Network function heterogeneous redundancy deployment method based on immune algorithm

Qingqing ZHANG; Hongbo TANG; Wei YOU; Yingle LI

doi:10.11959/j.issn.2096-109x.2021005

您当前的位置：

首页 >

文章列表页 >

Network function heterogeneous redundancy deployment method based on immune algorithm

Topic Ⅰ: Security Architecture Applications of Novel Network | 更新时间：2024-06-03

- Network function heterogeneous redundancy deployment method based on immune algorithm
- Chinese Journal of Network and Information Security Vol. 7, Issue 1, Pages: 46-56(2021)
- 作者机构：
- 作者简介：
- 基金信息：
- DOI：10.11959/j.issn.2096-109x.2021005
  CLC： TP393
- Online First：2021-02，
  
  Published：15 February 2021
- 稿件说明：
移动端阅览
Qingqing ZHANG, Hongbo TANG, Wei YOU, et al. Network function heterogeneous redundancy deployment method based on immune algorithm[J]. Chinese Journal of Network and Information Security, 2021, 7(1): 46-56.
DOI：

Qingqing ZHANG, Hongbo TANG, Wei YOU, et al. Network function heterogeneous redundancy deployment method based on immune algorithm[J]. Chinese Journal of Network and Information Security, 2021, 7(1): 46-56. DOI： 10.11959/j.issn.2096-109x.2021005.

摘要

针对现有安全防御手段无法抵御网络功能虚拟化平台中众多未知的漏洞与后门的问题。运用拟态防御思想，提出一种网络功能虚拟化的拟态防御架构，并针对其中的异构体池构建问题设计了一种基于免疫算法的网络功能异构冗余部署方法。首先，结合熵值法对异构体之间的异构度进行量化评估；然后，以实现异构体之间异构度最大为优化目标将网络功能异构冗余部署问题构建成极大极小问题；最后，基于免疫算法快速求解最优部署方案。仿真结果表明，该方法可以迅速收敛到最优部署方案，并保证异构体之间的异构度值整体分布在较高的水平，有效增加了异构体池的多样性，提升了攻击者的攻击难度。

Abstract

Aiming at the problem that the existing security defense methods cannot resist many unknown vulnerabilities and backdoors in the network function virtualization platform

a mimic defense architecture for network function virtualization using mimic defense ideas was proposed

a heterogeneous redundant deployment method based on an immune algorithm for the construction of heterogeneous pools was proposed.Firstly

the degree of heterogeneity between heterogeneous entities was quantitatively evaluated in combination with the entropy value method

then the network function heterogeneous redundant deployment problem was constructed into a minimax problem with the optimization goal of maximizing the degree of heterogeneity between heterogeneous entities

and finally the immune algorithm was used to quickly solve the optimal deployment solution of network functions.Simulation results show that the proposed method can quickly converge to an optimal deployment scheme and ensure that the overall distribution of heterogeneity between heterogeneous bodies is at a high level

effectively increasing the diversity between heterogeneous bodies and improving the attacker's difficulty.

关键词

Keywords

references

刘宇涛 , 陈海波 . 虚拟化安全:机遇,挑战与未来 [J ] . 网络与信息安全学报 , 2016 , 2 ( 10 ): 17 - 28 .

LIU Y T , CHEN H B . Virtualization security:the good,the bad and the ugly [J ] . Chinese Journal of Network and Information Security , 2016 , 2 ( 10 ): 17 - 28 .

LAL S , TALEB T , DUTTA A . NFV:security threats and best practices [J ] . IEEE Communications Magazine , 2017 , 55 ( 8 ): 211 - 217 .

高丽华 , 董飞 , 任新宇 , 等 . NFV网络的安全威胁及防护方案探讨 [C ] // 5G网络创新研讨会(2018)论文集 . 2018 .

GAO L H , DONG F , REN X Y , et al . Discussion on NFV network security threats and protection schemes [C ] // Proceedings of 5G Network Innovation Seminar (2018) . 2018 .

吴宏建 , 张如意 , 芦玥 . NFV安全风险分析及应对建议 [J ] . 信息通信技术与政策 , 2018 , 293 ( 11 ): 75 - 79 .

WU H J , ZHANG R Y , LU Y . Analysis of NFV risks and protection concerns [J ] . Information and Communication Technology and Policy , 2018 , 293 ( 11 ): 75 - 79 .

潘启润 , 黄开枝 , 游伟 . 基于隔离等级的网络切片部署方法 [J ] . 网络与信息安全学报 , 2020 , 6 ( 2 ): 96 - 105 .

PAN Q R , HUANG K Z , YOU W . Network slicing deployment method based on isolation level [J ] . Chinese Journal of Network and Information Security , 2020 , 6 ( 2 ): 96 - 105 .

CHRISTOPHER D C , RALPH E W . Firewall system for protecting network elements connected to a public network [S ] . US , 2020 .

LI G X , GAO W M . Research on network security system based on intrusion detection [C ] // IEEE International Conference on E-business＆ E-government . 2010 : 2096 - 2100 .

邬江兴 . 网络空间拟态防御研究 [J ] . 信息安全学报 , 2016 , 1 ( 4 ): 1 - 10 .

WU J X . Research on cyber mimic defense [J ] . Journal of Cyber Security , 2016 , 1 ( 4 ): 1 - 10 .

张晨 , 黄韬 , 张娇 , 等 . 网络编排技术进展研究 [J ] . 信息通信技术 , 2016 ( 1 ): 68 - 76 .

ZHANG C , HUANG T , ZHANG J , et al . A technology research of network orchestration [J ] . Information and Communications Technologies , 2016 ( 1 ): 68 - 76 .

ETSI Network function virtualization:architectural framework [EB ] .

马海龙 , 伊鹏 , 江逸茗 , 等 . 基于动态异构冗余机制的路由器拟态防御体系结构 [J ] . 信息安全学报 , 2017 , 2 ( 1 ): 29 - 42 .

MA H L , YI P , JIANG Y M , et al . Dynamic heterogeneous redundancy based router architecture with mimic defenses [J ] . Journal of Cyber Security , 2017 , 2 ( 1 ): 29 - 42 .

仝青 , 张铮 , 张为华 , 等 . 拟态防御 Web 服务器设计与实现 [J ] . 软件学报 , 2017 , 28 ( 4 ): 883 - 897 .

TONG Q , ZHANG Z , ZHANG W H , et al . Design and implementation of mimic defense web server [J ] . Journal of Software , 2017 , 28 ( 4 ): 883 - 897 .

王禛鹏 , 扈红超 , 程国振 . 一种基于拟态安全防御的 DNS 框架设计 [J ] . 电子学报 , 2017 , 45 ( 11 ): 2705 - 2714 .

WANGZ P , HU H C , CHENG G Z . A DNS architecture based onmimic security defense [J ] . Acta Electronica Sinica , 2017 , 45 ( 11 ): 2705 - 2714 .

魏帅 , 于洪 , 顾泽宇 , 等 . 面向工控领域的拟态安全处理机架构 [J ] . 信息安全学报 , 2017 , 2 ( 1 ): 54 - 73 .

WEI S , YU H , GU Z Y , et al . Mimic security processor architecture oriented to the industrial control field [J ] . Journal of Cyber Security , 2017 , 2 ( 1 ): 54 - 73 .

刘勤让 , 林森杰 , 顾泽宇 . 面向拟态安全防御的异构功能等价体调度算法 [J ] . 通信学报 , 2018 , 373 ( 7 ): 192 - 202 .

LIU Q R , LIN S J , GU Z Y . Heterogeneous redundancies scheduling algorithm for mimic security defense [J ] . Journal on Communications , 2018 , 373 ( 7 ): 192 - 202 .

李亮 . 评价中权系数理论与方法比较 [D ] . 上海:上海交通大学 , 2009 .

LI L . Weights theory and weighting methods comparison in the evaluation [D ] . Shanghai:Shanghai Jiao Tong University , 2009 .

公茂果 , 焦李成 , 杨咚咚 , 等 . 进化多目标优化算法研究 [J ] . 软件学报 , 2009 , 20 ( 2 ): 271 - 289 .

GONG M G , JIAO L C , YANG D D , et al . Research on evolutionary multi-objective optimization algorithms [J ] . Journal of Software , 2009 , 20 ( 2 ): 271 - 289 .

DEB K . Multi-objective optimization [M ] // Search Methodologies . Brlim : Springer , 2014 : 403 - 449 .

金中 . 最优化算法中极小极大问题的教学思考 [J ] . 创新教育研究 , 2019 , 7 ( 5 ): 628 - 634 .

JIN Z . Teaching thoughts on minimax problems in optimization algorithms [J ] . Innovation Education Research , 2019 , 7 ( 5 ): 628 - 634 .

KHEBBACHE S , HADJI M , ZEGHLACHE D . Scalable and cost-efficient algorithms for VNF chaining and placement problem [C ] // IEEE Conference Innovations in Cloud . 2017 : 92 - 99 .

赵雨 . 一类求解无约束极大极小问题的新算法 [D ] . 西安:西安科技大学 , 2011 .

ZHAO Y . An efficient method for solving nonlinear unconstrained min-max problem [D ] . Xi'an:Xi'an University of Science and Technology , 2011 .

焦李成 , 杜海峰 . 人工免疫系统进展与展望 [J ] . 电子学报 , 2003 ( 10 ): 1540 - 1548 .

JIAO L C , DU H F . Development and prospect of the artificial immune system [J ] . Acta Electronica Sinica , 2003 ( 10 ): 1540 - 1548 .

TWU P , MOSTOFI Y , EGERSTEDT M . A measure of heterogeneity in multi-agent systems [C ] // IEEE 2014 American Control Conference . 2014 : 3972 - 3977 .

RAOC R . Diversity and dissimilarity coefficients:a unified approach [J ] . theoretical population biology , 1982 , 21 ( 1 ): 30 - 43 .

Views

400

下载量

CSCD

Alert me when the article has been cited

提交

Tools

Publicity Resources

Security protection method based on mimic defense and Paillier encryption for smart IoT terminals

Design and analysis of intelligent service chain system for network security resource pool

Verification on policies for network functions in SDN/NFV-based environment

Large-scale resource state monitoring strategy in network function virtualization environment

New collaborative DDoS defense technology based on NFV

Related Author

JI Yimu

LIU Shangdong

SHI Yuchen

ZHENG Yulu

JI Zongkai

NIE Yijun

SHAO Sisi

ZENG Fukang

Related Institution

School of Computer Science, Nanjing University of Posts and Telecommunications

School of Internet of Things, Nanjing University of Posts and Telecommunications

Institute of High Performance Computing and Big Data Processing, Nanjing University of Posts and Telecommunications

National High Performance Computing Center Nanjing Branch

Purple Mountain Laboratories

⁰