基于多维动态网络属性的新型企业网防御系统的设计与实现

陈扬; 扈红超; 程国振

doi:10.1631/FITEE.1800516

Your Location：

Home >

Browse articles >

基于多维动态网络属性的新型企业网防御系统的设计与实现

常规文章 | Updated：2022-05-19

- 基于多维动态网络属性的新型企业网防御系统的设计与实现
- Design and implementation of a novel enterprise network defense system by maneuvering multi-dimensional network properties
- 信息与电子工程前沿（英文） 2019年20卷第2期页码：238-252
- Affiliations：
  
  National Digital Switching System Engineering & Technological R & D Center, Zhengzhou 450002, China
- Author bio：
  
  Hong-chao HU, E-mail: 13633833568@139.com
- Funds：
  
  Project supported by the Information Engineering University Emerging Direction Cultivation Fund, China (No. 2016610708), the Science and Technology Research Project of Henan, China (No. 172102210615), the National Natural Science Foundation of China (Nos. 61521003 and 61602509), and the National Key Research and Development Program of China (Nos. 2016YFB0800100 and 2016YFB0800101)
- DOI：10.1631/FITEE.1800516
  中图分类号： TP393
- 收稿：2018-08-30，
  
  修回：2019-;1-22，
  
  纸质出版：2019-02
- Accepted：
Scan QR Code
陈扬, 扈红超, 程国振. 基于多维动态网络属性的新型企业网防御系统的设计与实现[J]. 信息与电子工程前沿（英文）, 2019,20(2):238-252.

Yang CHEN, Hong-chao HU, Guo-zhen CHENG. Design and implementation of a novel enterprise network defense system by maneuvering multi-dimensional network properties[J]. Frontiers of Information Technology & Electronic Engineering, 2019, 20(2): 238-252.
陈扬, 扈红超, 程国振. 基于多维动态网络属性的新型企业网防御系统的设计与实现[J]. 信息与电子工程前沿（英文）, 2019,20(2):238-252. DOI： 10.1631/FITEE.1800516.

Yang CHEN, Hong-chao HU, Guo-zhen CHENG. Design and implementation of a novel enterprise network defense system by maneuvering multi-dimensional network properties[J]. Frontiers of Information Technology & Electronic Engineering, 2019, 20(2): 238-252. DOI： 10.1631/FITEE.1800516.

摘要

虽然周界安全模型在内部主机可靠时足够有效，但是随着企业采用移动和云技术，如自带设备（BYOD），该模型难以为继。有针对性的高级网络攻击通常采用网络杀伤链，例如，基于网络扫描技术收集潜在目标信息。本文提出一种"隔离和动态"网络防御方法，切断潜在杀伤链，降低攻击者收集信息的可用性。首先，通过网络隔离构建一个零信任网络环境，操纵多维网络属性跳变，使攻击者无法获得目标主机的特征和位置；其次，为企业网络提出一种基于软件定义的主动网络防御解决方案（SPD），并设计了一个通用框架，在不显著影响网络性能条件下，策略性地操纵IP地址、网络端口、域名和路径的协同跳变；然后，通过软件定义网络控制器（OpenDaylight）实现SPD概念验证系统；最后，搭建实验平台验证系统防扫描、防窃听和防拒绝服务（DoS）攻击的能力。结果表明，该系统可以显著降低网络侦察扫描信息的可用性，阻止网络窃听，并大幅增加攻击者的网络攻击成本。

Abstract

Although the perimeter security model works well enough when all internal hosts are credible

it is becoming increasingly difficult to enforce as companies adopt mobile and cloud technologies

i.e.

the rise of bring your own device (BYOD). It is observed that advanced targeted cyber-attacks usually follow a cyber kill chain; for instance

advanced targeted attacks often rely on network scanning techniques to gather information about potential targets. In response to this attack method

we propose a novel approach

i.e.

an "isolating and dynamic" cyber defense

which cuts these potential chains to reduce the cumulative availability of the gathered information. First

we build a zero-trust network environment through network isolation

and then multiple network properties are maneuvered so that the host characteristics and locations needed to identify vulnerabilities cannot be located. Second

we propose a software-defined proactive cyber defense solution (SPD) for enterprise networks and design a general framework to strategically maneuver the IP address

network port

domain name

and path

while limiting the performance impact on the benign network user. Third

we implement our SPD proof-of-concept system over a software-defined network controller (OpenDaylight). Finally

we build an experimental platform to verify the system's ability to prevent scanning

eavesdropping

and denial-of-service attacks. The results suggest that our system can significantly reduce the availability of network reconnaissance scan information

block network eavesdropping

and sharply increase the cost of cyber-attacks.

关键词

Keywords

references

M Al-Fares , , , A Loukissas , , , A Vahdat . . A scalable, commodity data center network architecture . . ACM SIGCOMM Conf on Data Communication , , 2008 . . p.63 - - 74 . . DOI: 10.1145/1402958.1402967 http://doi.org/10.1145/1402958.1402967 . .

S Antonatos , , , P Akritidis , , , EP Markatos , , , 等 . . Defending against hitlist worms using network address space randomization . . Comput Netw , , 2007 . . 51 ( ( 12 ): ): 3471 - - 3490 . . DOI: 10.1016/j.comnet.2007.02.006 http://doi.org/10.1016/j.comnet.2007.02.006 . .

M Atighetchi , , , P Pal , , , F Webber , , , 等 . . Adaptive use of network-centric mechanisms in cyber-defense . . 6 th IEEE Int Symp on Object-Oriented Real-Time Distributed Computing , , 2003 . . p.183 - - 192 . . DOI: 10.1109/ISORC.2003.1199253 http://doi.org/10.1109/ISORC.2003.1199253 . .

TE Carroll , , , M Crouse , , , EW Fulp , , , 等 . . Analysis of network address shuffling as a moving target defense . . IEEE Int Conf on Communications , , 2014 . . p.701 - - 706 . . DOI: 10.1109/ICC.2014.6883401 http://doi.org/10.1109/ICC.2014.6883401 . .

Q Duan , , , E Al-Shaer , , , H Jafarian . . Efficient random route mutation considering flow and network constraints . . IEEE Conf on Communications and Network Security , , 2013 . . p.260 - - 268 . . DOI: 10.1109/CNS.2013.6682715 http://doi.org/10.1109/CNS.2013.6682715 . .

Duo . . Liftoff: guide to duo deployment best practices , , [Accessed on Oct. 18, 2018] 2018 . . https://duo.com/assets/pdf/Duo-Liftoff-Guide.pdf https://duo.com/assets/pdf/Duo-Liftoff-Guide.pdf , , . .

V Escobedo , , , B Beyer , , , M Saltonstall , , , 等 . . BeyondCorp 5: the user experience . . Login , , 2017 . . 42 ( ( 3 ): ): 38 - - 43 . . . .

DA Flores , , , F Qazi , , , A Jhumka . . Bring your own disclosure: analysing BYOD threats to corporate information . . IEEE Trustcom/BigDataSE/ISPA , , 2016 . . p.1008 - - 1015 . . DOI: 10.1109/TrustCom.2016.0169 http://doi.org/10.1109/TrustCom.2016.0169 . .

A Greenberg , , , JR Hamilton , , , N Jain , , , 等 . . Vl2: a scalable and flexible data center network . . ACM SIGCOMM Comput Commun Rev , , 2009 . . 39 ( ( 4 ): ): 51 - - 62 . . DOI: 10.1145/1594977.1592576 http://doi.org/10.1145/1594977.1592576 . .

ZT Guan , , , J Li , , , LF Wu , , , 等 . . Achieving efficient and secure data acquisition for cloud-supported Internet of Things in smart grid . . IEEE Internet Things J , , 2017 . . 4 ( ( 6 ): ): 1934 - - 1944 . . DOI: 10.1109/JIOT.2017.2690522 http://doi.org/10.1109/JIOT.2017.2690522 . .

E Hutchins , , , M Cloppert , , , R Amin . . Intelligence-driven computer network defense informed by analysis of adversary campaigns and intrusion kill chains . . In: Ryan J (Ed.), Leading Issues in Information Warfare & Security Research. Academic Publishing International Limited, London, UK , , 2011 . . p.80 - - 106 . . . .

JH Jafarian , , , E Al-Shaer , , , Q Duan . . Openflow random host mutation: transparent moving target defense using software defined networking . . 1 st Workshop on Hot Topics in Software Defined Networks , , 2012 . . p.127 - - 132 . . DOI: 10.1145/2342441.2342467 http://doi.org/10.1145/2342441.2342467 . .

JH Jafarian , , , E Al-Shaer , , , Q Duan . . Formal approach for route agility against persistent attackers . . 18 th European Symp on Research in Computer Security , , 2013 . . p.237 - - 254 . . DOI: 10.1007/978-3-642-40203-6_14 http://doi.org/10.1007/978-3-642-40203-6_14 . .

JH Jafarian , , , E Al-Shaer , , , Q Duan . . An effective address mutation approach for disrupting reconnaissance attacks . . IEEE Trans Inform Forensics Secur , , 2015 . . 10 ( ( 12 ): ): 2562 - - 2577 . . DOI: 10.1109/TIFS.2015.2467358 http://doi.org/10.1109/TIFS.2015.2467358 . .

D Kewley , , , R Fink , , , J Lowry , , , 等 . . Dynamic approaches to thwart adversary intelligence gathering . . DARPA Information Survivability Conf and Exposition Ⅱ , , 2001 . . p.176 - - 185 . . DOI: 10.1109/DISCEX.2001.932214 http://doi.org/10.1109/DISCEX.2001.932214 . .

J Kindervag . . Build security into your network's DNA: the zero trust network architecture , , [Accessed on Nov. 5, 2010] 2010 . . http://www.ndm.net/firewall/pdf/palo_alto/Forrester-Build-Security-Into-Your-Network.pdf http://www.ndm.net/firewall/pdf/palo_alto/Forrester-Build-Security-Into-Your-Network.pdf , , . .

J Kindervag . . No more chewy centers: the zero-trust model of information security , , [Accessed on Mar. 23, 2016] 2016 . . http://crystaltechnologies.com/wp-content/uploads/2017/12/forrester-zero-trust-model-information-security.pdf http://crystaltechnologies.com/wp-content/uploads/2017/12/forrester-zero-trust-model-information-security.pdf , , . .

C Lei , , , DH Ma , , , HQ Zhang , , , 等 . . Network moving target defense technique based on optimal forwarding path migration . . J Commun , , 2017 . . 38 ( ( 3 ): ): 133 - - 143 . . DOI: 10.11959/j.issn.1000-436x.2017056 http://doi.org/10.11959/j.issn.1000-436x.2017056 . .

GL Li , , , J Wu , , , JH Li , , , 等 . . Service popularity-based smart resources partitioning for fog computing-enabled industrial Internet of Things . . IEEE Trans Ind Inform , , 2018 . . 14 ( ( 10 ): ): 4702 - - 4711 . . DOI: 10.1109/TII.2018.2845844 http://doi.org/10.1109/TII.2018.2845844 . .

KW Miller , , , J Voas , , , GF Hurlburt . . BYOD: security and privacy considerations . . It Prof , , 2012 . . 14 ( ( 5 ): ): 53 - - 55 . . DOI: 10.1109/MITP.2012.93 http://doi.org/10.1109/MITP.2012.93 . .

J Peck , , , B Beyer , , , C Beske , , , 等 . . Migrating to BeyondCorp: maintaining productivity while improving security . . Login , , 2017 . . 42 ( ( 3 ): ): 49 - - 55 . . . .

DP Sharma , , , DS Kim , , , S Yoon , , , 等 . . FRVM: flexible random virtual IP multiplexing in software-defined networks . . 17 th IEEE Int Conf on Trust, Security, and Privacy in Computing and Communications/12 th IEEE Int Conf on Big Data Science and Engineering , , 2018 . . p.579 - - 587 . . DOI: 10.1109/trustcom/bigdatase.2018.00088 http://doi.org/10.1109/trustcom/bigdatase.2018.00088 . .

E Talipov , , , DX Jin , , , J Jung , , , 等 . . Path hopping based on reverse AODV for security . . 9 th Asia-Pacific Int Conf on Network Operations and Management: Management of Convergence Networks and Services , , 2006 . . p.574 - - 577 . . DOI: 10.1007/11876601_69 http://doi.org/10.1007/11876601_69 . .

J Wu , , , MX Dong , , , K Ota , , , 等 . . Big data analysis-based secure cluster management for optimized control plane in software-defined networks . . IEEE Trans Netw Serv Manag , , 2018 . . 15 ( ( 1 ): ): 27 - - 38 . . DOI: 10.1109/TNSM.2018.2799000 http://doi.org/10.1109/TNSM.2018.2799000 . .

Y Zhou , , , W Ni , , , KF Zheng , , , 等 . . Scalable node-centric route mutation for defense of large-scale software-defined networks . . Secur Commun Netw , , 2017 . . 2017 4651395 DOI: 10.1155/2017/4651395 http://doi.org/10.1155/2017/4651395 . .

浏览量

Downloads

CSCD

文章被引用时，请邮件提醒。

Submit

工具集

关联资源

Discovery method for distributed denial-of-service attack behavior in SDNs using a feature-pattern graph model