WO2018149406A1

WO2018149406A1 - Ip address hopping method and apparatus for software defined network (sdn)

Info

Publication number: WO2018149406A1
Application number: PCT/CN2018/076729
Authority: WO
Inventors: 李光; 孔勇; 王延松; 吴少勇; 吴春明; 周海峰
Original assignee: 中兴通讯股份有限公司
Priority date: 2017-02-16
Filing date: 2018-02-13
Publication date: 2018-08-23
Also published as: CN108449441A

Abstract

An IP address hopping method and apparatus for a software defined network (SDN). The method comprises: comparing a current calculated value and a pre-determined threshold, wherein the current calculated value is the difference between an infected host slope of the previous moment and the next moment (S102); and setting the next IP address hopping time interval according to the comparison result (S104).

Description

IP address hopping method and device for software defined network SDN

Technical field

This document relates to, but is not limited to, the field of communications, and in particular to a method and apparatus for Internet Protocol IP address hopping of a software defined network SDN.

Background technique

With the development of science and technology, the Internet security situation is becoming more and more serious, and the traditional Internet security defense methods have not worked well. Mobile Target Defense Technology (MTD) is one of the revolutionary technologies in the cyberspace “changing the rules of the game” proposed by the US Science and Technology Commission in recent years. It is completely different from previous cybersecurity research ideas. It increases the attacker's attack difficulty and cost through various and ever-changing construction, evaluation and deployment mechanisms and strategies, and effectively limits the exposure and vulnerability of the vulnerability. IP address hopping is an important technology in MTD. At present, the IP address hopping method based on time dimension is relatively simple.

Summary of the invention

The following is an overview of the topics detailed in this document. This Summary is not intended to limit the scope of the claims.

The embodiment of the invention provides a method and device for IP address hopping of a software defined network SDN.

According to an embodiment of the present invention, a method for IP address hopping of a software-defined network SDN is provided, including: comparing a current calculated value with a predetermined threshold, wherein the current calculated value is infected at a previous time and a next time The difference between the host slopes; according to the comparison result, set the next IP address hopping interval.

Optionally, the setting the next IP address hopping time interval according to the comparison result includes: according to the guarantee parameter, the evasive parameter, and the current IP address hopping time interval when the current calculated value is less than the predetermined threshold Calculating the next IP address hopping time interval, where the guarantee parameter is a ratio between a current network throughput and a traditional network throughput, where the evasive parameter is an attacker's successful detection times and total detection times a ratio between the two; the next IP address hopping time interval is set in an exponentially decreasing manner when the current calculated value is greater than the predetermined threshold.

Optionally, the calculating the next IP address hopping time interval according to the guarantee parameter, the evasive parameter, and the current IP address hopping interval includes: using a guarantee parameter, an evasive parameter, and a current IP address hopping, respectively. Time interval, at least two hopping time intervals are obtained according to a gradient falling manner; one time interval is selected as the next IP address hopping time interval in the at least two hopping time intervals, wherein the selected time interval The smallest time interval of the at least two time intervals.

Optionally, before calculating the next IP address hopping time interval according to the guarantee parameter, the evasive parameter, and the current IP address hopping time interval, the method further includes: setting a target value of the guarantee parameter and the avoiding The target value of the sexual parameter.

Optionally, the predetermined threshold is

Where I(t) represents the number of infected hosts at time t.

According to another embodiment of the present invention, there is provided an IP address hopping device for a software-defined network SDN, comprising: a comparison module configured to compare a current calculated value with a predetermined threshold, wherein the current calculated value is a previous time The difference from the slope of the infected host at the next moment; the setting module is set to set the next IP address hopping interval according to the comparison result.

Optionally, the setting module includes: a first setting unit, configured to calculate, according to the guarantee parameter, the evasive parameter, and the current IP address hopping time interval, when the current calculated value is less than the predetermined threshold An IP address hopping time interval, wherein the guarantee parameter is a ratio between a current network throughput and a traditional network throughput, and the evasive parameter is a ratio between an attacker's successful number of probes and a total number of probes. And a second setting unit, configured to set the next IP address hopping time interval in an exponentially decreasing manner when the current calculated value is greater than the predetermined threshold.

Optionally, the first setting unit includes: an obtaining sub-unit, configured to obtain at least two hopping time intervals according to a gradient descent manner by using a guarantee parameter, an evasive parameter, and a current IP address hopping time interval respectively; Selecting a subunit, configured to select a time interval as the next IP address hopping time interval in the at least two hopping time intervals, wherein the selected time interval is the smallest of the at least two time intervals time interval.

Optionally, the setting module further includes: a third setting unit, configured to: before calculating the next IP address hopping time interval according to the guarantee parameter, the evasive parameter, and the current IP address hopping time interval, The target value of the guarantee parameter and the target value of the avoidance parameter.

Optionally, the predetermined threshold is

Where I(t) represents the number of infected hosts at time t.

According to still another embodiment of the present invention, a storage medium is also provided. The storage medium is arranged to store program code for performing the following steps:

Comparing the current calculated value with a predetermined threshold, wherein the current calculated value is a difference between the slopes of the infected host at the previous time and the next time; and according to the comparison result, setting a next IP address hopping time interval.

According to the embodiment of the present invention, the current calculated value and the predetermined threshold are compared, wherein the current calculated value is a difference between the slopes of the infected host at the previous time and the next time; and according to the comparison result, the next IP address hopping time interval is set. In other words, the current calculated value and the predetermined threshold are compared in real time, and the next IP address hopping interval is dynamically set according to the comparison result, so that the IP address hopping based on the time dimension is relatively simple, and the technical effect of the IP address flexible hopping is achieved. .

Other aspects will be apparent upon reading and understanding the drawings and detailed description.

BRIEF abstract

1 is a flowchart of a method for IP address hopping of a software-defined network SDN according to an embodiment of the present invention;

2 is a flow chart of another software-defined network SDN IP address hopping method according to an embodiment of the present invention;

3 is a structural block diagram of an IP address hopping device of a software-defined network SDN according to an embodiment of the present invention;

4 is a structural block diagram (1) of an IP address hopping device of a software-defined network SDN according to an embodiment of the present invention;

5 is a structural block diagram (2) of an IP address hopping device of a software-defined network SDN according to an embodiment of the present invention;

Figure 6 is a block diagram (3) of the structure of an IP address hopping device of a software-defined network SDN according to an embodiment of the present invention.

Embodiments of the invention

The invention will be described in detail below with reference to the drawings in conjunction with the embodiments.

It is to be understood that the terms "first", "second" and the like in the specification and claims of the present invention are used to distinguish similar objects, and are not necessarily used to describe a particular order or order.

The embodiment of the present invention provides a method for hopping an IP address of a software-defined network SDN. FIG. 1 is a flowchart of a method for hopping an IP address of a software-defined network SDN according to an embodiment of the present invention. As shown in FIG. 1 , the process includes The following steps:

Step S102, comparing the current calculated value with a predetermined threshold, wherein the current calculated value is a difference between the slopes of the infected host at the previous time and the next time;

Step S104, according to the comparison result, setting a next IP address hopping time interval.

Optionally, in this embodiment, the application scenario of the IP address hopping method of the Software Defined Network (SDN) includes: IP address hopping based on the time dimension, and in the application scenario, comparing The current calculated value and the predetermined threshold, wherein the current calculated value is a difference between the slopes of the infected host at the previous time and the next time; according to the comparison result, the next IP address hopping time interval is set. In other words, the current calculated value and the predetermined threshold are compared in real time, and the next IP address hopping interval is dynamically set according to the comparison result, so that the IP address hopping based on the time dimension is relatively simple, and the technical effect of the IP address flexible hopping is achieved. .

The present embodiment will be exemplified below with reference to specific examples.

This example proposes a strategy for adaptive hopping of IP addresses based on software-defined networks (SDN) in the time dimension. Specifically, the following steps are included:

In step S11, two evaluation parameters are proposed: (1) a guarantee parameter (Φ); (2) an avoidance parameter (Θ).

In step S12, a threshold is set based on the mechanism of worm propagation.

In step S13, two corresponding models are established according to two cases, (1) when it is less than the threshold and (2) when the threshold is exceeded. The transition interval of the next IP address can be calculated separately.

In step S14, the calculated value and the threshold are periodically compared, and the calculated value is continuously maintained through the above steps S11 to S14.

The beneficial effect of this example is that two target values can be set according to the requirements of the system: the guaranteed parameter target value and the avoidance parameter target value, and the two optimal values can be obtained by using the gradient descent method. The controller can adjust the time interval of IP address hopping at any time according to the target value, which can achieve a compromise between performance and robustness. When the threshold is exceeded, the system will quickly increase the frequency of IP address hopping to achieve defense against worm breeding.

In an optional implementation manner, setting the IP address hopping time interval according to the comparison result includes the following steps:

Step S21: When the current calculated value is less than the predetermined threshold, calculate the next IP address hopping time interval according to the guarantee parameter, the evasive parameter, and the current IP address hopping time interval, where the guarantee parameter is the current network. The ratio between the throughput and the traditional network throughput. The evasive parameter is the ratio between the number of successful attackers and the total number of probes.

It should be noted that the foregoing predetermined threshold may be

Where I(t) represents the number of infected hosts at time t, ie the maximum value of the slope difference of the infected host.

Step S22: When the current calculated value is greater than the predetermined threshold, set the next IP address hopping time interval in an exponentially decreasing manner.

Through the above steps S21 to S22, the next IP address hopping time interval can be flexibly set.

Optionally, calculating the next IP address hopping time interval according to the guarantee parameter, the evasive parameter, and the current IP address hopping interval includes the following steps:

Step S31, using the guarantee parameter, the evasive parameter, and the current IP address hopping time interval, and obtaining at least two hopping time intervals according to the gradient falling manner;

Step S32, selecting a time interval as the next IP address hopping time interval in the at least two hopping time intervals, wherein the selected time interval is the smallest time interval among the at least two time intervals.

Through the above steps S31 to S32, the setting of the next IP address hopping time interval is made relatively safe with respect to the current network.

Optionally, before calculating the next IP address hopping interval according to the guarantee parameter, the evasive parameter, and the current IP address hopping interval, the following steps are further included:

Step S41, setting a target value of the guarantee parameter and a target value of the avoidance parameter.

Through the above step S41, the time interval of the IP address hopping can be adjusted according to the target value at any time, and a compromise between performance and robustness can be achieved.

First, two evaluation parameters are proposed: (1) guaranteedness parameter (Φ); (2) avoidance parameter (Θ). The guarantee parameter (Φ) represents the ratio of the throughput at the time of using the adaptive IP address hopping method to the throughput under the traditional network conditions; the evasive parameter (Θ) indicates the number of successful attackers and the total number of probes. The ratio of the number of times. Second, I(t) represents the number of worms at time t. Based on the simple worm breeding model and CAIDA data, calculate the difference between the slopes of the infected host at the previous moment and the next moment, and calculate the value:

And set a threshold:

This threshold takes into account both performance and security requirements. Before the threshold is reached, the IP address change frequency will be within a certain range, and after the threshold is reached, the change interval will decrease rapidly. Then, two models are built to analyze the current threshold condition. When the calculated value is less than the threshold, the guaranteed transition parameter and the avoidance parameter and the current transition time interval are respectively used, and the gradient transition method is used to calculate the next transition time interval. Obtain two transition time intervals respectively. From the perspective of achieving better security, always select the smaller of the two intervals calculated this time as the time interval of the next IP address hopping. When the calculated value is greater than the threshold, the IP address hopping frequency increases exponentially to effectively cope with worm breeding because of performance and robustness. In addition, the guarantee parameters are no longer decisive parameters in this case, and the evasive parameters are more important at this time. Finally, the calculated value and the threshold are compared periodically, and the calculated value is continuously maintained through the above steps, and the comparison between the calculated value and the threshold is fed back in real time (refer to step S201 to step S207 of FIG. 2 for details).

Through the description of the above embodiments, those skilled in the art can clearly understand that the method according to the above embodiment can be implemented by means of software plus a necessary general hardware platform, and of course, by hardware, but in many cases, the former is A better implementation. Based on such understanding, the technical solution of the present invention, which is essential or contributes to the prior art, may be embodied in the form of a software product stored in a storage medium (such as ROM/RAM, disk, The optical disc includes a number of instructions for causing a terminal device (which may be a cell phone, a computer, a server, or a network device, etc.) to perform the methods described in various embodiments of the present invention.

The embodiment also provides an IP address hopping device for the software-defined network SDN. The device is used to implement the foregoing embodiments and optional implementations, and details are not described herein. As used below, the term "module" may implement a combination of software and/or hardware of a predetermined function. Although the apparatus described in the following embodiments is preferably implemented in software, hardware, or a combination of software and hardware, is also possible and contemplated.

3 is a structural block diagram of an IP address hopping device of a software-defined network SDN according to an embodiment of the present invention. As shown in FIG. 3, the device includes:

1) The comparison module 32 is configured to compare the current calculated value with a predetermined threshold, wherein the current calculated value is a difference between the slopes of the infected host at the previous time and the next time;

2) The setting module 34 is set to set the next IP address hopping time interval according to the comparison result.

Optionally, in this embodiment, the application scenario of the IP address hopping device of the Software Defined Network (SDN) includes: IP address hopping based on the time dimension, and in the application scenario, comparing The current calculated value and the predetermined threshold, wherein the current calculated value is a difference between the slopes of the infected host at the previous time and the next time; according to the comparison result, the next IP address hopping time interval is set. In other words, the current calculated value and the predetermined threshold are compared in real time, and the next IP address hopping interval is dynamically set according to the comparison result, so that the IP address hopping based on the time dimension is relatively simple, and the technical effect of the IP address flexible hopping is achieved. .

4 is a structural block diagram (1) of an IP address hopping device of a software-defined network SDN according to an embodiment of the present invention. As shown in FIG. 4, the setting module 34 includes:

1) The first setting unit 42 is configured to calculate the next IP address hopping time interval according to the guarantee parameter, the evasive parameter, and the current IP address hopping time interval when the current calculated value is less than the predetermined threshold, where The guarantee parameter is a ratio between the current network throughput and the traditional network throughput, and the evasive parameter is a ratio between the number of successful attackers and the total number of probes;

2) The second setting unit 44 is configured to set the next IP address hopping time interval in an exponentially decreasing manner when the current calculated value is greater than the predetermined threshold.

Through the device shown in Figure 4, the next IP address hopping interval can be flexibly set.

FIG. 5 is a structural block diagram (2) of an IP address hopping device of a software-defined network SDN according to an embodiment of the present invention. As shown in FIG. 5, the first setting unit 42 includes:

1) The obtaining sub-unit 52 is configured to use the guarantee parameter, the evasive parameter and the current IP address hopping time interval respectively, and obtain at least two hopping time intervals according to the gradient falling manner; 2) selecting the sub-unit 54, set to A time interval is selected as the next IP address hopping time interval in the at least two hopping time intervals, wherein the selected time interval is the smallest time interval of the at least two time intervals.

Through the apparatus shown in FIG. 5, the setting of the next IP address hopping time interval is made relatively safe with respect to the current network.

6 is a structural block diagram (3) of an IP address hopping device of a software-defined network SDN according to an embodiment of the present invention. As shown in FIG. 6, the setting module 34 includes a first setting unit 42 and a second setting unit 44. include:

1) The third setting unit 62 is configured to set a target value of the guarantee parameter and the avoidance before calculating the next IP address hopping time interval according to the guarantee parameter, the evasive parameter, and the current IP address hopping time interval The target value of the sexual parameter.

Through the device shown in FIG. 6, the time interval of the IP address hopping can be adjusted at any time according to the target value, and a compromise between performance and robustness can be achieved.

Optionally, the predetermined threshold is

Where I(t) represents the number of infected hosts at time t.

It should be noted that each of the above modules may be implemented by software or hardware. For the latter, the foregoing may be implemented by, but not limited to, the foregoing modules are all located in the same processor; or, the above modules are in any combination. The forms are located in different processors.

Embodiments of the present invention also provide a storage medium. Optionally, in the embodiment, the foregoing storage medium may be configured to store program code for performing the following steps:

S1, comparing the current calculated value with a predetermined threshold, wherein the current calculated value is a difference between the slopes of the infected host at the previous time and the next time;

S2, according to the comparison result, set the next IP address hopping interval.

Optionally, in this embodiment, the foregoing storage medium may include: a USB flash drive, a read-only memory (ROM), a random access memory (RAM), a mobile hard disk, a magnetic disk, or a magnetic disk. And other media that can store program code.

Optionally, in this embodiment, the processor performs the above steps S1, S2 according to the stored program code in the storage medium.

For example, the specific examples in this embodiment may refer to the examples described in the foregoing embodiments and the optional embodiments, and details are not described herein again.

Those of ordinary skill in the art will appreciate that all or some of the steps, systems, and functional blocks/units of the methods disclosed above may be implemented as software, firmware, hardware, and suitable combinations thereof. In a hardware implementation, the division between functional modules/units mentioned in the above description does not necessarily correspond to the division of physical units; for example, one physical component may have multiple functions, or one function or step may be composed of several physical The components work together. Some or all of the components may be implemented as software executed by a processor, such as a digital signal processor or microprocessor, or as hardware, or as an integrated circuit, such as an application specific integrated circuit. Such software may be distributed on a computer readable medium, which may include computer storage media (or non-transitory media) and communication media (or transitory media). As is well known to those of ordinary skill in the art, the term computer storage medium includes volatile and nonvolatile, implemented in any method or technology for storing information, such as computer readable instructions, data structures, program modules, or other data. , removable and non-removable media. Computer storage media includes, but is not limited to, RAM, ROM, EEPROM, flash memory or other memory technology, CD-ROM, digital versatile disc (DVD) or other optical disc storage, magnetic cartridge, magnetic tape, magnetic disk storage or other magnetic storage device, or may Any other medium used to store the desired information and that can be accessed by the computer. Moreover, it is well known to those skilled in the art that communication media typically embodies computer readable instructions, data structures, program modules or other data in a modulated data signal, such as a carrier wave or other transport mechanism, and can include any information delivery media. The above is only an alternative embodiment of the present invention, and is not intended to limit the present invention, and various modifications and changes can be made to the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and scope of the present invention are intended to be included within the scope of the present invention.

Industrial applicability

In the embodiment of the present invention, the IP address hopping based on the time dimension is relatively simple, and the IP address flexible hopping is implemented.

Claims

A software protocol network SDN internet protocol IP address hopping method, comprising:

Comparing the current calculated value with a predetermined threshold, wherein the current calculated value is a difference between the slopes of the infected host at the previous time and the next time (S102);

According to the comparison result, the next IP address hopping time interval is set (S104).
The method of claim 1, wherein the setting the next IP address hopping time interval (S104) according to the comparison result comprises:

When the current calculated value is less than the predetermined threshold, the next IP address hopping time interval is calculated according to the guarantee parameter, the evasive parameter, and the current IP address hopping time interval, where the guarantee parameter is current The ratio between the network throughput and the traditional network throughput, the evasive parameter being the ratio between the number of successful attackers and the total number of probes;

When the current calculated value is greater than the predetermined threshold, the next IP address hopping time interval is set in an exponentially decreasing manner.
The method according to claim 2, wherein the calculating the next IP address hopping time interval according to the guarantee parameter, the evasive parameter, and the current IP address hopping time interval comprises:

Obtaining at least two transition time intervals according to the gradient falling manner by using the guarantee parameter, the evasive parameter, and the current IP address hopping time interval respectively;

Selecting one time interval as the next IP address hopping time interval in the at least two hopping time intervals, wherein the selected time interval is the smallest time interval of the at least two time intervals.
The method of claim 2 further comprising:

And setting a target value of the guarantee parameter and a target value of the avoidance parameter before calculating the next IP address hopping time interval according to the guarantee parameter, the evasive parameter, and the current IP address hopping time interval.
The method according to any one of claims 1 to 4, wherein

The predetermined threshold
Where I(t) represents the number of infected hosts at time t.
A software protocol network SDN internet protocol IP address hopping device, comprising:

a comparison module (32) configured to compare the current calculated value with a predetermined threshold, wherein the current calculated value is a difference between the slopes of the infected host at the previous time and the next time;

The setting module (34) is set to set the next IP address hopping time interval according to the comparison result.
The apparatus of claim 6 wherein said setting module (34) comprises:

The first setting unit (42) is configured to calculate, according to the guarantee parameter, the evasive parameter, and the current IP address hopping time interval, the next IP address hopping time interval when the current calculated value is less than the predetermined threshold The guarantee parameter is a ratio between a current network throughput and a traditional network throughput, and the evasive parameter is a ratio between an attacker's successful number of probes and a total number of probes;

The second setting unit (44) is configured to set the next IP address hopping time interval in an exponentially decreasing manner when the current calculated value is greater than the predetermined threshold.
The apparatus according to claim 7, wherein said first setting unit (42) comprises:

Obtaining a sub-unit (52), configured to use the guarantee parameter, the evasive parameter, and the current IP address hopping time interval respectively, and obtain at least two hopping time intervals according to the gradient descent manner;

Selecting a subunit (54), configured to select a time interval as the next IP address hopping time interval in the at least two hopping time intervals, wherein the selected time interval is the at least two time intervals The smallest time interval.
The apparatus of claim 7, the setting module (34) further comprising:

The third setting module (62) is configured to set a target value of the guarantee parameter and before calculating the next IP address hopping time interval according to the guarantee parameter, the evasive parameter, and the current IP address hopping time interval The target value of the evasive parameter.
A device according to any one of claims 6 to 9, wherein

The predetermined threshold
Where I(t) represents the number of infected hosts at time t.
A computer readable storage medium storing computer executable instructions that, when executed by a processor, implement the method of any one of claims 1 to 5.