Design And Implementation Of Traffic Replay System For Cyber Range

With the development of computing networks,cyber security incidents are emerging.The construction of cyber range is of great significance to improve the security of cyberspace.The construction of realistic network background traffic is an important support for the cyber range to simulate the network environment.Traffic replay can effectively improve the authenticity of background traffic in the cyber range.In response to the lack of minimum virtual resource calculation method,large replay interval error,low similarity and high packet loss rate of accelerated replay in the current technology of traffic replay under the cyber range,this paper proposes corresponding solutions and implements a traffic replay system for the cyber range.The specific work includes the following:Firstly,the usage scenarios about traffic replay in the cyber range are analyzed,the main functional and non-functional requirements of the system participants are analyzed according to the scenario requirements,and the key business processes of the system are constructed.Secondly,for the problem of lacking the minimum virtual resource calculation method,a computational model is constructed based on data streams.In order to satisfy the demand of more balanced number of packets and higher filling rate of the replay nodes,the data stream is taken as the minimum division unit,and the packet minimum adaptation algorithm based on the data stream and the approximate packet minimum adaptation algorithm are proposed to divide the data stream reasonably,and the node IP conflict discrimination algorithm is used to avoid the conflict between the source address and the destination address of the data stream in the division process.The experimental results show that the approximate packet minimum adaptation algorithm is more advantageous than the classical algorithm in terms of balance and fill rate.Thirdly,the data stream merging algorithm based on multiplex merging is proposed to merge the data stream division sets obtained in the previous step.To solve the problems of large interval error and low similarity in traffic replay,a multiinteraction low-delay traffic replay method is proposed,which controls the sending time of packets by constructing packets in advance and sleeping time interval,and the experimental results show that the method can effectively reduce the interval error and improve the similarity.To solve the problem of high packet loss rate of existing geometric compression time interval acceleration replay methods,the maximum priority compression traffic acceleration method is proposed.The method achieves the overall time compression by prioritizing the larger time interval for compression,and the experimental results show that the method can effectively reduce the packet loss rate in the replay process.Finally,the overall architecture,functional modules and database of the traffic replay system are designed based on the above achievements,and the functions of minimum virtual resource calculation,traffic replay management,traffic acceleration management and virtual resource monitoring are implemented.And the unit test and functional test of the system are completed.