MALICIOUS ATTACK DETECTION METHOD AND APPARATUS Russian patent published in 2018 - IPC G06F21/55 H04L12/28 

FIELD: active protection devices.

SUBSTANCE: invention relates to a method and a device for detecting a malicious attack. Method includes: receiving, by a controller, a packet-in message sent by a first switch, comprising source host identifier and a destination host identifier of a data packet for which the first switch does not find a flow entry; when determining that a host indicated by the destination host identifier does not exist in an SDN network, sending an abnormal flow entry, which includes the source host identifier, to the first switch; receiving a triggering count from the first switch after the abnormal flow entry times out, the triggering count indicating the number of times that the abnormal flow entry is triggered; determining according to the triggering count, whether a malicious attack is initiated from a source host indicated by the source host identifier.

EFFECT: technical result consists in detecting a malicious attack from a host device with a reduction in the amount of data processing by the software defined networking (SDN) network and improving its performance.

23 cl, 14 dwg, 2 tbl