# Multi-Constraint and Multi-Policy Path Hopping Active Defense Method Based on SDN
## 1 Introduction  
The rapid advancement of computer networks has revolutionized daily life but has also unveiled a myriad of network security challenges. Traditional network architectures inherently harbor security vulnerabilities during design and implementation. Exploiting the ubiquity of network systems, attackers continuously innovate attack strategies to amplify the impact of existing vulnerabilities and uncover novel threats. Defenders, constrained by a time lag, rely on past experiences and existing tools, struggling to thwart all attacker assaults and identify every potential vulnerability, resulting in an information asymmetry between attackers and defenders. Moreover, the static composition and configuration of conventional networks offer a conducive environment for malicious activities. The unchanging system properties grant attackers ample time for pre-attack preparations such as reconnaissance and target identification. As network usage is prolonged, attackers have more opportunities to exploit system vulnerabilities, intensify preparations, and elevate the success rate and impact of their attacks. Post-attack, installing undetectable back doors forsustained control becomes feasible due to the system's static nature, rendering defenders reactive over time. Conventional defense mechanisms typically rely on installing firewalls, IDSs (intrusion detection systems), IPSs (intrusion prevention systems), and other security devices at network perimeters to block attackers and reinforce existing system technologies and protocols, while this enhances system security to some extent, it necessitates significant human and material resources. In contrast, attackers, leveraging diverse attack methods and readily available tools, incur minimal time costs. By exploiting system vulnerabilities and rapidly propagating through susceptible nodes, attackers can dismantle entire systems and reap substantial gains at minimal expense, establishing a cost disparity between attackers and defenders. In essence, the deterministic nature of traditional network structures, static configurations, and passive defense approaches aimed at bolstering security through blocking are increasingly inadequate against evolving and sophisticated attack methodologies. This perpetual passivity places defenders at a disadvantage in the ongoing battle between attackers and defenders. Consequently, there is a pressing need for an effective active defense strategy to counter these challenges. To alleviate the challenges faced by network security and change the asymmetric situation of attack and defense, the US military has proposed the moving target defense technology (MTD) [1]. Unlike traditional defense measures that aim to enhance the overall security of the system and eliminate all security threats, MTD defends during the attacker's pre-attack preparation period and does not pursue the establishment of a perfect defense system. Its main idea is to constantly change the form features of the target system by constructing and implementing defense strategies with element diversity, dynamic structure, and compositional uncertainty. This increases the diversity, dynamism, randomness, and unpredictability of system resource properties; limits the opportunities for vulnerabilities to be continuously exposed and exploited; increases attack difficulty and attack cost; improves system resilience; and enhances active defense capabilities [2]. Path hopping, as a typical MTD technology, aims to continuously and dynamically change the transmission path during data transmission, enhance the uncertainty of the attack target, resist attackers' long-term continuous listening to the transmission path, increase the difficulty and cost of attacker detection, and enhance the defense capability and defense benefits of the network system. The traditional network architecture, with its static and deterministic characteristics, is not well suited for the large-scale deployment of MTD.