KR20170066907A - Software Defined Network based Network Flooding Attack Detection/Protection Method and System - Google Patents

Abstract

A software defined network based network flooding attack detection / prevention method and system is provided. The network flooding attack detection and defense system according to the embodiment of the present invention samples a network flooding attack packet applied to the SDN and detects a network flooding attack based on a sample packet. As a result, monitoring overhead can be reduced through optional switch monitoring based on packet sampling, and it is easy to expand due to various network flooding attacks based on software attack detection / attacker detection.

Description

Software Defined Network Based Network Flooding Attack Detection / Protection Method and System

FIELD OF THE INVENTION The present invention relates to software defined networks, and more particularly to a method and system for automatically detecting and defending a flooding attack on this network.

SDN (Software Defined Network) is a network that provides high level of flexibility by dynamically controlling the configuration and operation of the network using a network controller that utilizes the open API provided by OpenFlow.

With the high flexibility of SDN, it is expected to solve the high cost and complexity problems required to build a network infrastructure, helping to shorten the time to deliver new services to the market, as well as to provide innovative network services. Much research is under way for network solutions.

Security is a very important factor in network operation, especially Denial of Service (DoS) attacks can cause serious traffic to the network, have.

Typical network-level denial-of-service attacks include TCP SYN flooding attacks, UDP flooding attacks, and ICMP flooding attacks.

In the case of TCP SYN Flooding attack, it consumes network and computing resources of attacked computer by exploiting TCP's 3-way handshake and loophole which must maintain half-open state.

UDP Flooding and ICMP Flooding attacks are attacks that increase the load on the network by creating large quantities of User Datagram Protocol (UDP) and Internet Control Message Protocol (ICMP) packets, which are connectionless services.

DoS attacks can also be fatal to the SDN environment. In SDN, when a packet that is not understood by the current network switch is detected, the packet is transmitted to the network controller to set the processing method to the switch. Therefore, if a DoS attack using the IP spoofing technique that modifies information of a packet occurs in the SDN, the SDN network controller may consume computing resources as well as attacked hosts, thereby adversely affecting the operation of the entire SDN network.

In order to detect DoS attacks in existing network infrastructure, it is necessary to collect packets passing through a switch, router or server and analyze the collected traffic. If it is difficult to collect packets, it collects the service access log on the server side and deduce a DoS attack through it.

Although this detection can be performed automatically in the existing system, it is necessary to protect the detected DoS attack by using a host or a switch that is estimated to generate the attack with the help of an ISP (Internet Service Provider) It is troublesome to prevent the interface traffic through access control.

In the SDN environment, the network controller can constantly monitor the information and traffic information of the network switch through the OpenFlow open API. The collected information can be used to detect DoS attacks and automatically control access to network flow traffic associated with detected DoS attacks.

However, when performing such on-the-fly monitoring, as the resources of the SDN network controller are consumed by the monitoring, it may interfere with the operation of the SDN.

SUMMARY OF THE INVENTION The present invention has been made in order to solve the above problems, and it is an object of the present invention to provide a sampling-based network flooding attack detection / defense system for reducing resource consumption of an SDN controller for monitoring, Method and system.

According to an aspect of the present invention, there is provided a network flooding attack detection and defense system, including: a packet sampler for sampling a network flooding attack packet applied to an SDN (Software Defined Network); And an IDS (Intrusion Detection System) for detecting a network flooding attack based on the sample packet.

The packet sampler may receive packet samples from packet sampling agents installed in the switches constituting the SDN.

Also, the sampling period can be set and adjusted.

The IDS may set a rule for detecting network flooding and generate an attack event based on the collected sample packets.

Also, a network flooding attack detection and defense system according to an embodiment of the present invention includes: a controller for controlling an SDN; And an attack automatic defense unit for applying a policy for automatically blocking a network flooding attack to the SDN through the controller.

The network flooding attack detection and defense system according to an embodiment of the present invention may further include an attack event DB for storing a detected attack event, and the attack automatic defense unit may include an attack event storage unit It is possible to apply a policy to automatically block the network flow to the switch of the SDN associated with the attack.

In addition, the attack automatic defense unit may extract parameters necessary for generating a policy in an attack event, analyze the extracted parameters and SDN topology information, and generate a network flow blocking policy for defending the detected attack.

The policy may be applied to select switches to be blocked among the switches constituting the SDN.

Also, the attack automatic defense unit may set the valid period of the policy, and apply the network flow blocking policy to the switches selected by the policy.

According to another aspect of the present invention, there is provided a network flooding attack detection and prevention method comprising the steps of: sampling a network flooding attack packet applied to an SDN (Software Defined Network); And detecting a network flooding attack based on the sample packet.

As described above, according to the embodiments of the present invention, monitoring overhead can be reduced through selective monitoring of switches based on packet sampling, and various network flooding attacks based on software attack detection / easy expansion due to attacker detection Do.

In addition, according to the embodiments of the present invention, it is possible to manage and inquire effective attack information using an attack event database, and to enable automatic attack defense using attack defense automatic defense software for software defined networks.

In addition, according to embodiments of the present invention, it is possible to increase the use efficiency of the flow table of the switch according to the application of the selective attack blocking policy, and reduce the influence of IP spoofing using the network policy manager.

FIG. 1 illustrates an SDN-based network flooding attack detection / defense system according to an embodiment of the present invention; FIG.
FIG. 2 shows a detailed configuration of attack defense automatic defense software for SDN,
Figure 3 is a flow chart provided in the description of the process performed by the attack automatic defense software for SDN to automatically defend the detected attack.

Hereinafter, the present invention will be described in detail with reference to the drawings.

FIG. 1 is a diagram illustrating a Software Defined Network (SDN) based network flooding attack detection / defense system according to an embodiment of the present invention.

In order to reduce resource consumption of the SDN controller required for monitoring, the network flooding attack detection / defense system according to the embodiment of the present invention detects a network flooding attack based on sampling. In addition, the network flooding attack detection / defense system according to the embodiment of the present invention has a configuration for automating the detection and defense of a network flooding attack.

1, the network flooding attack detection / defense system according to an exemplary embodiment of the present invention includes a packet sampler 110, a software IDS (Intrusion Detection System) 120, DB 130, attack defense automatic defense software 140 for SDN, and SDN controller (SDN Controller)

For ease of understanding and explanation, FIG. 1 shows SDN in addition to the network flooding attack detection / defense system according to an embodiment of the present invention. The SDN consists of OpenFlow switches 10 and is operated through the SDN controller 150. [

The SDN controller 150 is implemented in software, and the network operator can operate the network using the Web UI or Consol UI provided by the SDN controller 150.

As described above, the network flooding attack detection / defense system according to the embodiment of the present invention does not monitor all the packets passing through the switch 10, but samples packets according to a given condition.

To this end, a packet sampling agent is selectively installed in the switch 10 to be monitored, and packet samples are transmitted to the packet sampler 110. The sampling period can be set according to need and demand, or it can be set dynamically.

The software IDS 120 analyzes the packet samples collected in the packet sampler 110 to detect whether there is a network flooding attack that exploits TCP SYN, ICMP, or UDP. Specifically, the software IDS 120 sets up a rule for detecting TCP SYN, ICMP, and UDP network flooding, and detects an attack by generating an event message based on the collected packets.

In order to store and manage the information of the detected attack, the attack event DB 130 is operated. The software IDS 120 stores the information of the detected attack in the attack event DB 130, thereby enabling more efficient attack log management and attack countermeasure in the future.

Attack defense automatic defense software (140) for automatic defense of the detected attack. The SDN attack defense automatic defense software 140 automatically applies a flow policy that can block the related network flow to the switch 10 related to the attack when it recognizes that a new attack event is stored in the attack event DB 130. [

For this purpose, the attack defense automatic defense software 140 for SDN utilizes the service and application interface provided by the SDN controller 150. The detailed configuration of the attack defense automatic defense software 140 for SDN is shown in FIG.

2, attack defense automatic defense software 140 for SDN includes a network flow policy generator 141, an SDN topology manager 142, a network flow policy manager 143, a sampling agent manager 144, An event DB connection manager 145, an SDN controller connection manager 146, and a user interface 147.

The attack event DB connection manager 145 is configured to secure newly detected attack information from the attack event database 130 and manages the connection for reading the newly stored attack event in the attack event DB 130. [

The SDN controller connection manager 146 manages the connections needed to obtain or transfer topology information and policy information from the SDN controller 150.

The SDN topology manager 142 collects the information of the OpenFlow switches 10 and the user hosts collected from the SDN controller 150 and generates / manages topology information for the entire SDN.

The network flow policy generator 141 analyzes the SDN topology information and the attack event information in the case of a newly detected attack, and creates a network flow blocking policy for protecting the attack.

The policy generated by the network flow policy generator 141 is not applied to all the network switches 10 but is a policy for selectively blocking only the optimal switch 10 for blocking an attack based on the network topology information .

The network flow policy manager 143 manages the network flow policies created for blocking the attack. In particular, the validity period of the network flow policy and the switch information to which the policy is applied are managed.

Also, in order to reduce the influence of IP spoofing, the network flow policy manager 143 sets a home network domain managed by the SDN controller 150, and when the source IP of the packets generated in the corresponding network is forged, To manage network policies.

The sampling agent manager 144 manages the operation of selecting a network switch 10 to perform attack detection and defense and installing a packet sampling agent in the selected network switch 10.

The user interface 147 is a means for performing environment setting, inquiry, and the like of the attack defense automatic defense software 140 for SDN.

FIG. 3 is a flowchart provided for explaining a process performed by the SDN attack automatic defense software 140 to automatically defend the detected attack.

3, the attack event DB connection manager 145 of the SDN attack automatic defense software 140 periodically checks the attack event DB 130 to determine whether a new attack event has occurred S210).

If it is determined in step S210 that a new attack event has occurred (S220-Y), the network flow policy generator 141 extracts parameters such as a MAC address, an IP address, and Port numbers necessary for establishing a network policy in the attack event information (S230).

Then, the network flow policy generator 141 analyzes the parameters extracted in step S230 and the SDN topology information, and creates a network flow blocking policy for defending the detected attack (S240).

After generating the blocking policy, the network flow policy generator 141 selects the switches 10 to which the blocking policy is to be applied (S250). The selection in step S250 is made with reference to the SDN topology information generated / managed by the SDN topology manager 142.

Then, the network flow policy manager 143 sets the valid period of the blocking policy (S260), and applies the network flow blocking policy to the switches selected in operation S250 (S270).

So far, a preferred embodiment of the SDN-based network flooding attack detection / prevention method and system has been described in detail.

According to the SDN-based network flooding attack detection / defense method and system according to the embodiment of the present invention, monitoring overhead can be reduced through optional switch monitoring based on packet sampling, and various network flooding attack / Extension by detection is easy.

In addition, effective attack information management and inquiry using the attack event DB 130 can be performed, and automatic attack defense using the attack automatic defense software for SDN is possible.

Furthermore, according to the selective attack blocking policy of the switch, the use efficiency of the flow table of the switch is high, and the influence of IP spoofing can be reduced by using the network flow policy manager.

The SDN-based network flooding attack detection / defense method and system according to an embodiment of the present invention can be utilized in a cloud data center or the like, and can be utilized for an Internet service, a communication service, and the like.

A simple and high impact attack such as a network attack in the SDN is one of the problems to be solved in utilizing the network. The SDN-based network flooding attack detection / It is a technology that automatically detects and defends flooding, and can be used in software firewall products for local networks and in the cloud.

While the present invention has been particularly shown and described with reference to exemplary embodiments thereof, it is to be understood that the invention is not limited to the disclosed exemplary embodiments, but, on the contrary, It will be understood by those skilled in the art that various changes and modifications may be made by those skilled in the art without departing from the spirit and scope of the present invention.

110: packet sampler
120: Software Intrusion Detection System (IDS)
130: Attack event DB
140: Attack automatic defense software for SDN
150: SDN controller

Claims (10)

A packet sampler for sampling a network flooding attack packet applied to an SDN (Software Defined Network); And
And an IDS (Intrusion Detection System) for detecting a network flooding attack based on a sample packet.
The method according to claim 1,
Wherein the packet sampler comprises:
And receives packet samples from packet sampling agents installed in the switches constituting the SDN.
The method of claim 2,
In the sampling period,
Wherein the network flooding attack detection and defense system is configured and adjustable.
The method according to claim 1,
The IDS,
Setting a rule for detecting network flooding, and generating an attack event based on the collected sample packet.
The method of claim 4,
A controller for controlling the SDN; And
And an attack automatic defense unit for applying a policy for automatically blocking a network flooding attack to the SDN through the controller.
The method of claim 5,
And an attack event DB for storing the detected attack event,
The attack auto-
Wherein a policy for blocking a network flow is automatically applied to a switch of the SDN related to an attack when it is recognized that an attack event has been stored in the attack event database.
The method of claim 6,
The attack auto-
A network flow blocking policy for protecting a detected attack is generated by extracting parameters necessary for creating a policy in an attack event and analyzing extracted parameters and SDN topology information.
The method of claim 6,
The policy includes:
Wherein the network flooding attack detection and defense system is applied to select a switch to be blocked among the switches constituting the SDN.
The method of claim 8,
The attack auto-
Setting a valid period of the policy, and applying a network flow blocking policy to the switches selected by the policy.
Sampling a network flooding attack packet applied to an SDN (Software Defined Network); And
Detecting a network flooding attack based on the sample packet; and detecting a network flooding attack based on the sample packet.

Images