| With the development of the Internet-based information society,the network environment has become more and more complex.The uneven distribution of network resources in a complex network environment leads to network bottlenecks.At the same time,the logical forwarding of traditional networks is characterized by high coupling,resulting in network attacks launched using network bottlenecks that are not easily detected,and a typical attack method is the link flooding attack.Link flooding attacks are not only difficult to detect,but can also cause significant economic damage.In this thesis,we study the problem of link flooding attack detection and defense in software-defined networks,and take full advantage of the network information monitoring function and global view of the controller in software-defined networks to find the links that tend to be performance bottlenecks in the network and protect them to eliminate the impact of link flooding attacks on software-defined networks.The main research of this thesis is as follows:(1)To address the characteristics of link flooding attacks using network bottleneck links,this thesis proposes a method for network bottleneck detection using both static and dynamic network metrics.Meanwhile,for the network congestion problem caused by the beginning of link flooding attack,this thesis designs a lightweight load balancing module based on bottleneck links to alleviate network congestion.The experiments show that the proposed method can accurately select the links under attack and those with insufficient performance,and protect these links effectively.(2)In this thesis,a link flooding attack detection module is designed by combining random forest and gradient boosting decision tree algorithms.By monitoring and analyzing the traffic in the link in real time and extracting the relevant data features,the module obtains an accuracy of 98.2% in the environment with 60% of link flooding attack traffic and no less than 96% in the environment with other percentage of link flooding attack traffic,outperforming algorithms such as KNN,SVM and the combination of related algorithms.(3)This thesis designs a defense module based on the characteristics of link flooding attack,and also designs a collaborative defense module for link flooding attack defense in multi-area scenarios for the current situation of software-defined network silos.The defense module uses two modes of blacklisting as its core.A link flooding attack uses an attack pair to flood critical links when the area where the attack pair is located is vulnerable to more traffic.To avoid excessive traffic influx leading to instability or high latency in the network environment,the module uses a blacklisting strategy based on the source of the traffic.The collaborative defense module avoids information leakage by using shared traffic statistics,while generating datasets and training new models by using blended old data.Experiments show that the method proposed in this thesis has high accuracy and stability.(4)In this thesis,we design and implement a link flooding attack defense system based on software-defined network to realize the defense against link flooding attack in software-defined network.The system was deployed in the experimental environment to test its protection against link flooding attacks,and the experiments showed that the system designed in this thesis has better protection against link flooding attacks. |
