基于SDN的动目标防御网络关键技术研究

Moving Target Defense is a new kind of network security techniques, which is to create, evaluate, and deploy mechanisms and strategies that are diverse, continually shift, and change over time to increase complexity and costs for attackers, limit the exposure of vulnerabilities and opportunities for attack, and increase system resiliency. In this project, the corresponding key techniques for moving target defense network based on SDN was researched..About the dynamical address changing techniques, the MAC address resolution problem in the context of dynamic addresses was analyzed. A novel MAC address resolution solution was proposed based on SDN, which is able to resolve the MAC addresses automatically in the context of dynamic addresses. Also, the limitation of terminal hosts’ changing scopes in current dynamic address proposals and its impact were analyzed. A novel dynamic address solution was proposed based on SDN, which could effectively manage the whole dynamically changing process and extend the terminal hosts’ changing scopes to a great extent..About the dynamical route changing techniques, the corresponding problems of route dynamical changing were analyzed. The thought of separating logical routes and physical routes was proposed. Based on that, a novel logical route dynamical changing solution based on SDN was proposed, which could achieve wide route dynamical changing in the network while maintaining normal communication process. After that, to satisfy relative needs of physical route dynamical changing, a novel physical route dynamical changing solution based on SDN was proposed, which could achieve both physical route and logical route dynamical changing to improve the feasibility and effectiveness of route dynamical changing techniques..About the moving target defense network analyzing techniques, the problem of false link inferences caused by load balancing was formulized. A novel assumption was proposed based on a fact observed from experiments. A novel link inference algorithm was proposed based on the assumption, which could improve the link inference correctness in the context of load balancing to a great extent. After that, an analysis model of moving target defense network effectiveness was proposed from the view of attack time. The effectiveness of moving target defense network was then analyzed according to the model. At last, a moving target defense network parallel analyzing solution was proposed based on corresponding analysis results.

动态目标防御技术是一种新型的网络安全技术，通过构建、评价和部署多样化、不断迁移并且随时间变化的机制及策略的方式，增加攻击者的攻击难度及代价，有效限制脆弱性的暴露及被攻击的机会，提高系统的弹性。本项目结合新一代网络架构SDN直接灵活、集中式的网络控制能力优势，对动态目标防御网络的动态地址防御与动态路由防御等相关关键技术进行研究。.在动态地址防御技术方面，研究基于SDN的IP地址动态变换方案，实现透明化、跨子网的主机地址动态变换，大幅度地提高主机地址的不确定性及不可预测性。在动态路由防御技术研究方面，研究基于SDN的逻辑路由与物理路由动态变换方案，能够以极小的代价在保证正常通信过程的前提下，有效地实现物理路由与逻辑路由的综合动态变换。并且，针对动目标防御网络中负载均衡导致的链路推测错误的问题，进行形式化分析和评估，研究新的链路推测算法，大幅提高链路推测准确性。

动态目标防御技术是一种新型的网络安全技术，通过构建、评价和部署多样化、不断迁移并且随时间变化的机制及策略的方式，增加攻击者的攻击难度及代价，有效限制脆弱性的暴露及被攻击的机会，提高系统的弹性。项目结合新一代网络架构SDN直接灵活、集中式的网络控制能力优势，对动态目标防御网络的相关关键技术进行了深入研究，主要研究工作及创新点如下：.对于基于SDN的路由随机变换技术，项目从同时保护路由器和终端数据流的角度出发，围绕提高路由随机变换性能和安全效能的目标，提出了一种新的基于SDN的拓展路由随机变换技术，并从路由随机变换的变换空间、变换频率、数据传输时间以及丢包率等方面对所提的拓展路由随机变换技术进行了性能分析和评估。.对于基于SDN的地址随机变换技术，项目从保护主机的角度出发，围绕提高地址随机变换性能和安全效能的目标，提出了一种新的基于SDN的拓展地址随机变换技术，并从地址随机变换的变换空间、变换频率、数据传输时间以及丢包率等方面对所提的拓展地址随机变换技术进行了性能分析和评估。.综合前述成果，项目从同时保护网络中路由器、终端数据流以及主机的角度出发，提出了一种新的基于SDN的地址与路由综合随机变换技术，并从地址和路由变换空间、地址和路由变换频率、数据传输时间以及丢包率等方面对所提的地址与路由综合随机变换技术进行了性能分析和评估。.最后，项目提出了路由随机变换技术安全效能分析模型，并分别对路由随机变换技术对于路由器和终端数据流的安全效能进行了理论分析，对路由随机变换技术在面对针对路由器的漏洞攻击方式以及针对终端数据流的拒绝服务攻击方式时的安全效能进行了评估，实现了更高的安全性能。之后，提出了地址随机变换技术安全效能分析模型并进行了理论分析，对地址随机变换技术在面对针对主机的木马植入攻击方式时的安全效能进行了评估。综上，项目所提的地址随机变换技术对于主机的安全效能高于目前的地址随机变换技术。