意图驱动的韧性网络安全研究

doi:10.12305/j.issn.1001-506X.2024.09.32

系统工程与电子技术 ›› 2024, Vol. 46 ›› Issue (9): 3211-3220.doi: 10.12305/j.issn.1001-506X.2024.09.32

• 通信与网络 • 上一篇

意图驱动的韧性网络安全研究

宋延博¹, 高先明², 杨春刚¹^,³^,*, 李鹏程³

1. 西安电子科技大学通信工程学院, 陕西西安 710071
2. 军事科学院系统工程研究院, 北京 100039
3. 西安电子科技大学杭州研究院, 浙江杭州 311200

收稿日期:2023-07-28 出版日期:2024-08-30 发布日期:2024-09-12
通讯作者: 杨春刚
作者简介:宋延博 (1994—), 男, 博士研究生, 主要研究方向为意图驱动网络、网络安全
高先明 (1988—), 男, 高级工程师, 博士, 主要研究方向为未来网络体系结构、智能路由协议、网络安全
杨春刚 (1982—), 男, 教授, 博士研究生导师, 博士, 主要研究方向为意图驱动智简网络、智能网络信息体系、软件定义网络自治、认知天地网络融合、网络通信博弈论
李鹏程 (1999—), 男, 硕士研究生, 主要研究方向为意图驱动网络、网络韧性

Research on intent-driven resilience network security

Yanbo SONG¹, Xianming GAO², Chungang YANG¹^,³^,*, Pengcheng LI³

1. School of Telecommunications Engineering, Xidian University, Xi'an 710071, China
2. Institute of System Engineering Academy of Military Sciences, Beijing 100039, China
3. Hangzhou Institute of Technology, Xidian University, Hangzhou 311200, China

Received:2023-07-28 Online:2024-08-30 Published:2024-09-12
Contact: Chungang YANG

摘要/Abstract

摘要：

未来的网络要求有一个灵活、弹性、可拓展的网络架构, 才能适应多样化对服务的新要求。意图驱动网络针对这一难题提供了一种切实可行的新思想, 具体地说是基于意图闭环技术可以让网络管理员不必再去注意复杂的配置细节, 仅需表达网络服务需求即可获得自主可靠的服务。首先对目前网络安全中出现的新问题进行剖析, 对意图驱动网络方法论及其关键技术进行梳理, 提出一种基于意图驱动网络闭环生命周期架构；探究意图驱动网络安全服务韧性策略推理。意图驱动网络的实践案例包含意图的生成、转译、策略制定和部署等过程，实现了网络故障情况下保障网络服务的永续在线，反映出意图驱动网络的全生命周期。

关键词: 意图驱动网络, 网络安全, 网络策略, 网络韧性

Abstract:

In the future, network will necessitate flexible, resilient, and scalable frameworks to accommodate evolving and diverse services. Intent-driven network provides a practical and feasible new idea for addressing this challenge. Specifically, intent-driven loop allows network administrators to focus less on intricate configuration details and more on expressing service requirements, facilitating autonomous and reliable services. Firstly, this work analyzes new challenges emerging in the field of cybersecurity. Subsequently, it introduces the methodology and key technologies of intent-driven network, proposing a lifecycle intent-driven architecture based on intent-driven network. Secondly, a method of reasoning for resilience strategies is introduced in intent-driven network security services. The practical application of intent-driven network involves the generation, translation, policy formulation, and deployment of intents, thereby ensuring the continuous online availability of network services even in the event of network failures. This reflects the entire lifecycle of an intent-driven network.

Key words: intent-driven network, network security, network policy, network resilience

中图分类号:

TN915.08

宋延博, 高先明, 杨春刚, 李鹏程. 意图驱动的韧性网络安全研究[J]. 系统工程与电子技术, 2024, 46(9): 3211-3220.

Yanbo SONG, Xianming GAO, Chungang YANG, Pengcheng LI. Research on intent-driven resilience network security[J]. Systems Engineering and Electronics, 2024, 46(9): 3211-3220.

图/表 10

图1

图2

图3

图4

图5

图6

图7

图8

图9

图10

参考文献 31

1	YOU X H , WANG C X , HUANG J , et al. Towards 6G wireless communication networks: vision, enabling technologies, and new paradigm shifts[J]. Science China Information Sciences, 2021, 64, 110301. doi: 10.1007/s11432-020-2955-6
2	PANG L , YANG C G , CHEN D Y , et al. A survey on intent-driven networks[J]. IEEE Access, 2020, 8, 22862- 22873. doi: 10.1109/ACCESS.2020.2969208
3	SONG Y B , YANG C G , ZHANG J M , et al. Full-life cycle intent-driven network verification: challenges and approaches[J]. IEEE Network, 2023, 37 (5): 145- 153. doi: 10.1109/MNET.124.2200127
4	MEHMOOD K , KRALEVSKA K , PALMA D . Intent-driven autonomous network and service management in future networks: a structured literature review[J]. Computer Networks, 2023, 220, 109477. doi: 10.1016/j.comnet.2022.109477
5	KIM J , KIM E , YANG J , et al. IBCS: intent-based cloud services for security applications[J]. IEEE Communications Magazine, 2020, 58 (4): 45- 51. doi: 10.1109/MCOM.001.1900476
6	TIAN B C, ZHANG X Y, ZHAI E N, et al. Safely and automatically updating in-network ACL configurations with intent language[C]//Proc. of the ACM Special Interest Group on Data Communication, 2019: 214-226.
7	CHUNG C, JEONG J P. A design of IoT device configuration translator for intent-based IoT-cloud services[C]//Proc. of the 22nd International Conference on Advanced Communication Techno-logy, 2020: 52-56.
8	OpenDayLight. Nemo user guide[EB/OL]. [2023-05-11]. http://test-odl-docs.readthedocs.io/en/latest/user-guide/nemo-user-guide.html.
9	CHOWDHARY A , SABUR A , VADNERE N , et al. Intent-driven security policy management for software-defined systems[J]. IEEE Trans.on Network and Service Management, 2022, 19 (4): 5208- 5223. doi: 10.1109/TNSM.2022.3183591
10	SCHEID J, MACHADO C, FRANCO F, et al. INSpIRE: integrated NFV-based intent refinement environment[C]//Proc. of the IFIP/IEEE Symposium on Integrated Network and Service Management, 2017: 186-194.
11	ABHASHKUMAR A, KANG J M, BANERJEE S, et al. Supporting diverse dynamic intent-based policies using JANUS[C]// Proc. of the 13th International Conference on Emerging Networking Experiments and Technologies, 2017, 14: 296-309.
12	YANG C G , MI X R , OUYANG Y , et al. SMART intent-driven network management[J]. IEEE Communications Magazine, 2023, 61 (1): 106- 112. doi: 10.1109/MCOM.002.2200119
13	LIYANAGE M , PHAM Q V , DEV K , et al. A survey on zero touch network and service management (ZSM) for 5G and beyond networks[J]. Journal of Network and Computer Applications, 2022, 203, 103362. doi: 10.1016/j.jnca.2022.103362
14	MEHMOOD K , KRALEVSKA K , PALMA D . Intent-driven autonomous network and service management in future cellular networks: a structured literature review[J]. Computer Networks, 2023, 220, 109477. doi: 10.1016/j.comnet.2022.109477
15	LIU X M , LI D Q , MA M Q , et al. Network resilience[J]. Physics Reports, 2022, 971, 1- 108. doi: 10.1016/j.physrep.2022.04.002
16	ZEYDAN E, TURK Y. Recent advances in intent-based networking: a survey[C]//Proc. of the IEEE 91st Vehicular Technology Conference, 2020.
17	AREZOUMAND S, DZEPAROSKA K, BANNAZADEH H, et al. MD-IDN: Multi-domain intent-driven networking in software-defined infrastructures[C]//Proc. of the 13th International Conference on Network and Service Management, 2017.
18	SHAGHAGHI A, KAAFAR M A, BUYYA R. Software-defined network (SDN) data plane security: issues, solutions, and future directions[M]. GUPTA B, PEREZ G, AGRAWAI D, et al, ed. Cham: Handbook of Computer Networks and Cyber Security, 2020: 341-387.
19	张佳鸣, 杨春刚, 庞磊, 等. 意图物联网[J]. 物联网学报, 2019, 3 (3): 5- 10.
	ZHANG J M , YANG C G , PANG L , et al. Intent driven Internet of Things[J]. Chinese Journal on Internet of Things, 2019, 3 (3): 5- 10.
20	何发智, 吕晓, 蔡维纬. 支持操作意图一致性的实时协同编辑算法综述[J]. 计算机学报, 2018, 41 (4): 840- 867.
	HE F Z , LYU X , CAI W W . Survey of real-time collaborative editing algorithms supporting operation intention consistency[J]. Chinese Journal of Computer, 2018, 41 (4): 840- 867.
21	ADDAD R, DUTRA D, BAGAA M. Benchmarking the ONOS Intent interfaces to ease 5G service management[C]//Proc. of the IEEE Global Communications Conference, 2018.
22	RFC 8994. An autonomic control plane (ACP)[S]. New York: Internet Engineering Task Force, 2021.
23	JACOBS S, PFITSCHER J, RIBEIRO H. Deploying natural language intents with lumi[C]//Proc. of the ACM SIGCOMM Conference Posters and Demos, 2019: 82-84.
24	JACOBS A, FERREIRA R, PITSCHER R. Refining network intents for self-driving networks[C]//Proc. of the Afternoon Workshop on Self-Driving Networks, 2018: 15-21.
25	朱梦迪, 束永安. 软件定义网络中控制数据平面一致性的验证[J]. 计算机应用, 2020, 40 (6): 1751- 1754.
	ZHU M D , SHU Y A . Verification of control-data plane consistency in software defined network[J]. Journal of Computer Applications, 2020, 40 (6): 1751- 1754.
26	王敬宇, 周铖, 张蕾, 等. 知识定义的意图网络自治[J]. 电信科学, 2021, 37 (9): 1- 13.
	WANG J Y , ZHOU C , ZHANG L , et al. Knowledge-defined intent-based network autonomy[J]. Telecommunications Science, 2021, 37 (9): 1- 13.
27	NUNES I , SCHARDONG F , SCHAEFFER-FILHO A . BDI2DoS: an application using collaborating BDI agents to combat DDoS attacks[J]. Journal of Network and Computer Applications, 2017, 84, 14- 24. doi: 10.1016/j.jnca.2017.01.035
28	CHOWDHARY A , SABUR A , VADNERE N , et al. Intent-dri-ven security policy management for software-defined systems[J]. IEEE Trans.on Network Service Management, 2022, 19 (4): 5208- 5223. doi: 10.1109/TNSM.2022.3183591
29	OOI E , BEURAN R , KURODA T , et al. Intent-driven secure system design: methodology and implementation[J]. Computers & Security, 2023, 124, 102955.
30	SHARMA Y , BHAMARE D , SASTRY N , et al. SLA management in intent-driven service management systems: a taxonomy and future directions[J]. ACM Computing Surveys, 2023, 55 (13): 292.
31	LARA A , KOLASANI A , RAMAMURTHY B . Network innovation using openflow: a survey[J]. IEEE Communications Surveys & Tutorials, 2013, 16 (1): 493- 512.

[1]	刘祥林, 杨春刚, 李富强, 欧阳颖, 宋延博. 意图驱动数据链网络策略协商模型与算法[J]. 系统工程与电子技术, 2024, 46(6): 2128-2137.
[2]	姬泽阳, 杨春刚, 李富强, 欧阳颖, 刘祥林. 基于自然语言处理的意图驱动网络表征[J]. 系统工程与电子技术, 2024, 46(1): 318-325.
[3]	刘斌, 蚁佳才, 姚莉, 王炎娟, 丁兆云, 朱先强. 面向太空网络战威胁的态势感知本体建模[J]. 系统工程与电子技术, 2023, 45(3): 745-754.
[4]	茹鑫鑫, 高晓光, 王阳阳. 基于模糊约束的贝叶斯网络参数学习[J]. 系统工程与电子技术, 2023, 45(2): 444-452.
[5]	孙隽丰, 李成海, 曹波. 基于TCN-BiLSTM的网络安全态势预测[J]. 系统工程与电子技术, 2023, 45(11): 3671-3679.
[6]	蚁佳才, 刘斌, 姚莉, 赵文涛. 基于知识推理的卫星网络态势理解[J]. 系统工程与电子技术, 2022, 44(5): 1562-1571.
[7]	金志刚, 吴桐. 基于特征选取与树状Parzen估计的入侵检测[J]. 系统工程与电子技术, 2021, 43(7): 1954-1960.
[8]	何春蓉, 朱江. 基于注意力机制的GRU神经网络安全态势预测方法[J]. 系统工程与电子技术, 2021, 43(1): 258-266.
[9]	李方伟, 李俊瑶, 聂益芳, 朱江. 基于多代理系统的动态信任态势感知机制[J]. 系统工程与电子技术, 2017, 39(5): 1148-1153.
[10]	钱玉文，宋华菊，赵邦信，张彤芳，郝劲松. 基于校正熵的网络行为隐蔽信道的检测算法[J]. Journal of Systems Engineering and Electronics, 2013, 35(6): 1312-1217.
[11]	王斌1,2,3，吴钦章1，王春鸿1，孙永泉3，杜中平3. 基于安全控制模块的高可信计算机研究[J]. Journal of Systems Engineering and Electronics, 2010, 32(2): 437-440.
[12]	王杰, 石成辉, 刘亚宾. 基于节点共享计数型Bloom filter高效动态数据包过滤方案[J]. Journal of Systems Engineering and Electronics, 2009, 31(9): 2227-2231.
[13]	杜志强, 沈玉龙, 马建峰, 周利华. 基于AKB-OTS的传感器网络广播认证协议 [J]. Journal of Systems Engineering and Electronics, 2009, 31(8): 2008-2012.
[14]	秦华旺, 戴跃伟, 王执铨. 一种基于Petri net的分布式入侵容忍系统模型研究[J]. Journal of Systems Engineering and Electronics, 2009, 31(1): 208-212.
[15]	秦华旺, 戴跃伟, 王执铨. 一种基于Petri net的分布式入侵容忍系统模型研究[J]. Journal of Systems Engineering and Electronics, 2009, 31(01): 208-212.

意图驱动的韧性网络安全研究

Research on intent-driven resilience network security

RichHTML

PDF (PC)

可视化

摘要/Abstract

引用本文

使用本文

图/表 10

参考文献 31

相关文章 15

编辑推荐

Metrics

本文评价