| 一种防御DDoS攻击的软件定义安全网络机制 |
| |
| 引用本文： | 王秀磊,陈鸣,邢长友,孙志,吴泉峰. 一种防御DDoS攻击的软件定义安全网络机制[J]. 软件学报, 2016, 27(12): 3104-3119 |
| |
| 作者姓名： | 王秀磊 陈鸣 邢长友 孙志 吴泉峰 |
| |
| 作者单位： | 解放军理工大学 指挥信息系统学院, 江苏 南京 210007,解放军理工大学 指挥信息系统学院, 江苏 南京 210007,解放军理工大学 指挥信息系统学院, 江苏 南京 210007,解放军理工大学 指挥信息系统学院, 江苏 南京 210007;海军航空工程学院青岛校区 信息管理中心, 山东 青岛 266041,解放军理工大学 指挥信息系统学院, 江苏 南京 210007 |
| |
| 基金项目： | 国家重点基础研究计划（973）（2012CB315806）；国家自然科学基金（61379149，61402521，61103225）；江苏省自然科学基金（BK20140070，BK20140068）；江苏省未来网络科技计划（BY2013095-1-06） |
| |
| 摘 要： | 软件定义网络的出现为防御DDoS攻击提供了新的思路.首先，从网络体系结构角度建模分析了DDoS攻击所需的3个必要条件：连通性、隐蔽性与攻击性；然后，从破坏或限制这些必要条件的角度出发，提出了一种能够对抗DDoS攻击的软件定义安全网络机制SDSNM（software defined security networking mechanism）.该机制主要在边缘SDN网络实现，同时继承了核心IP网络体系架构，具有增量部署特性.利用云计算与Chord技术设计实现了原型系统，基于原型系统的测量结果表明，SDSNM具有很好的扩展性和可用性.
|
| 关 键 词： | 网络安全 DDoS 软件定义网络 OpenFlow 网络体系结构 |
| 收稿时间： | 2015-03-12 |
| 修稿时间： | 2015-08-11 |
Software Defined Security Networking Mechanism Against DDoS Attacks |
| |
| WANG Xiu-Lei,CHEN Ming,XING Chang-You,SUN Zhi and WU Quan-Feng. Software Defined Security Networking Mechanism Against DDoS Attacks[J]. Journal of Software, 2016, 27(12): 3104-3119 |
| |
| Authors: | WANG Xiu-Lei CHEN Ming XING Chang-You SUN Zhi WU Quan-Feng |
| |
| Affiliation: | College of Command Information System, PLA University of Science & Technology, Nanjing 210007, China,College of Command Information System, PLA University of Science & Technology, Nanjing 210007, China,College of Command Information System, PLA University of Science & Technology, Nanjing 210007, China,College of Command Information System, PLA University of Science & Technology, Nanjing 210007, China;Information Management Center, Naval Aeronautical Engineering Institute Qingdao Branch, Qingdao 266041, China and College of Command Information System, PLA University of Science & Technology, Nanjing 210007, China |
| |
| Abstract: | The emerging software defined networking (SDN) offers a new way to rethink the defense of DDoS attacks. In this paper the DDoS attacks are first modeled and analyzed from the perspective of network architecture, and the necessary conditions of DDoS attacks such as connectivity, concealment and aggressivity are presented. Then for breaking or limiting these necessary conditions, a software defined security networking mechanism (SDSNM) against DDoS attacks is proposed. The security mechanism is implemented in the edge SDN networks while inheriting the core infrastructure of IP network. Cloud computing and Chord technology are also employed to solve the expansibility and consistency problems. The experiments demonstrate that SDSNM is feasible and incrementally deployable. |
| |
| Keywords: | network security DDoS software defined networking OpenFlow network architecture |
|
| 点击此处可从《软件学报》浏览原始摘要信息 |
|
点击此处可从《软件学报》下载全文 |
|
