Design and implementation of intrusion detection model for software defined network architecture

doi:10.11772/j.issn.1001-9081.2019061125

Journal of Computer Applications ›› 2020, Vol. 40 ›› Issue (1): 116-122.DOI: 10.11772/j.issn.1001-9081.2019061125

• Cyber security • Previous Articles Next Articles

Design and implementation of intrusion detection model for software defined network architecture

CHI Yaping^1,2, MO Chongwei^1,2, YANG Yintan², CHEN Chunxia¹

1. Department of Cyberspace Security, Beijing Electronic Science and Technology Institute, Beijing 100070, China;
2. College of Communication Engineering, Xidian University, Xi'an Shaanxi 710071, China

Received:2019-06-28 Revised:2019-09-24 Online:2020-01-10 Published:2019-10-11
Supported by:
This work is partially supported by the National Key Research and Development Program of China (2018YFB1004100).

面向软件定义网络架构的入侵检测模型设计与实现

池亚平^1,2, 莫崇维^1,2, 杨垠坦², 陈纯霞¹

1. 北京电子科技学院网络空间安全系, 北京 100070;
2. 西安电子科技大学通信工程学院, 西安 710071

通讯作者: 莫崇维
作者简介:池亚平(1969-),女,北京人,教授,博士,CCF高级会员,主要研究方向:虚拟化安全、可信计算、加密技术、网络安全、软件定义网络、云计算安全;莫崇维(1989-),男,广西来宾人,硕士研究生,主要研究方向:软件定义网络、云计算、网络安全;杨垠坦(1993-),男,河南南阳人,硕士研究生,主要研究方向:软件定义网络、云计算、网络安全;陈纯霞(1996-),女,广东汕头人,硕士研究生,主要研究方向:云计算、网络安全、加密技术。
基金资助:
国家重点研发计划项目（2018YFB1004101）。

Abstract

Abstract: Concerning the problem that traditional intrusion detection method cannot detect the specific attacks aiming at Software Defined Network (SDN) architecture, an intrusion detection model based on Convolutional Neural Network (CNN) was proposed. Firstly, an feature extraction method was designed based on SDN flow table entry. The SDN specific attack samples were collected to form the attack flow table dataset. Then, the CNN was used for training and detection. And focusing on the low recognition rate caused by small sample size of SDN attacks, a reinforcement learning method based on probability was proposed. The experimental results show that the proposed intrusion detection model can effectively detect the specific attacks aiming at SDN architecture with high accuracy, and the proposed reinforcement learning method can effectively improve the recognition rate of small probability attacks.

Key words: intrusion detection, Convolutional Neural Network (CNN), Software Defined Network (SDN), network security, reinforcement learning

摘要： 针对传统入侵检测方法无法检测软件定义网络（SDN）架构的特有攻击行为的问题，设计一种基于卷积神经网络（CNN）的入侵检测模型。首先，基于SDN流表项设计了特征提取方法，通过采集SDN特有攻击样本形成攻击流表数据集；然后，采用CNN进行训练和检测，并针对SDN攻击样本量较小而导致的识别率低的问题，设计了一种基于概率的加强训练方法。实验结果表明，所提的入侵检测模型可以有效检测面向SDN架构的特有攻击，具有较高的准确率，所提的基于概率的加强学习方法能有效提升小概率攻击的识别率。

关键词: 入侵检测, 卷积神经网络, 软件定义网络, 网络安全, 加强学习

CLC Number:

TP311

CHI Yaping, MO Chongwei, YANG Yintan, CHEN Chunxia. Design and implementation of intrusion detection model for software defined network architecture[J]. Journal of Computer Applications, 2020, 40(1): 116-122.

池亚平, 莫崇维, 杨垠坦, 陈纯霞. 面向软件定义网络架构的入侵检测模型设计与实现[J]. 计算机应用, 2020, 40(1): 116-122.

References

[1] 张朝昆,崔勇,唐翯祎. 软件定义网络(SDN)研究进展[J]. 软件学报, 2015, 26(1):62-81. (ZHANG C K, CUI Y, TANG H Y. State-of-the-art survey on Software-Defined Networking (SDN)[J]. Journal of Software, 2015, 26(1):62-81.)
[2] 王蒙蒙,刘建伟,陈杰,等. 软件定义网络:安全模型、机制及研究进展[J]. 软件学报, 2016, 27(4):969-992. (WANG M M, LIU J W, CHEN J, et al. Software defined networking:security model, threats and mechanism[J]. Journal of Software, 2016, 27(4):969-992.)
[3] 孙三山,汪帅,樊自甫. 软件定义网络架构下基于流调度代价的数据中心网络拥塞控制路由算法[J]. 计算机应用, 2016, 36(7):1784-1788. (SUN S S, WANG S, FAN Z F, et al. Flow scheduling cost based congestion control routing algorithm for data center network on software defined network architecture[J]. Journal of Computer Applications, 2016, 36(7):1784-1788.)
[4] 刘静,郭景元,赖英旭. 基于OpenFlow的流量监控架构实践方案[J]. 北京工业大学学报, 2016, 42(5):713-721. (LIU J, GUO J Y, LAI Y X. Practice scheme of a traffic monitor architecture based on OpenFlow[J]. Journal of Beijing University of Technology, 2016, 42(5):713-721.)
[5] AKYILDIZ I F, LEE A, WANG P, et al. Research challenges for traffic engineering in software defined networks[J]. IEEE Network, 2016, 30(3):52-58.
[6] 郭中孚,张兴明,赵博,等. 软件定义网络数据平面安全综述[J]. 网络与信息安全学报, 2018, 4(11):1-12. (GUO Z F, ZHANG X M, ZHAO B, et al. Survey of software-defined networking data plane security[J]. Chinese Journal of Network and Information Security, 2018, 4(11):1-12.)
[7] KIM K, AMINANTO M E. Deep learning in intrusion detection perspective:overview and further challenges[C]//Proceedings of the 2017 International Workshop on Big Data and Information Security. Piscataway:IEEE, 2017:5-10.
[8] HODO E, BELLEKENS X, HAMILTON A, et al. Shallow and deep networks intrusion detection system:a taxonomy and survey[EB/OL].[2019-02-12]. https://arxiv.org/ftp/arxiv/papers/1701/1701.02145.pdf.
[9] 王雪丽. 一种基于Elman改进的网络入侵检测算法[J]. 湖南文理学院学报(自然科学版), 2017, 29(4):31-33. (WANG X L. Research on network intrusion detection algorithm based on improved Elman[J]. Journal of Hunan University of Arts and Science (Science and Technology), 2017, 29(4):31-33.)
[10] TANG T A, MHAMDI L, MCLERNON D, et al. Deep learning approach for network intrusion detection in software defined networking[C]//Proceedings of the 2016 International Conference on Wireless Networks and Mobile Communications. Piscataway:IEEE, 2016:258-263.
[11] WANG P, CHAO K M, LIN H C, et al. An efficient flow control approach for SDN-based network threat detection and migration using support vector machine[C]//Proceedings of the IEEE 13th International Conference on e-Business Engineering. Piscataway:IEEE, 2016:56-63.
[12] AJAEIYA G A, ADALIAN N, ELHAJJ I H, et al. Flow-based intrusion detection system for SDN[C]//Proceedings of the 2017 IEEE Symposium on Computers and Communications. Piscataway:IEEE, 2017:787-793.
[13] 左青云,陈鸣,赵广松,等. 基于OpenFlow的SDN技术研究[J]. 软件学报, 2013, 24(5):1078-1097. (ZUO Q Y, CHEN M, ZHAO G S, et al. Research on OpenFlow-based SDN technologies[J]. Journal of Software, 2013, 24(5):1078-1097.)
[14] SCOTT-HAYWARD S, NATARAJAN S, SEZER S. A survey of security in software defined networks[J]. IEEE Communications Surveys and Tutorials, 2016, 18(1):623-654.
[15] SHU Z, WAN J, LI D, et al. Security in software-defined networking:Threats and countermeasures[J]. Mobile Networks and Applications, 2016, 21(5):764-776.

Design and implementation of intrusion detection model for software defined network architecture

面向软件定义网络架构的入侵检测模型设计与实现

PDF

Knowledge

Abstract

Cite this article

share this article

References

Related Articles 15

Recommended Articles

Metrics

[1]	WANG Hebing, ZHANG Chunmei. Facial landmark detection based on ResNeXt with asymmetric convolution and squeeze excitation [J]. Journal of Computer Applications, 2021, 41(9): 2741-2747.
[2]	ZHANG Shipeng, LI Yongzhong, DU Xiangtong. Intrusion detection model based on semi-supervised learning and three-way decision [J]. Journal of Computer Applications, 2021, 41(9): 2602-2608.
[3]	SONG Zhongshan, LIANG Jiarui, ZHENG Lu, LIU Zhenyu, TIE Jun. Remote sensing scene classification based on bidirectional gated scale feature fusion [J]. Journal of Computer Applications, 2021, 41(9): 2726-2735.
[4]	LI Kangkang, ZHANG Jing. Multi-layer encoding and decoding model for image captioning based on attention mechanism [J]. Journal of Computer Applications, 2021, 41(9): 2504-2509.
[5]	ZHANG Yongbin, CHANG Wenxin, SUN Lianshan, ZHANG Hang. Detection method of domains generated by dictionary-based domain generation algorithm [J]. Journal of Computer Applications, 2021, 41(9): 2609-2614.
[6]	ZHAO Hong, KONG Dongyi. Chinese description of image content based on fusion of image feature attention and adaptive attention [J]. Journal of Computer Applications, 2021, 41(9): 2496-2503.
[7]	XU Jianglang, LI Linyan, WAN Xinjun, HU Fuyuan. Indoor scene recognition method combined with object detection [J]. Journal of Computer Applications, 2021, 41(9): 2720-2725.
[8]	CAO Yuhong, XU Hai, LIU Sun'ao, WANG Zixiao, LI Hongliang. Review of deep learning-based medical image segmentation [J]. Journal of Computer Applications, 2021, 41(8): 2273-2287.
[9]	QIN Binbin, PENG Liangkang, LU Xiangming, QIAN Jiangbo. Research progress on driver distracted driving detection [J]. Journal of Computer Applications, 2021, 41(8): 2330-2337.
[10]	HUANG Chengcheng, DONG Xiaoxiao, LI Zhao. Deep pipeline 5×5 convolution method based on two-dimensional Winograd algorithm [J]. Journal of Computer Applications, 2021, 41(8): 2258-2264.
[11]	ZENG Xiangyin, ZHENG Bochuan, LIU Dan. Detection of left and right railway tracks based on deep convolutional neural network and clustering [J]. Journal of Computer Applications, 2021, 41(8): 2324-2329.
[12]	WU Guangli, LI Leiting, GUO Zhenzhou, WANG Chengxiang. Video summarization generation model based on improved bi-directional long short-term memory network [J]. Journal of Computer Applications, 2021, 41(7): 1908-1914.
[13]	YANG Su, OUYANG Zhi, DU Nisuo. Unsupervised parallel hash image retrieval based on correlation distance [J]. Journal of Computer Applications, 2021, 41(7): 1902-1907.
[14]	WANG Yue, JIANG Yiming, LAN Julong. Intrusion detection based on improved triplet network and K-nearest neighbor algorithm [J]. Journal of Computer Applications, 2021, 41(7): 1996-2002.
[15]	TAN Daoqiang, ZENG Cheng, QIAO Jinxia, ZHANG Jun. Shadow detection method based on hybrid attention model [J]. Journal of Computer Applications, 2021, 41(7): 2076-2081.