基于路径与端址跳变的SDN网络主动防御技术

发布时间：2018-05-17 10:03

本文选题：软件定义网络 + 移动目标防御　；参考：《计算机研究与发展》2017年12期

【摘要】：为解决已有路径跳变技术难以抵御全局截获分析攻击及已有端址跳变技术跳变同步难、部署难度大等问题,提出基于路径与端址跳变的SDN网络主动防御技术.首先,将路径跳变问题建模为约束求解问题,使用可满足性模理论求解器求解获得满足重复约束和容量约束的多条路径,然后,依据特定跳变时隙向所选跳变路径上的所有OpenFlow交换机下发对应的端址跳变流表项,使这些交换机对数据流进行正确转发的同时,更改其端口与地址信息.理论分析与实验结果表明:所提技术可以以较小的通信时延开销与计算开销实现通信双方传输路径与传输路径上端口与地址的随机跳变,且可提升SDN网络对于全局截获分析攻击、拒绝服务攻击与内部威胁的主动防御能力.
[Abstract]:In order to solve the problem that the existing path hopping technology is difficult to resist the attack of global interception and analysis and the synchronization and deployment of the existing terminal address jump technology, the active defense technology based on path and end address jump for SDN network is proposed. Firstly, the path jump problem is modeled as a constraint solution problem, and multiple paths satisfying the repeated constraints and capacity constraints are obtained by using the satisfiability modulus theory solver. According to the specific hopping time slot, the corresponding end-to-address jump flow table items are sent to all OpenFlow switches on the selected hopping path, so that these switches can correctly forward the data flow and change the port and address information at the same time. The theoretical analysis and experimental results show that the proposed technique can realize the random jump between the communication path and the port and address on the transmission path with small communication delay overhead and computational overhead. And it can enhance the active defense ability of SDN network against global interception analysis attack, denial of service attack and internal threat.
【作者单位】：数学工程与先进计算国家重点实验室;江南计算技术研究所;
【基金】：国家自然科学基金项目(61402526,61402525,61502528)~~
【分类号】：TP393.08

【相似文献】