技术领域technical field
本发明涉及拟态网络，具体涉及一种高速轻量级拟态虚拟网构建方法。The invention relates to a mimic network, in particular to a method for constructing a high-speed lightweight mimic virtual network.
背景技术Background technique
目前，主动防御技术是网络安全的关键技术，网络虚拟化及拟态网络是实现网络主动防御的一种有效技术途径。拟态网络是一种全新的主动防御技术方法。拟态网络利用网络属性多样化、系统化及动态化等特征，在网络逻辑功能等价的条件下，以防御者可控的方式通过网络、平台、环节、软件、数据等结构的主动跳变与快速迁移来实现拟态环境，对外呈现目标网络环境的动态性、非确定性、异构性和非持续性的变化网络，从而增加攻击难度和攻击成本。At present, active defense technology is the key technology of network security, and network virtualization and mimic network are an effective technical way to realize network active defense. Mimic network is a brand-new active defense technology method. The mimic network takes advantage of the characteristics of network attributes such as diversification, systematization, and dynamism. Under the condition that the network logic function is equivalent, the defender can control the network, platform, links, software, data and other structures through active jumps and attacks. Rapid migration to realize the pseudo-environment, and externally present the dynamic, non-deterministic, heterogeneous and non-sustainable change network of the target network environment, thereby increasing the difficulty and cost of attack.
网络虚拟化技术是实现拟态网络的有效途径。构建基于虚拟化的拟态网络需要解决三个方面的关键问题：一是网络架构及服务的虚拟化构建问题；二是可控的网络属性跳变与快速迁移问题；三是拟态网络功能等价于映射问题。Network virtualization technology is an effective way to realize mimic network. Building a virtualization-based mimic network needs to solve three key issues: first, the virtualization construction of network architecture and services; second, the controllable network attribute jump and rapid migration; third, the mimic network function is equivalent to Mapping problem.
发明内容Contents of the invention
本发明针对上述问题，提供一种高速轻量级拟态虚拟网构建方法，包括拟态虚拟网络构建方法和可控网络跳变与迁移方法；Aiming at the above problems, the present invention provides a high-speed lightweight mimic virtual network construction method, including a mimic virtual network construction method and a controllable network jump and migration method;
所述拟态虚拟网络构建方法包括以下步骤：The method for constructing a mimic virtual network comprises the following steps:
S11，令网络G＝(N,L)，其中N表示网络节点集，L表示网络链路集；节点n＝{id,nm,tp,os,nl,pt,sp,s},n∈N，其中id为节点序号，nm为节点名称，tp为节点类型，os为节点运行操作系统，nl为节点网络地址，sp为节点上的服务提供程序，pt为sp开放的端口，s为sp能够提供服务；S11, let the network G=(N,L), where N represents the network node set, L represents the network link set; node n={id, nm, tp, os, nl, pt, sp, s}, n∈N , where id is the node serial number, nm is the node name, tp is the node type, os is the node operating system, nl is the node network address, sp is the service provider on the node, pt is the port opened by sp, and s is the sp capability Provide services;
S12，链路l＝{id,nm,ni,nj},l∈L，其中id为节点序号，nm为链路名称，ni，nj分别为当前链路连接的两个节点；节点分为两种，一种是底层的物理节点，另一种即为容器节点；如果不特别指明，本构建方法中所称的节点即为容器节点；链路也分为两种，一种是物理节点之间连接的物理链路，另一种即为容器节点之间连接的SDN逻辑链路；S12, link l={id,nm,ni ,nj },l∈L, where id is the node serial number, nm is the link name, ni and nj are the two nodes connected by the current link respectively; There are two types of nodes, one is the underlying physical node, and the other is the container node; if not specified, the node referred to in this construction method is the container node; the link is also divided into two types, one One is the physical link connecting physical nodes, and the other is the SDN logical link connecting container nodes;
S13，拟态虚拟网构建需要经历4个阶段，分别是节点构建阶段、链路构建阶段、网络构建阶段和拟态变化阶段；需要提供5种职能，分别是用户接口、逻辑模型、部件管理、拟态网络和外界信息；S13, the construction of a mimic virtual network needs to go through four stages, which are the node construction stage, the link construction stage, the network construction stage, and the mimic change stage; five functions need to be provided, namely user interface, logic model, component management, and mimic network and external information;
S14，在节点和链路构造过程中，用户接口需要用户提供上述模型中节点n的nm，tp，os，nl，sp信息和链路l的nm，ni，nj信息；逻辑模型需要针对用户接口获得信息，分别对节点与链路生成唯一的uuid编码，同时使用面向对象技术将其存储；S14, in the process of node and link construction, the user interface needs the user to provide the nm, tp, os, nl, sp information of the node n in the above model and the nm,ni ,nj information of the link l; the logic model needs to be aimed at The user interface obtains information, generates unique uuid codes for nodes and links, and stores them using object-oriented technology;
S15，在节点构建阶段，将生成的节点逻辑对象信息转化为DockerFile并提交给容器管理器，使得容器管理器生成所需的服务容器；在链路构建阶段，将生成的链路逻辑对象信息转化为对SDN控制器的RESTful API的调用，使得SDN控制器生成所需的OpenFlow流表信息，生成所定义的链路；在网络构建阶段将生成的容器和链路组合成为需要的拟态网络，随后构建协调器统一容器管理器和SDN控制器的功能，对用户提供系统运维接口，供用户进行控制；在拟态变化阶段，定义可控网络跳变和迁移方法，用户通过系统运维接口设定跳变与迁移相关参数，同时IDS日志等外界信息也作为可控网络跳变和迁移方法的决策依据；变化控制流程通过综合用户设定和外界信息做出决策，并通过协调器对容器和网络结构进行调整；S15, in the node construction phase, convert the generated node logical object information into a DockerFile and submit it to the container manager, so that the container manager generates the required service container; in the link construction phase, convert the generated link logical object information In order to call the RESTful API of the SDN controller, the SDN controller generates the required OpenFlow flow table information and generates the defined links; in the network construction phase, the generated containers and links are combined into the required mimic network, and then Build a coordinator to unify the functions of the container manager and SDN controller, and provide users with a system operation and maintenance interface for users to control; in the stage of mimicry change, define controllable network jump and migration methods, and users can set through the system operation and maintenance interface Jump and migration related parameters, and external information such as IDS logs are also used as the decision-making basis for controllable network jump and migration methods; the change control process makes decisions through comprehensive user settings and external information, and through the coordinator container and network structural adjustments;
所述可控网络跳变与迁移方法包括网络功能映射和网络跳变迁移。The controllable network hopping and migration method includes network function mapping and network hopping migration.
进一步地，所述网络功能映射具体为：Further, the network function mapping is specifically:
首先建立功能映射关系表；其形式为M＝{(nv,F)}，其中nv指网络服务或功能，F为功能提供二元组；随后建立映射函数，其形式为Fm(nv,Fset)，其中nv为服务类型，Fset为提供服务的二元组集合；还需要考虑功能依赖，所谓功能依赖是指某一功能的实现需要其他功能进行支撑，用nv′＝ref(nv)表示，即nv所依赖的其他功能；First establish a function mapping table; its form is M={(nv , F)}, wherein nv refers to network services or functions, and F provides a binary group for the function; then establishes a mapping function, and its form is Fm (nv , Fset ), where nv is the type of service, and Fset is the set of 2-tuples that provide services; functional dependence also needs to be considered, the so-called functional dependence means that the realization of a certain function needs other functions to support, use nv ′ ＝ref(nv ) represents, that is, other functions on which nv depends;
还包括在网络跳变和迁移后如何在可变空间内选择新的映射关系：It also includes how to select a new mapping relationship in the variable space after network jumps and migrations:
首先给定当前的(nv,F)，在可变空间中寻找Fnew≠F，使得其满足(nv,Fnew)；然后，找到nv的依赖关系nv′＝ref(nv)，通过其映射函数找到当前nv′对应的F′；随后验证Fnew是否满足F与F′之间的依赖关系，如果满足则直接通过映射函数修改功能映射关系，即将Fm(nv,F)映射为Fm(nv,Fnew)，如果不满足则组建中间构件适配Fnew与F′的关系，如果存在适配组件则将其与Fnew整合成F′new，再修改映射关系，如果不存在则重新寻找Fnew。First given the current (nv , F), search for Fnew ≠ F in the variable space so that it satisfies (nv , Fnew ); then, find the dependency relationship nv ′=ref(nv ), through its mapping function, find the corresponding F' of the current nv '; then verify whether Fnew satisfies the dependency between F and F', if so, directly modify the functional mapping relationship through the mapping function, that is, Fm (nv , F) is mapped to Fm (nv , Fnew ), if it is not satisfied, build an intermediate component to adapt the relationship between Fnew and F′, if there is an adaptation component, integrate it with Fnew into F′new , and then modify If the mapping relationship does not exist, search for Fnew again.
更进一步地，所述网络跳变迁移具体为：Further, the network hopping migration is specifically:
在可控网络跳变与迁移方法中，首先对链路及节点进行编号，实体链路分别为逻辑链路分别为物理节点分别为容器节点分别为In the controllable network hopping and migration method, the links and nodes are numbered first, and the physical links are respectively Logical links are The physical nodes are The container nodes are
Nc中的容器对应的操作系统为其提供的服务为Ntype表示基本服务类型，例如网页服务，数据库服务，文件存储服务等；而服务与服务程序是1:n关系，即定义服务提供函数f(s)，则其中服务程序sk ∈Sapp，可认为这里有两个重要条件：一是每一只提供一种二是sk在任意上都能运行；The operating system corresponding to the container in Nc is The services it provides are Ntype represents the basic service type, such as web page service, database service, file storage service, etc.; and the service and service program have a 1:n relationship, that is, define the service provider function f(s), then Among them, the service program sk ∈ Sapp can be regarded as There are two important conditions here: one is that each only provide one Second, sk in any can run on
随后利用随机函数r(t)与外部信息i对网络进行跳变与迁移；定义信息收益函数Pi(s,d)，其中s为变化的源Lg、Np、Ncos或Nc，d为变化的目的Lg、Np、Ncos或Nc，其值表示按照外部信息i从s变化到d的收益；因此对于某一源而言，其变化收益可视为收益向量将其使用min-max标准化，即Then use the random function r(t) and external information i to jump and migrate the network; define the information income function Pi (s,d), where s is the source of change Lg , Np , Ncos or Nc , d is the purpose of change Lg , Np , Ncos or Nc , and its value represents the income of changing from s to d according to external information i; therefore, for a certain source, its change income can be regarded as income vector Normalize it using min-max, i.e.
其中min(Pi(s,dn))表示所有pi(s,dn)中的最小值，max(Pi(s,dn))表示所有pi(s,dn)中的最大值；可视其为通过外部信息进行迁移的概率，则可定义变化收益为在实际变化过程中按照最大P(s,d)对应的变化进行迁移与跳变；Among them, min(Pi (s,dn )) represents the minimum value among all pi (s,dn ), max(Pi (s,dn )) represents the minimum value among all pi (s,dn ) The maximum value; it can be regarded as the probability of migration through external information, and the change income can be defined as Migrate and jump according to the change corresponding to the maximum P(s,d) during the actual change process;
可定义变化能力f(s,d)，其中s为变化的源Lg、Np、Ncos或Nc，d为变化的目的Lg、Np、Ncos或Nc；函数表示由s变化为d；链路的变化能力由SDN控制器提供，通过对OpenFlow交换机的流表进行更改实现链路的重映射；节点的变化由容器管理器提供，通过容器迁移和动态生成等实现容器的重映射；The ability to change f(s,d) can be defined, where s is the source of change Lg , Np , Ncos or Nc , d is the purpose of change Lg , Np , Ncos or Nc ; the function is represented by s The change is d; the ability to change the link is provided by the SDN controller, and the remapping of the link is realized by changing the flow table of the OpenFlow switch; the change of the node is provided by the container manager, and the container is realized through container migration and dynamic generation. remap;
最后，通过约束函数r对迁移后的状态进行检查；设置一系列检查条件并定义对应的阈值只有当所有检查条件得出的结果都符合各项阈值时，该次变化才能够实施；Finally, check the migrated state through the constraint function r; set a series of check conditions And define the corresponding threshold Only when the results of all inspection conditions meet the thresholds, the change can be implemented;
因此，可将T(S,t,i,Ce,c)定义为：Therefore, T(S,t,i,Ce ,c) can be defined as:
其中变化条件为max(P(s,d))，并通过ck(sth(c(S)))；其中ck(s)表示阈值检测函数。The change condition is max(P(s,d)), and passes ck(sth (c(S))); where ck(s) represents the threshold detection function.
本发明的优点：Advantages of the present invention:
本发明的高速轻量级拟态虚拟网构建方法为解决基于拟态虚拟网的主动网络防御提供了方法途径。虚拟网构建方法构建的拟态虚拟网是一种全新的主动防御技术，利用拟态虚拟网属性多样化、系统化及动态化等特性，使目标网络呈现动态性、非确定性、异构性和非持续性等变化特征，从而增加攻击难度和攻击成本。The high-speed and lightweight mimic virtual network construction method of the invention provides a method for solving the active network defense based on the mimic virtual network. The mimetic virtual network constructed by the virtual network construction method is a brand-new active defense technology, which makes the target network appear dynamic, non-deterministic, heterogeneous and non-deterministic by using the properties of the mimetic virtual network, such as diversification, systematization and dynamism. Change characteristics such as persistence, thereby increasing the difficulty and cost of attacks.
除了上面所描述的目的、特征和优点之外，本发明还有其它的目的、特征和优点。下面将参照图，对本发明作进一步详细的说明。In addition to the objects, features and advantages described above, the present invention has other objects, features and advantages. Hereinafter, the present invention will be described in further detail with reference to the drawings.
附图说明Description of drawings
构成本申请的一部分的附图用来提供对本发明的进一步理解，本发明的示意性实施例及其说明用于解释本发明，并不构成对本发明的不当限定。The accompanying drawings constituting a part of this application are used to provide further understanding of the present invention, and the schematic embodiments and descriptions of the present invention are used to explain the present invention, and do not constitute an improper limitation of the present invention.
图1是本发明的一种高速轻量级拟态虚拟网构建方法的拟态虚拟网络构建架构图；Fig. 1 is a kind of high-speed lightweight mimetic virtual network construction method of the present invention's mimetic virtual network construction framework diagram;
图2是本发明的一种高速轻量级拟态虚拟网构建方法的拟态虚拟网络示例架构图。FIG. 2 is an example architecture diagram of a mimetic virtual network in a method for constructing a high-speed lightweight mimetic virtual network according to the present invention.
具体实施方式Detailed ways
为了使本发明的目的、技术方案及优点更加清楚明白，以下结合附图及实施例，对本发明进行进一步详细说明。应当理解，此处所描述的具体实施例仅仅用以解释本发明，并不用于限定本发明。In order to make the object, technical solution and advantages of the present invention clearer, the present invention will be further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described here are only used to explain the present invention, not to limit the present invention.
参考图1，如图1所示的一种高速轻量级拟态虚拟网构建方法，包括拟态虚拟网络构建方法和可控网络跳变与迁移方法；Referring to FIG. 1, a high-speed lightweight mimic virtual network construction method as shown in FIG. 1 includes a mimic virtual network construction method and a controllable network jump and migration method;
所述拟态虚拟网络构建方法包括以下步骤：The method for constructing a mimic virtual network comprises the following steps:
S11，令网络G＝(N,L)，其中N表示网络节点集，L表示网络链路集；节点n＝{id,nm,tp,os,nl,pt,sp,s},n∈N，其中id为节点序号，nm为节点名称，tp为节点类型，os为节点运行操作系统，nl为节点网络地址，sp为节点上的服务提供程序，pt为sp开放的端口，s为sp能够提供服务；S11, let the network G=(N,L), where N represents the network node set, L represents the network link set; node n={id, nm, tp, os, nl, pt, sp, s}, n∈N , where id is the node serial number, nm is the node name, tp is the node type, os is the node operating system, nl is the node network address, sp is the service provider on the node, pt is the port opened by sp, and s is the sp capability Provide services;
S12，链路l＝{id,nm,ni,nj},l∈L，其中id为节点序号，nm为链路名称，ni，nj分别为当前链路连接的两个节点；节点分为两种，一种是底层的物理节点，另一种即为容器节点；如果不特别指明，本构建方法中所称的节点即为容器节点；链路也分为两种，一种是物理节点之间连接的物理链路，另一种即为容器节点之间连接的SDN逻辑链路；S12, link l={id,nm,ni ,nj },l∈L, where id is the node serial number, nm is the link name, ni and nj are the two nodes connected by the current link respectively; There are two types of nodes, one is the underlying physical node, and the other is the container node; if not specified, the node referred to in this construction method is the container node; the link is also divided into two types, one One is the physical link connected between physical nodes, and the other is the SDN logical link connected between container nodes;
S13，拟态虚拟网构建需要经历4个阶段，分别是节点构建阶段、链路构建阶段、网络构建阶段和拟态变化阶段；需要提供5种职能，分别是用户接口、逻辑模型、部件管理、拟态网络和外界信息；S13, the construction of a mimic virtual network needs to go through four stages, which are the node construction stage, the link construction stage, the network construction stage, and the mimic change stage; five functions need to be provided, namely user interface, logic model, component management, and mimic network and external information;
S14，在节点和链路构造过程中，用户接口需要用户提供上述模型中节点n的nm，tp，os，nl，sp信息和链路l的nm，ni，nj信息；逻辑模型需要针对用户接口获得信息，分别对节点与链路生成唯一的uuid编码，同时使用面向对象技术将其存储；S14, in the process of node and link construction, the user interface needs the user to provide the nm, tp, os, nl, sp information of the node n in the above model and the nm,ni ,nj information of the link l; the logic model needs to be aimed at The user interface obtains information, generates unique uuid codes for nodes and links, and stores them using object-oriented technology;
S15，在节点构建阶段，将生成的节点逻辑对象信息转化为DockerFile并提交给容器管理器，使得容器管理器生成所需的服务容器；在链路构建阶段，将生成的链路逻辑对象信息转化为对SDN控制器的RESTful API的调用，使得SDN控制器生成所需的OpenFlow流表信息，生成所定义的链路；在网络构建阶段将生成的容器和链路组合成为需要的拟态网络，随后构建协调器统一容器管理器和SDN控制器的功能，对用户提供系统运维接口，供用户进行控制；在拟态变化阶段，定义可控网络跳变和迁移方法，用户通过系统运维接口设定跳变与迁移相关参数，同时IDS日志等外界信息也作为可控网络跳变和迁移方法的决策依据；变化控制流程通过综合用户设定和外界信息做出决策，并通过协调器对容器和网络结构进行调整；S15, in the node construction phase, convert the generated node logical object information into a DockerFile and submit it to the container manager, so that the container manager generates the required service container; in the link construction phase, convert the generated link logical object information In order to call the RESTful API of the SDN controller, the SDN controller generates the required OpenFlow flow table information and generates the defined links; in the network construction phase, the generated containers and links are combined into the required mimic network, and then Build a coordinator to unify the functions of the container manager and SDN controller, and provide users with a system operation and maintenance interface for users to control; in the stage of mimicry change, define controllable network jump and migration methods, and users can set through the system operation and maintenance interface Jump and migration related parameters, and external information such as IDS logs are also used as the decision-making basis for controllable network jump and migration methods; the change control process makes decisions through comprehensive user settings and external information, and through the coordinator container and network structural adjustments;
所述可控网络跳变与迁移方法包括网络功能映射和网络跳变迁移。The controllable network hopping and migration method includes network function mapping and network hopping migration.
所述网络功能映射具体为：The network function mapping is specifically:
首先建立功能映射关系表；其形式为M＝{(nv,F)}，其中nv指网络服务或功能，F为功能提供二元组；随后建立映射函数，其形式为Fm(nv,Fset)，其中nv为服务类型，Fset为提供服务的二元组集合；还需要考虑功能依赖，所谓功能依赖是指某一功能的实现需要其他功能进行支撑，用n′v＝ref(nv)表示，即nv所依赖的其他功能；First establish a function mapping table; its form is M={(nv , F)}, wherein nv refers to network services or functions, and F provides a binary group for the function; then establishes a mapping function, and its form is Fm (nv , Fset ), where nv is the service type, and Fset is the set of binary groups that provide the service; functional dependence also needs to be considered, the so-called functional dependence means that the realization of a certain function needs other functions to support, use n′v ＝ref(nv ) represents, that is, other functions on which nv depends;
还包括在网络跳变和迁移后如何在可变空间内选择新的映射关系：It also includes how to select a new mapping relationship in the variable space after network jumps and migrations:
首先给定当前的(nv,F)，在可变空间中寻找Fnew≠F，使得其满足(nv,Fnew)；然后，找到nv的依赖关系nv′＝ref(nv)，通过其映射函数找到当前nv′对应的F′；随后验证Fnew是否满足F与F′之间的依赖关系，如果满足则直接通过映射函数修改功能映射关系，即将Fm(nv,F)映射为Fm(nv,Fnew)，如果不满足则组建中间构件适配Fnew与F′的关系，如果存在适配组件则将其与Fnew整合成F′new，再修改映射关系，如果不存在则重新寻找Fnew。First given the current (nv , F), search for Fnew ≠ F in the variable space so that it satisfies (nv , Fnew ); then, find the dependency relationship nv ′=ref(nv ), through its mapping function, find the corresponding F' of the current nv '; then verify whether Fnew satisfies the dependency between F and F', if so, directly modify the functional mapping relationship through the mapping function, that is, Fm (nv , F) is mapped to Fm (nv , Fnew ), if it is not satisfied, build an intermediate component to adapt the relationship between Fnew and F′, if there is an adaptation component, integrate it with Fnew into F′new , and then modify If the mapping relationship does not exist, search for Fnew again.
所述网络跳变迁移具体为：The network jump migration is specifically:
在可控网络跳变与迁移方法中，首先对链路及节点进行编号，实体链路分别为逻辑链路分别为物理节点分别为容器节点分别为In the controllable network hopping and migration method, the links and nodes are numbered first, and the physical links are respectively Logical links are The physical nodes are The container nodes are
Nc中的容器对应的操作系统为其提供的服务为Ntype表示基本服务类型，例如网页服务，数据库服务，文件存储服务等；而服务与服务程序是1:n关系，即定义服务提供函数f(s)，则其中服务程序sk ∈Sapp，可认为这里有两个重要条件：一是每一只提供一种二是sk在任意上都能运行；The operating system corresponding to the container in Nc is The services it provides are Ntype represents the basic service type, such as web page service, database service, file storage service, etc.; and the service and service program have a 1:n relationship, that is, define the service provider function f(s), then Among them, the service program sk ∈ Sapp can be regarded as There are two important conditions here: one is that each only provide one Second, sk in any can run on
随后利用随机函数r(t)与外部信息i对网络进行跳变与迁移；定义信息收益函数Pi(s,d)，其中s为变化的源Lg、Np、Ncos或Nc，d为变化的目的Lg、Np、Ncos或Nc，其值表示按照外部信息i从s变化到d的收益；因此对于某一源而言，其变化收益可视为收益向量＝(P(s,d1),P(s,d2),L,P(s,dn))，将其使用min-max标准化，即Then use the random function r(t) and external information i to jump and migrate the network; define the information income function Pi (s,d), where s is the source of change Lg , Np , Ncos or Nc , d is the purpose of change Lg , Np , Ncos or Nc , and its value represents the income of changing from s to d according to external information i; therefore, for a certain source, its change income can be regarded as income vector =(P(s,d1 ),P(s,d2 ),L,P(s,dn )), normalize it using min-max, ie
其中min(Pi(s,dn))表示所有pi(s,dn)中的最小值，max(Pi(s,dn))表示所有pi(s,dn)中的最大值；可视其为通过外部信息进行迁移的概率，则可定义变化收益为在实际变化过程中按照最大P(s,d)对应的变化进行迁移与跳变；Among them, min(Pi (s,dn )) represents the minimum value among all pi (s,dn ), max(Pi (s,dn )) represents the minimum value among all pi (s,dn ) The maximum value; it can be regarded as the probability of migration through external information, and the change income can be defined as Migrate and jump according to the change corresponding to the maximum P(s,d) during the actual change process;
可定义变化能力f(s,d)，其中s为变化的源Lg、Np、Ncos或Nc，d为变化的目的Lg、Np、Ncos或Nc；函数表示由s变化为d；链路的变化能力由SDN控制器提供，通过对OpenFlow交换机的流表进行更改实现链路的重映射；节点的变化由容器管理器提供，通过容器迁移和动态生成等实现容器的重映射；The ability to change f(s,d) can be defined, where s is the source of change Lg , Np , Ncos or Nc , d is the purpose of change Lg , Np , Ncos or Nc ; the function is represented by s The change is d; the ability to change the link is provided by the SDN controller, and the remapping of the link is realized by changing the flow table of the OpenFlow switch; the change of the node is provided by the container manager, and the container is realized through container migration and dynamic generation. remap;
最后，通过约束函数r对迁移后的状态进行检查；设置一系列检查条件并定义对应的阈值只有当所有检查条件得出的结果都符合各项阈值时，该次变化才能够实施；Finally, check the migrated state through the constraint function r; set a series of check conditions And define the corresponding threshold Only when the results of all inspection conditions meet the thresholds, the change can be implemented;
因此，可将T(S,t,i,Ce,c)定义为：Therefore, T(S,t,i,Ce ,c) can be defined as:
其中变化条件为max(P(s,d))，并通过ck(sth(c(S)))；其中ck(s)表示阈值检测函数。The change condition is max(P(s,d)), and passes ck(sth (c(S))); where ck(s) represents the threshold detection function.
拟态虚拟网络构建方法：Mimic virtual network construction method:
为了满足主动防御目的，实现拟态网络架构与服务的虚拟化构建，提出一种拟态虚拟网络构建方法。In order to meet the purpose of active defense and realize the virtualization construction of mimic network architecture and services, a method of constructing mimic virtual network is proposed.
构建拟态虚拟网，需要建立基本的对外提供正常访问功能的虚拟网络结构。网络的拟态性可以通过几种方式实现：一是网络部件冗余方式。此种方式通过节点与链路的冗余实现对网络的热切换，对外表现为拟态网络，但是存在使用效率不高，硬件同步困难的问题。二是使用VLAN、MPLS等虚拟网络技术。此种方式能够有效复用当前硬件设施，同时也具有较强的网络调整能力，但是无法对网络节点进行有效变化。三是虚拟机网络方式。此种方式通过虚拟机构建网络节点，通过虚拟机网络实现拟态网络，避免了前两种方式的缺点，但是虚拟机及其网络的标准通常与虚拟机服务提供商紧密耦合，难以有效进行扩展。因此，提出以软件定义网络配合容器技术的拟态虚拟网构建方法。To build a pseudo-virtual network, it is necessary to establish a basic virtual network structure that provides normal access to the outside world. The mimicry of the network can be realized in several ways: One is the redundancy of network components. This method realizes the hot switching of the network through the redundancy of nodes and links, which appears as a mimic network to the outside world, but has the problems of low efficiency and difficult hardware synchronization. The second is to use virtual network technologies such as VLAN and MPLS. This method can effectively reuse current hardware facilities and has strong network adjustment capabilities, but it cannot effectively change network nodes. The third is the virtual machine network mode. This method builds network nodes through virtual machines and implements a mimic network through virtual machine networks, which avoids the shortcomings of the first two methods. However, the standards of virtual machines and their networks are usually tightly coupled with virtual machine service providers, making it difficult to effectively expand. Therefore, a method for constructing a pseudo-virtual network using software-defined networking combined with container technology is proposed.
可令网络G＝(N,L)，其中N表示网络节点集，L表示网络链路集。节点n＝{id,nm,tp,os,nl,pt,sp,s},n∈N，其中id为节点序号，nm为节点名称，tp为节点类型，os为节点运行操作系统，nl为节点网络地址，sp为节点上的服务提供程序，pt为sp开放的端口，s为sp能够提供服务。链路l＝{id,nm,ni,nj},l∈L，其中id为节点序号，nm为链路名称，ni，nj分别为当前链路连接的两个节点。节点分为两种，一种是底层的物理节点，另一种即为容器节点。如果不特别指明，本构建方法中所称的节点即为容器节点。链路也分为两种，一种是物理节点之间连接的物理链路，另一种即为容器节点之间连接的SDN逻辑链路。如果不特别指明，本构建方法所称的链路即为SDN逻辑链路。The network can be set as G=(N, L), where N represents a network node set, and L represents a network link set. Node n={id, nm, tp, os, nl, pt, sp, s}, n∈N, where id is the node serial number, nm is the node name, tp is the node type, os is the operating system of the node, and nl is Node network address, sp is the service provider on the node, pt is the port opened by sp, s is the service that sp can provide. Link l={id,nm,ni ,nj },l∈L, where id is the node serial number, nm is the link name, ni and nj are the two nodes connected by the current link respectively. There are two types of nodes, one is the underlying physical node, and the other is the container node. Unless otherwise specified, the nodes referred to in this construction method are container nodes. There are also two types of links, one is the physical link connecting physical nodes, and the other is the SDN logical link connecting container nodes. Unless otherwise specified, the links referred to in this construction method are SDN logical links.
开始拟态虚拟网构建需要经历4个阶段，分别是节点构建阶段、链路构建阶段、网络构建阶段和拟态变化阶段；需要提供5种职能，分别是用户接口、逻辑模型、部件管理、拟态网络和外界信息。The construction of a mimic virtual network needs to go through four stages, which are node construction stage, link construction stage, network construction stage and mimic change stage; five functions need to be provided, namely user interface, logic model, component management, mimic network and outside information.
在节点和链路构造阶段中，用户接口需要用户提供上述模型中节点n的nm，tp，os，nl，sp信息和链路l的nm，ni，nj信息；逻辑模型需要针对用户接口获得信息，分别对节点与链路生成唯一的uuid编码，同时使用面向对象技术将其存储。在节点构建阶段，将生成的节点逻辑对象信息转化为DockerFile并提交给容器管理器，使得容器管理器生成所需的服务容器。在链路构建阶段，将生成的链路逻辑对象信息转化为对SDN控制器的RESTful API的调用，使得SDN控制器生成所需的OpenFlow流表信息，生成所定义的链路。在网络构建阶段将生成的容器和链路组合成为需要的拟态网络，随后构建协调器统一容器管理器和SDN控制器的功能，对用户提供系统运维接口，供用户进行控制。在拟态变化阶段，定义可控网络跳变和迁移方法，用户通过系统运维接口设定跳变与迁移相关参数，同时IDS日志等外界信息也作为可控网络跳变和迁移方法的决策依据。变化控制流程通过综合用户设定和外界信息做出决策，并通过协调器对容器和网络结构进行调整。In the node and link construction phase, the user interface needs the user to provide the nm, tp, os, nl, sp information of the node n in the above model and the nm,ni , nj information of the link l; the logical model needs to be specific to the user interface Obtain information, generate unique uuid codes for nodes and links, and store them using object-oriented technology. In the node construction phase, the generated node logic object information is converted into a DockerFile and submitted to the container manager, so that the container manager generates the required service container. In the link construction phase, the generated link logic object information is converted into a call to the RESTful API of the SDN controller, so that the SDN controller generates the required OpenFlow flow table information and generates the defined link. In the network construction phase, the generated containers and links are combined into the required mimic network, and then the coordinator is constructed to unify the functions of the container manager and SDN controller, and provide users with a system operation and maintenance interface for users to control. In the stage of mimicry change, define controllable network jump and migration methods, users set jump and migration related parameters through the system operation and maintenance interface, and external information such as IDS logs are also used as decision-making basis for controllable network jump and migration methods. The change control process makes decisions by integrating user settings and external information, and adjusts the container and network structure through the coordinator.
可控网络跳变与迁移方法：Controllable network hopping and migration methods:
为了抵消传统网络的确定性、静态性和同构性给攻击者带来的攻击时间、信息不对称和攻击成本的优势，提出一种基于拟态思想的可控网络跳变与迁移方法。In order to offset the advantages of attack time, information asymmetry and attack cost brought by the determinism, staticity and isomorphism of the traditional network to the attacker, a controllable network jump and migration method based on the idea of mimicry is proposed.
可控网络跳变与迁移方法的相关定义：Related definitions of controllable network hopping and migration methods:
定义1变化，即链路跳变与节点迁移的统称。可分为被动变化与主动变化。在主动变化中可分为随机变化和应激变化。Definition 1 Change, that is, the general term for link hopping and node migration. Can be divided into passive change and active change. Active change can be divided into random change and stress change.
可控网络跳变与迁移方法所称的被动变化是指需要外界信息Io驱动的，在保证网络功能等价的条件下，网络内部利用该信息进行变化p(i)的一种形式。被动变化需要外界信息驱动，即需要外界信息才能进行变化。同时，变化需要外界的信息做出相应变化决策。三是网络功能等价，即需要约束函数c(S)对变化结果进行控制，保证变化后从外部观察网络功能前后等价。The passive change referred to in the controllable network hopping and migration method refers to a form that needs to be driven by external information Io and uses this information inside the network to change p(i) under the condition of ensuring network function equivalence. Passive changes need to be driven by external information, that is, external information is required to make changes. At the same time, changes require external information to make corresponding change decisions. The third is the equivalence of network functions, that is, the constraint function c(S) is required to control the change results to ensure that the network functions are equivalent before and after the changes are observed from the outside.
随机变化是指网络内部按照一定的随机函数r(t)，在保证网络功能等价的条件下进行变化的一种形式。随机变化包含三个要点。一是随机函数r(t)，即变化是随机进行的，不能或者相当难以预测其变化规律特点。二是网络功能等价，即需要约束函数c(S)对r(t)进行控制，保证变化后从外部观察网络功能前后等价。Random change refers to a form of change within the network according to a certain random function r(t) under the condition that the network functions are equivalent. Random variation contains three main points. One is the random function r(t), that is, the change is carried out randomly, and it is impossible or quite difficult to predict the characteristics of its change law. The second is the equivalence of network functions, that is, the constraint function c(S) is required to control r(t) to ensure that the network functions are equivalent before and after the changes are observed from the outside.
应激变化指网络内部按照一定的随机函数r(t)，在保证网络功能等价的条件下结合外界信息Io进行变化的一种形式。应激变化综合了被动变化与随机变化的特点，主要包含五个要点。一是随机函数r(t)，即变化是随机进行的，不能或者相当难以预测其变化规律特点。二是利用外部信息，即变化需要外界的信息做出相应变化决策。三是结合比Cr，即外界信息能在多大程度上影响变化。Cr∈[0,1]，若Cr＝0则应激变化退化为随机变化；若Cr＝1则应激变化退化为被动变化。四是网络功能等价，即需要约束函数c(S)对变化结果进行控制，保证变化后从外部观察网络功能前后等价。五是网络内部变化，即变化由网络内部进行控制。可控网络跳变与迁移方法实现的是网络的应激变化。Stress change refers to a form in which the network internally changes according to a certain random function r(t) and combined with external information Io under the condition of ensuring network function equivalence. Stress change combines the characteristics of passive change and random change, and mainly includes five points. One is the random function r(t), that is, the change is carried out randomly, and it is impossible or quite difficult to predict the characteristics of its change law. The second is to use external information, that is, changes require external information to make corresponding change decisions. The third is the combination ratioCr , that is, the extent to which external information can affect the change. Cr ∈ [0,1], if Cr =0, the stress change degenerates into a random change; if Cr =1, the stress change degenerates into a passive change. The fourth is the equivalence of network functions, that is, the constraint function c(S) is required to control the change results to ensure that the network functions are equivalent before and after the changes are observed from the outside. Fifth, changes within the network, that is, changes are controlled within the network. The controllable network hopping and migration method realizes the stress change of the network.
定义2变化函数T(S,t,i,Cr,c)是指从一种网络状态到另一种网络状态的映射关系，其中S指当前网络状态，t指时间，i指外部信息，Cr指结合比，c指功能等价约束条件。Definition 2 The change function T(S,t,i,Cr ,c) refers to the mapping relationship from one network state to another network state, where S refers to the current network state, t refers to time, and i refers to external information,Cr refers to the binding ratio, and c refers to the functional equivalence constraint.
定义3可变空间即为映射的集合空间。其大小为Sdiv(nv)＝Ncos×Ncs，其中Ncos为容器节点内操作系统的映射，Ncs为容器节点内提供服务程序的映射。Definition 3 The variable space is the set space of mapping. Its size is Sdiv (nv )=Ncos ×Ncs , where Ncos is the mapping of the operating system in the container node, and Ncs is the mapping of the service program in the container node.
定义4功能映射指提供相同网络服务的二元组的映射关系，即Fold a Fnew。其中sk∈Ncs。功能映射是在可变空间中的映射关系，容器可以看作是能够提供的二元组。Definition 4 Functional mapping refers to providing the same network service the two-tuple The mapping relationship of Fold a Fnew . in sk ∈ Ncs . Functional mapping is the mapping relationship in the variable space, and the container can be regarded as being able to provide of Two-tuple.
1.网络功能映射1. Network function mapping
要实现可控网络跳变与迁移，则必须先实现网络功能的映射。首先建立功能映射关系表。其形式为M＝{(nv,F)}，其中nv指网络服务或功能，F为功能提供二元组；随后建立映射函数，其形式为Fm(nv,Fset)，其中nv为服务类型，Fset为提供服务的二元组集合；还需要考虑功能依赖，所谓功能依赖是指某一功能的实现需要其他功能进行支撑，可用n′v＝ref(nv)表示，即nv所依赖的其他功能。To realize controllable network hopping and migration, the mapping of network functions must be realized first. Firstly, a functional mapping relation table is established. Its form is M={(nv ,F)}, where nv refers to a network service or function, and F provides a two-tuple for the function; then a mapping function is established, and its form is Fm (nv ,Fset ), where nv is the type of service, and Fset is the set of 2-tuples that provide the service; functional dependence also needs to be considered. The so-called functional dependence means that the realization of a certain function requires support from other functions, which can be expressed by n′v = ref(nv ) , other functions on which nv depends.
在可控网络跳变与迁移方法中，更多的是考虑功能重映射的问题，即在网络跳变和迁移后如何在可变空间内选择新的映射关系。首先给定当前的(nv,F)，在可变空间中寻找Fnew ≠F，使得其满足(nv,Fnew)；然后，找到nv的依赖关系n′v＝ref(nv)，通过其映射函数找到当前n′v对应的F′；随后验证Fnew是否满足F与F′之间的依赖关系，如果满足则直接通过映射函数修改功能映射关系，即将Fm(nv,F)映射为Fm(nv,Fnew)，如果不满足则组建中间构件适配Fnew与F′的关系，如果存在适配组件则将其与Fnew整合成Fn′ew，再修改映射关系，如果不存在则重新寻找Fnew。In the controllable network hopping and migration method, more consideration is given to the problem of functional remapping, that is, how to select a new mapping relationship in the variable space after network hopping and migration. First given the current (nv , F), search for Fnew ≠ F in the variable space so that it satisfies (nv , Fnew ); then, find the dependency relationship n′v = ref(nv ), find the F′ corresponding to the current n′v through its mapping function; then verify whether Fnew satisfies the dependency relationship between F and F′, and if so, directly modify the functional mapping relationship through the mapping function, that is, Fm (nv ,F) is mapped to Fm (nv ,Fnew ), if not satisfied, build an intermediate component to adapt the relationship between Fnew and F′, if there is an adaptation component, integrate it with Fnew into Fn ′ew , Then modify the mapping relationship, if it does not exist, search for Fnew again.
2.网络跳变迁移2. Network jump migration
在可控网络跳变与迁移方法中，首先对链路及节点进行编号，实体链路分别为逻辑链路分别为物理节点分别为容器节点分别为In the controllable network hopping and migration method, the links and nodes are numbered first, and the physical links are respectively Logical links are The physical nodes are The container nodes are
Nc中的容器对应的操作系统为其提供的服务为Ntype表示基本服务类型，例如网页服务，数据库服务，文件存储服务等。而服务与服务程序是1:n关系，即定义服务提供函数f(s)，则其中服务程序sk∈Sapp，可认为这里有两个重要条件：一是每一只提供一种二是sk在任意上都能运行。考虑到目前绝大部分服务提供程序是可移植的，这个条件也是可以成立的。The operating system corresponding to the container in Nc is The services it provides are Ntype indicates the basic service type, such as web page service, database service, file storage service, etc. The service and the service program have a 1:n relationship, that is, define the service providing function f(s), then Among them, the service program sk ∈ Sapp can be regarded as There are two important conditions here: one is that each only provide one Second, sk in any can run on. Considering that the vast majority of service providers are portable, this condition can also be established.
随后利用随机函数r(t)与外部信息i对网络进行跳变与迁移。定义信息收益函数Pi(s,d)，其中s为变化的源Lg、Np、Ncos或Nc，d为变化的目的Lg、Np、Ncos或Nc，其值表示按照外部信息i从s变化到d的收益。因此对于某一源而言，其变化收益可视为收益向量将其使用min-max标准化，即Then use the random function r(t) and external information i to jump and migrate the network. Define the information gain function Pi (s,d), where s is the source of change Lg , Np , Ncos or Nc , d is the purpose of change Lg , Np , Ncos or Nc , and its value represents The payoff of changing from s to d according to external information i. Therefore, for a certain source, its variable income can be regarded as the income vector Normalize it using min-max, i.e.
其中min(Pi(s,dn))表示所有pi(s,dn)中的最小值，max(Pi(s,dn))表示所有pi(s,dn)中的最大值。可视其为通过外部信息进行迁移的概率，则可定义变化收益为在实际变化过程中按照最大P(s,d)对应的变化进行迁移与跳变。Among them, min(Pi (s,dn )) represents the minimum value among all pi (s,dn ), max(Pi (s,dn )) represents the minimum value among all pi (s,dn ) maximum value. It can be regarded as the probability of migration through external information, and the change income can be defined as Migrate and jump according to the change corresponding to the maximum P(s,d) in the actual change process.
可定义变化能力f(s,d)，其中s为变化的源Lg、Np、Ncos或Nc，d为变化的目的Lg、Np、Ncos或Nc。函数表示由s变化为d。链路的变化能力由SDN控制器提供，通过对OpenFlow交换机的流表进行更改实现链路的重映射。节点的变化由容器管理器提供，通过容器迁移和动态生成等实现容器的重映射。The ability to change f(s,d) can be defined, where s is the source of change Lg , Np , Ncos or Nc , and d is the target of change Lg , Np , Ncos or Nc . The function represents the change from s to d. The ability to change the link is provided by the SDN controller, and the remapping of the link is realized by changing the flow table of the OpenFlow switch. The change of the node is provided by the container manager, and the remapping of the container is realized through container migration and dynamic generation.
最后，通过约束函数r对迁移后的状态进行检查。可以设置一系列检查条件并定义对应的阈值只有当所有检查条件得出的结果都符合各项阈值时，该次变化才能够实施。Finally, the migrated state is checked by the constraint function r. A series of check conditions can be set And define the corresponding threshold Only when the results of all check conditions meet the thresholds, the change can be implemented.
因此，可将T(S,t,i,Ce,c)定义为：Therefore, T(S,t,i,Ce ,c) can be defined as:
其中变化条件为max(P(s,d))，并通过ck(sth(c(S)))。其中ck(s)表示阈值检测函数。The change condition is max(P(s,d)), and passes ck(sth (c(S))). where ck(s) represents the threshold detection function.
拟态网络重映射示例：Mimic network remapping example:
本方法首先确定可变空间的大小。对于同一个功能nv，存在不同的容器操作系统与服务提供软件的组合。例如一个Web服务，容器操作系统搭配与服务提供软件搭配可能表所示：This method first determines the size of the variable space. For the same function nv , there are different combinations of container operating systems and service providing software. For example, for a web service, the collocation of container operating system and service provider software may be shown in the following table:
表1Web服务的可变空间Table 1 The variable space of Web service
在表中各操作系统与服务提供软件均未计版本，同时只选取主流操作系统与服务提供软件。如果考虑到版本因素，可变空间将更大。The operating systems and service-providing software in the table are not counted in version, and only mainstream operating systems and service-providing software are selected. If the version factor is considered, the variable space will be larger.
随后，通过蜜网等技术获取到攻击者的攻击信息。例如攻击的操作系统类型、利用的软件漏洞等。通过对这些信息进行分析，有针对性的对进行变化。例如，已知了攻击者通过Linux CVE-2017-7184漏洞与Apache CVE-2016-4976漏洞对WEB服务实施提权攻击，此时应该对当前功能映射表进行检查。Subsequently, the attacker's attack information was obtained through honeynet and other technologies. For example, the type of operating system attacked, the software vulnerability exploited, etc. By analyzing this information, targeted Make changes. For example, it is known that attackers use the Linux CVE-2017-7184 vulnerability and the Apache CVE-2016-4976 vulnerability to carry out privilege escalation attacks on WEB services. At this time, the current function mapping table should be checked.
对功能映射表进行变化。例如当前功能映射表如表所示：Make changes to the function map. For example, the current function mapping table is as shown in the table:
表2当前功能映射表Table 2 Current function mapping table
获得的信息为攻击者通过Linux漏洞和Apache漏洞对WEB服务进行攻击，因此可以从可变空间内抽取出非Linux系统和非Apache的服务提供二元组，将WEB服务映射到其上。即可选择WindowsServer系列的操作系统搭配IIS、Nginx和Lighttpd服务提供软件。假设选择Nginx，则重映射后的映射表如表所示：The information obtained is that attackers attack WEB services through Linux vulnerabilities and Apache vulnerabilities, so non-Linux systems and non-Apache services can be extracted from the variable space to provide binary groups, and WEB services can be mapped to it. You can choose the operating system of Windows Server series with IIS, Nginx and Lighttpd service provider software. Assuming that Nginx is selected, the remapped mapping table is as shown in the table:
表3重映射功能映射表Table 3 Remapping function mapping table
对于DATA功能而言，其当前的为Linux系列，为了安全起见也可将其重映射为WindowsServer。映射与否取决于系统的安全策略。For the DATA function, its current For the Linux series, it can also be remapped to Windows Server for security reasons. Mapping or not depends on the security policy of the system.
最后根据映射表，利用映射函数实施重映射。可以采取两种策略，一是动态生成DockerFile，以之生成新的二是将可变空间内所有的提前生成，利用f(s,d)进行动态迁移。Finally, according to the mapping table, the mapping function is used to implement remapping. Two strategies can be adopted, one is to dynamically generate DockerFile to generate new The second is to put all the variables in the variable space Generated in advance, using f(s,d) for dynamic migration.
值得注意的是，当功能映射发生变化时，其ref(nv)也要进行调整。例如WEB功能依赖于DATA功能，在重映射后，原有的WEB功能提供软件与DATA功能提供软件之间的关系在重映射后要得到保留。It is worth noting that when the feature mapping changes, its ref(nv ) is also adjusted. For example, the WEB function depends on the DATA function. After remapping, the original WEB function provides software Provided software with DATA function The relationship between should be preserved after remapping.
可控网络跳变与迁移方法如算法1所示：The controllable network hopping and migration method is shown in Algorithm 1:
信息收益归一化算法如算法2所示：The information gain normalization algorithm is shown in Algorithm 2:
拟态功能映射算法如算法3所示：The mimic function mapping algorithm is shown in Algorithm 3:
本发明的高速轻量级拟态虚拟网构建方法为解决基于拟态虚拟网的主动网络防御提供了方法途径。虚拟网构建方法构建的拟态虚拟网是一种全新的主动防御技术，利用拟态虚拟网属性多样化、系统化及动态化等特性，使目标网络呈现动态性、非确定性、异构性和非持续性等变化特征，从而增加攻击难度和攻击成本。The high-speed and lightweight mimic virtual network construction method of the invention provides a method for solving the active network defense based on the mimic virtual network. The mimetic virtual network constructed by the virtual network construction method is a brand-new active defense technology, which makes the target network appear dynamic, non-deterministic, heterogeneous and non-deterministic by using the properties of the mimetic virtual network, such as diversification, systematization and dynamism. Change characteristics such as persistence, thereby increasing the difficulty and cost of attacks.
以上所述仅为本发明的较佳实施例，并不用以限制本发明，凡在本发明的精神和原则之内，所作的任何修改、等同替换、改进等，均应包含在本发明的保护范围之内。The above descriptions are only preferred embodiments of the present invention, and are not intended to limit the present invention. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principles of the present invention shall be included in the protection of the present invention. within range.
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201711030111.7ACN108055232B (en) | 2017-10-30 | 2017-10-30 | High-speed lightweight mimicry virtual network construction method |
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201711030111.7ACN108055232B (en) | 2017-10-30 | 2017-10-30 | High-speed lightweight mimicry virtual network construction method |
| Publication Number | Publication Date |
|---|---|
| CN108055232Atrue CN108055232A (en) | 2018-05-18 |
| CN108055232B CN108055232B (en) | 2020-11-06 |
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201711030111.7AExpired - Fee RelatedCN108055232B (en) | 2017-10-30 | 2017-10-30 | High-speed lightweight mimicry virtual network construction method |
| Country | Link |
|---|---|
| CN (1) | CN108055232B (en) |
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN111083113A (en)* | 2019-11-15 | 2020-04-28 | 华东计算技术研究所（中国电子科技集团公司第三十二研究所） | Mimicry distribution system, method and medium |
| CN109861993B (en)* | 2019-01-15 | 2021-08-13 | 中国电子科技网络信息安全有限公司 | SDN-based traffic security collection method and system |
| CN115828253A (en)* | 2022-10-28 | 2023-03-21 | 珠海高凌信息科技股份有限公司 | Mimicry super-fusion management device, resource redistribution method and storage medium |
| CN116234072A (en)* | 2023-01-09 | 2023-06-06 | 福建时刻智能科技有限责任公司 | Low-cost lightweight 2.4G multi-hop technology |
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20080170583A1 (en)* | 2007-01-16 | 2008-07-17 | Futurewei Technologies, Inc. | Method of Supporting an Open Provider Backbone Network |
| CN102903006A (en)* | 2012-09-14 | 2013-01-30 | 哈尔滨工程大学 | Hyperspectral image waveband selecting method |
| US20130100953A1 (en)* | 2011-10-24 | 2013-04-25 | Futurewei Technologies, Co. | In Band Signaling in Next Generation-Multicast Virtual Private Network Using Receiver Driven Resource Reservation Protocol-Traffic Engineering Point-To-Multipoint |
| CN104331742A (en)* | 2014-09-12 | 2015-02-04 | 广东电网公司江门供电局 | Power transmission line operation and maintenance optimization method and system based on multi-target mimicry physics |
| CN104408372A (en)* | 2014-11-26 | 2015-03-11 | 大连梯耐德网络技术有限公司 | System and method for implementing mimic security based on system overloading |
| CN104754048A (en)* | 2015-03-30 | 2015-07-01 | 中国人民解放军信息工程大学 | Imitative organization structure of server cluster |
| CN105306251A (en)* | 2015-09-14 | 2016-02-03 | 上海红神信息技术有限公司 | Mimicry network topology transformation method |
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20080170583A1 (en)* | 2007-01-16 | 2008-07-17 | Futurewei Technologies, Inc. | Method of Supporting an Open Provider Backbone Network |
| US20130100953A1 (en)* | 2011-10-24 | 2013-04-25 | Futurewei Technologies, Co. | In Band Signaling in Next Generation-Multicast Virtual Private Network Using Receiver Driven Resource Reservation Protocol-Traffic Engineering Point-To-Multipoint |
| CN102903006A (en)* | 2012-09-14 | 2013-01-30 | 哈尔滨工程大学 | Hyperspectral image waveband selecting method |
| CN104331742A (en)* | 2014-09-12 | 2015-02-04 | 广东电网公司江门供电局 | Power transmission line operation and maintenance optimization method and system based on multi-target mimicry physics |
| CN104408372A (en)* | 2014-11-26 | 2015-03-11 | 大连梯耐德网络技术有限公司 | System and method for implementing mimic security based on system overloading |
| CN104754048A (en)* | 2015-03-30 | 2015-07-01 | 中国人民解放军信息工程大学 | Imitative organization structure of server cluster |
| CN105306251A (en)* | 2015-09-14 | 2016-02-03 | 上海红神信息技术有限公司 | Mimicry network topology transformation method |
| Title |
|---|
| 廉哲等: "面向网络攻击态势的SDN虚拟蜜网", 《空军工程大学学报(自然科学版)》* |
| 蔡桂林等: "移动目标防御技术研究进展", 《计算机研究与发展》* |
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN109861993B (en)* | 2019-01-15 | 2021-08-13 | 中国电子科技网络信息安全有限公司 | SDN-based traffic security collection method and system |
| CN111083113A (en)* | 2019-11-15 | 2020-04-28 | 华东计算技术研究所（中国电子科技集团公司第三十二研究所） | Mimicry distribution system, method and medium |
| CN115828253A (en)* | 2022-10-28 | 2023-03-21 | 珠海高凌信息科技股份有限公司 | Mimicry super-fusion management device, resource redistribution method and storage medium |
| CN115828253B (en)* | 2022-10-28 | 2025-07-01 | 珠海高凌信息科技股份有限公司 | A kind of mimetic hyper-convergence management device, resource reallocation method and storage medium |
| CN116234072A (en)* | 2023-01-09 | 2023-06-06 | 福建时刻智能科技有限责任公司 | Low-cost lightweight 2.4G multi-hop technology |
| Publication number | Publication date |
|---|---|
| CN108055232B (en) | 2020-11-06 |
| Publication | Publication Date | Title |
|---|---|---|
| US20240146774A1 (en) | Assurance of security rules in a network | |
| CN112219382B (en) | Ensuring of security rules in a network | |
| US10305776B2 (en) | Network verification | |
| Kogan et al. | SAX-PAC (scalable and expressive packet classification) | |
| US8302157B2 (en) | Method and system for generating user group identifiers | |
| US10504025B2 (en) | Parallel processing of data by multiple semantic reasoning engines | |
| US10439926B2 (en) | Network analysis | |
| CN108055232A (en) | A kind of high speed lightweight mimicry virtual net construction method | |
| US10623271B2 (en) | Intra-priority class ordering of rules corresponding to a model of network intents | |
| Amiri et al. | Congestion-free rerouting of flows on dags | |
| Yoon et al. | Minimizing the maximum firewall rule set in a network with multiple firewalls | |
| CN106533966A (en) | Network service resource arranging method and apparatus | |
| US9722874B2 (en) | Inference-based network route control | |
| Zhang et al. | A conflict resolution scheme in intent-driven network | |
| Maggi et al. | Domain clustering for inter‐domain path computation speed‐up | |
| Imani et al. | Guard sets in tor using as relationships | |
| US12047380B2 (en) | Access control lists rules reduction | |
| El-Dalahmeh et al. | Intrusion detection system for SDN based VANETs using a deep belief network, decision tree, and ToN-IoT dataset | |
| Chetouane et al. | New Continual Federated Learning System for Intrusion Detection in SDN‐Based Edge Computing | |
| CN115834340A (en) | Rule storage method and device, electronic equipment and storage medium | |
| Sun et al. | Minimizing network complexity through integrated top-down design | |
| US11184282B1 (en) | Packet forwarding in a network device | |
| Chuprikov et al. | General ternary bit strings on commodity longest-prefix-match infrastructures | |
| Schiff et al. | Orange: Multi field openflow based range classifier | |
| CN112437065A (en) | Strategy conflict detection and solution method based on graphic representation under SDN environment |
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant | ||
| CF01 | Termination of patent right due to non-payment of annual fee | ||
| CF01 | Termination of patent right due to non-payment of annual fee | Granted publication date:20201106 Termination date:20211030 |