基于贝叶斯−斯坦科尔伯格博弈的SDN安全控制平面模型

卢振平; 陈福才; 程国振

doi:10.11959/j.issn.2096-109x.2017.00211

您当前的位置：

首页 >

文章列表页 >

基于贝叶斯−斯坦科尔伯格博弈的SDN安全控制平面模型

学术论文 | 更新时间：2024-06-03

- 基于贝叶斯−斯坦科尔伯格博弈的SDN安全控制平面模型
- Secure control plane for SDN using Bayesian Stackelberg games
- 网络与信息安全学报 2017年3卷第11期页码：40-49
- 作者机构：
- 作者简介：
  
  [ "卢振平（1992-），男，河南商丘人，国家数字程控交换系统工程技术研究中心硕士生，主要研究方向为软件定义网络、网络先进防御。" ]
  [ "陈福才（1974-），男，江西南昌人，硕士，国家数字程控交换系统工程技术研究中心研究员，主要研究方向为电信网关防、网络安全。" ]
  [ "程国振（1986-），男，山东菏泽人，博士，国家数字程控交换系统工程技术研究中心助理研究员，主要研究方向为云数据中心、软件定义网络、网络安全。" ]
- 基金信息：
  
  国家自然科学基金创新研究群体基金资助项目;The Foundation for Innovative Research Groups of the National Natural Science Foundation of China(61521003);国家重点研发计划项目;The National Key R＆D Program of China(2016YFB0800100);国家重点研发计划项目;The National Key R＆D Program of China(2016YFB0800101);国家自然科学基金资助项目;The National Natural Science Foundation of China(61309020);国家自然科学基金资助项目;The National Science Foundation for Distinguished Young Scholars of China(61602509)
- DOI：10.11959/j.issn.2096-109x.2017.00211
  中图分类号： TP309
- 网络首发：2017-11，
  
  纸质出版：2017-11-15
- 稿件说明：
移动端阅览
卢振平, 陈福才, 程国振. 基于贝叶斯−斯坦科尔伯格博弈的SDN安全控制平面模型[J]. 网络与信息安全学报, 2017,3(11):40-49.

Zhen-ping LU, Fu-cai CHEN, Guo-zhen CHENG. Secure control plane for SDN using Bayesian Stackelberg games[J]. Journal of network and information security, 2017, 3(11): 40-49.
卢振平, 陈福才, 程国振. 基于贝叶斯−斯坦科尔伯格博弈的SDN安全控制平面模型[J]. 网络与信息安全学报, 2017,3(11):40-49. DOI： 10.11959/j.issn.2096-109x.2017.00211.

Zhen-ping LU, Fu-cai CHEN, Guo-zhen CHENG. Secure control plane for SDN using Bayesian Stackelberg games[J]. Journal of network and information security, 2017, 3(11): 40-49. DOI： 10.11959/j.issn.2096-109x.2017.00211.

摘要

提出一种基于动态异构冗余的安全控制平面，通过动态地变换异构的控制器以增加攻击者的难度。首先，提出基于贝叶斯−斯坦科尔伯格博弈模型的控制器动态调度方法，将攻击者和防御者作为博弈参与双方，求得均衡解，进而指导调度策略；其次，引入一种自清洗机制，与博弈策略结合形成闭环的防御机制，进一步地提高了控制层的安全增益；最后，实验定量地描述了基于该博弈策略的安全控制层相比与传统部署单个控制器以及采用随机策略调度控制器的收益增益，并且自清洗机制能够使控制平面一直处于较高的安全水平。

Abstract

A dynamic scheduling controller in SDN control layer was proposed by dynamically transform heteroge-neous controlled in order to increase the difficulty of the attacker.Firstly

a dynamic scheduling method based on Bayesian Stackelberg games the attacker and defender were game participation on both sides

obtained the equili-brium

which guided the scheduling strategy.Secondly

introducing a self-cleaning mechanism

it improved the gain of the control layer security combined with game strategy form closed-loop defense mechanism.The experiments described quantitatively based on the game strategy compared with traditional safety control layer to deploy a single controller and adopt the strategy of random scheduling profit gain of the controller

and self-cleaning mechanism could make the control plane to be in a higher level of security.

关键词

Keywords

references

KREUTZ D , RAMOS F M V , VERISSIMO P . Towards secure and dependable software-defined networks [C ] // ACM SIGCOMM Workshop on Hot Topics in Software Defined Networking . 2013 : 55 - 60 .

SHIN S , SONG Y , LEE T , et al . Rosemary:a robust,secure,and high-performance network operating system [C ] // ACM Conference on Computer and Communications Security . 2014 : 78 - 89 .

LENG J , ZHOU Y , ZHANG J , et al . An inference attack model for flow table capacity and usage:exploiting the vulnerability of flow table overflow in software-defined network [J ] . Water Air ＆ Soil Pollution , 2015 , 85 ( 3 ): 1413 - 1418 .

SONCHACK J , AVIV A J , KELLER E . Timing SDN control planes to infer network configurations [C ] // ACM International Workshop on Security in Software Defined Networks ＆ Network Function Virtualization . 2016 .

LEE S , YOON C , SHIN S . The smaller,the shrewder:a simple malicious application can kill an entire SDN environment [C ] // ACM International Workshop on Security in Software Defined Networks＆ Network Function Virtualization . 2016 .

MORZHOV S , ALEKSEEV I , NIKITINSKIY M . Firewall applica-tion for Floodlight SDN controller [C ] // The International Siberian Conference on Control and Communications . 2016 .

SHIN S , SNOS Y , LEE T , et al . Rosemary:a robust,secure,and high-performance network operating system [J ] . 2014 : 78 - 89 .

TOOTOONCHIAN A , GANJALI Y . HyperFlow:a distributed control plane for OpenFlow [C ] // Internet Network Management Conference on Research on Enterprise Networking . 2010 : 3 .

SHERWOOD R , GIBB G , YAP K K , et al . FlowVisor:a network virtualization layer [J ] . 2009 .

YEGANEH S H , GANJALI Y . Kandoo:a framework for efficient and scalable offloading of control applications [C ] // The Workshop on Hot Topics in Software Defined Networks . 2012 : 19 - 24 .

KOPONEN T , CASADO M , GUDE N , et al . Onix:a distributed control platform for large-scale production networks [C ] // Usenix Symposium on Operating Systems Design and Implementa-tion(OSDI 2010) . 2010 : 351 - 364 .

DIXIT A , FANG H , MUKHERJEE S , et al . Towards an elastic distributed SDN controller [C ] // The 1st Workshop on Hot Topics in Software Defined Networking (HotSDN 2013) . 2013 : 7 - 12 .

BERDE P , GEROLA M ,and HART J , et al . ONOS:towards an open,distributed SDN OS [C ] // The Workshop on Hot Topics in Software Defined Networking . 2014 : 1 - 6 .

LI H , LI P , GUO S , et al . Byzantine-resilient secure software-defined networks with multiple controllers in cloud [C ] // 2014 IEEE International Conference on Communications (ICC 2014) . 2014 : 695 - 700 .

ELDEFRAWY K , KACZMAREK T . Byzantine fault tolerant soft-ware-defined networking (SDN) controllers [C ] // IEEE Computer Society International Conference on Computers,Software ＆ Ap-plications . 2016 : 208 - 213 .

LEE C , SHIN S . SHIELD:an automated framework for static analysis of SDN applications [C ] // ACM International Workshop on Security in Software Defined Networks ＆ Network Function Virtu-alization . 2016 : 29 - 34 .

WILCZEWSKI . Security considerations for equipment controllers and SDN [C ] // 2016 IEEE International Telecommunications Energy Conference (INTELEC) . 2016 : 1 - 5 .

AHMAD I , NAMAL S , YLIANTTILA M , et al . Security in soft-ware defined networks:a survey [J ] . IEEE Communications Sur-veys ＆ Tutorials , 2015 , 17 ( 4 ): 1 .

PORRAS P , SHIN S , YEGNESWARAN V , et al . A security en-forcement kernel for OpenFlow networks [C ] // The First Workshop on Hot Topics in Software Defined Networks . 2012 : 121 - 126 .

SONCHACK J , AVIV A J , KELLER E , et al . Enabling practical software-defined networking security applications with OFX [C ] // Network and Distributed System Security Symposium . 2016 .

MEDVED J , VARGA R , TKACIK A , et al . OpenDaylight:towards a model-driven SDN controller architecture [C ] // IEEE International Symposium on World of Wireless,Mobile and Multimedia Net-works . 2014 : 1 - 6 .

WANG T , LIU F , GUO J , et al . Dynamic SDN controller assign-ment in data center networks:Stable matching with transfers [C ] // IEEE Conference on Computer Communications . 2016 : 1 - 9 .

LU Z P , CHEN F C , et al . Poster:a secure control plane with dynamic multi-NOS for SDN [C ] // NDSS Posters . 2017 .

LEE S , YOON C . DELTA:a security assessment framework for software-defined networks [C ] // Network and Distributed System Security Symposium . 2017 .

KIEKINTVELD C , MARECKI J , TAMBE M . Approximation methods for infinite bayesian stackelberg games:Modeling distri-butional payoff uncertainty [C ] // The 10th International Conference on Autonomous Agents and Multiagent Systems . 2011 : 1005 - 1012 .

PARUCHURI P , PEARCE J P . Playing games for security:an efficient exact algorithm for solving bayesian stackelberg games [C ] // The 7th International Joint Conference on Autonomous Agents and Multiagent Systems (AAMAS'08) . 2008 : 985 - 902 .

DAVID Jorm . 44CON LONDON 2015 Presentations [EB/OL ] . https://44con.com/44con-london-2015/44con-london-2015-presentations/ https://44con.com/44con-london-2015/44con-london-2015-presentations/ .

PITA J , JAIN M , TAMBE M , et al . Robust solutions to stackelberg games:addressing bounded rationality and limited observations in human cognition [J ] . Artificial Intelligence , 2010 , 174 ( 15 ): 1142 - 1171 .

浏览量

2318

下载量

CSCD

文章被引用时，请邮件提醒。

提交

工具集

关联资源

基于博弈的异构控制器云安全策略研究

软件定义网络中控制器调度时间机制设计与实现

面向时延敏感的TRDP安全防护机制

面向软件定义晶上系统的安全多维互连网络

工业互联网蜜网技术综述