Network defense resource optimal allocation method for advanced persistent threats

Abstract

The invention discloses a network defense resource optimal allocation method for advanced persistent threats. The method comprises the following steps: modeling a network attack and defense process ofthe advanced persistent threats by using a time-varying dynamic system theory; and calculating the number of prevention resources and recovery resources needing to be allocated to each network node by utilizing a modeling result and combining a geometric programming method, so that the effectiveness of the defense resources is maximized. According to the method, when the network system is subjected to the APT attack, the optimal network defense resource allocation scheme can be adopted to defend the APT attack as soon as possible under the condition of giving a certain defense resource, so that the loss generated by the APT attack is minimized, and the aim of defending the APT attack by the network system is fulfilled.

Description

technical field [0001] The invention relates to the field of network security dynamic systems, in particular to a method for optimal allocation of network defense resources aimed at advanced persistent threats. Background technique [0002] The rapid development of network information technology has brought huge changes to the productivity of today's society. More and more institutions, organizations, companies and governments are accelerating the development of their own network applications and service technologies. Today, as computer networks and software systems become increasingly complex, there are more and more corresponding vulnerabilities. Cybercriminals use these vulnerabilities to carry out cyber attacks on personal computers and even organizations to achieve political, economic and military goals. With the development of network technology, network attack methods are increasingly diversified, organized and persistent, and the attack surface is gradually extending...

AI Technical Summary

Problems solved by technology

In the existing research, the mathematical model established for one-time network attack is static, and the mathematical model for the defense process of repetitive network attack is discrete, which cannot represent the interaction between the internal nodes of the network under different states. Therefore, in the existing research Mathematical models proposed for one-time or repeated cyber attacks are often not suitable for APT attacks

Secondly, the existing research mainly focuses on systems such as the spread of epidemics and malware propagation. The modeling process only considers the problem of internal infection, or assumes that the attacker is inside the network, and does not consider the impact of external attacks (such as APT attacks) on the system. to influence

Images