US 10,313,375 B2 · Method and apparatus for malicious attack detection in an SDN network

Abstract

A malicious attack detection method includes: receiving, by a controller, a Packet-in message sent by a switch, where the Packet-in message includes a source host identifier and a destination host identifier of a data packet for which the switch does not find a flow entry; when determining that a host indicated by the destination host identifier does not exist in an SDN network, sending, by the controller, an abnormal flow entry to the switch; receiving, by the controller, a triggering count sent by the switch, where the triggering count is a quantity of times that the abnormal flow entry is triggered; and determining, according to the triggering count, whether a malicious attack is initiated. According to the method, a malicious attack from a host can be detected, a data processing volume of a controller can be reduced, and performance of the controller can be improved.

Claims11

Dependent claims

A malicious attack detection method performed by a controller of a software-defined network (SDN), comprising:

receiving a Packet-in message sent by a switch of the SDN, wherein the Packet-in message indicates there is no matching flow entry for a data packet in the switch and comprises a source host identifier and a destination host identifier of the data packet;
determining that a destination host indicated by the destination host identifier does not exist in the SDN;
sending an abnormal flow entry to the switch in response to determining that the destination host indicated by the destination host identifier does not exist in the SDN, wherein the abnormal flow entry comprises the source host identifier of the data packet;
receiving a triggering count from the switch after the abnormal flow entry times out, wherein the triggering count indicates a number of times that the abnormal flow entry is triggered due to the switch receiving other data packets that contain the source host identifier;
and
determining according to the triggering count, whether a malicious attack is initiated from a source host indicated by the source host identifier.

3 more elements

A controller apparatus of a software-defined network (SDN), comprising:

a processor;
a memory, configured to store instructions;
a transceiver;
and
a bus,
wherein the processor, the memory, and the transceiver are interconnected using the bus, and wherein the processor is configured to:
receive a Packet-in message sent by a switch of the SDN, wherein the Packet-in message indicates there is no matching flow entry in the switch for a data packet received by the switch, and comprises a source host identifier and a destination host identifier of the data packet,
determine that a destination host indicated by the destination host identifier does not exist in the SDN,
in response to determining that the destination host indicated by the destination host identifier does not exist in the SDN, send an abnormal flow entry to the switch, wherein the abnormal flow entry includes the source host identifier;
receive a triggering count from the switch after the abnormal flow entry times out, wherein the triggering count indicates a number of times that the abnormal flow entry is triggered due to the switch receiving other data packets containing the source host identifier;
and
determine, according to the triggering count received by the transceiver, whether a malicious attack is initiated from a source host indicated by the source host identifier.

9 more elements

Dependencies are inferred from the claim text.

Method and apparatus for malicious attack detection in an SDN network

Life of this patent

Method and apparatus for malicious attack detection in an SDN network

Life of this patent

Abstract

Claims11