CN110366170A - A wireless network security defense method based on software-defined security - Google Patents

Abstract

The invention discloses a wireless network security defense method based on software-defined security. The approach is based on a software-defined secure network architecture, including cloud platforms, SDN controllers, and wireless access points. The wireless access point sniffs the network environment data packets in the wireless network, uploads the network environment data to the cloud platform in real time; executes the network flow table from the SDN controller to realize network defense. The cloud platform completes the attack detection of network environment data, and generates a defense decision after detecting a network attack, and sends it to the SDN controller. The SDN controller manages and configures network forwarding devices including wireless access points, and delivers network flow tables based on defense decisions. The invention realizes the automation and integration of attack detection and defense under the wireless network, and improves the protection efficiency.

Description

A wireless network security defense method based on software-defined security

technical field

The invention relates to a wireless network security defense method, which belongs to the field of network security.

Background technique

With the rapid development of the Internet, network and information technology has been more widely used, but it is also accompanied by a larger area and a wider range of network attacks.

The existing detection and defense methods for wireless networks use wireless sniffing devices deployed in the network environment to sniff the environmental data, rely on the expert rule base to detect whether there is an attack on the network environment data, determine the location of the network attack, and then manually or other network tools The network defends. Existing methods rely on the deployment of network sniffing devices in the network, and cannot detect network attacks outside the scope of deployment; in addition, existing methods often only focus on network monitoring and detection, and cannot perform automated network defense after an attack is detected , the protection efficiency is low in actual deployment.

The rise of software-defined networking (SDN) provides important support for the evolution of network information security, and its management and control of network forwarding devices makes network defense possible. The security protection idea of software-defined security (SDS) proposed on the basis of SDN improves the initiative and linkage of security detection and defense, and enhances the management capability, coordination level and service quality of the network. The idea is to separate the data plane from the control plane and divide it from top to bottom: application layer, control layer and physical layer. The control layer uniformly manages the physical layer network resources, and centrally controls them to implement specific security defense operations according to instructions. The application layer uniformly performs intelligent and automatic business arrangement and management in a software-defined manner to complete the corresponding security functions, thereby realizing A security protection mechanism with flexible functions, flexible capabilities, and intelligent decision-making.

Contents of the invention

The purpose of the present invention is to provide a wireless network security defense method based on a software-defined security architecture, which realizes environmental awareness by combining a network security agent with a network device, uses a cloud platform to complete intelligent algorithm detection and decision-making, and uses an SDN controller to Realize automatic defense, realize the automation and integration of attack detection and defense under the wireless network, and improve the protection efficiency.

The technical scheme that the present invention realizes its object to take is:

The wireless network security defense method based on the software-defined security architecture of the present invention is specifically: in the software-defined security architecture, the wireless access point at the physical layer includes a security agent, and the cloud platform at the application layer includes a database, a communication server, and a detection system , the SDN controller of the control layer includes a firewall; the wireless network security defense method includes the following steps:

(1) The security agent sniffs the wireless network environment, and uploads the network environment data to the communication server; the communication server analyzes the received network environment data packets, and stores the analyzed network environment data into the database;

(2) The detection system detects whether there is network attack data in the analyzed network environment data. If it exists, the detection system calls the corresponding defense action from the database according to the attack type in the network attack data and extracts it from the network attack data. Attack feature information, which encapsulates defense actions and attack feature information into a defense decision, and sends the defense decision to the SDN controller;

(3) The firewall in the SDN controller sends the network flow table to the network forwarding device according to the defense action, and the network forwarding device executes the corresponding defense action according to the received network flow table.

Further, in the step (1) of the present invention, the security agent uploads the network environment data to the communication server using the CoAP protocol.

Further, the security agent of the present invention includes a communication client and an environment sniffing module; in the step (1), the environment sniffing module sniffs the wireless network environment and sends the obtained network environment data to the communication client, The communication client uploads the received network environment data to the communication server.

Further, the environment sniffing module of the present invention obtains the network environment data in the following way:

1) The environment sniffing module establishes a network socket in the application process, and binds the network socket to the wireless network card of the wireless access point;

2) The environment sniffer module captures all wireless data packets in the network environment where the wireless network card is located through the wireless network card of the wireless access point, and transmits the wireless data packets from the wireless network card to the environment sniffer module through the network socket;

3) The environment sniffing module adds a pcap format header to the wireless data packet to generate pcap format data, and adds a communication protocol header to the pcap format data to obtain network environment data.

Further, the detection system of the present invention includes an attack detection module and a decision delivery module; the step (2) is performed in the following way:

The attack detection module analyzes the network environment data to determine whether there is network attack data; if it exists, the decision delivery module retrieves the corresponding defense action from the database according to the attack type judged by the attack detection module, and extracts the attack characteristics in the network attack data Information; the decision delivery module encapsulates the defense action and attack feature information into a defense decision, and sends the defense decision to the SDN controller.

Compared with the prior art, the beneficial effects of the present invention are: (1) By dividing the detection and defense of the wireless network into three steps: environment perception, intelligent detection and automatic defense, a complete closed loop from detection to defense of wireless network attacks is realized. (2) Using the wireless access point as a network sniffer to capture network environment data packets can realize global network monitoring without relying on other devices, which solves the device dependence caused by relying on specific sniffer deployment in the prior art and the problem of limited coverage; it greatly expands the scope of network sniffing, reduces the difficulty of network sniffing and environmental perception, and realizes real-time perception of a wide range of network environments. (3) Deploying attack detection on the cloud platform can use the powerful computing and storage capabilities of the cloud platform to realize complex algorithm detection and data storage, and solve the problem of algorithm detection and unified monitoring and storage that cannot be realized due to limited computing power in the existing technology The problem. (4) Using the SDN controller to control the wireless network and realize automatic defense, which solves the problem of low defense efficiency caused by relying on manual defense or other defense tools in the existing technology, realizes defense automation and improves protection efficiency.

Description of drawings

FIG. 1 is a software-defined security architecture diagram of an embodiment of the present invention.

Detailed ways

The present invention will be further elaborated below with a specific embodiment. Figure 1 shows the software-defined security architecture of this embodiment, and the specific description is as follows:

Wireless access point: In order to ensure the developability of the wireless access point, in this embodiment, the operating system of the wireless access point may adopt an open source operating system. In order to make the wireless access point adapt to the OpenFLow protocol and realize the access of the SDN network, this embodiment uses Open vSwitch (OVS) as the internal bridge of the wireless access point. In addition, a security agent is deployed in the wireless access point. The security agent consists of a communication client and an environment sniffing module. In this embodiment, considering the hardware limitation of the wireless access point, the communication client is a CoAP client, and the communication protocol is a CoAP protocol. The present invention can also use other application layer communication protocols such as HTTP. After the wireless access point is turned on, the communication client starts and sends a CoAP data packet of type CON to the communication server in the cloud platform. The Token of the data packet stores the MAC address of the wireless access point; the communication server passes the authentication of the wireless access point The MAC address is the access authorization of the wireless access point, and the connection is established. After the communication connection is established, the environment sniffing module of the wireless access point starts. The environment sniffing module first establishes a network socket in the application process, and binds the network socket to the wireless network card of the wireless access point; then, the wireless network card of the wireless access point captures the network environment where the network card is located. All wireless data packets, transmit wireless data packets to the environment sniffer module locally through the network socket; the environment sniffer module adds a pcap format header to the wireless data packet, generates pcap format data, and adds a CoAP protocol header to the pcap format data, Get network environment data. The communication client uploads the obtained network environment data in NON type to the communication server in the cloud platform in real time.

Cloud platform: The cloud platform can be implemented by an open source cloud platform architecture, such as OpenStack; it can also use existing cloud platform service provider products, such as Alibaba Cloud, AWS, etc. In this embodiment, at least one communication server, one detection system and one database are deployed on the cloud platform. The communication server is used to receive data from the communication client in the wireless access point, and the communication protocol corresponds to the communication client in the wireless access point, which is the CoAP protocol in this embodiment; the detection system includes an attack detection system for detecting attacks module and a decision-making module for issuing decisions; the database stores network logs and defense actions for defending against network attacks. At the beginning of the establishment of the communication connection, the communication server receives the authentication data packet from the communication client in the wireless access point. After the authentication is successful, the communication server returns the ACK data packet, and stores the start command in the option of the data packet. After the communication connection is established, the communication server continuously receives network environment data from the communication client in the wireless access point. The communication server stores the network environment data in the database, and at the same time transmits the network environment data to the detection system for attack detection. In this embodiment, the attack detection module in the detection system uses algorithm matching for detection. The attack detection module of the present invention can also use other detection methods such as expert database matching detection, and the algorithm used for algorithm matching detection can be artificial intelligence algorithms such as CNN, KNN, and random forest. In this embodiment, the attack detection module first uses the data set to train the artificial intelligence algorithm to generate an algorithm model before using algorithm matching for attack detection; when detecting an attack, the attack detection module takes network environment data as input data and inputs it to the In the algorithm model, the judgment result output by the model is the detection result. The output judgment result may be normal, or a certain type of attack (such as flood attack, simulation attack, injection attack). If there is an attack in the detection result, the decision delivery module of the detection system retrieves the corresponding defense action (drop, block, hopping) from the database according to the attack type, and extracts the attack characteristic information in the attack data. The attack feature information varies according to the attack type and defense action, and needs to be set accordingly according to the specific situation. For example, for flooding attack and injection attack, the corresponding defense action can be "drop", and the attack feature information is the The source MAC address; for interference attacks, the corresponding defense action can be "hopping", and the attack characteristic information is the destination MAC address and channel number. Finally, the decision delivery module encapsulates the defense action and attack feature information into a defense decision in JSON data format, and sends the defense decision to the SDN controller through the HTTP protocol.

SDN controller: After the SDN controller receives the defense decision from the cloud platform, the firewall generates a network flow table according to the content of the defense decision, fills the action item in the flow table with the defense action in the defense decision, and fills the defense decision in the object item Attack signature information in . The firewall sends the generated network flow table to all network forwarding devices in the wireless local area network where the wireless access point is located through the packet-out message of the OpenFLow protocol. The OVS bridge in the wireless access point performs defense actions based on the flow table information to realize automatic network defense.

Taking flooding attack as an example, a typical detection and defense of the present invention will be described in a specific embodiment.

The wireless access point turns on and starts the communication client. The communication client in the wireless access point first performs connection authentication with the communication server in the cloud platform. If the authentication fails, the wireless access point returns an error message, and the program ends. If the authentication is successful, the cloud platform returns the start command to the wireless access point, and the wireless access point starts the environment sniffing module after receiving the start command, and the environment sniffing module captures the network data of the wireless network where it is located through the wireless network card of the wireless access point, And add pcap data format and CoAP protocol header to generate network environment data packets. The communication client continuously uploads the network environment data captured by the environmental sniffing module to the communication server in the cloud platform through the CoAP protocol.

There are attackers in the network environment where the wireless access point is located. The attacker sends a large number of authentication packets to the wireless access point as attack packets to implement a flood attack. These attack data packets are captured by the environment sniffing module of the wireless access point and mixed with the normal network environment data and uploaded to the cloud platform.

After receiving the network environment data packet, the communication server in the cloud platform analyzes the data packet, and stores the analyzed network environment data in the database. At the same time, the attack detection module in the cloud platform detection system inputs the network environment data into the trained CNN model for attack detection. Since there are attack data packets of a flood attack in the network environment data, the attack detection module detects the attack data packets and determines that the attack type is a flood attack.

According to the attack type determined by the attack detection module, the decision delivery module of the detection system retrieves the defense action of Hongfan attack from the database, here is "drop", the specific defense method of this action is to discard all data from a certain MAC address Bag. At the same time, according to the attack type and defense action, the decision delivery module extracts the attack characteristic information in the attack data packet, here is the source MAC address.

The decision delivery module encapsulates the attack feature information and defense actions in JSON format, and forwards them to the SDN controller through the HTTP protocol.

After the SDN controller receives the message from the cloud platform, the firewall analyzes the defense decision, generates a network flow table according to the defense action and attack feature information in the defense decision, and sends the packet-out message of the Openflow protocol to the wireless network where the wireless access point is located. All network forwarding devices in the LAN.

Add an action "drop" to the OVS bridge of the wireless access point, and the object is the network flow table of the above MAC address. The OVS bridge will discard all data messages from the MAC address to complete network defense.

The cycle wireless access point captures network environment data and uploads it to the cloud platform attack detection system to detect attacks. Once the attack data is detected, the cloud platform and SDN controller respond to defend against attacks to protect the network.

Claims (5)

1. a kind of wireless network secure based on software definition security architecture defends method, it is characterised in that: fixed in the software In adopted security architecture, the wireless access point of physical layer includes broker security, and the cloud platform of application layer includes database, communication clothes Business device and detection system, the SDN controller of control layer include firewall；The wireless network secure defence method includes following step It is rapid:

(1) broker security sniff wireless network environment, and network environment data is uploaded to the communication server；The communication server pair The network environment data packet received is parsed, and the network environment data after parsing is deposited into the database；

(2) it whether there is network attack data in the network environment data after detection system detection parsing, and if it exists, then detection system System acts and from network attack data according to the attack type in network attack data from corresponding defence is transferred in database Extracting attack characteristic information by defence movement and attack signature Information encapsulation at defence decision, and issues defence decision and controls to SDN Device processed；

(3) firewall in SDN controller, which is acted according to defence to network forwarding equipment, issues network flow table, network forwarding equipment Corresponding defence movement is executed according to the network flow table received.

2. wireless network secure according to claim 1 defends method, it is characterised in that: in the step (1), safety Proxy server uploads network environment data to the communication server using CoAP agreement.

3. wireless network secure according to claim 1 or 2 defends method, it is characterised in that: broker security includes logical Believe client and environment sniff module；In the step (1), by environment sniff module sniff wireless network environment and it will obtain Network environment data be sent to communication customer end, received network environment data is uploaded to communication clothes by communication customer end Business device.

4. wireless network secure according to claim 3 defends method, it is characterised in that: environment sniff module is pressed with lower section Method obtains network environment data:

1) environment sniff module establishes web socket in application process, by the wireless network of web socket and wireless access point Card binding；

2) environment sniff module captures the institute in network environment locating for the wireless network card by the wireless network card of wireless access point There is wireless data packet, and wireless data packet is transmitted to from wireless network card by environment sniff module by web socket；

3) environment sniff module is that wireless data packet adds pcap format packet header, generates pcap formatted data, and is pcap format Data add communication protocol packet header, obtain network environment data.

5. wireless network secure according to any one of claim 1 to 4 defends method, it is characterised in that: detection system Module is issued including attack detection module and decision；The step (2) are executed by the following method:

Attack detection module analyzing network circumstance data, judge whether there is network attack data；If it exists, then decision issues mould The attack type that root tuber judges according to attack detection module transfers corresponding defence movement from database, and extracts network attack number Attack signature information in；Decision issues module for defence movement and attack signature Information encapsulation into defence decision, and will prevent Imperial decision is issued to SDN controller.