基于POF的网络窃听攻击移动目标防御方法  

Moving target defense against network eavesdropping attack using POF

作　　者：马多贺[1] 李琼[2] 林东岱[1] 

机构地区：[1]中国科学院信息工程研究所信息安全国家重点实验室,北京100093 [2]哈尔滨工业大学计算机学院信息对抗技术研究所,黑龙江哈尔滨150001

出　　处：《通信学报》2018年第2期73-87,共15页Journal on Communications

基　　金：国家重点研发计划课题基金资助项目(No.2017YFB1010000);国家高技术研究发展计划("863"计划)基金资助项目(No.2015AA016106);中国科学院信息工程研究所"青年之星"计划基金资助项目(No.Y7Z0201105);国家自然科学基金资助项目(No.61471141);深圳市技术攻关基金资助项目(No.JSGG20160427185010977)~~

摘　　要：网络窃听攻击是网络通信安全的重大威胁,它具有隐蔽性和无干扰性的特点,很难通过传统的流量特征识别的被动防御方法检测到。而现有的路径加密和动态地址等方法只能混淆网络协议的部分字段,不能形成全面的防护。提出一种基于协议无感知转发(POF,protocol-oblivious forwarding)技术的移动目标防御(MTD,moving target defense)方法,通过私有协议分组随机化策略和动态路径欺骗分组随机丢弃策略,大大提高攻击者实施网络窃听的难度,保障网络通信过程的隐私性。通过实验验证和理论分析证明了该方法的有效性。Eavesdropping attack hereby was the major attack for traditional network communication. As this kind of at-tacks was stealthy and untraceable, it was barely detectable for those feature detection or static configuration based pas-sive defense approaches. Since existing encryption or dynamic address methods could only confuse part of fields of net-work protocols, they couldn’t form a comprehensive protection. Therefore a moving target defense method by utilizing the protocol customization ability of protocol-oblivious forwarding （POF） was proposed, through private protocol packet randomization strategy and randomly drop deception-packets on dynamic paths strategy. It could greatly increase the dif-ficulty of implementing network eavesdropping attack and protect the privacy of the network communication process. Experiments and compare studies show its efficiency.

关 键 词：移动目标防御 窃听攻击 协议栈随机化 网络空间欺骗 协议无感知转发 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]