# Multi-Constraint and Multi-Policy Path Hopping Active Defense Method Based on SDN
## 3 The Overall Structure of SDADM  
As shown in Figure 1, the control layer interacts with the forwarding layer through the southbound interface to obtain network topology, link status, and other information from the forwarding layer, thereby achieving centralized control of the forwarding equipment. At the same time, it issues flow tables to the forwarding devices through the southbound interface, making the forwarding devices strictly forward data according to the flow tables. This paper introduces SDADM, leveraging the capabilities of SDN, including features such as separation of control and data plane, centralized control, and programability. This method mainly includes four modules: data collection, path calculation, path selection, and hopping execution. The data collection module obtains relevant network and communication host data from the forwarding layer and sends it to the path calculation module, which calculates all paths satisfying the constraint conditions b  
Figure 1: SDADM architecture diagram. hosts through DFS traversal, generating a path hopping space. The path calculation module sends the calculated communication paths to the path selection module, which calculates alternative paths satisfying the constraint conditions based on the currently used path, forming an alternative path space. The hopping execution module selects a path from the alternative path space adaptively based on the current network status, performs hopping, and generates corresponding flow table entries. It pre-issues flow table entries to the nodes of the hopping path in a \"reverse addition, forward deletion\" manner. The design of its functional modules is as follows:  
1. Data collection module: This module is responsible for collecting network status information required for path switching. For example, it gathers information related to communicating hosts, network topology, remaining link bandwidth, node capacity, etc., for further data processing by other modules. Node capacity refers to the available flow table entries in communicating nodes, which can be obtained by sending an OFPPortStatsRequest message to switches to request statistical information and then calculating it. When a host initiates communication and there are no matching flow table entries in the network, the communicating node encapsulates the host's information in a Packet-In message and sends it to the controller. This module analyzes the Packet-In message to extract source and destination addresses and other relevant information. SDN controllers support link layer discovery protocol (LLDP) and broadcast domain discovery protocol (BDDP) for obtaining network topology and link status information [19]. The SDN controller sends LLDP packets to switches using Packet-Out messages, and upon receiving these packets, switches forward them to neighboring devices and send Packet-In messages to the controller. The controller analyzes these messages, saves link discovery records in the link discovery table, and retrieves global network topology and link status information. Controllers typically provide API interfaces for accessing network topology information. In this paper, the Ryu controller is used, and this module utilizes functions like \"get_switch\", \"get_links\", and \"get_host\" from the \"ryu.topology.api\" module to obtain lists of switches, links, and hosts, thereby constructing a global network topology including hosts. 2. Path calculation module: This module is mainly used to generate a path hopping space. Based on the network topology and the source-destination host information provided by the data collection module, all paths between the communication hosts are calculated using the DFS method, and paths with a length greater than the constraint conditions are deleted to generate a path hopping space \(Space^{S\to D}\). 3. Path selection module: This module is mainly used to select hopping paths that meet the constraint conditions from the generated path hopping space as an alternative path space.