基于拟态防御架构的服务功能链执行体动态调度方法

doi:10.11959/j.issn.1000-0801.2022070

Abstract

Abstract:

Faced with the problem that static and lagging traditional defense technologies cannot effectively deal with new network attacks, according to the theory of mimetic security defense, a defense architecture of mimic service function chain (MSFC) based on the data forwarding level was proposed, and an execution dynamic scheduling method based on the decision feedback was further proposed.The method took the abnormal executor information fed back by the decision maker, the heterogeneity of executors and the actual load of the system as the scheduling influencing factors, so that the scheduling method can be adjusted adaptively according to the actual changes of the network.In addition, the scheduling method used decision feedback to adjust the scheduling time, so as to achieve the best balance between system cost and security, and reduce the resource overhead of the system.Simulation results showed that the scheduling method can select a set of highly heterogeneous actuators that better meet the current network requirements on the basis of balancing the system cost and security, so as to improve the security and reliability of the system.

Key words: service function chain, mimic defense, dynamic scheduling, executor, heterogeneous degree

CLC Number:

TP393

Chuanhuang LI, Jingjing TANG, Yangting CHEN, Rui LEI, Chao CHEN, Weiming WANG. Dynamic scheduling method of service function chain executors based on the mimic defense architecture[J]. Telecommunications Science, 2022, 38(4): 101-112.

Figures/Tables 11

References 25

[1]	RFC. Service function chaining (SFC) architecture[R]. 2015.
[2]	李天龙 . 多域网络安全服务编排系统的设计与实现[D]. 北京:北京交通大学, 2018.
	LI T L . The design and implement of multi-domain network security service orchestration system[D]. Beijing:Beijing Jiaotong University, 2018.
[3]	RFC. Forwarding and control element separation (ForCES) protocol specification[R]. 2010.
[4]	BIFULCO R , CANONICO R , BRUNNER M ,et al. A practical experience in designing an OpenFlow controller[C]// Proceedings of 2012 European Workshop on Software Defined Networking. Piscataway:IEEE Press, 2012: 61-66.
[5]	Table of contents[EB]. 2006.
[6]	JAIN R , PAUL S . Network virtualization and software defined networking for cloud computing:a survey[J]. IEEE Communications Magazine, 2013,51(11): 24-31.
[7]	GUERZONI R , . Network functions virtualization an introduction,benefits,enablers,challenges and call for action[C]// SDN and OpenFlow World Congress,St Louis.[S.l.:s.n.], 2012.
[8]	CHOWDHURY N M M K , BOUTABA R . A survey of network virtualization[J]. Computer Networks, 2010,54(5): 862-876.
[9]	宋永春 . 基于 SDN 的设备间服务链设计与实现[D]. 兰州:兰州大学, 2017.
	SONG Y C . The design and realization of equipment service-chain in SDN[D]. Lanzhou:Lanzhou University, 2017.
[10]	IETF. Problem statement for service function chaining:RFC 7498[S]. 2018.
[11]	OKTIAN Y E , LEE S , LEE H . Mitigating Denial of Service (DoS) attacks in OpenFlow networks[C]// Proceedings of 2014 International Conference on Information and Communication Technology Convergence (ICTC). Piscataway:IEEE Press, 2014: 325-330.
[12]	JABEUR N , MOH A N S , BARKIA M M . A bully approach for competitive redundancy in heterogeneous wireless sensor network[J]. Procedia Computer Science, 2016(83): 628-635.
[13]	邬江兴 . 网络空间拟态安全防御[J]. 保密科学技术, 2014(10): 1,4-9.
	WU J X . Cyberspace pseudo security defense[J]. Secrecy Science and Technology, 2014(10): 1,4-9.
[14]	马海龙, 伊鹏, 江逸茗 ,等. 基于动态异构冗余机制的路由器拟态防御体系结构[J]. 信息安全学报, 2017,2(1): 29-42.
	MA H L , YI P , JIANG Y M ,et al. Dynamic heterogeneous redundancy based router architecture with mimic defenses[J]. Journal of Cyber Security, 2017,2(1): 29-42.
[15]	马海龙, 江逸茗, 白冰 ,等. 路由器拟态防御能力测试与分析[J]. 信息安全学报, 2017,2(1): 43-53.
	MA H L , JIANG Y M , BAI B ,et al. Tests and analyses for mimic defense ability of routers[J]. Journal of Cyber Security, 2017,2(1): 43-53.
[16]	DURANTE L , SENO L , VALENZA F ,et al. A model for the analysis of security policies in service function chains[C]// Proceedings of 2017 IEEE Conference on Network Softwarization (NetSoft). Piscataway:IEEE Press, 2017.
[17]	XIE J C , YI P , ZHANG Z ,et al. A service function chain deployment scheme based on heterogeneous backup[C]// Proceedings of 2018 IEEE 18th International Conference on Communication Technology (ICCT). Piscataway:IEEE Press, 2018.
[18]	JAJODIA S , GHOSH A K , SWARUP V ,et al. Moving Target Defense[M]. New York,NY: Springer New York, 2011.
[19]	OKHRAVI H , HOBSON T , BIGELOW D ,et al. Finding focus in the blur of moving-target techniques[J]. IEEE Security ＆Privacy, 2014,12(2): 16-26.
[20]	CADAR C , AKRITIDIS P , COSTA M ,et al. Data randomization[R]. 2008.
[21]	邬江兴, 李军飞 . 一种异构功能等价体调度装置及方法:CN106161417A[P]. 2016.
	WU J X , LI J F . A heterogeneous functional equivalent scheduling device and method:CN106161417A[P]. 2016.
[22]	QI C , WU J X , HU H C ,et al. Dynamic-scheduling mechanism of controllers based on security policy in software-defined network[J]. Electronics Letters, 2016,52(23): 1918-1920.
[23]	季新生, 徐水灵, 刘文彦 ,等. 一种面向安全的虚拟网络功能动态异构调度方法[J]. 电子与信息学报, 2019,41(10): 2435-2441.
	JI X S , XU S L , LIU W Y ,et al. A security-oriented dynamic and heterogeneous scheduling method for virtual network function[J]. Journal of Electronics ＆ Information Technology, 2019,41(10): 2435-2441.
[24]	王禛鹏 . 拟态网络操作系统调度与裁决机制研究及实现[D]. 郑州:战略支援部队信息工程大学, 2017.
	WANG Z P . Research on the scheduling and decision-making mechanism of mimic network operating system[D]. Zhengzhou:Information Engineering University, 2017.
[25]	王宇 . 网络主动防御与主动防御网络[J]. 保密科学技术, 2014(11): 27-34.
	WANG Y . Cyber active defense and active defense network[J]. Secrecy Science and Technology, 2014(11): 27-34.

Metrics

Recommended 0

No Suggested Reading articles found!

防御机制	防御方案	特点
被动防御	SF安全加固	需增设安全模块，造成额外开销
	SFC安全编排与部署	未知漏洞易被攻破
主动防御	移动目标防御	计算难度较大
	拟态安全防御	对调度算法质量要求较高

虚拟机	操作系统	软件
V₃	Ubuntu	iptables
V₄	Windows	Kaspersky Anti-Hacker
V₅	CentOS	XELIOS Personal Firewall
V₆	Windows	ZoneAlarm Pro
V₇	Windows	Norton Personal Firewall
V₈	CentOS	LVS
V₉	Windows	Nginx
V₁₀	CentOS	HAproxy
V₁₁	Ubuntu	LVS
V₁₂	Ubuntu	Nginx

Dynamic scheduling method of service function chain executors based on the mimic defense architecture

RichHTML

PDF下载

Knowledge

Abstract

Cite this article

share this article

Figures/Tables 11

References 25

Related Articles 11

Metrics

Recommended 0

[1]	Xiaochun WU, Chen HONG, Yue ZHANG, Junnan ZHANG, Jingjing ZHOU. Variable granularity service function chain mapping algorithm based on microservice architecture [J]. Telecommunications Science, 2022, 38(12): 11-26.
[2]	Yue ZHANG, Junnan ZHANG, Xiaochun WU, Chen HONG, Jingjing ZHOU. Improved grey wolf optimization algorithm based service function chain mapping algorithm [J]. Telecommunications Science, 2022, 38(11): 57-72.
[3]	Ruyun ZHANG, Heyuan LI, Shunbin LI. Mimic security scheduling algorithm for industrial control under limited heterogeneous resource constraints [J]. Telecommunications Science, 2021, 37(3): 57-65.
[4]	Shuo QUAN, Xuliang WANG, Zeya ZHU. Research and practice of software-defined security technology architecture in the 5G+ era [J]. Telecommunications Science, 2021, 37(12): 60-71.
[5]	Junning QIN,Jiajia HAN,Sheng ZHOU,Chunming WU,Shuangxi CHEN,Ruoyan ZHAO,Jiangyu ZHANG. Modeling of the mimic defense based on heterogeneous redundancy [J]. Telecommunications Science, 2020, 36(5): 31-38.
[6]	Liyue CHEN,Xin SUN,Tiansheng CHENG,Chunming WU,Shuangxi CHEN. Defense of hidden backdoor technology for Web [J]. Telecommunications Science, 2020, 36(5): 39-46.
[7]	Ming GAO,Jin LUO,Huiying ZHOU,Hai JIAO,Lili YING. A differential feedback scheduling decision algorithm based on mimic defense [J]. Telecommunications Science, 2020, 36(5): 73-82.
[8]	Yongqing ZHU,Xia GONG,Huanan CHEN. SFP selection algorithm for SFC [J]. Telecommunications Science, 2017, 33(5): 113-118.
[9]	Xinsheng JI,Hao LIANG,Hongchao HU. New thoughts on security technologies for space-ground integration information network [J]. Telecommunications Science, 2017, 33(12): 24-35.
[10]	Ligang DONG,Bohan HE,Tijie XU,Shuocheng FEI,Weiming WANG. Deployment and implementation of dynamic network policy in SDN [J]. Telecommunications Science, 2016, 32(10): 137-149.
[11]	Honglei MOU,Bo YANG,Yafei HAO. Resource scheduling scheme of cloud platform for business support system [J]. Telecommunications Science, 2015, 31(Z1): 179-185.