一种基于软件定义网络的移动目标防御方法的研究与实现

发布时间：2019-03-21 08:13

【摘要】：随着互联网技术的飞速发展,网络安全受到了社会各界的高度重视。多年的网络安全研究和实践表明,网络攻防的成本是非对称的,并且有利于攻击方。为改变“攻易守难”的网络攻防现状,学术界提出了移动目标防御(Moving Target Defense,MTD)这一新思想,试图让包含攻击面的目标以攻击方不可预知的方式移动,减少包括网络在内的计算机系统的静态和同质等特点,增加攻击方的成本,从而有效地提高网络的安全性。MTD技术对网络的可移动性提出了更高的要求。相比于传统网络,软件定义网络(Software-defined Networking,SDN)的逻辑集中控制和可编程的特性能够为MTD提供新的思路,同时其灵活的流表和消息机制也能够为网络的移动提供更好的技术支持。通过对网络攻击流程的分析,攻击者首先要执行完毕情报收集过程才能继续进行下一步的攻击。通过对情报收集过程干扰,使攻击者陷入到情报收集过程的循环中,能够达到保护目标网络的目的。攻击者常用的网络探测手段有主机发现、端口扫描、指纹识别、网络拓扑映射和网络流量嗅探。因此,针对上述网络探测手段,结合SDN的能力和MTD思想进行防御,能有效提高网络的安全性。本文首先分析了移动目标防御技术的发展现状,然后对常见的网络探测手段进行了攻击面分析,并针对相应的攻击提出了基于SDN的移动目标防御策略,最后在开源的Mininet网络仿真工具和SDN控制器框架的基础上,设计并实现了 SDN移动目标防御仿真系统。通过实验仿真,初步验证了所提移动目标防御方法的有效性。
[Abstract]:With the rapid development of Internet technology, network security has been highly valued by all walks of life. Many years of network security research and practice show that the cost of network attack and defense is asymmetric and beneficial to the attacker. In order to change the current situation of "attack easy to defend" network attack and defense, the academic circles put forward the new idea of mobile target defense (Moving Target Defense,MTD), trying to make the target including attack surface move in an unpredictable way by the attacking party. By reducing the static and homogeneous characteristics of computer systems including the network and increasing the cost of the attacker, the security of the network can be improved effectively. MTD technology puts forward higher requirements for the mobility of the network. Compared to traditional networks, the logical centralized control and programmable features of software-defined networks (Software-defined Networking,SDN) can provide new ideas for MTD. At the same time, its flexible flow table and message mechanism can also provide better technical support for network mobility. Through the analysis of the network attack process, the attacker must finish the intelligence gathering process before proceeding to the next attack. By interfering with the information gathering process, the attacker is trapped in the cycle of the information gathering process, and the goal of protecting the target network can be achieved. The network detection methods commonly used by attackers include host discovery, port scanning, fingerprint identification, network topology mapping and network traffic sniffing. Therefore, the security of the network can be effectively improved by combining the ability of SDN and the idea of MTD to defend against the above-mentioned network detection methods. This paper first analyzes the current situation of mobile target defense technology, then analyzes the attack surface of common network detection methods, and puts forward the mobile target defense strategy based on SDN for the corresponding attacks. Finally, based on the open source Mininet network simulation tool and SDN controller framework, a SDN mobile target defense simulation system is designed and implemented. The effectiveness of the proposed defense method for moving targets is verified by experimental simulation.
【学位授予单位】：北京邮电大学
【学位级别】：硕士
【学位授予年份】：2017
【分类号】：TP393.08

【相似文献】