Design and analysis of intelligent service chain system for network security resource pool

Zenan WANG; Jiahao LI; Chaohong TAN; Dechang PI

doi:10.11959/j.issn.2096-109x.2022051

您当前的位置：

首页 >

文章列表页 >

Design and analysis of intelligent service chain system for network security resource pool

Papers | 更新时间：2024-06-03

- Design and analysis of intelligent service chain system for network security resource pool
- Chinese Journal of Network and Information Security Vol. 8, Issue 4, Pages: 175-181(2022)
- 作者机构：
  
  1. 网络通信与安全紫金山实验室，江苏南京 211100
  2. 南京航空航天大学，江苏南京 211100
  3. 江苏省未来网络创新研究院，江苏南京 211100
- 作者简介：
- 基金信息：
- DOI：10.11959/j.issn.2096-109x.2022051
  CLC： TP393
- Online First：2022-08，
  
  Published：15 August 2022
- 稿件说明：
移动端阅览
Zenan WANG, Jiahao LI, Chaohong TAN, et al. Design and analysis of intelligent service chain system for network security resource pool[J]. Chinese Journal of Network and Information Security, 2022, 8(4): 175-181.
DOI：

Zenan WANG, Jiahao LI, Chaohong TAN, et al. Design and analysis of intelligent service chain system for network security resource pool[J]. Chinese Journal of Network and Information Security, 2022, 8(4): 175-181. DOI： 10.11959/j.issn.2096-109x.2022051.

摘要

传统网络安全架构通过将流量引导经过硬件形式的网络安全功能设备来保障网络安全，该架构由形式固定的硬件组成，导致网络安全区域部署形式单一，可扩展性较差，在面对网络安全事件时无法灵活地做出调整，难以满足未来网络的安全需求。面向网络安全资源池的智能服务链系统基于软件定义网络与网络功能虚拟化技术，能够有效解决上述问题。基于网络功能虚拟化技术新增虚拟形式的网络安全功能网元，结合已有的硬件网元构建虚实结合的网络安全资源池，并基于软件定义网络技术实现对连接网元的交换设备的灵活控制，从而构建可动态调节的网络安全服务链；基于安全日志检测与安全规则专家库实现对网络安全事件的检测与生成对应的响应方案，从而能够在面对网络安全事件时通过集中式控制的方式实现服务链的动态智能调节；对服务链的部署过程进行数学建模并设计了一种启发式的服务链优化编排算法，实现服务链的优化部署。通过搭建原型系统并进行实验，结果表明，所设计系统能够在面对安全事件时在秒级时间内完成安全事件的检测，并能够在分钟级时间内完成对安全服务链的自动调整，所设计的服务链优化部署算法能够将服务链对虚拟安全资源池中资源的占用降低 65%。所设计系统有望运用于园区与数据中心网络出口处的网络安全区域，简化该区域的运维并提高该区域的部署灵活度。

Abstract

The traditional network security architecture ensures network security by directing traffic through hardware based network security function devices.Since the architecture consists of fixed hardware devices

it leads to a single form of network security area deployment and poor scalability.Besides

the architecture cannot be flexibly adjusted when facing network security events

making it difficult to meet the security needs of future networks.The intelligent service chain system for network security resource pool was based on software-defined network and network function virtualization technologies

which can effectively solve the above problems.Network security functions of virtual form were added based on network function virtualization technology

combined with the existing hardware network elements to build a network security resource pool.In addition

the switching equipment connected to the network security elements can be flexibly controlled based on software-defined network technology.Then a dynamically adjustable network security service chain was built.Network security events were detected based on security log detection and a expert library consisting of security rules.This enabled dynamic and intelligent regulation of the service chain by means of centralized control in the face of network security events.The deployment process of the service chain was mathematically modeled and a heuristic algorithm was designed to realize the optimal deployment of the service chain.By building a prototype system and conducting experiments

the results show that the designed system can detect security events in seconds and automatically adjust the security service chain in minutes when facing security events

and the designed heuristic algorithm can reduce the occupation of virtual resources by 65%.The proposed system is expected to be applied to the network security area at the exit of the campus and data center network

simplifying the operation and maintenance of this area and improving the deployment flexibility of this area.

关键词

Keywords

references

ZHANG X S , CHENG X Z , LI H B , et al . Security service chain based on sdn＆nfv construction technology [C ] // Signal and Information Processing,Networking and Computers.Lecture Notes in Electrical Engineering,vol 628 . 2020 .p. 840 - 848 .

ZHU S , ZHOU C , WANG C . Security service function chain based on software-defined security [J ] . Journal of Physics:Conference Series,2021 . 2010 ( 1 ): 12083 .

KRISHNAN P , DUTTAGUPTA S , ACHUTHAN K . SDN/NFV security framework for fog to things computing infrastructure [J ] . Software:Practice and Experience , 2020 , 50 ( 5 ): 757 - 800 .

CHIOSI M , CLARKE D , WILLIS P , et al . Network functions virtualisation introductory white paper [R ] . SDN and OpenFlow World Congress , 2012 .

MCKEOWN N , ANDERSON T , BALAKRISHNAN H , et al . OpenFlow:Enabling innovation in campus networks [J ] . ACM SIGCOMM Computer Communication Review , 2008 , 38 ( 2 ): 69 - 74 .

LINA Z , DONGZHAO Z . A new network security architecture based on SDN/NFV technology [C ] // 2020 International Conference on Computer Engineering and Application (ICCEA) . IEEE , 2020 : 669 - 675 .

SANTOS G L , BEZERRA D F , ROCHA E S , et al . Service function chain placement in distributed scenarios:a systematic review [J ] . Journal of Network and Systems Management , 2022 , 30 ( 1 ): 1 - 39 .

CHEN W , WANG Z , ZHANG H , et al . Cost-efficient dynamic service function chain embedding in edge clouds [C ] // 2021 17th International Conference on Network and Service Management (CNSM) . IEEE , 2021 : 310 - 318 .

SHIN S , PORRAS P , YEGNESWARAN V , et al . FRESCO:modular composable security services for soft-ware-defined networks [C ] // Proceedings of the 20th Annual Network and Distributed System Security Symposium . 2013 .

LIU Y P , GUO Z G , SHOU G C , et al . To achieve a security service chain by integration of NFV and SDN [C ] // 2016 Sixth International Conference on Instrumentation ＆ Measurement,Computer,Communication and Control (IMCCC) . 2016 : 974 - 977 .

MARTINI B , PAGANELLI F , MOHAMMED A A , et al . SDN controller for context-aware data delivery in dynamic service chaining [C ] // Proceedings 1st IEEE Conference on Network Softwarization , 2015 : 1 - 5 .

GIOTIS K , KRYFTIS Y , MAGLARIS V . Policy-based orchestration of NFV services in software-defined networks [C ] // Proceedings of the 1st IEEE Conference on Network Softwarization . 2015 . 1 - 5 .

QAZI Z A , TU C C , CHIANG L , et al . SIMPLE-fying middlebox policy enforcement using SDN [C ] // Proceedings of the ACMSIGCOMM 2013 . 2013 . 27 - 38 .

IFFLANDER L , WALTER J , EISMANN S , et al . The ¨Vision of self-aware reordering of security network function Chains [C ] // Companion of the 2018 ACM/SPEC International Conference on Performance Engineering . 2018 .

刘宇涛 , 陈海波 . 虚拟化安全：机遇,挑战与未来 [J ] . 网络与信息安全学报 , 2016 , 2 ( 10 ): 17 - 28 .

LIU Y T , CHEN H B . Virtualization security:the good,the bad and the ugly [J ] . Chinese Journal of Network and Information Security , 2016 , 2 ( 10 ): 17 - 28 .

LI B , CHENG B , LIU X , et al . Joint resource optimization and delay-aware virtual network function migration in data center networks [J ] . IEEE Transactions on Network and Service Management , 2021 , 18 ( 3 ): 2960 - 2974 .

CERRATO I , ANNARUMMA M , RISSO F . Supporting fine-grained network functions through Intel DPDK [C ] // 2014 Third European Workshop on Software Defined Networks . 2014 : 1 - 6 .

MAHDAVIFAR S , GHORBANI A A . DeNNeS:deep embedded neural network expert system for detecting cyber attacks [J ] . Neural Computing and Applications , 2020 , 32 ( 18 ): 14753 - 14780 .

LIU Y , LU Y , LI X , et al . On dynamic service function chain reconfiguration in IoT networks [J ] . IEEE Internet of Things Journal , 2020 , 7 ( 11 ): 10969 - 10984 .

谢记超 , 伊鹏 , 张震 , 等 . 基于异构备份与重映射的服务功能链部署方案 [J ] . 网络与信息安全学报 , 2018 , 4 ( 6 ): 23 - 35 .

XIE J C , YI P , ZHANG Z , et al . Service function chain deployment scheme based on heterogeneous backup and remapping [J ] . Chinese Journal of Network and Information Security , 2018 , 4 ( 6 ): 23 - 35 .

HUANG M , LUO W , WAN X . Research on Network Security of Campus Network [C ] // Journal of Physics:Conference Series . IOP Publishing,2019 , 1187 ( 4 ): 042113 .

Views

267

下载量

CSCD

Alert me when the article has been cited

提交

Tools

Publicity Resources

Verification on policies for network functions in SDN/NFV-based environment

Network function heterogeneous redundancy deployment method based on immune algorithm

Large-scale resource state monitoring strategy in network function virtualization environment

New collaborative DDoS defense technology based on NFV

Related Author

Haoyu CHEN

Deqing ZOU

Hai JIN

Qingqing ZHANG

Hongbo TANG

Wei YOU

Yingle LI

Meisheng HAI

Related Institution

National Engineering Research Center for Big Data Technology and System, School of Computer Science and Technology, Huazhong University of Science and Technology

Services Computing Technology and System Lab, School of Computer Science and Technology, Huazhong University of Science and Technology

Cluster and Grid Computing Lab, School of Computer Science and Technology, Huazhong University of Science and Technology

Hubei Engineering Research Center on Big Data Security, School of Cyber Science and Engineering, Huazhong University of Science and Technology

School of Mathematics and Computer Science,Fujian Normal University

⁰