Method and apparatus for malicious attack detection in a software defined network (SDN)
AssigneeHuawei Technologies Co., Ltd.
InventorsKe Lin, Yongcan Wang, Yingjun Tian
Life of this patent
Estimating the term…
Abstract
A malicious attack detection method includes receiving, by a controller, a packet-in message sent by a switch, sending, by the controller, an abnormal flow entry to the switch, receiving, by the controller, a triggering count sent by the switch, where the triggering count is a quantity of times that the abnormal flow entry is triggered, and determining, according to the triggering count, whether a malicious attack is initiated.
Claims21
A malicious attack detection method performed by a controller of a software-defined network (SDN), comprising:
- receiving a packet-in message from a switch in the SDN, wherein the packet-in message indicates that the switch lacks a matching flow entry for a data packet received by the switch;
- determining that a destination host of the data packet does not exist in the SDN;
- sending an abnormal flow entry comprising a source host identifier of the data packet to the switch;
- receiving a triggering count indicating a quantity of times that the abnormal flow entry is triggered from the switch;
- and
- determining whether a malicious attack is initiated from a source host indicated by the source host identifier based on the triggering count.
A malicious attack detection apparatus, comprising:
- a memory configured to store instructions;
- and
- a processor coupled to the memory and configured to execute the instructions to cause the processor to be configured to:
- receive a packet-in message from a switch in the SDN, wherein the packet-in message indicates that the switch lacks a matching flow entry for a data packet received by the switch;
- determine that a destination host of the data packet does not exist in the SDN;
- send an abnormal flow entry comprising a source host identifier of the data packet to the switch;
- receive a triggering count indicating a quantity of times that the abnormal flow entry is triggered from the switch;
- and
- determine whether a malicious attack is initiated from a source host indicated by the source host identifier based on the triggering count.
A malicious attack detection system applied in a software-defined network (SDN), comprising;
- a switch;
- and
- a controller coupled to the switch and comprising:
- a receiver configured to receive a packet-in message from the switch of the SDN, wherein the packet-in message indicates that the switch lacks a matching flow entry for a data packet received by the switch;
- a processor coupled to the receiver and configured to determine a destination host of the data packet does not exist in the SDN;
- and
- a transmitter coupled to the processor and configured to send an abnormal flow entry comprising a source host identifier of the data packet to the switch,
- wherein the receiver is further configured to receive a triggering count indicating a quantity of times that the abnormal flow entry is triggered from the switch, and
- wherein the processor is further configured to determine whether a malicious attack is initiated from a source host indicated by the source host identifier based on the triggering count.
Dependencies are inferred from the claim text.