Key node hidden topology information confusion method and device and computer equipment

Abstract

This application relates to a method, apparatus, and computer device for obfuscating topology information by hiding key nodes. It involves using a topology measurement method typically employed by attackers to infer the topology of the real network to be protected, obtaining a predicted topology. Key nodes in this predicted topology are then identified and hidden to obtain a false obfuscated topology, along with a corresponding false shared link matrix. This false shared link matrix is ​​input into a delay strategy model to obtain the optimal false link delay vector. Based on the false shared link matrix and the link delay vector, false path delay vectors of the obfuscated topology are derived. Finally, a delay strategy is obtained based on the false path delay vectors and the delay vectors of each path in the real network. Nodes in the real network are then arranged according to this delay strategy, ensuring that the topology inferred by measuring the correlation delays of different receiver pairs in the real network is a false obfuscated topology. This method can hide key nodes and links in a network.

Description

Technical Field

[0001] This application relates to the field of network security technology, and in particular to a method, apparatus, and computer device for obfuscating topology information by hiding key nodes. Background Technology

[0002] Network topology information helps attackers identify network bottlenecks and target them as primary attack targets. Therefore, attackers often use network tomography or traceroute methods to probe the network topology before launching an attack. As an end-to-end measurement method, the former is more flexible and harder to distinguish than the latter, making it more difficult for network operators to identify. As a countermeasure, network operators aim to obfuscate the topology to deliberately expose a pre-designed false topology to attackers. However, existing topology obfuscation designs for countering tomography-based topology inference only protect tree-like topologies and cannot guarantee the hiding of bottleneck nodes and links. Summary of the Invention

[0003] Therefore, it is necessary to provide a topology information obfuscation method, apparatus, and computer equipment that can hide bottleneck nodes, i.e., key nodes, in the network structure to address the above-mentioned technical problems.

[0004] A method for obfuscating topological information hidden in key nodes, the method comprising:

[0005] Obtain the real network to be protected;

[0006] The time delay vector of each path in the real network is measured using a tomographic imaging method, and its topology is estimated to obtain the inferred topology of the real network.

[0007] Based on a preset security threshold, key nodes in the inferred topology are identified. By constructing multiple virtual nodes to hide the key nodes, a false and obfuscated topology is obtained.

[0008] Based on the aforementioned false confusion topology, a false shared link matrix is ​​constructed, and the false shared link matrix is ​​input into the delay strategy model to obtain the optimal false link delay vector;

[0009] The false path delay vector of the false confusion topology is obtained based on the false shared link matrix and the link delay vector.

[0010] A delay strategy is obtained based on the delay vector of the false path and the delay vector of each path in the real network. The nodes in the real network are arranged according to the delay strategy, so that the topology inferred by measuring the relevant delay of different receiver pairs in the real network is the false confusion topology.

[0011] In one embodiment, the step of measuring the time delay vector of each path in the real network using a tomographic imaging method and estimating its topology to obtain the inferred topology of the real network includes:

[0012] The tomography-based imaging method sends probe traffic to each receiver of the real network and constructs a preliminary inference of the topology based on the nodes and links through which the probe traffic flows.

[0013] After deleting non-branch points in the preliminary inferred topology, the inferred topology is obtained.

[0014] In one embodiment, identifying key nodes in the inferred topology based on a preset security threshold includes:

[0015] Calculate the degree of each node in the inferred topology. If the degree is greater than the security threshold, the corresponding node is a critical node.

[0016] In one embodiment, the step of hiding the key node by constructing multiple virtual nodes to obtain a false obfuscated topology includes:

[0017] Based on the degree of the key node, a corresponding number of related virtual nodes are constructed, and multiple related virtual nodes and corresponding key points are arranged in a ring around each other, with each node connected by a dummy link.

[0018] Remove the links connected to the key points, and reconnect the nodes at the other end of each removed link to the corresponding virtual nodes through fake links;

[0019] By using fake nodes and fake links to hide all the key nodes in the inferred topology, a fake obfuscated topology is obtained.

[0020] In one embodiment, the delay strategy model is constructed based on the relationship between spoofed link delay, spoofed shared link matrix, and spoofed shared link delay.

[0021] In one embodiment, when solving the delay strategy model, the constraints are that the end-to-end real delay in the fake scrambling topology is greater than or equal to the end-to-end real delay in the real network structure, the delay of each fake link is less than the corresponding threshold, and the difference between the end-to-end total delay in the fake scrambling topology and the real network structure is minimized.

[0022] In one embodiment, a solver is used to solve the delay strategy model.

[0023] In one embodiment, the method for obfuscating the topology information of key nodes is used to counter network attacks based on tomographic topology inference.

[0024] A topology information obfuscation device for hiding key nodes, the device comprising:

[0025] The real network acquisition module is used to acquire the real network to be protected;

[0026] The inferred topology estimation module is used to measure the time delay vector of each path in the real network using a tomographic imaging method, and to estimate its topology to obtain the inferred topology of the real network.

[0027] The module for obtaining a false obfuscated topology is used to identify key nodes in the inferred topology based on a preset security threshold. By constructing multiple virtual nodes to hide the key nodes, a false obfuscated topology is obtained.

[0028] The fake link delay vector solving module is used to construct a fake shared link matrix based on the fake confusion topology, and input the fake shared link matrix into the delay strategy model to obtain the optimal fake link delay vector;

[0029] The fake path delay vector acquisition module is used to obtain the fake path delay vector of the fake scrambling topology based on the fake shared link matrix and the link delay vector;

[0030] The topology information obfuscation module is used to obtain a delay strategy based on the false path delay vector and the delay vector of each path in the real network, and to arrange the nodes in the real network according to the delay strategy, so that the topology inferred by measuring the relevant delay of different receiver pairs in the real network is the false obfuscated topology.

[0031] A computer device includes a memory and a processor, the memory storing a computer program, and the processor executing the computer program performing the following steps:

[0032] Obtain the real network to be protected;

[0033] The time delay vector of each path in the real network is measured using a tomographic imaging method, and its topology is estimated to obtain the inferred topology of the real network.

[0034] Based on a preset security threshold, key nodes in the inferred topology are identified. By constructing multiple virtual nodes to hide the key nodes, a false and obfuscated topology is obtained.

[0035] Based on the aforementioned false confusion topology, a false shared link matrix is ​​constructed, and the false shared link matrix is ​​input into the delay strategy model to obtain the optimal false link delay vector;

[0036] The false path delay vector of the false confusion topology is obtained based on the false shared link matrix and the link delay vector.

[0037] A delay strategy is obtained based on the delay vector of the false path and the delay vector of each path in the real network. The nodes in the real network are arranged according to the delay strategy, so that the topology inferred by measuring the relevant delay of different receiver pairs in the real network is the false confusion topology.

[0038] A computer-readable storage medium having a computer program stored thereon, the computer program performing the following steps when executed by a processor:

[0039] Obtain the real network to be protected;

[0040] The time delay vector of each path in the real network is measured using a tomographic imaging method, and its topology is estimated to obtain the inferred topology of the real network.

[0041] Based on a preset security threshold, key nodes in the inferred topology are identified. By constructing multiple virtual nodes to hide the key nodes, a false and obfuscated topology is obtained.

[0042] Based on the aforementioned false confusion topology, a false shared link matrix is ​​constructed, and the false shared link matrix is ​​input into the delay strategy model to obtain the optimal false link delay vector;

[0043] The false path delay vector of the false confusion topology is obtained based on the false shared link matrix and the link delay vector.

[0044] A delay strategy is obtained based on the delay vector of the false path and the delay vector of each path in the real network. The nodes in the real network are arranged according to the delay strategy, so that the topology inferred by measuring the relevant delay of different receiver pairs in the real network is the false confusion topology.

[0045] The aforementioned method, apparatus, and computer equipment for obfuscating topology information by hiding key nodes work by using topology measurement methods employed by attackers to infer the topology of the real network to be protected. This yields the attacker's inferred topology. Key nodes within this inferred topology are then identified and hidden to obtain a false obfuscated topology. A false shared link matrix is ​​constructed based on this false obfuscated topology. This matrix is ​​then input into a delay policy model to obtain the optimal false link delay vector. Finally, based on the false shared link matrix and the link delay vector, the false path delay vector of the obfuscated topology is derived.

[0046] Finally, a delay strategy is derived based on the delay vectors of the spurious paths and the delay vectors of each path in the real network. Nodes in the real network are then arranged according to this strategy, ensuring that the topology inferred by measuring the correlation delays of different receiver pairs in the real network is the spurious obfuscated topology. This method can hide critical nodes and links in the network. Attached Figure Description

[0047] Figure 1 This is a schematic diagram illustrating the effect of topology obfuscation on altering an attacker's attack motivation in one embodiment.

[0048] Figure 2 This is a flowchart illustrating a method for obfuscating topological information of key nodes in one embodiment.

[0049] Figure 3 This is a schematic diagram illustrating how an attacker uses sandwich probes to measure the relevant latency of a target network and infers its topology when the target network is unprotected or has deployed a topology obfuscation method, in one embodiment.

[0050] Figure 4 In one embodiment, the attacker merges multiple probe trees with different senders as root nodes into a complete probe topology, and identifies bottleneck nodes and link diagrams based on degree centrality and edge connectivity respectively.

[0051] Figure 5 This is a schematic diagram illustrating the method steps and overall workflow of this paper in one embodiment;

[0052] Figure 6 This is a flowchart illustrating the attack view extraction algorithm in one embodiment;

[0053] Figure 7 This is a flowchart illustrating a method for generating a false topology in one embodiment;

[0054] Figure 8 This is a schematic diagram illustrating the construction of a false shared link matrix in one embodiment;

[0055] Figure 9 This is a structural block diagram of a topology information obfuscation device for hiding key nodes in one embodiment;

[0056] Figure 10 This is an internal structural diagram of a computer device in one embodiment. Detailed Implementation

[0057] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0058] Network topology information plays a crucial role in ensuring the normal operation of networks because it helps network operators diagnose network faults. However, once network topology information is leaked, attackers can use it to identify network bottlenecks (which can be understood as critical nodes in the network topology) and launch devastating attacks. Many network attacks rely heavily on network topology information to construct low-cost attack strategies, such as distributed denial-of-service attacks and DNS poisoning. Research shows that when launching a link flooding attack, without knowing the target network's topology, attackers will use more than five times the flow to congest an arbitrary link and several orders of magnitude more flow to congest a specific link. Therefore, attackers often send probing traffic before an attack to collect topology information of the target network and then identify its bottlenecks.

[0059] To this end, attackers utilize traceroute, a standard and widely used link tracing tool, to send probe packets to the target network and infer the topology by synthesizing response packets. However, traceroute probe packets are easily identifiable, and much work has been done on how to counter traceroute-based topology inference, rendering this type of inference ineffective. Instead, tomographic-based topology inference allows attackers to send normal packets from one sender to multiple receivers to measure the performance of each end-to-end routing path reaching those receivers. This type of method does not require responses from internal devices along those paths, making it much more difficult to identify such behavior from large volumes of network traffic and to protect network topology information.

[0060] In fact, the attacker's motivation is directly proportional to the network's vulnerability, and the network's vulnerability is related to network bottlenecks. For example... Figure 1As shown in (a), the discovery of network bottlenecks increases an attacker's desire to launch an attack. However, directly altering the existing network infrastructure to conceal the bottleneck would incur enormous costs and lack scalability and practicality. Therefore, topology obfuscation has been proposed to proactively expose a fictitious topology to attackers without changing the network's physical structure. This proactive countermeasure can reduce an attacker's motivation and may even deter them from launching an attack. Figure 1 As shown in (b), when a topology obfuscation system is deployed on the target network, attackers can only detect the fictitious bottleneck-free topology, not the actual topology. This can significantly increase the attacker's costs, reduce their success rate, and ultimately cause them to abandon the attack.

[0061] To realize the vision of topology obfuscation against network tomography, the following issues need to be addressed: (i) How to develop a general design to hide network bottlenecks in fake topologies? This challenge involves two distinct problems. First, the topology obfuscation method should provide a reasonable solution for general network topologies, not just tree topologies. Second, the generated fake topology must be able to hide network bottlenecks, including bottleneck nodes and bottleneck links. (ii) How to accurately deploy the generated fake topology to the target network at low cost by adding specific perturbations to the attacker's measurements? When deploying fake topologies, the topology obfuscation method should provide a deployment strategy that minimizes network performance degradation without violating network constraints. Furthermore, the topology inferred by the attacker based on erroneous measurements should be identical to the generated fake topology. (iii) How to react immediately to any sudden probing attacks? Due to the sudden nature of attacker probing attacks, the topology obfuscation method needs to provide solutions in a short time when dealing with new probing attacks.

[0062] However, existing topology obfuscation methods cannot adequately address these challenges. To solve the aforementioned problems, in this embodiment, as... Figure 2 As shown, a method for obfuscating topology information to hide key nodes is provided, including the following steps:

[0063] Step S100: Obtain the real network to be protected;

[0064] Step S110: The time delay vector of each path in the real network is measured using a tomographic imaging method, and its topology is estimated to obtain the inferred topology of the real network.

[0065] Step S120: Identify key nodes in the topology based on a preset security threshold, and hide the key nodes by constructing multiple virtual nodes to obtain a false and confusing topology.

[0066] Step S130: Construct a false shared link matrix based on the false confusion topology, and input the false shared link matrix into the delay strategy model to obtain the optimal false link delay vector;

[0067] Step S140: Obtain the false path delay vector of the false spoofed topology based on the false shared link matrix and the link delay vector;

[0068] Step S150: Obtain a delay strategy based on the false path delay vector and the delay vector of each path in the real network. Arrange the nodes in the real network according to the delay strategy so that the topology inferred by measuring the relevant delay of different receiver pairs in the real network is a false confusing topology.

[0069] In this method, in order to counter attackers who use topological reasoning based on tomography to infer the structure of the target network so that they can quickly dismantle the target network after attacking the key nodes, a false topology is constructed to hide the key nodes and related links. Based on this false topology, perturbations are added to the attacker's measurement results to accurately expose the false topology with low overhead.

[0070] Furthermore, this method actually includes three important components. Steps S110 to S120 constitute a fake topology generator, which alleviates network bottlenecks by generating multiple virtual nodes and links, simultaneously addressing problems i and iii, and quickly constructing a fake topology that hides bottleneck nodes and links for the entire network. Next, steps S130 to S140 are for policy deployment, which converts the generated fake topology into an appropriate probe packet interference policy. This interference policy contains complete fake topology information and minimizes the potential negative impact on non-probe packets, thus addressing problem ii. Finally, step S150 is for obfuscation nodes, which configure the interference policy generated by the policy deployer, filter probe packets, and add specific perturbations to the probe packets in the data plane. In this way, attackers will obtain incorrect measurement results, thereby inferring the carefully designed fake topology. This increases the cost of the attack, reduces the success rate of the attack, and significantly reduces the attacker's motivation.

[0071] Before further elaborating on each step of this method, it is necessary to explain the tomographic topology inference method used by attackers as a means of speculating on the target network structure, so that the subsequent description of this method will be clearer.

[0072] Topology inference based on tomography requires the attacker to deploy K probe nodes outside the target network, using a set of... This involves sending probe traffic between probe nodes to obtain end-to-end measurement results. In each round of probing, the attacker designates one probe node as the sender (S) and the other probe nodes as receivers. And it aggregates the paths from the sender to different receivers into a tree-like topology. For example... Figure 3 As shown in the example at the bottom right, the sender S is connected to the root node A, and each receiver is connected to a leaf node of the tree.

[0073] Attackers can send probe packets from the sender to different receivers to obtain end-to-end performance measurement results for different paths.

[0074] In the network attack context targeted by this method, attackers infer the topology of the target network based on latency measurements. This method is more accurate and has wider applications than loss-based methods. Specifically, attackers can use sandwich probes to obtain latency measurements, such as... Figure 3 As shown in the upper right corner, the sandwich probe consists of two small data packets, sp1 and sp2, and one large data packet, lp1. The destination address of sp1 and sp2 is receiver N5, while the destination address of lp1 is receiver N4. After sending sp1, sender N1 waits for a period of time before continuously sending lp1 and sp2, with an initial time interval of d between sp1 and sp2. When they reach intermediate node B, the interval between sp1 and sp2 will become larger because sp2 will be queued after lp1. The interval between sp1 and sp2 increases each time they traverse a common node until they reach the branch node, node N3. When sp2 and lp1 separate at N3, the interval between sp2 and sp1 remains until they reach receiver N5. At this point, their interval becomes d + Δd, where Δd is called the correlation delay. The correlation delay is equal to the sum of the queuing delays on all shared links along the path from sender N1 to receivers N4 and N5.

[0075] Therefore, an attacker can obtain measurements of the relevant delay by sending sandwich probes from sender S to each pair of receivers. Based on these associated delays, attackers can recover probes rooted at sender S by estimating the shared link situation among all forwarding paths of the probe traffic. Specifically, we use the probe triple (S, R...) i ,R j () represents a transmitter S and a pair of receivers R. i and R j The combination of [variables]. Furthermore, we use a binary variable. Indicates whether link l is included from the sender S to the receiver R. i and R j In the shared links between paths. Related latency. It equals the distance from sender S to receiver R. i and R j The sum of the delays of all shared links between the paths.

[0076] According to relevant delays An attacker can recover the probe tree rooted at the sender S using the following formula:

[0077] CD S =SLM S ×D S (1)

[0078] In formula (1), D S It is a column vector representing all internal links. The latency is due to the fact that the endpoints of the internal links are not leaf nodes in the probe tree. It is the shared link matrix of the probe tree with sender S.

[0079] like Figure 3 The above example illustrates how an attacker can infer the probe tree. Without any defensive measures taken by the target network, the attacker can obtain accurate measurements of the relevant latency, where the numbers appended to the links represent the latency on those links. According to formula (1), the attacker estimates the optimal D using Maximum Likelihood Estimation (MLE). S and SLM S Then the probe tree is restored. However, the sandwich probe can only measure the sum of the delays on all shared links, not the specific delay on each shared link. Therefore, the topology inference method based on tomography cannot identify non-branch nodes with fewer than two child nodes. For example, since node B in the target network is a non-branch node, the two nodes B and D in the target network will be restored as node B in the probe tree, and the delay of link (AB) in the probe tree will be equal to the sum of the delays of links (AB) and (BD) in the target network.

[0080] Furthermore, an attacker can select a new probe node as the sender in each round of probing until all probe nodes have been traversed, thus obtaining multiple probe trees with different roots. Using existing algorithms, such as tree merging algorithms, the attacker can aggregate the nodes from different probe trees to obtain a complete probe topology. Then, the attacker can identify and infer bottleneck nodes and links in the topology based on different metrics.

[0081] In this embodiment, bottleneck nodes and links can be identified using degree centrality and edge connectivity.

[0082] Specifically, node degree is a widely used metric for bottleneck nodes. The higher the degree of a node, the more nodes it connects to, and the greater its impact on the network. Therefore, if it fails or is attacked, it will have a more negative impact on the network. Thus, in this paper, degree centrality is defined as follows:

[0083]

[0084] In formula (2), degree(v) i ) represents node v i The degree.

[0085] Specifically, the edges connecting two bottleneck nodes also play a crucial role in maintaining network connectivity. Attackers often target these critical edges, sending more attack traffic to traverse and block them. To quantify this impact, edge connectivity is defined in this paper as follows:

[0086]

[0087] In formula (3), e i,j Indicates the connection node v i and v j The edge.

[0088] like Figure 4 As shown, an attacker can collect multiple probe trees by selecting different probe nodes as senders, where darker nodes represent the root nodes of the probe trees. By merging these probe trees, the attacker can obtain the complete probe topology of the target network. The attacker can then identify bottleneck nodes and links for targeted attacks. For example, a node with 5 degrees under the degree centrality metric is considered a bottleneck node.

[0089] In this method, large data packets of the sandwich probe (such as...) Figure 3 When the lp1 packet enters the target network, it is deliberately delayed. Therefore, the time interval between two small probe packets is artificially increased, thus giving the attacker false correlation delay and allowing them to infer incorrect topology. Figure 3 The lower part of the diagram explains why an attacker might reconstruct an incorrect probe tree based on flawed measurements. If the target network employs topology obfuscation, the attacker may obtain incorrect correlation delay measurements. For example, the correlation delay of the probe triple (S, R1, R4) might be 6 instead of the true value of 0, where the added number represents the active delay. This allows the attacker to estimate incorrect shared link matrices and link delay vectors, thus reconstructing an incorrect probe tree that differs significantly from the target network's.

[0090] However, randomly delaying probe packets does not guarantee obfuscation and may even alert attackers to the target network's defenses, which is undesirable for network operators. Therefore, this method first creates a fake topology that hides bottleneck nodes and links, and then generates an active delay strategy for probe packets based on this fake topology. In this way, attackers will infer the carefully crafted topology from erroneous measurements, which also conforms to topological laws, preventing attackers from detecting interference with the target network.

[0091] It is important to note that this method does not change the network configuration, including network topology and forwarding behavior; it simply delays the probe packets.

[0092] like Figure 5 The main steps and overall workflow of this method are shown in the figure.

[0093] In step S100, after obtaining the target network to be protected, the actual topology and related information of the target network are extracted, including forwarding behavior, security thresholds, etc.

[0094] In step S110, the topology inference method that the attacker would use is used to infer the attack network structure that the attacker would obtain, which is the inferred topology structure of the real network.

[0095] Specifically, a major limitation of network tomography is that attackers cannot precisely identify all nodes in the target network. However, identifying almost all branch nodes traversed by probe traffic is sufficient to pinpoint bottlenecks in the target network. For this reason, this method first determines an attack view of the target network topology that can be perceived by potential attackers. Given the potential locations of attacker probe nodes, the attack view is extracted by determining whether nodes or links in the target network have been traversed by probe traffic and discovered through tomography-based topology inference. Therefore, the attack view only retains nodes and links that can potentially be inferred by the attacker. Attack view extraction helps prune the topology scale, accurately identify critical nodes and links, and avoid redundant computation.

[0096] Furthermore, the time delay vector of each path in the real network is measured using a tomographic imaging method, and its topology is estimated to obtain the inferred topology of the real network. This includes: sending probe traffic to each receiver in the real network using a tomographic imaging method, constructing a preliminary inferred topology based on the nodes and links through which the probe traffic flows, and deleting non-branch points in the preliminary inferred topology to obtain the inferred topology.

[0097] In this embodiment, pseudocode for extracting the inferred topological structure is also proposed, as shown in Algorithm 1:

[0098]

[0099]

[0100] Furthermore, Algorithm 1 outlines the process of the attack view extraction algorithm. Initially, each edge and vertex in the network topology is assigned a binary variable called `flag`, which is initialized to `FALSE` and set to `TRUE` if any probe traffic traverses a vertex or edge (lines 2-4). Then, the attack view is extracted through the following two steps.

[0101] Step 1: Shortest Path Filtering. The first step constructs an initial attack view by removing nodes and links in the target network that probe traffic has not traversed. For any two probe nodes n... i and n j The shortest path between them is considered as the forwarding path of the probe packets, and the flag of each vertex and edge on the path is set to TRUE (lines 6-10). Then, after traversing all the forwarding paths of the probe traffic, the vertices and edges with flag == TRUE form the initial attack view (lines 11-12).

[0102] Step 2: Branch Node Filtering. Since attackers cannot deduce all the nodes the probe traffic passes through, the algorithm further prunes the attack view to make it closer to the topology inferred by the attacker, thus avoiding unnecessary computation. The pruning principle is to remove non-branch nodes with degree 2 from the attack view. The algorithm traverses all nodes in the current attack view; if one of the nodes is a non-branch node, it deletes the node and creates a new edge between its neighbors, with a weight equal to the sum of the original two edges (lines 14-18).

[0103] like Figure 6 The example of Algorithm 1 is shown. Since no probe traffic passes through node D and edge (AD), they are not retained in the attack view after the first step. Next, node B and its connected edges are removed from the attack view because B is a non-branch node. The remaining nodes and edges constitute the final attack view.

[0104] In this embodiment, it is reasonably assumed that the attacker is cost-sensitive. That is, the attacker's motivation is proportional to the vulnerability of critical nodes and links in the target network. Therefore, this method reduces the motivation to attack by exposing a fake topology with higher security. The purpose of generating the fake topology is to hide the critical nodes and links of the target network, making it challenging for the attacker to discover the real network bottlenecks and forcing the attacker to abandon the attack.

[0105] In step S120, identifying key nodes in the speculative topology based on a preset security threshold includes: calculating the degree of each node in the speculative topology; if the degree is greater than the security threshold, the corresponding node is a key node.

[0106] Furthermore, by constructing multiple virtual nodes to hide key nodes, a false obfuscated topology is obtained, which includes: constructing a corresponding number of related virtual nodes based on the degree of the key nodes; forming a ring around the corresponding key points with multiple related virtual nodes, and connecting the two nodes through false links; removing the links connected to the key points; and reconnecting the nodes with the other end of the removed links to the corresponding virtual nodes through false links. By using false nodes and false links to hide all key nodes in the inferred topology, a false obfuscated topology is obtained.

[0107] In this embodiment, pseudocode for generating a fake obfuscated topology is also provided, as shown in Algorithm 2.

[0108]

[0109]

[0110] Since degree centrality and edge connectivity are directly related to node degree, the basic idea of ​​the pseudo-topology generation algorithm is to introduce specific pseudo nodes and pseudo edges into the attack view to alleviate the degree of critical nodes, as shown in Algorithm 2. First, this algorithm uses a security threshold th... d Check each node in the attack view to see if it is a critical node; this security threshold depends on the network operator's input. If node v i degree(v) i (exceeding the threshold) d The algorithm will create num virtual nodes and connect them in a ring around the node v. i Connect them (lines 8-14). The value of num is related to degree(v). i Proportional to, equal to (Line 7). Next, the algorithm will connect v i Some edges are evenly distributed among these virtual nodes to reduce v. i The degree is then hidden (lines 12-16). Specifically, the algorithm iteratively calculates the degree from v each time and hides it. i Select a node v from the neighbors j Delete v i and v j The edges between them are connected to the created virtual nodes until v is reached. i The degree of all created virtual nodes is equal to th. d (Lines 15-20). At this point, node vi The degree also decreased to th d The algorithm then continues to check the next node until the degree of all nodes in the attack view is no higher than th. d Therefore, the maximum edge connectivity in the attack view will not exceed [a certain value]. That is, the distribution of edge connectivity is naturally uniform. In summary, this algorithm achieves the goal of hiding key nodes and edges.

[0111] Furthermore, it was demonstrated that the algorithm can reduce the degree of key nodes in spurious confused topologies to below the degree threshold th. d .

[0112] Specifically, assuming the key node v i The degree is x0 in the attack view, x0>th d This algorithm can create num virtual nodes to share v. i The degree, virtual node and v i They connect to form a loop. Therefore, in the pseudo-topology, v i degree x t equal Then we have:

[0113]

[0114] like Figure 7 As shown, an example of a fake confusing topology generation algorithm is given. Initially, there is a critical node with a degree of 8, and the network operator wants to use the th... d =3 generates a pseudo-topology. Therefore, the algorithm calculates... It creates 7 virtual nodes and forms a ring connection with the key node. Then, it reconnects the neighbors of the key node to these virtual nodes evenly, reducing the maximum node degree in the pseudo-topology to 3. Ultimately, the maximum degree centrality decreases from 0.5 to 0.125, and the maximum edge connectivity decreases from 0.125 to 0.09.

[0115] After generating a fake obfuscated topology, consider how to expose the fake topology to attackers by simply delaying probe packets without modifying network configuration. Since attackers recover the topology by finding the most suitable combination of SLM and D, they need to forge a fake shared link matrix SLM' and a fake link delay vector D' to calculate the specific active delay strategy. This allows attackers to infer the generated fake topology without being aware of the target network's defenses.

[0116] In step S130, to construct a spoofed shared link matrix SLM', a legitimate routing path is first assigned to each probe flow in the spoofed obfuscated topology, and then they are represented as SLM'. However, since only the large data packets of the sandwich probes are actively delayed, the associated latency of all probe triples can only be increased. This limits the ability to arbitrarily change the routing path of any probe traffic.

[0117] For example, such as Figure 3 As shown, the path from sender S to receivers R1 and R2 has a shared link in the target network, resulting in a correlation delay greater than 0 for the probe triple (S, R1, R2). If the routing path of the probe traffic is arbitrarily changed, the forwarding path of this probe triple may not contain any shared links, i.e., the correlation delay is equal to 0. However, since the correlation delay cannot be reduced, it is impossible to find a feasible solution for a delay strategy. Therefore, a valid routing path should be assigned to all probe traffic, rather than arbitrarily.

[0118] Most importantly, maintaining shared links between paths leading to different receivers is crucial when changing the routing path of probe traffic. If these paths previously had shared links, they should have shared links after the routing path is changed, but they don't necessarily need to maintain the same shared links. Furthermore, shared links can be introduced for paths that initially didn't have them. To satisfy these constraints, a simple and effective approach is to maintain the original path weights in the attack view while assigning a weight of 0 to each newly added spoof link. This ensures that the shared link characteristics of the actual routing paths are preserved to the greatest extent possible in the fake topology.

[0119] Because this method protects the most general topology, not just tree topology, it generates SLM' for all probe triples at once, where SLM' = [SLM']. 1 ;…;SLM' K SLM is a Matrix, where |E'| represents the number of probe triples; |E'| represents the number of internal links in the pseudo-topology. Figure 8 An example is given to illustrate how to construct an SLM. When PN1 is selected as the sender, link 1 (AB) is a shared link on the path from sender PN1 to receivers PN2 and PN3. Therefore, Equals 1, and It equals 0.

[0120] Next, in step S130, a delay strategy model is constructed based on the relationship between the false link delay, the false shared link matrix, and the false shared link delay, i.e., formula (1). Simultaneously, when solving this model using a solver, three constraints must be met: the actual end-to-end delay in the false scrambled topology must be greater than or equal to the actual end-to-end delay in the real network structure; the delay of each false link must be less than its corresponding threshold; and the difference between the total end-to-end delay in the false scrambled topology and the real network structure must be minimized.

[0121] Specifically, the following considerations were taken into account when constructing the delay strategy model:

[0122] First, since network operators cannot artificially reduce latency, they can only intervene by increasing the latency of probe packets. Therefore:

[0123]

[0124]

[0125] In formula (5), slm' i,j,k D' is a row vector representing the shared links between sender i and receivers j and k in a spoofed topology, and D' is a column vector representing the appropriate link delays reallocated in the spoofed topology. This indicates the shared link latency in a spoofed topology.

[0126] Many existing topology inference methods can use end-to-end delay measurements to help improve the accuracy of the inferred topology. Therefore, ensuring that the end-to-end delay in the fake topology is sufficient to prevent attackers from perceiving the target network's defenses is crucial.

[0127] p′ i,j =pm′ i,j ×D' (6)

[0128]

[0129] In formula (6), pm′ i,j Let p be a row vector representing the links contained in the path from node i to node j in a spoofed topology. i,j This represents the end-to-end delay from node i to node j in a real network topology.

[0130] In addition, to prevent some links from having insufficient latency to expose them to attackers, we specify a threshold for each link, denoted as th. l :

[0131]

[0132] The fundamental premise of all topology obfuscation methods is to classify malicious probe packets from normal packets. However, developing a perfect classifier is beyond the scope of this paper; existing classifiers, while achieving high detection rates, often suffer from high false positive rates. Therefore, the potential negative impact on normal packets—that is, normal packets being misclassified as probe packets, thus causing latency—must be considered. Since only normal packets traveling to and from the obfuscated node can be misidentified, the potential negative impact on normal packets is defined in this method as follows:

[0133] NI=∑ i,j∈PN (p′ i,j -p i,j (8)

[0134] Finally, the delay strategy model can be modeled as follows:

[0135] min NI

[0136] st(5)-(8) (9)

[0137] By solving the above model, we can obtain the optimal D', which is the appropriate delay on each link in the pseudo-topology.

[0138] In step S140, the specific time of active delay for all detection triples can be calculated using (SLM'×D'-SLM×D).

[0139] Finally, in step S150, the delay policy is converted into a configuration rule and passed to each obfuscation node.

[0140] The aforementioned method for obfuscating topology information to hide key nodes first estimates the target network's topology using a topology inference method typically employed by attackers, resulting in an attack topology that the attacker would perceive. By introducing specific virtual nodes and links, the skewed distribution of key topology information within the attack topology is balanced, thereby hiding these key nodes and related links and reducing the attacker's motivation to attack the target network. Subsequently, the generated fake topology is converted into an active delay strategy. After successful deployment in the target network, it disrupts the attacker's end-to-end measurement results, causing the attacker to infer an incorrect network topology. The method was evaluated on three real-world network topologies. Experimental results demonstrate that this method can effectively hide key nodes and links in the target network, reducing the attacker's motivation to attack.

[0141] It should be understood that, although Figure 1The steps in the flowchart are shown sequentially as indicated by the arrows, but these steps are not necessarily executed in the order indicated by the arrows. Unless otherwise specified herein, there is no strict order in which these steps are executed, and they can be performed in other orders. Figure 1 At least some of the steps in the process may include multiple sub-steps or multiple stages. These sub-steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these sub-steps or stages is not necessarily sequential, but can be executed in turn or alternately with other steps or at least some of the sub-steps or stages of other steps.

[0142] In one embodiment, such as Figure 9 As shown, a topology information obfuscation device for hiding key nodes is provided, comprising: a real network acquisition module 200, a topology estimation module 210, a false obfuscated topology acquisition module 220, a false link delay vector solving module 230, a false path delay vector acquisition module 240, and a topology information obfuscation module 250, wherein:

[0143] The real network acquisition module 200 is used to acquire the real network to be protected.

[0144] The topology estimation module 210 is used to measure the time delay vector of each path in the real network using a tomographic imaging method, and estimate its topology to obtain the inferred topology of the real network.

[0145] The spurious obfuscated topology module 220 is used to identify key nodes in the inferred topology based on a preset security threshold. By constructing multiple virtual nodes to hide the key nodes, a spurious obfuscated topology is obtained.

[0146] The fake link delay vector solving module 230 is used to construct a fake shared link matrix based on the fake confusion topology, and input the fake shared link matrix into the delay strategy model to obtain the optimal fake link delay vector;

[0147] The False Path Delay Vector Acquisition Module 240 is used to obtain the false path delay vector of the false spoofed topology based on the false shared link matrix and the link delay vector;

[0148] The topology information obfuscation module 250 is used to obtain a delay strategy based on the false path delay vector and the delay vector of each path in the real network, and to arrange the nodes in the real network according to the delay strategy, so that the topology inferred by measuring the relevant delay of different receiving end pairs in the real network is the false obfuscated topology.

[0149] Specific limitations regarding the topology obfuscation device for hiding critical nodes can be found in the limitations of the topology obfuscation method for hiding critical nodes described above, and will not be repeated here. Each module in the aforementioned topology obfuscation device for hiding critical nodes can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in or independent of the processor in a computer device in hardware form, or stored in the memory of a computer device in software form, so that the processor can call and execute the operations corresponding to each module.

[0150] In one embodiment, a computer device is provided, which may be a terminal, and its internal structure diagram may be as follows: Figure 10 As shown, the computer device includes a processor, memory, network interface, display screen, and input devices connected via a system bus. The processor provides computing and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The network interface is used to communicate with external terminals via a network connection. When executed by the processor, the computer program implements a topology information obfuscation method to hide key nodes. The display screen can be an LCD screen or an e-ink screen. The input devices can be a touch layer covering the display screen, buttons, a trackball, or a touchpad mounted on the computer device casing, or an external keyboard, touchpad, or mouse.

[0151] Those skilled in the art will understand that Figure 10 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0152] In one embodiment, a computer device is provided, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to perform the following steps:

[0153] Obtain the real network to be protected;

[0154] The time delay vector of each path in the real network is measured using a tomographic imaging method, and its topology is estimated to obtain the inferred topology of the real network.

[0155] Based on a preset security threshold, key nodes in the inferred topology are identified. By constructing multiple virtual nodes to hide the key nodes, a false and obfuscated topology is obtained.

[0156] Based on the aforementioned false confusion topology, a false shared link matrix is ​​constructed, and the false shared link matrix is ​​input into the delay strategy model to obtain the optimal false link delay vector;

[0157] The false path delay vector of the false confusion topology is obtained based on the false shared link matrix and the link delay vector.

[0158] A delay strategy is obtained based on the delay vector of the false path and the delay vector of each path in the real network. The nodes in the real network are arranged according to the delay strategy, so that the topology inferred by measuring the relevant delay of different receiver pairs in the real network is the false confusion topology.

[0159] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon, the computer program performing the following steps when executed by a processor:

[0160] Obtain the real network to be protected;

[0161] The time delay vector of each path in the real network is measured using a tomographic imaging method, and its topology is estimated to obtain the inferred topology of the real network.

[0162] Based on a preset security threshold, key nodes in the inferred topology are identified. By constructing multiple virtual nodes to hide the key nodes, a false and obfuscated topology is obtained.

[0163] Based on the aforementioned false confusion topology, a false shared link matrix is ​​constructed, and the false shared link matrix is ​​input into the delay strategy model to obtain the optimal false link delay vector;

[0164] The false path delay vector of the false confusion topology is obtained based on the false shared link matrix and the link delay vector.

[0165] A delay strategy is obtained based on the delay vector of the false path and the delay vector of each path in the real network. The nodes in the real network are arranged according to the delay strategy, so that the topology inferred by measuring the relevant delay of different receiver pairs in the real network is the false confusion topology.

[0166] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. Any references to memory, storage, databases, or other media used in the embodiments provided in this application can include non-volatile and / or volatile memory. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), or flash memory. Volatile memory can include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in various forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), dual data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link DRAM (SLDRAM), Rambus direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM), etc.

[0167] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0168] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the invention patent. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this patent application should be determined by the appended claims.

Claims

1. A method for obfuscating topological information hidden in key nodes, characterized in that, The method includes: Obtain the real network to be protected; The time delay vector of each path in the real network is measured using a tomographic imaging method, and its topology is estimated to obtain the inferred topology of the real network. Based on a preset security threshold, key nodes in the inferred topology are identified. By constructing multiple virtual nodes to hide the key nodes, a false and obfuscated topology is obtained. A false shared link matrix is ​​constructed based on the false obfuscation topology. The false shared link matrix is ​​then input into a delay policy model to obtain the optimal false link delay vector, wherein the delay policy model is expressed as: In the above formula, It is a row vector representing the topology of the spoofed network from the sender. To the recipient and Shared links between paths It is a column vector representing the appropriate reallocation of link delays in a spoofed topology. Represented as a set of probe nodes, This indicates the shared link latency in a spoofed topology. Let be a row vector, representing the nodes in the spoofed topology. To the node The links contained in the path. Represents nodes in a real network topology To the node End-to-end latency, Indicates a preset threshold; The false path delay vector of the false confusion topology is obtained based on the false shared link matrix and the link delay vector. A delay strategy is obtained based on the delay vector of the false path and the delay vector of each path in the real network. The nodes in the real network are arranged according to the delay strategy, so that the topology inferred by measuring the relevant delay of different receiver pairs in the real network is the false confusion topology.

2. The topology information obfuscation method according to claim 1, characterized in that, The method of measuring the time delay vector of each path in the real network using tomographic imaging and estimating its topology to obtain the inferred topology of the real network includes: The tomography-based imaging method sends probe traffic to each receiver of the real network and constructs a preliminary inference of the topology based on the nodes and links through which the probe traffic flows. After deleting non-branch points in the preliminary inferred topology, the inferred topology is obtained.

3. The topology information obfuscation method according to claim 2, characterized in that, The step of identifying key nodes in the hypothetical topology based on a preset security threshold includes: Calculate the degree of each node in the inferred topology. If the degree is greater than the security threshold, the corresponding node is a critical node.

4. The topology information obfuscation method according to claim 3, characterized in that, The process of hiding the key node by constructing multiple virtual nodes to obtain a false obfuscated topology includes: Based on the degree of the key node, a corresponding number of related virtual nodes are constructed, and multiple related virtual nodes and corresponding key points are arranged in a ring around each other, with each node connected by a dummy link. Remove the links connected to the key points, and reconnect the nodes at the other end of each removed link to the corresponding virtual nodes through fake links; By using fake nodes and fake links to hide all the key nodes in the inferred topology, a fake obfuscated topology is obtained.

5. The topology information obfuscation method according to claim 1, characterized in that, The delay strategy model is constructed based on the relationship between false link delay, false shared link matrix, and false shared link delay.

6. The topology information obfuscation method according to claim 5, characterized in that, When solving the delay strategy model, the constraints are that the end-to-end real delay in the false confusion topology is greater than or equal to the end-to-end real delay in the real network structure, the delay of each false link is less than the corresponding threshold, and the difference between the end-to-end total delay in the false confusion topology and the real network structure is minimized.

7. The topology information obfuscation method according to claim 6, characterized in that, The delay strategy model is solved using a solver.

8. The topology information obfuscation method according to any one of claims 1-7, characterized in that, The method of obfuscating the topology information hidden in key nodes is used to combat network attacks based on topology inference from tomography.

9. A topology information obfuscation device for hiding key nodes, characterized in that, The apparatus implements the topology information obfuscation method according to any one of claims 1-8, and the apparatus comprises: The real network acquisition module is used to acquire the real network to be protected; The inferred topology estimation module is used to measure the time delay vector of each path in the real network using a tomographic imaging method, and to estimate its topology to obtain the inferred topology of the real network. The module for obtaining a false obfuscated topology is used to identify key nodes in the inferred topology based on a preset security threshold. By constructing multiple virtual nodes to hide the key nodes, a false obfuscated topology is obtained. The fake link delay vector solving module is used to construct a fake shared link matrix based on the fake confusion topology, and input the fake shared link matrix into the delay strategy model to obtain the optimal fake link delay vector; The fake path delay vector acquisition module is used to obtain the fake path delay vector of the fake scrambling topology based on the fake shared link matrix and the link delay vector; The topology information obfuscation module is used to obtain a delay strategy based on the false path delay vector and the delay vector of each path in the real network, and to arrange the nodes in the real network according to the delay strategy, so that the topology inferred by measuring the relevant delay of different receiver pairs in the real network is the false obfuscated topology.

10. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 8.

Images