An Intrusion Response Method Based on Attack Graph and Theory of Mind

Abstract

The invention discloses an intrusion response method based on an attack graph and a psychological theory. According to the method, each step of action when an attacker invades a network is simulated through an attack graph; the probability that the attacker takes a certain action at the next moment can be speculated by analyzing the attack psychology of the attacker, and in order to maximize the income value in the network attack and defense game, the defender formulates a corresponding response measure according to the speculated attacker behavior, so that real-time network response is provided. Compared with a traditional IDS alerts mapping response action method, the method has the advantages that the response strategy is adjusted in real time during multi-step complex intrusion detection, real-time response is achieved, and efficient protection is achieved.

Description

technical field [0001] The invention belongs to the technical field of network security, in particular to an intrusion response method based on attack graph and psychological theory. Background technique [0002] With the increasingly complex forms of network attacks, network intrusion detection and defense are facing severe challenges. Today, a complex network attack usually gradually invades the entire network in the form of a multi-step attack, which greatly increases the difficulty for defenders to defend the network. When the network is faced with multi-step intrusion, how to formulate correct defense measures for each step of attack has become an important task for defenders. The intrusion response system (IRS) aims to formulate corresponding countermeasures for network intrusions, take response measures when network intrusions are detected, and shorten the time window for network restoration. [0003] The traditional intrusion response system maps the alarm message ...

AI Technical Summary

Problems solved by technology

However, this fixed mapping relationship is not suitable for new types of network attacks

Secondly, in a complex attack-defense game, the attacker usually has a certain learning ability. After several failed attacks, the attacker may find that the current attack behavior has been successfully defended.

Images