MNOS:拟态网络操作系统设计与实现

发布时间：2018-02-20 23:55

本文关键词： 软件定义网络主动防御拟态安全防御动态异构冗余网络操作系统　出处：《计算机研究与发展》2017年10期 　论文类型：期刊论文

【摘要】：控制层的漏洞利用攻击,如恶意APP、流表篡改等是软件定义网络(software defined networking,SDN)面临的主要威胁之一,而传统基于漏洞修复技术的防御策略无法应对未知漏洞或后门.提出一种基于拟态防御思想的网络操作系统安全架构——拟态网络操作系统(mimic network operating system,MNOS)——保障SDN控制层安全.该架构采用异构冗余的网络操作系统(network operating system,NOS),并在传统的SDN数据层和控制层间增设了拟态层,实现动态调度功能.首先拟态层动态选取若干NOS作为激活态并行提供服务,然后根据各NOS的处理结果决定最终的有效响应返回底层交换机.实验评估表明:在增加有限的时延开销下,MNOS可以有效降低SDN控制层被成功攻击的概率,并具备良好的容错/容侵能力;在此基础上,提出的选调策略和判决机制,可以有效提升系统的异构度和判决的准确性,进一步提升安全性能.
[Abstract]:Vulnerability exploitation in the control layer, such as malicious app and stream table tampering, is one of the main threats to software defined networking. However, the traditional defense strategy based on vulnerability repair technology can not cope with unknown vulnerabilities or backdoors. This paper presents a security architecture of network operating system based on mimic network operating system and SDN control layer. Security. The architecture adopts heterogeneous and redundant network operating system operating system and adds a pseudo layer between the traditional SDN data layer and the control layer. The dynamic scheduling function is realized. Firstly, some NOS are selected dynamically in the pseudo layer as the active state to provide the service in parallel. Then according to the processing results of each NOS, the final effective response is decided to return to the underlying switch. The experimental evaluation shows that the MNOS can effectively reduce the probability of successful attack on the SDN control layer under the condition of increasing the limited delay overhead. On the basis of the proposed tuning strategy and decision mechanism, the heterogeneity of the system and the accuracy of the decision can be improved effectively, and the security performance can be further improved.
【作者单位】：国家数字交换系统工程技术研究中心;
【基金】：国家自然科学基金项目(61309020,61602509);国家自然科学基金创新群体项目(61521003) 国家重点研发计划项目(2016YFB0800100,2016YFB0800101) 河南省科技攻关项目(172102210615,172102210441)~~
【分类号】：TP316.8;TP393.0

【相似文献】