Attack stream identification method, apparatus, and device on software defined network

An attack stream identification apparatus on a software defined network, comprising:

• a receiver;
• a transmitter;
• a memory storing executable instructions;
• and
• a processor coupled to the memory, the receiver, and the transmitter,
• wherein the receiver is configured to:
• receive a data packet of a data stream;
• search, according to a characteristic value of the data packet, an invalid stream filter table for a state field of a filter entry corresponding to the data stream;
• and
• send the state field to the transmitter,
• wherein the transmitter is configured to:
• receive the state field;
• and
• send a report message to a controller when the state field is a suspected attack stream state or a non-attack stream state,
• wherein the processor is configured to:
• fill a rate value for sending the report message to the controller in a rate field of the filter entry;
• receive the rate value;
• and
• change the state field of the filter entry to an attack stream state when the rate value is greater than a preset rate threshold.

A switch, comprising:

• a receiver configured to;
• receive a data packet of a data stream, and
• search, according to a characteristic value of the data packet, an invalid stream filter table for a state field of a filter entry corresponding to the data stream;
• a transmitter configured to send a report message to a controller when the state field is a suspected attack stream state or a non-attack stream state;
• and
• a processor coupled to the receiver and the transmitter and configured to:
• store the invalid stream filter table;
• fill a rate value for sending the report message to the controller in a rate field of the filter entry;
• and
• change the state field of the filter entry to an attack stream state when the rate value is greater than a preset rate threshold.