网络行为描述了网络上各类元素对象动态交互过程. 它以各类网络服务协议及应用为运行载体, 形成不断变化的丰富多样的网络行为, 反映出网络拓扑结构给定时间内网络上的场景特点. 网络行为仿真主要包括运行框架、背景流仿真、前景流仿真, 将生产网络环境下网络行为按需映射到测试网络环境, 提供一种按需灵活定制仿真再现能力. 网络仿真应用场景不断发展, 包括性能分析评估、产品和技术验证、网络入侵检测、网络攻防演练与研究发展等. 为总结现有研究成果和存在的不足, 分析未来发展趋势, 梳理了网络行为仿真的相关概念和研究框架, 从框架、背景流、前景流等技术层面总结了网络行为仿真的国内外研究现状, 并对相关商业产品和开源软件工具进行了系统地分析调研, 最后对网络行为仿真的未来发展进行了展望.

The network behavior typically describes the interaction process among different kinds of network elements, which is based on different kinds of network service protocols and applications, formulates evolving and diverse network behavior, and reflects attributes of network scenarios during certain periods on the network topology. Network behavior emulation includes runtime framework, background traffic emulation, and foreground traffic emulation which project network behaviors in the production network environment to the test cyber environment, and provides the mirroring capability of on-demand and flexible design specifications. The application scenarios of network behavior emulation continuously evolve, including performance analysis and evaluation, product and technique evaluation, network intrusion detection, and the research and development of network attack and defense techniques. To summarize existing research results and limitations, and analyze future development trends, this study seeks to category relevant definitions and research frameworks on simulating network behaviors, summarizes the state-of-the-art research progress in terms of the framework, background traffic, and foreground traffic, and systematically surveys both commercial and open-sourced software tools. Finally, this study proposes future research topics on network behavior simulation.

国家重点研发计划(2018YFB0204300, 2020YFB2104003); 国家自然科学基金(61972409, 61972182, 61672264)