Network security decision-making method and device for game attack and defense graph and storage medium

Abstract

The invention discloses a network security decision-making method and device for a game attack and defense graph and a storage medium, and the method comprises the following steps: employing an optimal vulnerability evaluation weight combination search algorithm and an optimal vulnerability point evaluation weight combination selection algorithm to evaluate vulnerability points of all host nodes,and obtaining high-diversity scores of the vulnerability points; constructing a state attack and defense graph; calculating the success probability and hazard index of attack accumulation in the stateattack and defense graph in combination with the high diversity score of the vulnerability; establishing a game model according to the state attack and defense graph; solving the game model to obtainan optimal attack and defense strategy. An optimal vulnerability evaluation weight combination search algorithm and an optimal vulnerability point evaluation weight combination selection algorithm are adopted to evaluate vulnerability points in a target network, the actual harm condition of each fragile point can be effectively distinguished, so that a more reliable game attack and defense graphis established, the optimal security strategy of the network is obtained by solving the game attack and defense graph, and the network management of the maximum income is realized.

Description

technical field [0001] The invention relates to the field of network security, in particular to a network security decision-making method, device and storage medium of a game attack-defense graph. Background technique [0002] There are many kinds of network security protection systems in the industrial Internet. The essence of network security attack and defense is the attack and defense confrontation between the attacker and the defender. The two conflicting goals of attack and defense are opposite, and the goal of the attacker is to destroy The target network function or service quality is to maximize the profit of the attack, while the goal of the defense is to do its best to protect the network from attacks and minimize the loss of the network. Therefore, a reasonable prevention system should ideally protect the security loopholes and all attacks in the network, but the actual situation is that it is necessary to strike a balance between information security and risk in...

AI Technical Summary

Problems solved by technology

[0003] In addition, before formulating a security policy, it is necessary to evaluate the security vulnerabilities of each host node, but the vulnerability assessment methods in the prior art, such as the CVSS scoring mechanism, cannot effectively distinguish the real hazard status of each vulnerability, and cannot reflect the vulnerability. The complexity and diversity of points may lead to large errors in the subsequent formulation of security policies

Images