Software-Defined Networking(SDN)adapts logically-centralized control by decoupling control plane from data plane and provides the efficient use of network resources.However,due to the limitation of traditional routing...Software-Defined Networking(SDN)adapts logically-centralized control by decoupling control plane from data plane and provides the efficient use of network resources.However,due to the limitation of traditional routing strategies relying on manual configuration,SDN may suffer from link congestion and inefficient bandwidth allocation among flows,which could degrade network performance significantly.In this paper,we propose EARS,an intelligence-driven experiential network architecture for automatic routing.EARS adapts deep reinforcement learning(DRL)to simulate the human methods of learning experiential knowledge,employs the closed-loop network control mechanism incorporating with network monitoring technologies to realize the interaction with network environment.The proposed EARS can learn to make better control decision from its own experience by interacting with network environment and optimize the network intelligently by adjusting services and resources offered based on network requirements and environmental conditions.Under the network architecture,we design the network utility function with throughput and delay awareness,differentiate flows based on their size characteristics,and design a DDPGbased automatic routing algorithm as DRL decision brain to find the near-optimal paths for mice and elephant flows.To validate the network architecture,we implement it on a real network environment.Extensive simulation results show that EARS significantly improve the network throughput and reduces the average packet delay in comparison with baseline schemes(e.g.OSPF,ECMP).展开更多
软件定义网络(Software Defined Network,SDN)技术凭借其灵活的网络资源管理和高度可编程性,在电力系统算力网络的运行和维护中发挥着重要作用。SDN能够集中控制网络设备,动态调整网络流量和配置,实时响应网络状态变化,提升故障应对的...软件定义网络(Software Defined Network,SDN)技术凭借其灵活的网络资源管理和高度可编程性,在电力系统算力网络的运行和维护中发挥着重要作用。SDN能够集中控制网络设备,动态调整网络流量和配置,实时响应网络状态变化,提升故障应对的速度和精确性。文章探讨了SDN技术在电力系统算力网络远程维护中的应用,包括网络拓扑动态调整、故障实时检测与隔离、流量精确调度与管理、网络性能的持续监控与优化,旨在有效提高网络运维效率。展开更多
随着电力系统的复杂性和自动化水平的提高,传统的继电保护通信网络已难以满足高可靠性、低时延和大带宽的需求。为此,探讨软件定义网络(Software Defined Network,SDN)架构在电力系统继电保护通信网络中的应用,重点研究SDN控制器架构设...随着电力系统的复杂性和自动化水平的提高,传统的继电保护通信网络已难以满足高可靠性、低时延和大带宽的需求。为此,探讨软件定义网络(Software Defined Network,SDN)架构在电力系统继电保护通信网络中的应用,重点研究SDN控制器架构设计、网络拓扑优化、通信协议选择与实现、流量管理与调度策略以及冗余设计与故障恢复机制等关键技术,提供一种创新的网络设计思路和实施方案。展开更多
针对通信网络传输流量调度的难题,创新性地提出结合软件定义网络(Software Defined Network,SDN)与机器学习算法的调度方案,借助SDN控制器的强大功能,全面采集了网络数据层的关键信息。利用先进的机器学习算法,深入分析这些数据,准确预...针对通信网络传输流量调度的难题,创新性地提出结合软件定义网络(Software Defined Network,SDN)与机器学习算法的调度方案,借助SDN控制器的强大功能,全面采集了网络数据层的关键信息。利用先进的机器学习算法,深入分析这些数据,准确预测了未来的网络流量走势。基于这些精准的预测结果,制定了细致入微的流量调度策略,从而实现了网络流量的动态优化和高效管理。实验数据充分证明,与传统方法相比,所提出的方法在降低网络丢包率、提升资源利用率及传输性能等方面均表现出显著优势。这一创新成果不仅有效增强了网络流量的稳定性和规律性,还为通信网络传输流量调度领域开辟了新的研究路径。展开更多
由于干线网络流量具有较强的波动性,传统的静态资源分配方法在资源调度上存在灵活性差、响应慢等问题。基于此,提出基于软件定义网络(Software Defined Network,SDN)和遗传算法优化的干线数字双链路动态资源调度方法。在SDN架构下实时...由于干线网络流量具有较强的波动性,传统的静态资源分配方法在资源调度上存在灵活性差、响应慢等问题。基于此,提出基于软件定义网络(Software Defined Network,SDN)和遗传算法优化的干线数字双链路动态资源调度方法。在SDN架构下实时监控干线数字双链路的可用带宽、时延等资源,以最大化带宽利用率、最小化时延为目标,构建一个干线数字双链路动态资源调度模型,通过遗传算法求解模型,得到最佳干线数字双链路动态资源调度策略。实验结果表明,设计方法在业务时延与业务丢包率方面具有一定优越性,可最大限度地保证干线数字双链路的数据传输质量。展开更多
软件定义网络(Software Defined Network,SDN)在通信网络中的应用日益广泛,但其集中控制架构也带来新的安全挑战。文章深入剖析SDN架构下通信网络面临的安全威胁,包括控制器单点故障、拒绝服务攻击等,南向接口虚假流表注入、协议漏洞利...软件定义网络(Software Defined Network,SDN)在通信网络中的应用日益广泛,但其集中控制架构也带来新的安全挑战。文章深入剖析SDN架构下通信网络面临的安全威胁,包括控制器单点故障、拒绝服务攻击等,南向接口虚假流表注入、协议漏洞利用等,北向接口应用程序漏洞、身份认证问题等,以及数据平面流量劫持、分布式拒绝服务攻击等。提出相应的安全防御机制,为构建安全可靠的基于SDN的通信网络提供理论依据与实践指导。展开更多
随着下一代通信网的发展,传统网络架构已无法满足日益增长的灵活性、可扩展性及管理需求。软件定义网络(Software Defined Network,SDN)作为一种新型网络架构,为6G网络提供了新的研究方向。文章分析SDN的基本架构和工作原理,并总结SDN...随着下一代通信网的发展,传统网络架构已无法满足日益增长的灵活性、可扩展性及管理需求。软件定义网络(Software Defined Network,SDN)作为一种新型网络架构,为6G网络提供了新的研究方向。文章分析SDN的基本架构和工作原理,并总结SDN技术的优化方法。在此基础上,结合Mininet仿真平台对SDN与传统网络架构在6G应用场景下的性能进行对比实验。结果表明,SDN在网络延迟、丢包率及资源利用率等关键性能指标上显著优于传统网络架构,为6G网络的部署提供了重要理论依据和实践指导。展开更多
探讨基于软件定义网络(Software Defined Network,SDN)的动态流量控制在通信网络安全中的应用。SDN将网络控制平面与数据平面分离,实现可编程和集中化管理。基于SDN的动态流量控制具有实时监测与响应、灵活流量调度、增强安全策略执行...探讨基于软件定义网络(Software Defined Network,SDN)的动态流量控制在通信网络安全中的应用。SDN将网络控制平面与数据平面分离,实现可编程和集中化管理。基于SDN的动态流量控制具有实时监测与响应、灵活流量调度、增强安全策略执行等优势,可用于网络攻击检测和防御、数据泄露防范及网络资源优化分配。通过实时监测异常流量、结合入侵检测系统/入侵防御系统(Intrusion Detection System/Intrusion Prevention System,IDS/IPS)、监控数据流量、加密与访问控制等手段提升安全性,同时实现流量负载均衡和资源分配优化,为通信网络安全提供有力保障。展开更多
随着轨道交通智能化发展,传统通信网络面临控制僵化、业务隔离等挑战。提出基于软件定义网络(Software Defined Network,SDN)技术的轨道交通通信网络架构优化设计方案,通过多域控制器协同机制和服务质量(Quality of Service,QoS)动态调...随着轨道交通智能化发展,传统通信网络面临控制僵化、业务隔离等挑战。提出基于软件定义网络(Software Defined Network,SDN)技术的轨道交通通信网络架构优化设计方案,通过多域控制器协同机制和服务质量(Quality of Service,QoS)动态调度算法改进关键技术。实验结果表明,SDN网络架构在端到端时延、数据吞吐量及故障恢复能力方面均优于传统网络架构。展开更多
软件定义网络(Software Defined Network,SDN)技术通过控制平面与数据平面解耦,为通信网络优化提供了新思路。分析SDN关键技术特征,探讨传统通信网络在性能、安全和标准化等方面面临的挑战。从架构、技术及安全3个层面提出优化策略,通...软件定义网络(Software Defined Network,SDN)技术通过控制平面与数据平面解耦,为通信网络优化提供了新思路。分析SDN关键技术特征,探讨传统通信网络在性能、安全和标准化等方面面临的挑战。从架构、技术及安全3个层面提出优化策略,通过设计扁平化网络架构提高资源利用效率,提出基于OpenFlow的高效转发机制和软件定义的多队列优先级调度算法,构建纵深信任域安全架构。实验结果表明,该优化方案在高负载条件下的端到端时延降低约59.5%,网络吞吐量提升约33.0%,分布式拒绝服务(Distributed Denial of Service,DDoS)攻击检测时延降低75.9%,显著提升了网络性能。展开更多
为加快监控系统的响应速度,增强系统的安全防护能力,基于软件定义网络(Software Defined Network,SDN)技术,设计油气田井口远程监控系统,集成数据平面、控制平面、应用平面,构建系统架构、流量管理与故障处理机制。系统性能测试结果表明...为加快监控系统的响应速度,增强系统的安全防护能力,基于软件定义网络(Software Defined Network,SDN)技术,设计油气田井口远程监控系统,集成数据平面、控制平面、应用平面,构建系统架构、流量管理与故障处理机制。系统性能测试结果表明,设计的监控系统在关键性能指标上均优于传统监控系统,能够满足油气田井口的监控需求,提升油气田生产的安全性和管理效率。展开更多
文章深入研究基于强化学习的流量优化与拥塞控制方法在软件定义网络(Software Defined Network,SDN)中的应用。首先,详细阐述SDN网络的架构与原理。SDN网络的灵活性和可编程性为网络管理提供了全新的范式。其次,提出了一种基于强化学习...文章深入研究基于强化学习的流量优化与拥塞控制方法在软件定义网络(Software Defined Network,SDN)中的应用。首先,详细阐述SDN网络的架构与原理。SDN网络的灵活性和可编程性为网络管理提供了全新的范式。其次,提出了一种基于强化学习的流量优化与拥塞控制方法,通过建模状态、动作、奖励等要素,实现网络流量智能调整。最后,在Mininet仿真环境中进行了实验验证。通过监测吞吐量、延迟、拥塞情况等性能指标,验证所提方法的有效性。实验结果表明,在网络性能方面,所提方法相较于传统方法取得了显著改善,具备更好的适应性和优化能力。展开更多
重点研究智慧校园网络与安全的软件定义网络(Software Defined Network,SDN)架构选择,分别讨论SDN架构应用的必要性、实现方法、网络与安全维护建议等内容。从智慧校园的集中部署、意图网络与智慧校园的融合、以零信任为核心构建网络安...重点研究智慧校园网络与安全的软件定义网络(Software Defined Network,SDN)架构选择,分别讨论SDN架构应用的必要性、实现方法、网络与安全维护建议等内容。从智慧校园的集中部署、意图网络与智慧校园的融合、以零信任为核心构建网络安全架构3个维度出发,提出保护智慧校园网络安全的建议。旨在强调SDN架构对于智慧校园建设的运行安全维护作用,以期为今后智慧校园的深化建设提供技术支持。展开更多
This paper proposes a cross-layer design to enhance the location privacy under a coordinated medium access control(MAC) protocol for the Internet of Vehicles(Io V). The channel and pseudonym resources are both essenti...This paper proposes a cross-layer design to enhance the location privacy under a coordinated medium access control(MAC) protocol for the Internet of Vehicles(Io V). The channel and pseudonym resources are both essential for transmission efficiency and privacy preservation in the Io V. Nevertheless, the MAC protocol and pseudonym scheme are usually studied separately, in which a new MAC layer semantic linking attack could be carried out by analyzing the vehicles' transmission patterns even if they change pseudonyms simultaneously. This paper presents a hierarchical architecture named as the software defined Internet of Vehicles(SDIV). Facilitated by the architecture, a MAC layer aware pseudonym(MAP) scheme is proposed to resist the new attack. In the MAP, RSU clouds coordinate vehicles to change their transmission slots and pseudonyms simultaneously in the mix-zones by measuring the privacy level quantitatively. Security analysis and extensive simulations are conducted to show that the scheme provides reliable safety message broadcasting, improves the location privacy and network throughput in the Io V.展开更多
Distributed Denial of Service(DDoS) attacks have been one of the most destructive threats to Internet security. By decoupling the network control and data plane, software defined networking(SDN) offers a flexible netw...Distributed Denial of Service(DDoS) attacks have been one of the most destructive threats to Internet security. By decoupling the network control and data plane, software defined networking(SDN) offers a flexible network management paradigm to solve DDoS attack in traditional networks. However, the centralized nature of SDN is also a potential vulnerability for DDo S attack. In this paper, we first provide some SDN-supported mechanisms against DDoS attack in traditional networks. A systematic review of various SDN-self DDo S threats are then presented as well as the existing literatures on quickly DDoS detection and defense in SDN. Finally, some promising research directions in this field are introduced.展开更多
In recent years, SDN(Software Defined Network) as a new network architecture has become the hot research point. Meanwhile,the well-known Open Flow-based SDN got a lot of attention. But it can't provide a flexible ...In recent years, SDN(Software Defined Network) as a new network architecture has become the hot research point. Meanwhile,the well-known Open Flow-based SDN got a lot of attention. But it can't provide a flexible and effective network resource description method.As an open programmable technology, For CES(Forwarding and Control Element Separation)has also been concerned. However, For CES is confined within a single network node and cannot be applied to the entire network. This paper proposes a new architecture — ForS A(ForC ESbased SDN architecture). The architecture is added a configuration layer based on the traditional SDN architecture, which solves the problem that the northbound interface is not clear between the application layer and the control layer in the SDN architecture. ForS A also implements the compatibility within various forwarding devices in the forwarding layer.展开更多
针对大流检测、突变流检测和基数估计等的网络流量测量对保障网络安全具有重要意义.但当前相关研究存在实时性不足、测量精度不高等问题.针对上述问题,设计了一种基于多层Sketch(multiple layer sketch, ML Sketch)的网络流量测量模型....针对大流检测、突变流检测和基数估计等的网络流量测量对保障网络安全具有重要意义.但当前相关研究存在实时性不足、测量精度不高等问题.针对上述问题,设计了一种基于多层Sketch(multiple layer sketch, ML Sketch)的网络流量测量模型.首先,该模型采用自主设计的ML Sketch结构,使用分类存储结构提高了流量测量的精度.其次,在SDN(software defined network)环境下利用流量实时回放技术,模拟了流量的动态发生场景.最后,在SDN控制平面实现了对大流、突变流和基数估计类流量的实时动态检测.在UNSW-NB15上的实验结果表明,与传统Sketch结构相比,所设计的ML Sketch结构在F1_Score指标上最高提高4.81%,相关误差最高降低81.12%,验证了该模型的有效性.展开更多
Link flooding attack(LFA)is a type of covert distributed denial of service(DDoS)attack.The attack mechanism of LFAs is to flood critical links within the network to cut off the target area from the Internet.Recently,t...Link flooding attack(LFA)is a type of covert distributed denial of service(DDoS)attack.The attack mechanism of LFAs is to flood critical links within the network to cut off the target area from the Internet.Recently,the proliferation of Internet of Things(IoT)has increased the quantity of vulnerable devices connected to the network and has intensified the threat of LFAs.In LFAs,attackers typically utilize low-speed flows that do not reach the victims,making the attack difficult to detect.Traditional LFA defense methods mainly reroute the attack traffic around the congested link,which encounters high complexity and high computational overhead due to the aggregation of massive attack traffic.To address these challenges,we present an LFA defense framework which can mitigate the attack flows at the border switches when they are small in scale.This framework is lightweight and can be deployed at border switches of the network in a distributed manner,which ensures the scalability of our defense system.The performance of our framework is assessed in an experimental environment.The simulation results indicate that our method is effective in detecting and mitigating LFAs with low time complexity.展开更多
基金supported by the National Natural Science Foundation of China for Innovative Research Groups (61521003)the National Natural Science Foundation of China (61872382)+1 种基金the National Key Research and Development Program of China (2017YFB0803204)the Research and Development Program in Key Areas of Guangdong Province (No.2018B010113001)
文摘Software-Defined Networking(SDN)adapts logically-centralized control by decoupling control plane from data plane and provides the efficient use of network resources.However,due to the limitation of traditional routing strategies relying on manual configuration,SDN may suffer from link congestion and inefficient bandwidth allocation among flows,which could degrade network performance significantly.In this paper,we propose EARS,an intelligence-driven experiential network architecture for automatic routing.EARS adapts deep reinforcement learning(DRL)to simulate the human methods of learning experiential knowledge,employs the closed-loop network control mechanism incorporating with network monitoring technologies to realize the interaction with network environment.The proposed EARS can learn to make better control decision from its own experience by interacting with network environment and optimize the network intelligently by adjusting services and resources offered based on network requirements and environmental conditions.Under the network architecture,we design the network utility function with throughput and delay awareness,differentiate flows based on their size characteristics,and design a DDPGbased automatic routing algorithm as DRL decision brain to find the near-optimal paths for mice and elephant flows.To validate the network architecture,we implement it on a real network environment.Extensive simulation results show that EARS significantly improve the network throughput and reduces the average packet delay in comparison with baseline schemes(e.g.OSPF,ECMP).
文摘软件定义网络(Software Defined Network,SDN)技术凭借其灵活的网络资源管理和高度可编程性,在电力系统算力网络的运行和维护中发挥着重要作用。SDN能够集中控制网络设备,动态调整网络流量和配置,实时响应网络状态变化,提升故障应对的速度和精确性。文章探讨了SDN技术在电力系统算力网络远程维护中的应用,包括网络拓扑动态调整、故障实时检测与隔离、流量精确调度与管理、网络性能的持续监控与优化,旨在有效提高网络运维效率。
文摘随着电力系统的复杂性和自动化水平的提高,传统的继电保护通信网络已难以满足高可靠性、低时延和大带宽的需求。为此,探讨软件定义网络(Software Defined Network,SDN)架构在电力系统继电保护通信网络中的应用,重点研究SDN控制器架构设计、网络拓扑优化、通信协议选择与实现、流量管理与调度策略以及冗余设计与故障恢复机制等关键技术,提供一种创新的网络设计思路和实施方案。
文摘针对通信网络传输流量调度的难题,创新性地提出结合软件定义网络(Software Defined Network,SDN)与机器学习算法的调度方案,借助SDN控制器的强大功能,全面采集了网络数据层的关键信息。利用先进的机器学习算法,深入分析这些数据,准确预测了未来的网络流量走势。基于这些精准的预测结果,制定了细致入微的流量调度策略,从而实现了网络流量的动态优化和高效管理。实验数据充分证明,与传统方法相比,所提出的方法在降低网络丢包率、提升资源利用率及传输性能等方面均表现出显著优势。这一创新成果不仅有效增强了网络流量的稳定性和规律性,还为通信网络传输流量调度领域开辟了新的研究路径。
文摘由于干线网络流量具有较强的波动性,传统的静态资源分配方法在资源调度上存在灵活性差、响应慢等问题。基于此,提出基于软件定义网络(Software Defined Network,SDN)和遗传算法优化的干线数字双链路动态资源调度方法。在SDN架构下实时监控干线数字双链路的可用带宽、时延等资源,以最大化带宽利用率、最小化时延为目标,构建一个干线数字双链路动态资源调度模型,通过遗传算法求解模型,得到最佳干线数字双链路动态资源调度策略。实验结果表明,设计方法在业务时延与业务丢包率方面具有一定优越性,可最大限度地保证干线数字双链路的数据传输质量。
文摘软件定义网络(Software Defined Network,SDN)在通信网络中的应用日益广泛,但其集中控制架构也带来新的安全挑战。文章深入剖析SDN架构下通信网络面临的安全威胁,包括控制器单点故障、拒绝服务攻击等,南向接口虚假流表注入、协议漏洞利用等,北向接口应用程序漏洞、身份认证问题等,以及数据平面流量劫持、分布式拒绝服务攻击等。提出相应的安全防御机制,为构建安全可靠的基于SDN的通信网络提供理论依据与实践指导。
文摘随着下一代通信网的发展,传统网络架构已无法满足日益增长的灵活性、可扩展性及管理需求。软件定义网络(Software Defined Network,SDN)作为一种新型网络架构,为6G网络提供了新的研究方向。文章分析SDN的基本架构和工作原理,并总结SDN技术的优化方法。在此基础上,结合Mininet仿真平台对SDN与传统网络架构在6G应用场景下的性能进行对比实验。结果表明,SDN在网络延迟、丢包率及资源利用率等关键性能指标上显著优于传统网络架构,为6G网络的部署提供了重要理论依据和实践指导。
文摘随着轨道交通智能化发展,传统通信网络面临控制僵化、业务隔离等挑战。提出基于软件定义网络(Software Defined Network,SDN)技术的轨道交通通信网络架构优化设计方案,通过多域控制器协同机制和服务质量(Quality of Service,QoS)动态调度算法改进关键技术。实验结果表明,SDN网络架构在端到端时延、数据吞吐量及故障恢复能力方面均优于传统网络架构。
文摘软件定义网络(Software Defined Network,SDN)技术通过控制平面与数据平面解耦,为通信网络优化提供了新思路。分析SDN关键技术特征,探讨传统通信网络在性能、安全和标准化等方面面临的挑战。从架构、技术及安全3个层面提出优化策略,通过设计扁平化网络架构提高资源利用效率,提出基于OpenFlow的高效转发机制和软件定义的多队列优先级调度算法,构建纵深信任域安全架构。实验结果表明,该优化方案在高负载条件下的端到端时延降低约59.5%,网络吞吐量提升约33.0%,分布式拒绝服务(Distributed Denial of Service,DDoS)攻击检测时延降低75.9%,显著提升了网络性能。
文摘为加快监控系统的响应速度,增强系统的安全防护能力,基于软件定义网络(Software Defined Network,SDN)技术,设计油气田井口远程监控系统,集成数据平面、控制平面、应用平面,构建系统架构、流量管理与故障处理机制。系统性能测试结果表明,设计的监控系统在关键性能指标上均优于传统监控系统,能够满足油气田井口的监控需求,提升油气田生产的安全性和管理效率。
文摘文章深入研究基于强化学习的流量优化与拥塞控制方法在软件定义网络(Software Defined Network,SDN)中的应用。首先,详细阐述SDN网络的架构与原理。SDN网络的灵活性和可编程性为网络管理提供了全新的范式。其次,提出了一种基于强化学习的流量优化与拥塞控制方法,通过建模状态、动作、奖励等要素,实现网络流量智能调整。最后,在Mininet仿真环境中进行了实验验证。通过监测吞吐量、延迟、拥塞情况等性能指标,验证所提方法的有效性。实验结果表明,在网络性能方面,所提方法相较于传统方法取得了显著改善,具备更好的适应性和优化能力。
文摘重点研究智慧校园网络与安全的软件定义网络(Software Defined Network,SDN)架构选择,分别讨论SDN架构应用的必要性、实现方法、网络与安全维护建议等内容。从智慧校园的集中部署、意图网络与智慧校园的融合、以零信任为核心构建网络安全架构3个维度出发,提出保护智慧校园网络安全的建议。旨在强调SDN架构对于智慧校园建设的运行安全维护作用,以期为今后智慧校园的深化建设提供技术支持。
基金supported by key special project of National Key Research and Development Program (2017YFC0803900)
文摘This paper proposes a cross-layer design to enhance the location privacy under a coordinated medium access control(MAC) protocol for the Internet of Vehicles(Io V). The channel and pseudonym resources are both essential for transmission efficiency and privacy preservation in the Io V. Nevertheless, the MAC protocol and pseudonym scheme are usually studied separately, in which a new MAC layer semantic linking attack could be carried out by analyzing the vehicles' transmission patterns even if they change pseudonyms simultaneously. This paper presents a hierarchical architecture named as the software defined Internet of Vehicles(SDIV). Facilitated by the architecture, a MAC layer aware pseudonym(MAP) scheme is proposed to resist the new attack. In the MAP, RSU clouds coordinate vehicles to change their transmission slots and pseudonyms simultaneously in the mix-zones by measuring the privacy level quantitatively. Security analysis and extensive simulations are conducted to show that the scheme provides reliable safety message broadcasting, improves the location privacy and network throughput in the Io V.
基金supported in part by the“973”Program of China under Grant No.2013CB329103the National Natural Science Foundation of China under Grant No.61271171 and No.61401070+1 种基金National Key Research and Development Program of China No.2016YFB0800105the“863”Program of China under Grant No.2015AA015702 and No.2015AA016102
文摘Distributed Denial of Service(DDoS) attacks have been one of the most destructive threats to Internet security. By decoupling the network control and data plane, software defined networking(SDN) offers a flexible network management paradigm to solve DDoS attack in traditional networks. However, the centralized nature of SDN is also a potential vulnerability for DDo S attack. In this paper, we first provide some SDN-supported mechanisms against DDoS attack in traditional networks. A systematic review of various SDN-self DDo S threats are then presented as well as the existing literatures on quickly DDoS detection and defense in SDN. Finally, some promising research directions in this field are introduced.
基金supported in part by a grant from the National Basic Research Program of China(973 Program)(No.2012CB315902)the National High Technology Research and Development Program(863 Program) (No.2015AA011901)+1 种基金the National Natural Science Foundation of China(No.61402408, 61379120)Zhejiang Leading Team of Science and Technology Innovation(No.2011R50010-04, 2011R50010-03,2011R50010-2)
文摘In recent years, SDN(Software Defined Network) as a new network architecture has become the hot research point. Meanwhile,the well-known Open Flow-based SDN got a lot of attention. But it can't provide a flexible and effective network resource description method.As an open programmable technology, For CES(Forwarding and Control Element Separation)has also been concerned. However, For CES is confined within a single network node and cannot be applied to the entire network. This paper proposes a new architecture — ForS A(ForC ESbased SDN architecture). The architecture is added a configuration layer based on the traditional SDN architecture, which solves the problem that the northbound interface is not clear between the application layer and the control layer in the SDN architecture. ForS A also implements the compatibility within various forwarding devices in the forwarding layer.
文摘针对大流检测、突变流检测和基数估计等的网络流量测量对保障网络安全具有重要意义.但当前相关研究存在实时性不足、测量精度不高等问题.针对上述问题,设计了一种基于多层Sketch(multiple layer sketch, ML Sketch)的网络流量测量模型.首先,该模型采用自主设计的ML Sketch结构,使用分类存储结构提高了流量测量的精度.其次,在SDN(software defined network)环境下利用流量实时回放技术,模拟了流量的动态发生场景.最后,在SDN控制平面实现了对大流、突变流和基数估计类流量的实时动态检测.在UNSW-NB15上的实验结果表明,与传统Sketch结构相比,所设计的ML Sketch结构在F1_Score指标上最高提高4.81%,相关误差最高降低81.12%,验证了该模型的有效性.
基金supported in part by the National Key R&D Program of China under Grant 2018YFA0701601in part by the National Natural Science Foundation of China(Grant No.62201605,62341110,U22A2002)in part by Tsinghua University-China Mobile Communications Group Co.,Ltd.Joint Institute。
文摘Link flooding attack(LFA)is a type of covert distributed denial of service(DDoS)attack.The attack mechanism of LFAs is to flood critical links within the network to cut off the target area from the Internet.Recently,the proliferation of Internet of Things(IoT)has increased the quantity of vulnerable devices connected to the network and has intensified the threat of LFAs.In LFAs,attackers typically utilize low-speed flows that do not reach the victims,making the attack difficult to detect.Traditional LFA defense methods mainly reroute the attack traffic around the congested link,which encounters high complexity and high computational overhead due to the aggregation of massive attack traffic.To address these challenges,we present an LFA defense framework which can mitigate the attack flows at the border switches when they are small in scale.This framework is lightweight and can be deployed at border switches of the network in a distributed manner,which ensures the scalability of our defense system.The performance of our framework is assessed in an experimental environment.The simulation results indicate that our method is effective in detecting and mitigating LFAs with low time complexity.
