基于路径定位与规模聚合的跨域网络防御策略一致性验证方法

doi:10.3969/j.issn.1671-1122.2026.06.007

信息网络安全 ›› 2026, Vol. 26 ›› Issue (6): 925-943.doi: 10.3969/j.issn.1671-1122.2026.06.007

基于路径定位与规模聚合的跨域网络防御策略一致性验证方法

刘馨璐¹(), 常德显¹^,², 张大伟¹

¹ 网络空间部队信息工程大学密码工程学院，郑州 450001
² 河南省信息安全重点实验室，郑州 450001

收稿日期:2025-11-24 出版日期:2026-06-10 发布日期:2026-07-27
通讯作者: 刘馨璐 E-mail:347980008@qq.com
作者简介:刘馨璐（2001—），女，辽宁，硕士研究生，主要研究方向为网络主动防御|常德显（1977—），男，河南，副教授，博士，主要研究方向为网络信息防御|张大伟（1996—），男，安徽，硕士研究生，主要研究方向为网络安全管理
基金资助:
中国博士后科学基金(GZC20240321)

A Consistency Verification Method for Cross-Domain Network Defense Strategies Based on Path Location and Scale Aggregation

LIU Xinlu¹(), CHANG Dexian¹^,², ZHANG Dawei¹

¹ School of Cyptography Engineering, Cyberspace Force Information Engineering University, Zhengzhou 450001, China
² Henan Provincial Key Laboratory of Information Security, Zhengzhou 450001, China

Received:2025-11-24 Online:2026-06-10 Published:2026-07-27
Contact: LIU Xinlu E-mail:347980008@qq.com

摘要/Abstract

摘要：

随着软件定义网络在云网融合的多域环境中泛化部署，跨域防御策略的一致性验证已成为保障网络服务质量与安全的关键挑战。传统全路径验证方法因计算与通信开销过大，缺乏动态适应性，难以适用于大规模云网环境下的轻量级验证场景。基于此文章提出一种轻量级跨域网络防御策略验证方法。首先，设计了一种基于深度强化学习与最优监控分配的混合算法，动态精准定位策略影响的关键路径与最小监控点集，避免了全网范围的下发与探测。其次，构建了多目标优化的任务调度模型，综合策略紧急度、重要性及网络负载等因素动态调整并验证优先级，实现验证资源的高效利用。实验结果表明，与现有方法相比，本文方法适用于大规模动态跨域SDN环境。

关键词: 跨域管理, 策略验证, 深度强化学习, 多目标优化

Abstract:

With the generalized deployment of software defined network in the multi-domain environment of cloud-network convergence, the consistency verification of cross-domain defense strategies has become a key challenge in ensuring the quality and security of network services. The traditional full-path verification method is difficult to be applied to lightweight verification scenarios in large-scale cloud network environments due to its excessive computational and communication overheads and lack of dynamic adaptability. This paper proposed a lightweight verification method for cross-domain network defense strategies. Firstly, a hybrid algorithm based on deep reinforcement learning and optimal monitoring allocation was designed to dynamically and accurately locate the critical path and the minimum monitoring point set affected by the strategy, avoiding the distribution and detection across the entire network. Secondly, a multi-objective optimization task scheduling model was constructed. The verification priority was dynamically adjusted by comprehensively considering factors such as the urgency, importance of the strategy, and network load to achieve efficient utilization of verification resources. The experimental results show that, compared with the existing methods, the method proposed in this paper is suitable for large-scale dynamic cross-domain SDN environments.

Key words: cross-domain management, strategy verification, deep reinforcement learning, multi-objective optimization

中图分类号:

TP309

刘馨璐, 常德显, 张大伟. 基于路径定位与规模聚合的跨域网络防御策略一致性验证方法[J]. 信息网络安全, 2026, 26(6): 925-943.

LIU Xinlu, CHANG Dexian, ZHANG Dawei. A Consistency Verification Method for Cross-Domain Network Defense Strategies Based on Path Location and Scale Aggregation[J]. Netinfo Security, 2026, 26(6): 925-943.

图/表 9

图1

表1

表2

图2

图3

表3

表4

图4

表5

参考文献 19

[1]	KREUTZ D, RAMOS F M V, VERISSIMO P E, et al. Software-Defined Networking: A Comprehensive Survey[J]. The IEEE, 2015, 103(1): 14-76.
[2]	KARAKUS M, DURRESI A. A survey: Control Plane Scalability Issues and Approaches in Software-Defined Networking (SDN)[J]. Computer Networks, 2017, 112: 279-293.
[3]	ZOU Xiang, JIN Bo, NI Lishun. Research on Cross-Domain Access Control and Border Defense Method[J]. Application Research of Computers, 2010, 27(4): 1481-1484.
	邹翔, 金波, 倪力舜. 跨域访问控制与边界防御方法研究[J]. 计算机应用研究, 2010, 27(4):1481-1484.
[4]	WANG Bolan, LIU Rui, GAO Pu. Prospect and Key Technology Analysis of Future Intelligent Cross-Domain Elastic Defense System[J]. Journal of Nanjing University of Aeronautics & Astronautics, 2022, 54(5): 1-8.
	王波兰, 刘瑞, 高璞. 未来智能跨域弹性防御体系展望及关键技术分析[J]. 南京航空航天大学学报, 2022, 54(5): 1-8.
[5]	AMIN R, SHAH N, SHAH B, et al. Auto-Configuration of ACL Policy in Case of Topology Change in Hybrid SDN[J]. IEEE Access, 2016, 4: 9437-9450.
[6]	ZHANG Delong, YE Chong, HE Fei. P4Inv: Inferring Packet Invariants for Verification of Stateful P4 Programs[C]//IEEE. INFOCOM 2024-IEEE Conference on Computer Communications. New York: IEEE, 2024: 2129-2138.
[7]	CHEN Zhuo, LI Hao, WANG Peng, et al. Dynamic Topology Adaptation in SDN: Challenges and Solutions for Consistent Policy Verification[J]. IEEE Transactions on Network and Service Management, 2022, 19(4): 2456-2470.
[8]	LEE Y, CONTRERAS M, KING D, et al. Architecture for Abstraction and Control of TE Networks (ACTN)[R]. Fremont, CA: Internet Engineering Task Force (IETF), RFC 8453, 2018.
[9]	ZHANG Wen. Research on Cross-Domain Routing and Network Function Resource Optimization in SDN Networks[D]. Hefei: University of Science and Technology of China, 2016.
	张文. SDN网络下跨域路由及网络功能体资源优化研究[D]. 合肥: 中国科学技术大学, 2016.
[10]	ZHOU Ning, HU Tao, HU Yuxiang, et al. Multi-Domain Collaborative Control Mechanism for Software Defined Networks Based on Proximity Context Awareness[J]. Journal of Computer Applications Research, 2020, 37(10): 3143-3146.
	周宁, 胡涛, 胡宇翔, 等. 基于近邻情景认知的软件定义网络多域协同控制机制[J]. 计算机应用研究, 2020, 37(10):3143-3146.
[11]	LIU Sheng, BENSON T A, REITER M K. Efficient and Safe Network Updates with Suffix Causal Consistency[C]// ACM. The Fourteenth EuroSys Conference 2019. New York:ACM. 2019: 1-15.
[12]	LIN Shichang, AKYILDIZ I F, WANG Pu, et al. QoS-Based Deep Reinforcement Learning Routing for Software-Defined Networks[J]. IEEE Transactions on Network and Service Management, 2020, 17(2): 876-889.
[13]	MAI H, KHURSHID A, AGARWAL R, et al. Debugging the Data Plane with Anteater[J]. ACM SIGCOMM Computer Communication Review, 2011, 41(4): 290-301.
[14]	KHURSHID A, ZHOU Wenxuan, CAESAR M, et al. VeriFlow: Verifying Network-Wide Invariants in Real Time[C]// ACM. The First Workshop on Hot Topics in Software Defined Networks. New York: ACM, 2012: 49-54.
[15]	CHERAGHALIKHANI M, AZIZI Z, BHATNAGAR S, et al. Structure-Aware Feature Stylization for Domain Generalization[J]. Computer Vision and Image Understanding, 2024, 244: 104016.
[16]	OQAILEY A, JARRAYA Y, WANG Lingyu, et al. MLFM: Machine Learning Meets Formal Method for Faster Identification of Security Breaches in Network Functions Virtualization (NFV)[C]// Springer. European Symposium on Research in Computer Security. Heidelberg: Springer, 2022: 466-489.
[17]	KAZEMIAN P, VARGHESE G, MCKEOWN N. Header Space Analysis: Static Checking for Networks[C]// USENIX. The 9th USENIX Conference on Networked Systems Design and Implementation. Berkeley: USENIX, 2012: 113-126.
[18]	PRAKASH C, LEE J, TURNER Y, et al. FlowGuard: Building Robust Firewalls for Software-Defined Networks[C]//ACM. The Third Workshop on Hot Topics in Software Defined Networking. New York: ACM, 2014: 1-6.
[19]	TRIPATHY B K, SETHY A G, BERA P, et al. A Novel Secure and Efficient Policy Management Framework for Software Defined Network[C]//IEEE. 2016 IEEE 40th Annual Computer Software and Applications Conference (COMPSAC). New York: IEEE, 2016: 423-430.

系统负载状态	${{w}_{u}} $	${{w}_{i}} $	${{w}_{r}} $	调度策略
低负载(<30%)	0.50	0.40	0.10	优先紧急和重要任务
正常负载(30%~70%)	0.40	0.35	0.25	平衡调度
高负载(>70%)	0.20	0.30	0.50	优先资源友好型任务

组件	版本/配置	说明
网络仿真	Mininet 2.3.0	虚拟网络拓扑
SDN控制器	ONOS 2.7.0, OpenDaylight Carbon, RYU 4.34	3个域分别使用不同的控制器
消息中间件	Apache Kafka 3.3.1 (3节点集群)	处理跨域策略同步
监控系统	Prometheus 2.40.5+Grafana 9.3.2	采集性能指标（时延、内存）
策略生成与检测	Python 3.9,Custom Scripts	策略注入、冲突检测核心算法实现
机器学习框架	TensorFlow 2.8.0+Keras	DRL智能体训练与推理
数据平面	Open vSwitch 2.17.0	6台虚拟交换机

方法	路径发现准确率	平均监控点数/个	计算时延 /ms	吞吐量/策略·min^-1	内存占用 /MB
本文方法	94.2%±1.5%	4.1±0.6	152±18	19.8±2.3	45.2±3.1
FPV	98.7%±0.5%	10.5±0.1	423±35	6.2±1.1	210.5±15.3
FlowGuard	92.1%±1.8%	5.8±0.7	187±22	16.5±2.0	85.6±6.8
PolicyGuard	91.5%±2.1%	5.2±0.8	165±20	17.8±2.1	92.3±7.2

配置方案	路径发现准确率	平均监控点数 /个	系统吞吐量/策略·min^-1	资源利用率
完整系统	96.8%±1.2%	2.3±0.4	22.5±2.1	78.4%±3.2%
无DRL	72.5%±3.5%	3.1±0.6	15.2±1.8	65.3%±4.1%
无OMA	98.1%±0.8%	6.0±1	14.8±1.5	45.6%±2.9%
无调度	96.5%±1.3%	2.4±0.5	18.7±1.9	62.1%±3.8%
随机方法	68.4%±4.2%	7.3±1.2	8.5±2.3	38.2%±5.2%

指标	系统吞吐量 /策略·min^-1	任务完成时间/s	CPU利用率	内存利用率	并行子任务数/个
本文方法（启用拆分）	24.8±2.1	242±18	78.5%±3.2%	72.3%±2.8%	3
传统方法（禁用拆分）	8.5±1.1	705±45	65.2%±4.1%	68.7%±3.5%	1

基于路径定位与规模聚合的跨域网络防御策略一致性验证方法

A Consistency Verification Method for Cross-Domain Network Defense Strategies Based on Path Location and Scale Aggregation

RichHTML

PDF (PC)

可视化

摘要/Abstract

引用本文

使用本文

图/表 9

参考文献 19

相关文章 1

编辑推荐

Metrics

本文评价