CHAOS：一种基于SDN的移动目标防御系统
CHAOS: an SDN-based Moving Target Defense System
摘要：
当前网络系统的静态性质使其很容易受到攻击和破坏。通过不断地改变系统，移动目标防御（MTD）提供了一种有前途的方法来减少或移动可供对手利用的攻击面。然而，当前基于网络的MTD不加区别地混淆网络，使得一些网络关键服务（诸如web和DNS服务）不可用，因为这些服务的许多信息必须向外部开放并且保持真实而不损害它们的可用性。此外，不分青红皂白的混淆也严重降低了网络的性能。在本文中，我们提出了混沌，SDN（软件定义网络）为基础的MTD系统，有区别地混淆网络中不同的安全级别的主机。在CHAOS中，我们引入了一种混沌塔混淆（Chaos Tower Obfuscation，CTO）方法，它使用一个混沌塔结构（Chaos Tower Structure，CTS）来描述内部网中所有主机的层次结构，提供了一种更加不可预测和灵活的混淆方法。我们还介绍了混沌的设计，它利用SDN功能来混淆攻击表面，包括IP混淆，端口混淆和指纹混淆，从而提高网络环境的不可预测性。我们开发了快速CTO算法，以实现不同程度的混淆在每一层的主机。实验结果表明，混沌保护的网络能够有效地降低信息泄露的比例，保证网络流量的正常流动。
英文摘要：
The static nature of current cyber systems has made them easy to be attacked and compromised. By constantly changing a system, Moving Target Defense (MTD) has provided a promising way to reduce or move the attack surface that is available for exploitation by an adversary. However, the current network- based MTD obfuscates networks indiscriminately that makes some networks key services, such as web and DNS services, unavailable, because many information of these services has to be opened to the outside and remain real without compromising their usability. Moreover, the indiscriminate obfuscation also severely reduces the performance of networks. In this paper, we propose CHAOS, an SDN (Software-defined networking)-based MTD system, which discriminately obfuscates hosts with different security levels in a network. In CHAOS, we introduce a Chaos Tower Obfuscation (CTO) method, which uses a Chaos Tower Structure (CTS) to depict the hierarchy of all the hosts in an intranet and provides a more unpredictable and flexible obfuscation method. We also present the design of CHAOS, which leverages SDN features to obfuscate the attack surface including IP obfuscation, ports obfuscation, and fingerprint obfuscation thereby enhancing the unpredictability of the networking environment. We develop fast CTO algorithms to achieve a different degree of obfuscation for the hosts in each layer. Our experimental results show that a network protected by CHAOS is capable of decreasing the percentage of information disclosure effectively to guarantee the normal flow of traffic.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
