数据驱动的软件定义安全

发布时间：2018-12-18 10:04

【摘要】：近年来,互联网的迅猛发展给人们带来巨大便利的同时,网络的安全防护、部署运维等领域面临着巨大的压力,但是传统网络很难从根本上解决这个问题,软件定义网络的出现打破了这个瓶颈。软件定义网络的核心思想就是将控制层与数据层分离,将控制层单独出来就为集中管理与控制可编程化提供了可能。将软件定义网络的这种思想引申到安全领域,用这种新的思想去设计、部署、管理安全机制就形成了软件定义安全的概念。软件定义安全提供了一种通过将安全机制从硬件层面抽象到软件层面,从而实现灵活且集中控制安全解决方案,吸引着很多研究人员深入研究。但是软件定义安全实现调度、管理自动化与智能化存在两个关键挑战:一个是安全智能信息交互问题,即如何通过处理系统中大量异构的威胁信息来实现众多安全应用的灵活调度和编排,另一个是安全能力抽象问题,即繁多的安全设备缺少统一的标准化接口供安全系统集中控制。为了解决这两个问题,这篇文章提出了一种数据驱动的软件定义安全架构。为了集中管理架构中所有的数据,我们采用了结构化的威胁信息表达(STIX)模型和相应的工具来规范架构中的所有安全信息。在这个架构中,为了实现安全设备的统一编排以及他们产生的数据可以能够统一收集和分析,我们为安全设备提出了统一的接口标准。这两个改进点的实现使软件定义安全中的实时动态编排功能成为了可能。最后,我们还提供了一个编排场景实验演示来说明数据驱动的软件定义安全架构在实践中是如何工作的,并通过性能测试证明这种架构的可实施性。
[Abstract]:In recent years, the rapid development of the Internet has brought great convenience to people, at the same time, the network security protection, deployment, operation and maintenance and other fields are facing tremendous pressure, but the traditional network is very difficult to solve this problem fundamentally. The emergence of software-defined networks breaks this bottleneck. The core idea of the software defined network is to separate the control layer from the data layer, and to separate the control layer from the control layer provides the possibility for centralized management and programmable control. The idea of software definition network is extended to the field of security. The concept of software defined security is formed by using this new idea to design, deploy and manage the security mechanism. Software definition security provides a flexible and centralized control security solution by abstracting the security mechanism from the hardware level to the software level, attracting many researchers to study deeply. However, there are two key challenges to software definition, security, scheduling, management automation and intelligence: one is the problem of intelligent information interaction. That is, how to deal with a large number of heterogeneous threat information in the system to achieve the flexible scheduling and orchestration of many security applications, and the other is the abstraction of security capabilities. That is, many security devices lack a unified standardized interface for centralized control of security systems. In order to solve these two problems, this paper proposes a data-driven software definition security architecture. In order to centrally manage all the data in the architecture, we use the structured threat information to express the (STIX) model and the corresponding tools to standardize all the security information in the architecture. In this architecture, in order to achieve the unified arrangement of security devices and the data they produce can be collected and analyzed uniformly, we propose a unified interface standard for security devices. The implementation of these two improvement points makes it possible for real-time dynamic orchestration in software definition security. Finally, we provide an orchestration scenario experiment to illustrate how the data-driven software definition security architecture works in practice, and demonstrate its implementability through performance tests.
【学位授予单位】：北京邮电大学
【学位级别】：硕士
【学位授予年份】：2017
【分类号】：TP393.08

【相似文献】