面向网络层的动态跳变技术研究进展

何威振; 陈福才; 牛杰; 谭晶磊; 霍树民; 程国振

doi:10.11959/j.issn.2096-109x.2021104

您当前的位置：

首页 >

文章列表页 >

面向网络层的动态跳变技术研究进展

专栏Ⅰ：新型网络技术及安全 | 更新时间：2024-06-03

- 面向网络层的动态跳变技术研究进展
- Research progress on dynamic hopping technology for network layer
- 网络与信息安全学报 2021年7卷第6期页码：44-55
- 作者机构：
  
  1. 信息工程大学，河南郑州 450001
  2. 中国人民解放军61212部队, 北京 100091
- 作者简介：
  
  [ "何威振（1996− ），男，安徽亳州人，信息工程大学硕士生，主要研究方向为网络安全、移动目标防御" ]
  [ "陈福才（1974− ），男，江西南昌人，信息工程大学研究员，主要研究方向为网络安全、网络通信" ]
  [ "牛杰（1982− ），男，河南郸城人，中国人民解放军61212部队工程师，主要研究方向为网络信息前沿技术发展" ]
  [ "谭晶磊（1994− ），男，山东章丘人，信息工程大学博士生，主要研究方向为网络信息安全、移动目标防御、攻防博弈对抗等" ]
  [ "霍树民（1985− ），男，山西长治人，信息工程大学副研究员，主要研究方向为网络安全" ]
  [ "程国振（1986− ），男，山东菏泽人，信息工程大学副教授，主要研究方向为云数据中心、SDN、网络安全" ]
- 基金信息：
  
  国家重点研发计划;The National Key R＆D Program of China(2021YFB1006200);国家重点研发计划;The National Key R＆D Program of China(2021YFB1006201);国家自然科学基金;The National Natural Science Foundation of China(62072467)
- DOI：10.11959/j.issn.2096-109x.2021104
  中图分类号： TP393
- 网络首发：2021-12，
  
  纸质出版：2021-12-15
- 稿件说明：
移动端阅览
何威振, 陈福才, 牛杰, 等. 面向网络层的动态跳变技术研究进展[J]. 网络与信息安全学报, 2021,7(6):44-55.

Weizhen HE, Fucai CHEN, Jie NIU, et al. Research progress on dynamic hopping technology for network layer[J]. Chinese Journal of Network and Information Security, 2021, 7(6): 44-55.
何威振, 陈福才, 牛杰, 等. 面向网络层的动态跳变技术研究进展[J]. 网络与信息安全学报, 2021,7(6):44-55. DOI： 10.11959/j.issn.2096-109x.2021104.

Weizhen HE, Fucai CHEN, Jie NIU, et al. Research progress on dynamic hopping technology for network layer[J]. Chinese Journal of Network and Information Security, 2021, 7(6): 44-55. DOI： 10.11959/j.issn.2096-109x.2021104.

摘要

首先，介绍了网络层跳变技术的基本概念并给出了其所能抵御的安全威胁；接着，从传统网络和软件定义网络给出了网络层跳变技术的两种模型和通信方式；然后，从跳变属性、跳变的实现方式和跳变的触发方式3个方面对网络层跳变技术进行分类，并给出网络层跳变的两种评估模型；最后，总结了网络层跳变技术目前仍然存在的问题，以及相应的发展方向。

Abstract

Firstly

the basic concept of network layer hopping technology was introduced and the security threats it faced were given.Then

two type of models and communication methods of network layer hopping technology based on traditional networks and software-defined networks were given.And the network layer hopping technology was classified from three aspects of hopping attributes

the method of hopping realization and the method of hopping trigger

two evaluation models of network layer hopping were given.Finally

the problems that still exist in the network layer hopping technology and the corresponding development direction were summarized.

关键词

Keywords

references

Symantec . Internet Security Threat Report [R ] . 2016 .

Trend Micro . Understanding Targeted Attacks:The Impact of Targeted Attacks [R ] . 2015 .

JAJODIA S , GHOSH A K , SWARUP V , et al . Moving target defense [M ] . New York,NY : Springer New York , 2011 .

CHO J H , SHARMA D P , ALAVIZADEH H , et al . Toward proactive,adaptive defense:a survey on moving target defense [J ] . IEEE Communications Surveys ＆ Tutorials , 2020 , 22 ( 1 ): 709 - 745 .

KEWLEY D , FINK R , LOWRY J , et al . Dynamic approaches to thwart adversary intelligence gathering [C ] // Proceedings of Proceedings DARPA Information Survivability Conference and Exposition II.DISCEX'01 . 2001 : 176 - 185 .

ATIGHETCHI M , PAL P , WEBBER F , et al . Adaptive use of network-centric mechanisms in cyber-defense [C ] // Proceedings of Sixth IEEE International Symposium on Object-Oriented Real-Time Distributed Computing,2003 . 2003 : 183 - 192 .

DUNLOP M , GROAT S , URBANSKI W , et al . MT6D:a moving target IPv6 defense [C ] // Proceedings of 2011 - MILCOM 2011 Military Communications Conference . 2011 : 1321 - 1326 .

AL-SHAER E , DUAN Q , JAFARIAN J H . Random host mutation for moving target defense [M ] // Lecture Notes of the Institute for Computer Sciences,Social Informatics and Telecommunications Engineering . Berlin,Heidelberg : Springer , 2013 : 310 - 327 .

石乐义 , 贾春福 , 吕述望 . 基于端信息跳变的主动网络防护研究 [J ] . 通信学报 , 2008 , 29 ( 2 ): 106 - 110 .

SHI L Y , JIA C F , LYU S W . Research on end hopping for active network confrontation [J ] . Journal on Communications , 2008 , 29 ( 2 ): 106 - 110 .

DUAN Q , AL-SHAER E , JAFARIAN H . Efficient Random Route Mutation considering flow and network constraints [C ] // Proceedings of 2013 IEEE Conference on Communications and Network Security (CNS) . 2013 : 260 - 268 .

HONG J B , KIM D S . Assessing the effectiveness of moving target defenses using security models [J ] . IEEE Transactions on Dependable and Secure Computing , 2016 , 13 ( 2 ): 163 - 177 .

JAFARIAN J H , AL-SHAER E , DUAN Q . OpenFlow random host mutation:transparent moving target defense using software defined networking [C ] // Proceedings of the First Workshop on Hot Topics in Software Defined Networks . 2012 : 127 - 132 .

YOON S , CHO J H , KIM D S , et al . Poster:address shuffling based moving target defense for in-vehicle software-defined networks [C ] // Proceedings of MobiCom '19:The 25th Annual International Conference on Mobile Computing and Networking . 2019 : 1 - 3 .

CARROLL T E , CROUSE M , FULP E W , et al . Analysis of network address shuffling as a moving target defense [C ] // Proceedings of 2014 IEEE International Conference on Communications (ICC) . 2014 : 701 - 706 .

ZHOU Z , XU C Q , KUANG X H , et al . An efficient and agile spatio-temporal route mutation moving target defense mechanism [C ] // Proceedings of ICC 2019 - 2019 IEEE International Conference on Communications (ICC) . Piscataway:IEEE Press , 2019 : 1 - 6 .

LUO Y B , WANG B S , WANG X F , et al . RPAH:random port and address hopping for thwarting internal and external adversaries [C ] // Proceedings of 2015 IEEE Trustcom/BigDataSE/ISPA . 2015 : 263 - 270 .

AYDEGER A , SAPUTRO N , AKKAYA K , et al . Mitigating crossfire attacks using SDN-based moving target defense [C ] // Proceedings of 2016 IEEE 41st Conference on Local Computer Networks (LCN) . 2016 : 627 - 630 .

CLARK A , SUN K , BUSHNELL L , et al . A game-theoretic approach to IP address randomization in decoy-based cyber defense [M ] // Lecture Notes in Computer Science . 2015 : 3 - 21 .

GROAT S , DUNLOP M , URBANKSI W , et al . Using an IPv6 moving target defense to protect the smart grid [C ] // Proceedings of 2012 IEEE PES Innovative Smart Grid Technologies (ISGT) . 2012 : 1 - 7 .

吴桦 , 陈廷政 . SDN环境中基于端址跳变的DDoS防御方法 [J ] . 网络空间安全 , 2020 , 11 ( 8 ): 17 - 22 .

WU H , CHEN T Z . A DDoS defense method based on port and ad-dress hopping in SDN [J ] . Cyberspace Security , 2020 , 11 ( 8 ): 17 - 22 .

LEE H C J , THING V L L . Port hopping for resilient networks [C ] // Proceedings of IEEE 60th Vehicular Technology Conference,2004.VTC2004-Fall.2004 . 2004 : 3291 - 3295 .

SHI L Y , JIA C F , LÜ S , et al . Port and address hopping for active cyber-defense [M ] // Intelligence and Security Informatics . Berlin,Heidelberg : Springer Berlin Heidelberg , 2007 : 295 - 300 .

ANTONATOS S , AKRITIDIS P , MARKATOS E P , et al . Defending against hitlist worms using network address space randomization [J ] . Computer Networks , 2007 , 51 ( 12 ): 3471 - 3490 .

JAFARIAN J H H , AL-SHAER E , DUAN Q . Spatio-temporal address mutation for proactive cyber agility against sophisticated attackers [C ] // Proceedings of the First ACM Workshop on Moving Target Defense - MTD '14 . 2014 : 69 - 78 .

BADISHI G , HERZBERG A , KEIDAR I . Keeping denial-of-service attackers in the dark [J ] . IEEE Transactions on Dependable and Secure Computing , 2007 , 4 ( 3 ): 191 - 204 .

REHMANI M H , DAVY A , JENNINGS B , et al . Software defined networks-based smart grid communication:a comprehensive survey [J ] . IEEE Communications Surveys ＆ Tutorials , 2019 , 21 ( 3 ): 2637 - 2670 .

陈扬 , 扈红超 , 程国振 . 软件定义的内网动态防御系统设计与实现 [J ] . 电子学报 , 2018 , 46 ( 11 ): 2604 - 2611 .

CHEN Y , HU H C , CHENG G Z . The design and implementation of a software-defined intranet dynamic defense system [J ] . Acta Electronica Sinica , 2018 , 46 ( 11 ): 2604 - 2611 .

JAFARIAN J H , NIAKANLAHIJI A , AL-SHAER E , et al . Multi-dimensional host identity anonymization for defeating skilled attackers [C ] // MTD '16:Proceedings of the 2016 ACM Workshop on Moving Target Defense . 2016 : 47 - 58 .

LUO Y B , WANG B S , WANG X F , et al . RPAH:random port and address hopping for thwarting internal and external adversaries [C ] // Proceedings of 2015 IEEE Trustcom/BigDataSE/ISPA . Piscataway:IEEE Press , 2015 : 263 - 270 .

SHARMA D P , CHO J H , MOORE T J , et al . Random host and service multiplexing for moving target defense in software-defined networks [C ] // Proceedings of ICC 2019 - 2019 IEEE International Conference on Communications (ICC) . 2019 : 1 - 6 .

WANG K , CHEN X , ZHU Y F . Random domain name and address mutation (RDAM) for thwarting reconnaissance attacks [J ] . PLoS One , 2017 , 12 ( 5 ): e0177111 .

SIFALAKIS M , SCHMID S , HUTCHISON D . Network address hopping:a mechanism to enhance data protection for packet communications [C ] // Proceedings of IEEE International Conference on Communications,2005.ICC 2005.2005 . 2005 : 1518 - 1523 .

LIN K , JIA C . Distributed timestamp synchronization for end hopping [J ] . China Communications , 2011 , 8 ( 4 ): 164 - 169 .

林楷 , 贾春福 , 石乐义 . 分布式时间戳同步技术的改进 [J ] . 通信学报 , 2012 , 33 ( 10 ): 110 - 116 .

LIN K , JIA C F , SHI L Y . Improvement of distributed timestamp syn-chronization [J ] . Journal on Communications , 2012 , 33 ( 10 ): 110 - 116 .

石乐义 , 郭宏彬 , 温晓 , 等 . 端信息跳扩混合的主动网络防御技术研究 [J ] . 通信学报 , 2019 , 40 ( 5 ): 125 - 135 .

SHI L Y , GUO H B , WEN X , et al . Research on end hopping and spreading for active cyber defense [J ] . Journal on Communications , 2019 , 40 ( 5 ): 125 - 135 .

JAFARIAN J H , AL-SHAER E , DUAN Q . An effective address mutation approach for disrupting reconnaissance attacks [J ] . IEEE Transactions on Information Forensics and Security , 2015 , 10 ( 12 ): 2562 - 2577 .

胡毅勋 , 郑康锋 , 杨义先 , 等 . 基于 OpenFlow 的网络层移动目标防御方案 [J ] . 通信学报 , 2017 , 38 ( 10 ): 102 - 112 .

HU Y X , ZHENG K F , YANG Y X , et al . Moving target defense solution on network layer based on OpenFlow [J ] . Journal on Communications , 2017 , 38 ( 10 ): 102 - 112 .

SHARMA D P , KIM D S , YOON S , et al . FRVM:flexible random virtual IP multiplexing in software-defined networks [C ] // Proceedings of 2018 17th IEEE International Conference on Trust,Security and Privacy In Computing and Communications/ 12th IEEE International Conference on Big Data Science and Engineering (TrustCom/BigDataSE) . 2018 : 579 - 587 .

CHANG S Y , PARK Y , ASHOK BABU B B . Fast IP hopping randomization to secure hop-by-hop access in SDN [J ] . IEEE Transactions on Network and Service Management , 2019 , 16 ( 1 ): 308 - 320 .

JAFARIAN J H , AL-SHAER E , DUAN Q . Adversary-aware IP address randomization for proactive agility against sophisticated attackers [C ] // Proceedings of 2015 IEEE Conference on Computer Communications (INFOCOM) . 2015 : 738 - 746 .

MA D H , LEI C , WANG L M , et al . A self-adaptive hopping approach of moving target defense to thwart scanning attacks [M ] // Information and Communications Security . Cham : Springer International Publishing , 2016 : 39 - 53 .

王鹏超 , 陈福才 , 程国振 , 等 . 软件定义的 L2/L3 地址协同拟态伪装策略研究 [J ] . 电子学报 , 2019 , 47 ( 10 ): 2032 - 2039 .

WANG P C , CHEN F C , CHENG G Z , et al . L2/L3 address coop-erative mimicry strategy research based on SDN [J ] . Acta Electro-nica Sinica , 2019 , 47 ( 10 ): 2032 - 2039 .

YOON S , CHO J H , KIM D S , et al . Attack graph-based moving target defense in software-defined networks [J ] . IEEE Transactions on Network and Service Management , 2020 , 17 ( 3 ): 1653 - 1668 .

WANG H X , LI F , CHEN S Q . Towards cost-effective moving target defense against DDoS and covert channel attacks [C ] // Proceedings of the 2016 ACM Workshop on Moving Target Defense . 2016 : 15 - 25 .

CLARK A , SUN K , POOVENDRAN R . Effectiveness of IP address randomization in decoy-based moving target defense [C ] // Proceedings of 52nd IEEE Conference on Decision and Control . 2013 : 678 - 685 .

MALEKI H , VALIZADEH S , KOCH W , et al . Markov modeling of moving target defense games [C ] // Proceedings of the 2016 ACM Workshop on Moving Target Defense . 2016 : 81 - 92 .

MANADHATA P K . Game theoretic approaches to attack surface shifting [M ] . Moving Target Defense II . New York,NY : Springer New York , 2012 : 1 - 13 .

LEI C , MA D H , ZHANG H Q . Optimal strategy selection for moving target defense based on Markov game [J ] . IEEE Access , 2017 , 5 : 156 - 169 .

FENG X T , ZHENG Z Z , MOHAPATRA P , et al . A stackelberg game and Markov modeling of moving target defense [M ] // Lecture Notes in Computer Science . Cham : Springer International Publishing , 2017 : 315 - 335 .

陈永强 , 吴晓平 , 付钰 , 等 . 基于模糊静态贝叶斯博弈的网络主动防御策略选取 [J ] . 计算机应用研究 , 2015 , 32 ( 3 ): 887 - 889 , 899 .

CHEN Y Q , WU X P , FU Y , et al . Active defense strategy selection of network based on fuzzy static Bayesian game model [J ] . Applica-tion Research of Computers , 2015 , 32 ( 3 ): 887 - 889 , 899 .

ZHU Q Y , BAŞAR T , . Game-theoretic approach to feedback-driven multi-stage moving target defense [M ] // Lecture Notes in Computer Science . Cham : Springer International Publishing , 2013 : 246 - 263 .

LEI C , ZHANG H Q , WAN L M , et al . Incomplete information Markov game theoretic approach to strategy generation for moving target defense [J ] . Computer Communications , 2018 , 116 : 184 - 199 .

TAN J L , LEI C , ZHANG H Q , et al . Optimal strategy selection approach to moving target defense based on Markov robust game [J ] . Computers ＆ Security , 2019 , 85 : 63 - 76 .

LEI C , ZHANG H Q , TAN J L , et al . Moving target defense techniques:a survey [J ] . Security and Communication Networks , 2018 , 2018 : 1 - 25 .

张明悦 , 金芝 , 赵海燕 , 等 . 机器学习赋能的软件自适应性综述 [J ] . 软件学报 , 2020 , 31 ( 8 ): 2404 - 2431 .

ZHANG M Y , JIN Z , ZHAO H Y , et al . Survey of machine learning enabled software self-adaptation [J ] . Journal of Software , 2020 , 31 ( 8 ): 2404 - 2431 .

CHENG K , BAI Y B , ZHOU Y , et al . CANeleon:protecting CAN bus with frame ID chameleon [J ] . IEEE Transactions on Vehicular Technology , 2020 , 69 ( 7 ): 7116 - 7130 .

浏览量

251

下载量

CSCD

文章被引用时，请邮件提醒。

提交

工具集

关联资源

高效安全的软件定义网络拓扑发现协议

基于Renyi熵的SDN自主防护系统

容器云中基于Stackelberg博弈的动态异构调度方法

面向对抗样本攻击的移动目标防御

低故障恢复开销的软件定义网络控制器布局算法