Research on detection techniques for scanning attacks in software-defined network environments

Cybersecurity incidents continue to plague digital life. Attackers planning to compromise a network or system often use methods such as scanning attacks to obtain valid attack information in advance, thus increasing the probability of a successful network attack. In response to this problem, the high flexibility of new architectures for software-defined networks and the OpenFlow protocoOpenFlowrovided some statistical information about network traffic in recent years. This method allows traffic to be monitored through switches that support the OpenFlow protocol and enables faster port scan detection than traditional methods of collecting periodic statistics, which can be used to detect malicious traffic activity. In this paper, we delve into the statistical rules of traffic in Openflow networks, develop and implement a traffic detection method based on port scanning in Openflow networks, establish an information entropy-based inspection mechanism, and use a mixture of two conventional traffic models and anomalous traffic for access. The experimental results show that the method can effectively and reasonably detect slow scanning attacks as well as improve the accuracy of identifying abnormal traffic.