基于入侵诱骗的网络拓扑污染攻击防御研究  

Research on Network Topology Pollution Attack Defense Based on Intrusion Deception

作　　者：魏波 冯乃勤[2] WEI Bo;FENG Nai-qin(College of Information Engineering,Zhengzhou University of Industrial Technology,Zhengzhou Henan 451150,China;College of Computer and Information Engineering,Henan Normal University,Xinxiang Henan 453007,China)

机构地区：[1]郑州工业应用技术学院信息工程学院,河南郑州451150 [2]河南师范大学计算机与信息工程学院,河南新乡453007

出　　处：《计算机仿真》2024年第5期410-414,共5页Computer Simulation

摘　　要：以目标为中心的攻击防御手段检测到攻击后才有所响应,攻击防御不及时,为了提升网络拓扑污染攻击防御能力,提出一种基于入侵诱骗的网络拓扑污染攻击防御方法。通过入侵诱骗系统模拟网络脆弱性,采集攻击模式,并添加到知识库中;通过多个和子空间正交的向量判断知识库内污染信息类型,完成网络拓扑污染攻击类型分类;通过分类结果量化分析网络攻击与防御的成本收益,构建成本收益量化模型;基于攻击图、防御图和博弈论构建攻击防御模型,获取最佳网络拓扑污染攻击防御策略。实验结果表明,所提方法可以有效检测主机位置劫持攻击和链路伪造攻击,提升网络拓扑污染攻击防御效果,且提升了攻击防御的及时性。In order to improve the defensive capability for network topology pollution attack,this paper presented a method of defending network topology pollution attack based on intrusion deception.Firstly,the intrusion deception system was used to simulate the network vulnerability and collect attack patterns,and then they were added to the knowledge base.Secondly,the type of pollution information in knowledge base was judged by multiple vectors orthogonal to the subspace.In this way,the classification of network topology pollution attack types was completed.Based on classification results,the cost and benefit of network attack and defense were analyzed quantitatively.Moreover,a quantitative model was constructed.Based on attack graph,defense graph and game theory,a model of defending attacks was constructed to obtain the best strategy of defending network topology pollution attacks.The experimental results prove that the proposed method can effectively detect the hijacking attacks in host and forgery attacks in link,improve the defense effect of network topology pollution attack as well as the timeliness of attack defense.

关 键 词：入侵诱骗 网络拓扑 污染攻击防御 防御图 博弈论 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]