现有研究者采用威胁建模和安全分析系统的方法评估和预测软件定义网络(software defined network,SDN)安全威胁,但该方法未考虑SDN控制器的漏洞利用概率以及设备在网络中的位置,安全评估不准确。针对以上问题,根据设备漏洞利用概率和设...现有研究者采用威胁建模和安全分析系统的方法评估和预测软件定义网络(software defined network,SDN)安全威胁,但该方法未考虑SDN控制器的漏洞利用概率以及设备在网络中的位置,安全评估不准确。针对以上问题,根据设备漏洞利用概率和设备关键度结合PageRank算法,设计了一种计算SDN中各设备重要性的算法;根据SDN攻击图和贝叶斯理论设计了一种度量设备被攻击成功概率的方法。在此基础上设计了一种基于贝叶斯攻击图的SDN安全预测算法,预测攻击者的攻击路径。实验结果显示,该方法能够准确预测攻击者的攻击路径,为安全防御提供更准确的依据。展开更多
随着网络规模的扩大及业务的多样化,原有的网络架构难以满足未来发展需求,软件定义网络(software defined networking,SDN)作为一种新型网络架构被提出。将控制平面从数据平面中分离出来,控制平面的集中管控简化了网络配置管理,实现了...随着网络规模的扩大及业务的多样化,原有的网络架构难以满足未来发展需求,软件定义网络(software defined networking,SDN)作为一种新型网络架构被提出。将控制平面从数据平面中分离出来,控制平面的集中管控简化了网络配置管理,实现了灵活部署,提高了网络性能。利用SDN的集中获取信息的特性可对网络中的安全威胁进行监督检测,提高网络安全性。然而SDN在带来便利的同时也带来了新的安全问题。文中从SDN的各层及接口对网络安全问题进行分析,并对现有的解决方案进行了分类,分别从提升SDN控制器安全性、DoS/DDoS攻击防御、流规则一致性、提升应用程序安全性、北向接口标准化这5个方面进行了探讨,进而得出结论,并对未来进行展望。展开更多
Software Defined Networking(SDN) is a revolutionary networking paradigm towards the future network,experiencing rapid development nowadays.However,its main characteristic,the separation of control plane and data plane...Software Defined Networking(SDN) is a revolutionary networking paradigm towards the future network,experiencing rapid development nowadays.However,its main characteristic,the separation of control plane and data plane,also brings about new security challenges,i.e.,Denial-of-Service(DoS) attacks specific to Open Flow SDN networks to exhaust the control plane bandwidth and overload the buffer memory of Open Flow switch.To mitigate the DoS attacks in the Open Flow networks,we design and implement SGuard,a security application on top of the NOX controller that mainly contains two modules:Access control module and Classification module.We employ novel six-tuple as feature vector to classify traffic flows,meanwhile optimizing classification by feature ranking and selecting algorithms.All the modules will cooperate with each other to complete a series of tasks such as authorization,classification and so on.At the end of this paper,we experimentally use Mininet to evaluate SGuard in a software environment.The results show that SGuard works efficiently and accurately without adding more overhead to the SDN networks.展开更多
文摘现有研究者采用威胁建模和安全分析系统的方法评估和预测软件定义网络(software defined network,SDN)安全威胁,但该方法未考虑SDN控制器的漏洞利用概率以及设备在网络中的位置,安全评估不准确。针对以上问题,根据设备漏洞利用概率和设备关键度结合PageRank算法,设计了一种计算SDN中各设备重要性的算法;根据SDN攻击图和贝叶斯理论设计了一种度量设备被攻击成功概率的方法。在此基础上设计了一种基于贝叶斯攻击图的SDN安全预测算法,预测攻击者的攻击路径。实验结果显示,该方法能够准确预测攻击者的攻击路径,为安全防御提供更准确的依据。
文摘随着网络规模的扩大及业务的多样化,原有的网络架构难以满足未来发展需求,软件定义网络(software defined networking,SDN)作为一种新型网络架构被提出。将控制平面从数据平面中分离出来,控制平面的集中管控简化了网络配置管理,实现了灵活部署,提高了网络性能。利用SDN的集中获取信息的特性可对网络中的安全威胁进行监督检测,提高网络安全性。然而SDN在带来便利的同时也带来了新的安全问题。文中从SDN的各层及接口对网络安全问题进行分析,并对现有的解决方案进行了分类,分别从提升SDN控制器安全性、DoS/DDoS攻击防御、流规则一致性、提升应用程序安全性、北向接口标准化这5个方面进行了探讨,进而得出结论,并对未来进行展望。
基金supported by the National key Research and Development Program of China(No.2016YFB0800100,2016YFB0800101)the National Natural Science Fund for Creative Research Groups Project(No.61521003)the National Natural Science Fund for Youth Found Project(No.61602509)
文摘Software Defined Networking(SDN) is a revolutionary networking paradigm towards the future network,experiencing rapid development nowadays.However,its main characteristic,the separation of control plane and data plane,also brings about new security challenges,i.e.,Denial-of-Service(DoS) attacks specific to Open Flow SDN networks to exhaust the control plane bandwidth and overload the buffer memory of Open Flow switch.To mitigate the DoS attacks in the Open Flow networks,we design and implement SGuard,a security application on top of the NOX controller that mainly contains two modules:Access control module and Classification module.We employ novel six-tuple as feature vector to classify traffic flows,meanwhile optimizing classification by feature ranking and selecting algorithms.All the modules will cooperate with each other to complete a series of tasks such as authorization,classification and so on.At the end of this paper,we experimentally use Mininet to evaluate SGuard in a software environment.The results show that SGuard works efficiently and accurately without adding more overhead to the SDN networks.
