Network safety optimum attacking and defending decision method for attacking and defending game

Abstract

The invention relates to a network safety attacking and defending method for a state attacking and defending map model, and belongs to the technical field of network safety attacking and defending. The method comprises the following steps of modeling an attacking and defending scene of a network system by a state attacking and defending map, then calculating the cost and income of atomic attacking, further calculating utility matrixes of different attacking and defending strategies adopted by an attacking party and a defending party under different network safety states, and finally solving a Mash balance on the basis of a non-cooperated type non-zero-sum game model, so as to obtain an optimum attacking and defending strategy. The method has the significant advantages that 1, the attacking scene is modeled by the state attacking and defending map, and the attacking and defending strategies of the network system under different network safety states are visually and clearly described; 2, the calculation of the cost and income of the attacking and defending is converted into the calculation of the attacking and defending success probability and the hazard index, and the calculation of the attacking and defending utilities is simplified; and 3, in the attacking and defending process of the network system, the costs and the incomes of the attacking party and the defending party are considered, the rational decision is made for a network management person, and the maximum income is realized for the network management.

Description

technical field [0001] The invention relates to the technical field of network security defense, in particular to an optimal attack and defense decision-making method for network security in an attack and defense game. Background technique [0002] At present, with the rapid development of network technology and the continuous increase of network scale, there are more and more security incidents related to the network, such as attacks and intrusions. In order to ensure the security and robustness of network systems, governments and enterprises around the world have invested a lot of money in building network security defense systems. The existing network security defense system deploys a large number of firewalls, intrusion detection and anti-virus software to detect the vulnerability and weak links of each node in the network system, so as to ensure the security of the network system to the greatest extent. [0003] An ideal defense system should protect against all vulner...

AI Technical Summary

Problems solved by technology

[0003] An ideal defense system should protect against all vulnerabilities and attacks. However, considering the actual situation such as organizational resource constraints, "at all costs" defense is obviously unreasonable, and the concept of "moderate security" must be considered. That is, to seek a balance between the risk and investment of network security, and to use limited resources to make reasonable decisions

Images