SDN中基于MS-KNN算法的LFA攻击检测方法

bstarct: To address the problem that a new type of DDoS attack, link-flooding attack (LFA) , is difficult to detect, an LFA detection method based on MS-KNN (Mean Shift-K-NearestNeighbor) method in SDN is proposed. Firstly, this paper simulated LFA and constructed LFA dataset by building an SDN experiment platform; secondly, an improved weighted Euclidean distance mean shift (MS) algorithm was used to classify the LFA dataset; finally, the K-nearestneighbor (KNN) algorithm was used to determine whether LFA data were included in the classification results. The experimental results show that the use of MS-KNN not only obtains a higher accuracy rate but also a lower false positive rate compared with the KNN algorithm.