软件定义安全架构下的异常流量检测与控制技术研究

With all-round development of technologies, such as Internet of Things, cloud computing, and intelligent network equipment, terminal-side security protection is increasingly difficult to meet the real-time response requirements for intelligent, automated, and rapid variant network attacks. Big data driven threat traffic analysis and attack intention identification have become a hot spot in current network security research field. However, the real-time acquisition and transmission of mass network traffic, storage filtering, analysis and mining and situational awareness are still the technical difficulties. Although Software Defined Security (SDS) technology is still in its infancy, its centralized management and control capabilities of network equipment and traffic have made it a potential framework for network security. To solve above issues, the specific tasks to be carried out in this project include: 1) Propose a method of machine learning adaptive traffic identification method based on the combination of traffic identification and deep packet inspection; 2) Propose an attack situation prediction mechanism based on attack intention dynamic identification; 3) Propose a strategy-driven active abnormal behavior control technology. This project will help to improve the networking, automation and agility of security protection, have theoretical and practical significance in the field of cyberspace security and software-defined security.

随着物联网、云计算以及智能网络设备等技术的全面发展，单纯终端侧的安全防护越来越难以应对智能化、自动化和快速变种网络攻击的实时响应需求。大数据驱动下的威胁流量分析及攻击意图识别已经成为当前网络安全领域研究的热点。然而，海量网络流量的实时采集传输、存储过滤、分析挖掘及态势感知仍然是技术难点。软件定义安全技术虽然仍处于起步阶段，但其网络设备及流量集中管理控制能力促其成为网络安全防护体系的潜在架构。针对以上问题，本项目拟开展的具体工作包括：1）提出基于流量识别和深度包分析相结合的机器学习自适应流量识别方法；2）提出基于攻击意图动态识别的攻击态势预测机制；3）提出策略驱动的主动式异常行为控制技术。通过上述研究，本项目将有助于提升安全防护的网络化、自动化和敏捷性，将对网络空间安全领域具有重要的理论意义与实际价值。

随着新型网络和智能网络设备的层出不穷，当前的网络安全形势日益严峻。网络安全防御逐渐由静态的终端防御向网络层面的主动防护、积极防御演化。本课题研究网络层面的软件定义安全架构下的异常流量检测方法、安全防御机制和异常行为控制技术。主要研究内容包括网络层面的异常流量的检测，攻击意图识别和防御机制、深度学习算法在网络安全上的应用等方面。具体研究工作包括：1）建立了面向软件定义的网络安全机制测试平台；2）研究了软件定义安全架构下的典型攻防机制，提出了基于软件定义安全的DDoS攻击检测与防御模型和基于PCA-DNN的扫描攻击检测模型；3）针对智能网络设备的安全问题，提出了基于流规则一致性的恶意交换机检测机制和基于端口动态变换的主动防御机制；4）针对流量分类和识别方面，提出了基于集成机器学习的流量分类技术；5）研究了网络攻击意图动态识别及攻击态势预测机制。该项目成果有助于提升安全防护的网络化、自动化和敏捷性，驱动信息安全新型架构升级发展，对网络空间安全领域具有重要的理论意义与实用价值。