基于特征-模式图的SDN下分布式拒绝服务攻击发现方法

校娅; 樊志杰; Amiya NAYAK; 谭成翔

doi:10.1631/FITEE.1800436

Your Location：

Home >

Browse articles >

基于特征-模式图的SDN下分布式拒绝服务攻击发现方法

未来网络专题 | Updated：2022-05-19

- 基于特征-模式图的SDN下分布式拒绝服务攻击发现方法
- Discovery method for distributed denial-of-service attack behavior in SDNs using a feature-pattern graph model
- 信息与电子工程前沿（英文） 2019年20卷第9期页码：1195-1208
- Affiliations：
  
  College of Electronics and Information Engineering, Tongji University, Shanghai 201804, China
  School of Electrical Engineering and Computer Science, University of Ottawa, Ottawa K1N 6N5, Canada
  The Third Research Institute of the Ministry of Public Security, Shanghai 200120, China
- Author bio：
  
  [ "Ya XIAO, E-mail:1710053@tongji.edu.cn" ]
  Zhi-jie FAN, E-mail:aaronzfan@126.com
  [ "Amiya NAYAK, E-mail:nayak@uottawa.ca" ]
- Funds：
  
  Project supported by the National Key R&D Program of China (Nos. 2017YFB0802300 and 2017YFC0803700)
- DOI：10.1631/FITEE.1800436
  中图分类号： TP39
- 收稿：2018-07-18，
  
  修回：2019-;8-23，
  
  纸质出版：2019-09
- Accepted：
Scan QR Code
校娅, 樊志杰, Amiya NAYAK, 等. 基于特征-模式图的SDN下分布式拒绝服务攻击发现方法[J]. 信息与电子工程前沿（英文）, 2019,20(9):1195-1208.

Ya XIAO, Zhi-jie FAN, Amiya NAYAK, et al. Discovery method for distributed denial-of-service attack behavior in SDNs using a feature-pattern graph model[J]. Frontiers of Information Technology & Electronic Engineering, 2019, 20(9): 1195-1208.
校娅, 樊志杰, Amiya NAYAK, 等. 基于特征-模式图的SDN下分布式拒绝服务攻击发现方法[J]. 信息与电子工程前沿（英文）, 2019,20(9):1195-1208. DOI： 10.1631/FITEE.1800436.

Ya XIAO, Zhi-jie FAN, Amiya NAYAK, et al. Discovery method for distributed denial-of-service attack behavior in SDNs using a feature-pattern graph model[J]. Frontiers of Information Technology & Electronic Engineering, 2019, 20(9): 1195-1208. DOI： 10.1631/FITEE.1800436.

摘要

由于软件定义网络（software-defined networks

SDN）的开方式结构，软件定义网络环境下的安全威胁已成为一个重要问题。在所有威胁中，分布式拒绝服务攻击（distribute ddenial-of-service

DDoS）对网络具有巨大影响。本文提出一种基于特征-模式图模型的方法来发现软件定义网络环境下的DDoS攻击行为。所提出的特征-模式图采用网络模式作为节点，将其相似度作为加权边。该图模型可同时表示网络包的头信息和各网络模式之间的关系信息。节点之间的相似度由度量学习和马氏距离表示。所提方法可以基于图的邻近分类模型发现DDoS攻击，并具有自动发现未知攻击的能力且可通过全局或局部插入新节点的方式扩展已有图结构。两个数据集上的实验证明了所提方法在攻击行为检测和图更新任务上的可行性，并证明了本文基于图的模型在DDoS攻击检测上优于对比模型。

Abstract

The security threats to software-defined networks (SDNs) have become a significant problem

generally because of the open framework of SDNs. Among all the threats

distributed denial-of-service (DDoS) attacks can have a devastating impact on the network. We propose a method to discover DDoS attack behaviors in SDNs using a feature-pattern graph model. The feature-pattern graph model presented employs network patterns as nodes and similarity as weighted links; it can demonstrate not only the traffic header information but also the relationships among all the network patterns. The similarity between nodes is modeled by metric learning and the Mahalanobis distance. The proposed method can discover DDoS attacks using a graph-based neighborhood classification method; it is capable of automatically finding unknown attacks and is scalable by inserting new nodes to the graph model via local or global updates. Experiments on two datasets prove the feasibility of the proposed method for attack behavior discovery and graph update tasks

and demonstrate that the graph-based method to discover DDoS attack behaviors substantially outperforms the methods compared herein.

关键词

Keywords

references

E Albin , , , NC Rowe . . A realistic experimental comparison of the Suricata and Snort intrusion-detection systems . . Proc 26 th Int Conf on Advanced Information Networking and Applications Workshops , , 2012 . . p.122 - - 127 . . DOI: 10.1109/WAINA.2012.29 http://doi.org/10.1109/WAINA.2012.29 . .

A AlEroud , , , I Alsmadi . . Identifying cyber-attacks on software defined networks: an inference-based intrusion detection approach . . J Netw Comput Appl , , 2017 . . 80 152 - - 164 . . DOI: 10.1016/j.jnca.2016.12.024 http://doi.org/10.1016/j.jnca.2016.12.024 . .

M Antikainen , , , T Aura , , , M Srel . . Spook in your network: attacking an SDN with a compromised OpenFlow switch . . Proc 19 th Nordic Conf on Secure IT Systems , , 2014 . . p.229 - - 244 . . DOI: 10.1007/978-3-319-11599-3_14 http://doi.org/10.1007/978-3-319-11599-3_14 . .

MZA Aziz , , , K Okamura . . Leveraging SDN for detection and mitigation SMTP flood attack through deep learning analysis techniques . . Int J Comput Sci Netw Secur , , 2017 . . 17 ( ( 10 ): ): 166 - - 172 . . . .

NZ Bawany , , , JA Shamsi , , , K Salah . . DDoS attack detection and mitigation using SDN: methods, practices, and solutions . . Arab J Sci Eng , , 2017 . . 42 ( ( 2 ): ): 425 - - 441 . . DOI: 10.1007/s13369-017-2414-5 http://doi.org/10.1007/s13369-017-2414-5 . .

R Braga , , , E Mota , , , A Passito . . Lightweight DDoS flooding attack detection using NOX/OpenFlow . . Proc IEEE Local Computer Network Conf , , 2010 . . p.408 - - 415 . . DOI: 10.1109/LCN.2010.5735752 http://doi.org/10.1109/LCN.2010.5735752 . .

CJ Chung , , , P Khatkar , , , TY Xing , , , 等 . . NICE: network intrusion detection and countermeasure selection in virtual network systems . . IEEE Trans Depend Sec Comput , , 2013 . . 10 ( ( 4 ): ): 198 - - 211 . . DOI: 10.1109/TDSC.2013.8, http://doi.org/10.1109/TDSC.2013.8, . .

RLS de Oliveira , , , CM Schweitzer , , , AA Shinoda , , , 等 . . Using Mininet for emulation and prototyping software-defined networks . . Proc IEEE Colombian Conf on Communications and Computing , , 2014 . . p.1 - - 6 . . DOI: 10.1109/ColComCon.2014.6860404 http://doi.org/10.1109/ColComCon.2014.6860404 . .

ZJ Fan , , , Y Xiao , , , A Nayak , , , 等 . . An improved network security situation assessment approach in software defined networks . . Peer-to-Peer Netw Appl , , 2019 . . 12 ( ( 2 ): ): 295 - - 309 . . DOI: 10.1007/s12083-017-0604-2 http://doi.org/10.1007/s12083-017-0604-2 . .

P Fiadino , , , A D'Alconzo , , , M Schiavone , , , 等 . . Challenging entropy-based anomaly detection and diagnosis in cellular networks . . ACM SIGCOMM Comput Commun Rev , , 2015 . . 45 ( ( 4 ): ): 87 - - 88 . . DOI: 10.1145/2829988.2790011 http://doi.org/10.1145/2829988.2790011 . .

K Giotis , , , C Argyropoulos , , , G Androulidakis , , , 等 . . Combining OpenFlow and sFlow for an effective and scalable anomaly detection and mitigation mechanism on SDN environments . . Comput Netw , , 2014 . . 62 122 - - 136 . . DOI: 10.1016/j.bjp.2013.10.014 http://doi.org/10.1016/j.bjp.2013.10.014 . .

J Goldberger , , , S Roweis , , , G Hinton , , , 等 . . Neighbourhood components analysis . . Proc 17 th Int Conf on Neural Information Processing Systems , , 2004 . . p.513 - - 520 . . . .

R Klti , , , V Kotronis , , , P Smith . . OpenFlow: a security analysis . . Proc 21 st IEEE Int Conf on Network Protocols , , 2013 . . p.1 - - 6 . . DOI: 10.1109/ICNP.2013.6733671 http://doi.org/10.1109/ICNP.2013.6733671 . .

TH Kobayashi , , , AB Batista , , , AM Brito , , , 等 . . Using a packet manipulation tool for security analysis of industrial network protocols . . Proc IEEE Conf on Emerging Technologies and Factory Automation , , 2007 . . p.744 - - 747 . . DOI: 10.1109/EFTA.2007.4416847 http://doi.org/10.1109/EFTA.2007.4416847 . .

D Kreutz , , , FM Ramos , , , PE Verssimo , , , 等 . . Software-defined networking: a comprehensive survey . . Proc IEEE , , 2015 . . 103 ( ( 1 ): ): 14 - - 76 . . DOI: 10.1109/JPROC.2014.2371999 http://doi.org/10.1109/JPROC.2014.2371999 . .

HV Nguyen , , , L Bai . . Cosine similarity metric learning for face verification . . Proc 10 th Asian Conf on Computer Vision , , 2010 . . p.709 - - 720 . . DOI: 10.1007/978-3-642-19309-5_55 http://doi.org/10.1007/978-3-642-19309-5_55 . .

Q Niyaz , , , WQ Sun , , , AY Javaid . . A deep learning based DDoS detection system in software-defined networking (SDN) . . EAI Endorsed Trans Secur Safety , , 2017 . . 4 ( ( 12 ): ): e2 DOI: 10.4108/eai.28-12-2017.153515 http://doi.org/10.4108/eai.28-12-2017.153515 . .

M Roesch . . Snort: lightweight intrusion detection for networks . . Proc 13 th USENIX Conf on System Administration , , 1999 . . p.229 - - 238 . . . .

S Scott-Hayward , , , G O'Callaghan , , , S Sezer . . SDN security: a survey . . IEEE SDN for Future Networks and Services , , 2013 . . p.1 - - 7 . . DOI: 10.1109/SDN4FNS.2013.6702553 http://doi.org/10.1109/SDN4FNS.2013.6702553 . .

A Shalimov , , , D Zuikov , , , D Zimarina , , , 等 . . Advanced study of SDN/OpenFlow controllers . . Proc 9 th Central & Eastern European Software Engineering Conf in Russia, Article 1 , , 2013 . . DOI: 10.1145/2556610.2556621 http://doi.org/10.1145/2556610.2556621 . .

C Shen , , , J Kim , , , L Wang . . Scalable large-margin mahalanobis distance metric learning . . IEEE Trans Neur Netw , , 2010 . . 21 ( ( 9 ): ): 1524 - - 1530 . . DOI: 10.1109/TNN.2010.2052630 http://doi.org/10.1109/TNN.2010.2052630 . .

A Shiravi , , , H Shiravi , , , M Tavallaee , , , 等 . . Toward developing a systematic approach to generate benchmark datasets for intrusion detection . . Comput Secur , , 2012 . . 31 ( ( 3 ): ): 357 - - 374 . . DOI: 10.1016/j.cose.2011.12.012 http://doi.org/10.1016/j.cose.2011.12.012 . .

T van Erven , , , P Harremos . . Rnyi divergence and Kullback-Leibler divergence . . IEEE Trans Inform Theory , , 2014 . . 60 ( ( 7 ): ): 3797 - - 3820 . . DOI: 10.1109/TIT.2014.2320500 http://doi.org/10.1109/TIT.2014.2320500 . .

B Wang , , , Y Zheng , , , WJ Lou , , , 等 . . DDoS attack protection in the era of cloud computing and software-defined networking . . Comput Netw , , 2015 . . 81 308 - - 319 . . DOI: 10.1016/j.comnet.2015.02.026 http://doi.org/10.1016/j.comnet.2015.02.026 . .

R Wang , , , ZP Jia , , , L Ju . . An entropy-based distributed DDoS detection mechanism in software-defined networking . . Proc IEEE Trustcom/BigDataSE/ISPA , , 2015 . . p.310 - - 317 . . DOI: 10.1109/Trustcom.2015.389 http://doi.org/10.1109/Trustcom.2015.389 . .

QS Wu , , , D Ferebee , , , YY Lin , , , 等 . . An integrated cyber security monitoring system using correlation-based techniques . . Proc IEEE Int Conf on System of Systems Engineering , , 2009 . . p.1 - - 6 . . . .

Y Xu , , , Y Liu . . DDoS attack detection under SDN context . . Proc 35 th Annual IEEE Int Conf on Computer Communications , , 2016 . . p.1 - - 9 . . DOI: 10.1109/INFOCOM.2016.7524500 http://doi.org/10.1109/INFOCOM.2016.7524500 . .

Q Yan , , , FR Yu , , , QX Gong , , , 等 . . Software-defined networking (SDN) and distributed denial of service (DDoS) attacks in cloud computing environments: a survey, some research issues, and challenges . . IEEE Commun Surv Tutor , , 2016 . . 18 ( ( 1 ): ): 602 - - 622 . . DOI: 10.1109/COMST.2015.2487361 http://doi.org/10.1109/COMST.2015.2487361 . .

S Yu , , , S Guo , , , I Stojmenovic . . Can we beat legitimate cyber behavior mimicking attacks from botnets . . Proc IEEE INFOCOM , , 2012 . . p.2851 - - 2855 . . DOI: 10.1109/INFCOM.2012.6195714 http://doi.org/10.1109/INFCOM.2012.6195714 . .

浏览量

Downloads

CSCD

文章被引用时，请邮件提醒。

Submit

工具集

关联资源

Design and implementation of a novel enterprise network defense system by maneuvering multi-dimensional network properties