CCN中基于节点状态模型的缓存污染攻击检测算法

doi:10.11959/j.issn.1000-436x.2016172

摘要/Abstract

摘要：

针对内容中心网络中的缓存污染攻击问题，以污染内容数量、分布状态和攻击强度3个参数对缓存污染攻击进行定量描述和分析，建立了攻击下的节点缓存状态模型。通过分析节点关键参数的变化，提出了基于节点状态模型的攻击检测原则，并分别以单位时间缓存替换率和请求达到率为观测参数进行算法实例化设计。仿真结果与性能分析表明，所提检测算法在应对分散式攻击与集中式攻击时，可以取得良好的检测性能。

关键词: 内容中心网络, 缓存污染攻击, 缓存状态模型, 攻击检测

Abstract:

Aiming at cache pollution attacks in content centric networking,the attacks were quantitatively described by three parameters,namely number of pollution contents,distribution of attack requests and attack intensity,then the cache state model of node under attack was built.Benefited from the analysis of key parameters of cache node,the attack detection principle based on node state model was put forward,correspondingly,two attack detection algorithms were instantiated with the observation parameters of cache replacement ratio and request arrival rate.The simulation results show that proposed algorithm can obtain good detection performance under each decentralized attack and centralized attack.

Key words: content centric networking, cache pollution attacks, cache state model, attack detection

汤红波,郑林浩,葛国栋,袁泉. CCN中基于节点状态模型的缓存污染攻击检测算法[J]. 通信学报, 2016, 37(9): 1-9.

Hong-bo TANG,Lin-hao ZHENG,Guo-dong GE,Quan YUAN. Detection algorithm for cache pollution attacks based on node state model in content centric networking[J]. Journal on Communications, 2016, 37(9): 1-9.

图/表 9

图1

图2

表1

图3

图4

图5

图6

图7

表2

参考文献 17

[1]	XYLOMENOS G , VERVERIDIS C , SIRIS V ,et al. A survey of information-centric networking research[J]. IEEE Communications Surveys ＆amp; Tutorials, 2014,16: 1024-1049.
[2]	JACOBSON V , SMETTERS D K , THORNTON J D ,et al. Networking named content[J]. Communications of the ACM, 2012,55(1): 117-124.
[3]	兰巨龙, 程东年, 胡宇翔 . 可重构信息通信基础网络体系研究[J]. 通信学报, 2014,35(1): 128-139. LAN J L , CHENG D N , HU Y X . Research on reconfigurable information communication based network architecture[J]. Journal on Communications, 2014,35(1): 128-139.
[4]	ACS G , CONTI M , GASTI P ,et al. Cache privacy in named-data networking[C]// IEEE International Conference on Distributed Computing Systems. Philadelphia,USA, 2013: 41-51.
[5]	CHAABANE A , DE CRISTOFARO E , KAAFAR M A ,et al. Privacy in content-oriented networking:threats and countermeasures[J]. ACM SIGCOMM Computer Communication Review, 2013,43(3): 25-33.
[6]	LAUINGER T . Security ＆amp; scalability of content-centric networking[D]. TU Darmstadt, 2010.
[7]	CONTI M , GASTI P , TEOLI M . A lightweight mechanism for detection of cache pollution attacks in named data networking[J]. Computer Networks, 2013,57(16): 3178-3191.
[8]	PARK H , WIDJAJA I , LEE H . Detection of cache pollution attacks using randomness checks[C]// IEEE International Conference on Communications (ICC). Ottawa, 2012: 1096-1100.
[9]	XIE M , WIDJAJA I , WANG H . Enhancing cache robustness for content-centric networking[C]// IEEE INFOCOM Annual IEEE International Conference on Computer Communications. Orlando, 2012: 2426-2434.
[10]	SANDBERG A,EKL?V D , HAGERSTEN E . Reducing cache pollution through detection and elimination of non-temporal memory accesses[C]// 2010 ACM/IEEE International Conference for High Performance Computing,Networking,Storage and Analysis. Washington DC:IEEE Computer Society, 2010: 1-11.
[11]	KIM Y , YEOM I . Performance analysis of in-network caching for content-centric networking[J]. Computer Networks, 2013,57(13): 2465-2482.
[12]	DAN A , TOWSLEY D . An approximate analysis of the LRU and FIFO buffer replacement schemes[M]. New York,USA: ACM PublisherPress, 1990: 143-152.
[13]	CHAI W K , HE D , PSARAS I ,et al. Cache “less for more” in information-centric networks[C]// IFIP Networking. Prague,Czech, 2012: 27-40.
[14]	ROSENSWEIG E J , KUROSE J , TOWSLEY D . Approximate models for general cache networks[C]// IEEE INFOCOM 2010. San Diego, 2010: 1-9.
[15]	DENG L , GAO Y , CHEN Y ,et al. Pollution attacks and defenses for Internet caching systems[J]. Computer Networks, 2008,52(5): 935-956.
[16]	MOHAISEN A , ZHANG X W , SCHUCHARD M ,et al. Protecting access privacy of cached contents in information centric networks[C]// ACM SIGSAC Symposium on Information,Computer and Communications Security. Hangzhou,China, 2013: 173-178.
[17]	AFANASYEV A , MAHADEVAN P , MOISEENKO I ,et al. Interest flooding attack and countermeasures in named data networking[C]// IFIP Networking Conference. New York, 2013: 1-9.

模型参数	可观测性
总未命中概率P _miss	可观测
正常请求未命中概率P _miss,n	不可观测
攻击请求未命中概率P _miss,a	不可观测
单位时间缓存替换率m	可观测
单位时间正常内容替换率m_n	不可观测
单位时间污染内容替换率m_a	不可观测
内容请求的到达率r	可观测
正常请求到达率λ_n	不可观测
攻击请求到达率λ_a	不可观测

检测方法			攻击模式
检测方法	轻量攻击	集中式攻击	分散式轻量攻击	分散式攻击	中量攻击
单位时间替换率检测	?0.22	0.15	?0.10	1.30	0.44
请求到达率检测	0.10	8.00	?0.21	?0.02	0.34
LWM	?0.17	2.05	?0.22	2.01	0.60
CUSUM	?0.18	?0.20	2.80	0.10	?0.05