关键词: 目标侦察, 软件定义网络, 拟态伪装, 纳什均衡, 网络防御, 地址跳变

Abstract: The detection of the vulnerability of the target host from the intranet is the main way to initiate the network attack. The static characteristics of the current network are beneficial to the implementation of attacker reconnaissance, and the L2/L3 address inside the network is the main information that the attacker expects to scout. In order to change the network attack and defense situation in the reconnaissance stage, based on the idea of mimicry camouflage, a collaborative dynamic technology of L2 and L3 addresses is proposed to strategically hide the real network host without affecting normal business conditions. Firstly, the cyber reconnaissance game (CRG) is established.Based on the NASH equilibrium solution,the mimetic camouflage strategy of L2/L3 address is solved,and the optimal mutation period calculation formula is given. Secondly, based on the software-defined network architecture, the cooperative mutation intranet defense system (CMID) is designed and implemented, and the SDN controller cooperatively controls the camouflage transformation of the L2/L3 address. Finally, the theoretical analysis and experimental results show that the above method can effectively cut off the correlation between L2/L3 address and real network identity and upper-layer services, maximally hide the internal hosts of the network, delay the reconnaissance speed, and block the continuity of network attacks.

Key words: reconnaissance, software defined network, mimicry, NASH equilibrium, cyber defense, address mutation