions [J ] . Computer Science Review , 2020 , 37 : 1 - 25 .

MCKEOWN N , ANDERSON T , BALAKRISHNAN H , et al . OpenFlow:enabling innovation in campus networks [J ] . ACM Sigcomm Computer Communication Review , 2008 , 38 ( 2 ): 69 - 74 .

ZHAO P , ZHAO W , LIU Q . Multi-objective link-separation multipath selection using k max-min for software-defined MANET [C ] // 2019 15th International Conference on Mobile Ad-Hoc and Sensor Networks (MSN) . 2019 : 253 - 258 .

SALMAN O , ELHAJJ I H , KAYSSI A , et al . A review on machine learning-based approaches for Internet traffic classification [J ] . Annals of Telecommunications , 2020 : 1 - 38 .

WILLIAMS N , ZANDER S , ARMITAGE G . A preliminary performance comparison of five machine learning algorithms for practical IP traffic flow classification [J ] . ACM SIGCOMM Computer Communication Review , 2006 , 36 ( 5 ): 5 - 16 .

LAKHINA A , CROVELLA M , DIOT C . Mining anomalies using traffic feature distributions [C ] // ACM Sigcomm Conference on Applications . 2005 :217.

FIADINO P D , DALCONZO A , SCHIAVONE M , et al . Challenging entropy-based anomaly detection and diagnosis in cellular networks [J ] . ACM Sigcomm Computer Communication Review , 2015 , 45 ( 4 ): 87 - 88 .

TIMCENKO V V , IBRAHIM J , GAJIN S . The hybrid machine learning support for entropy based network traffic anomaly detection [C ] // ICIST 2019 . 2019 : 144 - 149 .

IBRAHIM J , TIMCENKO V V , GAJIN S . A comprehensive flow-based anomaly detection architecture using entropy calculation and machine learning classification [C ] // ICIST 2019 . 2019 : 138 - 143 .

SHUKLA A S , MAURYA R . Entropy-based anomaly detection in a network [J ] . Wireless Personal Communications , 2018 , 99 : 1487 - 1501 .

SCHAEFFER-FILHO A , MAUTHE A , HUTCHISON D , et al . PReSET:a toolset for the evaluation of network resilience strategies [C ] // IFIP/IEEE International Symposium on Integrated Network Management . 2013 .

STONE-GROSS B , COVA M , GILBERT B , et al . Analysis of a Botnet Takeover [J ] . IEEE Security ＆ Privacy , 2011 , 9 ( 1 ): 64 - 72 .

WANG Q , CHEN Z , CHEN C , et al . On the robustness of the botnet topology formed by worm infection [C ] // Global Telecommunications Conference . 2010 .

周佳骏 , 汪婷婷 . 基于计算机网络对抗的 Agobot 实例分析 [J ] . 网络安全技术与应用 , 2013 ,( 7 ): 86 - 88 .

ZHOU J J , WANG T T . Instance analysis of Agobot based on computer network operations [J ] . Network Security Technology ＆ Application , 2013 ,( 7 ): 86 - 88 .

李世杰 , 倪洪 . 面向DDoS防御设备安全性测试的Scapy应用 [J ] . 网络安全技术与应用 , 2020 ,( 1 ): 20 - 22 .

LI S J , NI H . Scapy application for DDoS defense equipment se curity test [J ] . Network Security Technology and Application , 2020 ,( 1 ): 20 - 22 .

KAUR K , SINGH J , GHUMMAN N S . Mininet as Software Defined Networking Testing Platform [C ] // International Conference on Communiction,Computing ＆ Systems . 2014 .

浏览量

789

下载量

CSCD

文章被引用时，请邮件提醒。

提交

工具集

关联资源

高效安全的软件定义网络拓扑发现协议

面向网络层的动态跳变技术研究进展

低故障恢复开销的软件定义网络控制器布局算法

面向链路洪泛攻击的多维检测与动态防御方法

软件定义网络中控制器调度时间机制设计与实现