面向未知网络威胁的网络要地自适应防御模型  

Adaptive defense model for critical assets against unknown network threats

作　　者：郝宵荣 刘波 周鼎 曹玖新 张进 HAO Xiaorong;LIU Bo;ZHOU Ding;CAO Jiuxin;ZHANG Jin(School of Cyber Science and Engineering,Southeast University,Nanjing 211189,China;Purple Mountain Laboratories,Nanjing 211111,China)

机构地区：[1]东南大学网络空间安全学院,江苏南京211189 [2]紫金山实验室,江苏南京211111

出　　处：《通信学报》2025年第3期45-61,共17页Journal on Communications

基　　金：国家重点研发计划基金资助项目(No.2022YFB3104300);国家自然科学基金资助项目(No.62472092,No.62172089);江苏省网络与信息安全重点实验室基金资助项目(No.BM2003201);教育部计算机网络与信息集成重点实验室基金资助项目(No.93K-9)。

摘　　要：针对未知网络威胁的隐匿性和渗透性等特点,提出了一种基于拟态防御理论的新型自适应防御模型。该模型引入拟态伪装机制,创新性地提出基于子网伪装的动态重构策略,通过动态调整子网的拓扑结构,扰乱攻击路径的生效过程,自适应阻止未知威胁的扩散,实现对网络要地的保护。该模型包括输入代理、可重构子网、调度控制层和策略裁决层,输入代理将业务流传输至可重构子网,策略裁决层构建强化学习驱动的智能决策模型,感知可重构子网的状态并生成防御策略;调度控制层根据防御策略动态调整子网连接,自适应地干扰攻击路径并阻止未知威胁的扩散。实验结果表明,与同类防御方法相比,所提模型能在有限步数内显著提高未知网络威胁防御成功率。To address the stealthy and penetrative characteristics of unknown network threats,a novel adaptive defense model based on mimic defense theory was proposed.The model introduced a mimic disguise mechanism and proposed a dynamic reconstruction strategy using subnet camouflage.By dynamically adjusting subnet topologies,it disrupted attack path and protected critical assets.The model included input proxy,reconfigurable subnet,scheduling control layer,and policy decision layer.The input proxy forwarded traffic to reconfigurable subnet.A reinforcement learning-based decision model in the policy decision layer perceived reconfigurable subnet states to generate defense strategies.Subnet connections were dynamically adjusted by the scheduling control layer to adaptively interfere with attack paths and prevent unknown threat diffusion.Experiments show that the proposed model achieves higher success rate in blocking unknown threats within limited steps compared to existing methods.

关 键 词：未知威胁 动态异构冗余 强化学习 拟态防御 自适应防御 

分 类 号：TP302[自动化与计算机技术—计算机系统结构]