5G移动通信的SDN-NFV安全评估方法
54 浏览量
更新于2024-08-26
收藏 220KB PDF 举报
“面向5G移动通信的漏洞评估”
在5G移动通信时代，软件定义网络（Software-Defined Networking, SDN）已经成为一种重要的网络架构。这种被称为SDN-Based Mobile Networks (SDN-MN)的架构引入了动态性和虚拟化特性，从而极大地提升了网络的灵活性和服务质量。然而，这些特性也带来了新的安全挑战，传统的网络安全评估方法不再适用于SDN-MN。因此，本文针对这一问题，提出了一种新的、基于攻击图算法和层次分析过程（Analytic Hierarchy Process, AHP）的漏洞评估机制。
攻击图是一种表示网络攻击可能性和路径的图形模型，它能够清晰地展示攻击者如何通过一系列步骤渗透到系统中。在本文中，作者利用优化的攻击图来解决评估中的可扩展性问题，这意味着该方法能够处理更复杂、更大规模的网络结构。为了量化安全级别，文章定义了一个节点最小努力的概念，用于衡量攻击成本，然后据此推导出系统的安全性指数。
层次分析过程（AHP）则是一种多准则决策分析方法，用于处理复杂的问题，通过比较和综合各种因素来确定它们的相对重要性。在漏洞评估中，AHP可以帮助确定不同漏洞的影响程度和优先级，使得安全管理人员可以优先处理最严重和最紧急的漏洞。
此外，文章还讨论了如何通过这种方式对网络的弱点进行识别和排序，以及如何制定相应的防护策略。通过结合攻击图和AHP，该机制不仅能够识别潜在的攻击路径，还能评估这些路径的威胁等级，为5G移动通信网络的安全防护提供科学依据。
这篇研究论文提出了一个创新的漏洞评估方法，对于保障5G网络的安全性具有重要意义。通过对SDN-MN架构的理解和对新型攻击方式的预测，该方法有望提升网络防御能力，防止或减少潜在的安全事件。同时，这种方法也为未来6G和其他先进移动通信网络的安全评估提供了理论基础和技术参考。
Toward Vulnerability Assessment for 5G Mobile Communication Networks
Shibo Luo, Jun Wu, Member,IEEE, Jianhua Li,
and Longhua Guo
School of Electronic Information and Electrical
Engineering
Shanghai Jiao Tong University
Shanghai, China
luoshibo.pla@sjtu.edu.cn, junwuhn@sjtu.edu.cn
Bei Pei
Key Lab of Information Network Security
Ministry of Public Security
Shanghai, China
Abstract—For 5G, Software-Defined Networking have
emerged as a future mobile network architecture. It is so called
Software-Defined Networking based Mobile Networks (SDN-
MN). Because of the dynamic and virtual features of SDN-MN,
most traditional network vulnerability assessment
methodologies cannot be applied in SDN-MN directly. As a
result, a new methodology of vulnerability assessment for
SDN-MN is needed. In this paper, an effective vulnerability
assessment mechanism is proposed for SDN-MN using attack
graph algorithm and analytic hierarchy process (AHP). An
optimized attack graph is given to alleviate scalability problem.
In order to quantify security level, we define node minimal
effort to quantify attack cost and then derive system security
level. Aiming to calculate node minimal effort of attack graph
in SDN-MN dynamic environment, AHP and Technique for
Order Preference by Similarity to an Ideal Solution (TOPSIS)
are integrated into the methodology with regard to dynamic
vulnerability factors in SDN-MN. Finally, we offer a case study
to validate the methodology. The case study and evaluation
show the advantages of the proposed vulnerability assessment
mechanism.
Keywords-5G, Vulnerability assessment, Software-Defined
Networking based Mobile Networks, attack graph, node minimal
effort, analytic hierarchy process
I. INTRODUCTION
In recent years, Software-Defined Networking (SDN) has
attracted great attentions as emerging future network
architecture in the fields such as 5G, cloud services and so on.
Different from traditional network architecture, network
control plane of SDN is decoupled from forwarding and is
directly programmable. This feature is a great help to
simplify policy enforcement and network (re)configuration
and evolution [1][2].
On the other hand, today’s mobile customers desire to
remain connected anywhere, at any time, and using any
device. This triggered the investigation of 5G for the next
generation of terrestrial mobile telecommunications. In this
context, SDN based Mobile Networks (SDN-MN) have
emerged as a future architecture for 5G [4][8].
Accompanied with benefits of SDN-MN, the properties of
centralized control and programmability also produce some
new properties into network that introduce new security
challenges. That is to say SDN-MN is not as same static as
traditional networks and it is greatly dynamic. These
properties lead to new security vulnerabilities in SDN-MN.
To defend SDN-MN, it is the most primary to measure the
security of SDN-MN addressing the dynamic property.
A number of security researches for SDN have recently
been performed [3]. These work have found that the
relationship between elements in the SDN framework
introduce new vulnerabilities. Some of them were not
present before SDN. A comprehensive security attack
vectors map of SDN is illustrated in Fig. 1.
There are also already lots of researches focusing on
traditional network vulnerability assessment. Among the
researches, how to compose the measure of individual
components is one of the critical issues. Attack graph method
is to address this problem [5].
Among traditional researches, some of them only focus
on traditional networks that do not take the special properties
of SDN into consideration. And some of them only focus on
the isolated security issues in SDN that do not provide a
system level security methodology. All of them can’t be
applied in SDN-MN directly for vulnerability assessment.
Based on aforementioned analysis, it is very necessary to
provide an effective vulnerability assessment mechanism for
SDN-MN considering its vulnerability and virtual features.
This paper propose a vulnerability assessment scheme for
SDN-MN using attack graph and analytic hierarchy process
(AHP).The rest of the paper is organized as follows: The
basic idea of our vulnerability assessment methodology is
described in Section II. Section III presents the formalism for
an attack graph model. The quantification method of node
minimal effort of attack graph is discussed in Section IV. In
WorkStation
SDN App Logic
6'1$SSOLFDWLRQ
Northbound Interface
Service Compiler
6'1&RQWUROOHU
Kernel
Network Function
1HWZRUN(OHPHQW
Kernel
Network Function
1HWZRUN(OHPHQW
Network Compiler
NMS Plugins
Network Configuration
WorkStation
SDN App Logic
6'1$SSOLFDWLRQ
WorkStation
SDN App Logic
6'1$SSOLFDWLRQ
Topology Discovering
Topology Monitoring
Southbound Interface
...
Attacks on traffic
flows
Attacks on control
plane communications
Attacks on
network
elements
Attacks on
controllers
Attacks on application
plane communications
Attacks on Apps
Fig. 1. Security attack vectors of SDN
2015 IEEE International Conference on Smart City/SocialCom/SustainCom together with DataCom 2015 and SC2 2015
978-1-5090-1893-2/15 $31.00 © 2015 IEEE
DOI 10.1109/SmartCity.2015.50
72
下载后可阅读完整内容，剩余4页未读，立即下载
2023-12-15 上传
2022-06-29 上传
2021-06-25 上传
2021-09-13 上传
2021-09-20 上传
2016-05-13 上传
点击了解资源详情
点击了解资源详情
点击了解资源详情
weixin_38689477
- 粉丝: 2
- 资源: 907
我的内容管理
展开
最新资源
- SSM动力电池数据管理系统源码及数据库详解
- R语言桑基图绘制与SCI图输入文件代码分析
- Linux下Sakagari Hurricane翻译工作：cpktools的使用教程
- prettybench: 让 Go 基准测试结果更易读
- Python官方文档查询库，提升开发效率与时间节约
- 基于Django的Python就业系统毕设源码
- 高并发下的SpringBoot与Nginx+Redis会话共享解决方案
- 构建问答游戏：Node.js与Express.js实战教程
- MATLAB在旅行商问题中的应用与优化方法研究
- OMAPL138 DSP平台UPP接口编程实践
- 杰克逊维尔非营利地基工程的VMS项目介绍
- 宠物猫企业网站模板PHP源码下载
- 52简易计算器源码解析与下载指南
- 探索Node.js v6.2.1 - 事件驱动的高性能Web服务器环境
- 找回WinSCP密码的神器：winscppasswd工具介绍
- xctools：解析Xcode命令行工具输出的Ruby库
