基於SDN架構下利用動態分散服務方法阻擋藉由殭屍網路之阻斷服務攻擊

SDN-based Architecture for Dynamical Distribute Service in Blocking Botnet DDOS

楊順程(Shun-Cheng Yang)

指導教授 ： 賴槿峰

國立中正大學/工學院/資訊工程學系/碩士(2016年)

摘要

近年來，網路服務快速發展，生活中的各項服務大多數都可以透過網路來進行。舉凡購物，交通，資訊傳遞，繳費等等，網路幾乎可以涵蓋到我們生活周遭的各個角落，而伴隨著網路的便利性，資訊安全一直以來也是網路服務的重大課題。在提供網路服務的同時，如何避免服務遭到惡意破壞，甚至是洩漏使用者資料的情況，一旦資訊安全出現了漏洞，使用者以及服務提供者都將可能蒙受重大損失。
　　分散式阻斷服務攻擊(DDOS)，是利用控制相當數量的殭屍網路，這些看似合法殭屍網路同時連線到伺服器，使伺服器不堪負荷並且達到癱瘓服務的目的。DDOS攻擊的連線行為往往與一般使用者的合法連線行為沒有顯著的差異，各類的防堵措施經常容易使無辜的合法使用者也受到牽連，使的有效防預DDOS攻擊造成困難。
　　本研究的目標是希望藉由SDN監控整體網路拓樸的特性，希望能讓攻擊行動尚未造成重大損失之前，由SDN controller主動做應變，將封包導向至多台伺服器，替服務爭取更大的負載量，讓其他針對DDoS攻擊的應變措施可以有更充裕的時間進行應對，減緩DDoS攻擊對服務造成的損失。

關鍵字

負載平衡 ； 軟體定義網路 ； 分散式阻斷服務攻擊

並列摘要

In recent years, Network services grows rapidly. Many requirements in our life could be done via network services, including shopping, traffic, communication, repayment, etc. Network service covering many area in our life, and along with the convenience of the Internet, Network Security has become one of the main topic in network service. In providing network service, how to avoid service vandalism, and even user data leakage? Any network security vulnerabilities of system could let users and service providers suffer significant losses.
Distributed denial-of-service (DDoS) attacks is an attempt to make a machine or network resource unavailable to its intended users by many attack sources. The similarities of DDoS malicious packets and legitimate user cause DDoS is hard to detect. Many measures to filter malicious source often involve innocent normal users.
Our research was to utilize SDN overall network topology monitoring that expecting SDN controller strains when DDoS occurs, forwarding packets to many backup servers in emergency condition before DDoS caused more damage. Decrease the loss of service caused by DDoS

並列關鍵字

NAT ； Load Balancing ； DDoS ； SDN

參考文獻

[1] Nick McKeown. (2008). OpenFlow: Enabling Innovation in Campus Networks. ACM SIGCOMM Computer Communication Review archive

Volume 38 Issue 2, April 2008.

[2] ONF. (2009). OpenFlow Switch Specification 1.0.0.

[3] Velagapudi Sreenivas(2014). Load balancing techniques: Major challenge in Cloud Computing-a systematic review. Electronics and Communication Systems (ICECS), 2014 International Conference on.

Computing. IJCSI, Vol. 9, Issue 1, January 2012.