软件定义网络下的拟态防御实现架构

王禛鹏; 扈红超; 程国振; 张传浩

doi:10.11959/j.issn.2096-109x.2017.00205

您当前的位置：

首页 >

文章列表页 >

软件定义网络下的拟态防御实现架构

学术论文 | 更新时间：2024-06-03

- 软件定义网络下的拟态防御实现架构
- Implementation architecture of mimic security defense based on SDN
- 网络与信息安全学报 2017年3卷第10期页码：52-61
- 作者机构：
  
  1. 国家数字交换系统工程技术研究中心，河南郑州 450003
  2. 铁道警察学院公安技术系，河南郑州 450053
- 作者简介：
  
  [ "王禛鹏（1993-），男，湖北黄冈人，国家数字交换系统工程技术研究中心硕士生，主要研究方向为拟态安全防御。" ]
  [ "扈红超（1982-），男，河南商丘人，国家数字交换系统工程技术研究中心副研究员，主要研究方向为网络安全防御和新型网络体系结构。" ]
  [ "程国振（1986-），男，山东菏泽人，国家数字交换系统工程技术研究中心助理研究员，主要研究方向为主动防御技术和SDN安全。" ]
  [ "张传浩（1979-），男，河南郑州人，铁道警察学院讲师，主要研究方向为网络安全。" ]
- 基金信息：
  
  国家自然科学基金资助项目;The National Natural Science Foundation of China(61309020);国家自然科学基金资助项目;The National Science Foundation for Distinguished Young Scholars of China(61602509);国家自然科学基金创新研究群体基金资助项目;The Foundation for Innovative Research Groups of the National Natural Science Foundation of China(61521003);国家重点研发计划项目;The National Key R＆D Program of China(2016YFB0800100);国家重点研发计划项目;The National Key R＆D Program of China(2016YFB0800101);河南省科技攻关计划项目;The Science and Technology Research Project of Henan Province(172102210615);河南省科技攻关基金资助项目;The Key Technologies Research and Development Program of Henan Province of China(172102210441)
- DOI：10.11959/j.issn.2096-109x.2017.00205
  中图分类号： TP393
- 网络首发：2017-10，
  
  纸质出版：2017-10-15
- 稿件说明：
移动端阅览
王禛鹏, 扈红超, 程国振, 等. 软件定义网络下的拟态防御实现架构[J]. 网络与信息安全学报, 2017,3(10):52-61.

Zhen-peng WANG, Hong-chao HU, Guo-zhen CHENG, et al. Implementation architecture of mimic security defense based on SDN[J]. Chinese Journal of Network and Information Security, 2017, 3(10): 52-61.
王禛鹏, 扈红超, 程国振, 等. 软件定义网络下的拟态防御实现架构[J]. 网络与信息安全学报, 2017,3(10):52-61. DOI： 10.11959/j.issn.2096-109x.2017.00205.

Zhen-peng WANG, Hong-chao HU, Guo-zhen CHENG, et al. Implementation architecture of mimic security defense based on SDN[J]. Chinese Journal of Network and Information Security, 2017, 3(10): 52-61. DOI： 10.11959/j.issn.2096-109x.2017.00205.

摘要

针对传统防御技术难以应对未知漏洞和后门的问题，拟态安全防御（MSD

mimic security defense）通过构造动态异构冗余模型，提高系统的不确定性，增加攻击者的攻击难度和成本，提升网络安全性能。基于软件定义网络，提出了一种拟态防御的实现架构，首先，按照非相似余度准则构建异构冗余执行体，而后借助软件定义网络的集中管理控制实现动态选调和多模判决等功能。实验验证了架构的入侵容忍能力和可用性。

Abstract

To deal with the attacks employing unknown security vulnerabilities or backdoors which are difficult for traditional defense techniques to eliminate

mimic security defense (MSD) that employs “dynamic

heterogeneity

redundancy (DHR)” mechanism can increase the difficulty and cost of attack and uncertainty of system so as to improve network security.Based on the software defined networking (SDN)

an implementation architecture of MSD was proposed.First

diverse functional equivalent variants for the protected target were constructed

then leverage the rich programmability and flexibility of SDN to realize the dynamic scheduling and decision-making functions on SDN controller.Simulation and experimental results prove the availability and the intrusion tolerant ability of the architecture.

关键词

Keywords

references

VOAS J , GHOSH A , CHARRON F , et al . Reducing uncertainty about common-mode failures [C ] // IEEE Symposium Software Reliability Engineering . 1997 : 308 - 319 .

LEVITIN G . Optimal structure of fault-tolerant software systems [J ] . Reliability Engineering ＆ System Safety , 2005 , 89 ( 3 ): 286 - 295 .

AROMS E . NIST special publication 800-94 guide to intrusion detection and prevention systems (IDPS) [M ] . South Carolina : CreateSpacePress , 2012 .

SPITZNER L , . Honeypots:catching the insider threat [C ] // IEEE Computer Security Applications Conference . 2003 : 170 - 179 .

JANA S , PORTER D E , SHMATIKOV V . TxBox:building secure,efficient sandboxes with system transactions [C ] // IEEE Symposium on Security and Privacy,IEEE Computer Society . 2011 : 329 - 344 .

ZHUANG R , DELOACH S A , OU X . Towards a theory of moving target defense [C ] // ACM Workshop on Moving Target Defense . 2014 : 31 - 40 .

邬江兴 . 网络空间拟态防御研究 [J ] . 信息安全学报 , 2016 , 1 ( 4 ): 1 - 10 .

WU J X . Research on cyber mimic defense [J ] . Journal of Cyber Security , 2016 , 1 ( 4 ): 1 - 10 .

MCKEOWN N , ANDERSON T . OpenFlow:enabling innovation in campus networks [J ] . ACM Sigcomm Computer Communication Review , 2008 , 38 ( 2 ): 69 - 74 .

COX B , EVANS D , FILIPI A , et al . 2006.N-variant systems:a secretless framework for security through diversity [C ] // Usenix Security Symposium . 2006 :9.

KC G S , KEROMYTIS A D , PREVELAKIS V . Countering code-injection attacks with instruction-set randomization [C ] // ACM Conference on Computer and Communications Security . 2003 : 272 - 280 .

HOMESCU A , BRUNTHALER S , LARSEN P , et al . Librando:transparent code randomization for just-in-time compilers [C ] // ACM Sigsac Conference on Computer ＆ Communications Security . 2013 : 993 - 1004 .

BHATKAR S , DUVARNEY D C , SEKAR R . Address obfuscation:an efficient approach to combat a board range of memory error exploits [C ] // Conference on Usenix Security Symposium . 2003 : 105 - 120 .

DUNLOP M , GROAT S , URBANSKI W , et al . Mt6d:a moving target IPv6 defense [C ] // IEEE Military Communications Conference . 2011 : 1321 - 1326 .

JAFARIAN J H , AL-SHAER E , DUAN Q . An effective address mutation approach for disrupting reconnaissance attacks [J ] . IEEE Transactions on Information Forensics and Security , 2015 , 10 ( 12 ): 2562 - 2577 .

JAFARIAN J H , AL-SHAER E , DUAN Q . Adversary-aware IP address randomization for proactive agility against sophisticated attackers [C ] // 2015 IEEE Conference on Computer Communications (Infocom) . 2015 : 738 - 746 .

MAYO J R , TORGERSON M D , WALKER A M , et al . The theory of diversity and redundancy in information system security [R ] . LDRD Final Report , 2010 .

王禛鹏 , 扈红超 , 程国振 . 一种基于拟态安全防御的 DNS 框架设计 [J ] . 电子学报 .

WANG Z P , HU H C , CHENG G Z . A DNS architecture based on mimic security defense [J ] . Chinese Journal of Electronics .

HU H C , WANG Z P , CHENG G Z , et al . MNOS:a mimic network operating system for software defined networks [J ] . IET Information Security , 2017

WANG H , SCHMITT J . Load balancing-towards balanced delay guarantees in NFV/SDN [C ] //IEEE Conference on NFV-SDN 2016:240-245. IEEE Conference on NFV-SDN ,　　　　　　 2016 : 240 - 245 .

CASCONE C , SANVITO D , POLLINI L , et al . Fast failure detection and recovery in SDN with stateful data plane [J ] . International Journal of Network Management , 2016

PANG J , XU G , FU X . SDN-based data center networking with collaboration of multipath TCP and segment routing [J ] . IEEE Access , 2017 ,( 99 ): 1 - 1 .

HAN W , ZHAO Z , AHN G J . HoneyMix:toward SDN-based intelligent honeynet [C ] // ACM International Workshop on Security in Software Defined Networks ＆ Network Function Virtualization . 2016 : 1 - 6 .

JAFARIAN J H , AL-SHAER E , DUAN Q . Openflow random host mutation:transparent moving target defense using software defined networking [C ] // The Workshop on Hot Topics in Software Defined Networks . 2012 : 127 - 132 .

GEMBER-JACOBSON A , VISWANATHAN R , PRAKASH C , et al . OpenNF:enabling innovation in network function control [C ] // ACM Conference on Sigcomm . 2015 : 163 - 174 .

JAFARIAN J H , AL-SHAER E , DUAN Q . Adversary-aware IP address randomization for proactive agility against sophisticated attackers [C ] // Computer Communications(IEEE Infocom) . 2015 :738746.

PORRAS P , SHIN S , YEGNESWARAN V , et al . A security enforcement kernel for OpenFlow networks [C ] // The First Workshop on Hot Topics in Software Defined Networks . 2012 : 121 - 126 .

CHEUNG S , FONG M , PORRAS P , et al . Securing the software-defined network control layer [C ] // Network and Distributed System Security Symposium . 2015 .

SHIN S , SONG Y , LEE T , et al . Rosemary:a robust,secure,and high-performance network operating system [C ] // 2014 ACM SIGSAC Conference on Computer and Communications Security . 2014 : 78 - 89 .

BERDE P , HART J , HART J , et al . ONOS:towards an open,distributed SDN OS [C ] // The Workshop on Hot Topics in Software Defined Networking . 2010 : 1 - 6 .

LI H , LI P , GUO S , et al . Byzantine-resilient secure software defined networks with multiple controllers in cloud [J ] . IEEE Transactions on Cloud Computing , 2015 , 2 ( 4 ): 436 - 447 .

HU H C , WANG Z P , CHENG G Z , et al . MNOS:a mimic network operating system for software defined networks [J ] . IET Information Security , 2017 .

浏览量

3471

下载量

CSCD

文章被引用时，请邮件提醒。

提交

工具集

关联资源

SDN中基于历史信息的负反馈调度算法

晶上系统广义功能安全技术研究综述

基于蜜罐的主动防御应用研究

基于贝叶斯−斯坦科尔伯格博弈的SDN安全控制平面模型