| With the development of big data,cloud computing and other technologies,Software Defined Network(SDN),which has unique advantages such as flexible deployment and easy management and maintenance,is widely used in various industries.At the same time,SDN also faces many network attacks such as DDo S and port scanning,which seriously threaten the security of SDN networks.Therefore,an effective anomaly detection mechanism is important to build a secure network environment.Existing anomaly detection mechanisms can usually be divided into two dimensions:fine detection for frame-by-frame data,and overall detection for traffic characteristics.However,these two approaches still have limitations in terms of detection range,detection efficiency,device hijacking tolerance,and network difference adaptation.To address the above-mentioned problems,this thesis combines blockchain and federated learning technologies to carry out research on distributed intelligent anomaly detection technology for SDN at the data frame and traffic levels,respectively,with the following main research contents:(1)Blockchain-based data frame verifcaiton technology for SDN.Firstly,the blockchain is applied to achieve reliable maintenance of detection information by using its characteristics of non-tamperability and traceability.Then,the network switching equipment is used as the detection subject,and the network switching equipment is selected in a semirandom manner to implement distributed detection of data frames.Thus,the block randomness and the semi-randomness of the detection subject are used to provide security for the normal operation of the detection mechanism.(2)Federated Learning-based cooperative anomaly detection in SDN.Firstly,to realize the increase of detectable traffic service under the limited resources,detection models are deployed on those nodes selected according to the topology and traffic factors.Then,to solve the problem that multiple detection models fail to be optimized as a whole when trained due to insufficient samples,environmental differences,etc.This thesis proposes a reasonable combination of local and global data features in a federated learning architecture to optimize detection models for different deployment environments.The simulation results show that the proposed data frame detection mechanism can still maintain good verification performance and efficiency under the same proportion of switches under malicious control,and the resource overhead and communication cost introduced by the proposed mechanism are within a reasonable range.And the proposed cooperative anomaly detection mechanism shows better detection results compared with local independent training and traditional federation learning,reflecting a stronger adaptability to the detection environment. |
