【作者】 熊琦；

【导师】 王丽娜；

【作者基本信息】 武汉大学 ， 信息安全， 2010， 博士

【摘要】 可生存性(Survivability)这一概念最早起源于美国的军事研究报告中,主要关注在军用指挥操作系统发生故障失效后如何能够防止灾难事件的发生,最大程度地减少因人为操作或者机器故障所造成的损失,此后在网络及系统安全领域得到了广泛的研究。由于基于保护和阻断的第一、二代网络安全技术都无法满足人们对信息系统安全的要求,面向容忍和自动响应的信息系统生存性技术引起了越来越多的关注,如何在入侵和灾难发生以后仍然能够对外提供服务则成为了网络信息系统安全研究的焦点。可生存性研究主要有可生存性分析和可生存性增强两大领域,其中生存性分析主要研究如何定义能够反映系统生存状况的指标,并在此基础上对系统的生存能力进行量化评估,对系统的生存性变化趋势和脆弱性进行预测,从而在理论上对生存性增强或者可生存性系统的设计提供指导；而生存性增强是要以较小的代价最大程度地提高系统的生存能力。生存性分析是生存性增强的前提,生存性增强的效果要靠生存性分析来进行评价,生存性增强则是生存性研究的实际落脚点和最终目标。自律计算AC (autonomic computing),又称自主计算,最早于2001年由IBM公司提出。AC的主要目标是开发计算系统,使其能够“自我管理”,克服目前计算系统管理消耗复杂庞大的问题,减小管理复杂性对系统进一步发展的障碍。换句话说,自律计算的主要特征就是对分布式计算资源进行自动管理,对不可预期的环境变化进行自动调节,并向操作者和用户隐藏下层实现的复杂性。自律系统根据所设定的高级策略,进行自我决策,系统不断检查并优化其自身状态,自动地根据环境变化进行自我调整适应。目前,生存性分析和生存性增强虽然已经取得了一些进展,但还存在着评价过程缺乏实时性,模型抽象度过高；生存性增强过程缺乏动态性,自动化程度低,需要大量人工干预。这些缺点限制了研究成果的实际应用。本文针对这些缺陷,将自律计算引入生存性研究中,抓住信息系统可生存性的核心思想,分别从以下几方面展开研究：首先,针对当前生存性量化方法行为描述能力差的问题,提出一种基于随机博弈论的入侵容忍系统可生存性量化方法,构建了面向可生存性研究的网络信息系统状态转换模型,将入侵者和入侵容忍系统作为随机博弈的局中人,建立了描述入侵过程的随机博弈模型,使用纳什均衡计算了博弈结果,使用基于连续马尔可夫过程的方法对容侵系统可生存性进行了量化评估。最后,利用博弈分析的结果和所建立的评估模型进行了容侵系统的生存性分析,指出了容侵系统的生存性敏感的参数,提高了对网络信息系统容侵过程的描述能力,为信息系统生存性动态分析提供了合理的依据。其次,针对当前生存性评价方法缺乏对安全防护措施评价的问题,提出了一个基于排队网的入侵响应系统生存性评估方法,并将其转化为对应的二维马尔可夫模型,通过拟生灭过程的构造实现了模型的化简,使用频谱扩展法求出了模型的稳态概率分布。最后,在此基础上分别从阻塞概率和平均队长两个方面来量化入侵响应系统的可生存性。量化结果不仅可以用来检验系统的设计是否符合生存性要求,也可为系统结构和系统参数的优化调整提供依据。再次,针对当前生存性分析方法动态建模和复杂系统建模能力差的缺陷,提出了一种基于层次赋时CPN (HTCP-nets)的系统可生存性建模和静态优化的方法,应用建模仿真工具CPN Tools对网络系统的生存环境和服务流程进行建模分析,求得了关键服务请求的平均响应时间、平均服务时间等表征系统生存能力的指标,最后根据分析结果给出了进行系统可生存增强的方法。再次,针对网络信息系统防御自动化程度低的缺点,将自律计算引入系统生存性增强中,提出了一种基于Q学习的网络信息系统生存性动态增强机制,该机制以终端自适应控制系统为保护对象,周期性地提取网络生存特征参数,将其作为Q学习模块的输入参数,由Q学习模块进行最优生存性增强措施的选择,优选出来的防御措施交与系统端执行。防御措施基于动态服务资源分配,根据系统当前运行状态对服务资源进行动态调整,从而保障正常服务请求的响应率。最后使用着色Petri网结合BP神经网络对系统生存环境进行了建模和仿真,结果表明：该方法具有较好的实时性和较高的灵敏性,能够自适应地进行生存性增强,显著提高了系统生存性增强的自动化程度：最后,针对传统网络信息系统灾难备份和镜像技术存在的恢复速度慢、故障后难以定位到正确数据版本的缺陷,提出了一种基于连续数据保护的信息系统灾难生存方法,在利用文件过滤驱动实现连续数据捕获的基础上,综合运用远程数据虚拟访问技术、交互式查询技术和快速恢复技术实现了系统关键业务的灾难可生存,有效保障了关键业务的可生存性。通过上述研究,综合解决了信息系统可生存性中的核心技术和难点问题,提出了网络信息系统容侵过程建模方法、网络信息系统生存性分析框架、网络信息系统静态、动态生存性增强及灾难生存技术,可为网络信息系统的生存性增强提供理论和技术支撑。更多还原

【Abstract】 The concept of System Survivability first came from the research report of United States Department of Defense. It focused on how to prevent the appearance of disaster after military commanding information system failed. After that, it was widely interested by the researchers in the filed of network and system security. Because the network security technologies of first and the second generations based on information insurance and information protection can not satisfy the increasing requirement on the information security of human being, intrusion tolerance and automatic attack response oriented information surviving technologies which can be considered as the third generation one get more and more attentions. How to survive the network intrusions and disasters, and continuous providing critical service gradually become the hot spot of information security filed.The research on system survivability can be considered from two aspects, survivability evaluation and survivability enhancing. Survivability evaluation maily works on the definition of suitable survivability evaluation metrics, predicting the surviving tendency and vulnerability from the qualification results, and making some guidance for survivability enhancing. In additional, survivability enhancing focuses on how to improve the survivability of information system with less cost. These two aspects depend on each other, the former is the primary work of the later, the later is the goal of the former one.Automotic computing firstly proposed by IBM at 2001, aims at developing a class of computing system which can manage itselfs automatically to overcome the problem of resourse cusuming at managing computer system. In another word, the main feature of automotic computing locates at the following aspects-managing the distributed computing resources automatically, adapting system to touch the step of environment changes, and hiding the complexity of low-level components. Automatic system can make decision, optimize itself, and adapt to touch the environment changes according to the pre-defined high-level rules.Although in field of system survivability, a great deal of achievements have been made, some drawbacks like lacking time reality and the detailed model description, the process of survivability enhancing still needs manual operation, holding low level automation prevents these achievements from application. Regarding these defaults existed, this paper apply the technology of automotic computing to system survivability, and try to make some improvements in the following aspects according to the kernel concepts of survivability.Firstly, a stochastic game theory based survivability qualification method is proposed, and survivability oriented state transition model of information system is constructed, intruder and information system are described as players of the stochastic game, related game model for intrusion process description is established, Nash Equilibrium is introduced for solving the game model. Continuous Markov Chain is used to qualify the survivability of Intrusion tolerant system, some sensitive parameters for improving the survivability of intrusion tolerant system is pointed out. This method not only improves the describing ability for the intrusion tolerant process of information system, but also provides some reasonable evidence for the dynamic analysis of the survivability of information system.Secondly, methodology for survivability analysis of intrusion response system based on queuing nets is proposed. Then it is transformed into a two-dimension Markov model and simplified into a Quasi Birth and Death (QBD) process. The steady-state distribution of this model is Obtained Based on Spectral Expansion method. Finally, the blocking probability and the mean queue length of intrusion response model are calculated to quantify the survivability of Intrusion Response System. The results can be useful not only to determine whether the survivability requirements are satisfied but also for the optimization of the system structure and parameters.Thirdly, a system survivability analysis method based on Hierarchical TCPN is proposed. Compared with traditional survivability analysis methods, our method is more suitable for modeling dynamic behavior of complex system. CPN Tools, a Hierarchical timed Colored Petri net simulation tool was deployed for modeling the survivability environment and service workflow of network system. Based on the model established, two metrics, the average response delay and average service delay are extracted from the simulation results to evaluate system survivability. In the end, some measures for system survivability enhancements are proposed according to the result.Fourthly, automotic Computing is introduced into information system survivability enhanding method to overcome the default of leaking automation. A q-learning based information system dynamic survivability enhancing method is proposed. Parameter vector for surviving state is cyclely abstracted from information system and forward to q-learning module as input. Q-learning module can recognize the surviving status from input and choose the best survivability enhancing action in the current state. The decision result will be transmitted to information system for execution and feedback the reward to improve the learning module. The whole process is validated by the Model established using Coloured Petri nets together with BP Neutral Network. The result of experiment shows that the methodology holds not only good time reality and well sensitivity, but also can make survivability enhancing automatically.Finally, a method based on continuous data protection for information system surviving disaster is proposed. File-system filtering driver is introduced for continuous data capturing, remote data virtual accessing technology, recovering process querying technology and quick restoring technology are incorporated to surviving disaster of critical service providing.The contents described in the thesis resolve some core problems and develops some critical technologies for survivability research. These achievements will provide help in not only theory aspects, but also in real problem solving.更多还原