Decision method for dynamic network transformation under full information conditions and system thereof

Abstract

The invention belongs to the technical field of network safety and specifically relates to a decision method for dynamic network transformation under full information conditions and a system thereof.The decision method comprises the following steps: obtaining state transition probability according to the network state, an attack strategy and a defense strategy; using a game theory to describe gains of both sides of the offensive and defensive game during moving target defense; constructing a moving target defense model based on a Markov game in combination with the state transition probability; transforming the solution of the moving target defense model into an equivalent of a target function and obtaining an optimal moving target defense strategy. According to the method and the systemin the invention, the moving target defense model based on the Markov game is constructed according to the state transition probability and both the sides of the offensive and defensive game; furthermore, the optimal moving target defense strategy is obtained by solving so as to realize balance of network performance overheads and moving target defense gains and solve the technical problem of howto select the optimal defense strategy based on limited network resources.

Description

technical field [0001] The invention belongs to the technical field of network security, and in particular relates to a decision-making method and system for network dynamic transformation under the condition of complete information. Background technique [0002] With the continuous evolution of new network attack methods, attacks such as Zero-day Exploitation and Advanced Persistent Threat (Advanced Persistent Threat) have severely challenged Internet security. Studies have shown that the biggest feature of Internet security is "easy to attack but difficult to defend". On the one hand, because the attacker can detect, collect and utilize the resource vulnerability of the target network system for a long time, it has the advantage of time and information asymmetry; on the other hand, because the existing firewall, intrusion detection and virus killing methods are Defenses are implemented based on prior knowledge, so there are cognitive limitations and hysteresis. The root ...

AI Technical Summary

Problems solved by technology

Although existing studies have proposed a variety of MTD technologies and implementation methods for different network security threats, the simple superposition of different MTD technologies will greatly increase the performance overhead of the network system, and the "at all costs" defense cannot be applied to networks with limited defense costs. actual conditions

Images