基于AMI网络分布式拒绝服务攻击的蜜罐博弈模型  

HONEYPOT GAME MODEL BASED ON DISTRIBUTED DENIAL OF SERVICE ATTACK IN AMI NETWORK

作　　者：曹康华 王勇 周林 董伟伟 Cao Kanghua;Wang Yong;Zhou Lin;Dong Weiwei(College of Computer Science and Technology,Shanghai University of Electric Power,Shanghai 200090,China)

机构地区：[1]上海电力大学计算机科学与技术学院,上海200090

出　　处：《计算机应用与软件》2021年第3期298-302,308,共6页Computer Applications and Software

基　　金：国家自然科学基金项目(61772327);上海市自然科学基金项目(16ZR14366300);智能电网产学研开发中心项目(A-0090-17-002-05);浙江大学工业控制技术国家重点开发实验室开放式基金项目(ICT1800380)。

摘　　要：高级计量基础设施(AMI)和消费者之间的双向通信使AMI网络易受各种攻击。针对其中的分布式拒绝服务攻击,将蜜罐引入AMI网络作为诱饵系统,并考虑攻击者会通过反蜜罐侦察后再选择攻击行为来创建博弈模型。运用博弈论分析混合服务模型下双方的行为策略,进一步验证存在的几个贝叶斯均衡和约束条件。经分析表明该策略相对于传统网络攻防博弈具有更好的有效性和主动性。通过博弈仿真软件Gambit进行仿真,结果表明该方案可以有效干扰攻击者决策,帮助提高攻击检测率。Two-way communication between the advanced metering infrastructure(AMI)and the consumer makes the AMI network vulnerable to a variety of attacks.Aiming at the distributed denial of service attack,the honeypot was introduced into the AMI network as a decoy system,and the honeypot game model was established by considering the attacker may select the attack behavior through the anti-honeypot detection.Using game theory to analyze the behavioral strategies between the two sides,it further proved the existence of several Bayesian equilibrium and constraints in the game.The analysis shows that the strategy has better effectiveness and initiative than the traditional network attack and defense game.The game simulation software Gambit is used to simulate the correctness of the scheme.The results show that the attack behavior can be effectively judged and the attack detection rate can be improved.

关 键 词：高级计量基础设施 蜜罐 博弈论 分布式拒绝服务攻击 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]