The distributed denial of service(DDoS) attack detection method in traditional software defined network(SDN) requires frequent communication between the control plane and the data plane, which will lead to significant overhead and delay, and the current programmable data plane can not implement complex detection algorithms, so it is difficult to ensure high detection efficiency. To solve the above problems, this paper proposed a DDoS attack detection method based on programming protocol-independent packet processors(P4) programmable data plane. First of all, the method used the improved information entropy based on P4 as initial detection to determine whether suspicious traffic occurred. Then, it took advantage of the microsecond time required for feature extraction by P4 to extract the six-tuple features of suspicious traffic, and imported them into the data standardization-deep neural network(DS-DNN) reinspection module to determine whether they were DDoS attack traffic. Finally, it tested the evaluation indicators of the method in the real environment. The experimental results show that this method can better detect DDoS attacks in SDN environments, ensure high detection rate and accuracy, effectively reduce the false alarm rate, and shorten the detection time to millisecond level.

[2022-02-16] Accepted Paper /doc/2021.12.0661/v1

[2022-07-05] Printed Article /doc/2021.12.0661/v2