基于遗传算法的拟态蜜罐系统研究

发布时间：2018-08-26 19:55

【摘要】：蜜罐技术能够通过诱骗入侵者,主动了解黑客组织的攻击策略、工具和目的,弥补了入侵检测、防火墙等被动防御的不足,对防范他们的入侵具有极高的价值。然而,面对日益多样化的攻击,研究如何提高蜜罐主动性、自适应性是蜜罐持续有效的关键。首先,本文分别从防御者、入侵者角度阐述了蜜罐和反蜜罐技术研究热点。伴随着反蜜罐技术的应用,防御者引入伪蜜罐技术进行对抗。从中我们发现,单一的蜜罐技术或伪蜜罐技术对入侵者的诱骗程度有限。借鉴生物中拟态现象,课题组前期提出拟态蜜罐,将蜜罐和伪蜜罐技术结合,通过模拟服务环境的保护色机制(蜜罐)和模拟蜜罐特征的警戒色机制(伪蜜罐),进行拟态特征构建和动态演化,可以达到持续迷惑和诱骗攻击者的目的,本文主要针对拟态蜜罐特征的演化进行研究。借鉴生物进化中“优胜劣汰,适者生存”的思想,遗传算法已在入侵检测规则、服务组合优化中广泛应用。本文在阐述遗传算法流程和优点后,重点研究遗传算法在蜜罐优化问题上的应用,并提出了基于自适应遗传算法的蜜罐演化算法(GA-MHEA),该算法借助遗传算法的随机搜索策略和优质个体的可继承性。首先定义蜜罐/伪蜜罐服务诱骗QoS,然后针对蜜罐(保护色)和伪蜜罐(警戒色)服务特征和内容,提取并形式化关键服务特征进行编码。并依据蜜罐/伪蜜罐服务的诱骗QoS设计适应度函数,自适应调整遗传算子的操作空间,优化蜜罐的服务特征和服务内容,以应对不断变化的网络环境及攻击者的蜜罐识别扫描,为蜜罐系统的自适应性的提高提供新的技术路线。然后,在分析拟态蜜罐中警戒色失效后果的严重性基础上,提出了服务器逃逸机制,即攻击者一旦识破系统中的伪蜜罐,进行伪蜜罐服务迁移,蜜罐候补,增加拟态蜜罐系统的抗攻击能力。在研究的最后,本文针对基于遗传算法的拟态式蜜演化系统的NS2仿真及Linux系统QT平台下的原型实现,分别设计带有蜜罐识别的Syn-Flood攻击实验。通过实验验证了拟态蜜罐服务演化扫描攻击特性,证明了GA-MHEA演化策略可行性和有效性。
[Abstract]:Honeypot technology can deceive intruders and actively understand the attack strategies tools and purposes of hacker organizations and make up for the shortcomings of passive defense such as intrusion detection firewall and so on. It is of great value to prevent their intrusion. However, in the face of increasingly diverse attacks, the study of how to improve the honeypot initiative, self-adaptability is the key to the continued effectiveness of honeypot. Firstly, the research focus of honeypot and anti-honeypot technology are discussed from the point of view of defenses and intruders respectively. With the application of anti-honeypot technology, defenders introduce pseudo-honeypot technology to counter. We find that the single honeypot technology or pseudo honeypot technology is limited in the degree of invaders. Drawing lessons from the mimicry phenomenon in biology, the research group put forward the pseudo honeypot in the early stage, combining honeypot and pseudo honeypot technology. By simulating the protective color mechanism of serving environment (honeypot) and the warning mechanism of simulated honeypot feature (pseudo honeypot), the pseudo feature can be constructed and dynamically evolved, and the purpose of continually confusing and deceiving the attacker can be achieved. In this paper, the evolution of the characteristics of simulated honeypot is studied. Based on the idea of "survival of the fittest and survival of the fittest" in biological evolution, genetic algorithm has been widely used in intrusion detection rules and service composition optimization. After expounding the flow and advantages of genetic algorithm, this paper focuses on the application of genetic algorithm in honeypot optimization. A honeypot evolutionary algorithm (GA-MHEA) based on adaptive genetic algorithm (AGA) is proposed. The algorithm is based on the random search strategy of genetic algorithm and the inheritance of high-quality individuals. Firstly, the honeypot / pseudo honeypot service decoy QoS, is defined, and then the key service features are extracted and coded according to the honeypot (protective color) and pseudo honeypot (alert color) service features and contents. According to the QoS of honeypot / pseudo honeypot service, the fitness function is designed, the operation space of genetic operator is adjusted adaptively, and the service features and contents of honeypot are optimized to deal with the changing network environment and the honeypot identification scan of the attacker. It provides a new technical route for improving the adaptability of honeypot system. Then, on the basis of analyzing the severity of warning color failure in simulated honeypot, a mechanism of server escape is proposed, that is, once the attacker detects the pseudo honeypot in the system, the false honeypot service is migrated and the honeypot alternate. Increases the ability to resist attack of a simulated honeypot system. At the end of the study, aiming at the NS2 simulation of pseudo-honey evolution system based on genetic algorithm and the prototype implementation of Linux system based on QT platform, the Syn-Flood attack experiment with honeypot recognition is designed respectively. The characteristics of evolution scan attack of simulated honeypot service are verified by experiments, and the feasibility and effectiveness of GA-MHEA evolution strategy are proved.
【学位授予单位】：中国石油大学(华东)
【学位级别】：硕士
【学位授予年份】：2014
【分类号】：TP393.08;TP18

【相似文献】