命名数据网络内容污染防御机制研究

发布时间：2018-03-04 11:16

本文选题：命名数据网络　切入点：内容污染　出处：《江苏大学》2017年硕士论文　论文类型：学位论文

【摘要】：命名数据网络(Named Data Networking,NDN)作为一种革命式的未来网络设计思路,通过提供泛在式网内存储,改变了网络的通信模式。与传统TCP/IP网络相比,NDN在内容分发方面有着明显的先进性和优势,其主要特点集中体现在多样灵活的路由策略选择和基于数据本身的安全机制上,而由此带来诸多的理念和实践上的好处。但是,NDN也面临着若干新的安全问题,其中一类重要安全威胁即为内容污染攻击。内容污染攻击通过劫持源服务器,使网内充斥着虚假内容,严重制约着网络性能。针对这一问题,本文围绕内容污染的防御方法开展研究工作,通过分析NDN节点出现内容污染攻击的成因,深入探索有效的防御机制,并从理论角度进行防御机制性能评估。本文研究工作的主要创新点是:(1)针对存在虚假内容的非安全NDN网络,提出节点接口可靠性的概念,利用节点接口对接收数据包的校验成功概率来评估该接口的可靠性,进而提出了一种基于节点接口可靠性的概率转发策略(PFSIR),根据节点接口的可靠性来设置兴趣包在该接口的转发概率,将请求兴趣包大概率转发到可靠性高的内容源。在此基础上,对PFSIR下的网络性能进行了理论分析,并与等概率随机转发策略进行对比。数值结果表明,当接入请求流量在一定范围内,本策略对内容源污染有较好的防御效果,与等概率随机转发策略相比,优势较为明显。(2)考虑到PFSIR策略虽然可以通过转发策略,将请求流量大概率转发到可靠性高的内容源,实现非安全NDN环境下网络性能的提升。但是,随着网络内容源污染程度加深,当大多数内容源均出现污染时,单纯从路由机制角度,难以对抗网内虚假内容泛滥,PFSIR策略不能维持网络的正常工作,还是需要有效的校验机制配合才能抑制内容污染。针对这一问题,论文进一步提出了一种基于节点可信度的概率校验策略(PVSRC),对NDN节点接收数据流的真实性加以评估,以此作为节点可信度设置校验概率,在保证了节点缓存真实内容比例的同时,降低节点的无效校验开销,提高了校验机制的可行性。数值计算结果表明,相比于命中校验机制,PVSRC能更有效抑制网内内容污染攻击,综合性能较优。
[Abstract]:As a revolutionary way of future network design, named Data Network (NDN) has changed the communication mode of the network by providing universal storage in the network. Compared with the traditional TCP/IP network, it has obvious advantages and advantages in content distribution. The main features of NDN are mainly reflected in the flexible routing policy choice and the security mechanism based on data itself, which brings many benefits in concept and practice. However, NDN also faces some new security problems. One of the most important security threats is the content pollution attack, which makes the network full of false content by hijacking the source server, which seriously restricts the performance of the network. In this paper, the defense methods of content pollution are studied, and the effective defense mechanism is explored by analyzing the causes of content pollution attacks on NDN nodes. The main innovation of this paper is the concept of node interface reliability for insecure NDN networks with false content. The reliability of the node interface is evaluated by using the success probability of the node interface to verify the received data packet. Then a probabilistic forwarding strategy based on the reliability of node interface is proposed. According to the reliability of the node interface, the probability of forwarding interest packets in the interface is set, and the large probability of requesting interest packets is forwarded to the content source with high reliability. The network performance under PFSIR is analyzed theoretically and compared with the equal probability random forwarding strategy. The numerical results show that when the access request traffic is within a certain range, the strategy has a good defense effect against the content source pollution. Compared with the equal probability random forwarding strategy, the advantage of the PFSIR strategy is obvious. (2) considering that the PFSIR strategy can transmit the high probability of request traffic to the content source with high reliability through the forwarding strategy, it can improve the network performance in the non-secure NDN environment. With the deepening of network content source pollution, when most of the content sources are polluted, it is difficult to resist the proliferation of false content in the network simply from the point of view of routing mechanism. PFSIR strategy can not maintain the normal work of the network. In order to restrain the content pollution, an effective verification mechanism is needed. In this paper, a probabilistic verification strategy based on the reliability of the node is proposed to evaluate the authenticity of the data stream received by the NDN node. As a result of setting the check probability of the node credibility, it not only guarantees the proportion of the real content of the node cache, but also reduces the invalid check cost of the node, and improves the feasibility of the verification mechanism. The numerical results show that, Compared with the hit check mechanism PVSRC is more effective to suppress the content pollution attack in the network and the comprehensive performance is better.
【学位授予单位】：江苏大学
【学位级别】：硕士
【学位授予年份】：2017
【分类号】：TP393.02

【相似文献】