SDN based DDoS attack mitigation

Project brief introduction

In a given experimental network environment , Use the attack host to launch a simulated traffic flooding attack on the target , utilize SDN The controller completes the flow table distribution and flow control , To intercept and defend against flooding attacks

Basic knowledge of flood attack

Flood introduction

Flooding is when an attacker sends a large amount of data traffic , By flooding , Make the attacker's resources exhausted , Unable to provide services for normal users .

Attack principle

In the network, two computers establish TCP Three handshakes are required for connection , The client first sends a shutdown message to the server TCP SYN Data packets , Then the server will send the corresponding message to the client SYN ACK Data packets , Finally, the client will ACK To respond . To establish a normal handshake process . In the specific connection details , The server is the first to receive SYN Packet time , stay TCP In the protocol stack, the corresponding half The connection record is added to the queue , Then wait to accept the packet ready for handshake below , If the handshake is successful , Then the semi connected record will be deleted from the queue . Or when the server does not receive the confirmation package from the client , Will be heavy Send request package , This entry was not deleted from the connection queue until the timeout . however , On the server TCP The semi connection records stored in the protocol stack are limited , When the server receives SYN Type DOS After the attack , The queue will soon be full , The client forges a large number of nonexistent IP Address , Send... To the server constantly SYN package , Server reply confirmation package , And wait for the customer's confirmation , Because the source address does not exist , The server needs to be retransmitted until the timeout , These fake SYN Package will take a long time to use the unconnected queue , natural SYN The request is discarded , The target system runs slowly, and serious cases cause network congestion and even system paralysis , The server then no longer accepts new network connections , Thus, the normal client cannot access the server .

harm

SYN In addition to the attack can affect the host , It can also harm routers , Firewall and other network systems , in fact SYN Attacks don't matter what system the target is , As long as these systems are on TCP Services can be implemented .

DoS The way to prevent attacks

1. syn cookie
2. Prohibition IP
3. Filter suspicious IP Direct address
4. Reduce the timeout value
5. Increase the queue SYN The maximum number of semi connections

About flooding attacks , Everything you need to know

mininet Basic knowledge （ Common commands and examples ）

Mininet brief introduction

Mininet Stanford University is based on Linux Container Architecture development of a process virtualization network simulation tool , You can create a containing host , Switch , Virtual network of controllers and links , Its switch supports OpenFlow, Highly flexible custom software defined network .

Mininet use

• by OpenFlow The application provides a simple , Cheap network test platform ;
• Enable complex topology tests , No need to connect to the physical network ;
• Have topology awareness and OpenFlow Perceptual CLI, Used to debug or run network wide tests ;
• Support any custom topology , The number of hosts can reach 4096, And includes a basic set of parameterized topologies ;
• Provide expandable for user network creation and experiment Python API.

Mininet command

Mininet The command is divided into network construction startup parameters 、 Internal interactive commands 、 Three parts of external operating parameters .

1. Network build startup parameters ：–topo,–custom,–switch,–controller,–mac wait .
2. Internal interactive commands ：dump,net,nodes,links,dpctl,iperf wait .
3. External operating parameters ：-c( Clear configuration information ),-h( help ) etc. .

mn Introduction to network construction parameters

–topo： Define Topology

minimal Minimize Topology ( A switch , Two hosts )

sudo mn --protocol=openflow13

single Single topology （ There is only one switch in the whole network topology , It can be attached to one or more hosts ）

sudo mn --topo=single,5

liner Linear topology （ The switches are in a linear arrangement , There are multiple switches , And the number of hosts attached to each switch is the same ）

sudo mn --topo=linear,3
sudo mn --topo=linear,3,2

tree Tree topology （ The connections of the switches are arranged in a tree , And each switch can be connected to multiple switches , Multiple hosts ）

sudo mn --topo=tree,3,2
sudo mn --topo=tree,depth3=,fanout=2【 Three layers , The first layer is a switch , The second floor 2 A switch , The third level 4 Exchange , host ：4 x 2 = 8】
depth Indicates how many layers the switch has ,fanout Indicates that all switches are parent nodes , How many subtrees are there .

reversed Reverse Topology （ This topology type is similar to single The single topology type is the same ）

sudo mn --topo=reversed,4

–switch： Definition mininet Switch to use

Switch classification 3 class ： User type 、 Kernel and OVS type , Kernel and OVS The throughput of type A is much larger than that of the user , Therefore, the latter two are generally used . It can test the TCP bandwidth( difference UDP bandwidth):

The main parameters are as follows ：
a. lxbr： Kernel switch .
b. user： Subscriber switch .
c. ovsk：OpenVSwitch Switch , This value is used by default .
d. ovsbr：OpenVSwitch Switch .
e. ivs：OpenVSwitch Switch .

sudo mn --test iperf
sudo mn --switch user --test iperf
sudo mn --switch ovsk --test iperf

–controller： Define the controller to use

Use... If not specified mininet The default controller in .

sudo mn --controller=remote,--ip=[controller ip],--port=[port]
// Do not specify topology -- By default, two hosts are attached to one switch 　　
//--controller=remote   Yes, it will mininet The controller of points to the remote controller   Not specified ip, Default 0.0.0.0 Or local IP  By default, the port is in 6635

–mac： Automatically configure the device MAC Address

Give Way MAC The address is easy to read , That is, set the of the switch MAC, host MAC And IP Sort addresses from small to large , And the setting is simple and unique , Not only does it make the machine easy to access , It is also easy for the naked eye to recognize its ID. How to use it is as follows ：

sudo mn --topo=tree,depth=2,fanout=2,--mac

-x(XTerm)

By using -x Parameters ,mn After startup, an... Will be automatically opened on each node XTerm, It is convenient to operate multiple nodes separately in some cases . The order is

sudo mn -x

When entering mn cli after , You can also use node xterm The command specifies to start... On some nodes xterm

h1 xterm

Introduction and use of internal interactive commands

Use mn After the network is created by default , You can use a series of commands to view and verify the link robustness of the network system .
（1）iperf： Between two nodes iperftcp Bandwidth test .

iperf h1 h2

（2）iperfudp： Between two nodes iperfudp Bandwidth test .

iperfudp bw h1 h2

（3）link： Disable or start inter node links .

link s1 s2 up
link s1 s2 down

（4）dpctl： Add, delete and change the flow lookup table on all switches .

dpctl dump-flows

（5）xterm： Node on xterm Enter the visual operation interface .

xterm h1

（6）py： perform python expression .

py help(s1)
py dir(s1)
py net.addSwitch("h3")
py net.addLink(s1,net.get("h3"))
py s1.attach("s1-eth3")
py net.get("h3").cmd("ifconfig h3-eth0 10.3")
pingall

（6）sh： perform ovs The instructions of the system

sh ovs-vsctl show

Summary of common commands

help： All command documents are listed by default , Adding the command name will introduce the command usage dump Print node information
gterm： On a given node gnome-terminal. notes ： May lead to mn collapse xterm On a given node xterm
intfs： List all network interfaces
iperf： A simple... Between two nodes iperf TCP test
iperfudp： Set bandwidth between two nodes udp To test
net： Show network link status
noecho： Run the interactive window , Close response （echoing）
pingpair： Between the first two hosts ping test
source： Read commands from external files
dpctl： Use... On all switches dptcl Execute relevant orders , Local tcp 127.0.0.1:6634
dump： View node information .
link： Disable or enable the link between two nodes
links ： Check whether the link is working properly .
nodes： List all node information
pingall： all host Nodes interact with each other ping
py： perform python expression
sh： Run the external shell command
quit/exit： sign out

Other operating

（1） perform sudo mn -c Clean up the configuration , Suitable for recovery after failure .
（2） perform exit Will quit Mininet Of cli, At the same time, the running time statistics .
（3）py cmd Use python To execute cmd.
（4） test Mininet The time to close immediately after startup can be sudo mn --test none.

Mininet course ( 3、 ... and )：Mininet The command operation

sFlow Basic knowledge

sFlow brief introduction

sFlow By InMon、HP and FoundryNetworks On 2001 A network monitoring technology jointly developed in , It uses data stream random sampling technology , Complete second to fourth layers are available , Even network wide traffic information , It can adapt to large network traffic ( If it is greater than 10Gbit/s) Traffic analysis in environment , Let the user know in detail 、 Analyze the performance of network transport stream in real time 、 Trends and problems .

sFlow principle

sFlow Agent yes sFlow Client device for , In a typical deployment sFlow In the network , It is generally embedded in the network forwarding device （ Such as switches and routers ）, Collect the traffic forwarding information on the device and send it to the sFlow Collector For analysis .

The term	explain
sFlow Agent	Embedded in network devices , stay sFlow Collect traffic statistics in the system and send them to Collector End supply analysis .
sFlow Collector	Usually a dedicated server acts as , stay sFlow The system collects data from each Agent And summarize them in the form of icons or reports .

sFlow With firewalls and IDS comparison

Gigabit in modern networks 、 Gigabit and 10 Gigabit Ethernet links , Make firewalls and IDS It is becoming more and more difficult to undertake the task of monitoring and controlling traffic . Connect the firewall and IDS Placed on a critical network （ Such as server groups and departments with a large number of knowledge assets ） Entrance point , There may be many problems .

The increase of checkpoints will inevitably lead to performance degradation . The mirror port cannot forward all traffic of the Gigabit uplink , Gigabit firewall and IDS The system is very expensive , The centralized management and observation of captured data is very resource consuming , Not enough IT Resources to install all firewalls and IDS System , And maintain and perform the required operations . And in the face of large traffic attacks , Traditional security components that rely on mirror ports or bypasses can become overloaded —— Reduced overall performance .

although sFlow It is not a complete security analysis for all forwarded packets “ Mirroring Port ” or “ Network bypass ” technology , But it can provide a large amount of information suitable for security monitoring and policy implementation .sFlow Its advantage is that it can analyze the real-time sampling data provided by the security collector , So as to provide continuous monitoring capability of the whole network .

Through network devices ASIC Chip implementation of data collection technology , Even if the network is attacked by a large number of denial of service attacks, it will not affect the performance . In the event of a denial of service attack , Malicious traffic has increased dramatically , The sampled packets will also increase in proportion to the malicious traffic , In this way, we can quickly judge the attack behavior , So as to ensure that the collector will not be overloaded due to the increase of attack packets .

Sampling data can be used to create a normal usage benchmark for comparing traffic . These benchmarks can be used to show the use of port mapping 、 Use ping And port scanning ; Shows the consumption of computer resources or network bandwidth , To prevent a denial of service attack on host communication , If ICMP Of Smurf Attack or SYN flood attack ; It shows that repeated login or TCP hijacked , Acts that pose a threat to hosts on the network ; Show the wrong use behavior of using the system in an incorrect way , And the use of services and applications prohibited by enterprise policy .

sFlow Sampling message format

sFlow The message adopts UDP encapsulation , The default destination port number is the well-known port 6343.sFlow There are 4 Three message header formats , Respectively Flow sample、Expanded Flow sample、Counter sample、Expanded Counter sample. among Expanded Flow sample and Expanded Counter sample yes sFlow version5 The new content , yes Flow sample and Counter sample An extension of , But not forward compatible . be-all Extended The sampling content of must use Expanded Sampling message header encapsulation .

Above, sFlow Message format

sFlow Agent Two sampling methods are provided for users to analyze network traffic from different perspectives , Respectively Flow Sampling and Counter sampling .

Sampling methods	explain
Flow	Flow Sampling is sFlow Agent The device performs sampling analysis on the specified port according to the specific sampling direction and sampling comparison message , And the results of the analysis are passed through sFlow The message is sent to Collector Process of equipment .
Counter	Counter Sampling is sFlow Agent The device periodically obtains the traffic statistics on the interface , And pass these statistics through sFlow A message is sent to Collector Process of equipment .

sFlow Top ten advantages of

sFlow In the past RMON、RMON II and NetFlow Network monitoring technology ,sFlow The main advantage of ：

◆ Lower cost of network wide monitoring —— No need to buy any probes ;

◆ Always on technology with real-time analytics ;

◆ Embedded in ASIC Powerful technology in ;

◆ You can see the full network view of the device or port configuration ;

◆ User configurable sampling rate ;

◆ No impact on equipment performance ;

◆ The impact on network bandwidth is very small ;

◆ Complete packet header information ;

◆ Complete Second ～ Level 7 details ;

◆ Support multiple protocols （IP、MAC、Appletalk、IPX、BGP etc. ）.

SFlow Technology judgment on potential safety hazards

sFlow When the following conditions are found in the flow , Will suspect possible safety problems .

◆ Identify the Super bandwidth occupier with suspicious traffic ;

◆ Discover changes in transport traffic patterns associated with the use of new services or applications ;

◆ Both sides of the dialogue are abnormal or have excessive communication with the external host ;

◆ Identify infrequently used protocols ;

◆ A host tries to connect to a wide range of addresses using a large number of service ports ;

◆ Traffic to a host , Abnormally large in a very short time ;

◆ A host sends an abnormal number of login traffic ;

◆ By monitoring the external host , Abnormal transport traffic or service type port used is found ;

◆ sFlow In addition to sending all traditional packet headers and protocol information , Also send physical transmission information , Such as switch / Port interface information 、RMON Statistics and partial packet payload to monitor . such , Use sFlow The possibility of network security is obviously increased , And security related applications , Such as the whole enterprise IDS、 Application identification and traffic monitoring , It will be possible .

sFlow application

sFlow The system contains a... Embedded in the device sFlow Agent And remote sFlow Collector. among ,sFlow Agent It is used to obtain the interface statistics and data information on the device , Encapsulate information into sFlow message , When sFlow The message buffer is full or in sFlow Message cache time （ Cache time is 1 second ） After a timeout ,sFlow Agent Will sFlow The message is sent to the designated sFlow Collector.sFlow Collector Yes sFlow Message analysis , And display the analysis results .

https://blog.csdn.net/wuming5454/article/details/51527082

https://blog.csdn.net/a3192048/article/details/86475878

ryu Basic knowledge of controller

First understand what is SDN

Software Defined Network （Software Defined Network,SDN） Stanford University Clean-Slate A new network innovation framework proposed by the research group , Is a way to realize network virtualization , The network can be defined and controlled in the form of software programming . Its core technology OpenFlow By separating the control surface and data surface of network equipment , Thus, the flexible control of network traffic is realized , Make the network more intelligent as a pipeline , It provides a good platform for innovation of core network and application .

ryu What is it?

Ryu Is a component-based software definition network framework

Ryu Provides well-defined... For software components API, Enable developers to easily create new network management and control applications .

Support multiple protocols for managing network devices

Ryu It's using Python Developed

Official documents

install ryu

https://www.cnblogs.com/ssyfj/p/11730362.html

Ryu Source directory

1、 base
base There is a very important file in ：app_manager.py, Its effect is RYU Application Management Center . Used for loading RYU Applications , Accept from APP Messages sent , At the same time, it also completes the routing of messages .

Its main functions are app register 、 Cancellation 、 lookup 、 And defined RYUAPP Base class , Defined RYUAPP Basic properties of . contain name, threads, events, event_handlers and observers Wait for members , And many corresponding basic functions . Such as ：start(), stop() etc. .

Ryu APP In fact, it is to use Ryu Application code written by controller , We are Ryu Based on the framework , Note that there APP Different from the application plane , What we are talking about now is the control plane .

2、controller：
Realize the connection and event processing between the controller and the switch .

3、lib：
The basic protocol and data structure of the network are realized .
ofctl_v1_3.py The code in has a matching function , But before comparison OpenFlow Describes the matching fields displayed in ：
4、ofproto：
There are two types of files , One is the data structure definition of the protocol , The other is protocol parsing , That is, the function of processing .
Such as ofproto_v1_3.py yes 1.3 Version of OpenFlow Definition of protocol data structure , and ofproto_v1_3_parser.py It defines 1.3 Version of the protocol encoding and decoding .

5、topology：
Here we define the data structure of the switch and some event.
You can see... Here Switches class The basic content of the switch has been defined ：
6、contrib：
Stored the code of open source community contributors .

7、cmd：
Create an environment for the execution of the controller , Execute the command on the command line .

Use ryu

Turn on the controller , Use layer 2 switching

~/ryu/ryu/app$ ryu-manager simple_switch.py 

The experimental steps

topology

Set up process

Start the controller

Start the first host remote shell（“ Command line ”）, Get into /opt/ryu/ryu/app/ Catalog , Use ryu-manager Command to start ryu controller , And load ofctl_rest.py and simple_switch.py Two app（ Because to use ryu To the north , So you have to load ofctl_rest.py);

ofctl_rest.py Is to open the north interface of the controller ,simple_switch_13.py As a self-learning switch .

nohup ryu-manager --verbose ofctl_rest.py simple_switch.py > /home/ryu.log 2>&1 &

Use nohup Instructions will be ryu The process runs in the background , The output information is redirected to /home In the catalog ryu.log file ; If you want to know ryu You can view the contents of this file for the working details of the controller . To close the process , You need to execute ps -aux |grep ryu-manager Command get process id, Further implementation kill -9 process id that will do

Create a network topology

Start the second host shell（“ Command line 1”）, Use mn command , Create a star network of three nodes ,IP The address is 10.0.0.1-10.0.0.3, Set up ovs Of controller Is the controller host address ;

mn --controller=remote,ip=10.0.0.1-10.0.0.3,port=6653,protocols=OpenFlow13 --top single,3 

perform pingall Command can test network connectivity ;
Use net Command to view the connection of the simulation host ovs The name of the interface ;
Use dump Command to view the network structure

install sFlow-RT

Start the third host shell（“ Command line 2”）, Install using the following code java Environmental Science , And start the sFlow-rt Of controller.

#  install java Environmental Science  
apt-get update  
apt-get install default-jre  
# wget https://inmon.com/products/sFlow-RT/sflow-rt.tar.gz 
#  The experimental environment has downloaded the package , Put it in /opt/ Catalog  
tar -xvzf sflow-rt.tar.gz  
./sflow-rt/get-app.sh sflow-rt flow-trend   
./sflow-rt/get-app.sh sflow-rt browse-metrics  
nohup ./sflow-rt/start.sh -Dhttp.port=8081 &

nohup Command to detach the process shell Run in the background , To close the sflow process , You need to execute ps -aux |grep sflow Command get process id, Further implementation kill -9 process id that will do .

To configure sFlow Agent

Host computer shell（“ Command line 2”） in , To configure sFlow Agent, Yes mn Create virtual switch traffic for sampling .
because OVS Virtual switch supports sFlow Agent function , Use ovs-vsctl Command complete Agent To configure ：

ovs-vsctl -- --id=@sflow create sflow agent=s1 target=\"127.0.0.1:6343\" header=128 sampling=10 polling=1 -- set bridge s1 sflow=@sflow

agent： Monitor the flow of an interface of the switch ;
target：sFlow-RT Of IP, Default port 6343;
bridge： Need to open sFlow The bridge ;
sampling： Sampling rate , Said every N individual Packet Just take a sample
polling： poll time , every other N second polling A poll
remarks ： In practice, , The number of times the above command is executed and it needs to be started sFlow The number of bridges , There are several bridges , You need to execute this command several times , There is only one bridge here , Therefore, only for s1 The bridge is configured once Agent

View configured sFlow Agent Use the following command ：

ovs-vsctl list sflow

When the configuration is complete , Access to the host 8008 port （ The mapping port should be dynamically provided according to the container generated each time ）, Check the load

Simulate flooding attacks

Before launching a mock attack , Need to be in shell" Command line 2" in , start-up /data/workspace/myshixun/SDN-security In the catalog bps_record.py Script , Regularly polling sFlow The throughput of collected data （ This script sets the recording time length to 10 minute , So please be sure to complete the following processes within ten minutes ）

Get into " Command line 1", stay mininet In the end , perform h1 ping h3 operation , Check the flow value , After the h1 As an attacker , To the target h3 Simulation ping Flooding attack

h1 ping -f h3  

If the operation is correct , You can see that when the command is executed ,sFlow A sharp increase in transmission traffic is detected (sFlow Bytes、sFlow Packets),CPU Occupation and memory occupation also increased significantly .

Send out the flow meter

To realize the defense and mitigation against Hong Fan's attack , You need to send the flow table from the controller to OVS Switch , In order to achieve the blocking of attack traffic ; Suppose we know the source of the attack IP The address is 10.0.0.1, To write python Script call ryu Of rest api Complete the flow table distribution , Distribute flow table matching and filtering 10.0.0.1 All packets for the source address and discard

import requests
import json
url="http://127.0.0.1:8080/stats/switches"

url1="http://127.0.0.1:8080/stats/flow/1"
res=requests.get(url1).json()
print("-----------------------flows in switch1--------------------")
print(res)
print("-----------------------flows in switch1--------------------")

url_addEntry="http://127.0.0.1:8080/stats/flowentry/add"

data={
    
# *******************************************
#  Please fill in here request message body, Complete the flow table matching field and action field settings 
    "idle_timeout":30,
    "hard_timeout":120,
    "apid":1,
    "cookie":1,
    "table_id":0,
    "priority":555555,
    "flags":1,
    "match":{
    
        "nw_src":"10.0.0.1/32",
        "dl_type":2048
    },
    "actions":[]


# *******************************************
}
data=json.dumps(data)
res=requests.post(url_addEntry,data=data)
print("FlowTable update status:")
print(res)

print("-----------------------flows in switch1 after update--------------------")
res=requests.get(url1).json()
print(res)
print("-----------------------flows in switch1 after update--------------------")

Be careful ：

When distributing the flow table ,idle_timeout Set to 30,hard_timeout Set to 120;
After the flow table is successfully distributed , return 200 Status code , And print it on the screen ;
openflow Agreement ,actions The field is set to empty （ namely "actions":[]） Indicates that the switch does not handle the matching traffic , Direct discarding ;
Priority field in the flow table , The higher the value, the higher the priority , It is recommended to set 30000 above ;
Use the online editor to complete the code , Switch to switch to /data/workspace/myshixun/SDN-security Under the table of contents , utilize pyhton3 Execute as an interpreter flow_entry.py Script .

Observe the phenomenon

Use python3 The interpreter executes the py Script , Switch to bps_record Script execution shell, Observe the flow change ; You can see that the traffic value is rapidly reduced to tens of bytes per second ;
Wait for flow table timeout （ Such as 120 second ）, The traffic value is restored to tens of megabytes per second , Express DDoS After the mitigation mechanism is cancelled , The target is attacked again

Configure automatic defense

How to automate the above attack mitigation process , Realization SDN The controller is based on the dynamic detection of the flow , Automated generation of flow tables , Match attack traffic and block it ？

May adopt rest api programme 、 Customize ryu app programme 、 perhaps sFlow Of js Plug in solution ;

Problems encountered

port

Open port

/sbin/iptables -I INPUT -p tcp --dport 8080 -j ACCEPT

Close the port

/sbin/iptables -I INPUT -p tcp --dport 8080 -j DROP

Check the port

/sbin/iptables -L -n

modular

If the module cannot be installed

1. First try update command sudo apt-get update
2. If not, execute upgrade sudo apt-get upgrade After the above command succeeds, it can be used normally sudo apt-get install xxxxx
3. Finally, if neither of the above two items works, try sudo apt-get install aptitude Use after success sudo aptitude install xxxxx

import No.

./bps_record.py: line 1: import: command not found

stay python On the first line of the document, add

 #!/usr/bin/python

jurisdiction

-bash: ./bps_record.py: Permission denied
Modify the permissions

mn Fail to judge

host Between the host ping no
View the static flow table
stay mininet In the environment ：

mininet> dpctl dump-flows # View the static flow table 

Add flow table

mininet> dpctl add-flow in_port=1,actions=output:2 # For all the switch add to 
mininet> dpctl add-flow in_port=2,actions=drop # Discard packets 

Delete flow table

mininet> dpctl del-flows # Delete all stream tables 
mininet> dpctl del-flows in_port=2 # For entry only 2
mininet> sh ovs-ofctl del-flows s1 in_port=2 # Only on s1& entrance 2

Cannot reduce the flow

Pay attention to the version problem
stay official documents finding