Implementation architecture of mimic security defense based on SDN

Zhen-peng WANG; Hong-chao HU; Guo-zhen CHENG; Chuan-hao ZHANG

doi:10.11959/j.issn.2096-109x.2017.00205

您当前的位置：

首页 >

文章列表页 >

Implementation architecture of mimic security defense based on SDN

Papers | 更新时间：2024-06-03

- Implementation architecture of mimic security defense based on SDN
- Chinese Journal of Network and Information Security Vol. 3, Issue 10, Pages: 52-61(2017)
- 作者机构：
  
  1. 国家数字交换系统工程技术研究中心，河南郑州 450003
  2. 铁道警察学院公安技术系，河南郑州 450053
- 作者简介：
- 基金信息：
- DOI：10.11959/j.issn.2096-109x.2017.00205
  CLC： TP393
- Online First：2017-10，
  
  Published：15 October 2017
- 稿件说明：
移动端阅览
Zhen-peng WANG, Hong-chao HU, Guo-zhen CHENG, et al. Implementation architecture of mimic security defense based on SDN[J]. Chinese Journal of Network and Information Security, 2017, 3(10): 52-61.
DOI：

Zhen-peng WANG, Hong-chao HU, Guo-zhen CHENG, et al. Implementation architecture of mimic security defense based on SDN[J]. Chinese Journal of Network and Information Security, 2017, 3(10): 52-61. DOI： 10.11959/j.issn.2096-109x.2017.00205.

摘要

针对传统防御技术难以应对未知漏洞和后门的问题，拟态安全防御（MSD

mimic security defense）通过构造动态异构冗余模型，提高系统的不确定性，增加攻击者的攻击难度和成本，提升网络安全性能。基于软件定义网络，提出了一种拟态防御的实现架构，首先，按照非相似余度准则构建异构冗余执行体，而后借助软件定义网络的集中管理控制实现动态选调和多模判决等功能。实验验证了架构的入侵容忍能力和可用性。

Abstract

To deal with the attacks employing unknown security vulnerabilities or backdoors which are difficult for traditional defense techniques to eliminate

mimic security defense (MSD) that employs “dynamic

heterogeneity

redundancy (DHR)” mechanism can increase the difficulty and cost of attack and uncertainty of system so as to improve network security.Based on the software defined networking (SDN)

an implementation architecture of MSD was proposed.First

diverse functional equivalent variants for the protected target were constructed

then leverage the rich programmability and flexibility of SDN to realize the dynamic scheduling and decision-making functions on SDN controller.Simulation and experimental results prove the availability and the intrusion tolerant ability of the architecture.

关键词

Keywords

references

VOAS J , GHOSH A , CHARRON F , et al . Reducing uncertainty about common-mode failures [C ] // IEEE Symposium Software Reliability Engineering . 1997 : 308 - 319 .

LEVITIN G . Optimal structure of fault-tolerant software systems [J ] . Reliability Engineering ＆ System Safety , 2005 , 89 ( 3 ): 286 - 295 .

AROMS E . NIST special publication 800-94 guide to intrusion detection and prevention systems (IDPS) [M ] . South Carolina : CreateSpacePress , 2012 .

SPITZNER L , . Honeypots:catching the insider threat [C ] // IEEE Computer Security Applications Conference . 2003 : 170 - 179 .

JANA S , PORTER D E , SHMATIKOV V . TxBox:building secure,efficient sandboxes with system transactions [C ] // IEEE Symposium on Security and Privacy,IEEE Computer Society . 2011 : 329 - 344 .

ZHUANG R , DELOACH S A , OU X . Towards a theory of moving target defense [C ] // ACM Workshop on Moving Target Defense . 2014 : 31 - 40 .

邬江兴 . 网络空间拟态防御研究 [J ] . 信息安全学报 , 2016 , 1 ( 4 ): 1 - 10 .

WU J X . Research on cyber mimic defense [J ] . Journal of Cyber Security , 2016 , 1 ( 4 ): 1 - 10 .

MCKEOWN N , ANDERSON T . OpenFlow:enabling innovation in campus networks [J ] . ACM Sigcomm Computer Communication Review , 2008 , 38 ( 2 ): 69 - 74 .

COX B , EVANS D , FILIPI A , et al . 2006.N-variant systems:a secretless framework for security through diversity [C ] // Usenix Security Symposium . 2006 :9.

KC G S , KEROMYTIS A D , PREVELAKIS V . Countering code-injection attacks with instruction-set randomization [C ] // ACM Conference on Computer and Communications Security . 2003 : 272 - 280 .

HOMESCU A , BRUNTHALER S , LARSEN P , et al . Librando:transparent code randomization for just-in-time compilers [C ] // ACM Sigsac Conference on Computer ＆ Communications Security . 2013 : 993 - 1004 .

BHATKAR S , DUVARNEY D C , SEKAR R . Address obfuscation:an efficient approach to combat a board range of memory error exploits [C ] // Conference on Usenix Security Symposium . 2003 : 105 - 120 .

DUNLOP M , GROAT S , URBANSKI W , et al . Mt6d:a moving target IPv6 defense [C ] // IEEE Military Communications Conference . 2011 : 1321 - 1326 .

JAFARIAN J H , AL-SHAER E , DUAN Q . An effective address mutation approach for disrupting reconnaissance attacks [J ] . IEEE Transactions on Information Forensics and Security , 2015 , 10 ( 12 ): 2562 - 2577 .

JAFARIAN J H , AL-SHAER E , DUAN Q . Adversary-aware IP address randomization for proactive agility against sophisticated attackers [C ] // 2015 IEEE Conference on Computer Communications (Infocom) . 2015 : 738 - 746 .

MAYO J R , TORGERSON M D , WALKER A M , et al . The theory of diversity and redundancy in information system security [R ] . LDRD Final Report , 2010 .

王禛鹏 , 扈红超 , 程国振 . 一种基于拟态安全防御的 DNS 框架设计 [J ] . 电子学报 .

WANG Z P , HU H C , CHENG G Z . A DNS architecture based on mimic security defense [J ] . Chinese Journal of Electronics .

HU H C , WANG Z P , CHENG G Z , et al . MNOS:a mimic network operating system for software defined networks [J ] . IET Information Security , 2017

WANG H , SCHMITT J . Load balancing-towards balanced delay guarantees in NFV/SDN [C ] //IEEE Conference on NFV-SDN 2016:240-245. IEEE Conference on NFV-SDN ,　　　　　　 2016 : 240 - 245 .

CASCONE C , SANVITO D , POLLINI L , et al . Fast failure detection and recovery in SDN with stateful data plane [J ] . International Journal of Network Management , 2016

PANG J , XU G , FU X . SDN-based data center networking with collaboration of multipath TCP and segment routing [J ] . IEEE Access , 2017 ,( 99 ): 1 - 1 .

HAN W , ZHAO Z , AHN G J . HoneyMix:toward SDN-based intelligent honeynet [C ] // ACM International Workshop on Security in Software Defined Networks ＆ Network Function Virtualization . 2016 : 1 - 6 .

JAFARIAN J H , AL-SHAER E , DUAN Q . Openflow random host mutation:transparent moving target defense using software defined networking [C ] // The Workshop on Hot Topics in Software Defined Networks . 2012 : 127 - 132 .

GEMBER-JACOBSON A , VISWANATHAN R , PRAKASH C , et al . OpenNF:enabling innovation in network function control [C ] // ACM Conference on Sigcomm . 2015 : 163 - 174 .

JAFARIAN J H , AL-SHAER E , DUAN Q . Adversary-aware IP address randomization for proactive agility against sophisticated attackers [C ] // Computer Communications(IEEE Infocom) . 2015 :738746.

PORRAS P , SHIN S , YEGNESWARAN V , et al . A security enforcement kernel for OpenFlow networks [C ] // The First Workshop on Hot Topics in Software Defined Networks . 2012 : 121 - 126 .

CHEUNG S , FONG M , PORRAS P , et al . Securing the software-defined network control layer [C ] // Network and Distributed System Security Symposium . 2015 .

SHIN S , SONG Y , LEE T , et al . Rosemary:a robust,secure,and high-performance network operating system [C ] // 2014 ACM SIGSAC Conference on Computer and Communications Security . 2014 : 78 - 89 .

BERDE P , HART J , HART J , et al . ONOS:towards an open,distributed SDN OS [C ] // The Workshop on Hot Topics in Software Defined Networking . 2010 : 1 - 6 .

LI H , LI P , GUO S , et al . Byzantine-resilient secure software defined networks with multiple controllers in cloud [J ] . IEEE Transactions on Cloud Computing , 2015 , 2 ( 4 ): 436 - 447 .

HU H C , WANG Z P , CHENG G Z , et al . MNOS:a mimic network operating system for software defined networks [J ] . IET Information Security , 2017 .

Views

3471

下载量

CSCD

Alert me when the article has been cited

提交

Tools

Publicity Resources

Negative feedback scheduling algorithm based on historical information in SDN

Survey on generalized safety and security technology for system on wafer

Research on active defense application based on honeypot

Secure control plane for SDN using Bayesian Stackelberg games

Related Author

Yingying LYU

Yunfei GUO

Zhenpeng WANG

Guozhen CHENG

Yawen WANG

LI Peijie

GUO Wei

SHEN Jianliang

Related Institution

Information Engineering University

⁰