SDN网络中的端口跳变DoS防御新策略

154 浏览量更新于2024-08-26 收藏 248KB PDF 举报

在现代网络环境中，安全防御策略的重要性日益凸显，尤其是在Software Defined Networking (SDN)架构中。SDN网络作为一种新兴的网络设计模式，通过将控制平面与数据平面分离，提供了一种灵活且可编程的方式来管理网络流量。这篇研究论文《SDN网络中基于端口跳变的DoS缓解方案》由Liancheng Zhang、Yi Guo和Huiqiang Yuwen等人提出，着重探讨了如何利用SDN网络的这些特性来对抗拒绝服务（DoS）攻击。该论文的核心内容是提出了一种端口跳变的DoS缓解策略，旨在增强SDN网络对DoS攻击的防护能力。传统的端口跳变技术通常在设备层面实现，而此方案将其功能提升到SDN控制器，使其能够更有效地管理和控制网络行为。通过将端口切换与时间戳反馈机制相结合，这种方法可以在早期检测并过滤恶意流量，同时减少对受保护服务器的性能影响。该方案的优点在于： 1. 效率提升：通过集中控制，SDN控制器可以更快地响应和调整端口配置，减少了端口跳变操作的时间成本，提高了抵御DoS攻击的响应速度。 2. 资源节约：传统端口跳变可能会频繁占用服务器资源，而该方案通过智能控制，减少了不必要的资源消耗，使网络资源得到更有效的利用。 3. 增强防护：除了抵御DoS攻击，该方法还能防止端口扫描和内部攻击，提供全方位的安全保障。 4. 理论与实践验证：论文提供了详尽的理论分析和实验结果，证实了该方案在不显著增加SDN控制器资源消耗的前提下，能有效抵御DoS攻击和端口扫描。这篇研究论文不仅为SDN网络设计者和管理员提供了一种创新的端口跳变策略，而且对于提高网络安全性，降低攻击风险具有重要的实际应用价值。通过深入了解和实施这种基于SDN的DoS缓解方案，网络运维人员可以更好地应对复杂的网络威胁，确保网络服务的稳定性和可靠性。

A Port Hopping Based DoS Mitigation Scheme in SDN Network

Liancheng Zhang, Yi Guo, Huiqiang Yuwen

China National Digital Switching System Engineering

and Technological Research Center

Zhengzhou City, China

e-mail: liancheng17@gmail.com

Yu Wang

School of Computer and Communication Engineering

Zhengzhou University of Light Industry

Zhengzhou City, China

e-mail: stonchor@163.com

Abstract—In order to resist DoS attack, taking advantages of

SDN network’s logically centralized control and network

programmable features, a port hopping based DoS mitigation

scheme in SDN network is proposed, which moves port

hopping function forward to SDN controller and presents a

timestamp feedback based hopping synchronization method.

This proposed scheme not only can reduce protected server’s

cost caused by port hopping, earlier detect and filter malicious

packets than traditional port hopping schemes, but also can

resist port scanning and internal attack. Theoretical analysis

and experimental results show that this proposed scheme can

effectively defend against DoS attack and port scanning

without consuming many resources on SDN controller.

Keywords-software defined network; denial of service; port

hopping; moving target defense; timestamp feedback

I. INTRODUCTION

Current denial of service (DoS) attack resistance methods

of software defined network (SDN) focus on DoS attack

detection or defense [1-3] for specific DoS attacks, but few

active defense method has been put forward.

Moving target defense (MTD) [4, 5] abandons the way of

building a defect-free defense system to protect network

security, and develops a mechanism by irregularly changing

network parameters over time to improve the attacker’s

complexity and cost. In this way, MTD can limit the leakage

of vulnerabilities and reduce the success rate of attacks.

Port hopping (PH) is a typical kind of MTD technology

[6, 7], which borrows idea from frequency hopping

communication and dynamically maps service ports to

unused and/or random ports. Port hopping technologies can

confuse potential attackers and increase their attack cost, as

they can’t locate opened ports used by network services.

This paper introduces the port hopping technology to

resist DoS attack in SDN network, which can improve the

proactive defense ability for defending against DoS attack in

SDN network with a relatively small price and cost.

II. P

ORT HOPPING BASED DOSMITIGATION SCHEME

Making full use SDN network’s features, such as

network programmable, logically centralized control and

control plane and data plane separation, a port hopping based

DoS mitigation (PH-DM) scheme is proposed, which locates

the port hopping function in SDN controller (cooperating

with OpenFlow switches), reduces the load on the server and

resists internal attackers at the same time.

A. Basic Process and Architecture of the PH-DM Scheme

According to SDN network’s logically centralized

control and network programmable features, port hopping

module on the server side is forwarded to the SDN controller,

which reduces large load caused by port hopping on the

server. SDN controller (cooperating with OpenFlow switches)

acts as a DoS attack filtering gateway, and checks the

network connection launched by the clients, which mainly

checks whether the destination port of the connection suits

the opened port used in the current time slot. If the two ports

are the same, SDN controller will install specific flow entries

to the corresponding OpenFlow switches along the

transmission path, and the packets of this connection will be

transmitted to the target server if they match these installed

flow entries, by this way, the trusted and authorized clients

can communicate with the target server normally. If the

destination port differs from the opened port, this connection

will be considered to be malicious, which will be discarded

directly and won’t be forwarded, then illegal and malicious

network flows can’t access to the SDN network.

For the convenience of distinction, this paper defines the

protected server as the server and defines the host that will

access the server as the client. The specific architecture of

the PH-DM scheme is shown in Fig. 1.

Client

Server

Control channel

Data channel

OpenFlow switch 1

OpenFlow switch 2

OpenFlow switch 3

SDN

controller

Figure 1. Framework of the PH-DM scheme.

2016 12th International Conference on Computational Intelligence and Security

DOI 10.1109/CIS.2016.76

314

下载后可阅读完整内容，剩余3页未读，立即下载

weixin_38621638

粉丝: 1
资源: 983

SDN网络中的端口跳变DoS防御新策略

基于端址重载的SDN包转发验证.docx

Mininet：Python网络模拟中的网络安全，保障网络模拟环境安全

云网络基础深度解读：云服务中网络设计的奥秘

Linux内核网络栈优化：揭秘提升数据传输效率的秘方

【网络优先级保障】：NetGear R7000 QoS优化，关键应用优先通行

Infiniband网络安全性深度剖析：专家解答如何确保金融与企业数据的安全

【java毕业设计】网页时装购物系统源码（springboot+vue+mysql+说明文档+LW）.zip

Kylin10 + GDAL2.4 + OSG3.6.4 + OsgEarth2.10.1

计算机系统维护技术.xps

数学建模问题中阻滞增长模型

最新资源