Method for detecting and defending DDoS attack in SDN environment

1. A method, installing an entropy-based pre-detection module at an entry of a port of a switch, and a proxy module on a controller, comprising:

acquiring, by the entropy-based pre-detection module, entropy values of a destination address of a package when the package flows in ports;

comparing the acquired entropy values of the destination address with a default threshold; and

when the entropy values of the destination address of no less than three ports are greater than the default threshold, rate-limiting the ports;

sending, by the switch, a request and a statistical message to the controller;

building, by the proxy module, data messages acquired as feature messages, and sending the feature messages to a classification and regression tree (CART) detection model of a server to obtain a detection result, wherein the data messages comprise a request, a statistical message, and data held by the controller;

making, by the server, a decision instruction based on the detection result;

performing, by the proxy module, actual control release operations based on the decision instruction, comprising:

dropping attacking packages when the obtained decision instruction is a host blocking;

blocking response attack ports when the obtained decision instruction is a port blocking; and

dropping all packages from a source host when the obtained decision instruction is a host isolation.

2. The method of claim 1 , wherein a method of building the CART detection model comprises:

building data sets based on the feature messages;

performing feature selection and training on the data sets to obtain feature subsets; and

iterating the feature subsets to obtain the CART detection model.

3. The method of claim 2 , wherein a method of building data sets based on the feature messages comprises:

generating a plurality of sample sets based on the feature messages;

marking each sample set, which is marked as 0 in case of no attack, marked as 1 in case of a distributed denial of service (DDoS) attack launched by IP address forgery, marked as 2 in case of synchronize sequence numbers (SYN) flooding, marked as 3 in case of user datagram protocol (UDP) flooding, and marked as 4 in case of internet control message protocol (ICMP) flooding; and

classifying a plurality of marked samples into training sample sets and test sample sets, and the data sets comprising the training sample sets and test sample sets.

4. The method of claim 2 , wherein a method of performing feature selection on the data sets comprises:

classifying the data sets by a classifier, and assigning weights to the obtained features;

taking and sorting absolute values of the weights of the obtained features; and

filtering the weights of the obtained features based on the sorted absolute values.

5. The method of claim 2 , wherein training on the data sets comprises:

taking a training set and a threshold of a Gini coefficient as an input;

selecting features,

calculating the Gini coefficient of the selected features according to types of the features, and

selecting a feature with a minimal Gini coefficient and its corresponding attributes as splitting criteria;

dividing the sample sets into sub-nodes,

performing a recursion process until the Gini coefficient is less than the threshold or there is no feature, and outputting a decision tree, where performing the recursion process is to select the features repeatedly; and

pruning the decision tree to generate the CART detection model.

6. The method of claim 1 , wherein the feature messages comprise an index component and a feature domain component;

the feature domain component comprises control information and combined features; and

the combined features comprise one or more of an average number of packages in each data flow, an average number of bytes in each data flow, an average duration in each data flow, a proportion of pair flows, a change rate of asymmetric flows, and a change rate of ports.