A method for issuing heterogeneous redundant defense strategies for intrinsically secure switches

Abstract

This invention discloses a method for distributing heterogeneous redundancy defense strategies for intrinsically secure switches. This method analyzes and models the manifestations of various network attacks in the data plane, generating a set of multi-method heterogeneous defense strategies for each type of attack, achieving policy flexibility. Finally, it utilizes an MRV knowledge base and intelligent voting based on boundary resources to select strategies, enabling policy implementation under simulated conditions. This invention aims to proactively defend against six types of network attacks: VLAN hopping attacks, spanning tree attacks, MAC table flooding attacks, ARP spoofing attacks, UDP flooding attacks, and MAC spoofing attacks. Based on the severity of the current network state under attack, a hierarchical defense mechanism is introduced, implementing a combination of four defense strategies: cleaning, isolation, asset migration, and system transition.

Description

Technical Field

[0001] The invention belongs to the technical field of network attack and defense, and in particular relates to a method for issuing heterogeneous redundant defense strategies of an intrinsic security switch. Background Art

[0002] As the "gate" for network information flow, the security of switches is an important part of network security construction. With the development of the network information age, the network information industry has gradually occupied an increasingly important position. The frequency of attacks on network switches has increased, and the types of attacks have also increased, such as MAC table flooding attacks, ARP spoofing attacks, spanning tree loop attacks, etc. Traditional Ethernet switches often use passive defense methods such as adding firewalls and port binding, which cannot cope with a wide variety of network attacks, especially when attackers use unknown vulnerabilities and unknown backdoors of switches to attack, making traditional prevention measures ineffective and posing a major threat to network information security.

[0003] In view of the inherent defects of passive defense, Academician Wu Jiangxing proposed an active defense method, namely, mimicry defense (intrinsic security) technology, whose core adopts a dynamic heterogeneous redundant system mechanism, which can not only effectively prevent a variety of known network attacks, but also defend against external network attacks that exploit unknown vulnerabilities and unknown backdoors. As an active defense technology, mimicry defense technology has strong anti-attack capabilities, allowing the switch platform to have good network attack defense capabilities even when it is "toxic and bacterial" to a certain extent.

[0004] The dynamic heterogeneous redundancy mechanism is the core of the mimetic defense technology. The mechanism has three characteristics, namely, dynamics, heterogeneity, and redundancy. Dynamics means that whenever a network attack occurs, the policy scheduling module will select different policy solutions from the heterogeneous executor pool to prevent attackers from penetrating the internal defense architecture of the switch; heterogeneity means that there will be differences between executors with the same function, such as different systems, different protocols, or different programming languages; redundancy means that for the same attack, multiple executors can play a defensive role, and there are multiple alternatives for the same threat situation. It can be seen that the dynamic heterogeneous redundancy mechanism benefits from the introduction of dynamics, randomness, and diversity in terms of uncertainty mechanism, and benefits from the dilemma of coordinated attack under non-cooperative conditions created by the "de-cooperative environment" in terms of attack difficulty. In terms of implementation method, it comes from the application of multi-dimensional dynamic reconstruction mechanism under functional equivalence conditions. Summary of the invention

[0005] In view of the above problems, the present invention proposes a method for issuing heterogeneous redundant defense strategies for an intrinsically secure switch, which effectively defends against various attacks directed at or passing through network switches based on a dynamic heterogeneous redundant mechanism and the collected network information and software and hardware resource data.

[0006] To achieve the purpose of the present invention, the technical solution adopted by the present invention is a method for issuing heterogeneous redundant defense strategies for an intrinsically secure switch.

[0007] The present invention intends to measure the endogenous switch's own state information and link state information. The required measurements are: the switch's memory usage, CPU usage, link delay, link bandwidth, and link packet loss rate. Different weights are assigned to the above measurements, normalized and quantified, and then a grading mechanism is introduced to intelligently select defense strategies based on the severity of the threat situation.

[0008] A method for issuing heterogeneous redundant defense strategies for an endogenous security switch, the method mainly comprising the following steps:

[0009] (1) Collect and measure the link status information of the path endogenous security switch and the switch status information, manage the switch and link status data to build a network resource view;

[0010] (2) Generate threat intelligence and classify responses based on the network resource view. Different levels of responses will activate different types of defense methods to control the resource consumption of the switch and maintain the normal operation of the current network to the greatest extent possible;

[0011] The first type: Based on the current threat intelligence, if there is a threat to the resources at the switch network layer, a level 3 response is initiated, and the intrinsically secure switch will take an isolation solution for the current attack;

[0012] The second type: depending on the current threat intelligence, if the hard disk or internal data is tampered with, the secondary response is initiated, and the endogenous security switch will take a cleaning solution for the current attack;

[0013] The third type: Depending on the current threat intelligence, if there is a fight for control of the switch, a level 1 response will be initiated, and the intrinsically secure switch will take asset migration or system jump measures for the current attack.

[0014] In the step (1), the method for collecting switch status information and link information to construct a network resource view is as follows:

[0015] (1.1) The switch measures its own status information in real time, including the switch CPU usage, memory usage, and switch IP address;

[0016] (1.2) The switch measures link status information, including link delay, link bandwidth, and link packet loss rate. The measurement method is to use ICMP protocol message raw socket to construct a fixed-size detection packet and send it to the target node at the other end of the link. The link bandwidth, RTT, and packet loss rate are obtained through the returned data.

[0017] (1.3) Based on the collected and measured status information and network resource information, initially construct a network resource view, as Figure 2 shown.

[0018] In the above step (2), the design scheme of the response grading mechanism is as follows:

[0019] (2.1) The endogeneous security switch generates threat intelligence based on the current network resource view and determines whether a network attack has occurred;

[0020] (2.2) The switch performs normalization and quantization based on the generated threat intelligence;

[0021] (2.3) Classify the quantized threat intelligence data according to the severity of the threat situation. If the threat level is extremely high, it can be classified as level one.

[0022] Among them, in step (2.2), for the five-tuple of threat intelligence: the CPU usage rate C, memory occupancy rate M, link bandwidth B, link delay L, and packet loss rate P of the switch, according to the formula:

[0023]

[0024] Obtain the normalized data: C′, M′, B′, L′, P′. Assign different weights to them, which are K1, K2, K3, K4, K5 respectively, and:

[0025] K1 + K2 + K3 + K4 + K5 = 1

[0026] The threat intelligence data S after normalization and quantization can be expressed as:

[0027] S = C′K1 + M′K2 + B′K3 + L′K4 + P′K5

[0028] In step (2.3), it is planned to set two-level thresholds for the threat intelligence data S: S1, S2. When S ≥ S1, it is classified as a level one response, indicating that the current attack is a struggle for control of the switch and strong measures need to be taken for protection; when S2 ≤ S < S1, it is classified as a level two response, indicating that the current attack tampers with the hard disk and internal data, and the defense strategy adopted at this time needs to take into account the resource overhead; when S < S2, it means that the current attack threatens the resources of the switch network layer, and it is not appropriate to adopt a defense strategy with a large overhead.

[0029] At the same time, it should be noted that the purpose of the grading response mechanism is to reasonably control the overhead cost brought by the defense. The switch should dynamically select other levels of defense strategies for supplementation according to the situation. After obtaining multiple output vectors, the output result is judged according to the voting mechanism.

[0030] In the first type, the specific process of the isolation mechanism is as follows:

[0031] In response to VLAN trunk attacks, network switches can be set up for security, that is, all trunk ports of network switches need to use VLAN IDs. If the switch receives a DTP negotiation message without a port assignment, it will consider the message illegal, and the isolation mechanism will block the source IP address of the message to prevent the trunk from being established. In response to spanning tree spoofing attacks, the attacker sends a BridgeID smaller than the current root switch to declare himself as the root bridge and seize the role of the root switch. The isolation mechanism will isolate the port that receives the forged BPDU, and the port will not forward any traffic, thereby forcibly establishing the position of the root bridge in the network. In response to MAC table flooding attacks, the isolation strategy limits the upper limit of the number of MACs that the switch port can learn, and the number of MACs that exceed this limit will be discarded. In response to ARP spoofing attacks, the switch can reserve DHCP. The MAC address of each computer on the network can be detected when the forged ARP data packet is sent, and the isolation strategy is to block the IP; for UDP flooding attacks, for IP addresses that repeatedly send more than 1500 bytes, the isolation strategy can block such IP addresses based on the information provided by threat intelligence, such as the reputation value of the IP, and can filter out messages with obviously abnormal TTL values ​​through the normal range of the TTL value in the message; for MAC spoofing attacks, the isolation strategy is also based on the information provided by threat intelligence. For example, the switch can check whether the source IP and source MAC in the IP message are consistent with those set by the administrator in the switch. If they are inconsistent, such IP addresses will be blocked and an alarm message will be sent.

[0032] In the second type, the specific process of the cleaning mechanism is as follows:

[0033] The invention uses a method for identifying threat traffic based on IP reputation value, assigning a certain reputation value to IP addresses on the Internet. Some IP addresses that are regarded as zombie hosts and generate malicious attack behaviors will be assigned lower reputation values. These low-reputation IPs may become the source of network attacks. In the process of traffic cleaning, traffic sent by IP addresses with low reputation is cleaned first. The specific process is to transfer all traffic through HPENP to the cloud computing center, use the information provided by threat intelligence, and use more complex machine learning methods to classify threat traffic. After clearly finding the threat traffic five-tuple, the threat traffic is discarded, and the remaining traffic is forwarded back to the switch to complete the cleaning process.

[0034] In the third type, the specific process of proposing two defense strategies is as follows:

[0035] Asset migration is to first perform redundant backup on the intrinsic security switch, dynamically transfer the attack surface, and directly migrate system resources to another switch when threatened. The specific operation is that the host establishes a routing backup. When it is detected that the current switch is under serious attack and cannot work normally, the backup switch IP in the routing table is used to connect to the redundant switch; system hopping is to enable the hopping protocol, and start to randomly change the ports, addresses, and time slots of various adjacent points of data transmission according to the protocol to achieve active network protection. The specific operation is that in a fixed hopping interval, the intrinsic security switch will use a pseudo-random function to generate a new IP address and communication port based on the key, source ID, switch ID and time shared with the communication host, so that in different time slots, the communicating parties will definitely use different IP and port pairs to resist network attacks.

[0036] Compared with the prior art, the technical solution of the present invention has the following beneficial technical effects:

[0037] (1) The present invention can address the inherent defects of passive defense of network switches and design an intrinsically secure switch with active defense function, thereby overcoming the defense defects of previous switches and having important practical significance.

[0038] (2) The present invention proposes a method for issuing dynamic heterogeneous redundant defense strategies with intrinsic security properties. The intrinsic security switch can dynamically adopt different sets of defense strategies for each network attack, presenting the uncertainty of the internal defense mechanism to the outside world, greatly increasing the attacker's overhead of reconnaissance and attack implementation.

[0039] (3) At the same time, the endogenous security switch proposed in the present invention introduces a hierarchical response mechanism, which completes the hierarchical distribution of defense strategies according to the severity of the attack based on the information provided by the threat intelligence, thereby greatly saving its own resource expenditure and cost. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] Figure 1 Schematic diagram of defense decision voting for heterogeneous redundancy;

[0041] Figure 2 It is a schematic diagram of a network resource view;

[0042] Figure 3 This is the architecture diagram of the intrinsic security switch;

[0043] Figure 4 This is a schematic diagram of a VLAN trunk attack;

[0044] Figure 5 Schematic diagram of the experimental topology. DETAILED DESCRIPTION

[0045] In order to deepen the recognition and understanding of the present invention, the technical solution is further introduced below in conjunction with the accompanying drawings and implementation methods.

[0046] Example 1: See Figure 1-Figure 5 , a method for issuing heterogeneous redundant defense strategies for an endogenous security switch, the method mainly comprising the following steps:

[0047] (1) Collect and measure the link status information of the path endogenous security switch and the switch status information, manage the switch and link status data to build a network resource view;

[0048] (2) Generate threat intelligence and classify responses based on the network resource view. Different levels of responses will activate different types of defense methods to control the resource consumption of the switch and maintain the normal operation of the current network to the greatest extent possible;

[0049] The first type: Based on the current threat intelligence, if there is a threat to the resources at the switch network layer, a level 3 response is initiated, and the intrinsically secure switch will take an isolation solution for the current attack;

[0050] The second type: depending on the current threat intelligence, if the hard disk or internal data is tampered with, the secondary response is initiated, and the endogenous security switch will take a cleaning solution for the current attack;

[0051] The third type: Depending on the current threat intelligence, if there is a fight for control of the switch, a level 1 response will be initiated, and the intrinsically secure switch will take asset migration or system jump measures for the current attack.

[0052] In the step (1), the method for collecting switch status information and link information to construct a network resource view is as follows:

[0053] (1.1) The switch measures its own status information in real time, including the switch CPU usage, memory usage, and switch IP address;

[0054] (1.2) The switch measures link status information, including link delay, link bandwidth, and link packet loss rate. The measurement method is to use ICMP protocol message raw socket to construct a fixed-size detection packet and send it to the target node at the other end of the link. The link bandwidth, RTT, and packet loss rate are obtained through the returned data.

[0055] (1.3) Based on the collected and measured status information and network resource information, a preliminary network resource view is constructed, such as Figure 2 shown.

[0056] In step (2), the design scheme of the response classification mechanism is as follows:

[0057] (2.1) The endogenous security switch generates threat intelligence based on the current network resource view and determines whether a network attack has occurred;

[0058] (2.2) The switch normalizes and quantifies the generated threat intelligence;

[0059] (2.3) Classify the quantified threat intelligence data according to the severity of the threat situation. If the threat level is extremely high, it can be classified as level one.

[0060] Among them, in step (2.2), for the five-tuple of threat intelligence: the CPU usage rate C, memory occupancy rate M, link bandwidth B, link delay L, and packet loss rate P of the switch, according to the formula:

[0061]

[0062] Obtain the normalized data: C′, M′, B′, L′, P′. Assign different weights to them, which are K1, K2, K3, K4, K5 respectively, and:

[0063] K1 + K2 + K3 + K4 + K5 = 1

[0064] The threat intelligence data S after normalization and quantification can be expressed as:

[0065] S = C′K1 + M′K2 + B′K3 + L′K4 + P′K5

[0066] In step (2.3), it is planned to set two-level thresholds for the threat intelligence data S: S1, S2. When S ≥ S1, it is defined as a level-one response, indicating that the current attack is competing for control of the switch and strong measures need to be taken for protection; when S2 ≤ S < S1, it is defined as a level-two response, indicating that the current attack is tampering with the hard disk and internal data, and the defense strategy adopted at this time needs to take into account the resource overhead; when S < S2, it means that the current attack poses a threat to the resources of the switch network layer, and a defense strategy with a large overhead is not suitable.

[0067] At the same time, it should be noted that the purpose of the hierarchical response mechanism is to reasonably control the overhead cost brought by the defense. The switch should dynamically select other levels of defense strategies for supplementation according to the situation. After obtaining multiple output vectors, the output results are adjudicated according to the voting mechanism.

[0068] In the first type, the specific process of the isolation mechanism is as follows:

[0069] In response to VLAN trunk attacks, network switches can be set up for security, that is, all trunk ports of network switches need to use VLAN IDs. If the switch receives a DTP negotiation message without a port assignment, it will consider the message illegal, and the isolation mechanism will block the source IP address of the message to prevent the trunk from being established. In response to spanning tree spoofing attacks, the attacker sends a BridgeID smaller than the current root switch to declare himself as the root bridge and seize the role of the root switch. The isolation mechanism will isolate the port that receives the forged BPDU, and the port will not forward any traffic, thereby forcibly establishing the position of the root bridge in the network. In response to MAC table flooding attacks, the isolation strategy limits the upper limit of the number of MACs that the switch port can learn, and the number of MACs that exceed this limit will be discarded. In response to ARP spoofing attacks, the switch can reserve DHCP. The MAC address of each computer on the network can be detected when the forged ARP data packet is sent, and the isolation strategy is to block the IP; for UDP flooding attacks, for IP addresses that repeatedly send more than 1500 bytes, the isolation strategy can block such IP addresses based on the information provided by threat intelligence, such as the reputation value of the IP, and can filter out messages with obviously abnormal TTL values ​​through the normal range of the TTL value in the message; for MAC spoofing attacks, the isolation strategy is also based on the information provided by threat intelligence. For example, the switch can check whether the source IP and source MAC in the IP message are consistent with those set by the administrator in the switch. If they are inconsistent, such IP addresses will be blocked and an alarm message will be sent.

[0070] In the second type, the specific process of the cleaning mechanism is as follows:

[0071] The invention uses a method for identifying threat traffic based on IP reputation value, assigning a certain reputation value to IP addresses on the Internet. Some IP addresses that are regarded as zombie hosts and generate malicious attack behaviors will be assigned lower reputation values. These low-reputation IPs may become the source of network attacks. In the process of traffic cleaning, traffic sent by IP addresses with low reputation is cleaned first. The specific process is to transfer all traffic through HPENP to the cloud computing center, use the information provided by threat intelligence, and use more complex machine learning methods to classify threat traffic. After clearly finding the threat traffic five-tuple, the threat traffic is discarded, and the remaining traffic is forwarded back to the switch to complete the cleaning process.

[0072] The specific processes of the two defense strategies proposed in the third type are as follows:

[0073] Asset migration is to first perform redundant backup on the intrinsic security switch, dynamically transfer the attack surface, and directly migrate system resources to another switch when threatened. The specific operation is that the host establishes a routing backup. When it is detected that the current switch is under serious attack and cannot work normally, the backup switch IP in the routing table is used to connect to the redundant switch; system hopping is to enable the hopping protocol, and start to randomly change the ports, addresses, and time slots of various adjacent points of data transmission according to the protocol to achieve active network protection. The specific operation is that in a fixed hopping interval, the intrinsic security switch will use a pseudo-random function to generate a new IP address and communication port based on the key, source ID, switch ID and time shared with the communication host, so that in different time slots, the communicating parties will definitely use different IP and port pairs to resist network attacks.

[0074] like Figure 1 The figure shows a schematic diagram of defense decision voting for heterogeneous redundancy. The multi-mode elastic intelligent decision module mainly makes decisions on the output of heterogeneous executors by comparison based on the decision strategy, judges the state of the executor based on the comparison result, and reports the state information to the scheduling control module, and delivers the decision result to the agent module, which is output by the agent. The mimetic decision mechanism uses the perception ability of abnormal situations composed of factor perception and situation understanding to make consistency judgments on the output results of heterogeneous executors, which can effectively avoid non-cooperative attacks or random failures on the mimetic interface. According to the decision result, the feedback controller can reconstruct the executor service set according to the given strategy.

[0075] Generally speaking, any interface with standardized or normalizable functions or operations has the basic conditions for implementing mimicry defense. Because there are at least time differences, value range differences (calculation accuracy) or allowed version differences (syntax, options, default values, and extended domain filling) between the output vectors of the diverse redundant defense executors within the boundary. Different application scenarios, different performance requirements, and security standards have a great impact on the complexity of issuing elastic intelligent defense decision instructions.

[0076] Functionally equivalent defense strategies selected by endogenous security switches. Under the same input stimulus specification, it is highly likely that the multi-mode output vectors of heterogeneous executors have most of the same or completely consistent conditions. However, due to differences in the pre-processing methods, implementation algorithms, support environments, and even processing platforms (FPGA or CPU delivery) between heterogeneous executors, there will inevitably be differences in output responses. In order not to affect the multi-mode decision of the output vector, vector normalization processing and output proxy functions need to be added before the decision to ensure that the mimetic brackets can not only shield all differences in the defense scenario to the outside as much as possible, but also allow certain differences between executors internally. For endogenous security switches, the available normalization means are strongly related to specific application scenarios. In the situation awareness stage, the endogenous security switch has mastered the multi-dimensional resource view of the network. Combining the view with the current switch resource status, the controller is designed to normalize and analyze the network status. Combined with the threat intelligence classification obtained from the situation understanding, the required defense strategy is intelligently selected, and hot deployment is performed without interfering with the business as much as possible to ensure the efficiency of the switch.

[0077] The present invention intends to subdivide the strategies into cleaning, isolation, asset migration and system jump. Although the cleaning operation is accurate, it consumes network resources, while the isolation method is relatively rough and does not occupy bandwidth, but it is easy to discard normal traffic. The asset migration strategy and the system jump strategy are highly resistant to attacks and are proactive, allowing the platform to survive with bacteria, but the overhead is too large, and even hot deployment cannot be achieved, which may temporarily interrupt the switch service. The four strategies have their own advantages and disadvantages, and it is necessary to intelligently select the defense strategy according to the severity of the current attack on the intrinsic security switch. The present invention intends to defend against the following 6 types of network attacks:

[0078] (1) VLAN relay attack: VLAN relay attack is a deception type attack. The attack process is as follows: Figure 4 As shown in the figure, the attacker pretends to be another switch and sends a false DTP negotiation message to the switch in a specific VLAN, announcing that he wants to become a relay. After the attacked switch receives the DTP message, if the relay function is enabled, all information flows through the VLAN will be sent to the attacker's computer.

[0079] (2) Spanning Tree Attack: Spanning Tree Protocol (STP) is a communication protocol that works at the data link layer in the OSI network model. Its basic application is to prevent loops caused by redundant links in switches, thereby avoiding broadcast storms that occupy a large number of switch resources. Spanning Tree Attack is a deception attack, which means that the attacker can send a carefully designed Bridge Protocol Data Unit (BPDU) to the switch to deceive the switch into thinking it is the root bridge, which will cause STP to reconverge. Since the STP protocol converges slowly, loops will be generated within a certain period of time, causing the network to collapse.

[0080] (3) MAC table flood attack: When a frame enters the switch, the source MAC address is recorded, and a record is generated that associates this MAC address with the port that the frame enters. In the future, information flows to this MAC address will only be sent out through this port. This record is stored in the content addressable memory (CAM) so that it can be quickly queried when forwarding data. A MAC table flood attack refers to an attacker taking advantage of the limited memory capacity of the CAM to send a large number of data packets with forged multiple source MAC addresses to the CAM, causing the CAM to be full. Subsequent data packets will cause the switch to send data in a broadcast mode, and the switch bandwidth will be quickly filled, causing the switch to deny service.

[0081] (4) ARP attack The Address Resolution Protocol (ARP) first resolves the target machine's IP address into a unique MAC address, then ARP automatically searches for the IP-to-MAC resolution and sends the request in the form of a broadcast, so that all hosts can receive the message information. An ARP attack is when the attacker uses a deceptive method to connect to the target host and communicate, resulting in a large number of abnormal messages on the target host, causing the network switch to paralyze.

[0082] (5) UDP flood attack: UDP protocol (User Datagram Protocol) is a connectionless protocol that provides a method for applications to send encapsulated IP data packets without establishing a connection. UDP flood attack is a DDOS-type attack, which has two types: small packet attack and large packet attack. Small packet attack refers to the attacker sending a large number of small UDP packets with forged source IP addresses to the target of attack, generally 64 bytes. In this way, under the same traffic conditions, the number of data packets increases, the inspection overhead increases, and finally the bandwidth resources of the target of attack are exhausted; large packet attack refers to the attacker sending a large number of large UDP packets with forged source IP addresses, generally larger than 1500 bytes. Due to the high pressure of fragmentation and reassembly of large data packets, bandwidth resources will be quickly exhausted.

[0083] (6) MAC spoofing attack: MAC address spoofing is often used to break through LAN access control based on MAC addresses. For example, by limiting the forwarding source MAC address on the switch to a MAC address that exists in the access list, the access restriction can be broken. Moreover, this modification is dynamic and easy to recover. Another access control method binds the IP address and MAC address so that a switch port can only be provided to one host of one user. In this case, the attacker needs to modify his IP address and MAC address at the same time to break through this restriction.

[0084] For the above six different types of network attacks, the intrinsic security switch can basically adopt cleaning, isolation, system jump or asset migration strategies. The present invention will determine what defense strategy to adopt when suffering a network attack through a hierarchical mechanism to minimize the resource overhead of the switch to maintain normal operation. To this end, the intrinsic security switch will construct a network resource view.

[0085] The above is an introduction to the theoretical system of intrinsic security switches. The following three experimental schemes are designed to verify the effectiveness of the intrinsic security switch defense strategy.

[0086] Experiment 1: Single attack and single defense test

[0087] Purpose:

[0088] Verify the effectiveness of four defense strategies

[0089] Experimental steps:

[0090] 1. Start the server, establish a Docker network, and experiment with topology as follows Figure 5 As shown. Attack nodes and defense nodes are deployed in the Docker network. The attack node consists of six containers, each of which can launch an attack method; the defense node consists of two containers, one of which is used as a redundant backup, and the other is the main target of attack. The container has functions such as isolation, traffic forwarding, and system jump.

[0091] 2. Randomly select one of the above six attacks and use one of the above four defense strategies to conduct an attack and defense experiment

[0092] 3. Select attack type and defense type without repetition and conduct multiple experiments.

[0093] Experiment 2: Single attack and multiple defense tests

[0094] Purpose:

[0095] Verify the effect of combining dynamic heterogeneous redundancy mechanism with defense strategy

[0096] Experimental steps:

[0097] 1. Start the created Docker network

[0098] 2. Randomly select one of the above six attacks, and the defense node selects a defense strategy set according to the hierarchical response mechanism and dynamic selection strategy to defend. The resource consumption and defense effect of the defense node are compared with those in Experiment 1.

[0099] 3. Choose attack types without duplication and conduct multiple experiments.

[0100] Experiment 3: Multiple Attack and Multiple Defense Tests

[0101] Purpose:

[0102] Test the overall defense performance of the built-in security switch

[0103] Experimental steps:

[0104] 1. Start the created Docker network

[0105] 2. Randomly select multiple attack types to attack the defense node. The defense node selects a defense strategy set for defense based on the hierarchical response mechanism and dynamic selection strategy.

[0106] 3. Compare the resource consumption and defense effect of the defense node with those of Experiments 1 and 2.

Claims

1. A method for issuing heterogeneous redundant defense strategies for an endogenous security switch, characterized in that: The method comprises the following steps: (1) Collect and measure network traffic passing through the endogenous security switch, manage the initial state data of the switch and link to build a network resource view; (2) Responses are graded based on threat intelligence. Different levels of responses will trigger different types of defense methods to control switch resource overhead and maintain the normal operation of the current network to the greatest extent possible. The first type: Based on the current threat intelligence, if there is a threat to the resources at the switch network layer, a level 3 response is initiated, and the intrinsically secure switch will adopt an isolation strategy for the current attack; The second type: depending on the current threat intelligence, if the hard disk or internal data is tampered with, the secondary response is initiated, and the endogenous security switch will adopt a cleaning strategy for the current attack; The third type: Based on the current threat intelligence, if there is a contention for control over the switch, a first-level response is initiated, and the intrinsically secure switch will adopt asset migration or system jump strategies for the current attack; The design method in step (2) is as follows: (2.1) The endogenous security switch generates threat intelligence based on the current network resource view to determine whether it has been attacked by a network; (2.2) The switch performs normalization and quantification based on the generated threat intelligence; the threat intelligence quintuple includes the switch’s CPU usage C, memory usage M, link bandwidth B, link delay L, and link packet loss rate P; (2.3) The quantified threat intelligence data is classified into levels, with the extremely high threat level being level one, and the levels being graded based on the severity of the threat situation.

2. The method for issuing heterogeneous redundant defense strategies for an intrinsically secure switch according to claim 1, characterized in that: In step (2.2), for the threat intelligence quintuple, according to the normalization formula: Where x represents the original data, min is the minimum value of the original data set, max is the maximum value of the original data set, x' is the normalized data, and the normalized data are: C', M', B', L', P', and different weight coefficients are assigned to them, namely K1, K2, K3, K4, K5, and: K1+K2+K3+K4+K5=1; The normalized and quantified threat intelligence data S is expressed as: S=C'K1+M'K2+B'K3+L'K4+P'K5.

3. The method for issuing heterogeneous redundant defense strategies for an intrinsically secure switch according to claim 1, characterized in that: The specific method of step (1) is as follows: (1.1) The switch measures its own status information, including CPU usage and memory usage; (1.2) The switch collects link status information, including link delay, link bandwidth, and link packet loss rate; (1.3) Construct a network resource view based on the collected and measured status information and network resource information.

4. The method for issuing heterogeneous redundant defense strategies for an intrinsically secure switch according to claim 1, characterized in that: In step (2.3), two levels of thresholds are to be set for the threat intelligence data S: S1 and S2. When S ≥ S1, it is defined as a first-level response, indicating that the current attack is vying for control of the switch, and strong measures need to be taken for protection. When S2 ≤ S < S1, it is defined as a second-level response, indicating that the current attack is tampering with the hard disk and internal data. At this time, the defense strategy adopted needs to take into account the resource overhead. When S < S2, it means that the current attack poses a threat to the resources of the switch network layer, and a defense strategy with a large overhead should not be adopted.

5. The method for distributing a heterogeneous redundancy defense strategy of an endogenously secure switch according to claim 1, wherein The specific method of the first type is as follows: After the endogenously secure switch starts a three-level response, the isolation method is to directly block the IP address of the threat traffic within a time slice inside the switch, and briefly trace back according to the situation information number corresponding to the threat intelligence to determine the threat IP.

6. The method for distributing a heterogeneous redundancy defense strategy of an endogenously secure switch according to claim 1, wherein The specific method of the second type is as follows: Transfer all the traffic in the endogenously secure switch to the cloud computing center through HPENP; according to the information provided by the threat intelligence, use machine learning methods to classify the threat traffic, and after clearly finding the threat intelligence five-tuple, discard the threat traffic; forward the remaining traffic back to the switch to complete the cleaning process.

7. The specific steps of the method for distributing a heterogeneous redundancy defense strategy of an endogenously secure switch according to claim 1 are as follows: After the endogenously secure switch starts a first-level response, the asset migration strategy will perform redundant backup for the endogenously secure switch, dynamically transfer the attack surface, and directly migrate the system resources into another switch when under a threat attack; system jump is to enable the jump protocol and start randomly changing ports, addresses, and time slots for various adjacent points of data transmission according to the protocol to achieve active network protection.

Images