SDN中基于信息熵与DNN的DDoS攻击检测模型

张龙; 王劲松

doi:10.7544/issn1000-1239.2019.20190017

SDN中基于信息熵与DNN的DDoS攻击检测模型

张龙,
王劲松

(天津理工大学计算机科学与工程学院天津 300384) (计算机病毒防治技术国家工程实验室(天津理工大学) 天津 300457) (天津市智能计算及软件新技术重点实验室(天津理工大学) 天津 300384) (zl_blue87@163.com)

基金项目: 国家重点研发计划项目(2018YFC0831405)；天津市自然科学基金项目(18JCZDJC30700)；赛尔网络下一代互联网创新项目(NGII20160121)

详细信息

中图分类号: TP393
计量
- 文章访问数: 1892
- HTML全文浏览量: 16
- PDF下载量: 985
出版历程
- 发布日期: 2019-04-30

DDoS Attack Detection Model Based on Information Entropy and DNN in SDN

(School of Computer Science and Engineering, Tianjin University of Technology, Tianjin 300384) (National Engineering Laboratory for Computer Virus Prevention and Control Technology (Tianjin University of Technology), Tianjin 300457) (Tianjin Key Laboratory of Intelligence Computing and Novel Software Technology (Tianjin University of Technology), Tianjin 300384)

摘要

摘要: 软件定义网络(software defined networking, SDN)解耦了网络的数据层与控制层，同时控制器也面临“单点失效”的危险.攻击者可以发起分布式拒绝服务攻击(distributed denial of service, DDoS)使控制器失效，影响网络安全.为解决SDN中的DDoS流量检测问题，创新性地提出了基于信息熵与深度神经网络(deep neural network, DNN)的DDoS检测模型.该模型包括基于信息熵的初检模块和基于深度神经网络DNN的DDoS流量检测模块.初检模块通过计算数据包源、目的IP地址的信息熵值初步发现网络中的可疑流量，并利用基于DNN的DDoS检测模块对疑似异常流量进行进一步确认，从而发现DDoS攻击.实验表明：该模型对DDoS流量的识别率达到99%以上，准确率也有显著提高，误报率明显优于基于信息熵的检测方法.同时，该模型还能缩短检测时间，提高资源使用效率.
- 软件定义网络 /
- 异常检测 /
- 分布式拒绝服务攻击 /
- 信息熵 /
- 深度神经网络
Abstract: The software defined networking (SDN) decouples the data layer and the control layer of the network, but the controller is in danger of “single node invalidation ”. Attackers launch DDoS attacks to disable the controller and threaten the safety of networks. This paper presents a DDoS detection model based on entropy and deep neural network (DNN), which includes the initial detection module based on entropy-based detection method and the further detection module based on DNN. The initial detection module finds out the suspicious traffic in the network preliminarily by calculating the entropy of source and destination IP address, and then the suspected abnormal traffic with DNN-based DDoS detection module confirms the anomaly traffic. Experiments show that this model has higher recognition rate and accuracy rate than the traditional detection algorithm based on entropy or machine learning. At the same time, the model can shorten the detection time and improve the efficiency of resource utilization.
- software defined networking (SDN) /
- anomaly detection /
- distributed denial of service (DDoS) /
- information entropy /
- deep neural network (DNN)

HTML全文

参考文献(0)

施引文献(8)

期刊类型引用(2)

1.	李学成，王力. 新型水果切片机结构的发展研究. 南方农机. 2020(02): 3+5 . 百度学术
2.	方旭东，吴俊杰. 基于忆阻器的计算存储融合体系结构研究进展. 计算机工程与科学. 2020(11): 1929-1940 . 百度学术