DDoS  ATTACK PROCESSING APPARATUS AND METHOD IN OPENFLOW SWITCH

An OpenFlow switch in an OpenFlow environment includes an attack determination module to collect statistical information on packet processing with respect to incoming packets to be processed in the OpenFlow switch at a predetermined period interval to determine whether a DDoS attack occurs. The Openflow switch also includes an attack responding module to perceive a feature of the DDoS attack by using the incoming packets introduced into the OpenFlow switch after the determination of the occurrence of the DDoS attack and process the incoming packets in line with the perceived feature of the DDoS attack. Therefore, it is possible to determine and responds to DDos attacks in the OpenFlow switches.

DETAILED DESCRIPTION

In describing the embodiments of the invention, known functions or configuration will not be described fully if the detailed description thereof makes the scope and spirit of the invention ambiguous. The following terms are defined in consideration of functions in the embodiments of the invention and may vary in accordance with the intentions of a user or an operator or according to usual practice. Therefore, the definitions of the terms should be interpreted on the basis of the entire content of the specification.

Hereinafter, the exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings.

Before describing the exemplary embodiment, an OpenFlow technology to which the exemplary embodiment is applied will be described as follows.

FIG. 1is a network diagram illustrating an OpenFlow technology to which an exemplary embodiment of the present invention is applied.

Referring toFIG. 1, a virtual network to which the embodiment is applied includes an OpenFlow controller110for controlling centrally the entire network, a plurality of OpenFlow switches120for processing incoming data packets that are introduced into the OpenFlow switches under a control scheme settled by the OpenFlow controller110, an OpenFlow protocol130that is responsible for communication between the OpenFlow controller110and the OpenFlow switches120, and a terminal140such as a personal computer for transmitting the data packets to the OpenFlow switches120and receiving the data packets through the OpenFlow switches120. Also, each of the OpenFlow switches120may be constructed with a hardware part having a flow table for processing the data packets and a software part for providing a secure channel.

Following is a description on a process performed when a new flow is introduced into the virtual network optimized to serve a particular service.

First, when data packets of a new flow are introduced into the OpenFlow switches120, the OpenFlow switches120transmit signaling packets to inquire of the OpenFlow controller110how to process the flow since they have no processing information on the flow to which the packets belongs.

The OpenFlow controller110decides a processing method for the flow on a basis of status information of the OpenFlow switches120on the virtual network and transmits the processing method to all the OpenFlow switches120to which the packets belonging to the flow are delivered.

The OpenFlow switches120, in response to the receipt of the processing method, processes the incoming packets in line with the processing method.

In the exemplary embodiment of the present invention, the OpenFlow switches120are designed to determine whether an exterior invasion, e.g., a DDoS attack, occurs and responds to the invasion.

The configuration and operation of the OpenFlow switch120will be discussed with reference toFIG. 2toFIG. 5.

FIG. 2shows a configuration of one OpenFlow switch120among others in accordance with an exemplary embodiment of the present invention. The OpenFlow switch120includes a secure channel210, a flow table215and a DDoS attack processing apparatus220.

The DDoS attack processing apparatus220collects statistical information on the packet processing from the hardware part of the OpenFlow switch120and determines whether the DDoS attack occurs on a basis of the collected statistical information on the packet processing.

When it is determined that the DDoS attack has happened, the DDoS attack processing apparatus220inspects the headers of the incoming packets or sampled packets introduced onto the hardware part so that it can respond to the DDoS attack. More specifically, the DDoS attack processing apparatus220determines whether the attack is a signature-based DDoS attack or a behavior-based DDoS attack through the inspection of the headers and responds to the DDoS attack by processing the packets related to the DDoS attack, e.g., discarding the related packets in accordance with the determination.

The configuration and functionality of the DDoS attack processing apparatus220will be described with reference toFIG. 3.

FIG. 3is a block diagram of a DDoS attack processing apparatus220in accordance with an exemplary embodiment of the present invention;

Referring toFIG. 3, the DDoS attack processing apparatus220includes a DDoS attack determination module310, a DDoS attack responding module320and a DDoS attack information collection module330.

The DDoS attack determination module310, which is located on the hardware part of the OpenFlow switch120, receives the statistical information on packet processing from the hardware part and determines whether the DDoS attack occurs on a basis of the received statistical information on packet processing and pre-stored feature information on the DDoS attack. Herein, the feature information on the DDoS attack may be information collected by the DDoS attack information collection module330.

The DDoS attack determination module310may include a threshold-based DDoS attack determination unit312for determining whether the DDoS attack occurs on a basis of a predetermined threshold and a packet capture unit314for capturing the packets with the determination of the DDoS attack.

The threshold-based DDoS attack determination unit312determines that the DDoS attack had happened when there is a sudden increase in the number of packets and bytes at a specific period via the packet processing statistical information obtained every period. In other words, when the number of packets and bytes being processed at a current period is larger than a predetermined threshold in comparison with the number of packets and bytes processed at a previous period, the threshold-based DDoS attack determination unit312determines the occurrence of the DDoS attack, and the packet capture unit314captures the incoming packets introduced into the OpenFlow switch120to provide the captured packets to the DDoS attack responding module320. In this regard, the predetermined threshold may be dynamically set in line with a network situation.

The DDoS attack responding module320analyzes the increase in a traffic ratio from the captured packets and perceives the signature-based DDoS attack with the analyzed traffic ratio, thereby responding to the signature-based DDoS attack.

Further, the DDoS attack responding module320analyzes the features of the captured packets if the attack is not the signature-based DDoS attack and perceives the behavior-based DDoS attack with the analyzed feature, thereby responding to the behavior-based DDoS attack.

The DDoS attack responding module320includes a signature-based DDoS attack responding unit322and a behavior-based DDoS attack responding unit324.

The signature-based DDoS attack responding unit322may respond to a standardized type of DDoS attacks. That is, the signature-based DDoS attack responding unit322analyzes the increase in the traffic ratio from the captured packets to perceive the feature of the signature-based DDoS attack. Herein, the traffic may include ICMP (Internet Control Message Protocol) traffic, TCP (Transmission Control Protocol) traffic, UDP (User Datagram Protocol) traffic, HTTP (Hyper Text Transfer Protocol) traffic and the like, and the analysis of the traffic ratio increase may be made through the comparison between the predetermined threshold and the increased traffic ratio of the overall traffics in the OpenFlow switch.

The signature-based DDoS attack responding unit322performs a disposal process for the incoming packets when the feature of the signature-based DDoS attack is detected, thereby responding to the signature-based DDoS attack.

The behavior-based DDoS attack responding unit324responds to an unstandardized type of DDoS attacks. That is, the behavior-based DDoS attack responding unit324perceives the attack to be the unstandardized type of DDoS attacks, i.e., the behavior-based DDoS attack if the attack is not the signature-based DDoS attack, thereby responding to the behavior-based DDoS attack.

The behavior-based DDoS attack responding unit324responds to the behavior-based DDoS attack by discarding the incoming packets when the feature of the behavior-based DDoS attack is perceived.

Meanwhile, the feature of signature-based DDoS attack or the behavior-based DDoS attack may be provided to the information collection module330.

The information collection module330includes an information collection unit322for collecting the feature of the DDoS attack obtained in the course of responding to the DDoS attack and an information database334that stores the collected features.

The feature information stored in the information collection unit332may be provided to the DDoS attack determination module310and the DDoS attack responding module320. In response thereto, the DDoS attack determination module310can update information necessary for determining whether the DDoS attack occurs, and the DDoS attack responding module320can update information necessary for responding to the DDoS attack.

A process in which the OpenFlow controller110determines whether the DDoS attack occurs and responds to the DDoS attack will be described with reference toFIG. 4.

FIG. 4illustrates a flow chart of a process for determining and responding to the DDoS attack performed by the OpenFlow controller110in accordance with an exemplary embodiment of the present invention.

Referring toFIG. 4, the OpenFlow switch120processes the packets on the hardware part in operation402and transfers the statistical information on the packet processing, for example, the number of processed packets and bytes every predetermined period onto the software part in operation404.

In response thereto, the DDoS attack determination module310residing on the software part determines whether the DDoS attack occurs on a basis of the transferred statistical information in operation406. For example, the threshold-based DDoS attack determination unit312may determine whether the DDoS attack occurs by comparing between the predetermined threshold and the number of the packets and bytes received at current as compared to the number of packets and bytes transferred at a current period. That is, it may be determined that the DDoS attack has begun in a case where the number of packets and bytes transferred at the current period is greater than the predetermined threshold.

As a result of the determination in operation406, if it is determined that the DDoS attack has happened, the DDoS attack determination module310activates the DDoS attack responding module320in operation408, and thus the DDoS attack responding module320responds to the DDoS attack targeting the incoming packets introduced into the OpenFlow switch120or the sampled packets while residing at the hardware part in operation410.

Meanwhile, as the result of the determination in operation406, if it is determined that none DDoS attack has happened, a process returns to the operation402to repeat the above operations. In other words, the OpenFlow switches120processes the incoming packets based on the information in the flow table215and transfers the statistical information on the packets processed every period onto the software part.

A process of responding to the DDoS attack to be performed in operation410will be described with reference toFIG. 5.

FIG. 5illustrates a flow chart of a process for responding to the DDoS attack in accordance with an exemplary embodiment of the present invention.

Referring toFIG. 5, the DDoS attack responding module320determines whether the attack is the signature-based attack through the use of the signature-based DDoS attack responding unit322. More specifically, the signature-based DDoS attack responding unit322calculates a ratio of the ICMP traffics to the total traffics in the OpenFlow switch120in operation502and determines whether the calculated ratio of the ICMP traffics is larger than a predetermined threshold of the ICMP traffic ratio in operation504.

As a result of the determination in operation504, if the calculated ratio of the ICMP traffics is larger than the predetermined threshold of the ICMP traffic ratio, the signature-based DDoS attack responding unit322determines that the attack is the signature-based attack, discards the ICMP related packets of the incoming packets and provides the feature information of the ICMP DDoS attack to the DDoS attack information collection module330in operation506. In response thereto, the DDoS attack information collection module330stores the feature information of the ICMP DDoS attack in the information database334in operation508.

Meanwhile, as a result of the determination in operation504, if the calculated ratio of the ICMP traffics is equal to or less than the predetermined threshold of the ICMP traffic ratio, the signature-based DDoS attack responding unit322calculates a ratio of the TCP traffics to the total traffics in operation510and determines whether the calculated ratio of the TCP traffics is larger than a predetermined threshold of the TCP traffic ratio in operation512.

As a result of the determination in operation512, if the calculated ratio of the TCP traffics is larger than the predetermined threshold of the TCP traffic ratio, the signature-based DDoS attack responding unit322determines that the attack is the TCP attack, that is, TCP flooding, discards the TCP related packets of the incoming packets and provides the feature information of the TCP DDoS attack to the DDoS attack information collection module330in operation514. In response thereto, the DDoS attack information collection module330stores the feature information of the TCP DDoS attack in the information database334in operation508.

Meanwhile, as a result of the determination in operation512, if the calculated ratio of the TCP traffics is equal to or less than the predetermined threshold of the TCP traffic ratio, the signature-based DDoS attack responding unit322calculates a ratio of the UDP traffics to the total traffics in operation516and determines whether the calculated ratio of the UDP traffics is larger than a predetermined threshold of the UDP traffic ratio in operation518.

As a result of the determination in operation518, if the calculated ratio of the UDP traffics is larger than the predetermined threshold of the UDP traffic ratio, the signature-based DDoS attack responding unit322determines that the attack is the UDP attack, that is, UDP flooding, discards the UDP related packets of the incoming packets and provides the feature information of the UDP DDoS attack to the DDoS attack information collection module330in operation520. In response thereto, the DDoS attack information collection module330stores the feature information of the UDP DDoS attack in the information database334in operation508.

Meanwhile, as a result of the determination in operation518, if the calculated ratio of the UDP traffics is equal to or less than the predetermined threshold of the UDP traffic ratio, the signature-based DDoS attack responding unit322calculates a ratio of the HTTP traffics to the total traffics in operation522and determines whether the calculated ratio of the HTTP traffics is larger than a predetermined threshold of the HTTP traffic ratio in operation524.

As a result of the determination in operation524, if the calculated ratio of the HTTP traffics is larger than the predetermined threshold of the HTTP traffic ratio, the signature-based DDoS attack responding unit322determines that the attack is the HTTP attack, that is, HTTP flooding, discards the HTTP related packets of the incoming packets and provides the feature information of the HTTP DDoS attack to the DDoS attack information collection module330in operation526. In response thereto, the DDoS attack information collection module330stores the feature information on the HTTP DDoS attack in the information database334in operation508.

Meanwhile, as a result of the determination in operation524, if the calculated ratio of the HTTP traffics is equal to or less than the predetermined threshold of the HTTP traffic ratio, the signature-based DDoS attack responding unit322determines that the attack is not the signature-based attack to trigger the operation of the information database334in operation528.

In response thereto, the behavior-based DDoS attack responding unit324analyzes all the packets introduced into the OpenFlow switches120or sampled packets to determine whether the attack is the behavior-based attack in operation530.

If, in the operation530, the attack is the behavior-based attack, the behavior-based DDoS attack responding unit324performs a disposal process for all the packets exploited in the behavior-based DDoS attack and provides the feature information on the behavior-based DDoS attack to the DDoS attack information collection module330in operation532. In response thereto, the DDoS attack information collection module330stores the feature information on the behavior-based DDoS attack in the information database334in operation508.

The feature information of the DDoS attacks stored in the information database334may be provided to the DDoS attack determination module310and the DDoS attack responding module320so that they can utilize the feature information as a reference data to determine whether the DDoS attack occurs and responds to the DDoS attack.

As mentioned above, in accordance with the exemplary embodiments of the present invention, an apparatus for determining whether the DDoS attack occurs and responding to the DDoS attack is installed in the respective OpenFlow switches so that the switches itself determines whether the DDoS attack occurs and responds to the DDoS attack, thereby not only minimizing the load due to the massive messages sent to the OpenFlow controller110at the time of the DDoS attack but also rapidly responding to the DDoS attack.

While the invention has been shown and described with respect to the preferred embodiments, the present invention is not limited thereto. It will be understood by those skilled in the art that various changes and modifications may be made without departing from the scope of the invention as defined in the following claims.