面向多控制器的SDN安全威胁检测技术研究

To alleviate single-point failure and poor scalability problems of single SDN controller, the specifications of OpenFlow after version 1.3 introduce a new deployment strategy of multiple controllers. The centralized control characteristic of conventional SDN enables compromised network entities to steal sensitive information and to launch internal attacks against other network entities or even denial-of-service. Hence, we argue that multi-party collaborative detection on the basis of the multi-controller deployment strategy is a promising way to address the above security challenges. This project aims to address a big challenge that stems from various security threats against different planes of SDN. By considering the operating mode of decoupling the control plane from the data one, we will study on novel SDN adversary models and their implementation based on protocol vulnerability exploitation. Then, we will investigate privacy preserving multi-party collaborative data analysis on the basis of the multi-controller deployment strategy to handle the parameter leakage of learning models and classifiers. After that, we will propose multi-layer learning based intrusion detection methods for SDN to identify complex and hidden malicious behaviors. Finally, we will design and implement a programmable platform for SDN security experiments to validate the effectiveness and the feasibility of the proposed models and methods. The research will make breakthrough on key technologies of security threat detection in SDN. It will propose feasible solutions to address the security issues that significantly challenge the development of SDN application services, and it will provide proper techniques for secure and reliable next-generation network infrastructure.

为缓解单个SDN控制器导致的单点失效、扩展性差等问题，OpenFlow 1.3版本之后的各规范增加了多控制器的部署策略。SDN集中控制特性使得被攻陷的网络实体可能窃取敏感信息、发起针对其他网络实体的攻击甚至拒绝网络服务。面向多控制器的多参与方协同检测技术可以很好地解决上述安全挑战。本课题从SDN各平面遭受多种安全威胁这一根本问题出发，研究基于协议缺陷利用的新型SDN攻击模型；针对学习模型本身和分类器参数可能面临的敏感数据泄露风险，在多控制器部署策略支持下，研究满足隐私保护要求的安全多参与方协同分析方法；针对传统的攻击流检测机制的不足，研究基于多层学习的SDN入侵检测方法；最后，搭建可编程的SDN安全实验平台，验证所提出模型和方法的有效性与可行性。本课题研究将突破SDN安全威胁检测若干关键技术，解决制约SDN应用服务推广的安全保护难题，为构建安全可靠的下一代网络基础设施提供合适的技术手段。

为缓解单个SDN控制器导致的单点失效、扩展性差等问题，OpenFlow 1.3版本之后的各规范增加了多控制器的部署策略。SDN集中控制特性使得被攻陷的网络实体可能窃取敏感信息、发起针对其他网络实体的攻击甚至拒绝网络服务。本课题研究了可穿戴设备隐私保护技术、人工智能安全和SDN安全感知测量相关的威胁模型，提出了一系列面向智能系统的安全威胁分析与设计方法；设计了多种异常检测与敏捷响应机制，提出了多种智能化算法及其应用研究机制。本课题研究突破了SDN安全威胁检测若干关键技术，为构建安全可靠的下一代网络基础设施奠定了一定的技术手段。