A network intrusion active defense method and system based on a mobile attack surface

Abstract

This invention provides a proactive network intrusion defense method and system based on the mobile attack surface. The method includes: fronting up the mobile attack surface of the industrial control system; obfuscating the network assets of the industrial control system through dynamic camouflage of virtual and physical nodes; periodically changing and dynamically configuring the endpoints of virtual and physical nodes; and determining the optimal defense strategy for the dynamic camouflage of virtual and physical nodes using multi-stage signal game theory. This invention applies mobile attack surface defense to service proxies, realizing real business services and port forwarding through a front-end proxy, while applying mobile attack surface defense technology to the system network to achieve proactive defense against network intrusions in the new energy wind power industrial control system. Its goal is to fully utilize the load and buffering effect of the mobile attack surface to effectively reduce the possibility of intrusion into the new energy wind power industrial control system. Furthermore, it adds intrusion awareness and defense capabilities to the mobile attack surface, which is of great significance for researching network security attack and defense technologies for new energy industrial control systems.

Description

Technical Field

[0001] This invention belongs to the field of network security defense technology, and in particular relates to a proactive network intrusion defense method and system based on the mobile attack surface. Background Technology

[0002] With the rapid development of internet technology, we are facing increasingly severe cybersecurity issues. While the internet has brought us immense convenience, it has also introduced various cybersecurity threats, including worms, Trojans, and highly persistent advanced persistent threats (APS). Almost every industry involved in network technology has experienced security incidents to varying degrees, leading to data breaches and economic losses for government departments, industrial systems, and the power sector. As a crucial part of the national renewable energy development strategy, wind power's industrial control system cybersecurity research is of great significance. Due to the power industry's increasing reliance on networks, cyberattacks pose a significant threat to the secure operation of these systems.

[0003] Existing cybersecurity defenses, due to their lag and passivity, are ineffective at promptly detecting and addressing unknown security threats. When attacking the industrial control systems of new energy wind power plants, attackers often only need to exploit a single vulnerability to successfully compromise the system. This is because traditional network attack surfaces are typically tied to the business plane, preventing defenders from responding promptly. Successful attackers can directly access related business processes, leading to information leaks and other problems. Furthermore, attackers can exploit vulnerabilities to further amplify the damage, even gaining access to the entire network topology and controlling other hosts within the network. The inadequacy of existing static protection mechanisms allows attackers to exploit any vulnerability in the system, thereby escalating potential harm. Once network infrastructure is compromised, data may suffer loss, tampering, forgery, and other security threats. Therefore, to effectively address this challenge, we need to further optimize cybersecurity measures. Summary of the Invention

[0004] To address the aforementioned technical problems, this invention provides a proactive network intrusion defense method and system based on the mobile attack surface. The core idea of ​​this solution is to isolate business operations from potential attack surfaces by establishing a front-end network attack surface, targeting attackers' scanning and reconnaissance activities. When the front-end attack surface detects attack traffic, the system can quickly respond to the attack, preventing attackers from stealing target information or accessing business servers. This strategy effectively utilizes the load and buffering characteristics of the mobile attack surface and applies mobile attack surface defense technology to the system network, thereby achieving proactive defense for the new energy wind power industrial control system.

[0005] The technical solution provided by this invention is as follows:

[0006] A proactive network intrusion defense method based on the mobile attack surface includes:

[0007] Move mobile attack fronts of industrial control systems to the forefront;

[0008] By dynamically disguising and obfuscating network assets of industrial control systems using virtual and real nodes;

[0009] Perform periodic address switching and dynamic configuration for virtual and physical nodes;

[0010] The optimal defense strategy for dynamic camouflage of virtual and real nodes is determined by using multi-stage signal game theory.

[0011] Furthermore, the process of fronting up the mobile attack surface of the industrial control system includes: separating the business server and the mobile attack surface of the industrial control system; introducing a reverse proxy as an intermediate layer between the mobile application and the business server before setting up the business server; the reverse proxy is used to intercept and filter requests initiated by the mobile application and provide security functions; the mobile attack surface is deployed in a cloud environment using virtualization and cloud technologies, enabling it to be accessed and managed through cloud services.

[0012] Furthermore, the method of dynamically masquerading and obfuscating the network assets of the industrial control system through virtual and physical nodes includes: creating a security application on the SDN controller and using the application programming interface of the SDN controller to implement a masquerading mechanism for virtual and physical nodes; the masquerading mechanism includes a response time adjustment mechanism, a dynamic redirection mechanism, and an IP address randomization mechanism.

[0013] Furthermore, the response time adjustment mechanism refers to increasing the response priority of fake nodes to attacker requests by adjusting the response time of all service nodes, thereby confusing the attacker's judgment between real and fake nodes. Specifically, it includes:

[0014] S101. Define adjustment rules to determine how to adjust the node's response time based on time t; define baseline response time (baseline_response) to represent the node's normal response time; define amplitude to represent the range of response time variation; define period to represent the length of the adjustment period.

[0015] S102. Within each period, calculate the adjustment factor 'adjustment_factor' based on time 't' and period 'period'. For each node, the new response time is calculated as: new_response = baseline_response + adjustment_factor * amplitude.

[0016] S103. Introduce a feedback mechanism to adjust the adjustment rules based on changes in the actual response time.

[0017] Furthermore, the dynamic redirection mechanism refers to redirecting requests to real service nodes to other real nodes, thereby increasing the response time of real nodes without interrupting normal business operations.

[0018] Assuming there are three real service nodes processing requests, denoted as a, b, and c, then:

[0019] S201. The attacker sends a large number of requests to node c, increasing the response time of node c.

[0020] S202. When the load balancer sends these requests to node c, the defender actually redirects these requests to nodes a and / or b, instead of sending them to node c.

[0021] S203, the response time of node c has increased significantly, and the response time adjustment mechanism makes attackers mistake real nodes for virtual nodes;

[0022] S204. The defender gradually restores node c to its normal state, allowing it to be re-added to the load balancer's list of active nodes so that it can provide services to real users.

[0023] Furthermore, the IP address randomization mechanism refers to storing all available IP addresses of all servers in an IP address pool. When most of the virtual and physical nodes become ineffective against the attacker or the attacker can distinguish between virtual and physical nodes, the IP addresses of a group of servers are randomly changed, and the configuration of all service nodes under that server is updated.

[0024] Furthermore, in the process of periodically changing and dynamically configuring the virtual and physical nodes, a hybrid triggering mechanism based on time-driven and threat event-driven mechanisms is used to change the IP address and port number of the node.

[0025] The threat event-driven mechanism relies on a threat analysis engine. When the threat analysis engine detects a threat event and generates a security alert, it immediately sends a jump instruction to the jump configuration manager to trigger the corresponding address jump operation.

[0026] The time-driven mechanism actively transmits jump instructions to the jump configuration manager according to a preset time period, updating the endpoint configuration information of all current endpoint nodes.

[0027] Furthermore, the periodic address hopping for virtual and physical nodes also includes: a hopping space self-adjustment strategy: when hopping addresses, avoid using the address space already in use under the current network segment, and randomly assign new address configuration information to the node by removing unusable addresses and the configuration of attack target addresses in threat events; a hopping period self-adjustment strategy: adaptively adjust the duration of the address information in the periodic address hopping based on the security alarms detected by the threat analysis engine; and a half-address hopping strategy: select different address hopping strategies according to the communication mode of the terminal node to be configured.

[0028] Furthermore, assuming that end node A needs to communicate with end node B, the process of dynamically configuring virtual and physical node addresses includes:

[0029] S301. End node A requests the endpoint address information of end node B from the SDN controller, and after the SDN controller verifies the identity of end node A, it receives the IP address vIP4 and port number vPort4 of end node B after the hopping from the SDN controller.

[0030] S302. End node A sends a data packet to end node B. The data packet contains the IP address rIP1 and port number rPort1 of end node A before the transition, and the end address vIP4 and vPort4 of end node B.

[0031] S303. When the data packet sent by end node A passes through the switch, it will first be sent to the SDN controller. The SDN controller will change the end address rIP1 and rPort1 of end node A to vIP1 and vPort1 according to the hopping rules, and generate flow table entries accordingly and send them to the switch.

[0032] S304. After the switch receives the flow table entry and modifies the destination address of the data packet to the actual address rIP4 and rPort4 of the end node B, the data packet sent by the end node A successfully arrives at the end node B.

[0033] S305. End node A receives a response data packet sent by end node B. The response data packet, through the flow table entries generated by the SDN controller on the transmission path, changes the original real endpoint addresses rIP4 and rPort4 of end node B to vIP4 and vPort4, and changes the original endpoint addresses vIP1 and vPort1 of end node A to the real endpoint addresses rIP1 and rPort1 of end node A.

[0034] Furthermore, assuming host A needs to communicate with host B, the process of dynamically configuring virtual and physical node addresses includes:

[0035] S401. Host A sends an ARP request to the first SDN switch to request the MAC address of host B. The first SDN switch sends a Packet-In message to the SDN controller. After receiving the message, the SDN controller sends a Packet-Out message to the second SDN switch, which then requests the actual MAC address rMAC of host B from the second SDN switch.

[0036] S402. Host B responds to the ARP request and sends its real MAC address rMAC to the second SDN switch. The second SDN switch sends a Packet-In message to the SDN controller. While sending a Packet-Out message to the first SDN switch, the SDN controller sends the flow table modification rules back to the second SDN switch. The first SDN switch uses the virtual MAC address vMAC of host B to spoof the response.

[0037] S403. When host A sends data to host B's virtual MAC address vAMC, the first SDN controller forwards the data to host B's virtual MAC address vMAC. The second SDN switch converts vMAC to rMAC according to the flow table modification rules and forwards the data to rMAC.

[0038] Furthermore, in the process of determining the optimal defense strategy for dynamic camouflage of virtual and real nodes using multi-stage signal game, the attacking and defending sides are analyzed through dynamic game, and the optimal defense strategy is determined by calculating the perfect Bayesian Nash equilibrium in the game.

[0039] A proactive network intrusion defense system based on the mobile attack surface includes a defense deployment module, a threat perception module, and a service proxy module. The defense deployment module is used to deploy and implement the proactive network intrusion defense method described above, which dynamically masquerades and obfuscates the network assets of the industrial control system using virtual and physical nodes. The threat perception module is used to identify known attacks targeting end nodes and accurately determine their types, and simultaneously perform periodic address hopping and dynamic configuration of virtual and physical nodes based on the threat analysis results. The service proxy module is used to implement real business services and port forwarding.

[0040] Furthermore, the threat perception module is managed by the SDN controller for each end node, and performs operations on the data of each end node, including filtering, transformation, normalization and dimensionality reduction, and constructs a multi-category attack identification model based on ensemble learning.

[0041] Furthermore, three separate classifiers were trained using the C4.5, Random Forest, and Forest PA algorithms as base learners, and the base learners were integrated using the Voting algorithm to form a multi-class attack identification model.

[0042] Furthermore, the defense deployment module is applied to the data plane, control plane, and application plane, with dynamic decision-making module, virtual-real camouflage module, and security inspection agent module deployed on each plane.

[0043] Furthermore, the dynamic decision-making module is deployed as a security application on the SDN controller. It is used to dynamically update the game parameters according to system requirements and combined with continuously updated security monitoring logs and service node status. It uses the multi-stage signal game in the above method to determine the optimal defense strategy for the dynamic masquerading of virtual and real nodes, and makes the corresponding best defense decision for each service node at each time step of the game.

[0044] Furthermore, the virtual-real masquerade module is implemented based on the application programming interface of the SDN controller, creating a corresponding independent security application embedded in the SDN controller, and executing the corresponding security function after receiving the control commands and configuration parameters from the dynamic decision module.

[0045] Furthermore, the security inspection agent module is embedded in the cloud server and switch to record the real system performance of the real service nodes and monitor security events of fake nodes.

[0046] Compared with the prior art, the beneficial effects of the present invention are:

[0047] 1) This invention provides a network intrusion proactive defense method and system based on mobile attack surface. This method focuses on the new energy wind power industrial control system, increases the difficulty of attacking the new energy wind power industrial control system and expands its attack surface. The mobile attack surface proactive defense method and system includes two dimensions: time and space. It uses methods such as virtual and physical nodes, IP and port switching to obfuscate network assets, and makes full use of the load and buffering effect of the mobile attack surface, effectively reducing the possibility of the new energy wind power industrial control system being intruded.

[0048] 2) This invention provides a mobile attack surface monitoring technology in the scenario of new energy wind power industrial control system. It utilizes the SDN framework to monitor the mobile attack surface. By deploying a threat perception module on the end node, the module is responsible for perceiving known threats against the end node and accurately identifying their types. The SDN controller receives attacker information and address hopping requests transmitted from each end node. The SDN transmits the information received from the end node to the new energy wind power industrial control system, thereby realizing the monitoring of the mobile attack surface in the scenario of new energy wind power industrial control system and effectively improving the active defense capability of the new energy wind power industrial control system.

[0049] 3) This invention applies attack surface mobile target defense to service proxies, implementing real business services and port forwarding through a front-end proxy. Simultaneously, it applies mobile attack surface defense technology to the system network, achieving proactive defense against network intrusions into the new energy wind power industrial control system. Its goal is to fully utilize the load and buffering effect of the mobile attack surface, effectively mitigating the possibility of intrusion into the new energy wind power industrial control system. Furthermore, it adds intrusion detection and defense capabilities to the mobile attack surface, which is of great significance for researching network security attack and defense technologies for new energy industrial control systems. Attached Figure Description

[0050] The accompanying drawings are provided to further illustrate the invention and form part of the specification. They are used together with the embodiments of the invention to explain the invention and do not constitute a limitation thereof.

[0051] Figure 1 This is a flowchart illustrating a proactive network intrusion defense method according to an embodiment of the present invention;

[0052] Figure 2 This is a schematic diagram of an address transition process provided in an embodiment of the present invention;

[0053] Figure 3 This is a schematic diagram of dynamic MAC address transformation provided in an embodiment of the present invention;

[0054] Figure 4 This is a schematic diagram of the framework of a network intrusion proactive defense system provided in an embodiment of the present invention. Detailed Implementation

[0055] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0056] Example 1

[0057] like Figure 1 As shown, this embodiment provides a proactive network intrusion defense method based on the mobile attack surface, including:

[0058] (1) Move the mobile attack front of the new energy wind power industrial control system to the front.

[0059] The business server and mobile attack surface of the new energy wind power industrial control system are separated. Before setting up the business server, a reverse proxy is introduced as an intermediate layer between the mobile application and the business server. The reverse proxy can intercept and filter requests initiated by the mobile application and provide additional security functions. At the same time, virtualization and cloud technologies are used to deploy the mobile attack surface in a cloud environment, enabling it to be accessed and managed through cloud services. This allows for flexible migration and scalability of the attack surface.

[0060] (2) Obfuscate network assets by dynamically disguising virtual and real nodes.

[0061] The SDN controller implements proactive defense transformation across all server nodes it manages. This is achieved by creating a separate security application on the SDN controller and utilizing its application programming interface (API) to implement a virtual-physical node masquerading mechanism. This virtual-physical masquerading mechanism primarily includes three types of proactive defense mechanisms: response time adjustment mechanism, dynamic redirection mechanism, and IP address randomization mechanism.

[0062] 1) Response time adjustment mechanism refers to dynamically and frequently adjusting the response time of all service nodes to increase the response priority of fake nodes to attacker requests, thus confusing the attacker's judgment of real and fake nodes. Specifically, this includes:

[0063] S101. Define adjustment rules to determine how to adjust the node's response time based on time t; define baseline response time (baseline_response) to represent the node's normal response time; define amplitude to represent the range of response time variation; define period to represent the length of the adjustment period.

[0064] S102. Within each period, calculate the adjustment factor (adjustment_factor), which can be calculated using a sine or cosine function based on time t and period. For each node, the new response time can be calculated as: new_response = baseline_response + adjustment_factor * amplitude.

[0065] S103. Introduce a feedback mechanism to adjust the adjustment rules based on changes in actual response time. This will help ensure that the system can adapt to different loads and demands.

[0066] 2) Dynamic redirection mechanism refers to redirecting requests to real service nodes to other real nodes, thereby increasing the response time of real nodes without interrupting normal business operations. In this way, real nodes can be disguised as fake nodes, causing attackers to misjudge and abandon their attacks on the real target.

[0067] Assuming there are three real service nodes processing requests, denoted as a, b, and c, then:

[0068] S201. The attacker sends a large number of requests to node c, and node c's response time increases significantly.

[0069] S202. When the load balancer sends these requests to node c, the defender actually redirects these requests to nodes a and / or b, instead of sending them to node c.

[0070] S203. Due to the dynamic redirection mechanism, the response time of node c is greatly increased. Combined with the response time adjustment mechanism, it makes attackers mistake the real node for a virtual node.

[0071] S204. The defender can gradually restore node c to its normal state, allowing it to be re-added to the load balancer's list of active nodes so that it can provide services to real users.

[0072] 3) The IP address randomization mechanism refers to storing all available IP addresses of all servers in an IP address pool, randomly changing the IP addresses of a group of servers, and updating the configuration of all service nodes, thereby reconstructing the game process. This mechanism is typically used when most virtual and real nodes are ineffective against the attacker, or when the attacker can distinguish between virtual and real nodes. This increases the complexity and difficulty of network attacks, making it harder for the attacker to accurately determine virtual and real nodes.

[0073] Through the above three proactive defense measures, the SDN controller can effectively protect the security of all service nodes and enhance the monitoring and defense capabilities of mobile attack surfaces.

[0074] (3) Perform periodic address switching and dynamic configuration of virtual and real nodes.

[0075] The network attack surface is dynamically changed for the IP addresses and port numbers of the SDN controller's managed endpoints. A hybrid triggering mechanism based on time-driven and threat event-driven methods is used to modify the IP addresses and port numbers. Specifically:

[0076] The threat event-driven triggering mechanism relies on the threat detection and attack identification capabilities of the threat analysis engine. When the threat analysis engine detects a threat event and generates a security alert, it immediately sends a jump instruction to the jump configuration manager to trigger the corresponding endpoint jump operation.

[0077] The time-driven triggering mechanism actively sends jump instructions to the jump configuration manager according to a preset time period. Even if the threat analysis engine does not generate a security alert, this can ensure that the endpoint jump is performed regularly, update the endpoint configuration information of all current endpoint nodes, and improve the defense effect.

[0078] By combining proactive and reactive address hopping triggering mechanisms, the system can flexibly adjust the address hopping strategy according to the threat situation, ensuring network security and availability.

[0079] Assuming a complete set of endpoint configuration information Where φ represents the set of all IP addresses in this network segment. Let represent the set of all ports. Since all of the above sets are finite sets, the dynamic randomized address space self-adjustment algorithm based on the available jump space is shown in the table below.

[0080] Table 1. Dynamically Randomized Endpoint Space Self-Adjustment Algorithm Based on Available Jump Space

[0081]

[0082] As shown in Table 1, periodic address transitions for virtual and physical nodes also include:

[0083] Self-adjusting strategy for hopping space: When performing address hopping, avoid using the address space already in use under the current network segment. By eliminating unusable addresses and the configuration of attack target addresses in threat events, quickly and efficiently allocate new address configuration information to nodes randomly.

[0084] Self-adjusting hop cycle strategy: Based on security alerts detected by the threat analysis engine, the duration of the hop cycle address information is adaptively adjusted to improve network communication service quality and avoid unnecessary defense overhead.

[0085] Half-endpoint hopping strategy: Different endpoint hopping strategies are selected according to the communication mode of the end nodes to be configured, so as to flexibly apply the half-endpoint hopping strategy and improve the defense effect.

[0086] like Figure 2 As shown, the process of dynamically configuring virtual and physical node endpoints includes:

[0087] S301. When end node 1 establishes communication with end node 4, end node 1 requests the end address information of end node 4 from the SDN controller. After the controller verifies the identity of end node 1, it returns the IP address vIP4 and port number vPort4 of end node 4 after the transition.

[0088] S302. After receiving the endpoint address information, endpoint 1 sends a data packet to endpoint 4. The data packet contains the IP address rIP1 and port number rPort1 of endpoint 1 before the hop, as well as the destination endpoint address vIP4 and vPort4.

[0089] S303. When a data packet passes through an OpenFlow switch that does not yet have a flow table entry, it will first be sent to the SDN controller. The controller will change rIP1 and rPort1 to vIP1 and vPort1 according to the hopping rules, and then generate flow table entries to send to the OpenFlow switch.

[0090] After receiving the flow table entry, the S304 and OpenFlow switches will modify the destination address of the data packet to the actual endpoint addresses rIP4 and rPort4 of the end node 4, and then send the data packet to the end node 4.

[0091] After receiving the data packet, S305, End Node 4 sends a response data packet to End Node 1. The response data packet contains the real endpoint addresses rIP4 and rPort4 of End Node 4, as well as the destination endpoint addresses vIP1 and vPort1. Similarly, the OpenFlow switches on the path will modify the endpoint information one by one.

[0092] like Figure 3 As shown, the dynamic configuration of virtual and physical node addresses also includes dynamic MAC address transformation. If host A in a new energy wind power industrial control system wants to communicate with host B in the same system, it must go through an SDN switch and an SDN controller. The specific steps are as follows:

[0093] S401. Host A sends an ARP request to SDN switch 1, requesting the MAC address of host B. SDN switch 1 sends a Packet-In message to the SDN controller. After receiving the message, the SDN controller sends a Packet-Out message to SDN switch 2, which then requests the actual MAC address (rMAC) of host B from SDN switch 2.

[0094] S402. Host B responds to the ARP request and sends its real MAC address (rMAC) to SDN switch 2. SDN switch 2 sends a Packet-In message to the SDN controller. While sending a Packet-Out message to SDN switch 1, the SDN controller sends the flow table modification rule (vMAC-rMAC) back to SDN switch 2. SDN switch 1 uses host B's virtual MAC address (vMAC) to spoof the response.

[0095] S403. At this time, host A can send data to the virtual MAC address (vAMC) of host B. SDN controller 1 will forward the data to the virtual MAC address (vMAC) of host B. SDN switch 2 will forward the data after converting the MAC address according to the flow table modification rules (vMAC-rMAC).

[0096] (4) Determine the optimal defense strategy for dynamic camouflage of virtual and real nodes using multi-stage signal game theory.

[0097] By analyzing the attacking and defending sides through dynamic game theory and calculating the perfect Bayesian Nash equilibrium (PBNE) in the game, the optimal defense strategy for confusing the network's core assets through camouflage is determined. In the dynamic game process, the various service nodes controlled by the defender become the senders in the signaling game, transmitting messages to the attacker through multiple camouflage mechanisms. Simultaneously, they can deploy dynamic camouflage in an optimally efficient manner to confuse the attacker's perception of network assets and protect core assets.

[0098] The game theory model first formally defines the information transmitted by the defender to the attacker, the action space of both sides, the belief function, and the utility function, ensuring an accurate description of the information exchange and behavioral choices of the attacker and defender in the game.

[0099] Requirement 1: When receiver R receives message m from sender S, receiver R will store a belief value ζ(θ|m) regarding the sender's type, satisfying the following requirement:

[0100]

[0101] Requirement 2: Given a belief value ζ(θ|m), receiver R will adjust its game strategy to maximize its expected utility value U. R Therefore, the receiver's game strategy λ R The following requirements must be met:

[0102]

[0103] Requirement 3: For a given sender type θ and receiver strategy λ R The strategy λ of each sender s All of them must be able to maximize their utility value and satisfy the following requirements:

[0104]

[0105] Requirement 4: If there exists a specific sender type θ, the game strategy of the sender of this type is λ. R =m * , where m * ∈M. Then, regarding sending message m... * For a given sender type, the receiver R's belief about it must satisfy the following Bayesian rule:

[0106]

[0107] The model then analyzes the dynamic game process between the attackers and defenders, including action choices and information transmission at different stages. By considering the game process across multiple stages, both sides can adjust and optimize their strategies based on each other's behavior and information.

[0108] This model determines the optimal defense strategy for obfuscating network core assets by calculating the perfect Bayesian Nash equilibrium (PBNE) in the game. Through this model, the best defense strategy can be found to cope with different attack scenarios and protect the security of network core assets. The algorithm for selecting the optimal strategy is shown in Table 2.

[0109] Table 2 Optimal Strategy Selection Algorithm

[0110]

[0111] If it is determined that the attacker is aware of the defender's dynamic masquerading using virtual and real nodes and has identified all real service nodes, then a decision is made to randomize IP addresses, assigning a new set of IP addresses to all end nodes. When the attacker's belief is influenced by the dynamic masquerading, a dynamic redirection operation is performed on real service nodes, making them appear as fake nodes. Simultaneously, response time adjustments are made to fake nodes, packaging them as real nodes. Finally, the optimal defense strategy for each server node is returned, and the process continues to the next time step, achieving a continuous dynamic decision-making process. Through these steps, the system can dynamically adjust its defense strategy according to different situations, maintaining a balance between attackers and defenders in the game and effectively protecting core network assets.

[0112] Example 2

[0113] like Figure 4 As shown, this example provides a proactive network intrusion defense system based on the mobile attack surface, mainly including a defense deployment module, a threat awareness module, and a service proxy module. The defense deployment module is responsible for proactive defense methods against the mobile attack surface, utilizing the dynamic masquerading of virtual and physical nodes to obfuscate network assets. The threat awareness module is primarily responsible for detecting known threats targeting end nodes and accurately identifying their types. To improve detection accuracy and efficiency, it also performs periodic address changes and dynamic configuration of virtual and physical nodes based on threat analysis results. The service proxy module mainly implements real business services and port forwarding.

[0114] The threat awareness module, managed by the SDN controller, controls end nodes and performs data filtering, transformation, normalization, and dimensionality reduction. To improve threat identification accuracy, ensemble learning typically combines multiple independent base classifiers to effectively solve the same problem, enabling them to predict classification results with higher stability and accuracy. This embodiment uses C4.5, Random Forest, and Forest PA algorithms to train three separate classifiers as base learners to construct a multi-class attack identification model based on ensemble learning, and then uses the Voting algorithm to integrate the base learners.

[0115] 1) C4.5 is a typical decision tree algorithm. This algorithm traverses the decision tree, visits each node, and selects the optimal branch based on maximizing the gain ratio. It is represented as follows:

[0116]

[0117] In this process, C4.5 will select the attribute with the highest information gain as the branch attribute of node N. Information gain typically represents the reduction in uncertainty after partitioning set D on attribute A. This uncertainty can be calculated using entropy, and its formula can be defined as:

[0118]

[0119] Where X is the set of categories in set D, and p(x) is the ratio of the number of elements in category x to the number of elements in set D. SplitInfo describes how attributes equally divide the data, and its calculation formula is as follows:

[0120]

[0121] 2) Breimanis's Random Forest (RF) algorithm can be described as a set of classification trees, where each decision tree votes once for the classification task of the most frequent class in the input data. Compared to other machine learning methods, running RF requires fewer parameters. In RF, the set of individual tree-structured classifiers can be defined as:

[0122] {h(x,θ k}, k=1,2…i…

[0123] 3) Forest PA is an algorithm that constructs a highly accurate set of decision trees by utilizing all non-class attributes in the dataset. It combines weight allocation and weight increment strategies to maintain individual accuracy and ensure strong diversity. For the weights of attributes appearing in the new tree, Forest PA randomly updates these attribute weights within a certain weight range (WR), which can be defined as follows:

[0124]

[0125] 4) The Voting algorithm combines the functions of multiple individual classifiers in ensemble learning and selects different ensemble rules for their classification decision process, such as minimum probability, maximum probability, majority voting, probability product and probability average, etc.

[0126] Suppose we have l classifiers C = {C1, ..., C2} l}, having c categories Ω{ω1,...,ω cIn threat detection, l depends on the number of base classifiers and can be set to 3, while the value of c depends on the number of attack types. For classifier C... i :R n →[0,1] c When it accepts an object x∈R n At that time, a vector will be output. in Represents classifier c i The assigned object x belongs to category w j The probability of w. j Let m j The average probability assigned by l classifiers can be calculated using the following formula:

[0127] The defense deployment module implements proactive defense transformations on all server nodes managed by the SDN controller. It uses dynamic masquerading to confuse attackers' perception of real nodes, thereby misleading them to target fake nodes. The defense deployment module is applied in the data plane, control plane, and application plane; at the data plane, it deploys core components such as dynamic decision-making, virtual / real masquerading, and security inspection agents.

[0128] 1) The security check agent module is embedded in the cloud server and OpenFlow switch, and is mainly responsible for recording the real system performance of real service nodes and monitoring security events of fake nodes.

[0129] 2) The dynamic decision-making module, deployed as a security application on the SDN controller, is primarily responsible for evaluating the security effectiveness of defense strategies and selecting appropriate proactive defense mechanisms and corresponding parameter configurations. Based on requirements and continuously updated security monitoring logs and service node status, it dynamically updates game parameters and uses a multi-stage signal game model to determine the optimal defense strategy for dynamic masquerading of virtual and real nodes. At each time step of the game, it makes the corresponding best defense decision for each service node.

[0130] 3) The virtual-real masquerade module is implemented based on the SDN controller's application programming interface (API). It creates a corresponding independent security application embedded in the SDN controller and executes the corresponding security functions upon receiving control commands and configuration parameters from the dynamic decision-making module. The defense deployment module also includes IP address and port randomization and flow splitting technologies. When most core network assets are under attack threat, this mechanism modifies the IP address parameters of all service nodes, thereby dynamically reconstructing the current game.

[0131] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; under the concept of the present invention, the technical features of the above embodiments or different embodiments can also be combined, the steps can be implemented in any order, and there are many other variations of different aspects of the present invention as described above, which are not provided in detail for the sake of brevity; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of this application.

Claims

1. A proactive network intrusion defense method based on the mobile attack surface, characterized in that, include: The mobile attack surface of the industrial control system is brought forward, including: separating the business server and the mobile attack surface of the industrial control system; introducing a reverse proxy as an intermediate layer between the mobile application and the business server before setting up the business server; the reverse proxy is used to intercept and filter requests initiated by the mobile application and provide security functions; the mobile attack surface is deployed in a cloud environment using virtualization and cloud technologies, so that it can be accessed and managed through cloud services. The network assets of the industrial control system are obfuscated by dynamically masquerading virtual and physical nodes: the masquerading mechanism of virtual and physical nodes is implemented by using the application programming interface of the SDN controller, including response time adjustment mechanism, dynamic redirection mechanism and IP address randomization mechanism; Perform periodic address transitions and dynamic configuration for both virtual and physical nodes: Assuming that endpoint A needs to communicate with endpoint B, the process of dynamically configuring virtual and physical node addresses includes: S301. End node A requests the endpoint address information of end node B from the SDN controller, and after the SDN controller verifies the identity of end node A, it receives the IP address vIP4 and port number vPort4 of end node B after the hopping from the SDN controller. S302. End node A sends a data packet to end node B. The data packet contains the IP address rIP1 and port number rPort1 of end node A before the transition, and the end address vIP4 and vPort4 of end node B. S303. When the data packet sent by end node A passes through the switch, it will first be sent to the SDN controller. The SDN controller will change the end address rIP1 and rPort1 of end node A to vIP1 and vPort1 according to the hopping rules, and generate flow table entries accordingly and send them to the switch. S304. After the switch receives the flow table entry and modifies the destination address of the data packet to the actual address rIP4 and rPort4 of the end node B, the data packet sent by the end node A successfully arrives at the end node B. S305. End node A receives a response data packet sent by end node B. The response data packet, through the flow table entries generated by the SDN controller on the transmission path, changes the original real end addresses rIP4 and rPort4 of end node B to vIP4 and vPort4, and changes the original end addresses vIP1 and vPort1 of end node A to the real end addresses rIP1 and rPort1 of end node A. Assuming host A needs to communicate with host B, the process of dynamically configuring virtual and physical node addresses includes: S401. Host A sends an ARP request to the first SDN switch to request the MAC address of host B. The first SDN switch sends a Packet-In message to the SDN controller. After receiving the message, the SDN controller sends a Packet-Out message to the second SDN switch, which then requests the actual MAC address rMAC of host B from the second SDN switch. S402. Host B responds to the ARP request and sends its real MAC address rMAC to the second SDN switch. The second SDN switch sends a Packet-In message to the SDN controller. While sending a Packet-Out message to the first SDN switch, the SDN controller sends the flow table modification rules back to the second SDN switch. The first SDN switch uses the virtual MAC address vMAC of host B to spoof the response. S403. When host A sends data to the virtual MAC address vAMC of host B, the first SDN controller will forward the data to the virtual MAC address vMAC of host B, and the second SDN switch will convert vMAC to rMAC according to the flow table modification rules and forward the data to rMAC. We use multi-stage signal game theory to analyze both the attackers and defenders, and determine the optimal defense strategy by calculating the perfect Bayesian Nash equilibrium in the game.

2. The network intrusion proactive defense method as described in claim 1, characterized in that, The response time adjustment mechanism refers to adjusting the response time of all service nodes to increase the response priority of fake nodes to attacker requests, thereby confusing the attacker's judgment of fake and real nodes. Specifically, it includes: S101. Define adjustment rules to determine how to adjust the node's response time based on time t; define baseline response time (baseline_response) to represent the node's normal response time; define amplitude to represent the range of response time variation; define period to represent the length of the adjustment period. S102. Within each period, calculate the adjustment factor (adjustment_factor) based on time (t) and period (period). For each node, the new response time is calculated as: new_response = baseline_response + adjustment_factor * amplitude. S103. Introduce a feedback mechanism to adjust the adjustment rules based on changes in the actual response time.

3. The network intrusion proactive defense method as described in claim 1, characterized in that, The dynamic redirection mechanism refers to redirecting requests to real service nodes to other real nodes, thereby increasing the response time of real nodes without interrupting normal business operations. Assuming there are three real service nodes processing requests, denoted as a, b, and c, then: S201. The attacker sends a large number of requests to node c, increasing the response time of node c. S202. When the load balancer sends these requests to node c, the defender actually redirects these requests to nodes a and / or b, instead of sending them to node c. S203, the response time of node c has increased significantly, and the response time adjustment mechanism makes attackers mistake real nodes for virtual nodes; S204. The defender gradually restores node c to its normal state, allowing it to be re-added to the load balancer's list of active nodes so that it can provide services to real users.

4. The network intrusion proactive defense method as described in claim 1, characterized in that, In the process of periodically changing and dynamically configuring the virtual and physical nodes, a hybrid triggering mechanism based on time-driven and threat event-driven mechanisms is used to change the IP address and port number of the node. The threat event-driven mechanism relies on a threat analysis engine. When the threat analysis engine detects a threat event and generates a security alert, it immediately sends a jump instruction to the jump configuration manager to trigger the corresponding address jump operation. The time-driven mechanism actively transmits jump instructions to the jump configuration manager according to a preset time period, updating the endpoint configuration information of all current endpoint nodes.

5. A proactive network intrusion defense system based on a mobile attack surface, characterized in that, It includes a defense deployment module, a threat awareness module, and a service proxy module; the defense deployment module is used to deploy and implement the network intrusion proactive defense method as described in any one of claims 1 to 4, which uses virtual and physical nodes to dynamically masquerade and obfuscate the network assets of the industrial control system; the threat awareness module is used to identify known attacks against end nodes and accurately determine their types, and at the same time, performs periodic address switching and dynamic configuration of virtual and physical nodes based on the threat analysis results; the service proxy module is used to implement real business services and port forwarding.

6. The network intrusion proactive defense system as described in claim 5, characterized in that, The threat perception module is managed by the SDN controller for each end node. It performs operations on the data of each end node, including filtering, transformation, normalization and dimensionality reduction, and builds a multi-category attack identification model based on ensemble learning. The defense deployment module is applied in the data plane, control plane and application plane. Dynamic decision module, virtual and real disguise module and security inspection agent module are deployed on each plane.

7. The network intrusion proactive defense system as described in claim 6, characterized in that, The dynamic decision-making module is deployed as a security application on the SDN controller. It is used to dynamically update the game parameters according to system requirements and combined with continuously updated security monitoring logs and service node status, and make the best defense decision for each service node at each time step of the game. The virtual-real masquerade module is implemented based on the application programming interface of the SDN controller. It creates a corresponding independent security application, embeds it into the SDN controller, and executes the corresponding security function after receiving the control command and configuration parameters from the dynamic decision module. The security inspection agent module is embedded in the cloud server and switch to record the real-time system performance of real service nodes and monitor security events of fake nodes.

Images