网络行为仿真综述  

State-of-the-art Survey on Network Behavior Emulation

作　　者：符永铨[1,2] 赵辉 王晓锋 刘红日 安伦 FU Yong-Quan;ZHAO Hui;WANG Xiao-Feng;LIU Hong-Ri;AN Lun(College of Computer Science and Technology,National University of Defense Technology,Changsha 410073,China;Cyberspace Security Research Center,Peng Cheng Laboratory,Shenzhen 518055,China;School of Artificial Intelligence and Computer Science,Jiangnan University,Wuxi 214122,China;College of Computer Science and Technology,Harbin Institute of Technology(Weihai),Weihai 264209,China;School of Cyberspace Security,Beijing University of Posts and Telecommunications,Beijing 100876,China)

机构地区：[1]国防科技大学计算机学院,湖南长沙410073 [2]鹏城实验室网络空间安全研究中心,广东深圳518055 [3]江南大学人工智能与计算机学院,江苏无锡214122 [4]哈尔滨工业大学(威海)计算机科学与技术学院,山东威海264209 [5]北京邮电大学网络空间安全学院,北京100876

出　　处：《软件学报》2022年第1期274-296,共23页Journal of Software

基　　金：国家重点研发计划(2018YFB0204300,2020YFB2104003);国家自然科学基金(61972409,61972182,61672264)。

摘　　要：网络行为描述了网络上各类元素对象动态交互过程.它以各类网络服务协议及应用为运行载体,形成不断变化的丰富多样的网络行为,反映出网络拓扑结构给定时间内网络上的场景特点.网络行为仿真主要包括运行框架、背景流仿真、前景流仿真,将生产网络环境下网络行为按需映射到测试网络环境,提供一种按需灵活定制仿真再现能力.网络仿真应用场景不断发展,包括性能分析评估、产品和技术验证、网络入侵检测、网络攻防演练与研究发展等.为总结现有研究成果和存在的不足,分析未来发展趋势,梳理了网络行为仿真的相关概念和研究框架,从框架、背景流、前景流等技术层面总结了网络行为仿真的国内外研究现状,并对相关商业产品和开源软件工具进行了系统地分析调研,最后对网络行为仿真的未来发展进行了展望.The network behavior typically describes the interaction process among different kinds of network elements,which is based on different kinds of network service protocols and applications,formulates evolving and diverse network behavior,and reflects attributes of network scenarios during certain periods on the network topology.Network behavior emulation includes runtime framework,background traffic emulation,and foreground traffic emulation which project network behaviors in the production network environment to the test cyber environment,and provides the mirroring capability of on-demand and flexible design specifications.The application scenarios of network behavior emulation continuously evolve,including performance analysis and evaluation,product and technique evaluation,network intrusion detection,and the research and development of network attack and defense techniques.To summarize existing research results and limitations,and analyze future development trends,this study seeks to category relevant definitions and research frameworks on simulating network behaviors,summarizes the state-of-the-art research progress in terms of the framework,background traffic,and foreground traffic,and systematically surveys both commercial and open-sourced software tools.Finally,this study proposes future research topics on network behavior simulation.

关 键 词：网络行为 网络靶场 背景流 前景流 运行框架 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]