基于双重地址跳变的移动目标防御方法  

Moving Target Defense Method Based on Double Address Hopping

作　　者：李朝阳 谭晶磊[1] 胡瑞钦 张红旗 LI Zhaoyang;TAN Jinglei;HU Ruiqin;ZHANG Hongqi(Department of Cryptogram Engineering,Information Engineering University,Zhengzhou 450001,China;Software College,Zhengzhou University,Zhengzhou 450001,China)

机构地区：[1]信息工程大学密码工程学院,郑州450001 [2]郑州大学软件学院,郑州450001

出　　处：《信息网络安全》2021年第2期24-33,共10页Netinfo Security

基　　金：国家自然科学基金[61902427];国家重点研发计划[2016YFF0204002,2016YFF0204003];郑州市科技领军人才项目[131PLJRC644]。

摘　　要：网络系统的确定性和静态性使得防御处在被动之中,移动目标防御作为一种改变攻守态势的防御理念被提出。针对嗅探和扫描攻击,文章提出一种基于双重地址跳变的移动目标防御方法——DAH。通过双重虚拟地址跳变频率分级,有效解决通信服务质量和跳变频率之间的矛盾,利用低频虚拟地址跳变保证网络可用性,利用高频虚拟地址跳变抵御嗅探攻击。通过检测主机异常通信行为构造欺骗数据包,以实现迷惑并阻断扫描攻击的效果。测试实验表明,DAH既可以保证网络的正常通信时延和CPU负载,又可以有效抵御嗅探和扫描攻击。The determinism and static nature of the network system make the network defense in a passive state.As a defense concept,moving target defense is proposed,which changes the offensive and defensive situation.Aiming at sniffing and scanning attacks,this paper proposes a moving target defense method based on double address hopping—DAH.Through double virtual address hopping frequency classification,DAH effectively solves the contradiction between communication service quality and hopping frequency.It utilizes low-frequency virtual address hopping to ensure network availability,and utilizes high-frequency virtual address hopping to resist sniffing attacks.By detecting abnormal communication behaviors of the host,DAH constructs spoofed packets to confuse and block scanning attacks.The experimental results show that DAH can not only ensure the normal communication delay and CPU load of the network,but also effectively resist sniffing and scanning attacks.

关 键 词：移动目标防御 软件定义网络 地址跳变 网络欺骗 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]