关键词: 软件定义网络, 网络安全, SDN 控制器, 拓扑攻击

Abstract: A SDN topology attack defense mechanism———PolicyTopo was proposed in order to protect the view se-curity of the controller in software-defined networking (SDN)，especially the global view integrity in the context of network link state changes． This mechanism introduces information entropy theory to build a model to verify the change of network link delay，and at the same time defines the security of data device ports． It also solves the de-fense problem of topology attacks under network state changes while defending against traditional topology attacks．PolicyTopo was deployed both on the virtual environment and the physical experiment platform，and the offensive and defensive tests were carried out based on Floodlight． The results show that PolicyTopo can dynamically and ef-fectively protect the topology integrity during network state changes and improve the security of the global view of the network． Compared with other mainstream defense mechanisms，this mechanism can largely reduce the cost of network resource and improve the security，flexibility and scalability of the network．

Key words: software-defined networking, cyber security, SDN controller, topology attack