基于可控网络攻击面的主动防御机制研究

Network attack and defense is an important part of cyberspace security. Under the traditional passive defense mechanism, there is significant information asymmetry between the attacker and defender: the attacker can obtain various information (such as network topology) of the network through various means (such as sniffing and side channel attack), and then launch highly efficient attacks based on such information; the defender cannot predict the type and time of attacks due to various types of attacks, random attacking time, and numerous attacking means, which results in that defense lags behind the attack. To solve this problem, considering the different characteristics of typical attacks such as timing attack, brute force attack and directed attack, the mechanisms of hiding, repairing and adjusting the network attack surface are proposed, thus to carry out the proactive network defense research: 1) Timing feature confusion based on adversary machine learning, preventing the attackers from getting the right information, thus to hide the network attack surface, by proactively introducing noise into the timing features, 2) Network self-repair based on on-demand resource allocation and traffic guidance, redeploying the needed resources and steering traffic in advance according to the network self-diagnosis results, thus to proactively repair the network attack surface, 3) Network reconfiguration based on moving target defense, reducing the attack success rate by dynamic network configuration modification and network attack surface adjustment. This proposal will effectively mitigate the problems of lag and information asymmetry of the passive defense mechanism, thus to notably improve the network's anti-attack capability.

网络攻防是网络空间安全的重要组成部分。传统的被动网络防御机制使得攻防双方存在明显的信息不对称：攻击者可通过嗅探、侧信道分析等多种手段获取网络的各种信息（如网络拓扑），进而，基于这些信息发动效率极高的攻击；防御者却由于攻击种类多样、时间随机、手段繁多等原因而无法预判攻击类型与时间，导致防御明显滞后于攻击。为此，针对时序攻击、蛮力攻击、定向攻击等典型攻击的不同特征，提出网络攻击面的隐藏、修复与调整机制，开展主动防御研究：①基于对抗机器学习的时序特征混淆，主动在时序特征中引入噪音，使攻击者无法获取正确信息，隐藏网络攻击面；②基于按需资源分配与流量引导的网络自修复，基于网络自诊断结果，进行资源再分配和流量引导，主动修复网络攻击面；③基于移动目标防御的网络配置重构，主动修改网络配置，调整网络攻击面，降低定向攻击成功率。项目的成功研发将有效解决被动防御机制的滞后与信息不对称等问题，提升网络抗攻击能力。

IT应用与业务的不断发展与更新使得用户需求呈现出多样化、差异化和高度定制化等特征。为了满足新型应用提出的上述需求，各类新型技术层出不穷。其中，在网络技术方面，软件定义网络技术具备支持新型网络体系结构和新型业务创新的能力，因此在物联网、云数据中心、移动网络等各类系统和场景中得到了广泛部署，成为了重要的网络基础设施。软件定义网络的应用使得可控的网络攻击面成为可能，即，通过软件定义网络的灵活管理、动态调整、全局视野等特性，实现对网络攻击面的隐藏、修复和调整，从而实现主动的网络防御。具体而言，针对网络时序攻击、蛮力攻击、定向攻击等问题，开展了以下三个方面的研究。1）软件定义网络中的时序侧信道攻击抵御机制：提出了基于网络特征随机扰动的时序侧信道攻击主动抵御方法，降低攻击者通过侧信道攻击获得内部网络状态数据的可能性，同时降低其获得的内部数据的可用性，从而增大时序侧信道攻击的难度；2）软件定义物联网中数据安全传输机制：提出基于路径动态选择数据安全传输机制，结合（k，n）秘密共享机制，通过数据发送端加密与分割、数据传输时路径路由动态选择、数据接收端基于k份切片的数据还原等方法，实现软件定义物联网中数据的安全传输，主动抵抗针对网络节点及其处理数据的定向攻击，保障上层服务和应用的安全可靠；3）软件定义网络中异常交换机检测：提出基于packet_in消息状态的异常交换机线性检测方法，及时发现针对交换机的蛮力攻击（如DDoS攻击），增强软件定义网络基础设施层的安全性，为上层应用提供安全基础。在本项目支持下，发表/录用论文13篇，获批国家发明专利1项，申请国家发明专利2项，培养硕士生2名。