Optimal attack path planning method based on Q learning

Abstract

The invention relates to an optimal attack path planning method based on Q learning and belongs to the technical field of information security. The method comprises the following specific operating steps of step 1, obtaining a network structure; step 2, obtaining vulnerabilities in various hosts in the network system; step 3, establishing a Q learning model; and step 4, obtaining an optimal attack path through the Q learning model. Compared with the prior art, the optimal attack path planning method based on Q learning provided by the invention has the following advantages that (1) the network model is trained without collecting training data; (2) online learning can be carried out and the optimal attack paths corresponding to different moments and different network states can be determined in real time; (3) the learning rate utilizes an annealing model, so that the convergence is more accurate; (4) the optimal attack path generation speed is fast; and (5) generation of an attack graph is not needed, so that the method can be suitable for a large-scale computer cluster.

Description

technical field [0001] The invention relates to a Q-learning-based optimal attack path planning method, belonging to the technical field of information security. Background technique [0002] When infiltrating information system networks, attackers hope to choose an attack path with low cost and high return. Among them, the attack path with the largest attack return and attack cost is the best attack path. The method is mainly based on the attack graph to obtain all the attack paths between the source node and the target node, and then select one of these paths as the best attack path. [0003] At present, the more commonly used network attack graphs are: vulnerability-based network attack graph and network state-based attack graph. The problems of the attack path or protection path generation methods based on the above two attack graphs are: ① slow generation speed; ② in order to solve the problem of state explosion, the way of limiting the attack path is adopted, which le...

AI Technical Summary

Problems solved by technology

The problems of the attack path or protection path generation method based on the above two attack graphs are: ①The generation speed is slow; ②In order to solve the problem of state explosion, the method of limiting the attack path leads to incomplete attack paths and other problems.

However, due to the high algorithm overhead of this method, when faced with a large-scale computer cluster, even if the minimum attack graph is used, the optimal attack path cannot be quickly fitted.

Images