SDN中IP欺骗数据分组网络溯源方法研究

doi:10.11959/j.issn.1000-436x.2018243

Abstract

Abstract:

IP packets back tracing is to find the source host hop by hop from the destination.The method found the forwarding path of target packets and source host by adding probe entry into flow tables on SDN switches and analyzing the effective back tracing Packet-in messages sent by related switches.The proposed scheme can provide convenience for debugging network problems ,so that the network administrator can obtain the forwarding paths of any data packets.Furthermore,it can help to solve the problem of IP spoofing.Experimental results prove that the traceability method can find the forwarding paths of target packets in a timely and accurate manner without affecting other traffic or significant system overhead.

Key words: SDN, IP address spoofing, IP trace back, flow table probe entry

CLC Number:

TP393

Songjie WEI,Xin SUN,Rudong ZHAO,Chao WU. Tracing IP-spoofed packets in software defined network[J]. Journal on Communications, 2018, 39(11): 181-189.

Figures/Tables 18

References 16

[1]	METI N , NARAYAN D G , BALIGAR V P . Detection of distributed denial of service attacks using machine learning algorithms in software defined networks[C]// International Conference on Advances in Computing,Communications and Informatics (ICACCI). 2017: 1366-1371.
[2]	阎冬 . IP网络溯源方法及协作模式相关技术研究[D]. 北京:北京邮电大学, 2012.
	YAN D . Research on IP traceback techniques and collaboration pat terns[D]. Beijing:Beijing University of Posts and Telecommunications, 2012.
[3]	FEAMSTER N , REXFORD J , ZEGURA E . The road to SDN:an intellectual history of programmable networks[J]. Acm Sigcomm Computer Communication Review, 2014,44(2): 87-98.
[4]	SIEBER C , OBERMAIR A , KELLERER W . Online learning and adaptation of network hypervisor performance models[C]// IFIP/IEEE Symposium on Integrated Network and Service Management (IM). 2017: 1204-1212.
[5]	王涛, 陈鸿昶, 程国振 . 软件定义网络及安全防御技术研究[J]. 通信学报, 2017,38(11): 133-160.
	WANG T , CHEN H C , CHENG G Z . Research on software-defined network and the security defense technology[J]. Journal on Communications, 2017,38(11): 133-160.
[6]	PATEL B , MENARIA S . Survey of traceback methods[J]. Journal of Engineering Computers ＆ Applied Sciences, 2015,4(1): 22-26.
[7]	黄琼, 熊文柱, 阳小龙 ,等. 分层次的无状态单分组IP溯源技术[J]. 通信学报, 2011,32(3): 150-157.
	HUANG Q , XIONG W Z , YANG X L ,et al. Hierarchical stateless sin-gle-packet IP traceback technique[J]. Journal on Communications, 2011,32(3): 150-157.
[8]	YAN D , WANG Y , SU S ,et al. A precise and practical IP traceback technique based on packet marking and logging[J]. Journal of In-formation Science ＆ Engineering, 2012,28(3): 453-470.
[9]	FOROUSHANI V A , ZINCIR-HEYWOOD A N . Deterministic and authenticated flow marking for IP traceback[J]. 2013 IEEE 27th International Conference on Advanced Information Networking and Applications (AINA), 2013,30(1): 397-404.
[10]	FRANCOIS J , FESTOR O . Anomaly traceback using software defined networking[C]// IEEE International Workshop on Information Forensics and Security. IEEE, 2014.
[11]	夏彬 . 基于软件定义网络的 WLAN 中 DDoS 攻击检测和防护[D]. 上海:上海交通大学, 2015.
	XIA B . Research on the detection and defence of DDoS attack in SDN-based WLAN[D]. Shanghai:Shanghai Jiaotong University, 2015.
[12]	CUI Y , YAN L , LI S ,et al. SD-Anti-DDoS:Fast and efficient DDoS defense in software-defined networks[J]. Journal of Network and Computer Applications, 2016,68: 65-79.
[13]	AGARWAL K , ROZNER E , DIXON C ,et al. SDN traceroute:tracing SDN forwarding without changing network behavior[C]// The Workshop on Hot Topics in Software Defined NETWORKING. 2014: 145-150.
[14]	TAMMANA P , AGARWAL R , LEE M . CherryPick:tracing packet trajectory in software-defined datacenter networks[C]// ACM SIGCOMM Symposium on Software Defined NETWORKING Research. 2015: 1-7.
[15]	NARAYANA S , REXFORD J , WALKER D . Compiling path queries in soft-ware-defined networks[C]// The Workshop on Hot Topics in Software Defined NETWORKING.. 2014: 181-186.
[16]	NICK M K , ANDERSON T , BALAKRISHNAN H ,et al. OpenFlow:enabling innovation in campus networks[J]. Acm Sigcomm Computer Communication Review, 2008,38(2): 69-74.

Metrics

Recommended 0

No Suggested Reading articles found!

性能	传统溯源			SDN溯源
性能	链路测试法	数据分组标记法	日志记录法	Renyi熵方法	CherryPick方法	本文溯源方法
溯源速度	较慢	较快	较慢	一般	较快	快
路由开销	高	高	很高	低	低	低
网络开销	中	低	中	低	低	低
溯源受限	限追溯单个流	对路由器性能要求高	受限于存储空间	受限于窗口大小和阈值	受限于数据分组头部字段长度	特征集需人为提取

数据分组字段	h1	h3	h5
源IP地址	10.0.1.3	10.0.1.3	10.0.2.5
目的IP地址	10.0.3.7	10.0.3.7	10.0.3.7
IP协议类型	UDP	UDP	UDP
源端口号	6000	6500	7000
目的端口号	80	80	80

特征集元素	第一组	第二组
以太网协议类型	2048	2048
源IP地址	10.0.1.3	10.0.1.3
目的IP地址	10.0.3.7	10.0.3.7
IP协议类型	17(UDP)	17(UDP)
源端口号	—	6000
目的端口号	80	80

事件	概率	意义
P(h7)	100%	溯源起点
P(s7\|h7)	100%	溯源第一台交换机
P(s4\|s7)	69%	第一、二条路径
P(s5\|s4)	84%	第一条路径
P(s2\|s5)	77%	第一条路径
P(h2\|s5)	23%	溯源终点h2
P(s1\|s2)	100%	第一、二条路径
P(h1\|s1)	100%	溯源终点h1
P(s3\|s4)	16%	第二条路径
P(s2\|s3)	100%	第二条路径
P(s1\|s2)	100%	第二条路径
P(h1\|s1)	100%	溯源终点h1
P(s8\|s7)	31%	第三条路径
P(h6\|s8)	100%	第三条路径
P(s1\|s6)	74%	第三条路径
P(h5\|s6)	26%	溯源终点h5
P(h1\|s1)	100%	溯源终点h1

速率/(packet·s^-1)	溯源准确性
2	49.1%
20	70.4%
100	91.2%
500	98.6%

Tracing IP-spoofed packets in software defined network

RichHTML

PDF

Knowledge

Abstract

Cite this article

share this article

Figures/Tables 18

References 16

Related Articles 15

Metrics

Recommended 0

[1]	Zhiyong LUO, Yu ZHANG, Qing WANG, Weiwei SONG. Study of SDN intrusion intent identification algorithm based on Bayesian attack graph [J]. Journal on Communications, 2023, 44(4): 216-225.
[2]	Jianzhong SU, Huayu ZHANG, Hailong ZHU. Computing method for periodic stream reservation in TSN combined with SDN controller [J]. Journal on Communications, 2021, 42(10): 23-31.
[3]	Yaomin WANG,Xia WANG,Yi DONG,Songhai ZHANG,Xinling SHI. Data center traffic scheduling strategy based on Fibonacci tree optimization algorithm [J]. Journal on Communications, 2020, 41(6): 112-127.
[4]	Zhenzhen HAN,Guofeng ZHAO,Chuan XU,Wentao ZHOU,Yangyang ZHOU. Dynamic SDN controller placement based on latency in LEO satellite network [J]. Journal on Communications, 2020, 41(3): 126-135.
[5]	Wenlong KE,Yong WANG,Miao YE,Junqi CHEN. Priority differentiated multicast flow scheduling method in Ceph cloud storage network [J]. Journal on Communications, 2020, 41(11): 40-51.
[6]	Hongyan QIAN,Hao XUE,Ming CHEN. UDM:NFV-based prevention mechanism against DDoS attack on SDN controller [J]. Journal on Communications, 2019, 40(3): 116-124.
[7]	Hui ZHAO, Liangmin WANG. Hybrid anonymous channel for recipient untraceability via SDN-based node obfuscation scheme [J]. Journal on Communications, 2019, 40(10): 55-66.
[8]	Tong DUAN,Julong LAN,Yuxiang HU,Hongwei FAN. Orchestration mechanism for VNF hardware acceleration resources in SDN/NFV architecture [J]. Journal on Communications, 2018, 39(6): 98-108.
[9]	Zhi-yuan ZHAO,Xiang-ru MENG,Yu-ze SU,Zhen-tao LI. Virtual SDN embedding with differentiated QoS under multiple controller [J]. Journal on Communications, 2017, 38(8): 101-110.
[10]	Zhi SUN,Ming CHEN. PriQoS:priority-differentiated flow control mechanism based on SDN [J]. Journal on Communications, 2017, 38(2): 115-124.
[11]	Tao WANG,Hong-chang CHEN,Guo-zhen CHENG. Research on software-defined network and the security defense technology [J]. Journal on Communications, 2017, 38(11): 133-160.
[12]	Jian WANG,Guo-sheng ZHAO,Zhi-xin LI. Research on mapping algorithm of virtual network oriented to SDN [J]. Journal on Communications, 2017, 38(10): 26-35.
[13]	Zhi-geng HAN,Xia FENG,Geng CHEN. SDN based e-mail repudiation source restraining method [J]. Journal on Communications, 2016, 37(9): 55-67.
[14]	Jun-fei LI,Ju-long LAN,Yu-xiang HU,Jiang-xing WU. Quantitative approach of multi-controller’s consensus in SDN [J]. Journal on Communications, 2016, 37(6): 86-93.
[15]	Zhe WANG,Man-gui LIANG,Xiao-meng JI,MateusAbisai Fillipus. Source-controlled OpenFlow data plane [J]. Journal on Communications, 2015, 36(3): 195-201.