通信学报 ›› 2022, Vol. 43 ›› Issue (6): 71-84.doi: 10.11959/j.issn.1000-436x.2022081

• 学术论文 • 上一篇    下一篇

面向持久性连接的自适应拟态表决器设计与实现

周大成, 陈鸿昶, 程国振, 何威振, 商珂, 扈红超   

  1. 信息工程大学信息技术研究所，河南 郑州 450001
  • 修回日期:2022-03-24 出版日期:2022-06-01 发布日期:2022-06-01
  • 作者简介:周大成（1995- ），男，河南息县人，信息工程大学博士生，主要研究方向为网络空间安全、云计算等
    陈鸿昶（1964- ），男，河南新密人，博士，信息工程大学教授、博士生导师，主要研究方向为网络空间安全、数据分析等
    程国振（1986- ），男，山东菏泽人，博士，信息工程大学副教授、硕士生导师，主要研究方向为网络空间安全、软件定义网络等
    何威振（1996- ），男，安徽亳州人，信息工程大学博士生，主要研究方向为网络空间安全、云计算等
    商珂（1995- ），女，河南郑州人，信息工程大学助理研究员，主要研究方向为网络空间安全、云计算等
    扈红超（1982- ），男，河南商丘人，博士，信息工程大学教授、博士生导师，主要研究方向为网络空间安全、拟态防御等
  • 基金资助:
    国家自然科学基金资助项目(62072467);国家重点研发计划基金资助项目(2021YFB1006200);国家重点研发计划基金资助项目(2021YFB1006201)

Design and implementation of adaptive mimic voting device oriented to persistent connection

Dacheng ZHOU, Hongchang CHEN, Guozhen CHENG, Weizhen HE, Ke SHANG, Hongchao HU   

  1. Institute of Information Technology, Information Engineering University, Zhengzhou 450001, China
  • Revised:2022-03-24 Online:2022-06-01 Published:2022-06-01
  • Supported by:
    The National Natural Science Foundation of China(62072467);The National Key Research and Develop-ment Program of China(2021YFB1006200);The National Key Research and Develop-ment Program of China(2021YFB1006201)

在线阅读

14

PDF下载

185

摘要：

目的：拟态表决器是拟态防御技术的动态异构冗余架构下的关键组件，但是现有拟态表决方法需要分析处理异构冗余执行体的完整输出数据，在基于HTTP 1.1协议的基于持久性连接持续传输数据分块的应用场景中存在表决效率过低、内存资源开销过大的问题。本文面向持久性连接的数据分块持续输出的场景，设计实现面向持久性连接的自适应拟态表决器，以降低表决器的内存资源开销并提高该场景下的表决效率。

方法：通过自适应切分陆续到达表决器的异构冗余分块报文，在数据持续传输过程中以滑动窗口的方式对分块报文的数据进行动态表决与输出，并逐步释放已表决分块报文数据，从而在保持持久性连接的数据传输连续性的条件下降低数据表决处理时间和拟态表决器的内存消耗。一方面，分析滑动窗口式表决的分块传输编码报文的数据特征，构建表决算法选择策略集，给出表决器在滑动窗口式的数据表决时的表决准确性的维护方案。另一方面，建立自适应拟态表决器的数据表决过程的存贮模型，并基于存贮模型的成本优化提出自适应表决窗口控制策略，为待表决数据的提供最佳的自适应切分方案。

结果：基于Nginx实现自适应拟态表决器的原型系统并与传统的拟态表决器进行一系列的对比实验。（1）通过对内存资源占用量评估发现，自适应拟态表决器在传输20MB分块编码传输的Web资源时消耗的物理内存的峰值及消耗物理内存的总时间相较于传统拟态表决器均明显降低；（2）通过传输时延评估发现，自适应拟态表决器在表决处理10MB至320MB的分块传输编码的网页资源的响应时间均较低，说明其表决速率得到明显提高；（3）通过并发性能评估发现，自适应拟态表决器在1000至5000的并发量下的系统平均响应时延低于传统拟态表决器的，表决处理吞吐量也高于传统拟态表决器；（4）通过表决准确性评估表明，基于表决算法选择策略集的自适应拟态表决器相较于分别采用字符相似度算法、语义特征算法、层次分析算法的传统拟态表决器，在多个HTML的数据篡改场景中略弱于语义特征算法和层次分析算法，但远优于字符相似度算法，因此具有可接受的表决准确率。

结论：自适应拟态表决器有效解决了持久性连接传输分块报文的表决过程中的内存资源的过度占用带来的服务性能下降问题。资源开销实验说明了自适应拟态表决器对该问题的改善效果；表决准确度评估实验说明了自适应拟态表决器在提高表决效率的同时维护了可接受的表决准确性；不同数据规模和不同服务压力下的实验以微基准的方式说明了自适应拟态表决器在一般应用场景下的可行性。因此，本文所设计实现的自适应拟态表决器在可接受的表决准确度下降低了资源开销并提高了表决效率，可有效支撑在持久性连接中传输数据的应用程序的拟态化改造。

关键词: 拟态防御, 拟态表决, 超文本传输协议, 持久性连接, 分块传输编码

Abstract:

Objectives: Mimic voter is a crucial component under the dynamic heterogeneous redundancy architecture of mimic defense technology,but the existing mimic voting method needs to collect and process the complete output data of heterogeneous redundant executives. In the application scenario where the connection continuously transmits data in chunked transfer encoding,there are problems that the mimic voting efficiency is too low and the memory resource overhead of mimic voting is too significant.This paper designs and implements an adaptive mimic voter oriented to the scenario of the continuous output of chunked transfer encoded data in a persistent connection to reduce the memory resource overhead of the mimic voter and improve voting efficiency.

Methods: The proposed mimic voter adaptively divides the chunked-transfer-encoded data arriving at the voter successively from the heterogeneous redundant executives,dynamically votes, and then outputs the data in the form of a sliding window during the continuous data transmission process.Gradually releasing the data of the voted blocks can reduce the memory consumption of the mimic voter and lower the voting processing time while maintaining the continuity of data transmission of the persistent connection.On the one hand,a voting algorithm selection strategy set is constructed to keep the voting accuracy by analyzing the data characteristics in the sliding window.On the other hand,an inventory model of the data voting process of the adaptive mimic voter is established,and an adaptive voting window control strategy is proposed based on the cost optimization of the inventory model to provide the best adaptive segmentation scheme for the data to be voted.

Results:A series of comparative experiments between the prototype system of the adaptive mimic voter and the traditional mimic voter is conducted as follows. (1) The evaluation of memory resource occupancy shows that the peak physical memory consumption and the total time of consuming physical memory when the adaptive mimic voter transmits 20MB web resources in chunked transfer encoding are significantly lower than those of the traditional mimic voter. (2) The evaluation of transmission delay shows that the response time of the adaptive mimic voter in the voting processing of 10MB to 320MB chunked transfer-encoded webpage resources is relatively low, indicating that its voting speed has been significantly improved. (3) The concurrency performance evaluation shows that the average of response time of the system applying the adaptive mimic voter under the request concurrency of 1000 to 5000 is lower than that of the traditional mimic voter,and the voting processing throughput is higher than that of the traditional mimic voter.(4)The evaluation of voting accuracy shows that the adaptive mimic voter based on the voting algorithm selects the strategy set is slightly weaker than the semantic feature algorithm and the AHP algorithm while far superior to the character similarity algorithm in the traditional mimic voter, which reveals that the adaptive mimic voter has an acceptable voting accuracy.

Conclusions: The design of the adaptive mimic voter effectively solves the problem of service performance degradation caused by the excessive occupation of memory resources in voting chunked transfer encoding data of persistent connection. The memory occupancy experiment shows the improvement effect of the adaptive mimic voter on this problem, and the voting accuracy evaluation experiment shows that the adaptive mimic voter can improve voting efficiency while maintaining acceptable voting accuracy.The experiments under different service pressures give the feasibility analysis of the adaptive mimic voter in general application scenarios with micro-benchmarks. Therefore, the adaptive mimic voter reduces resource overhead and improves voting efficiency with acceptable voting accuracy, which can effectively support the mimic transformation of applications that transmit data in persistent connections.

Key words: mimic defense, mimic voting, HTTP, persistent connection, chunked transfer encoding

中图分类号: 

No Suggested Reading articles found!