Active Defense Technology Research Articles

An Efficient Network Security Situation Assessment Method Based on AE and PMU

Network security situation assessment (NSSA) is an important and effective active defense technology in the field of network security situation awareness. By analyzing the historical network security situation awareness data, NSSA can evaluate the network security threat and analyze the network attack stage, thus fully grasping the overall network security situation. With the rapid development of 5G, cloud computing, and Internet of things, the network environment is increasingly complex, resulting in diversity and randomness of network threats, which directly determine the accuracy and the universality of NSSA methods. Meanwhile, the indicator data is characterized by large scale and heterogeneity, which seriously affect the efficiency of the NSSA methods. In this paper, we design a new NSSA method based on the autoencoder (AE) and parsimonious memory unit (PMU). In our novel method, we first utilize an AE‐based data dimensionality reduction method to process the original indicator data, thus effectively removing the redundant part of the indicator data. Subsequently, we adopt a PMU deep neural network to achieve accurate and efficient NSSA. The experimental results demonstrate that the accuracy and efficiency of our novel method are both greatly improved.

A Deep Random Forest Model on Spark for Network Intrusion Detection

This paper focuses on an important research problem of cyberspace security. As an active defense technology, intrusion detection plays an important role in the field of network security. Traditional intrusion detection technologies have problems such as low accuracy, low detection efficiency, and time consuming. The shallow structure of machine learning has been unable to respond in time. To solve these problems, the deep learning-based method has been studied to improve intrusion detection. The advantage of deep learning is that it has a strong learning ability for features and can handle very complex data. Therefore, we propose a deep random forest-based network intrusion detection model. The first stage uses a slide window to segment original features into many small pieces and then trains a random forest to generate the concatenated class vector as rerepresentation. The vector will be used to train the multilevel cascade parallel random forest in the second stage. Finally, the classification of the original data is determined by voting strategy after the last layer of cascade. Meanwhile, the model is deployed in Spark environment and optimizes cache replacement strategy of RDDs by efficiency sorting and partition integrity check. The experiment results indicate that the proposed method can effectively detect anomaly network behaviors, with high F1-measure scores and high accuracy. The results also show that it can cut down the average execution time on different scaled clusters.

Anti-reconnaissance Model of Host Fingerprint Based on Virtual Node

Aiming at the problem of insufficient defense ability of fingerprint detection, the anti-reconnaissance model of host fingerprint based on virtual node is proposed. The model constructs periodically reconfigurable virtual nodes, dynamically camouflages the fingerprint information of the host to deceive the detector, and redirect attack traffic targeting virtual nodes to honeypots that can capture and analyze attack behavior. Honeypot, as an active defense technology, can effectively improve the model’s defense capabilities. This paper introduces probabilistic models for the defense model to provide a deeper understanding of the theoretical effect their parameters have for cybersecurity, which quantifies the impact of different parameters on the probability of attack success, such as the number of probes, number of honeypot mapping rules, the virtual node deception rate, the honeypot detection rate and allowable losses. Furthermore, our prototype system using Software Defined Network (SDN) and Data Plane Development Kit (DPDK) verifies the effectiveness of the model against reconnaissance.

Active Defense Technology Based on Natural Software Diversity in Java Web Services

With the popular use of network application services and the growing number of users, web services have become the main target of hackers. Traditional single software has insufficient security protection against unknown threats and is prone to various vulnerabilities. In this paper, we adopt a new type of active defense strategy in java web services. At different application layers, we use existing components based on the natural software diversity to form different software stacks, and use dynamic scheduling mechanisms to change the attack surface at all times to obtain security protection. Our analysis shows that the flexibility of java web services using this defense strategy is enhanced, and the exploitability of its vulnerabilities is effectively reduced.

Application of New Active Defense Technology in Power Information Network Security

With the rapid development of the Internet and the expansion of the network scale, while the network brings unlimited convenience to people, the problem of network security has become increasingly prominent. Network security has become one of the main factors hindering the development of the Internet. In the operation of power network systems, in order to ensure network security, many security technologies are also being continuously applied. In the traditional network security defense technology, passive defense technology is used, all its defense measures are static and all rely on network administrators to implement equipment and manual configuration. In the new network era, the illegal attacks on power network information systems have become more and more frequent, at the same time, hackers’ offensive methods will also be updated and become more sophisticated. Therefore, traditional network security defense technologies have been unable to resist or even cannot withstand. Based on this, this paper focuses on new active defense technologies, analyzes its application in power information network security, and proposes defense of power information network security based on attack detection using honeypot technology suggestions.

Active Defense by Mimic Association Transmission in Edge Computing

A large amount of real-time data, including user privacy information, control commands, and other sensitive data, are transmitted in edge computing networks. It requires high-speed and reliable data transmission in dynamic edge computing networks. Traditional methods with passive defense cannot cope with the covert and complicated attacks. Edge computing networks require active defense during data transmission. Existing active defense methods based on dynamic network ignore the connectivity and link quality reduced by attacks and do not adjust defense positively. To maximize the defense revenue in moving adjustment strategy, this paper proposes the model of active defense for edge computing network data interaction. In this model, the network topology mimic association protocol is designed to associate multi-paths and multi-parameters automatically. On one hand, considering the transmission reliability and defensive revenue reduction caused by dynamic network transformation, a real-time multi-feature anomaly detection algorithm based on Non-extensive entropy and Renyi cross entropy is proposed. Based on this, a moving communication path alliance can be constructed pseudo-randomly. On the other hand, this paper proposes a Hidden Markov based state prediction model and a mimic transformation strategy for The Network Topology Mimic Association Graph based on predicted states. Combining these two ways improves the data transmission service quality of the active defense technology in edge computing networks. Experiments are carried in simulated power networks. The results show that our method outperforms the popular methods in terms of transmission efficiency, reliability, and anti-attack performance.

Network security model based on active defense and passive defense hybrid strategy

To build a network security system combining active defense and passive defense during covid-19, we need to break the original Castle type passive defense concept and build a reliable, controllable, flexible and active network environment to find defense points. The key is that the system should be able to actively predict and control our defenses. Any scheme cannot achieve absolute safety, only to minimize the probability of safety accidents, through various measures to assess and predict the possible points of safety accidents, and actively prevent the occurrence of accidents. In the management and construction of network security, we should realize that network security management is a comprehensive system engineering. We should start from the three aspects of strategy, management and technology, and build a more effective and reliable network security system on the basis of traditional passive defense and active defense technology, which can better maintain big data security during covid-19.

Intelligent Processing of Intrusion Detection Data

Intrusion detection technology, as an active and effective dynamic network defense technology, has rapidly become a hot research topic in the field of network security since it was proposed. However, current intrusion detection still faces some problems and challenges that affect its detection performance. Especially with the rapid development of the current network, the volume and dimension of network data are increasing day by day, and the network is full of a large number of unlabeled data, which brings great pressure on the data processing methods of IDS. In view of the tremendous pressure of intrusion detection brought by the current complex and high-dimensional network environment, this paper provides a feasible solution. Firstly, this paper briefly outlines the necessity of feature learning, the shortcomings of traditional feature learning methods and the new breakthroughs brought by deep belief network in feature learning, and focuses on the principle and working mechanism of deep belief network and Principal Component Analysis (PCA). Then, it constructs the intrusion detection model based on PCA-BP and DBN respectively. And through the experimental evaluation of the two detection models, a comparative experiment between deep belief network and principal component analysis is constructed. The experimental results show that deep belief network has unique advantages and good performance in feature learning. Therefore, deep belief network can be applied in the field of intrusion detection to extract effective features from the current high-dimensional and redundant network data, thereby improving the detection performance of IDS and its adaptability to the current complex and high-dimensional network environment.

Heterogeneity Quantization Method of Cyberspace Security System Based on Dissimilar Redundancy Structure

The Dissimilar Redundancy Structure (DRS) based cyberspace security technology is an active defense technology, which uses features such as dissimilarity and redundancy to block or disrupt network attacks to improve system reliability and security. By analyzing how heterogeneity can improve the security of the system, the importance of quantification of heterogeneity is pointed out and the heterogeneity of DRS is defined as the complexity and disparity of its execution set. A new method which is suitable for quantitative heterogeneity is also proposed. The experimental results show that this method can divide 10 execution sets into 9 categories, while the Shannon-Wiener index, Simpson index and Pielou index can only divide into 4 categories. This paper provides a new method to quantify the heterogeneity of DRS in theory, and provides guidance for engineering DRS systems.

Adaptively feature learning for effective power defense

Active defense technology is very important in intelligent systems and video surveillance. In some important fields, active defense system can effectively find intruders. Many intelligent video surveillance systems were proposed in recent years. They achieved good performance to some extent. Since power station is an important field, it is important to develop an intelligent video surveillance. Considering that detecting the whole surveillance video is time consumption and computation. So in this paper, we propose an active defense system to find intruders automatically. First, a key frame selection algorithm based on adaptive features is presented to select key frames. These key frames can cover the main content of videos and detecting these key frames can also reduce time consumption and computation. Then, a probabilistic model is proposed to learn the training data distribution. Finally, our system can achieve active defense based on probabilistic model. Experimental results show that our active defense system can achieve finding intruders effectively.

Performance Analysis of Honeypot with Petri Nets

As one of the active defense technologies, the honeypot deceives the latent intruders to interact with the imitated systems or networks deployed with security mechanisms. Its modeling and performance analysis have not been well studied. In this paper, we propose a honeypot performance evaluation scheme based on Stochastic Petri Nets (SPN). We firstly set up performance evaluation models for three types of defense scenarios (i.e., firewall; firewall and Intrusion Detection System (IDS); firewall, IDS and honeypot) based on SPN. We then theoretically analyze the SPN models by constructing Markov Chains (MC), which are isomorphic to the models. With the steady state probabilities based on the MC, the system performance evaluation is done with theoretical inference. Finally, we implement the proposed three SPN models on the PIPE platform. Five parameters are applied to compare and evaluate the performance of the proposed SPN models. The analysis of the probability and delay of three scenarios shows that the simulation results validate the effectiveness in security enhancement of the honeypot under the SPN models.

Active Defense Technology of Power Monitoring System With Adaptive Features

Internet of Things has found a lot of applications in power systems. However, with the increased the sensing, networking, and control capabilities, the security issues have become even more urgent at the same time. In this paper, a TMAC model based on trusted mandatory access control is proposed by studying the security situation of a power monitoring system. The model has self-learning characteristic and can realize the automatic escalation of the global security strategy based on intelligent agent, so as to build the safe immune ability and active defense system for the power monitoring. This paper introduces the key technology of the TMAC security model, formalizes some of the work, and finally tests its credibility and effectiveness for the typical application scenario of the power monitoring system. Through the study of this technology, the power monitoring system is further equipped with an immune ability against virus Trojan and hacker attacks, especially for application scenarios, such as substation, power plant, and master station.

Active Perceptive Dynamic Scheduling Mechanism Based on Negative Feedback

With the popularization of the Internet, the production and living of people and even the security development of the country have been more and more dependent on cyberspace, the importance of cyberspace has become increasingly prominent. Network security should be paid more and more attention to. Mimicry defense is one of active defense technologies. We focused on the DHR architecture and give a research on mimicry scheduling mechanism based on negative feedback and we have analyzed the feasibility of this method in theory.

Spatial Movement Analysis on the Intercepting Projectile in the Active Electromagnetic Armor

Active electromagnetic armor is a new kind of concept armor that integrates active defense and electromagnetic launch technology. During launching, the spatial movement of the intercepting projectile determines the intercepting probability for attacking the coming targets. For two perpendicular pancake coils, the intercepting projectile can be launched in different directions by changing the trigger times controlled by two switches. In this paper, a field-circuit coupled model of a two coil launcher is built first. When two coils are discharged simultaneously, the intercepting projectile is directed at the angular bisector of two coils. The eddy current in the intercepting projectile is mainly distributed near the coils, and the current density decreases dramatically along the normal direction of the surface. For different trigger times, the intercepting projectile moves in both types: linear and rotation. The moving characteristic on the intercepting projectile is analyzed. If the electromagnetic force is not exerted on the mass center along the movement of the intercepting projectile, the spatial movement may be changed. Based on the simulation results, a steerable launcher has been built. Three typical experimental results for the simultaneous discharge launching are shown under the same condition. The spatial movements for steerable launching at the simultaneous time and delay time of 1 ms are measured by the high speed camera. Compared with the experimental results, the simulation results are validated. It provides the reference for launching the projectile to intercept the coming targets.

Information Security Coding Rule Based on Neural Network and Greedy Algorithm and Application in Network Alarm Detection

With the development of computer network, network information resources have brought great convenience to users. However, the security problems of computer network have become increasingly prominent, and the main threat is the invasion of the information system through the network. Network intrusion will bring great losses to society, especially to the government and military agencies. With the increase of network intrusion, the firewall can't resist the attack on the network. Intrusion detection system makes up the shortcomings of traditional Internet security technology, and it is a kind of active defense technology. Through security log, audit data and other information, intrusion detection system can detect the network attacks and take the corresponding measures. Intelligent intrusion detection system is a hot spot in the field of network security, commonly based on neural network, genetic algorithm, greedy algorithm, fuzzy technology, and so on. In this paper, we apply the neural network and the greedy algorithm into the network security detection system. We analyze the theories of neural network and greedy algorithm, and introduce the evaluation model of network security system. Experiments show that the information security coding rule based on neural network and greedy algorithm can help network monitoring system better detect the network attacks.

Study on Active Defense Technology and Detection Algorithm of Virus Based on Computer Network

Study on Active Defense Technology and Detection Algorithm of Virus Based on Computer Network

Active Defense Technology in Network Security Based on Non-Cooperative Dynamic Game Theory

With the rapid development of network technology, the network security related threats are more and more serious at present. To guarantee the security of the network, now the main defense technology is static, but the static defense technology don’t change with the corresponding preventive measures change and unable to attack intention and attack strategies. Based on the analysis of the current situation, this paper mainly analyses the dynamic non cooperative game theory, and applied the theory to network security prevention, and achieved good results.

Research of Immune Network Defense System Based on Black Hole Theory

Active defense technology may predict future attack situation and detect unknown attacks, but it has many questions to will be researched: vulnerability, lower mal-ware detection rate, security situation awareness technology has faced problem of inter-organization cooperation, real-time response, correlation analysis, high-load low fault tolerance. Artificial immune technology combines with active defense technology to solve integrated artificial immune security situation awareness system with artificial immune technology and active defense technology by Black Hole theory and for diversification ad development characteristics of the artificial immune and active defense, gives a method about simulating Black Hole accretion theory to achieve absorption and utilization a variety of security and virus technology; a no escaped mechanism simulate the Black Hole; a method about access control method based on Hawking radiation theory. Based on the above work, applies virtual and sandbox technology to achieve network system itself virus immunity, and then that we implement re-engineering and reverse engineering for virus technology in order to study virus and dig more holes, create unified integrated defense tactics, so this defense system will improve ability of situation comprehension, situation prediction and intelligence decision.

Network Security System Design Integrating Intrusion Deception and Dynamic Forensic Technology

As the development of the network keeps on continuously changing, there is the very existence of brand new attacks that are unceasing. Under this circumstance, the corresponding network security system should be required to be equipped with adaptability. In this paper, active defense technologies are integrated on the basis of the traditional network security system. The active defense technologies have included the intrusion deception, dynamic forensic and so on. Through the connection with the traditional passive defense technologies such as the firewall and so on, a dynamic, comprehensive and adaptable network security system can be built. In addition, a detailed analysis research can be carried out on the work process.