基于深度确定性策略梯度的随机路由防御方法

徐潇雨; 胡浩; 张红旗; 刘玉岭

doi:10.11959/j.issn.1000-436x.2021093

您当前的位置：

首页 >

文章列表页 >

基于深度确定性策略梯度的随机路由防御方法

学术论文 | 更新时间：2024-06-05

- 基于深度确定性策略梯度的随机路由防御方法
- Random routing defense method based on deep deterministic policy gradient
- 通信学报 2021年42卷第6期页码：41-51
- 作者机构：
  
  1. 信息工程大学密码工程学院，河南郑州 450001
  2. 河南省信息安全重点实验室，河南郑州 450001
  3. 中国科学院信息工程研究所，北京 100190
- 作者简介：
  
  [ "徐潇雨（1992− ），男，江苏连云港人，信息工程大学博士生，主要研究方向为主动防御和智能决策" ]
  [ "胡浩（1989− ），男，安徽池州人，博士，信息工程大学讲师，主要研究方向为网络安全态势感知" ]
  [ "张红旗（1962− ），男，河北遵化人，博士，信息工程大学教授、博士生导师，主要研究方向为网络安全、风险评估、等级保护和信息安全管理等" ]
  [ "刘玉岭（1982− ），男，山东济阳人，博士，中国科学院信息工程研究所副教授，主要研究方向为网络安全测评和等级保护" ]
- 基金信息：
  
  国家自然科学基金资助项目(61902427);国家自然科学基金资助项目(61802404)
- DOI：10.11959/j.issn.1000-436x.2021093
  中图分类号： TP939
- 网络出版日期：2021-06，
  
  纸质出版日期：2021-06-25
- 稿件说明：
移动端阅览
徐潇雨, 胡浩, 张红旗, 等. 基于深度确定性策略梯度的随机路由防御方法[J]. 通信学报, 2021,42(6):41-51.

Xiaoyu XU, Hao HU, Hongqi ZHANG, et al. Random routing defense method based on deep deterministic policy gradient[J]. Journal on communications, 2021, 42(6): 41-51.
徐潇雨, 胡浩, 张红旗, 等. 基于深度确定性策略梯度的随机路由防御方法[J]. 通信学报, 2021,42(6):41-51. DOI： 10.11959/j.issn.1000-436x.2021093.

Xiaoyu XU, Hao HU, Hongqi ZHANG, et al. Random routing defense method based on deep deterministic policy gradient[J]. Journal on communications, 2021, 42(6): 41-51. DOI： 10.11959/j.issn.1000-436x.2021093.

摘要

针对现有随机路由防御方法对数据流拆分粒度过粗、对合法的服务质量（QoS）保障效果不佳、对抗窃听攻击的安全性有待提升等问题，提出一种基于深度确定性策略梯度（DDPG）的随机路由防御方法。通过带内网络遥测（INT）技术实时监测并获取网络状态；通过DDPG方法生成兼顾安全性和QoS需求的随机路由方案；通过 P4 框架下的可编程交换机执行随机路由方案，实现了数据包级粒度的随机路由防御。实验表明，与其他典型的随机路由方法相比，所提方法在对抗窃听攻击中的安全性和对网络整体QoS的保障效果均有提升。

Abstract

To solve the problem of the existing routing shuffling defenses

such as too coarse data flow splitting granularity

poor protection effect on legitimate QoS and the security against eavesdropping attacks needed to be improved

a random routing defense method based on DDPG was proposed.INT was used to monitor and obtain the network state in real time

DDPG algorithm was used to generate random routing scheme considering both security and QoS requirements

random routing scheme was implemented with programmable switch under P4 framework to realize real-time routing shuffling with packet level granularity.Experiment results show that compared with other typical routing shuffling defense methods

the security and QoS protection effect of the proposed method are improved.

关键词

Keywords

references

赛门铁 . 2018 年安全威胁趋势预测 [J ] . 网络安全和信息化 , 2018 ( 1 ): 103 - 105 .

EC . Security threat trend forecast in 2018 [J ] . Security ＆Informatization , 2018 ( 1 ): 103 - 105 .

JAJODIA S , GHOSH A K , SWARUP V , et al . Moving target defense [M ] . New York : Springer , 2011 .

YANG W , ZHENG Z Q , CHEN G R , et al . Security analysis of a distributed networked system under eavesdropping attacks [J ] . IEEE Transactions on Circuits and Systems II:Express Briefs , 2020 , 67 ( 7 ): 1254 - 1258 .

GURUNG S , CHAUHAN S . A survey of black-hole attack mitigation techniques in MANET:merits,drawbacks,and suitability [J ] . Wireless Networks , 2020 , 26 ( 3 ): 1981 - 2011 .

SINGH M P , BHANDARI A . New-flow based DDoS attacks in SDN:Taxonomy,rationales,and research challenges [J ] . Computer Communications , 2020 , 154 : 509 - 527 .

LILLICRAP T P , HUNT J J , PRITZEL A , et al . Continuous control with deep reinforcement learning [J ] . arXiv Preprint,arXiv:1509.02971 , 2015 .

BOSSHART P , DALY D , GIBB G , et al . P4 [J ] . ACM SIGCOMM Computer Communication Review , 2014 , 44 ( 3 ): 87 - 95 .

DUAN Q , AL-SHAER E , JAFARIAN H . Efficient random route mutation considering flow and network constraints [C ] // 2013 IEEE Conference on Communications and Network Security . Piscataway:IEEE Press , 2013 : 260 - 268 .

JAFARIAN J H , AL-SHAER E , DUAN Q . Formal approach for route agility against persistent attackers [C ] // European Symposium on Research in Computer Security . Berlin:Springer , 2013 : 237 - 254 .

ZHAO Z , GONG D F , LU B , et al . SDN-based double hopping communication against sniffer attack [J ] . Mathematical Problems in Engineering , 2016 , 2016 : 1 - 13 .

ASEERI A , NETJINDA N , HEWETT R . Alleviating eavesdropping attacks in software-defined networking data plane [C ] // Proceedings of the 12th Annual Conference on Cyber and Information Security Research . New York:ACM Press , 2017 : 1 - 8 .

ZHOU Z , XU C Q , KUANG X H , et al . An efficient and agile spatio-temporal route mutation moving target defense mechanism [C ] // 2019 IEEE International Conference on Communications . Piscataway:IEEE Press , 2019 : 1 - 6 .

DUAN Q , AL-SHAER E , CHATTERJEE S , et al . Proactive routing mutation against stealthy distributed denial of service attacks:metrics,modeling,and analysis [J ] . The Journal of Defense Modeling and Simulation:Applications,Methodology,Technology , 2018 , 15 ( 2 ): 219 - 230 .

LIU J , ZHANG H Q , GUO Z C . A defense mechanism of random routing mutation in SDN [J ] . IEICE Transactions on Information and Systems , 2017 , 100 ( 5 ): 1046 - 1054 .

雷程 , 马多贺 , 张红旗 , 等 . 基于最优路径跳变的网络移动目标防御技术 [J ] . 通信学报 , 2017 , 38 ( 3 ): 133 - 143 .

LEI C , MA D H , ZHANG H Q , et al . Network moving target defense technique based on optimal forwarding path migration [J ] . Journal on Communications , 2017 , 38 ( 3 ): 133 - 143 .

ZHANG T , KUANG X H , ZHOU Z , et al . An intelligent route mutation mechanism against mixed attack based on security awareness [C ] // 2019 IEEE Global Communications Conference . Piscataway:IEEE Press , 2019 : 1 - 6 .

ZHANG T , XU C Q , ZHANG B C , et al . DQ-RM:deep reinforcement learning-based route mutation scheme for multimedia services [C ] // 2020 International Wireless Communications and Mobile Computing . Piscataway:IEEE Press , 2020 : 291 - 296 .

KIM C , SIVARAMAN A , KATTA N , et al . In-band network telemetry via programmable dataplanes [J ] . ACM SIGCOMM , 2015 , 17 : 1 - 2 .

KANDULA S , KATABI D , SINHA S , et al . Dynamic load balancing without packet reordering [J ] . ACM SIGCOMM Computer Communication Review , 2007 , 37 ( 2 ): 51 - 62 .

KAUR K , SINGH J , GHUMMAN N S . Mininet as software defined networking testing platform [C ] // International Conference on Communiction,Computing ＆ Systems . Piscataway:IEEE Press , 2014 : 1 - 6 .

WAXMAN B M . Routing of multipoint connections [J ] . IEEE Journal on Selected Areas in Communications , 1988 , 6 ( 9 ): 1617 - 1622 .

ABADI M , BARHAM P , CHEN J , et al . TensorFlow:a system for large-scale machine learning [C ] // Proceedings of the 12th USENIX Conference on Operating Systems Design and Implementation . Berkeley:USENIX Association , 2016 : 265 - 283 .

浏览量

702

下载量

CSCD

文章被引用时，请邮件提醒。

提交

工具集

关联资源

基于POF的网络窃听攻击移动目标防御方法

基于深度确定性策略梯度的星地融合网络可拆分任务卸载算法

基于DPDK的内网动态网关关键技术设计

基于压缩感知的设备多源信息传输与分类算法

基于Markov时间博弈的移动目标防御最优策略选取方法