矢量数据包处理加速的动态防护系统设计与实现

doi:10.3969/j.issn.0372-2112.2019.08.016

电子学报 ›› 2019, Vol. 47 ›› Issue (8): 1724-1730.DOI: 10.3969/j.issn.0372-2112.2019.08.016

矢量数据包处理加速的动态防护系统设计与实现

苗力仁, 扈红超, 霍树民, 程国振

1. 国家数字交换系统工程技术研究中心, 河南郑州 450002

收稿日期:2019-03-20 修回日期:2019-06-13 出版日期:2019-08-25
- 通讯作者:
- 苗力仁
- 作者简介:
- 扈红超 男,1982年出生,河南商丘人,国家数字交换系统工程技术研究中心研究员,博士生导师,主要研究方向为云计算和网络安全.E-mail:13633833568@139.com
- 基金资助:
- 信息工程大学新兴方向研究项目 (No.2016610708）; 国家自然科学基金 (No.61602509）

The Design and Implementation of a Vector Packet Processing Accelerating Dynamic Protection System

MIAO Li-ren, HU Hong-chao, HUO Shu-min, CHENG Guo-zhen

1. National Digital Switching System Engineering R & D Center, Zhengzhou, Henan 450002, China

Received:2019-03-20 Revised:2019-06-13 Online:2019-08-25 Published:2019-08-25

摘要/Abstract

摘要： 针对IP地址动态化防护技术引入额外开销而导致正常网络传输性能下降的问题，首次设计并实现了一种基于矢量数据包处理（Vector Packet Processing，VPP）加速的IP地址动态防护系统，在隐藏真实IP地址的同时增强了系统数据处理能力.首先，针对控制平面和数据平面处理逻辑不同，分别设计了快转发逻辑和慢转发逻辑，降低数据报文处理过程中的拷贝次数；其次，面向真实IP-虚假IP频繁映射，提出一种共享内存的高效的IP地址动态变换机制；再次，采用最优化和哈希链算法制定了IP跳变策略与虚假IP地址预分配机制，最小化系统性能损耗；最后，实验结果表明，系统能够有效抵御DoS攻击并将潜在的侦查攻击命中率控制在16%以下，在数据处理性能上也有明显的速度提升.

关键词: 网络主动防御, IP跳变, 矢量数据包处理, 最优化

Abstract: IP address dynamic protection techniques will introduce additional overhead.Therefore,the performance of normal network transmission decreases.A dynamic protection system of IP address accelerated by Vector Packet Processing (VPP) is designed and implemented for the first time,which can hide the real IP address and enhance the system's data Processing ability.Firstly,fast forwarding logic and slow forwarding logic are designed respectively for different logic of control plane and data plane processing,so as to minimize the number of copies in data message processing.Secondly,facing the frequent mapping between real IP and virtual IP,an efficient dynamic IP address transformation mechanism of Shared memory is proposed.Thirdly,the optimization algorithm is used to formulate the IP hopping strategy,and the hashing chain algorithm is used to formulate the efficient virtual IP address pre-allocation mechanism.Minimize system performance losses.Finally,the experimental results show that the system can effectively resist DoS attacks and control the potential detection attack hit rate below 16%,which is significantly improved in data processing performance.

Key words: network active defense, IP mutation, vector packet processing, optimization

中图分类号:

TN915.08

苗力仁, 扈红超, 霍树民, 程国振. 矢量数据包处理加速的动态防护系统设计与实现[J]. 电子学报, 2019, 47(8): 1724-1730.

MIAO Li-ren, HU Hong-chao, HUO Shu-min, CHENG Guo-zhen. The Design and Implementation of a Vector Packet Processing Accelerating Dynamic Protection System[J]. Acta Electronica Sinica, 2019, 47(8): 1724-1730.

参考文献

[1] Kewley D,Fink R,Lowry J,et al.Dynamic approaches to thwart adversary intelligence gathering[A].Darpa Information Survivability Conference & Exposition Ⅱ[C].Anaheim,CA,USA.2001.176-185.
[2] POOVENDRAN R.Dynamic defense against adaptive and persistent adversaries[A].Proceedings of the 5th ACM Workshop on Moving Target Defense[C].Toronto,Canada.2018.57-58.
[3] Antonatos S,Akritidis P,Markatos E P,et al.Defending against hitlist worms using network address space randomization[J].Computer Networks,2007,51(12):3471-3490.
[4] Luo Y B,Wang B S,Wang X F,et al.RPAH:Random port and address hopping for thwarting internal and external adversaries[A].2015 IEEE Trustcom/BigDataSE/ISPA[C].Helsinki,Finland.2015.1:263-270.
[5] Macfarland D C,Shue C A.The SDN Shuffle:Creating a moving-target defense using host-based software-defined networking[A].Acm Workshop on Moving Target Defense[C].Denver,Colorado,USA.2015.37-41.
[6] Jafarian J H,Al-Shaer E,Duan Q.Openflow random host mutation:transparent moving target defense using software defined networking[A].Workshop on Hot Topics in Software Defined Networks[C].Chicago,Illinois,USA.2012.127-132.
[7] Inocybe Technologies:Innocybe_VPP_Whitepaper[OL].http://www.sdxcentral.com/wp-content/uploads/Innocybe_VPP_Whitepaper.pdf.2017.12.
[8] Clark A,Sun K,Poovendran R.Effectiveness of IP address randomization in decoy-based moving target defense[A].2013 IEEE 52nd Annual Conference on Decision and Control (CDC)[C].Firenze,Italy.2013.187-195.
[9] Wang K,Chen X,Zhu Y.Random domain name and address mutation (RDAM) for thwarting reconnaissance attacks[J].PLoS ONE,2017,12(5):e01777111.
[10] 胡毅勋,等.基于OpenFlow的网络层移动目标防御方案[J].通信学报,2017,38(10):102-112. HU Yi-xun,ZHENG Kang-feng,YANG Yi-xian,NIU Xin-xin.Moving target defense solution onnetwork layer based on OpenFlow[J].Journal on Communications,2017,38(10):102-112.(in Chinese)
[11] 陈扬,扈红超,程国振.软件定义的内网动态防御系统设计与实现[J].电子学报,2018,46(11):2604-2611. CHEN Yang,HU Hong-chao,CHENG Guo-zhe.The Design and Implementation of a Software-Defined ntranet Dynamic Defense System[J].Acta Electronica Sinica,2018,46(11):2604-2611.(in Chinese)

[1]	陈双喜, 吴安邦, 岐舒骏, 刘会, 吴春明. 新型主动防御框架的资源对抗模型分析[J]. 电子学报, 2019, 47(7): 1557-1565.
[2]	袁红星, 安鹏, 吴少群, 郑悠. 具有容错能力的L₁最优化半自动2D转3D[J]. 电子学报, 2018, 46(2): 447-455.
[3]	陈扬, 扈红超, 程国振. 软件定义的内网动态防御系统设计与实现[J]. 电子学报, 2018, 46(11): 2604-2611.
[4]	刘畅, 宋飞, 鄢欢, 张思东. 基于自学习选路算法的多路径并行传输[J]. 电子学报, 2013, 41(7): 1290-1296.
[5]	何书前, 倪江群, 石春. 一种分层判决结构的H.264/AVC快速帧间模式选择方法[J]. 电子学报, 2013, 41(11): 2199-2206.
[6]	黎湘, 范梅梅. 认知雷达及其关键技术研究进展[J]. 电子学报, 2012, 40(9): 1863-1870.
[7]	朱伟芳, 赵鹤鸣, 陈小平. 一种最小长度约束的EMD包络拟合方法[J]. 电子学报, 2012, 40(9): 1909-1912.
[8]	宋海岩, 朴胜春, 秦进平. 矢量最优化稳健波束形成性能分析[J]. 电子学报, 2012, 40(7): 1351-1357.
[9]	薛淼;董平;张思东;张宏科. 一种基于端到端多路径的最优化流量控制算法[J]. 电子学报, 2012, 40(3): 564-570.
[10]	蒋定德;王兴伟;郭磊;许争争;陈振华. 大尺度IP骨干网络流量矩阵估计方法研究[J]. 电子学报, 2011, 39(4): 763-771.
[11]	许培达;韩德强;邓勇;. 一种基本概率赋值转换为概率的最优化方法[J]. 电子学报, 2011, 39(3A): 121-125.
[12]	贾修一;李伟wei;商琳;陈家骏;. 一种自适应求三枝决策中决策阈值的算法[J]. 电子学报, 2011, 39(11): 2520-2525.
[13]	王国宏;苏伟;白晶;钟佩琳. 不同量测误差情况下1D和2D被动传感器交叉定位系统最优交会角研究[J]. 电子学报, 2009, 37(6): 1295-1299.
[14]	李平. 过程噪声未知但有界情况下系统最优滤波器设计方法[J]. 电子学报, 2004, 32(6): 1050-1053.
[15]	郝跃, 荆明娥, 马佩军. VLSI集成电路参数成品率及优化研究进展[J]. 电子学报, 2003, 31(S1): 1971-1974.

矢量数据包处理加速的动态防护系统设计与实现

The Design and Implementation of a Vector Packet Processing Accelerating Dynamic Protection System

PDF

可视化

摘要/Abstract

引用本文

使用本文

参考文献

相关文章 15

编辑推荐

Metrics