Optimal protection policy analysis system and method based on improved ant colony algorithm

Abstract

The invention provides an optimal protection policy analysis system and method based on an improved ant colony algorithm. The system comprises a network risk assessment subsystem, an attack path prediction subsystem and a security policy management subsystem. The method comprises the following steps: 1) importing a Bayesian probabilistic model to describe the complex relationship between multiple steps of atomic attacks, and constructing an attack diagram by using the Bayesian belief network to evaluate a network security risk; 2) simulating a decision making process of an attacker in combination with the quantitative indexes of the protection cost and the gain, and predicting a possible attack path; and 3) using the improved ant colony algorithm capable of calculating the quasi-optimal solution within a polynomial time to solve the security policy selection problem on the attack path. By adoption of the optimal protection policy analysis system and method, a risk solution can be provided for a network security administrator in time, the attack path prediction and protection strategy selection problems in network security protection are solved, and the security of the whole network under the condition of limited protection resources is effectively protected.

Description

technical field [0001] The invention belongs to the field of computer network security protection, and in particular relates to an optimal protection strategy analysis system and method based on an improved ant colony algorithm. Background technique [0002] With the development of information technology, the connection between the virtual network world and the real world is becoming more and more close. The Internet is widely used in all walks of life. More and more personal information is controlled by Internet companies and even malicious people. The frequency and influence of security incidents are increasing. In this context, the security of network environment becomes more and more important. The essence of security incidents is that there are defects in the design and implementation of hardware, software, and even protocols in the network system. Malicious people take advantage of these flaws to launch attacks and gain permissions in the system, thereby obtaining va...

AI Technical Summary

Problems solved by technology

[0003] The current difficulty in researching such security incidents lies in the complex multi-step nature of the attack process. One-step attacks in the intrusion process may not be intercepted by firewalls or IDS intrusion detection systems. When security personnel detect the intrusion, the system permissions may have been blocked. steal

Due to the multi-step nature of the attack behavior, it is difficult for defenders to determine the attacker's attack path and target node, and cannot perform effective protection

Secondly, deploying protection strategies requires a certain cost, and the cost of deploying protection strategies for all nodes is undoubtedly huge

Images