Wang Kun, Fu Yu, Duan Xueyuan, Liu Taotao
Department of Information Security, Naval University of Engineering, Wuhan, 430033, China.
School of Mathematics and Information Engineering, Xinyang Vocational and Technical College, Xinyang, 464000, China.
Sci Rep. 2024 Jul 16;14(1):16421. doi: 10.1038/s41598-024-66907-z.
Due to the large computational overhead, underutilization of features, and high bandwidth consumption in traditional SDN environments for DDoS attack detection and mitigation methods, this paper proposes a two-stage detection and mitigation method for DDoS attacks in SDN based on multi-dimensional characteristics. Firstly, an analysis of the traffic statistics from the SDN switch ports is performed, which aids in conducting a coarse-grained detection of DDoS attacks within the network. Subsequently, a Multi-Dimensional Deep Convolutional Classifier (MDDCC) is constructed using wavelet decomposition and convolutional neural networks to extract multi-dimensional characteristics from the traffic data passing through suspicious switches. Based on these extracted multi-dimensional characteristics, a simple classifier can be employed to accurately detect attack samples. Finally, by integrating graph theory with restrictive strategies, the source of attacks in SDN networks can be effectively traced and isolated. The experimental results indicate that the proposed method, which utilizes a minimal amount of statistical information, can quickly and accurately detect attacks within the SDN network. It demonstrates superior accuracy and generalization capabilities compared to traditional detection methods, especially when tested on both simulated and public datasets. Furthermore, by isolating the affected nodes, the method effectively mitigates the impact of the attacks, ensuring the normal transmission of legitimate traffic during network attacks. This approach not only enhances the detection capabilities but also provides a robust mechanism for containing the spread of cyber threats, thereby safeguarding the integrity and performance of the network.
由于传统软件定义网络（SDN）环境中用于分布式拒绝服务（DDoS）攻击检测和缓解方法存在大量计算开销、特征利用不足以及高带宽消耗等问题，本文提出了一种基于多维度特征的SDN中DDoS攻击的两阶段检测和缓解方法。首先，对SDN交换机端口的流量统计进行分析，这有助于在网络内进行DDoS攻击的粗粒度检测。随后，使用小波分解和卷积神经网络构建多维度深度卷积分类器（MDDCC），以从通过可疑交换机的流量数据中提取多维度特征。基于这些提取的多维度特征，可以采用简单分类器准确检测攻击样本。最后，通过将图论与限制策略相结合，可以有效地追踪和隔离SDN网络中的攻击源。实验结果表明，所提出的方法利用最少的统计信息，能够快速准确地检测SDN网络内的攻击。与传统检测方法相比，它展示出卓越的准确性和泛化能力，尤其是在模拟数据集和公共数据集上进行测试时。此外，通过隔离受影响的节点，该方法有效地减轻了攻击的影响，确保在网络攻击期间合法流量的正常传输。这种方法不仅增强了检测能力，还提供了一种强大的机制来遏制网络威胁的传播，从而保障网络的完整性和性能。
