关键词: 软件定义网络, 软件定义安全, 分布式拒绝服务, 策略盒, 动态决策

Abstract: With the rapid development of Internet, the issues of network security become more and more serious. Software Defined Network（SDN） has provided a new solution to solve the security problem in network, such as Software Defined Security（SDS）. Based on the SDS architecture, aiming at the attack features of Distributed Denial of Service（DDoS）, a new DDoS protection mechanism is proposed, namely SDS for DDoS. The protection mechanism contains the advantages of previous detection and protection approaches, atomizes the security services and realizes a security strategy box of multilevel protection. Under the attacks of DDoS, the mechanism can make a dynamic decision according to the detection of attack intensity and barrier the attacks from the beginning, which dose not only increase the credibility of the decision but solves the shortcomings of static protection and posterior type protection. Experimental results demonstrate the feasibility of the mechanism, which can effectively prevent the server from DDoS attacks, and highlight its flexibility in decision and priori under attacks.

Key words: software defined network, software defined security, distributed denial of service, strategy box, dynamic decision