SDN Communication Quality Assurance Strategy witb DDoS Defense and Routing Optimization

Jiahua Zhang; Zhongxue Yang; Jiangping Wang; Yukai Shi; Liang Wei

doi:10.11959/j.issn.1000-0801.2015053

您当前的位置：

首页 >

文章列表页 >

SDN Communication Quality Assurance Strategy witb DDoS Defense and Routing Optimization

research and development | 更新时间：2024-06-05

- SDN Communication Quality Assurance Strategy witb DDoS Defense and Routing Optimization
- Telecommunications Science Vol. 31, Issue 4, Pages: 120-126(2015)
- 作者机构：
  
  1. 南京晓庄学院数学与信息技术学院南京 211171
  2. 江苏省未来网络创新研究院南京 211100
- 作者简介：
- 基金信息：
- DOI：10.11959/j.issn.1000-0801.2015053
  CLC：
- Published Online：2015-04，
  
  Published：15 April 2015
- 稿件说明：
移动端阅览
Jiahua Zhang, Zhongxue Yang, Jiangping Wang, et al. SDN Communication Quality Assurance Strategy witb DDoS Defense and Routing Optimization[J]. Telecommunications science, 2015, 31(4): 120-126.
DOI：

Jiahua Zhang, Zhongxue Yang, Jiangping Wang, et al. SDN Communication Quality Assurance Strategy witb DDoS Defense and Routing Optimization[J]. Telecommunications science, 2015, 31(4): 120-126. DOI： 10.11959/j.issn.1000-0801.2015053.

摘要

提出了将DDoS威胁识别与路由优化有机结合的软件定义网络（SDN）通信质量保障策略，即在DDoS攻击造成部分网络链路拥塞的情况下，对异常数据分组进行识别过滤，同时生成最优路径，以保障网络通信质量。首先，设计了一种SDN 架构下的分布式入侵检测系统，实现了对欺骗报文、异常报文以及破坏报文3类DDoS威胁的检测识别和过滤处理。其次，实现了一种最优路径的生成算法。实验测试结果表明，部署了通信质量保障策略的SDN可有效识别并滤除DDoS攻击数据分组，且处理过程中网络平均传输时延无激增。

Abstract

A SDN communication quality assurance strategy which organic combines DDoS threat identification with route optimization was put forward.It means

when the intent link was congestive attacked by DDoS

it wi11 identify and filter the abnormal data packet

and wi11 generate optimized routing to ensure the quality of network communications.First of a11

a distributed intrusion detection system under SDN framework was designed.The system realizes the detection recognition

filtration and treatment about the DDoS threat

such as cheating message

excepting message and destroying message.Secondly

a kind of best algorithm about generating routing path was realized.The experimental result shows that the network deployment plan which mentioned in this paper

can identify and filter the aggressive data packet

and the average network data transmission delay doesn't increase sharply when the network is under attack.

关键词

Keywords

references

Zhou Y X . Study on technology of network and information security . Proceedings of International Conference on Services Science,Management and Engineering , Wuhan,China , 2010

刘奇旭，张翀斌，张玉清等．安全漏洞等级划分关键技术研究．通信学报， 2012 , 33 （ Z1 ）

Liu Q X , Zhang C B , Zhang C B , et al . Research on the key technology of vulnerability threat classification . Journal on Communications , 2012 , 33 （ Z1 ）: 79 ～ 87

Yaar A , Perrig A , Song D , et al . StackPi:new packet marking and filtering mechanisms for DDoS and IP spoofing defense . IEEE Journal on Selected Areas in Communications , 2006 , 24 （ 10 ）: 1853 ～ 1863

Zhou W , Wen S , Xiang Y , et al . Detection and defense of application-layer DDoS attacks in backbone web traffic . Future Generation Computer Systems , 2014 （ 38 ）: 36 ～ 46

金光，张飞，钱江波等．融合路径追溯和标识过滤的DDoS攻击防御方案．通信学报， 2011 , 32 （ 2 ）: 61 ～ 67

Jin G , Zhang F , Qian J B , et al . DDoS defense with IP traceback and path identification . Journal on Communications , 2011 , 32 （ 2 ）: 61 ～ 67

Jarraya Y , Madi T , Debbabi M . A survey and a layered taxonomy of software- defined networking . IEEE Communications Surveys ＆ Tutorials , 2014 , 16 （ 4 ）: 1955 ～ 1980

Seungwon S , Vinod Y , Phillp G , et al . AVANT-GUARD:Scalable and Vigilant Switch Flow Management in Software-Defined Networks . New York:ACM Press , 2013

Seungwon S , Phillp P , Vinod Y . FRESCO:modular composable security services for software-defined networks . Proceedings of NDSS Symposium , 2012

王歆平，王茜，刘恩慧等．基于 SDN 的按需智能路由系统研究与验证．电信科学， 2014 , 30 （ 4 ）: 8 ～ 15

Wang Y P , Wang X , Liu E H , et al . Research and verification on SDN-based on-demand smart routing system . Telecommunications Science , 2014 , 30 （ 4 ）: 8 ～ 15

Phillp P , Seungwon S , Vinod Y . A Security Enforcement Kernel for OpenFlow Networks . New York:ACM Press , 2012

Views

1010

下载量

CSCD

Alert me when the article has been cited

提交

Tools

Publicity Resources

Link Failure Recovery Based on SDN

Research on the application of quantum-secure algorithms in 5G network

Research on new energy station network security assessment method based on improved LSTM network

Application research on network security operation automation practice based on RPA technology

Challenges and innovative solutions of space-ground integrated network security

Related Author

Le Hou

Shuo Wang

Yikai Lin

Botao Yao

Jiang Liu

WANG Congli

LI Jinhui

WANG Jingran

Related Institution

National Engineering Research Center of Cloud and Network Infrastructure Security

China Telecom Research Institute

State Grid Shanxi Electric Power Company

State Grid Shanxi Electric Power Research Institute

Software Research Institute of China United Network Co., Ltd.

⁰