Distributed denial of service attack detection method based on software defined Internet of things

doi:10.11772/j.issn.1001-9081.2019091611

Journal of Computer Applications ›› 2020, Vol. 40 ›› Issue (3): 753-759.DOI: 10.11772/j.issn.1001-9081.2019091611

• Cyber security • Previous Articles Next Articles

Distributed denial of service attack detection method based on software defined Internet of things

LIU Xiangju, LIU Pengcheng, XU Hui, ZHU Xiaojuan

College of Computer Science and Engineering, Anhui University of Science and Technology, Huainan Anhui 232001, China

Received:2019-09-23 Revised:2019-10-22 Online:2020-03-10 Published:2017-07-20
Supported by:
This work is partially supported by the National Natural Science Foundation of China (51504010, 61404001), the Key Natural Science Research Project of Anhui Provincial Universities (KJ2014ZD12), the Huainan Science and Technology Project (2013A4011).

基于软件定义物联网的分布式拒绝服务攻击检测方法

刘向举, 刘鹏程, 徐辉, 朱晓娟

安徽理工大学计算机科学与工程学院, 安徽淮南 232001

通讯作者: 刘鹏程
作者简介:刘向举(1978-),男,黑龙江双城人,副教授,硕士,主要研究方向:物联网、智能控制;刘鹏程(1995-),男,安徽阜阳人,硕士研究生,主要研究方向:物联网、软件定义网络;徐辉(1979-),男,安徽淮南人,副教授,博士,主要研究方向:嵌入式系统综合与测试、高可靠性集成电路设计与容错;朱晓娟(1978-),女,安徽淮南人,副教授,博士,主要研究方向:无线传感器网络。
基金资助:
国家自然科学基金资助项目（51504010，61404001）；安徽省高校省级自然科学研究重大项目（KJ2014ZD12）；淮南市科技计划项目（2013A4011）。

Abstract

Abstract: Due to the large number, wide distribution and complex environments of Internet of Things (IoT) devices, IoT is more vulnerable to DDoS (Distributed Denial of Service) attacks than traditional networks. Concerning this problem, a Distributed Denial of Service (DDoS) attack detection method based on Equal Length of Value Range K-means (ELVR-Kmeans) algorithm in Software Defined IoT (SD-IoT) architecture was proposed. Firstly, the centralized control characteristic of the SD-IoT controller was used to extract the flow tables of the OpenFlow switch to analyze the DDoS attack traffic characteristics in SD-IoT environment and extract the seven-tuple features related to the DDoS attack traffic. Secondly, the obtained flow tables were classified by the ELVR-Kmeans algorithm to detect whether a DDoS attack had occurred. Finally, the simulation experiment environment was built to test the detection rate, accuracy and error rate of the method. The simulation results show that the proposed method can effectively detect DDoS attacks in SD-IoT environment with detection rate and accuracy of 96.43% and 98.71% respectively, and error rate of 1.29%.

Key words: Software Defined Internet of Things (SD-IoT), Distributed Denial of Service (DDoS) attack, Equal Length of Value Range K-means (ELVR-Kmeans) algorithm, seven-tuple feature, attack detection

摘要： 由于物联网（IoT）设备众多、分布广泛且所处环境复杂，相较于传统网络更容易遭受分布式拒绝服务（DDoS）攻击，针对这一问题提出了一种在软件定义物联网（SD-IoT）架构下基于均分取值区间长度-K均值（ELVR-Kmeans）算法的DDoS攻击检测方法。首先，利用SD-IoT控制器的集中控制特性通过获取OpenFlow交换机的流表，分析SD-IoT环境下DDoS攻击流量的特性，提取出与DDoS攻击相关的七元组特征；然后，使用ELVR-Kmeans算法对所获取的流表进行分类，以检测是否有DDoS攻击发生；最后，搭建仿真实验环境，对该方法的检测率、准确率和错误率进行测试。实验结果表明，该方法能够较好地检测SD-IoT环境中的DDoS攻击，检测率和准确率分别达到96.43%和98.71%，错误率为1.29%。

关键词: 软件定义物联网, 分布式拒绝服务攻击, 均分取值区间长度-K均值算法, 七元组特征, 攻击检测

CLC Number:

TP393.08

LIU Xiangju, LIU Pengcheng, XU Hui, ZHU Xiaojuan. Distributed denial of service attack detection method based on software defined Internet of things[J]. Journal of Computer Applications, 2020, 40(3): 753-759.

刘向举, 刘鹏程, 徐辉, 朱晓娟. 基于软件定义物联网的分布式拒绝服务攻击检测方法[J]. 计算机应用, 2020, 40(3): 753-759.

References

[1] MA H,LIU L,ZHOU A,et al. On networking of Internet of things:explorations and challenges[J]. IEEE Internet of Things Journal,2016,3(4):441-452.
[2] NEUMANN P G. Risks of automation:a cautionary total-system perspective of our cyber future[J]. Communications of the ACM, 2016,59(10):26-30.
[3] LIU X,ZHAO S,LIU A,et al. Knowledge-aware proactive nodes selection approach for energy management in Internet of things[J]. Future Generation Computer Systems,2019,92:1142-1156.
[4] LIU Y,LIU A,GUO S,et al. Context-aware collect data with energy efficient in cyber-physical cloud systems[J/OL]. Future Generation Computer Systems,[2019-06-04]. https://doi.org/10.1016/j.future.2017.05.029.
[5] LINDQVIST U,NEUMANN P G. The future of the Internet of Things[J]. Communications of the ACM,2017,60(2):26-30.
[6] SONAR K,UPADHYAY H. A survey:DDoS attack on Internet of Things[J]. International Journal of Engineering Research and Development,2014,10(11):58-63.
[7] BERTINO E,ISLAM N. Botnets and Internet of things security[J]. Computer,2017,50(2):76-79.
[8] 张朝昆, 崔勇, 唐翯祎, 等. 软件定义网络(SDN)研究进展[J]. 软件学报, 2015,26(1):62-81.(ZHANG C K,CUI Y,TANG H Y, et al. State-of-the-art survey on Software-Defined Networking (SDN)[J]. Journal of Software,2015,26(1):62-81.)
[9] GALLUCCIO L,MILARDO S,MORABITO G,et al. SDN-WISE:design,prototyping and experimentation of a stateful SDN solution for wireless sensor networks[C]//Proceedings of the 2015 IEEE Conference on Computer Communications. Piscataway:IEEE, 2015:513-521.
[10] ANADIOTIS A C,GALLUCCIO L,MILARDO S,et al. SDWISE:a software-defined wireless sensor network[J]. Computer Networks,2019,159:84-95.
[11] 胡向东, 贾子漠. 一种面向物联网的轻量级入侵检测方法[J]. 重庆邮电大学学报(自然科学版),2015,27(2):255-259. (HU X D, JIA Z M. A method of lightweight intrusion detection for the Internet of things[J]. Journal of Chongqing University of Posts and Telecommunications(Natural Science Edition),2015, 27(2):255-259.)
[12] LIU Y,KUANG Y,XIAO Y,et al. SDN-based data transfer security for Internet of things[J]. IEEE Internet of Things Journal, 2018,5(1):257-268.
[13] YIN D,ZHANG L,YANG K. A DDoS attack detection and mitigation with software-defined Internet of things framework[J]. Special Section on Security and Trusted Computing for Industrial Internet of Things,2018,6:24694-24705.
[14] 姬生生. 基于SDN的无线传感器网络流量异常检测机制研究[D]. 开封:河南大学,2015:21-39. (JI S S. The research of wireless sensor network traffic anomaly detection mechanism based on SDN[D]. Kaifeng:Henan University,2015:21-39.)
[15] 肖甫, 马俊青, 黄洵松, 等. SDN环境下基于KNN的DDoS攻击检测方法[J]. 南京邮电大学学报(自然科学版),2015,35(1):84-88.(XIAO F,MA J Q,HUANG X S,et al. DDoS attack detection based on KNN in software defined networks[J]. Journal of Nanjing University of Posts and Telecommunications(Natural Science Edition),2015,35(1):84-88.)
[16] 张雨龙, 叶进. SDN网络中基于流特征值的DDoS攻击检测方法[J]. 广西大学学报(自然科学版),2017,42(6):2208-2213. (ZHANG Y L,YE J. Research on DDoS attack detection and judgment based on stream eigenvalues of software defined networks[J]. Journal of Guangxi University(Natural Science Edition), 2017,42(6):2208-2213.)
[17] 陈超, 曹晓梅. SDN场景中基于双向流量特征的DDoS攻击检测方法[J]. 计算机应用研究,2019,36(7):2148-2153. (CHEN C,CAO X M. Distributed denial of service attack detection based on bidirectional traffic feature in software defined network[J]. Application Research of Computers,2019,36(7):2148-2153.)
[18] 华辉有, 陈启买, 刘海, 等. 一种融合Kmeans和KNN的网络入侵检测算法[J]. 计算机科学,2016,43(3):158-162.(HUA H Y,CHEN Q M,LIU H,et al. Hybrid Kmeans with KNN for network intrusion detection algorithm[J]. Computer Science,2016, 43(3):158-162.)
[19] 马乐乐, 束永安. SDN环境下基于机器学习算法的DDoS攻击检测模型[J]. 微电子学与计算机,2018,35(5):15-20. (MA L L,SHU Y A. A DDoS attack detection model based on machine learning algorithm in SDN environment[J]. Microelectronics and Computer,2018,35(5):15-20.)
[20] 张玉清, 周威, 彭安妮. 物联网安全综述[J]. 计算机研究与发展,2017,54(10):2130-2143. (ZHANG Y Q,ZHOU W,PENG A N. Survey of Internet of things security[J]. Journal of Computer Research and Development,2017,54(10):2130-2143.)
[21] 杜永文, 王章闵, 胡晓辉, 等. 软件定义无线传感器网络研究综述[J]. 计算机工程与应用,2019,55(1):1-8.(DU Y W, WANG Z M,HU X H,et al. A survey on software-defined wireless sensor network[J]. Computer Engineering and Applications, 2019,55(1):1-8.)
[22] 王丽娜, 王斐, 刘维杰. 面向SDN的安全威胁及其对抗技术研究[J]. 武汉大学学报(理学版),2019,65(2):153-164. (WANG L N,WANG F,LIU W J. Researches on security threats and countermeasures of SDN[J]. Journal of Wuhan University (Natural Science Edition),2019,65(2):153-164.)

Distributed denial of service attack detection method based on software defined Internet of things

基于软件定义物联网的分布式拒绝服务攻击检测方法

PDF

Knowledge

Abstract

Cite this article

share this article

References

Related Articles 12

Recommended Articles

Metrics

[1]	WU Ruohao, DONG Ping, ZHENG Tao. Malicious scanning protection technology based on OpenDayLight [J]. Journal of Computer Applications, 2018, 38(1): 188-193.
[2]	CHEN Hong, WAN Guangxue, XIAO Zhenjiu. Intrusion detection method of deep belief network model based on optimization of data processing [J]. Journal of Computer Applications, 2017, 37(6): 1636-1643.
[3]	MA Linjin, WAN Liang, MA Shaoju, YANG Ting, YI Huifan. Distributed denial of service attack recognition based on bag of words model [J]. Journal of Computer Applications, 2017, 37(6): 1644-1649.
[4]	HAN Dezhi, CHEN Xuguang, LEI Yuxin, DAI Yongtao, ZHANG Xiao. Real-time data analysis system based on Spark Streaming and its application [J]. Journal of Computer Applications, 2017, 37(5): 1263-1269.
[5]	SHEN Xueli, SHEN Jie. Optimization method of tracing distributed denial of service attacks based on autonomous system and dynamic probabilistic packet-marking [J]. Journal of Computer Applications, 2015, 35(6): 1705-1709.
[6]	LIU Qing-lin MENG Ke LI Su-feng. Attack detection method based on statistical process control in collaborative recommender system [J]. Journal of Computer Applications, 2012, 32(03): 707-709.
[7]	Yan GAO WANG Taihua GUO Fan YU Min. DDoS detection with non-iterative Apriori algorithm [J]. Journal of Computer Applications, 2011, 31(06): 1521-1524.
[8]	. CDPM: An Improved Packet Marking tracking Scheme [J]. Journal of Computer Applications, 2009, 29(12): 3185-3187.
[9]	Yang Su . Detecting worms based on candidate combination frequent pattern in Internet backbones [J]. Journal of Computer Applications, 2009, 29(1): 178-180.
[10]	. Improved route packet marking tracking scheme [J]. Journal of Computer Applications, 2009, 29(05): 1316-1320.
[11]	. DDoS attack detection based on global network properties of network traffic anomaly [J]. Journal of Computer Applications, 2007, 27(2): 314-317.
[12]	WANG Sheng,SUN Le-chang,GAN Guo-zheng. Application research based on Granger causality test for attack detection [J]. Journal of Computer Applications, 2005, 25(06): 1282-1285.