天地一体化网络中深度包检测应用开发

发布时间：2018-10-18 08:54

【摘要】：天地一体化网络具有结构复杂、链路质量较差和网络拓扑结构动态变化等特点,通常使用延迟容忍网络(Delay Tolerant Network,DTN)协议实现互联互通。天地一体化网络是一种高度开放的无线网络,要面对更多的安全隐患与挑战。深度包检测技术(Deep Packet Inspection,DPI)能够利用网络协议的高度规则性快速探测攻击的存在,在网络安全方面具有较高的实用性,但在天地一体化网络中针对空间网络协议还没有成熟的应用研究。由此,开展天地一体化网络中深度包检测的应用研究具有实际意义。本文以实验室承担的国家863计划课题“未来一体化标识网络关键技术和示范”(NO.2015AA015702)为依托,基于课题组搭建的采用DTN架构的天地一体化网络原型系统,设计并实现了基于nDPI的DTN协议深度包检测系统,完成了DTN协议深度包检测系统在天地一体化网络环境中的应用效果验证。本文基于nDPI开源平台实现了 DTN协议深度包检测系统的开发,在开源平台原有框架的基础上完成了模块拓展和适应性开发,系统主要包括预处理,协议检测,规则分析和响应报警四大模块。其中,协议检测模块作为核心模块,针对DTN增加了汇聚层和包裹层的检测过程,汇聚层检测实现了 TCP汇聚层协议(TCP Convergence-Layer Protocol,TCPCL)和 Licklider 传输协议(Licklider Transmission Protocol,LTP)的消息识别和状态检测功能,包裹层检测实现了包裹协议(Bundle Protocol)的解析和有效载荷检测的功能。消息识别与状态检测功能模块的联动能够实现对DTN汇聚层协议异常交互的有效识别,从而检测出恶意流量,Bundle协议解析和有效载荷检测能够实现对恶意和敏感载荷的检测。为验证本文实现的DTN协议深度包检测系统在天地一体化网络中的应用效果,本文基于863课题组搭建的原型系统设计了地面恶意攻击、空间恶意攻击和恶意负载三种攻击检测实验场景。验证了本文设计的DTN协议深度包检测系统在天地一体化网络中能够实现对端口扫描攻击、拒绝服务攻击、DDoS攻击、蠕虫病毒恶意载荷以及敏感词载荷的有效检测。
[Abstract]:Due to its complex structure, poor link quality and dynamic change of network topology, the integrated network of heaven and earth is usually interlinked by delay tolerant network (Delay Tolerant Network,DTN) protocol. The integrated network of heaven and earth is a highly open wireless network, which has to face more security risks and challenges. The depth packet detection (Deep Packet Inspection,DPI) technology can use the high rule of network protocol to detect the existence of attack quickly, and has high practicability in the aspect of network security. However, there is no mature application research on the space network protocol in the world integrated network. Therefore, it is of practical significance to study the application of depth packet detection in the world integrated network. Based on the national 863 project "key Technology and demonstration of Future Integrated Identification Network" (NO.2015AA015702), this paper is based on the prototype system of the integrated network of heaven and earth based on the DTN architecture, which is built by the research group. The DTN protocol depth packet detection system based on nDPI is designed and implemented, and the application effect of the DTN protocol depth packet detection system in the integrated network environment of heaven and earth is verified. This paper realizes the development of DTN protocol depth package detection system based on nDPI open source platform. Based on the original framework of open source platform, the module extension and adaptive development are completed. The system mainly includes preprocessing, protocol detection. Rule analysis and response alarm four modules. As the core module, the protocol detection module adds the detection process of the convergence layer and the package layer to the DTN. The convergence layer detection realizes the message recognition and status detection functions of the TCP convergence layer protocol (TCP Convergence-Layer Protocol,TCPCL) and the Licklider transport protocol (Licklider Transmission Protocol,LTP. The package layer detection realizes the parse of package protocol (Bundle Protocol) and the function of payload detection. The linkage of message recognition and state detection module can effectively identify the abnormal interaction of DTN convergence layer protocol, and detect malicious traffic. Bundle protocol parsing and payload detection can realize the detection of malicious and sensitive load. In order to verify the application effect of the DTN protocol depth packet detection system in the integrated network of heaven and earth, this paper designs a malicious attack on the ground based on the prototype system built by the 863 research group. Space malicious attack and malicious load attack detection of three experimental scenarios. It is verified that the DTN protocol depth packet detection system designed in this paper can effectively detect port scan attack, denial of service attack, DDoS attack, malicious load of worm and load of sensitive words in the integrated network of heaven and earth.
【学位授予单位】：北京交通大学
【学位级别】：硕士
【学位授予年份】：2017
【分类号】：TN927

【相似文献】