A Node Confidence Determination Based Moving Target Defense Strategy for SDN

With the rapid development of Internet technology, network assets have become an indispensable part of modern society. Especially in the face of high-value network assets, the attacker is faced with paying a greater cost to study the network structure. Due to the unknown attacker and attack means, the attacker has an advantage in the attack and defense situation. The moving target defense technique can flexibly change the static characteristics of the network attack surface and increase the difficulty for the attacker to detect the network, thus achieving the purpose of enhancing network security. Based on this technique, this paper proposes a defense strategy based on node confidence. It puts forward stricter constraints on the differential selection of address/port hopping paths, dynamically selects the hopping objects according to the node’s confidence, and implements the defense strategy of differential complexity. This further increases the network’s uncertainty and the difficulty for the attacker to detect the network structure. The experimental results show that in the path differentiation comparison, the maximum improvement is about 18% compared to the Dynamic Random Route Hopping strategy. In the CPU load experiment, the CPU load rate is reduced by about 4.625% on average compared to the Double Address Hopping strategy. Moreover, for larger hopping period, the proposed strategy also performs well in terms of CPU load rate. The proposed strategy also exhibits good performance in terms of CPU load ratio for large hopping cycles.