一种面向C/S模式的地址跳变主动网络防御方法  

A Proactive Network Defense Method Based on Address Hopping for C/S Model

作　　者：刘江[1,2] 张红旗[1,2] 杨英杰[1,2] 王义功[1,2] 

机构地区：[1]信息工程大学,郑州450001 [2]河南省信息安全重点实验室,郑州450001

出　　处：《电子与信息学报》2017年第4期1007-1011,共5页Journal of Electronics & Information Technology

基　　金：国家863计划项目(2012AA012704);郑州市科技领军人才项目(131PLJRC644)~~

摘　　要：现有地址跳变方法需要设计新的地址交互协议,扩展性较差,跳变周期缺乏自适应调整,该文提出一种基于改进DHCP协议的地址跳变方法。利用自回归求和平均模型对网络流量进行建模和预测以计算预分配地址数目,根据地址空置周期选择预分配地址,利用基于动态时间弯曲距离的时间序列相似性度量算法检测网络异常并动态调整地址租用期,客户端和服务器基于地址映射关系进行跳变通信。该方法在无需修改现有DHCP协议的基础上实现了跳变地址和跳变周期的动态调整,增加了攻击者进行流量截获和拒绝服务攻击的难度,提高了攻击者代价。The existing address hopping methods need to design a new protocol of address exchanging and the scalability is usually limited. Also, its hopping cycle is difficult to make self-adaption. This paper proposes an address hopping method based on an improved Dynamic Host Configuration Protocol （DHCP）. The number of hopping addresses is calculated by fitting and predicting network traffic which uses the auto regression integration moving average model. The hopping addresses are selected according to the address vacant time. The address lease time is adjusted dynamically according to the network anomaly which is detected by using the time series similarity measure algorithm based on dynamic time warping distance. Clients and application server are able to complete hopping communication based on the address mapping relationships. The proposed method can adjust hopping address and cycle dynamically without to modify the existing DHCP protocol, which not only increases attacker＇s difficult of intercepting traffic and launching denial of service attack but also enhances the attacker＇s overhead.

关 键 词：地址跳变 C/S通信模式 动态目标防御 主动防御 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]