【摘要】 近两年分布式拒绝服务攻击（Distributed Denial of Service,DDoS）以平均26%的速率增长，是网络安全的严重威胁之一。论文提出一种适用于软件定义网络（software-define-network,SDN）的DDoS实时入侵检测与即时防御方法RT-XB(Real-Time XGBoost-Bloom Filter)。该方法首先在SDN数据平面使用P4编程，以自定义的方式进行数据包收集；然后对其提取攻击特征向量并做必要的优化处理；再后使用极限梯度增强（extreme gradient boosting,XGBoost）算法构建分类器识别异常数据包，并由此确定攻击源；最后在数据平面构建攻击数据包特征的BF(Bloom Filter)实现对后续攻击数据包的快速识别，并通过修改流表匹配动作的方式做出即时防御。实验结果显示，与现有同类方法相比，RT-XB充分整合了SDN和机器学习的优点，不仅实时检测效率高，假阳性率可控，而且即时防御功能较强。更多还原

【Abstract】 In the past two years,Distributed Denial of Service(DDoS)has grown at an average rate of 26%,which is one of the serious threats to network security. This paper proposes a DDoS real-time intrusion detection and real-time defense method RT-XB(Real-Time XGBoost-Bloom Filter)in software-defined-network(SDN). This method first uses P4 programming in the SDN data plane to collect data packets in a custom manner,then extracts attack feature vectors and performs necessary optimization processing. Then it uses extreme gradient boosting(XGBoost)algorithm to construct a classifier to identify abnormal data packets,and thus determines the source of the attack. Finally,a BF(Bloom Filter)with the characteristics of attack data packets is constructed on the data plane to realize rapid identification of subsequent attack data packets,and immediate defense is made by modifying the flow table matching action. The experimental results show that compared with the existing DDoS detection methods,the proposed method in this paper fully integrates the advantages of SDN and machine learning,which not only has high real-time detection efficiency and controllable false positive rate,but also has a strong real-time defense.更多还原