基于入侵诱骗的网络拓扑污染攻击防御研究

Research on Network Topology Pollution Attack Defense Based on Intrusion Deception

以目标为中心的攻击防御手段检测到攻击后才有所响应,攻击防御不及时,为了提升网络拓扑污染攻击防御能力,提出一种基于入侵诱骗的网络拓扑污染攻击防御方法。通过入侵诱骗系统模拟网络脆弱性,采集攻击模式,并添加到知识库中;通过多个和子空间正交的向量判断知识库内污染信息类型,完成网络拓扑污染攻击类型分类;通过分类结果量化分析网络攻击与防御的成本收益,构建成本收益量化模型;基于攻击图、防御图和博弈论构建攻击防御模型,获取最佳网络拓扑污染攻击防御策略。实验结果表明,所提方法可以有效检测主机位置劫持攻击和链路伪造攻击,提升网络拓扑污染攻击防御效果,且提升了攻击防御的及时性。

In order to improve the defensive capability for network topology pollution attack,this paper presented a method of defending network topology pollution attack based on intrusion deception.Firstly,the intrusion deception system was used to simulate the network vulnerability and collect attack patterns,and then they were added to the knowledge base.Secondly,the type of pollution information in knowledge base was judged by multiple vectors orthogonal to the subspace.In this way,the classification of network topology pollution attack types was completed.Based on classification results,the cost and benefit of network attack and defense were analyzed quantitatively.Moreover,a quantitative model was constructed.Based on attack graph,defense graph and game theory,a model of defending attacks was constructed to obtain the best strategy of defending network topology pollution attacks.The experimental results prove that the proposed method can effectively detect the hijacking attacks in host and forgery attacks in link,improve the defense effect of network topology pollution attack as well as the timeliness of attack defense.