链路洪泛攻击的SDN移动目标防御机制
|
摘要
针对Crossfire分布式拒绝服务(distributed denial of service,DDoS)攻击,该文提出一种基于软件定义网络(software defined network,SDN)的攻击防御机制。在对Crossfire攻击分析基础上,设计一个SDN流量层级的集中监测及分流控制模型并部署到防御机制中,利用SDN的重路由策略疏解被攻击链路的拥塞负载,通过对流量的灵活调度缓解拥塞并避免关键链路中断对网络业务造成严重干扰。利用SDN的移动目标防御(mobile target defense,MTD)机制动态调整网络配置和网络行为并诱使攻击者对攻击流量进行调整,提高诱饵服务器对攻击的检测效率。实验结果表明:该机制可以有效防御Crossfire攻击且SDN的防御机制和重路由策略不会造成显著开销。
This paper presents a software defined network(SDN)based defense mechanism to detect and mitigate a new distributed denial of service(DDoS) attack named Crossfire. An SDN traffic-level centralized monitoring and shunt control model was defined based on the Crossfire characteristics for the defense mechanism.The SDN re-routing strategy was used to resolve the congestion load of the attacked link with flexible traffic scheduling used to alleviate the congestion and avoid critical link interruption that could seriously interfere with network service.The SDN mobile target defense mechanism was used to dynamically adjust the network configuration and network behavior to induce the attacker to adjust the attack traffic;thereby improving the attack detection efficiency of the bait server.Tests show that this mechanism can effectively defend against Crossfire attacks and that the SDN defense mechanism and rerouting strategy does not require significant overhead.
This paper presents a software defined network(SDN)based defense mechanism to detect and mitigate a new distributed denial of service(DDoS) attack named Crossfire. An SDN traffic-level centralized monitoring and shunt control model was defined based on the Crossfire characteristics for the defense mechanism.The SDN re-routing strategy was used to resolve the congestion load of the attacked link with flexible traffic scheduling used to alleviate the congestion and avoid critical link interruption that could seriously interfere with network service.The SDN mobile target defense mechanism was used to dynamically adjust the network configuration and network behavior to induce the attacker to adjust the attack traffic;thereby improving the attack detection efficiency of the bait server.Tests show that this mechanism can effectively defend against Crossfire attacks and that the SDN defense mechanism and rerouting strategy does not require significant overhead.
引文
[1] SAMI I U,AHMAD M B,ASIF M,et al.DoS/DDoS detection for e-healthcare in Internet of things[J].International Journal of Advanced Computer Science&Applications,2018,9(1):297-300.
[2] BHARDWAJ A,SUBRAHMANYAM G V B,AVASTHI V,et al.DDoS attacks,new DDoS taxonomy and mitigation solutions—A survey[C]//The Proceedings of the International Conference on Signal Processing,Communication,Power and EmbeddedSystem. Paralakhemundi, India:IEEE,2017:793-798.
[3] KANG M S,LEE S B,GLIGOR V D.The crossfire attack[C]//Proceedings of IEEE Symposium on Security and Privacy.Berkeley,USA:IEEE,2013:127-141.
[4] MAHALE V V,PAREEK N P, UTTARWAR V U.Alleviation of DDoS attack using advance technique[C]//Proceedings of 2017International Conference on Innovative Mechanisms for Industry Applications.Bangalore,India:IEEE,2017:172-176.
[5] LEE Y J,BAIK N K,KIM C,et al.Study of detection method for spoofed IP against DDoS attacks[J].Personal and Ubiquitous Computing,2018,22(1):35-44.
[6] HOQUE N,BHATTACHARYYA D K,KALITA J K.An alert analysis approach to DDoS attack detection[C]//Proceedings of 2016International Conference on Accessibility to Digital World.Guwahati,India:IEEE,2017:33-38.
[7] KHADKE A,MADANKAR M,MOTGHARE M.Review on mitigation of distributed denial of service(DDoS)attacks in cloud computing[C]//Proceedings of the 10th International Conference on Intelligent Systems and Control.Coimbatore,India:IEEE,2016:1-5.
[8] AYDEGER A, SAPUTRO N, AKKAYA K, et al.Mitigating crossfire attacks using SDN-based moving target defense[C]//The Proceedings of the 41st IEEE Conference on Local Computer Networks. Dubai, United Arab Emirates:IEEE,2016:627-630.
[9] GKOUNIS D, KOTRONIS V, DIMITROPOULOS X.Towards defeating the crossfire attack using SDN,1412.2013v1[R].Vassilika Vouton,Greece:The Foundation for Research and Technology-Hellas,2014.
[10]张朝昆,崔勇,唐翯祎,等.软件定义网络(SDN)研究进展[J].软件学报,2015,26(1):62-81.ZHANG C K,CUI Y,TANG H Y,et al.State-of-the art survey on software-defined networking(SDN)[J].Journal of Software,2015,26(1):62-81.(in Chinese)
[11]MCKEOWN N,ANDERSON T,BALAKRISHNAN H,et al.OpenFlow:Enabling innovation in campus networks[J].ACM SIGCOMM Computer Communication Review,2008,38(2):69-74.
[12]KALKAN K,GUR G,ALAGOZ F.Defense mechanisms against DDoS attacks in SDN environment[J].IEEE Communications Magazine,2017,55(9):175-179.
[13]KANAGEVLU R,AUNG K M M.SDN controlled local re-routing to reduce congestion in cloud data center[C]//Proceedings of 2015 International Conference on Cloud Computing Research and Innovation. Singapore:IEEE,2016:80-88.
[14]LAI J,FU Q,MOORS T.Rapid IP rerouting with SDN and NFV[C]//ProceedingsofGlobalCommunications Conference.San Diego,USA:IEEE,2016:1-7.
[15]BASTA A, BLENK A, DUDYCZ S,et al. Efficient Loop-free rerouting of multiple SDN flows[J].IEEE/ACM Transactions on Networking,2018,26(2):948-961.
[16]MAIER D.The complexity of some problems on subsequences and supersequences[M].New York,USA:ACM,1978.
[2] BHARDWAJ A,SUBRAHMANYAM G V B,AVASTHI V,et al.DDoS attacks,new DDoS taxonomy and mitigation solutions—A survey[C]//The Proceedings of the International Conference on Signal Processing,Communication,Power and EmbeddedSystem. Paralakhemundi, India:IEEE,2017:793-798.
[3] KANG M S,LEE S B,GLIGOR V D.The crossfire attack[C]//Proceedings of IEEE Symposium on Security and Privacy.Berkeley,USA:IEEE,2013:127-141.
[4] MAHALE V V,PAREEK N P, UTTARWAR V U.Alleviation of DDoS attack using advance technique[C]//Proceedings of 2017International Conference on Innovative Mechanisms for Industry Applications.Bangalore,India:IEEE,2017:172-176.
[5] LEE Y J,BAIK N K,KIM C,et al.Study of detection method for spoofed IP against DDoS attacks[J].Personal and Ubiquitous Computing,2018,22(1):35-44.
[6] HOQUE N,BHATTACHARYYA D K,KALITA J K.An alert analysis approach to DDoS attack detection[C]//Proceedings of 2016International Conference on Accessibility to Digital World.Guwahati,India:IEEE,2017:33-38.
[7] KHADKE A,MADANKAR M,MOTGHARE M.Review on mitigation of distributed denial of service(DDoS)attacks in cloud computing[C]//Proceedings of the 10th International Conference on Intelligent Systems and Control.Coimbatore,India:IEEE,2016:1-5.
[8] AYDEGER A, SAPUTRO N, AKKAYA K, et al.Mitigating crossfire attacks using SDN-based moving target defense[C]//The Proceedings of the 41st IEEE Conference on Local Computer Networks. Dubai, United Arab Emirates:IEEE,2016:627-630.
[9] GKOUNIS D, KOTRONIS V, DIMITROPOULOS X.Towards defeating the crossfire attack using SDN,1412.2013v1[R].Vassilika Vouton,Greece:The Foundation for Research and Technology-Hellas,2014.
[10]张朝昆,崔勇,唐翯祎,等.软件定义网络(SDN)研究进展[J].软件学报,2015,26(1):62-81.ZHANG C K,CUI Y,TANG H Y,et al.State-of-the art survey on software-defined networking(SDN)[J].Journal of Software,2015,26(1):62-81.(in Chinese)
[11]MCKEOWN N,ANDERSON T,BALAKRISHNAN H,et al.OpenFlow:Enabling innovation in campus networks[J].ACM SIGCOMM Computer Communication Review,2008,38(2):69-74.
[12]KALKAN K,GUR G,ALAGOZ F.Defense mechanisms against DDoS attacks in SDN environment[J].IEEE Communications Magazine,2017,55(9):175-179.
[13]KANAGEVLU R,AUNG K M M.SDN controlled local re-routing to reduce congestion in cloud data center[C]//Proceedings of 2015 International Conference on Cloud Computing Research and Innovation. Singapore:IEEE,2016:80-88.
[14]LAI J,FU Q,MOORS T.Rapid IP rerouting with SDN and NFV[C]//ProceedingsofGlobalCommunications Conference.San Diego,USA:IEEE,2016:1-7.
[15]BASTA A, BLENK A, DUDYCZ S,et al. Efficient Loop-free rerouting of multiple SDN flows[J].IEEE/ACM Transactions on Networking,2018,26(2):948-961.
[16]MAIER D.The complexity of some problems on subsequences and supersequences[M].New York,USA:ACM,1978.