As a defense technology with endogenous security, mimic defense plays an important role in network security research. The scheduling of executors is one of the severe problems to take into account for mimic defense, and current research lacks comprehensive consideration of the influence of system architecture and attack behavior on scheduling algorithm. Based on previous research, this paper first introduces concept of heterogeneity and confidence according to vulnerability attributes and attack distribution characteristics to characterize the executors. Moreover, the TOPSIS (Technique for Order Preference by Similarity to an Ideal Solution) algorithm is brought in to optimize the system security and improve operating efficiency. Experimental results showed that,compared with the existing algorithms, Random, MD, RSMS, it improves the security of the system in non-uniform distributed attack scenario and the operating efficiency in each attack scenario.

At present, attacks based on the vulnerability of the controller and flooding attacks still constitute a principal threat for hierarchical Software Defined Network (SDN), such as flow table tampering, malicious Application attacks, Distributed Denial of Service (DDoS) etc., due to the limitation against attacks based on known or unknown vulnerabilities for traditional cyber defence technology. Therefore, this study proposes an active defence architecture based on Mimic Defence (MD)–Mimic Hierarchical SDN Framework (MHSDN). Then endogenous security of MHSDN is theoretically analysed. Simultaneously, the attack surface measurement of MD is innovatively proposed, further improving the security and usability measurement standards of the MD system. Finally, to speed up detection and reduce defence cost of DDoS, this research proposes the Random Forest Feature Extract (RFFE) and tolerable switch migration. Simulation shows that RFFE has achieved a faster detection speed at the cost of less detection accuracy, and MHSDN can better improve the reliability of hierarchical SDN.

SDN (Software-Defined Networking) renders network management more centralized and flexible. However, its control plane is vulnerable to attacks. By introducing dynamic heterogeneous redundancy, the amimic control plane is built to effectively solve the problems of single control points of failure, unknown backdoor vulnerabilities and static configuration. Heterogeneity is an important indicator for evaluating the security of a system. Generally speaking, the greater the heterogeneity, the higher the security. Currently, there is little research evaluating the security of the mimic control plane in SDN by quantifying the heterogeneity. To this end, this paper proposes two methods for measuring the heterogeneity, based on the biological population diversity assessment method. Firstly, the heterogeneity quantification method, i.e., method 1, is based on system complexity and difference. On this basis, another heterogeneous quantification method, i.e., method 2, is established using high order symbiosis of the vulnerabilities. The experimental results show that, compared to the known methods, the heterogeneous quantification method 1 considers more comprehensive factors and is closer to reality. The heterogeneity quantification method 2 is more instructive to quantify the security of the mimic control plane.

With the rapid development of network technology, the traditional defense of “mending the fold after the sheep have been stolen” cannot accurately prevent various potential threats and attacks in cyberspace. At the same time, cyberspace mimic defense (CMD) makes the system uncertain and dynamic in time and space to effectively defend against potential attacks. As the key technology of CMD, the scheduling algorithm still needs to be improved in reliability and active defense. Aiming at current problems, this paper first innovatively proposes a new heterogeneous measure algorithm HVTG combined with a vulnerability topology graph, which measures the heterogeneity of executor set in a fine-grained manner. Then, based on the historical confidence, heterogeneity, and minimum sleep time of the executor, we propose an adaptive multi-executors scheduling algorithm (HHAC) to better defend against various attacks. Finally, combining with Analytic Hierarchy Process and Fuzzy Comprehensive Evaluation, this research proposes a comprehensive evaluation model and fill in the gap of the evaluation model of the scheduling algorithm. Theoretical analysis and simulation results show that the HHAC performs well on the system dynamics, probability of system failure, and reliability, which is conducive to the development of CMD.