Abstract: Aiming at the problem that IPv6 nodes are easily under probing attack by an attacker while end-to-end communication is restored in the IPv6 network, a proactive defense model of Address Hopping based on Sliding Time Window in IPv6 (AHSTW) was proposed. Session parameters such as the address hopping interval were firstly negotiated by using the shared key, and then the concept of sending and receiving time window was introduced. The two communication parties sent or received only the packets in the time window, through a Time Window Adaptive Adjustment (TWAA) algorithm. According to the change of network delay, the time window could be adjusted in time to adapt to the changes of the network environment. The theoretical analysis shows that the proposed model can effectively resist the data interception attacks and Denial of Service (DoS) attacks on the target IPv6 nodes. The experimental results show that in the transmission of the same data packet size, the extra CPU overhead of AHSTW model is to 2-5 percentage points, with no significant increase in communication cost and no significant decline in communication efficiency. The addresses and ports of two communication parties are random, decentralized, out of order and so on, which greatly improves the cost and difficulty of attackers and protects the network security of IPv6.

Key words: IPv6, address hopping, proactive defense, self-adaption, Denial of Service (DoS)

摘要： 针对IPv6恢复端到端通信，IPv6节点易被攻击者探测攻击等问题，提出一种基于滑动时间窗口的IPv6地址跳变（AHSTW）主动防御模型。首先通过共享密钥进行地址跳变间隔等会话参数的协商，之后引入收发时间窗口的概念，通信双方仅发送或接收处于时间窗口内的数据包，通过时间窗口自适应调整（TWAA）算法，依据网络时延的变化及时调整时间窗口大小以适应网络环境的变化。理论分析证明，该模型能够有效抵抗攻击者对目标IPv6节点的数据截获分析攻击和拒绝服务攻击（DoS）。实验结果表明，在传输相同数据包大小时，AHSTW的额外CPU开销在2~5个百分点，并无显著提高，通信效率并无显著下降；在通信过程中，通信双方地址与端口呈随机、分散、无序等特点，极大增加了攻击者的开销与攻击难度，保护了IPv6网络安全。

关键词: IPv6, 地址跳变, 主动防御, 自适应, 拒绝服务攻击