Intelligent defense decision-making method and device based on reinforcement learning and attack and defense games

Abstract

The invention belongs to the technical field of network security and particularly relates to an intelligent defense decision-making method and device based on reinforcement learning and attack and defense games. The method comprises the steps that an attack and defense game model is constructed under finite constraint, an attack and defense graph used for extracting the network state and the attack and defense action in the game model is generated, the attack and defense graph is set to take a host as the center, attack and defense graph nodes extract the network state, and the attack and defense graph edge analyzes the attack and defense action; and when the network state transition probability of the defender is unknown, the defender obtains the defense revenue through online learning, so that the defender automatically makes the selection of the optimal defense strategy when facing different attackers. The game state space is effectively compressed, and the storage and operation expenditure is reduced. Adefender performs reinforcement learning according to environmental feedback in confrontation with an attacker, and can adaptively make an optimal choice when facing different attacks; therefore, the learning speed of the defender is improved, the defense income is improved, the dependence on historical data is reduced, and the instantaneity and the intelligence of the defender during decision making are effectively improved.

Description

technical field [0001] The invention belongs to the technical field of network security, in particular to an intelligent defense decision-making method and device based on reinforcement learning and attack-defense game. Background technique [0002] In recent years, information security incidents have become more frequent, which has brought huge losses to network security. According to statistics, Alibaba Cloud suffered about 1.6 billion attacks every day in 2017. For different attackers, each attack and defense scenario may only It will happen once, but for defenders represented by Alibaba Cloud, they have to face a lot of the same offensive and defensive scenarios every day. Considering the limited hardware resources of network equipment, how to comprehensively consider the cost and benefit of defense, with the goal of maximizing the benefit of defense, so that the defender can achieve a balance between risk and investment, and how to make the defender respond to the same ...

AI Technical Summary

Problems solved by technology

In the evolutionary game, there are too many information exchanges between the participants and the research is mainly on the adjustment process, trend and stability of the offensive and defensive group strategies, which is not conducive to guiding the real-time strategy selection of individual members.

Images