CN117938543B - A network dynamic defense method and system based on topology difference measurement - Google Patents

Abstract

The invention belongs to the technical field of industrial control safety, and discloses a network dynamic defense method and system based on topology difference measurement, wherein the method is characterized in that an initial network topology is drawn, the initial network topology is abstract modeled into an undirected and unauthorized connected graph, and the characteristic value of the connected graph is calculated; adjusting connection relations among network nodes based on the initial network topology, and generating a variant of the initial network topology as a new network topology; calculating a difference value between the new network topology and the initial network topology by using the characteristic value sequence of the connected graph; selecting a new network topology with a great difference value from the initial network topology in a fixed hopping period as a hopping target network topology; and restoring the jump target network topology into a flow table, pushing the flow table to each switch, and finishing network topology jump, thereby realizing network dynamic defense. The invention can maximize the topology difference before and after the jump, reduce the number of invalid jump, reduce the jump expenditure and improve the efficiency of network topology protection.

Description

A network dynamic defense method and system based on topology difference measurement

Technical Field

The present invention belongs to the technical field of industrial control security, and in particular relates to a network dynamic defense method and system based on topology difference measurement.

Background technique

Traditional static network security defense is in a situation of "easy to attack but difficult to defend" due to the prevalence of vulnerabilities and asymmetric information between attack and defense. Faced with unknown security vulnerabilities and endless attack methods, defenders are often in a passive defense situation, and static defense methods are generally lagging and blind. The emergence of dynamic network defense has changed the traditional passive and static defense ideas. Network dynamic defense technology constantly changes the state of the network, so that the attack surface that attackers try to obtain is in dynamic change, which increases the difficulty and cost of attackers to detect the attack surface, obtain the attack chain, and implement the attack. Compared with traditional static network defense methods, network dynamic defense reverses the asymmetric situation of attack and defense, and has the advantages of being dynamic, timely, and efficient.

For network attacks, detecting and scanning the target network topology and selecting the appropriate target and attack plan are important pre-steps, so the protection of network topology is an important part of network dynamic defense. However, the current dynamic topology protection method still has the problem that the topology before and after the change may have a large similarity and high overhead.

Summary of the invention

The purpose of the present invention is to propose a network dynamic defense method and system based on topology difference measurement. The present invention performs jumps based on topology difference measurement, maximizes the topology difference before and after the jump while maintaining normal network communication services, and reduces the number of invalid jumps to reduce the jump overhead, thereby resisting attackers' scanning and mapping of the network topology and improving the effectiveness of network topology protection.

In order to achieve the above purpose, the present invention mainly implements dynamic protection for the network system by defining the network topology difference value before and after the jump, and quantitatively solving the new topology with a large topology difference value. The technical solution of the present invention is as follows: A network dynamic defense method based on topology difference measurement, comprising:

Draw the initial network topology, abstractly model the initial network topology as an undirected and unweighted connected graph, and calculate the eigenvalues of the connected graph;

Adjusting the connection relationship between network nodes based on the initial network topology to generate a variant of the initial network topology, wherein the variant serves as a new network topology;

The difference between the new network topology and the initial network topology is calculated using the eigenvalue sequence of the connected graph; the new network topology with the largest difference from the initial network topology is selected as the jump target network topology within a fixed jump period;

The target network topology is restored to a flow table and pushed to each switch to complete the network topology jump, thereby achieving dynamic network defense.

Further preferably, the initial network topology is abstractly modeled as an undirected and unweighted connected graph, specifically: the initial network topology _G1 is abstractly modeled as a connected graph _G1 (V,E) without self-loops and multiple edges, wherein V={ _v1 , _v2 ,…, _vi ,…, _vn } represents the set of network nodes, _vi represents the i-th network node, i∈1～n, n is the number of network nodes; E={ _e1 , _e2 ,…,e _k ,…,e _m } represents the set of links between network nodes, wherein e _k represents the k-th link e _k , representing the direct connection relationship between two network nodes connected by link e _k , k∈1～m, m is the number of links.

Further preferably, the calculation process of the eigenvalue of the connected graph is:

Obtain the degree sequence of the connected graph, convert the degree sequence into a diagonal matrix to obtain the degree diagonal matrix of the connected graph, and obtain the adjacency matrix of the connected graph;

Subtract the degree diagonal matrix from the adjacency matrix to get the difference matrix, and obtain the eigenvalue sequence of the difference matrix, which is the eigenvalue sequence of the connected graph.

Further preferably, adjusting the connection relationship between network nodes based on the initial network topology to generate a variant of the initial network topology includes the following sub-processes:

Input the connectivity graph of the initial network topology;

Network node connection switching: Starting from any network node, disconnect other network nodes adjacent to the network node, and randomly select other network nodes different from the network node and its adjacent network nodes for connection;

Repeat the network node connection switching until all network nodes have disconnected their original connections and generated new connections;

If there are isolated network nodes, the isolated network nodes are connected to any other connected network nodes in the network topology until the topology becomes a connected graph, and the connected graph of the new network topology is returned.

Further preferably, the difference between the new network topology and the initial network topology is calculated by using the characteristic value sequence of the connectivity graph; and the new network topology having a large difference value with the initial network topology is selected as the jump target network topology within a fixed jump period. The specific process is as follows:

Call the generated new network topology;

The difference value δ(G ₁ ,G _new ) between the new network topology and the initial network topology is calculated using the eigenvalue sequence of the connectivity graph. δ _crit is the critical value of the difference value between the two network topologies at the significance level. When δ(G ₁ ,G _new )≥δ _crit , it is considered that there is a significant difference between the two network topologies at the confidence level; otherwise, there is no significant difference.

Within the jump cycle, if the difference between the newly generated network topology with significant differences and the initial network topology is greater than the difference in the previous cycle, the jump target network topology is updated, otherwise the new network topology is regenerated and the difference value is calculated; at the end of the jump cycle, the final jump target network topology is obtained.

Furthermore, the difference between the new network topology and the initial network topology is calculated by using the eigenvalue sequence of the connectivity graph. The specific formula is as follows:

;

Wherein, μ _i (G ₁ ) represents the i-th eigenvalue of the connected graph of the initial network topology G ₁ , μ _i (G _new ) represents the i-th eigenvalue of the connected graph of the new network topology G _new , and θ _i represents the weight of the i-th eigenvalue.

The present invention also provides a network dynamic defense system based on topology difference measurement, comprising:

The network topology initialization module is used to draw the initial network topology, abstractly model the initial network topology as an undirected and unweighted connected graph, and calculate the eigenvalues of the connected graph;

A new network topology generation module, used for adjusting the connection relationship between network nodes based on the initial network topology, and generating a variant of the initial network topology, wherein the variant serves as the new network topology;

The jump target network topology screening module is used to calculate the difference between the new network topology and the initial network topology by using the characteristic value sequence of the connected graph; and select the new network topology with a large difference value from the initial network topology as the jump target network topology within a fixed jump period;

The jump control module is used to restore the jump target network topology into a flow table and push it to each switch;

The switch is responsible for deploying the received flow table, adjusting the routing information, and then changing the network topology to achieve dynamic network defense.

Further preferably, the execution process of the new network topology generation module is as follows:

Input the connectivity graph of the initial network topology;

Network node connection switching: Starting from any network node, disconnect other network nodes adjacent to the network node, and randomly select other network nodes different from the network node and its adjacent network nodes for connection;

Repeat the network node connection switching until all network nodes have disconnected their original connections and generated new connections;

If there are isolated network nodes, the isolated network nodes are connected to any other connected network nodes in the network topology until the topology becomes a connected graph, and the connected graph of the new network topology is returned.

Further preferably, the execution process of the target network topology screening module is as follows:

Call the generated new network topology;

The difference value δ(G ₁ ,G _new ) between the new network topology and the initial network topology is calculated using the eigenvalue sequence of the connectivity graph. δ _crit is the critical value of the difference value between the two network topologies at the significance level. When δ(G ₁ ,G _new )≥δ _crit , it is considered that there is a significant difference between the two network topologies at the confidence level; otherwise, there is no significant difference.

Within the jump cycle, if the difference between the newly generated network topology with significant differences and the initial network topology is greater than the difference in the previous cycle, the jump target network topology is updated, otherwise the new network topology is regenerated and the difference value is calculated; at the end of the jump cycle, the final jump target network topology is obtained.

The present invention also provides a computer-readable storage medium having a computer program stored thereon, and when the computer program is executed, the above-mentioned network dynamic defense method based on topology difference measurement is implemented.

The present invention has the following advantages: in a network of limited size, the process of implementing network topology jump includes quantifying the difference value of the new and old network topologies, obtaining a new topology with a large topology difference value, thereby avoiding the failure of network topology jump defense caused by network topology similarity. The frequency of network topology jump is reduced by setting a fixed jump period and excluding invalid jumps, thereby reducing the overhead of network topology jump.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG1 is a connectivity diagram of an initial network topology according to an embodiment of the present invention;

FIG2 is a connectivity diagram of a new network topology generated for the first time according to an embodiment of the present invention;

FIG3 is a connectivity diagram of a new network topology generated for the second time according to an embodiment of the present invention;

FIG4 is a flow chart of the method of the present invention;

FIG5 is a flow chart of generating a new network topology according to the present invention.

Detailed ways

In order to make the purpose, technical solution and advantages of the present invention clearer and more specific, the technical solution of the present invention will be further described in detail with reference to the accompanying drawings and specific implementation methods. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not used to limit the present invention.

The process and method of the present invention will be further described below in conjunction with Figures 1 to 4. A network dynamic defense method based on topology difference measurement includes:

S1: Draw the initial network topology, abstractly model the initial network topology as an undirected and unweighted connected graph, and calculate the eigenvalues of the connected graph. In order to facilitate calculation and abstraction, the initial network topology is simplified, the weights of the connectivity relationships between nodes are ignored, the communication delay between source and destination node pairs is ignored, and the initial network topology is abstracted as an undirected and unweighted connected graph. Specifically, this embodiment is described with the network topology corresponding to FIG1.

S101: Abstractly model the initial network topology G ₁ as a connected graph G ₁ (V,E) without self-loops and multiple edges, where V = {v ₁ ,v ₂ ,…, _vi ,…,v _n } represents the set of network nodes, _vi represents the i-th network node, i∈1～n, n is the number of network nodes; E = {e ₁ ,e ₂ ,…,e _k ,…,e _m } represents the set of links between network nodes, where e _k represents the k-th link e _k , representing the direct connection relationship between two network nodes connected by link e _k , k∈1～m, m is the number of links. As shown in Figure 1, a connected graph G ₁ (V, E) is established, where the network node set is V = {v ₁ ,v ₂ ,v ₃ ,v ₄ ,v ₅ ,v ₆ ,v ₇ ,v ₈ }, and the link set between network nodes is: E = {e ₁ ,e ₂ ,e ₃ ,e ₄ ,e ₅ ,e ₆ ,e ₇ }.

S102: Obtain the degree sequence {d ₁ , d ₂ , …, d _n } of the connected graph G ₁ (V, E), where d ₁ , d ₂ , …, d _n represent the 1st, 2nd, …, nth degrees of the connected graph G ₁ (V, E) respectively. Convert the degree sequence into a diagonal matrix to obtain the degree diagonal matrix D(G ₁ ) =diag(d ₁ , d ₂ , …, d _n ) of the connected graph G ₁ (V, E). Obtain the adjacency matrix A(G ₁ ) of the connected graph G ₁ (V, E). The elements of the adjacency matrix A(G ₁ ) are A _ij . If the i-th network node _vi is adjacent to the j-th network node v _j , then A _ij =1, otherwise A _ij =0. The corresponding degree sequence of this embodiment is {1,1,1,1,1,1,4,4}, the corresponding degree diagonal matrix is diag(1,1,1,1,1,1,4,4), and the corresponding adjacency matrix is A( ) satisfies A ₁₇ =A ₂₇ =A ₃₇ =A ₄₈ =A ₅₈ =A ₆₈ =A ₇₁ =A ₇₂ =A ₇₃ =A ₇₈ =A ₈₄ =A ₈₅ =A ₈₆ =A ₈₇ =1, and the other elements are all 0.

S103: Subtract the degree diagonal matrix D(G ₁ ) from the adjacency matrix A(G ₁ ) to obtain the matrix {D(G ₁ )-A(G ₁ )}. Obtain the eigenvalue sequence {μ ₁ (G ₁ ), μ ₂ (G ₁ ), …, μ _n (G ₁ )} of the matrix {D(G ₁ )-A(G 1 ₎ }, μ ₁ (G ₁ ), μ ₂ (G ₁ ), …, μ _n (G ₁ ) respectively represent the 1st, 2nd, …, nth eigenvalues of the matrix {D(G ₁ )-A(G ₁ )}, the eigenvalue sequence of the matrix {D(G ₁ )-A(G ₁ )} is the eigenvalue sequence of the connected graph of the initial network topology G 1, μ ₁ (G ₁ ), μ ₂ (G ₁ ), …, μ _n (G ₁ ) represent the 1st, 2nd, …, nth eigenvalues of the connected graph of the initial network topology G _1. The eigenvalue sequence obtained in this embodiment is {0, 0.3542, 1, 1 _, 1, 1, 4, 5.6458}.

S2: Based on the initial network topology, adjust the connection relationship between network nodes and generate a variant of the initial network topology, which is used as the new network topology. In order to ensure that the communication service of the network will not be interrupted due to the change of network topology, the new network topology generation method needs to meet the connectivity constraint conditions, that is, any source and destination network node pairs that are connected in the initial network topology must also be connected in the new network topology. Referring to Figure 5, the new network topology generation includes the following sub-processes:

S201: Input the connected graph G ₁ (V, E) of the initial network topology;

S202: Starting from any network node, disconnect other network nodes adjacent to the network node, and randomly select other network nodes different from the network node and its adjacent network nodes for connection;

S203: Repeat step S202 until all network nodes have disconnected their original connections and generated new connections;

S204: If there is an isolated network node, connect the isolated network node to any other connected network node in the network topology until the topology becomes a connected graph, and return the connected graph G _new (V, E) of the new network topology G _new . This embodiment generates a connected graph G _new (V, E) of the new network topology G _new according to the above steps, as shown in FIG2 .

S3: Calculate the difference between the new network topology and the initial network topology using the eigenvalue sequence of the connectivity graph; select the new network topology with the largest difference from the initial network topology as the target network topology within a fixed jump period. The specific process is as follows:

S301: calling the new network topology G _new generated in step S2;

S302: Calculate the difference value δ(G ₁ ,G _new ) between the new network topology and the initial network topology using the eigenvalue sequence of the connectivity graph, where δ _crit is the critical value of the difference value between the two network topologies at the significance level. When δ(G ₁ ,G _new )≥δ _crit , it is considered that there is a significant difference between the two network topologies at the confidence level; otherwise, there is no significant difference.

;

Wherein, μ _i (G ₁ ) represents the i-th eigenvalue of the connected graph of the initial network topology G ₁ , μ _i (G _new ) represents the i-th eigenvalue of the connected graph of the new network topology G _new , and θ _i represents the weight of the i-th eigenvalue;

S303: Within the jump cycle, repeat steps S301 and S302 in a loop; if the difference between the newly generated new network topology G _new with significant difference and the initial network topology G ₁ is greater than the difference in the previous cycle, update the jump target network topology, otherwise enter the next cycle; at the end of the jump cycle, obtain the final jump target network topology.

The jump target network topology at the beginning of each jump cycle is empty. This embodiment calls the connected graph G _new1 (V, E) of the new network topology G _new1 generated for the first time by S2, as shown in FIG2 . The corresponding eigenvalue sequence obtained by calculation is {0, 0.1892, 0.8207, 1.2558, 2.2216, 3.3354, 3.7575, 4.4198}, and the weight sequence of the eigenvalues is {0, 1, 1, 1, 1, 1, 2}, and δ _crit is set to 2. Then, the difference value δ(G ₁ , G _new1 ) between the new network topology G _new1 generated for the first time and the initial network topology is 5.6255>2, which is considered to have a significant difference. The jump cycle has not ended, and the next cycle is entered.

In this embodiment, the connectivity graph of the new network topology G _new2 generated for the second time is called as shown in FIG3 . The corresponding eigenvalue sequence obtained by calculation is {0, 0.5188, 0.6571, 1, 2.3111, 2.5293, 4.1701, 4.8136}. The difference value δ(G ₁ , G _new2 )=5.1822>2 between the new network topology G _new1 generated for the first time and the initial network topology is calculated, which is considered to have a significant difference. The difference value is compared with the previous difference value, 5.1822<5.6255, that is, the difference value of the new network topology generated for the second time is smaller than that of the first time, so the update of the jump target network topology is abandoned and the next cycle is entered. Here, the difference value of the new network topology generated for the t+1th time is greater than the difference value of the new network topology generated for the tth time, so the jump target network topology is updated. By analogy, a jump target network topology with a large difference value is obtained at the end of the jump cycle.

S4: Restore the jump target network topology to a flow table and push it to each switch to complete the network topology jump, thereby realizing dynamic network defense. At the end of the jump cycle, the controller converts the jump target network topology into a flow table and pushes it to each switch. The switch forwards data according to the new flow table to realize the jump of the network topology.

Another embodiment of the present invention provides a network dynamic defense system based on topology difference measurement, which is composed of a controller and a plurality of switches, wherein the controller includes a network topology initialization module, a new network topology generation module, a jump target network topology screening module, and a jump control module;

The network topology initialization module is used to draw the initial network topology, abstractly model the initial network topology as an undirected and unweighted connected graph, and calculate the eigenvalues of the connected graph;

A new network topology generation module, used for adjusting the connection relationship between network nodes based on the initial network topology, and generating a variant of the initial network topology, wherein the variant serves as the new network topology;

The jump target network topology screening module is used to calculate the difference between the new network topology and the initial network topology by using the characteristic value sequence of the connected graph; and select the new network topology with a large difference value from the initial network topology as the jump target network topology within a fixed jump period;

The jump control module is used to restore the jump target network topology into a flow table and push it to each switch;

The switch is responsible for deploying the received flow table, adjusting the routing information, and then changing the network topology to achieve dynamic network defense.

Among them, the execution process of the new network topology generation module is as follows:

Input the connectivity graph of the initial network topology;

Network node connection switching: Starting from any network node, disconnect other network nodes adjacent to the network node, and randomly select other network nodes different from the network node and its adjacent network nodes for connection;

Repeat the network node connection switching until all network nodes have disconnected their original connections and generated new connections;

If there are isolated network nodes, the isolated network nodes are connected to any other connected network nodes in the network topology until the topology becomes a connected graph, and the connected graph of the new network topology is returned.

Among them, the execution process of the jump target network topology screening module is as follows:

Call the generated new network topology;

The difference value δ(G ₁ ,G _new ) between the new network topology and the initial network topology is calculated using the eigenvalue sequence of the connectivity graph. δ _crit is the critical value of the difference value between the two network topologies at the significance level. When δ(G ₁ ,G _new )≥δ _crit , it is considered that there is a significant difference between the two network topologies at the confidence level; otherwise, there is no significant difference.

Within the jump cycle, if the difference between the newly generated network topology with significant differences and the initial network topology is greater than the difference in the previous cycle, the jump target network topology is updated, otherwise the new network topology is regenerated and the difference value is calculated; at the end of the jump cycle, the final jump target network topology is obtained.

Another embodiment of the present invention provides a computer-readable storage medium having a computer program stored thereon, and when the computer program is executed, the above-mentioned network dynamic defense method based on topology difference measurement is implemented.

Obviously, the above embodiments are merely examples for the purpose of clear explanation, and are not intended to limit the implementation methods. For those skilled in the art, other different forms of changes or modifications can be made based on the above description. It is not necessary and impossible to list all the implementation methods here. The obvious changes or modifications derived therefrom are still within the scope of protection of the present invention.

Claims (6)

1. A network dynamic defense method based on topology difference measurement, comprising:

drawing an initial network topology, abstractly modeling the initial network topology into an undirected and unauthorized connected graph, and calculating the characteristic value of the connected graph; the calculation process of the eigenvalue of the connected graph is as follows: acquiring a degree sequence of the communication graph, converting the degree sequence into a diagonal matrix to obtain a degree diagonal matrix of the communication graph, and acquiring an adjacent matrix of the communication graph; subtracting the degree diagonal matrix from the adjacent matrix to obtain a difference matrix, and obtaining a characteristic value sequence of the difference matrix, namely a characteristic value sequence of the connected graph;

Adjusting connection relations among network nodes based on the initial network topology, and generating a variant of the initial network topology, wherein the variant is used as a new network topology;

Calculating a difference value between the new network topology and the initial network topology by using the characteristic value sequence of the connected graph; selecting a new network topology with a great difference value from the initial network topology in a fixed hopping period as a hopping target network topology; the specific process is as follows:

Calling the generated new network topology;

Calculating a difference value delta between the new network topology and the initial network topology by using the characteristic value sequence of the connected graph (G ₁,G_new),

；

Wherein μ _i(G₁) represents the i-th eigenvalue of the connected graph of the initial network topology G ₁, μ _i(G_new) represents the i-th eigenvalue of the connected graph of the new network topology G _new, and θ _i represents the weight of the i-th eigenvalue;

Delta _crit is a critical value of the difference value of two network topologies at the significance level, when delta (G ₁,G_new)≥δ_crit, it is considered that there is a significant difference between the two network topologies at the confidence level;

If the difference value between the newly generated new network topology with the significant difference and the initial network topology is larger than the difference value in the previous cycle within the jump period, updating the jump target network topology, otherwise, entering to newly generate the new network topology and calculating the difference value; when the jump period is over, obtaining the final jump target network topology;

and restoring the jump target network topology into a flow table, pushing the flow table to each switch, and finishing network topology jump, thereby realizing network dynamic defense.

2. The network dynamic defense method based on topology difference measurement according to claim 1, wherein the initial network topology abstract modeling is an undirected and unowned connected graph, specifically: abstract modeling an initial network topology G ₁ into a connected graph G ₁ (V, E) without self loops and heavy edges, wherein V= { V ₁,v₂,…,v_i,…,v_n } represents each network node set, V _i represents the ith network node, i epsilon 1-n, and n is the number of network nodes; e= { E ₁,e₂,…,e_k,…,e_m } represents a link set between network nodes, where E _k represents a kth link E _k, represents a direct connection relationship between two network nodes connected by a link E _k, and k E1-m, m is the number of links.

3. The method for dynamically defending a network based on a metric of topology difference according to claim 1, wherein adjusting the connection relationship between network nodes based on the initial network topology generates a variant of the initial network topology, comprising the following sub-processes:

inputting a connectivity graph of an initial network topology;

Network node connection switching: starting from any network node, disconnecting other network nodes adjacent to the network node, and randomly selecting other network nodes different from the network node and the adjacent network nodes to connect;

repeating the network node connection switching until all network nodes complete the disconnection of the original connection and generate new connection;

If the isolated network node exists, connecting the isolated network node with any other communication network node in the network topology until the topology becomes a communication graph, and returning the communication graph of the new network topology.

4. A network dynamic defense system based on topology difference metrics, comprising:

The network topology initialization module is used for drawing an initial network topology, abstractly modeling the initial network topology into an undirected and unauthorized connected graph, and calculating the characteristic value of the connected graph; the calculation process of the eigenvalue of the connected graph is as follows: acquiring a degree sequence of the communication graph, converting the degree sequence into a diagonal matrix to obtain a degree diagonal matrix of the communication graph, and acquiring an adjacent matrix of the communication graph; subtracting the degree diagonal matrix from the adjacent matrix to obtain a difference matrix, and obtaining a characteristic value sequence of the difference matrix, namely a characteristic value sequence of the connected graph;

The new network topology generation module is used for adjusting the connection relation among the network nodes based on the initial network topology to generate a variant of the initial network topology, wherein the variant is used as the new network topology;

The jump target network topology screening module is used for calculating a difference value between the new network topology and the initial network topology by utilizing the characteristic value sequence of the connected graph; selecting a new network topology with a great difference value from the initial network topology in a fixed hopping period as a hopping target network topology; the execution process of the jump target network topology screening module is as follows: calling the generated new network topology;

Calculating a difference value delta between the new network topology and the initial network topology by using the characteristic value sequence of the connected graph (G ₁,G_new),

；

Wherein μ _i(G₁) represents the i-th eigenvalue of the connected graph of the initial network topology G ₁, μ _i(G_new) represents the i-th eigenvalue of the connected graph of the new network topology G _new, and θ _i represents the weight of the i-th eigenvalue;

Delta _crit is a critical value of the difference value of two network topologies at the significance level, when delta (G ₁,G_new)≥δ_crit, it is considered that there is a significant difference between the two network topologies at the confidence level;

If the difference value between the newly generated new network topology with the significant difference and the initial network topology is larger than the difference value in the previous cycle within the jump period, updating the jump target network topology, otherwise, entering to newly generate the new network topology and calculating the difference value; when the jump period is over, obtaining the final jump target network topology;

the jump control module is used for restoring the jump target network topology into a flow table and pushing the flow table to each switch;

The switch is responsible for deploying the received flow table, adjusting the routing information and further changing the network topology so as to realize the dynamic defense of the network.

5. The topology difference metric-based network dynamic defense system of claim 4, wherein the new network topology generation module is executed as follows:

inputting a connectivity graph of an initial network topology;

Network node connection switching: starting from any network node, disconnecting other network nodes adjacent to the network node, and randomly selecting other network nodes different from the network node and the adjacent network nodes to connect;

repeating the network node connection switching until all network nodes complete the disconnection of the original connection and generate new connection;

If the isolated network node exists, connecting the isolated network node with any other communication network node in the network topology until the topology becomes a communication graph, and returning the communication graph of the new network topology.

6. A computer readable storage medium, having stored thereon a computer program which, when executed, implements a topology difference metric based network dynamic defense method as claimed in any one of claims 1 to 3.