分散式阻斷服務攻擊快速偵測兩段式架構之研究

A Study Of Rapidly Two-Stage DDoS Detection

王立安(Li-An Wang)

指導教授 ： 李維聰

淡江大學/工學院/電機工程學系碩士在職專班/碩士(2021年)

https://doi.org/10.6846/TKU.2021.00573

摘要

隨著IOT物聯網的發展，網路的普及化，及近期5G行動網路的快速發展，分散式阻斷服務攻擊(DDoS Attack)，在網路工業中更加猖獗，甚至更具破壞力，近期又因新冠肺炎的影響，人們更加依賴網路於購物，工作等，讓網路攻擊的防範更具重要性。
現行偵測分散式阻斷服務攻擊(DDoS Attack)的主流方式，是藉由機器學習和深度學習的方式來預測判斷網路流量是否為攻擊並加以防範，其判斷模組皆放置於SDN網路架構中的控制器中，因需透過安全連線與switch溝通，導致攻擊流進入時無法及時快速處理，因此本論文提出新的系統架構，新增一組新的輕量快速判斷模組於switch中，來即時的將大部分的攻擊流量先分流，後續再使用目前的主流判斷方法，做第二次較準確的分流。

關鍵字

分散式阻斷服務攻擊偵測 ； 網路安全 ； 機器學習

並列摘要

With the development of IOT, the popularization of the Internet, and the recent rapid development of 5G mobile networks, distributed denial-of-service attack (DDoS Attacks) have become more rampant and even more destructive in the Internet industry. Because of the impact of the COVID-19, people rely more on the Internet for shopping, work, etc., making the prevention of cyber attacks more important.
The current mainstream method of detecting distributed denial-of-service attack (DDoS Attacks) by machine learning and deep learning. The classification models are usually placed on controller which is the part of the SDN network.
The controller communicate with the switch through a secure connection necessarily, so that the attack flow cannot be diverted in a timely manner when it enters. Therefore, this paper proposes a new system architecture adding a new set of lightweight and fast classification model to the switch. In this case, we will immediately divert most of the attack traffic first, and then use the current mainstream classification method to do a second, more accurate diversion.

並列關鍵字

DDoS Detection ； Machine Learning ； Switch ； Cyber Security ； internet security

參考文獻

[1] S. Sezer et al., "Are we ready for SDN? Implementation challenges for software-defined networks," in IEEE Communications Magazine, vol. 51, no. 7, pp. 36-43, July 2013.

[2] R. Braga, E. Mota and A. Passito, "Lightweight DDoS flooding attack detection using NOX/OpenFlow," IEEE Local Computer Network Conference, 2010, pp. 408-415.

[3] Scikit-learn: Machine Learning in Python, Pedregosa et al., JMLR 12, pp. 2825-2830, 2011.

[4] CSE-CIC-IDS2018-AWS, (N.d.). Retrieved from https://registry.opendata.aws/cse-cic-ids2018/

[5] Sharafaldin, I., Lashkari, A.H., & Ghorbani, A. (2018). Toward Generating a New Intrusion Detection Dataset and Intrusion Traffic Characterization. ICISSP.