基于置信度熵融合的多控制器SDN跨域联合DDoS检测
Cross-Domain Joint DDoS Detection in Multi-Controller SDN via Confidence-Based Entropy Fusion
浏览论文内容
中文总结 AI 辅助
针对多控制器SDN中基于熵的DDoS检测器存在的汇聚偏差问题，提出跨域置信度融合框架，有效降低汇聚控制器误报率并提升F1分数。
中文摘要 AI 辅助
在多控制器软件定义网络（SDN）中，分布式拒绝服务（DDoS）攻击呈现出“分散源、集中目标”的跨域模式，即攻击流量源自多个边缘控制器域，但汇聚至单个汇聚控制器域内的受害者。尽管基于熵的DDoS检测器在单控制器场景中有效，但其直接应用于多控制器SDN时会暴露出此前被忽视的异常。通过系统实验，我们识别出一种汇聚偏差：在攻击后过渡阶段，汇聚控制器仍会产生过多误报，而边缘控制器已恢复正常。我们将此现象归因于OpenFlow统计滞后与无约束动态阈值漂移的耦合效应。为解决该问题，我们提出一种跨域置信度融合框架，该框架利用轻量级边缘侧消息校准汇聚控制器的决策，无需共享原始流量数据。该框架非侵入式、通信高效且可增量部署。在包含24台主机的三控制器线性Mininet测试床上进行的10次运行实验表明，该方法在保留边缘控制器性能的同时，将汇聚控制器的误报率从8.87%降至1.96%，F1分数从89.04%提升至96.89%。
英文摘要
In multi-controller Software-Defined Networking (SDN), Distributed Denial-of-Service (DDoS) attacks exhibit a "dispersed source, concentrated target" pattern across domains, i.e., attack traffic originates from multiple edge-controller domains but converges on a victim in a single aggregation controller domain. While entropy-based DDoS detectors are effective in single-controller settings, their direct application in multi-controller SDN reveals a previously overlooked anomaly. Through systematic experiments, we identify an aggregation bias: during the post-attack transition phase, the aggregation controller continues to generate excessive false positives, while edge controllers have already returned to normal. We attribute this phenomenon to the coupled effects of OpenFlow statistics lag and unconstrained dynamic-threshold drift. To address this issue, we propose a cross-domain confidence-fusion framework that leverages lightweight edge-side messages to calibrate aggregation-controller decisions without sharing raw traffic data. The framework is non-intrusive, communication-efficient, and incrementally deployable. Experiments on a three-controller linear Mininet testbed with 24 hosts over 10 runs show that the method preserves edge-controller performance while reducing the aggregation false positive rate from 8.87% to 1.96% and increasing the F1 score from 89.04% to 96.89%.
