# US 2018/0324212 A1 · METHOD AND DEVICE FOR SIMULATING AND DETECTING DDoS ATTACKS IN SOFTWARE DEFINED NETWORKING > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2018/0324212 A1 - Document ID: US20180324212A1 - Status: Published application - Kind: A1 - Application number: 15/922,902 - Filed: 2018-03-15 - Published: 2018-11-08 - Earliest claimed: 2017-05-02 - Assignees: Shenzhen University - Applicants: Shenzhen University - Inventors: Qiao Yan; Qingxiang Gong; Jianyong Chen - Web page: https://patentgrep.com/patent/US20180324212A1 ## CPC - H04L 63/1458: {Denial of Service} - G06F 30/20: Design optimisation, verification or simulation (optimisation, verification or simulation of circuit designs G06F30/30) - H04L 63/1408: {by monitoring network traffic (monitoring network traffic per se H04L43/00)} - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - H04L 63/1433: {Vulnerability analysis} - H04L 63/1483: {service impersonation, e.g. phishing, pharming or web spoofing (detection of rogue wireless access points H04W12/12)} - H04L 2463/144: Detection or countermeasures against botnets - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract The present disclosure provides a method and a device for simulating and detecting DDoS Attacks in software defined networking. The method comprises: adding zombie hosts in a preset linear increasing mode and an incremental mode, and launching stealthy DDoS Attacks on a data plane to a preset target switch in a software defined networking through all zombie hosts; synchronously updating a pre-built attack flow monitoring table on a controller of the networking according to updating of flow tables on all switches; periodically detecting the monitoring table to determine whether the monitoring table includes a monitoring table entry having existence duration over a preset duration threshold; and determining that a network flow corresponding to the monitoring table entry is a stealthy attack flow on the data plane of the networking when the monitoring table includes the monitoring table entry having the existence duration over the preset duration threshold. ## Claims ### Claim 1 A method for simulating and detecting DDoS Attacks in software defined networking, characterized in that the method comprises the following steps: adding zombie hosts in a preset linear increasing mode and an incremental mode, and launching stealthy DDoS Attacks on a data plane to a preset target switch in a software defined networking through all zombie hosts; synchronously updating a pre-built attack flow monitoring table on a controller of the software defined networking according to updating of flow tables on all switches in the software defined networking; periodically detecting the attack flow monitoring table to determine whether the attack flow monitoring table includes a monitoring table entry having existence duration over a preset duration threshold; and determining that a network flow corresponding to the monitoring table entry having the existence duration over the preset duration threshold is a stealthy attack flow on the data plane of the software defined networking when the attack flow monitoring table includes the monitoring table entry having the existence duration over the preset duration threshold. ### Claim 2 (depends on 1) The method according to claim 1, characterized in that the step of adding zombie hosts in a preset linear increasing mode and an incremental mode, and launching stealthy DDoS Attacks on a data plane to a preset target switch in a software defined networking through all zombie hosts comprises: linearly increasing the number of the zombie hosts, and then stopping linearly increasing the number of the zombie hosts when detecting that a flow installing success rate of the target switch is lower than a preset first success rate threshold; incrementally increasing the number of the zombie hosts, and then stopping incrementally increasing the number of the zombie hosts when detecting that a flow installing success rate of the target switch is lower than a preset second success rate threshold; and sending a network flow to the target switch at a minimum attack speed according to a normal flow speed of all the zombie hosts and the software defined networking. ### Claim 3 (depends on 2) The method according to claim 2, characterized in that the step of linearly increasing the number of the zombie hosts, and then stopping linearly increasing the number of the zombie hosts when detecting that a flow installing success rate of the target switch is lower than a preset first success rate threshold comprises: increasing the number of the zombie hosts in multiple batches according to the linear increasing mode and a preset attack time interval, and launching an attack on the target switch at the normal flow speed through each batch of the zombie hosts after each batch of the zombie hosts appears; and acquiring the flow installing success rate of the target switch through the controller, and when detecting that the flow installing success rate is lower than the preset first success rate threshold, determining that the flow table approaches to saturation and stopping the linear increasing mode. ### Claim 4 (depends on 1) The method according to claim 1, characterized in that the step of synchronously updating a pre-built attack flow monitoring table on a controller of the software defined networking according to updating of flow tables on all switches in the software defined networking comprises: pre-building the attack flow monitoring table on the controller, wherein monitoring table entries of the attack flow monitoring table comprise a switch identifier, a flow table entry sequence, a flow table entry matching field, a flow table entry adding time and a flow table entry existence duration; respectively determining added flow table entries and removed flow table entries in the flow tables of all the switches according to a Packet-in event and a Flow-removed event triggered by all the switches; and adding monitoring table entries corresponding to the added flow table entries and removing monitoring table entries corresponding to the removed flow table entries in the attack flow monitoring table. ### Claim 5 (depends on 1) The method according to claim 1, characterized in that the step of periodically detecting the attack flow monitoring table to determine whether the attack flow monitoring table includes a monitoring table entry having existence duration over a preset duration threshold comprises: periodically detecting the attack flow monitoring table to detect whether the attack flow monitoring table includes a monitoring table entry corresponding to a flow table entry having existence duration over the preset duration threshold; and determining that the attack flow monitoring table includes the monitoring table entry having the existence duration over the preset duration threshold when the attack flow monitoring table includes the monitoring table entry corresponding to the flow table entry having the existence duration over the preset duration threshold. ### Claim 6 A device for simulating and detecting DDoS Attacks in software defined networking, characterized in that the device comprises: an attack simulating module, configured to add zombie hosts in a preset linear increasing mode and an incremental mode, and launch stealthy DDoS Attacks on a data plane to a preset target switch in a software defined networking through all zombie hosts; a table updating module, configured to synchronously update a pre-built attack flow monitoring table on a controller of the software defined networking according to updating of flow tables on all switches in the software defined networking; a timeout detecting module, configured to periodically detect the attack flow monitoring table to determine whether the attack flow monitoring table includes a monitoring table entry having existence duration over a preset duration threshold; and an attack flow determining module, configured to determine that a network flow corresponding to the monitoring table entry having the existence duration over the preset duration threshold is a stealthy attack flow on the data plane of the software defined networking when the attack flow monitoring table includes the monitoring table entry having the existence duration over the preset duration threshold. ### Claim 7 (depends on 6) The device according to claim 6, characterized in that the attack simulating module comprises: a linear increasing mode module, configured to linearly increase the number of the zombie hosts, and then stop linearly increasing the number of the zombie hosts when detecting that a flow installing success rate of the target switch is lower than a preset first success rate threshold; an incremental mode module, configured to incrementally increasing the number of the zombie hosts, and then stop incrementally increasing the number of the zombie hosts when detecting that a flow installing success rate of the target switch is lower than a preset second success rate threshold; and a stealthily attacking module, configured to send a network flow to the target switch at a minimum attack speed according to a normal flow speed of all the zombie hosts and the software defined networking. ### Claim 8 (depends on 7) The device according to claim 7, characterized in that the linear increasing mode module comprises: an increasing attacking module, configured to increase the number of the zombie hosts in multiple batches according to the linear increasing mode and a preset attack time interval, and launch an attack on the target switch at the normal flow speed through each batch of the zombie hosts after each batch of the zombie hosts appears; and an increasing stopping module, configured to acquire the flow installing success rate of the target switch through the controller, and when detecting that the flow installing success rate is lower than the preset first success rate threshold, determine that the flow table approaches to saturation and stop the linear increasing mode. ### Claim 9 (depends on 6) The device according to claim 6, characterized in that the table updating module comprises: a monitoring table building module, configured to pre-build the attack flow monitoring table on the controller, wherein monitoring table entries of the attack flow monitoring table comprise a switch identifier, a flow table entry sequence, a flow table entry matching field, a flow table entry adding time and a flow table entry existence duration; an updating determining module, configured to respectively determine added flow table entries and removed flow table entries in the flow tables of all the switches according to a Packet-in event and a Flow-removed event triggered by all the switches; and a monitoring table updating module, configured to add monitoring table entries corresponding to the added flow table entries and remove monitoring table entries corresponding to the removed flow table entries in the attack flow monitoring table. ### Claim 10 (depends on 6) The device according to claim 6, characterized in that the timeout detecting module comprises: a detecting module, configured to periodically detect the attack flow monitoring table to detect whether the attack flow monitoring table includes a monitoring table entry corresponding to a flow table entry having existence duration over the preset duration threshold; and a timeout determining module, configured to determine that the attack flow monitoring table includes the monitoring table entry having the existence duration over the preset duration threshold when the attack flow monitoring table includes the monitoring table entry corresponding to the flow table entry having the existence duration over the preset duration threshold.