基于序参量的云边端分布式体系协同安全评估

范其纲; 蒋忠元; 李兴华; 马建峰

doi:10.11959/j.issn.2096-109x.2024038

您当前的位置：

首页 >

文章列表页 >

基于序参量的云边端分布式体系协同安全评估

学术论文 | 更新时间：2024-08-14

- 基于序参量的云边端分布式体系协同安全评估
- Collaborative security assessment of cloud-edge-device distributed systems based on order parameters
- 网络与信息安全学报 2024年10卷第3期页码：38-51
- 作者机构：
  
  西安电子科技大学网络与信息安全学院，陕西西安 710126
- 作者简介：
  
  [ "范其纲（1999- ），男，福建福州人，西安电子科技大学硕士生，主要研究方向为复杂网络安全、云计算安全。" ]
  [ "蒋忠元（1988- ），男，陕西榆林人，西安电子科技大学教授、博士生导师，主要研究方向为复杂网络安全、复杂网络传输动力学、网络功能虚拟化。" ]
  [ "李兴华（1978- ），男，河南南阳人，西安电子科技大学教授、博士生导师，主要研究方向为网络与信息安全、安全协议形式化。" ]
  [ "马建峰（1963- ），男，陕西西安人，西安电子科技大学教授、博士生导师，主要研究方向为无线网络安全、移动智能系统安全。" ]
- 基金信息：
  
  陕西省重点研发项目(2023-YBGY-270)
- DOI：10.11959/j.issn.2096-109x.2024038
  中图分类号： TP393
- 收稿：2023-12-11，
  
  修回：2024-04-08，
  
  纸质出版：2024-06-25
- 稿件说明：
移动端阅览
范其纲, 蒋忠元, 李兴华, 等. 基于序参量的云边端分布式体系协同安全评估[J]. 网络与信息安全学报, 2024, 10(3): 38-51.

FAN Q G, JIANG Z Y, LI X H, et al. Collaborative security assessment of cloud-edge-device distributed systems based on order parameters[J]. Chinese Journal of Network and Information Security, 2024, 10(3): 38-51.
范其纲, 蒋忠元, 李兴华, 等. 基于序参量的云边端分布式体系协同安全评估[J]. 网络与信息安全学报, 2024, 10(3): 38-51. DOI： 10.11959/j.issn.2096-109x.2024038.

FAN Q G, JIANG Z Y, LI X H, et al. Collaborative security assessment of cloud-edge-device distributed systems based on order parameters[J]. Chinese Journal of Network and Information Security, 2024, 10(3): 38-51. DOI： 10.11959/j.issn.2096-109x.2024038.

摘要

基于云边端的分布式计算体系成功服务于众多应用，已经成为一种主流，具有受众广、用户体验好、安全期望高等特点。然而，近年来针对云、边、端的攻击事件频发，给用户造成严重的安全隐患与巨大经济损失。当前云、边、端的防御机制各自为战，抵御风险的能力差异大，全域安全风险消除难。事前配置和事后“亡羊补牢”式的安全手段难以满足高负载、高实时的云边端协同网络的安全需求。其根源在于云、边、端分层架构各自为营，未形成有效的协同防御体系，导致产生跨域安全治理难度大、实时性差、协同一致性评估难等问题。提出了实时感知、动态决策、积极防御三位一体的云边端协同安全架构，深度融合云、边、端，形成安全协同能力，并进行严格理论一致性证明；提出了基于序参量的协同安全评估模型，实现云、边、端风险感知一致，策略决策一致，攻击防御一致，实行高效率、低成本的安全风险协同防护，最大化系统性安全收益；对一致性理论与评估模型进行仿真验证，结果证明了提出的协同安全体系以及一致性评价模型的正确性与有效性。

Abstract

Distributed computing systems based on cloud-edge-device have been successfully serving thousands of applications and have become mainstream

characterized by a wide audience

high user experience requirements

and high security expectations. However

in recent years

frequent attacks on cloud-edge-device systems have resulted in serious security risks and significant economic losses for users. The defense mechanisms of cloud-edge-device systems have been found to operate independently

leading to major differences in the ability to resist risks

which makes it difficult to eliminate global security risks. Security measures of the pre-configuration and post-event remedy type have been found to hardly meet the security needs of high-load and high real-time in cloud-edge-device collaborative networks. The root cause has been identified as the hierarchical architecture of cloud-edge-device systems being separate

and no effective collaborative defense system has been formed

leading to problems such as difficult cross-domain security governance

poor real-time performance

and difficult collaborative consistency evaluation. Firstly

a cloud-edge-device collaborative security architecture that integrates real-time perception

dynamic decision

and proactive defense was proposed. The cloud-edge-device security collaboration capability was established through rigorous theoretical consistency proofs. Secondly

a collaborative security assessment model based on the order parameter was put forward to achieve consistency of risk perception

decision

and defense. In this way

the efficient and low-cost collaborative protection of security risks could be realized to maximize systemic security benefits. Finally

the consistency theory and assessment method were verified through simulations. The results show that the proposed collaborative security system and consistency evaluation model are correct and effective.

关键词

Keywords

references

张晓东 , 吕从东 . 云边端协同安全隐私保护框架研究 [J ] . 南京大学学报(自然科学) , 2022 , 58 ( 3 ): 413 - 419 .

ZHANG X D , LYU C D . A security and privacy protection framework for cloud edge collaborative [J ] . Journal of Nanjing University (Natural Sciences) , 2022 , 58 ( 3 ): 413 - 419 .

王文娟 , 杜学绘 , 王娜 , 等 . 云计算安全审计技术研究综述 [J ] . 计算机科学 , 2017 , 44 ( 7 ): 16 - 20+30 .

WANG W J , DU X H , WANG N , et al . Riview on security audit technology for cloud computing [J ] . Computer Science , 2017 , 44 ( 7 ): 16 - 20+30 .

MANIA H , ABDURACHMAN E , GAOL F L , et al . Survey on threats and risks in the cloud computing environment [J ] . Procedia Computer Science , 2019 , 161 : 1325 - 1332 .

HUANG Z Y , XIA G M , WANG Z H , et al . Survey on edge computing security [C ] // Proceedings of the 2020 International Conference on Big Data, Artificial Intelligence and Internet of Things Engineering (ICBAIE) . Piscataway : IEEE Press , 2020 : 96 - 105 .

冉黎琼 , 翁越男 , 徐小玲 , 等 . 云、边缘和雾计算安全性研究综述 [J ] . 无线电工程 , 2023 , 53 ( 2 ): 247 - 261 .

RAN L Q , WENG Y N , XU X L , et al . A review of cloud, edge and fog computing security [J ] . Radio Engineering , 2023 , 53 ( 2 ): 247 - 261 .

LATIF R , ABBAS H , ASSAR S , et al . Cloud computing risk assessment: a systematic literature review [M ] . Berlin, Heidelberg : Springer Berlin Heidelberg , 2014 : 285 - 295 .

SENDI A S , CHERIET M . Cloud computing: a risk assessment model [C ] // Proceedings of the 2014 IEEE International Conference on Cloud Engineering . Piscataway : IEEE Press , 2014 : 147 - 152 .

CAYIRCI E , GARAGA A , SANTANA A , et al . A cloud adoption risk assessment model [C ] // Proceedings of the 2014 IEEE/ACM 7th International Conference on Utility and Cloud Computing . Piscataway : IEEE Press , 2014 : 908 - 913 .

FURUNCU E , SOGUKPINAR I . Scalable risk assessment method for cloud computing using game theory (CCRAM) [J ] . Computer Standards & Interfaces , 2015 , 38 : 44 - 50 .

LI K , YANG D , BAI L , et al . Security risk assessment method of edge computing container based on dynamic game [C ] // 2021 IEEE 6th International Conference on Cloud Computing and Big Data Analytics (ICCCBDA) . Piscataway : IEEE Press , 2021 : 195 - 199 .

ENDSLEY M R . Design and evaluation for situation awareness enhancement [J ] . Proceedings of the Human Factors Society Annual Meeting , 1988 , 32 ( 2 ): 97 - 101 .

GONZALEZ G G , BELHAOUANE M , DEBAR H , et al . RORI-based countermeasure selection using the OrBAC formalism [J ] . International Journal of Information Security , 2014 , 13 ( 1 ): 63 - 79 .

SHAMELI-SENDI A , LOUAFI H , HE W B , et al . Dynamic optimal countermeasure selection for intrusion response system [J ] . IEEE Transactions on Dependable and Secure Computing , 2018 , 15 ( 5 ): 755 - 770 .

HAKEN H . Synergetics [J ] . Physics Bulletin , 1977 , 28 ( 9 ): 412 - 414 .

ARENAS A , DÍAZ-GUILERA A , KURTHS J , et al . Synchronization in complex networks [J ] . Physics Reports , 2008 , 469 ( 3 ): 93 - 153 .

SAYYAADI H , DOOSTMOHAMMADIAN M R . Finite-time consensus in directed switching network topologies and time-delayed communications [J ] . Scientia Iranica , 2011 , 18 ( 1 ): 75 - 85 .

GÓMEZ-GUTIÉRREZ D , VÁZQUEZ C R , ČELIKOVSKÝ S , et al . On finite-time and fixed-time consensus algorithms for dynamic networks switching among disconnected digraphs [J ] . International Journal of Control , 2020 , 93 ( 9 ): 2120 - 2134 .

KHALIL H K . Control of nonlinear systems [M ] . New York : Prentice Hall , 2002 : 156 - 162

LIU M , MA H , CUI J M , et al . Exploring information interactions in decentralized multiagent coordination under uncertainty [C ] // Proceedings of 2020 5th IEEE International Conference on Big Data Analytics (ICBDA) . Piscataway : IEEE Press , 2020 : 304 - 308 .

SHARAFALDIN I , HABIBI L A , GHOR-BANI A A . Toward generating a new intrusion detection dataset and intrusion traffic characterization [C ] // Proceedings of the 4th International Conference on Information Systems Security and Privacy . SCITEPRESS - Science and Technology Publications , 2018 : 108 - 116 .

BELARBI O , KHAN A , CARNELLI P , et al . An intru-sion detection system based on deep belief net-works [M ] . Cham : Springer International Publishing , 2022 : 377 - 392 .

YIN Y , JANG-JACCARD J , SABRINA F , et al . Improving multilayer-perceptron (MLP)-based network anomaly detection with birch clustering on CI-CIDS-2017 dataset [C ] // Proceedings of the 2023 26th International Conference on Computer Supported Cooperative Work in Design (CSCWD) . Piscataway : IEEE Press , 2023 : 423 - 431 .

MASEER Z K , YUSOF R , BAHAMAN N , et al . Benchmarking of machine learning for anomaly based intru-sion detection systems in the CICIDS2017 dataset [J ] . IEEE Access , 2021 , 9 : 22351 - 22370 .

KALISZEWSKI I , PODKOPAEV D . Simple additive weighting-a metamodel for multiple criteria decision analysis methods [J ] . Expert Systems with Applications , 2016 , 54 : 155 - 161 .

INAYAT Z , GANI A , ANUAR N B , et al . Cloud-based intrusion detection and response system: open research issues, and solutions [J ] . Arabian Journal for Science and Engineering , 2017 , 42 ( 2 ): 399 - 423 .

浏览量

下载量

CSCD

文章被引用时，请邮件提醒。

提交

工具集

关联资源

RSSP-II的安全分析及安全增强新方案