软件定义网络中网络遥测驱动的DDoS检测方法研究

软件定义网络解耦了传统网络设备的控制及转发功能，被认可为数据中心网络基础架构。以SDN为攻击目标的DDoS能摧毁部分或全部SDN网络，是SDN中不可忽视的安全问题。然而，SDN中DDoS检测存在三个难点：（1）难以按需获取有价值的检测数据；（2）追踪动态变化的最优特征集困难；（3）难以有效避免DDoS检测中信息丢失。本课题针对SDN中网络遥测驱动的DDoS检测方法开展研究：引入网络遥测技术，研究基于网络遥测的DDoS检测数据采集方法，按需获取有价值的DDoS检测数据；根据SDN中DDoS检测过程变化与最优特征解集迁移轨迹间的内在关联，研究面向DDoS检测的动态特征优化机制，快速追踪最优特征解集；结合多分类、集成学习以及D-S证据理论，研究基于网络遥测信息的分段式DDoS检测方法，避免信息丢失，提高检测精度。研究成果将为未来网络安全提供新思路和理论依据，为抵抗境内外DDoS攻击提供有效支撑。

Software-Defined Networking (SDN) decouples the control function and forwarding function of traditional network devices, making SDN become the data center network architecture. The Distributed Denial of Service (DDoS) which targets SDN can destroy a portion or all of the SDN network. It is the unavoidable security threat in SDN. However, there are three problems when detecting DDoS in SDN: (1) it is hard to collect valuable detection data on demand, (2) it is hard to trace the optimal feature set which changes dynamically, and (3) it is hard to effectively avoid losing information when detecting DDoS. This project focuses on the DDoS detection method by using network telemetry technology in SDN. By introducing network telemetry technology, it researches the data collection method to collect on-demand data used in DDoS detection. Using the internal relation between the changes of DDoS detection and the migration of the optimal feature set, it researches the DDoS detection-oriented dynamic feature optimization mechanism to quickly trace the optimal feature set. By combining the multi-class classification technology, ensemble learning technology, and D-S evidence theory, it also researches the multi-step DDoS detection method which detects DDoS based on network telemetry information, to avoid losing information and improve the detection accuracy. The research outcomes obtained from the project will provide new ideas and theories for future cyber security, effectively contributing to the defense of DDoS attacks from domestic and foreign.