Multi-step attack dynamic defense decision selection method and system for network attack and defense

Abstract

The invention belongs to the technical field of network security, and particularly relates to a multi-step attack dynamic defense decision selection method and system for network attack and defense, and the method comprises the steps: generating a network attribute attack graph through the analysis of network security element information; constructing a network survivability game model based on the attack graph, representing an attack and defense strategy and a path by the model by utilizing an attack and defense strategy matrix, and quantifying attack and defense intensity and network survivability; predicting the next attack behavior of an attacker according to the attack strategy matrix in the model, and selecting the optimal multi-step attack defense strategy according to the attack defense strategy cost. The attack and defense strategy is implemented around the network survivability, the situation pre-judgment and defense strategy can be adjusted according to the dynamically changing attack and defense situation of the network, an easily understood and reasonable defense decision is provided for network security management personnel, the network defense capability is improved,the application prospect is good, and the method has important guiding significance and value for the network security technology.

Description

technical field [0001] The invention belongs to the technical field of network security, in particular to a multi-step attack dynamic defense decision selection method and system for network attack and defense. Background technique [0002] At present, there are many research results on network security defense, but they mainly focus on network defense technologies such as firewalls, intrusion detection, and information encryption. Network defense technology is one of the key factors to ensure network security, but technology itself is not the only master of victory in network attack and defense confrontation. In traditional confrontation, the level of decision-making and the formulation of strategies have an important impact on the outcome. Similarly, reasonable decision-making methods also play a very important role in network attack and defense confrontation. When the technical level of attack and defense is not much different, the level of offensive and defensive decis...

AI Technical Summary

Problems solved by technology

The advantage of the dynamic defense decision-making method is that multiple factors are considered comprehensively. From this point of view, it is better than static mapping. However, neither static mapping nor dynamic mapping considers the cost of defense, and is often exploited by attackers, resulting in a loss outweighed by the defense. Due to its good scalability and adaptability, it has become an important technical means at present

Images