SDN self-protection system based on Renyi entropy

Abstract

Aiming at the abnormal behaviors in SDN architecture, a self-protection system based on Renyi entropy that implemented a set of detection, diagnosis and defense method of SDN abnormal behaviors was proposed. The system did not need to introduce the third-party measurement equipment, and directly used the flow table information of OpenFlow switches. Firstly, the abnormal network behavior was detected by calculating the characteristic entropy. Then, the information of the OpenFlow flow table was further analyzed to realize the diagnosis of abnormal behavior. Finally, a blacklist mechanism was established. And the system added the hosts with abnormal behavior to the blacklist and blocked the corresponding abnormal traffic. In order to verify the effectiveness of the system, a prototype was developed on the Floodlight controller. The simulation results on Mininet show that the system can effectively detect, diagnose and defend the abnormal behaviors. The system has low deployment cost, which enhances the security of SDN.

Keywords

• software defined network
• anomaly detection
• renyi entropy
• openflow protocol