Defense strategy generation method based on three-party dynamic game

Abstract

The invention discloses a defense strategy generation method based on a three-party dynamic game, and belongs to the field of network security. According to the method, internal and external threats are comprehensively considered, and the internal threats are instantiated in the strategy generation process. In the node value measurement process of the initialization stage, the influence of multiple targets on the node is balanced so as to reduce the bias problem in node value calculation. In the sequential game process, the defense party uses a heuristic method to obtain the path with the maximum threat in the plurality of attack paths for blocking; a user side models a strategy of a user by using a mixed strategy game model, so the coupling of a stealth attack and an internal threat is improved; for attackers, uncertainty of behavior modes of the attackers is increased, three attack strategies are used for simulating attack behaviors of different attackers respectively, and finally, defense strategies in each time period are combined to generate a final protection strategy set. According to the invention, through dynamic analysis of three-party behaviors, decision suggestions withhigher risk prevention capability are provided for an administrator.

Description

technical field [0001] The invention belongs to the field of network security, in particular to a method for generating a defense strategy based on a three-party dynamic game. Background technique [0002] At present, the difficulty in generating security policies lies in the multi-step nature of malicious attacks. At the same time, users inside the system may expose specific information about vulnerabilities inside the system because they have permissions that the attacker does not have. In order to cope with the dynamics of information systems, combining dynamic target defense technology with attack graph technology is a very effective means. Existing research can be divided into two categories: combining game models and combining advanced models. However, there is a common problem in all of them, that is, the influence of users in the offensive and defensive game is ignored. Some scholars use an uncertain variable to represent the influence caused by the third party's p...

AI Technical Summary

Problems solved by technology

However, there is a common problem in all of them, that is, the influence of users in the offensive and defensive game is ignored.

Some scholars use a variable with uncertainty to represent the influence caused by the third party's participation in the two-party game, and the results obtained in this way are not accurate

Images