面向SDN的移动目标防御技术研究进展

谭晶磊; 张红旗; 雷程; 刘小虎; 王硕

doi:10.11959/j.issn.2096-109x.2018061

您当前的位置：

首页 >

文章列表页 >

面向SDN的移动目标防御技术研究进展

综述 | 更新时间：2024-06-03

- 面向SDN的移动目标防御技术研究进展
- Research progress on moving target defense for SDN
- 网络与信息安全学报 2018年4卷第7期页码：1-12
- 作者机构：
  
  1. 信息工程大学密码工程学院，河南郑州 450001
  2. 河南省信息安全重点实验室，河南郑州 450001
- 作者简介：
  
  [ "谭晶磊（1994-），男，山东章丘人，信息工程大学研究生，主要研究方向为网络信息安全、移动目标防御。" ]
  [ "张红旗（1962-），男，河北遵化人，信息工程大学教授、博士生导师，主要研究方向为网络安全、移动目标防御、等级保护和信息安全管理。" ]
  [ "雷程（1989-），男，北京人，信息工程大学博士生，主要研究方向为网络信息安全、移动目标防御、数据安全交换和网络流指纹。" ]
  [ "刘小虎（1989-），男，河南太康人，信息工程大学讲师，主要研究方向为动态网络防御。" ]
  [ "王硕（1991-），男，河南南阳人，信息工程大学博士生，主要研究方向为网络系统安全。" ]
- 基金信息：
  
  国家高技术研究发展计划（“863”计划）基金资助项目;The National High Technology Research and Development Program of China (863 Program)(2012AA012704);国家高技术研究发展计划基金资助项目;The National High Technology Research and Development Program of China(2015AA7116040);郑州市科技领军人才基金资助项目;Zhengzhou Science and Technology Leader Project(131PLJRC644)
- DOI：10.11959/j.issn.2096-109x.2018061
  中图分类号： TP393
- 网络首发：2018-07，
  
  纸质出版：2018-07-15
- 稿件说明：
移动端阅览
谭晶磊, 张红旗, 雷程, 等. 面向SDN的移动目标防御技术研究进展[J]. 网络与信息安全学报, 2018,4(7):1-12.

Jinglei TAN, Hongqi ZHANG, Cheng LEI, et al. Research progress on moving target defense for SDN[J]. Chinese Journal of Network and Information Security, 2018, 4(7): 1-12.
谭晶磊, 张红旗, 雷程, 等. 面向SDN的移动目标防御技术研究进展[J]. 网络与信息安全学报, 2018,4(7):1-12. DOI： 10.11959/j.issn.2096-109x.2018061.

Jinglei TAN, Hongqi ZHANG, Cheng LEI, et al. Research progress on moving target defense for SDN[J]. Chinese Journal of Network and Information Security, 2018, 4(7): 1-12. DOI： 10.11959/j.issn.2096-109x.2018061.

摘要

软件定义网络是基于开放标准的灵活架构，通过控制层管理网络功能和服务，具有控转分离、集中控制的特性；移动目标防御技术致力于构建一个不断变换的环境以提高网络系统的视在不确定性，需要灵活可定制、集中可控制的网络架构加以实施，因此将移动目标防御与软件定义网络相结合已成为更具应用价值研究热点。首先，分别介绍了软件定义网络和移动目标防御的基本概念，概括了软件定义网络所面临的安全威胁，阐述了面向SDN的移动目标防御的实现模型；其次，分别从SDN数据层、控制层和应用层归纳了移动目标防御的技术方法；最后，总结了现有SDN动态防御面临的挑战，对面向SDN的移动目标防御技术发展方向进行了展望。

Abstract

Software-defined network is based on flexible and open standards

which manages network functions and services by the control layer.And it has the unique advantages of control-separation and centralized control.The moving target defense technology is dedicated to build an ever-changing environment to increase the uncertainty of the network system

which requires a flexible and customizable

centralized and controllable network architecture to implement it.Therefore

the combination of moving target defense and software-defined network have become a more valuable research hotspot.Firstly

the basic concepts of software-defined network and moving target defense were introduced

the security threats of software-defined network was summarized

and the realization model of moving target defense for SDN network was described.Secondly

the technical methods for moving target defense were summarized respectively form the data layer

control layer and application layer of the SDN.Finally

summing up the challenges of existing SDN dynamic defense

and looking forward to the development direction of moving target defense technologies for the SDN.

关键词

Keywords

references

LANTZ B , HELLER B , Mckeown N . A network in a laptop:rapid prototyping for software-defined networks [C ] // ACM Workshop on Hot Topics in Networks.HOTNETS 2010,Monterey,Ca,Usa October . DBLP , 2010 : 1 - 6 .

KREUTZ D , RAMOS F M V , et al . Software-defined networking:a comprehensive survey [J ] . Proceedings of the IEEE , 2014 , 103 ( 1 ): 10 - 13 .

SCOTT-HAYWARD S , O'CALLAGHAN G , SEZER S . SDN security:a survey [C ] // Future Networks and Services . IEEE , 2013 : 1 - 7 .

EATHERTON W , . The push of network processing to the top of the pyramid [C ] // Architecture for Networking and Communications Systems . 2005 .

BENTON K , CAMP L J , SMALL C . OpenFlow vulnerability assessment [C ] // ACM SIGCOMM Workshop on Hot Topics in Software Defined NETWORKING . ACM , 2013 : 151 - 152 .

OpenFlow Switch Specification v1.3.0(2013) [S ] . https://www.opennetworking.org/images/stories/downloads https://www.opennetworking.org/images/stories/downloads .

JAJODIA S , GHOSH A K , SWARUP V , et al . Moving target defense:creating asymmetric uncertainty for Cyber Threats [M ] . Berlin : Springer,2011 , 54 .

MANADHATA P K , WING J M . A formal model for a system’s attack surface [J ] . Advances in Information Security , 2011 , 54 : 1 - 28 .

ZHANG H G , HAN W B , LAI X J , et al . Survey on cyberspace security [J ] . Science China Information Sciences , 2015 , 58 ( 11 ): 1 - 43 .

雷程 , 马多贺 , 张红旗 , 杨英杰 , 王利明 . 基于网络攻击面自适应转换的移动目标防御技术 [J ] . 计算机学报 , 2017 ( 5 ): 1 - 23 .

LEI C , MA D , ZHANG H , et al . Moving target defense technology based on network attack surface self-adaptive mutation [J ] . Chinese Journal of Computers , 2017 ( 5 ): 1 - 23 .

MA D , LEI C , WANG L , et al . A Self-adaptive hopping approach of moving target defense to thwart scanning attacks [C ] // International Conference on Information and Communications,Security , 2016 .

PAPPA A C , ASHOK A , GOVINDARASU M . Moving target defense for securing smart grid communications:architecture,implementation ＆ evaluation [C ] // Power ＆ Energy Society Innovative Smart Grid Technologies Conference . IEEE , 2017 : 1 - 5 .

ZARGAR S T , JOSHI J , TIPPER D . A survey of defense mechanisms against distributed denial of service (DDoS) flooding attacks [J ] . IEEE Communications Surveys ＆ Tutorials , 2013 , 15 ( 4 ): 2046 - 2069 .

TOOTOONCHIAN A , GORBUNOV S , SHERWOOD R , et al . On controller performance in software-defined networks [C ] // Usenix Conference on Hot Topics in Management of Internet,Cloud,and Enterprise Networks and Services . USENIX Association , 2012 .

FEGHALI A , KILANY R , CHAMOUN M . SDN security problems and solutions analysis [C ] // International Conference on Protocol Engineering . IEEE , 2015 : 1 - 5 .

ZHUANG R . A theory for understanding and quantifying moving target defense [J ] . Dissertations ＆ Theses - Gradworks , 2015 .

KAMPANAKIS P , PERROS H , BEYENE T . SDN-based solutions for moving target defense network protection [C ] // World of Wireless,Mobile and Multimedia Networks . IEEE , 2014 : 1 - 6 .

CHUN C J , XING T , HUANG D , et al . SeReNe:on establishing secure and resilient networking services for an SDN-based multi-tenant datacenter environment [C ] // IEEE International Conference on Dependable Systems and Networks Workshops . IEEE , 2015 : 4 - 11 .

ZHOU H , WU C , JIANG M , et al . Evolving defense mechanism for future network security [J ] . IEEE Communications Magazine , 2015 , 53 ( 4 ): 45 - 51 .

WANG J , XIAO F , HUANG J , et al . CHAOS:an SDN-based moving target defense system [J ] . arXiv:1704.01482 , 2017 .

KOPONEN T , CASADO M , GUDE N , et al . Onix:a distributed control platform for large-scale production networks [C ] // Usenix Conference on Operating Systems Design and Implementation . USENIX Association , 2010 : 351 - 364 .

JAFARIAN J H , AL-SHAER E , DUAN Q . Openflow random host mutation:transparent moving target defense using software defined networking [C ] // The Workshop on Hot Topics in Software Defined Networks . ACM , 2012 : 127 - 132 .

CORBETT C , UHER J , COOK J , et al . Countering intelligent jamming with full protocol stack agility [J ] . IEEE Security ＆ Privacy , 2014 , 12 ( 2 ): 44 - 50 .

JAFARIAN J H H , AL-SHAER JE , DUAN Q . Spatio-temporal address mutation for proactive cyber agility against sophisticated attackers [C ] // ACM Workshop . ACM , 2014 : 69 - 78 .

JAFARIAN J H , AL-SHAER E , DUAN Q . Adversary-aware IP address randomization for proactive agility against sophisticated attackers [C ] // Computer Communications . IEEE , 2015 : 738 - 746 .

JAFARIAN J H , AL-SHAER E , DUAN Q . An effective address mutation approach for disrupting reconnaissance attacks [J ] . IEEE Transactions on Information Forensics ＆ Security , 2015 , 10 ( 12 ): 2562 - 2577 .

CHAVEZ A R , STOUT W M S , Peisert S . Techniques for the dynamic randomization of network attributes [C ] // International Carnahan Conference on Security Technology . IEEE , 2016 : 1 - 6 .

SMITH R J , ZINCIR-HEYWOOD A N , JACOBS J T , et al . Initiating a moving target network defense with a real-time neuro-evolutionary detector [C ] // Genetic and Evolutionary Computation Conference Companion . ACM , 2016 : 1095 - 1102 .

NOJOUMIAN M , GOLCHUBIAN A , SAPUTRO N , et al . Preventing collusion between SDN defenders anc attackers using a game theoretical approach [C ] // Computer Communications Workshops . IEEE , 2017 .

MACFARLAND D C , SHUE C A . The SDN Shuffle:creating a moving-target defense using host-based software-defined networking [C ] // ACM Workshop on Moving Target Defense . ACM , 2015 : 37 - 41 .

CHAVEZ A R , STOUT W M S , PEISERT S . Techniques for the dynamic randomization of network attributes [C ] // International Carnahan Conference on Security Technology . IEEE , 2016 : 1 - 6 .

WANG S , ZHANG L , TANG C . A new dynamic address solution for moving target defense [C ] // Information Technology,Networking,Electronic and Automation Control Conference,IEEE , 2016 : 1149 - 1152 .

AYDEGER A , SAPUTRO N , AKKAYA K , et al . Mitigating crossfire attacks using sdn-based moving target defense [C ] // Local Computer Networks . IEEE , 2016 : 627 - 630 .

MIN S K , LEE S B , GLIGOR V D . The crossfire attack [C ] // IEEE Symposium on Security and Privacy . IEEE Computer Society , 2013 : 127 - 141 .

WANG Q , XIAO F , ZHOU M , et al . Linkbait:active link obfuscation to thwart link-flooding attacks [J ] . arXiv:1703.09521 , 2017 .

ASEERI A , NETJINDA N , HEWETT R . Alleviating eavesdropping attacks in software-defined networking data plane [C ] // Conference on Cyber and Information Security Research . ACM , 2017 :1.

FEAMSTER N , REXFORD J , ZEGURA E . The road to SDN:an intellectual history of programmable networks [M ] . ACM , 2014 .

LIU J , ZHANG H , GUO Z . A Defense mechanism of random routing mutation in SDN [J ] . Ieice Transactions on Information ＆ Systems , 2017 , 100 ( 5 ): 1046 - 1054 .

DUAN Q , AL-SHAER E , JAFARIAN H . Efficient random route mutation considering flow and network constraints [C ] // Communications and Network Security . IEEE , 2013 : 260 - 268 .

雷程 , 马多贺 , 张红旗 , 等 . 基于最优路径跳变的网络移动目标防御技术 [J ] . 通信学报 , 2017 , 38 ( 3 ): 133 - 143 .

LEI C , MA D H , ZHANG H Q , et al . Network moving target defense technique based on optimal forwarding path migration [J ] . Journal on Communications , 2017 , 38 ( 3 ): 133 - 143 .

JAFARIAN J H , AL-SHAER E , DUAN Q . Formal approach for route agility against persistent attackers [C ] // European Symposium on Research in Computer Security . Springer,Berlin,Heidelberg , 2013 : 237 - 254 .

RAUF U , GILLANI F , AL-SHAER E , et al . Formal approach for resilient reachability based on end-system route agility [C ] // ACM Workshop on Moving Target Defense . ACM , 2016 : 117 - 127 .

HAACK J N , FINK G A , MAIDEN W M , et al . Ant-based cyber security [C ] // Eighth International Conference on Information Technology:New Generations . IEEE , 2011 : 918 - 926 .

FINK G A , HAACK J N , MCKINNON A D , et al . Defense on the move:ant-based cyber defense [J ] . IEEE Security ＆ Privacy , 2014 , 12 ( 2 ): 36 - 43 .

MIYAZAKI R , KAWAMOTO J , MATSUMOTO S , et al . Host independent and distributed detection system of the network attack by using OpenFlow [C ] // International Conference on Information NETWORKING . IEEE , 2017 : 236 - 241 .

LEI C , ZHANG H Q , MA D H , et al . Network moving target defense technique based on self-adaptive end-point hopping [J ] . Arabian Journal for Science ＆ Engineering , 2017 , 42 ( 8 ): 1 - 14 .

ZHANG H Q , LEI C , CHANG D X , et al . Network moving target defense technique based on collaborative mutation [J ] . Computers ＆Security , 2017 , 70 : 51 - 71 .

LEE H C J , THING V L L . Port hopping for resilient networks [C ] // Vehicular Technology Conference,IEEE , 2004 : 3291 - 3295 .

BADISHI G , HERZBERG A , KEIDAR I . Keeping denial-of-service attackers in the dark [J ] . IEEE Transactions on Dependable ＆ Secure Computing , 2007 , 4 ( 3 ): 191 - 204 .

SHI L , JIA C , LÜ S , et al . Port and address hopping for active cyber-defense [M ] // Intelligence and Security Informatics . Springer Berlin Heidelberg , 2007 : 295 - 300 .

LUO Y B , WANG B S , WANG X F , et al . A keyed-hashing based self-synchronization mechanism for port address hopping communication [J ] . Frontiers of Information Technology and Electronic Engineering , 2017 , 18 ( 5 ): 719 - 728 .

ZHANG L , WANG Z , GU K , et al . Transparent synchronization based port mutation scheme in SDN network [C ] // International Conference on Computer Science and Network Technology . 2016 : 581 - 585 .

ZHANG L , GUO Y , YUWEN H , et al . A port hopping based dos mitigation scheme in SDN network [C ] // International Conference on Computational Intelligence and Security . IEEE , 2017 : 314 - 317 .

MA D , XU Z , LIN D . Defending blind DDoS attack on SDN based on moving target defense [C ] // International Conference on Security and Privacy in Communication Networks . 2014 : 463 - 480 .

WU Z , WEI Q , REN K , et al . A dynamic defense using client puzzle for identity-forgery attack on the south-bound of software defined networks [J ] . Ksii Transactions on Internet ＆ Information Systems , 2017 , 11 ( 2 ): 846 - 864 .

CHOWDHARY A , PISHARODY S , ALSHAMRANI A , et al . Dynamic game based security framework in SDN-enabled cloud networking environments [C ] // ACM International Workshop on Security in Software Defined Networks ＆ Network Function Virtualization . ACM , 2017 : 53 - 58 .

JANTILA S , CHAIPAH K . A Security analysis of a hybrid mechanism to defend DDoS attacks in SDN [J ] . Procedia Computer Science , 2016 , 86 : 437 - 440 .

DEVI S R , YOGESH P . A Hybrid approach to counter application layer DDoS attacks [J ] . International Journal on Cryptography ＆Information Security , 2012 .

DEBROY S , CALYAM P , NGUYEN M , et al . Frequency-minimal moving target defense using software-defined networking [C ] // International Conference on Computing,Networking and Communications . IEEE , 2016 : 1 - 6 .

GILLANI F , AL-SHAER E , LO S , et al . Agile virtualized infrastructure to proactively defend against cyber attacks [C ] // Computer Communications . IEEE , 2015 : 729 - 737 .

SHIN S , PORRAS P , YEGNESWARAN V , et al . FRESCO:modular composable security services for software defined networks [J ] . Proceedings of Network ＆ Distributed Security Symposium , 2013 .

SHIN S , GU G . CloudWatcher:network security monitoring using openflow in dynamic cloud networks (or:How to provide security monitoring as a service in clouds?) [C ] // IEEE International Conference on Network Protocols . IEEE Computer Society , 2012 : 1 - 6 .

ZAALOUK A , KHONDOKER R , MARX R , et al . OrchSec:anorchestrator-based architecture for enhancing network-security using Network Monitoring and SDN Control functions [C ] // Noms . IEEE , 2014 : 1 - 9 .

浏览量

2993

下载量

CSCD

文章被引用时，请邮件提醒。

提交

工具集

关联资源

轻量级软件定义边缘计算网络拓扑发现方法

NFT图像隐写

面向网络层的动态跳变技术研究进展

容器云中基于Stackelberg博弈的动态异构调度方法

面向对抗样本攻击的移动目标防御