The detection of the vulnerability of the target host from the intranet is the main way to initiate the network attack. The static characteristics of the current network are beneficial to the implementation of attacker reconnaissance

and the L2/L3 address inside the network is the main information that the attacker expects to scout. In order to change the network attack and defense situation in the reconnaissance stage

based on the idea of mimicry camouflage

a collaborative dynamic technology of L2 and L3 addresses is proposed to strategically hide the real network host without affecting normal business conditions. Firstly

the cyber reconnaissance game (CRG) is established.Based on the NASH equilibrium solution

the mimetic camouflage strategy of L2/L3 address is solved

and the optimal mutation period calculation formula is given. Secondly

based on the software-defined network architecture

the cooperative mutation intranet defense system (CMID) is designed and implemented

and the SDN controller cooperatively controls the camouflage transformation of the L2/L3 address. Finally

the theoretical analysis and experimental results show that the above method can effectively cut off the correlation between L2/L3 address and real network identity and upper-layer services

maximally hide the internal hosts of the network

delay the reconnaissance speed

and block the continuity of network attacks.