Intrusion response strategy generation method and device

Abstract

The embodiment of the invention provides an intrusion response strategy generation method and device, and the method comprises the steps: determining a candidate measure set and a deployment point set for responding to an attack according to received alarm information and a network topological structure; taking the measures, the deployment points and the time sequence of the measure deployment as three dimensions of the array, taking the duration of the measure execution as elements in the array, and encoding the candidate strategies by using the three-dimensional array to generate a plurality of candidate strategies; carrying out iterative evolution on the plurality of candidate strategies based on a genetic algorithm according to a preset fitness function until a preset condition is met, and obtaining a target strategy so as to realize intrusion prevention, wherein each strategy comprises at least one meta-strategy, and each meta-strategy comprises a measure, a deployment point, a time sequence of measure deployment and measure execution duration. The time sequence and the execution duration of deployment of each selection measure are determined while the measure and the deployment point are selected, so that the accuracy of the generation strategy is ensured, and higher safety benefits can be obtained.

Description

Technical field [0001] The invention relates to the technical field of information security, in particular to a method and device for generating an intrusion response strategy. Background technique [0002] With the rapid growth of the network scale, intrusion events have become increasingly complex in recent years and often cause serious consequences. In order to resist attacks, intrusion response systems are designed to generate appropriate response strategies to eliminate potential impacts and reduce system risks. Most of the existing intrusion response strategy methods focus on selecting appropriate measures and deployment points. In terms of measure selection, existing methods usually select one or more measures to deal with malicious behaviors and provide a balance between attack losses and measures gains. The existing single measure selection method usually considers the intrusion cost, collateral loss, and measure security benefits, etc., sorts the measures and selects ...

AI Technical Summary

Problems solved by technology

Therefore, current intrusion response strategy methods cannot effectively guarantee sufficient response utility

Images