Dynamic defense method of Web server based on Linux namespace

doi:10.11772/j.issn.1001-9081.2017.12.3442

Journal of Computer Applications ›› 2017, Vol. 37 ›› Issue (12): 3442-3446.DOI: 10.11772/j.issn.1001-9081.2017.12.3442

Previous Articles Next Articles

Dynamic defense method of Web server based on Linux namespace

CHEN Gang^1,2, GUO Yudong^1,2, WEI Xiaofeng²

1. Information Engineering University, Zhengzhou Henan 450001, China;
2. State Key Laboratory of Mathematical Engineering and Advanced Computing, Zhengzhou Henan 450001, China

Received:2017-06-12 Revised:2017-08-02 Online:2017-12-10 Published:2017-12-18

基于Linux名字空间的Web服务器动态防御方法

陈刚^1,2, 郭玉东^1,2, 魏小锋²

1. 信息工程大学, 郑州 450001;
2. 数学工程与先进计算国家重点实验室, 郑州 450001

通讯作者: 陈刚
作者简介:陈刚(1992-),男,河南民权人,硕士研究生,主要研究方向:系统安全、云计算;郭玉东(1964-),男,河南太康人,教授,硕士,主要研究方向:操作系统、虚拟化;魏小锋(1985-),男,山东枣庄人,硕士,主要研究方向:信息安全。

Abstract

Abstract: Web servers are widely deployed on cloud computing platform represented by Docker containers and face serious security challenges. In order to improve the security and defense capability of such Web servers, a dynamic defense method of Web server based on Linux namespace was proposed. Firstly, the running environment of Web server was built by using namespace on the premise to ensure Web service working normally. Then, the dynamic transformation of Web server was realized by the alternate running of multiple environments to confuse intruder, which increased the difficulty of attacking Web server by the intruder. Finally, the running environment of Web server was periodically deleted and rebuilt to eliminate the impact of intrusion behavior on the Web server, and ultimately the dynamic defense capability of Web server was effectively improved. The experimental results show that, the proposed method can effectively enhance the security of Web server while it has little affect on system performance, and its response time of requesting 100 KB data is 0.02-0.07 ms.

Key words: container, Linux namespace, dynamic defense, virtualization

摘要： Web服务器广泛部署在以Docker容器为代表的云计算平台上，面临着严峻的安全挑战。为了提高此类Web服务器的安全防御能力，提出一种基于Linux名字空间的Web服务器动态防御方法。该方法能够保证在Web服务正常工作的前提下，首先使用名字空间构建Web服务器运行环境；其次，通过多环境的交替运行来实现Web服务器的动态变换以迷惑入侵者，增加入侵者对Web服务器的攻击难度；最后，通过定期主动清除并重建Web服务器的运行环境来消除入侵行为对Web服务器的影响，最终实现有效提高Web服务器的动态防御能力。实验结果表明，所提方法能够有效增强Web服务器的安全性，同时对系统性能影响很小，请求响应100 KB数据的时间损耗为0.02~0.07 ms。

关键词: 容器, Linux名字空间, 动态防御, 虚拟化

CLC Number:

TP393.08

CHEN Gang, GUO Yudong, WEI Xiaofeng. Dynamic defense method of Web server based on Linux namespace[J]. Journal of Computer Applications, 2017, 37(12): 3442-3446.

陈刚, 郭玉东, 魏小锋. 基于Linux名字空间的Web服务器动态防御方法[J]. 计算机应用, 2017, 37(12): 3442-3446.

References

[1] 中国信息通信研究院.2016年云计算白皮书[R].北京:中国信息通信研究院,2016.(China Academy of Information and Communications Technology. 2016 Cloud Computing White Paper[R]. Beijing:China Academy of Information and Communications Technology, 2016.)
[2] SINGER P W, FRIEDMAN A. Cybersecurity and Cyberwar:What Everyone Needs to Know[M]. Oxford:Oxford University Press, 2014:12-45.
[3] BUI T. Analysis of docker security[EB/OL].[2017-04-20]. https://www.researchgate.net/publication/270906436_Analysis_of_Docker_Security.
[4] CHUNG C J, KHATKAR P, XING T Y, et al. NICE:network intrusion detection and countermeasure selection in virtual network systems[J]. IEEE Transactions on Dependable and Secure Computing, 2013, 10(4):198-211.
[5] XU H, CHEN X, ZHOU J M, et al. Research on basic problems of cognitive network intrusion prevention[C]//Proceedings of the 2013 Ninth International Conference on Computational Intelligence and Security. Washington, DC:IEEE Computer Society, 2013:514-517.
[6] MADAN B B, GOŠEVA-POPSTOJANOVA K, VAIDYANATHAN K, et al. A method for modeling and quantifying the security attributes of intrusion tolerant systems[J]. Performance Evaluation, 2004, 56(1/2/3/4):167-186.
[7] OKHRAVI H, HOBSON T, BIGELOW D, et al. Finding focus in the blur of moving-target techniques[J]. IEEE Security & Privacy, 2014, 12(2):16-26.
[8] AZAB M, MOKHTAR B, ABED A S, et al. Toward smart moving target defense for Linux container resiliency[C]//Proceedings of the 2016 IEEE 41st Conference on Local Computer Networks. Piscataway, NJ:IEEE, 2016:619-622.
[9] 仝青,张铮,张为华,等.拟态防御Web服务器设计与实现[J].软件学报,2017,28(4):883-897.(TONG Q, ZHANG Z, ZHANG W H, et al. Design and implementation of mimic defense Web server[J]. Journal of Software, 2017, 28(4):883-897.)
[10] BANGALORE A K, SOOD A K. Securing Web servers using Self Cleansing Intrusion Tolerance (SCIT)[C]//Proceedings of the 2009 Second International Conference on Dependability. Piscataway, NJ:IEEE, 2009:60-65.
[11] BIEDERMAN E W. Multiple instances of the global Linux namespaces[EB/OL].[2017-05-06]. http://www.landley.net/kdocs/ols/2006/ols2006v1-pages-101-112.pdf.
[12] ROSEN R. Linux containers and the future cloud[J]. Linux Journal, 2014, 2014(240):Article No. 3.
[13] BABAR M A, RAMSEY B. Understanding container isolation mechanisms for building security-sensitive private cloud[R]. Adelaide, Australia:University of Adelaide, Centre for Research on Engineering Software Technologies, 2017.
[14] DUA R, RAJA A R, KAKADIA D. Virtualization vs containerization to support PaaS[C]//Proceedings of the 2014 IEEE International Conference on Cloud Engineering. Piscataway, NJ:IEEE, 2014:610-614.
[15] TANENBAUM A S, VAN STEEN M. Distributed Systems:Principles and Paradigms[M]. 2nd ed. Upper Saddle River, NJ:Prentice-Hall, 2007:545-585.
[16] CARLSON J L. Redis in Action[M]. Greenwich, CT:Manning Publications, 2013:90-110.

Dynamic defense method of Web server based on Linux namespace

基于Linux名字空间的Web服务器动态防御方法

PDF

Knowledge

Abstract

Cite this article

share this article

References

Related Articles 15

Recommended Articles

Metrics

[1]	Gang CHEN, Xiangru MENG, Qiaoyan KANG, Yong YANG. Virtual software defined network mapping algorithm based on topology segmentation and clustering analysis [J]. Journal of Computer Applications, 2021, 41(11): 3309-3318.
[2]	ZHENG Hongxing, ZHU Xutao, LI Zhenfei. Optimization algorithm of ship dispatching in container terminals with two-way channel [J]. Journal of Computer Applications, 2021, 41(10): 3049-3055.
[3]	GAO Yilu, HU Zhihua. Path planning for automated guided vehicles based on tempo-spatial network at automated container terminal [J]. Journal of Computer Applications, 2020, 40(7): 2155-2163.
[4]	MAO Minli, LIANG Chengji, HU Xiaoyuan. Optimization of quay crane assignment based on ship efficiency [J]. Journal of Computer Applications, 2020, 40(4): 1223-1230.
[5]	ZHAO Jihong, WU Doudou, QU Hua, YIN Zhenyu. Survivable virtual network embedding guarantee mechanism based on software defined network [J]. Journal of Computer Applications, 2020, 40(3): 770-776.
[6]	ZHOU Leilei, LIANG Chengji, HU Xiaoyuan. Delivery truck strategy under uncertain interference constraints [J]. Journal of Computer Applications, 2020, 40(3): 891-896.
[7]	XU Yingxin, SUN Lei, ZHAO Jiancheng, GUO Songhui. Virtual field programmable gate array placement strategy based on ant colony optimization algorithm [J]. Journal of Computer Applications, 2020, 40(3): 747-752.
[8]	LIU Fuxin, LI Jingwei, WANG Yihong, LI Lin. Design and implementation of cloud native massive data storage system based on Kubernetes [J]. Journal of Computer Applications, 2020, 40(2): 547-552.
[9]	LIU Weirong, ZHEN Hong. Modeling and simulation of container transportation process in blockchain based container sharing mode [J]. Journal of Computer Applications, 2019, 39(7): 2141-2147.
[10]	LI Qirui, PENG Zhiping, CUI Delong, HE Jieguang. Optimization of virtual resource deployment strategy in container cloud [J]. Journal of Computer Applications, 2019, 39(3): 784-789.
[11]	WANG Zhiwei, YANG Chao. Bandwidth control mechanism for Docker container network based on traffic control [J]. Journal of Computer Applications, 2019, 39(12): 3628-3632.
[12]	MAO Yingchi, HAO Shuai, PING Ping, QI Rongzhi. Cloud resource scheduling method based on combinatorial double auction [J]. Journal of Computer Applications, 2019, 39(1): 1-7.
[13]	FAN Hongwei, HU Yuxiang, LAN Julong. Two-stage hardware acceleration resource deployment mechanism for virtual network function [J]. Journal of Computer Applications, 2018, 38(9): 2575-2580.
[14]	LU Zicong, XU Kaiyong, GUO Song, XIAO Jingxu. Dynamic measurement of Android kernel based on ARM virtualization extension [J]. Journal of Computer Applications, 2018, 38(9): 2644-2649.
[15]	LI Shuai, SUN Lei, GUO Songhui. Interrupt path optimization method of virtual cryptographic device with reducing context switching [J]. Journal of Computer Applications, 2018, 38(7): 1946-1950.