一种保护代理的移动目标防御方法  

A Moving Target Defense Method of Protect Proxy

作　　者：蒋亚平 郭梦佳 张安康 JIANG Yaping;GUO Mengjia;ZHANG Ankang(School of Computer and Communication Engineering,Zhengzhou University of Light Industry,Zhengzhou 450002,China)

机构地区：[1]郑州轻工业大学计算机与通信工程学院,郑州450002

出　　处：《湖北民族大学学报（自然科学版）》2020年第2期165-170,共6页Journal of Hubei Minzu University:Natural Science Edition

基　　金：国家自然科学基金项目(61272038);河南省基础与前沿技术研究计划项目(122300410255).

摘　　要：DDoS攻击对关键基础设施和互联网服务构成重大威胁.在客户和应用服务器之间引入代理作为中间层的防御架构,恶意客户端能在发起DDoS攻击之前收集大量代理信息.为阻止系统受到来自内部人员发起的DDoS攻击、防止代理信息泄露,提出一种保护代理的移动目标防御架构PPMTD:提出代理隐藏算法,通过在身份验证服务器与应用服务器之间构造虚拟代理地址,实现对真实代理地址的隐藏;给出代理动态演化过程;将代理保护方案与代理地址转换算法结合,可有效减轻整个系统被攻击的概率、达到主动防御的目的.仿真实验验证了提出的隐藏算法可有效的降低代理被发现、系统被攻击的概率.DDoS attacks pose a major threat to critical infrastructure and Internet services.By introducing a proxy between the client and the application server as a middle-tier defense architecture,a malicious client can collect a large amount of proxy information before launching a DDoS attack.In order to prevent the system from being attacked by DDoS from the internal personnel and prevent the information leakage of the proxy,a moving target defense architecture PPMTD that protects the proxy is proposed:a proxy hiding algorithm is proposed to realize the hiding of the real proxy address by constructing a virtual proxy address between the authentication server and the application server;the dynamic evolution process of the proxy is given;the proxy is protected.The combination of the scheme and the proxy address translation algorithm can effectively reduce the probability of the entire system being attacked and achieve the purpose of active defense.The simulation experiments verify that the proposed hidden algorithm can effectively reduce the probability of agents being discovered and the system being attacked.

关 键 词：移动目标防御 DDOS攻击 代理 代理捕获攻击 代理保护 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]