Security-oriented Deception on Network Topology against Crossfire Attack

Crossfire attack has the cunning characteristics of wide distribution, weak traffic and indirectness. It poses a serious threat to cyberspace security and has attracted extensive attention of researchers. Starting with analyzing the characteristics of crossfire attack, this paper designs a network topology deception defense technology. A number of random and independent virtual network topologies are generated. The generated virtual topologies are respectively mapped to different hosts in external network, so that the attacker in the external network cannot find out the real internal network topology. The attacker cannot launch an effective crossfire attack because he cannot select necessary key links and decoy servers. We deploy some deception servers in the real internal topology to collect and analyze traffic from external network and further identify the controlled bots. Experiments show that compared with the three typical crossfire attack defense technologies, the proposed method has obvious advantages on server response delay and network transmission efficiency.