Network security evaluation system and method based on dynamic attack and defense game model

Abstract

The invention belongs to the field of network security, and discloses a network security evaluation system and method based on a dynamic attack and defense game model, and the evaluation system comprises four functional modules of attack and defense game construction, risk prediction, dynamic defense optimization and security situation awareness. According to the method, the idea of dynamic attack and defense game is introduced, multi-level and multi-scene attack and defense simulation is carried out according to historical states, strategy data and real-time data, and the optimal attack path and attack strategy are calculated and analyzed through a game equilibrium solution; according to the method, network resources and network security resources are dynamically adjusted by relying on reinforcement learning and deep learning technologies and a defense rule base generated by pre-training, network configuration is optimized according to a real-time evaluation result, and waste of system resources is reduced. By implementing the system and the method provided by the invention, the security of the target network can be dynamically evaluated, the security defense strategy of the network can be adjusted in real time, and unknown attacks such as advanced persistent threat (APT) and zero-day attack can be effectively resisted.

Description

Technical Field

[0001] The present invention belongs to the technical field of network security, and in particular relates to a network security evaluation system and method based on a dynamic attack and defense game model. Background Art

[0002] At present, the security assessment of the network under evaluation in the field of network security is mainly based on traditional static analysis, which scans and analyzes vulnerability information such as loopholes, backdoors, weak passwords, etc. of each node in the network, and evaluates the security of the entire network based on the established assessment model. This method has the following technical problems: the assessment data is mainly based on network status data and historical traffic data, and the assessment results lack real-time performance; it can only consider known threats and detect them by comparing rules or feature libraries, and it is impossible to introduce the attacker's attack behavior into the model, making it difficult to deal with unknown attacks such as advanced persistent threats (APT) and zero-day attacks. It is impossible to capture the dynamically changing network attack and defense behaviors in a timely manner, especially when facing complex multi-level attacks. The lag of static analysis cannot effectively defend against persistent attacks.

[0003] Some studies have introduced game theory models into network threat assessment, incorporating the behavioral game characteristics of both the attacker and the defender into the model calculations, but have failed to consider the deviations caused by the dynamic evolution of the strategies of both parties. The assessment results are one-sided and limited, making it difficult to provide a comprehensive and timely security defense strategy. Summary of the invention

[0004] In response to the existing technical problems, the present invention provides a network security assessment system and method based on a dynamic attack and defense game model from the perspective of the behavioral game between the attacking and defending parties, relying on pre-training models and real-time network data.

[0005] The present invention is implemented in this way: a network security situation assessment and defense system of attack and defense game includes:

[0006] The attack-defense game construction module is used to collect historical network attack data, network topology information, and data in the defense strategy library to build a multi-level attack path model and a defender response strategy model; the attack-defense game model simulates the attacker's selection of different attack paths and attack tools, and the defender deploys defense measures according to the attack path, generates an attack-defense game equilibrium solution, and provides preliminary defense suggestions;

[0007] A risk prediction module, connected to the attack and defense game building module, is used to perform risk assessment on potential attack behaviors by simulating different attack scenarios multiple times, generate predicted risk values, and provide a detailed risk assessment report;

[0008] The dynamic defense optimization module receives the output results of the risk prediction module, dynamically adjusts the network defense strategy according to the game model results, optimizes resource allocation, and reduces potential losses;

[0009] The real-time monitoring module is used to collect information such as network traffic, user behavior analysis, and system logs through sensors, and use this information as input to the game model to update the input parameters of risk assessment and realize dynamic adjustment of defense strategies;

[0010] The security situation awareness module is used to generate a real-time security situation map by collecting sensor data such as network traffic monitoring, user behavior analysis, and system logs, dynamically adjust the parameters in the game model, and optimize the defense strategy;

[0011] The defense feedback and execution module receives the security situation map generated by the security situation awareness module, adjusts the defense strategy in real time, and feeds back the defense strategy to devices such as firewalls, intrusion detection systems and traffic controllers to ensure that the defense strategy matches the current network environment.

[0012] Further, the implementation of the attack and defense game building module:

[0013] Collection and analysis of historical data:

[0014] Collect historical attack data in the network, including the attack methods, attack paths, network vulnerabilities, and intrusion points used by attackers; combine network topology information to establish a potential attack path library for attackers;

[0015] The defender's strategy includes the configuration of each protection node, the allocation strategy of network resources, the rules of firewalls and intrusion detection systems, and defense measures to deal with different types of attacks.

[0016] Furthermore, the attack and defense strategy game model is constructed:

[0017] Use game theory models to define the action space of the attacker and defender, i.e. the attacker's attack path selection and the defender's defense measures deployment, and convert them into the state space of the attack and defense game;

[0018] The utility functions of the attacker and defender are set, that is, the attacker tries to maximize the destructive benefits through attack means, while the defender minimizes the losses by deploying defense strategies; the strategies of both parties in action selection can be solved through Nash equilibrium.

[0019] Further, the implementation of the risk prediction module:

[0020] (1) Multi-scenario game simulation

[0021] Multi-scenario simulation: By simulating multiple possible attack scenarios, the system can pre-consider the paths and strategies that attackers may take under different conditions. Specifically, this can include the attacker's intrusion path, attack target, and means used, such as DDOS attacks, SQL injections, data theft, etc., as well as how the system responds to these attacks;

[0022] Game model: The system regards the attacker and the defender as two parties in the game, and uses game theory strategies to simulate the attacker's decision-making process and the defender's response behavior. Through multiple simulations, the system can evaluate the attacker's success probability and calculate the risk value of the network system under different attack scenarios.

[0023] (2) Training of risk prediction models

[0024] This multi-scenario simulation does not directly train the model, but provides the model with rich data and scenarios for risk assessment. By simulating the game model, the system can generate a variety of possible attack data and use this data to assess the weaknesses and potential risks of the network system.

[0025] Training of machine learning models: For the risk prediction module, the trained machine learning model can be a model based on small sample training. This small sample training model uses existing attack and defense data with limited sample data, and uses transfer learning or reinforcement learning to enable the model to obtain good generalization capabilities on data generated by multi-scenario simulation. This method can improve the performance of the model by combining limited real data with simulated data.

[0026] Multi-scenario simulation generates a large amount of data on different attack paths, which is used to train machine learning models. Even if the real attack samples are limited, the data set can be expanded through simulation to improve the learning effect of the model. The small sample training model uses these limited data, combined with methods such as transfer learning or reinforcement learning, to predict future attacks and assess risks, helping administrators take preventive measures in advance;

[0027] (3) Risk assessment and prediction

[0028] The system uses a trained machine learning model to predict the risk of attack behaviors. This model will combine the results of game simulation to evaluate the potential risks of each attack path and provide strategic recommendations to the defender.

[0029] Output results: Ultimately, the risk prediction module will output the evaluation of potential attack paths under the current network status, the probability of success, the possible risk value, and provide response suggestions; this can not only help network administrators understand the weak points in the current network, but also take measures in advance to reduce the success rate of attacks;

[0030] (4) Applicability and performance optimization

[0031] Since this method relies on data generated by multi-scenario game simulation when the data sample is limited, the model can still have high practicality and accuracy under small sample conditions.

[0032] Furthermore, the implementation of the dynamic defense optimization module:

[0033] Optimized configuration of defense resources:

[0034] Based on the risk assessment results and current network resources, the system automatically optimizes the allocation of defense resources, including computing resources and bandwidth, to minimize defense costs while maintaining the best protection effect.

[0035] The system converts different defense strategies, including adjusting firewall rules, IDS detection modes, malicious code detection rules, etc., into executable defense tasks, and deploys them to the entire network through the central control system;

[0036] Generation of defense rule base based on deep learning:

[0037] The system automatically generates a defense rule library suitable for different attack strategies through deep learning analysis of historical attack data; it uses deep neural networks or convolutional neural networks for feature extraction;

[0038] The defense rules refer to the specific protection measures taken by the system in response to different attack strategies. By analyzing historical attack data, the system identifies common attack patterns and characteristics and automatically generates corresponding response rules. These rules include protection strategies, traffic filtering rules, access control strategies, etc., which are used to respond quickly when similar attacks are detected to reduce potential damage.

[0039] The system continuously self-learns and iteratively optimizes defense strategies to respond to new and unknown threats.

[0040] Further, the implementation of the security situation awareness module:

[0041] Network situational awareness:

[0042] Through various sensor data including network traffic monitors, behavior analysis systems, and system logs; real-time monitoring of the security status of each node in the network, and generating a real-time situation map to display the security threats currently facing the network;

[0043] The system will dynamically adjust the parameters in the attack and defense game model according to the real-time network situation, and recalculate the optimal defense strategy based on new threat information;

[0044] Dynamic update and analysis of situation map:

[0045] Implement dynamic situation map update technology, use distributed computing platform to quickly process massive data; display situation maps to administrators through visualization technology;

[0046] The system will automatically feed back the threat information in the situation map to the game model as a reference for adjusting the next round of defense strategy.

[0047] Another object of the present invention is to provide a network security assessment method based on attack and defense game, comprising:

[0048] Step 1: Introduce a game theory model into the system through the attack and defense game construction module to simulate the dynamic interaction process between attackers and defenders. This module first builds a multi-level attack path model for attackers and a response strategy model for defenders based on historical attack data and network topology information. The strategies of both attackers and defenders include attack path selection, defense measures deployment, and resource allocation.

[0049] Step 2: The risk prediction module uses the game model to perform multiple simulations to predict the risk value that the network may suffer under different attack scenarios; the most likely attack behavior is analyzed through the equilibrium solution of the game, and the optimal response strategy is provided to the defender; the system also introduces a real-time monitoring module to dynamically adjust the input parameters of the risk assessment model by monitoring network traffic and system logs, so as to track and respond to the attacker's action changes in real time;

[0050] Step 3: During the evolution of network attacks, the system will dynamically adjust the network's defense strategy based on the results of the attack and defense game through the dynamic defense optimization module. The module will allocate and optimize network resources based on the evaluation results to minimize possible losses. The system combines deep learning models to mine and analyze historical attack data and automatically generate a defense rule library for different attack strategies.

[0051] Step 4: The security situation awareness module collects various sensor data in the network, including traffic monitoring, user behavior analysis, and system logs, to generate a real-time security situation map of the network; the system will dynamically adjust the parameters in the game model according to the real-time situation map, and recalculate the optimal strategy between the attacker and the defender to ensure that the defense strategy is consistent with the current network environment.

[0052] Another object of the present invention is to provide a computer device, comprising a memory and a processor, wherein the memory stores a computer program, and when the computer program is executed by the processor, the processor executes the steps of the network security assessment method based on attack and defense game.

[0053] Another object of the present invention is to provide a computer-readable storage medium storing a computer program, which, when executed by a processor, enables the processor to perform the steps of the network security assessment method based on attack and defense game.

[0054] Another object of the present invention is to provide an information data processing terminal, which is used to implement the network security assessment system and method based on the dynamic attack and defense game model.

[0055] In combination with the above technical solutions and the technical problems solved, the advantages and positive effects of the technical solutions to be protected by the present invention are as follows:

[0056] First, real-time enhancement: Compared with traditional static analysis methods, the network security assessment system based on dynamic attack and defense game can perceive the network status and attack behavior in real time, and can dynamically adjust the defense strategy, which greatly improves the ability to deal with advanced persistent threats.

[0057] Intelligent defense optimization: Through the combination of attack and defense game and machine learning algorithms, the system can adaptively optimize defense strategies and resource allocation, reduce the waste of defense resources, and improve the overall defense effect.

[0058] Accurate attack prediction: The introduction of the game model can more accurately predict the action path that an attacker may take, thereby providing defenders with more targeted countermeasures and reducing the probability of false positives and false negatives.

[0059] Comprehensive situational awareness capabilities: The system can perceive network situations in real time and generate dynamic security situation maps to help administrators understand the current network security status more clearly and make decisions quickly.

[0060] Second, the technical solution of the present invention solves several key problems in existing network security assessment and defense technologies in industrial applications and achieves significant technological progress, which is specifically reflected in the following aspects:

[0061] 1) Enhanced dynamic defense capabilities

[0062] Existing technologies usually rely on static security rules and preset defense strategies, which are difficult to effectively deal with complex and changeable network attacks. The present invention introduces a dynamic defense strategy based on an attack and defense game model, which can dynamically adjust the defense strategy based on historical attack data and real-time network status information. This game equilibrium-based strategy optimization enables defense measures to be adaptively adjusted as the attacker's behavior changes, effectively improving the flexibility and response speed of the defense system.

[0063] 2) Improved accuracy of multi-scenario risk assessment

[0064] The risk assessment methods in traditional network security systems are mostly based on static historical data and lack the ability to simulate and predict dynamic attack scenarios. The present invention uses an attack and defense game model to simulate multiple scenarios. Combined with reinforcement learning technology, the present invention uses an attack and defense game model to simulate multiple scenarios for network security. It not only relies on static historical data, but also can dynamically evaluate different strategies of attackers. Combined with reinforcement learning technology, the system can continuously optimize defense strategies and learn the best response measures during the simulation process. Reinforcement learning allows the system to gain experience in simulating attack and defense, and improve the ability to predict and respond to real-time risks.

[0065] It can predict the strategic behavior of attackers in different scenarios and give the best defense suggestions based on the game equilibrium solution. This multi-scenario simulation improves the accuracy of risk prediction, allowing the system to better foresee potential attack paths and risks, and help enterprises and network administrators prepare for defense in advance.

[0066] 3) Efficiently handle complex attack scenarios

[0067] The existing technology is usually inefficient in processing multi-dimensional and complex attack scenarios and cannot respond to multiple simultaneous attacks in a timely manner. The present invention can quickly respond to multi-dimensional and complex network attack scenarios by performing parallel processing of massive data based on a distributed computing platform (such as Hadoop or Spark), combined with reinforcement learning algorithms and game models. Multiple game simulations not only improve the processing efficiency of the system, but also provide the defender with accurate defense strategies for different attack scenarios.

[0068] Through the above-mentioned technological innovations, the present invention overcomes the deficiencies of existing network security technologies in terms of responding to dynamic attacks, accurate risk assessment, resource optimization, and intelligent defense, significantly improves the flexibility, intelligence, and resource utilization efficiency of the network security assessment system, and has broad industrial application prospects in the field of network security. BRIEF DESCRIPTION OF THE DRAWINGS

[0069] Figure 1 It is a structural block diagram of a network security assessment system and method based on a dynamic attack and defense game model provided by an embodiment of the present invention.

[0070] Figure 2 It is a flow chart of the method for constructing an attack and defense strategy game model provided by an embodiment of the present invention.

[0071] Figure 3 It is a flow chart of a network security assessment method based on a dynamic attack and defense game model provided by an embodiment of the present invention.

[0072] Figure 1 In: 1. Attack and defense game construction module; 2. Risk prediction module; 3. Dynamic defense optimization module; 4. Security situation awareness module. DETAILED DESCRIPTION

[0073] In order to make the purpose, technical solution and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not used to limit the present invention.

[0074] The network security assessment system and method implementation scheme based on the dynamic attack and defense game model can be divided into the following steps:

[0075] 1. Construction of attack and defense game model

[0076] Data collection: First, the system collects data from the network's historical attack data, network topology information, and defense strategy library. Historical attack data includes known attack types, paths, attackers' behavior patterns, etc., while network topology information includes network nodes, connections, and access rights.

[0077] Model construction: Based on these data, game theory is used to build a game model between attackers and defenders. The attacker's strategy includes choosing different attack paths, attack targets, and attack tools, while the defender's strategy includes deploying firewalls, intrusion detection systems, traffic filtering and other defense measures. The attacker's behavior is simulated through a multi-level attack path model, and the defender selects corresponding defense measures based on the attack path.

[0078] Model initialization: Each game simulation will initialize the network state, set the strategy set of the attacker and the defender, and form preliminary defense recommendations by calculating the optimal game equilibrium solution.

[0079] 2. Risk prediction and simulation

[0080] Multiple game simulations: Using the attack-defense game model, multiple simulations are performed on various possible attack scenarios. For example, in one scenario, the attacker chooses a path that bypasses the firewall to leak data, and the defender identifies this attack behavior by deploying an intrusion detection system. Multiple simulations are used to calculate the loss of each attack path and defense strategy.

[0081] Risk assessment: After each simulation, the system estimates the risk value by comparing the scores of the attacker and defender in the game results. Based on the equilibrium solution of the attack and defense game, the system predicts the most likely attack path and attacker's behavior. The simulation results will show the potential losses that the network may suffer in different scenarios and generate a detailed risk assessment report.

[0082] 3. Real-time monitoring and dynamic adjustment

[0083] Real-time monitoring: The system introduces a real-time monitoring module to continuously collect data such as network traffic, user behavior analysis, and system logs. These data are captured through network sensors and intrusion detection systems and transmitted to the game model. The system will analyze these real-time data, discover abnormal activities or potential threats, and update the input parameters in the game model in a timely manner to maintain the dynamic adjustment capability of the defense strategy.

[0084] Dynamically adjust defense strategies: Based on real-time data and risk assessment results, the system will adjust defense strategies in real time. For example, if an attacker chooses a new attack path, the defender can immediately adjust firewall rules, enhance intrusion detection sensitivity, or optimize the configuration of traffic filters to prevent attacks. The system will optimize the allocation of network resources based on the new game equilibrium solution, such as increasing defense resources for high-risk nodes or adjusting access rights.

[0085] 4. Security situation awareness and feedback

[0086] Situation map generation: The security situation awareness module generates a real-time security situation map of the network by collecting and analyzing network traffic monitoring, user behavior and system logs. This situation map can intuitively display the current network security status, the source of potential threats and the possible behavior of attackers.

[0087] Dynamic optimization of the game model: The situation awareness module updates the parameters in the game model through the situation map information, such as the attacker's possible path and the defender's response time, so that the defense strategy is more in line with the current network security situation.

[0088] Defense feedback and execution: The system feeds back the optimized defense strategy to the actual defense equipment (such as firewalls, intrusion detection systems, traffic controllers, etc.) and makes defense adjustments in real time, thereby improving the security of the network.

[0089] A specific application scenario is internal network security defense. In an internal network, attackers may try to steal sensitive data through vulnerabilities in network nodes. The system first builds an attack and defense game model based on historical data and current network topology to predict possible attack paths. The system monitors network traffic in real time, and when abnormal data transmission is found, it dynamically adjusts firewalls and access rights to prevent further expansion of attacks. Through real-time risk assessment and game optimization, the system can ensure that network security is continuously monitored and improved.

[0090] like Figure 1 As shown, a network security assessment system based on a dynamic attack and defense game model provided by an embodiment of the present invention includes:

[0091] Attack and defense game construction module 1, risk prediction module 2, dynamic defense optimization module 3, security situation awareness module 4.

[0092] The attack and defense game construction module 1 is connected to the risk prediction module 2 and is used to introduce a game theory model into the system to simulate the dynamic interaction process between the attacker and the defender. The module first constructs a multi-level attack path model for the attacker and a response strategy model for the defender based on historical attack data and network topology information. The strategies of both the attacker and the defender include attack path selection, defense measures deployment, and resource allocation.

[0093] The risk prediction module 2 is connected with the attack and defense game construction module 1, the dynamic defense optimization module 3, and the security situation awareness module 4, and is used to use the game model to perform multiple simulations to predict the risk value that the network may suffer under different attack scenarios; analyze the most likely attack behavior through the equilibrium solution of the game, and provide the best response strategy suggestions to the defender; the system also introduces a real-time monitoring module, which dynamically adjusts the input parameters of the risk assessment model by monitoring network traffic and system logs, so as to track and respond to the attacker's action changes in real time;

[0094] The dynamic defense optimization module 3 is connected with the risk prediction module 2 and the security situation awareness module 4. In the process of network attack evolution, the system will dynamically adjust the network's defense strategy according to the results of the attack and defense game. The module will allocate and optimize network resources according to the evaluation results to minimize possible losses. The system combines the deep learning model to mine and analyze historical attack data and automatically generate a defense rule library for different attack strategies.

[0095] The security situation awareness module 4 is connected to the risk prediction module 2 and the dynamic defense optimization module 3, and is used to generate a real-time security situation map of the network by collecting various sensor data in the network, including traffic monitoring, user behavior analysis, and system logs; the system will dynamically adjust the parameters in the game model according to the real-time situation map, and recalculate the optimal strategy between the attacker and the defender to ensure that the defense strategy is consistent with the current network environment.

[0096] The network security assessment system and method based on the dynamic attack and defense game model provided by the embodiment of the present invention combines game theory models, deep learning technology, dynamic defense optimization and security situation awareness, aiming to improve the network's defense capabilities and respond to complex network attacks in real time. The system consists of multiple modules, each of which plays a role in different network security stages. The specific implementation scheme is as follows:

[0097] 1. Offense and defense game building module 1

[0098] This module first introduces the basic model of game theory to simulate the dynamic interaction between attackers and defenders. The attacker's strategy includes choosing attack paths and attack methods (such as DDoS attacks, SQL injections, etc.), while the defender responds by deploying firewalls, intrusion detection systems, and other measures. Based on the multi-level attack path model, the system analyzes the attacker's possible paths and generates an attack graph in combination with the network topology. At the same time, using the defender's response strategy model, in the attack and defense game, the attacker's strategy includes choosing different attack paths and attack methods, such as DDoS attacks, SQL injections, etc.; the defender defends by deploying firewalls, intrusion detection systems, etc. Although the number of strategies on both ends of the attack and defense does not have to be exactly the same, it should be ensured that the system can cover a variety of possible attacks and defense methods to accurately simulate the real scenario.

[0099] The connotation of the multi-level attack path model in this article means that the system analyzes multiple paths that an attacker may take from the initial location to the target location based on the network topology, including network nodes and services at different levels. These paths are combined with potential attack methods to generate an attack graph to predict the potential threat of the attack.

[0100] The defender's response strategy model simulates the strategies taken by the defender when facing different attack scenarios, such as adjusting firewall rules, starting intrusion detection systems, etc. This model is used to evaluate the effectiveness of the defense strategy and adjust the defense plan according to the attack dynamics.

[0101] Calculate the optimal defense deployment method. This module builds the strategies of both attackers and defenders through historical attack data and the system's network topology information, and provides a basis for subsequent simulation and risk assessment.

[0102] 2. Risk prediction module 2

[0103] The risk prediction module performs multiple simulations based on the attack-defense game model to predict the risks that the network may face under different attack scenarios. Through the Nash equilibrium solution, the module determines the most likely behavior of the attacker in a specific attack scenario and predicts the network risk value under these behaviors. To enhance the accuracy of the prediction, the system also combines a real-time monitoring module to dynamically adjust the input parameters of the game model using real-time network traffic data, system logs and other information, so that the risk prediction model can adapt to changes in the network at any time. In addition, the Markov decision process (MDP) is used to predict the actions that the attacker may take in the future, and the optimal response strategy of the defender is obtained through repeated game simulations.

[0104] 3. Dynamic defense optimization module 3

[0105] During the evolution of network attacks, the dynamic defense optimization module automatically adjusts the network's defense strategy based on the results of the attack and defense game. This module combines deep reinforcement learning models (such as DQN or A3C) to analyze historical attack data, mine attackers' behavior patterns, and then automatically generate a defense rule library for different attack strategies. After each attack game, the system will re-evaluate the effectiveness of defense measures, dynamically allocate and optimize network resources to minimize possible losses. The module can also dynamically adjust resource allocation based on real-time data analysis to ensure that key nodes in the network have sufficient defense resources.

[0106] 4. Security situation awareness module 4

[0107] The security situation awareness module is responsible for generating a real-time security situation map of the network by collecting various sensor data in the network (such as traffic monitoring, user behavior analysis, system logs, etc.). This module uses convolutional neural networks (CNNs) to perform deep feature extraction on sensor data and identify potential threats in the network. In addition, by comparing historical data with real-time data, the module can detect abnormal activities and evaluate the current security status of the network through comprehensive analysis of traffic, user behavior patterns, and log records. The situation awareness map will dynamically reflect the attacker's actions, so as to adjust the parameters in the game model in a timely manner to ensure that the defense strategy is synchronized with the real-time network environment.

[0108] 5. Calculation of equilibrium solutions in game models

[0109] In order to ensure the best strategy selection for both the attacker and the defender, the attack and defense game building module uses the Nash equilibrium solution algorithm to determine the optimal strategy combination between the defender and the attacker. In each game, the system iteratively calculates the strategy selections of both parties to obtain the most effective equilibrium solution in the current environment. This process is dynamically adjusted in combination with real-time network situation data to adapt to changes in the attacker's strategy and ensure that the defender's response measures are always in the optimal state.

[0110] 6. Real-time monitoring and risk feedback

[0111] During system operation, the risk prediction module continuously obtains real-time monitoring data and updates key parameters in the game model based on the attacker's behavior and changes in network status. The module uses time series prediction models (such as LSTM) to analyze network traffic trends and predict the time and scope of potential attacks. The dynamic adjustment of risk values ​​enables defenders to respond quickly based on the latest threat situation and avoid excessive defense or waste of resources.

[0112] 7. Dynamic defense strategy generation

[0113] The dynamic defense optimization module automatically generates defense strategies based on the reinforcement learning algorithm. By analyzing the attack history and current network status, the system uses the Q-learning algorithm to gradually learn the optimal defense measures in different attack scenarios. These defense strategies are then stored in the defense rule library, and the system will automatically call the appropriate rules according to the current network situation for rapid response. In the middle of the attack, the module can also adjust the defense strategy according to the attacker's real-time behavior to achieve the best protection effect.

[0114] 8. Report generation and optimization suggestions

[0115] After the attack evolves and defense adjustments are completed, the system automatically generates a detailed report, including the risks faced by the network, the paths that the attacker may take, and the defender's response strategies. In addition, by combining machine learning models (such as decision trees and random forests), the system provides users with specific defense optimization suggestions to help users take more effective defense measures in future network attacks and further enhance the overall security of the network.

[0116] This system achieves automated defense and dynamic optimization of network security through the collaborative operation of multiple modules combined with deep learning and game theory models.

[0117] 1. Implementation plan of attack and defense game construction module 1

[0118] The implementation of this module is based on game theory and dynamic interaction modeling in the field of network security. The specific implementation steps are as follows:

[0119] Attack path and strategy modeling: The system first builds the attacker's strategy space based on historical attack data and network topology information. This includes the attack path chosen by the attacker (such as network layer attack, application layer attack) and the attack methods used (such as DDoS, SQL injection, etc.). Using the multi-level attack path model, the system generates an attack path graph, which represents the multiple paths that the attacker can choose and potential network weaknesses.

[0120] Defense strategy modeling: The defender's strategy includes firewall deployment, intrusion detection system (IDS) configuration, resource allocation, etc. By combining the network structure, a defense strategy model is constructed to determine the countermeasures that the defender can take. This module adopts dynamic defense modeling and uses heuristic algorithms (such as genetic algorithms or simulated annealing algorithms) to optimize resource allocation to ensure that defense resources are used reasonably.

[0121] Construction of game model: The interaction between attackers and defenders is abstracted as a zero-sum game or a non-zero-sum game.

[0122] The construction of the game model can be selected as a zero-sum game or a non-zero-sum game according to the actual application scenario. Specifically:

[0123] Zero-sum game: If the attacker's score is exactly equal to the defender's loss, that is, the gain of one party is equal to the loss of the other party, the total gain of both parties is zero. Such a model is suitable for completely opposite and clear-cut scenarios, such as the attacker trying to destroy the defender's system, and the defender is doing everything to prevent this goal from being achieved. Non-zero-sum game: If the gains of both parties are not strictly opposite, there may be a situation where both parties gain or lose at the same time. This model is more suitable for complex scenarios, such as network security, where attackers may explore defense strategies and defenders do not completely fail or succeed in every attack.

[0124] Therefore, the choice of game model depends on the specific interactive relationship between attack and defense. If it is regarded as an absolute opposition scenario, it is usually a zero-sum game; if there are complex interactions and asymmetric benefits, it is a non-zero-sum game.

[0125] The goal of the attacker is to maximize damage, while the goal of the defender is to minimize losses. Mathematically, the choice and results of the strategies of both parties are represented by establishing a profit matrix. The benefits generated when the attacker chooses a specific path and means are calculated by the historical data of the system, and the defender deploys defensive measures to counter these attacks.

[0126] Nash equilibrium calculation: In order to find the balance between the strategies of both parties, the system determines the optimal combination of the strategies of both parties through the Nash equilibrium solution. Using linear programming or optimal response algorithm, the system can automatically calculate the optimal strategies of attackers and defenders in a given network environment. This provides a theoretical basis for subsequent simulation and risk prediction.

[0127] 2. Implementation plan of risk prediction module 2

[0128] The core of the risk prediction module is to simulate multiple times based on the game model and dynamically adjust the prediction in combination with real-time data. The specific implementation is as follows:

[0129] Multiple simulations: After determining the attacker and defender strategy models, the risk prediction module predicts the risk value under different attack scenarios through repeated game simulations. The Monte Carlo simulation method is used in the simulation. Each simulation step will generate new game results based on different attacker behaviors and defender reactions to evaluate the potential risks of the system.

[0130] Risk value calculation: After each game, the system calculates the risk value of the attack scenario based on the attack success rate, defense failure rate and loss degree. The risk value is calculated by the formula (R = P*L), where P represents the probability of successful attack and L represents the potential loss caused by defense failure. This module can improve the accuracy of risk calculation by introducing historical data and probability estimation based on Bayesian network.

[0131] Real-time data monitoring: To make risk assessment more accurate, the system integrates a real-time network monitoring module to dynamically obtain network traffic data, system logs, and user behavior data. After preprocessing, these data are used as inputs to the game model to adjust the prediction of attacker behavior and the evaluation of defender response. Through real-time feedback, the model can adapt to the dynamic changes of the network and ensure the accuracy of risk prediction.

[0132] Markov Decision Process (MDP): To predict the attacker's possible future actions, the system introduces MDP. MDP regards the attacker's actions as a state transition process, using historical attack behaviors and the current environment state to predict the next possible attack means and targets. The MDP state transition probability matrix (P(s'|s,a)) will be updated after each game, and the strategy selection will be continuously optimized based on the current attacker strategy and defender response.

[0133] Optimized strategy generation: After each game simulation, the system uses the Bellman equation to optimize the defense strategy and generate recommendations for optimal response measures. The recursive form of the Bellman equation helps defenders adjust resource allocation based on current status and future risks, ensuring that the system's defense measures are always in the optimal state.

[0134] The present invention monitors and responds to network attack threats in real time through the collaborative work of multiple modules. First, the attack and defense game construction module builds a multi-level game model of attackers and defenders based on historical attack data and network topology information. The module processes content including network attack behavior, topology structure and defense strategy, and simulates multiple possible paths of attackers through historical data analysis, calculates the strategy selection of both parties of the game, and forms a decision-making framework between attack and defense. Each simulation will generate an attack path and a corresponding defense strategy. Secondly, the risk prediction module uses the attack and defense game model to perform multiple simulations to evaluate the risks that the system may face under different attack scenarios. Data processing mainly includes attack behavior and defense strategy data from the game model, and the equilibrium solution obtained through multiple game analysis is used to predict the most likely behavior path of the attacker. At the same time, the real-time monitoring module will introduce information such as current network traffic, user behavior, system logs, etc. into the game model, dynamically update model parameters, and ensure that the prediction results are consistent with the current network environment. These dynamically input data will be filtered, parsed and used to adjust the parameters in the game model. Third, the dynamic defense optimization module uses deep learning models to process historical attack data based on risk assessment, and generates a defense rule base through deep mining and pattern recognition. The data processing of this module includes dynamic adjustment of network resource allocation and attack defense rules, and optimizes the network's defense configuration in real time by analyzing attack paths and defense effects. According to the risk value and game results output by the model, the module will readjust the network's resource configuration and defense strategy to ensure that losses are minimized in different attack scenarios.

[0135] Finally, the security situation awareness module generates a real-time security situation map of the network by analyzing system logs, user behavior data and network traffic. This module generates a real-time network security situation map after preprocessing the raw data collected by the sensor, including data cleaning and feature extraction. The situation map is generated by dynamically adjusting the input parameters in the game model through network traffic anomaly detection and behavior pattern analysis, thereby optimizing the defense strategy in real time and ensuring the continuous synchronization and adaptability of the attack and defense game with the actual network environment.

[0136] Implementation of the attack and defense game building module provided by the embodiment of the present invention:

[0137] Collection and analysis of historical data:

[0138] Collect historical attack data in the network, including the attack methods, attack paths, network vulnerabilities, and intrusion points used by attackers; combine network topology information to establish a potential attack path library for attackers;

[0139] The defender's strategy includes the configuration of each protection node, the allocation strategy of network resources, the rules of firewalls and intrusion detection systems, and defense measures to deal with different types of attacks.

[0140] like Figure 2 As shown, the attack and defense strategy game model provided by the embodiment of the present invention is constructed as follows:

[0141] S101, using the game theory model, defines the action space of the attacker and defender, i.e. the attacker's attack path selection and the defender's defense measures deployment, and converts it into the state space of the attack and defense game;

[0142] S102, set the utility function of the attacker and defender, that is, the attacker tries to maximize the destructive benefit through attack means, while the defender minimizes the loss by deploying defense strategies; the strategies of both parties in action selection can be solved through Nash equilibrium.

[0143] Implementation of the risk prediction module provided by the embodiment of the present invention:

[0144] Multi-scenario game simulation:

[0145] The system simulates multiple possible attack scenarios and performs multiple simulations on the game model to evaluate the success probability of different paths and attack strategies of the attacker, as well as the risk value that the network system may suffer in these situations;

[0146] Based on the analysis of game equilibrium solutions, the most likely attack paths and behaviors are predicted, and the best response suggestions are given to the network defenders;

[0147] Real-time monitoring and dynamic adjustment:

[0148] The real-time monitoring module obtains real-time data through network traffic, system logs, and behavioral analysis, and continuously updates the input of the game model and adjusts the risk assessment model;

[0149] Combined with machine learning algorithms, it helps administrators take preventive measures by predicting impending attack behaviors and assessing possible risks in advance.

[0150] Implementation of the dynamic defense optimization module provided by the embodiment of the present invention:

[0151] Optimized configuration of defense resources:

[0152] Based on the risk assessment results and current network resources, the system automatically optimizes the allocation of defense resources, including computing resources and bandwidth, to minimize defense costs while maintaining the best protection effect.

[0153] The system converts different defense strategies, including adjusting firewall rules and IDS detection modes, into executable defense tasks and deploys them to the entire network through a central control system.

[0154] Generation of defense rule base based on deep learning:

[0155] The system automatically generates a defense rule library suitable for different attack strategies through deep learning analysis of historical attack data; it uses deep neural networks or convolutional neural networks for feature extraction;

[0156] The system continuously self-learns and iteratively optimizes defense strategies to respond to new and unknown threats.

[0157] Implementation of the security situation awareness module provided by the embodiment of the present invention:

[0158] Network situational awareness:

[0159] Through various sensor data including network traffic monitors, behavior analysis systems, and system logs; real-time monitoring of the security status of each node in the network, and generating a real-time situation map to display the security threats currently facing the network;

[0160] The system will dynamically adjust the parameters in the attack and defense game model according to the real-time network situation, and recalculate the optimal defense strategy based on new threat information;

[0161] Dynamic update and analysis of situation map:

[0162] Implement dynamic situation map update technology, use distributed computing platform to quickly process massive data; display situation maps to administrators through visualization technology;

[0163] The system will automatically feed back the threat information in the situation map to the game model as a reference for adjusting the next round of defense strategy.

[0164] like Figure 3 As shown, a network security assessment method based on attack and defense game provided by an embodiment of the present invention includes:

[0165] S201, introduces a game theory model into the system through the attack and defense game construction module to simulate the dynamic interaction process between attackers and defenders; this module first builds a multi-level attack path model for attackers and a response strategy model for defenders based on historical attack data and network topology information; the strategies of both attackers and defenders include attack path selection, defense measures deployment, and resource allocation;

[0166] S202, through the risk prediction module, the game model is used to perform multiple simulations to predict the risk value that the network may suffer under different attack scenarios; the most likely attack behavior is analyzed through the equilibrium solution of the game, and the optimal response strategy is provided to the defender; the system also introduces a real-time monitoring module, which dynamically adjusts the input parameters of the risk assessment model by monitoring network traffic and system logs, so as to track and respond to the attacker's action changes in real time;

[0167] S203, through the dynamic defense optimization module, during the evolution of network attacks, the system will dynamically adjust the network's defense strategy according to the results of the attack and defense game; the module will allocate and optimize network resources according to the evaluation results to minimize possible losses; the system combines deep learning models to mine and analyze historical attack data and automatically generate a defense rule library for different attack strategies;

[0168] S204, collects various sensor data in the network including traffic monitoring, user behavior analysis, and system logs through the security situation awareness module to generate a real-time security situation map of the network; the system will dynamically adjust the parameters in the game model according to the real-time situation map, and recalculate the optimal strategy between the attacker and the defender to ensure that the defense strategy is consistent with the current network environment.

[0169] Another object of the present invention is to provide a computer device, comprising a memory and a processor, wherein the memory stores a computer program, and when the computer program is executed by the processor, the processor executes the steps of the network security assessment method based on attack and defense game.

[0170] Another object of the present invention is to provide a computer-readable storage medium storing a computer program, which, when executed by a processor, enables the processor to perform the steps of the network security assessment method based on attack and defense game.

[0171] Another object of the present invention is to provide an information data processing terminal, which is used to implement the network security assessment system and method based on the dynamic attack and defense game model.

[0172] In view of the above problems, a network security assessment system and method based on a dynamic attack and defense game model proposes an improved dynamic network security assessment framework, which includes the following key components:

[0173] 1. Offense and defense game building module:

[0174] The game theory model is introduced into the system to simulate the dynamic interaction process between attackers and defenders. This module first builds a multi-level attack path model for attackers and a response strategy model for defenders based on historical attack data and network topology information.

[0175] The strategies of both the attacker and the defender include attack path selection, defense measures deployment, resource allocation, etc.

[0176] 2. Risk prediction module:

[0177] The game model is used to perform multiple simulations to predict the risk value that the network may suffer under different attack scenarios. The most likely attack behavior is analyzed through the equilibrium solution of the game, and the optimal response strategy is provided to the defender.

[0178] The system also introduces a real-time monitoring module, which monitors network traffic and system logs and dynamically adjusts the input parameters of the risk assessment model, thereby tracking and responding to changes in attackers' actions in real time.

[0179] 3. Dynamic defense optimization module:

[0180] In the process of network attack evolution, the system will dynamically adjust the network's defense strategy according to the results of the attack and defense game. This module will allocate and optimize network resources (such as computing resources, bandwidth, etc.) according to the evaluation results to minimize possible losses.

[0181] The system combines deep learning models to mine and analyze historical attack data and automatically generates a defense rule library for different attack strategies.

[0182] 4. Security situation awareness module:

[0183] This module generates a real-time security situation map of the network by collecting various sensor data in the network (including traffic monitoring, user behavior analysis, system logs, etc.).

[0184] The system will dynamically adjust the parameters in the game model according to the real-time situation map and recalculate the optimal strategy between the attacker and the defender to ensure that the defense strategy is consistent with the current network environment.

[0185] Systematic approach steps:

[0186] 1. Initialize the network environment: Build an initial game model based on the network topology and historical attack data, and initialize the strategy sets of attackers and defenders.

[0187] 2. Real-time data collection and analysis: Monitor network traffic, node status, system logs, etc. through various sensors, and update the input of the game model in real time.

[0188] 3. Attacker strategy prediction and risk assessment: The system uses game models combined with machine learning algorithms to predict the attacker’s optimal attack path and assess the risk of attacks that the current network may suffer.

[0189] 4. Defense strategy optimization and implementation: Generate dynamic defense strategies based on game results and risk assessment, and make optimal allocation of defense resources (such as firewall rule updates, IDS rule adjustments, etc.).

[0190] 5. Feedback and continuous improvement: By continuously collecting new network data, the game model is iteratively optimized to ensure that the system can cope with continuous and dynamic attack behaviors.

[0191] Technological advances brought about by systems and methods:

[0192] 1. Intelligent defense optimization: Through the combination of attack and defense game and machine learning algorithms, the system can adaptively optimize defense strategies and resource allocation, reduce the waste of defense resources, and improve the overall defense effect.

[0193] 2. Accurate attack prediction: The introduction of the game model can more accurately predict the action path that the attacker may take, thereby providing the defender with more targeted response measures and reducing the probability of false positives and false negatives.

[0194] 3. Comprehensive situational awareness: The system can perceive the network situation in real time and generate a dynamic security situation map to help administrators understand the current network security status more clearly and make decisions quickly.

[0195] The specific implementation of this system is based on the attack and defense game model, reinforcement learning algorithm, deep learning technology and security situation awareness data stream processing. The following six steps combine specific mathematical models and data to elaborate on the implementation of each module:

[0196] 1. Construction of attack and defense game model

[0197] The attack-defense game model optimizes the strategies of attackers and defenders based on the Nash equilibrium in game theory. First, collect the historical attack data of the network A = {a1, a2, ..., a n}, including attack paths, vulnerabilities and attack methods. Then, combined with the network topology T = {t1, t2, ..., t n}, (here t n represents the nth node in the grid) to generate the attack path library. The strategy set of the attacking and defending parties is defined as SA = {s-a1, s-a2, ..., sa n} and SD = {s-d1,s-d2,...,sd n}, where the attacker’s strategy is to choose the attack path and the defender’s strategy is to deploy defensive measures.

[0198] The attack path and defense measures are introduced into the model in a quantitative way. The attack path can be represented by a probability matrix, and the defense measures are quantified by the defense response matrix. For example, the probability of selecting the attack path p i The loss caused by the attack i The combination constitutes the attacker’s utility function. The defensive measures are calculated by the defense loss D i and its deployment cost c D The combination constitutes the utility function of the defender. In this way, the strategies and losses of the attacker and defender can be expressed in matrices, which facilitates the calculation of the optimal strategy.

[0199] The system obtains the optimal game solution and optimizes the attack and defense strategy by solving the utility function UA ​​attacker's gain function and UD defender's loss function. The utility function of both the attacker and the defender can be expressed as:

[0200]

[0201] where p i is the probability of selecting the attack path, L i is the loss caused by the attack, D i is the defender's loss, c A and c D is the cost of attack and defense. A Can only be used once.

[0202] By solving the utility functions UA and UD, the system can calculate the optimal strategies of the attacker and defender, that is, find the Nash equilibrium point, at which neither party can gain greater benefits by changing their strategy alone. In this way, the attack-defense game model can not only optimize the defender's strategy, but also predict the most likely attack path and improve the overall protection capability of network security.

[0203] The practical significance of utility function in network security assessment lies in that it provides a way to quantify risks and defense effects, helping defenders deploy the most effective defense strategy at the lowest cost while reducing possible attack losses.

[0204] 2. Application of reinforcement learning in game theory

[0205] In a dynamic network environment, the Q-learning reinforcement learning algorithm is used to train attackers and defenders to learn the optimal strategy. The core D of Q-learning is to evaluate the expected benefit (i.e., Q value) of taking an action A in each state S. Here:

[0206] S (state) refers to a specific state in the network, such as the network topology, current security situation, etc. It can be combined with the network topology T mentioned above, that is, T represents different network node states, and S is the state of these nodes at a specific moment.

[0207] A (action) represents the strategies or operations taken by the attacker and defender in a specific state. For example, the attacker's action may be to choose a certain attack path or execute a certain attack method (such as DDoS attack or SQL injection), while the defender's action is to choose which defense measures to deploy (such as strengthening the firewall or enabling intrusion detection).

[0208] In this context, action A can be understood as the specific choice behavior of the attacker and defender in the game, which is associated with the strategy sets SA and SD mentioned above. In other words, A is an element in the strategy set SA or SD, representing a decision at a specific moment.

[0209] Q-learning update formula:

[0210]

[0211] α is the learning rate: it controls the speed of Q value update and determines the influence of new experience on the update. If Q is too high, the system will rely too much on the latest data and easily ignore long-term experience; if Q is too low, the system will be insensitive to new information.

[0212] r is the reward for the current state: after executing an action A in the current state, the system obtains the reward value based on the actual result. The reward value is closely related to the actual situation such as the success of the attack and defense, the degree of loss, etc. For example, successfully blocking an attack will give the defender a higher reward, while the attacker will receive a high reward for successfully breaking through the defense.

[0213] γ is the discount factor: it indicates the degree of attenuation of future rewards, and its value is between 0 and 1. The closer it is to 1, the more the system values ​​long-term future rewards; the smaller the value, the more the system focuses on immediate returns. For defenders, long-term considerations may require a larger discount value.

[0214] S' is the new state after the action is executed: after action A is executed, the system will enter a new state S; this reflects the changes in the network attack and defense status, such as whether the attack is successful, whether the network defense is strengthened, etc.

[0215] Model training process:

[0216] The system gradually updates the Q value by repeatedly simulating the attack and defense interactions between attackers and defenders. In each interaction, the attacker will choose an optimal attack path and adjust the Q value according to the attack and defense results; similarly, the defender will adjust the defense strategy and learn how to deal with attacks more effectively in the future.

[0217] Through this reinforcement learning process, the Q-value function of the final game model will converge to the optimal strategy, allowing the attacker to learn the attack path with the highest success rate, while the defender can find the most effective defense strategy, forming the best attack and defense strategy combination.

[0218] 3. Risk prediction and multi-scenario game simulation

[0219] The system performs statistical analysis on the results of multiple game simulations to predict the risk value under different scenarios. First, set multiple scenarios C = {c1, c2, ..., c m}, each scenario is defined as a different path combination chosen by the attacker. Through multiple simulations, the attack success probability P(c i ), and the defender’s loss L(c i ). The risk prediction model is based on the expected loss function:

[0220]

[0221] Among them, R is the total risk value. The system simulates different scenarios, calculates the risk value of each scenario, and provides the best defense suggestions for the defender.

[0222] Set multiple scenes C = {c i ,c2,…,c m} represents the set of scenarios that may occur when the system simulates different attack and defense situations. Each scenario c i Represents a specific attack and defense scenario, such as different attack methods, path selections, or combinations of defense measures. By simulating these scenarios, the system can statistically analyze the risk value under each scenario, predict the probability of successful attack and the effectiveness of defense under different circumstances, and provide decision-making basis for administrators.

[0223] 4. Dynamic defense optimization and resource allocation

[0224] After the risk assessment results are combined with the game model, the dynamic defense optimization module will dynamically allocate network resources according to the optimal game results. D , the system optimizes the objective function O(R D ) to minimize defense costs and maximize defense benefits. The defense's resource allocation can be achieved through a linear programming model:

[0225]

[0226] Among them C i is the cost of defense resources, R i The resource consumption of each defense measure, x i is the decision variable for whether to adopt the defense measure (0 means not adopted, 1 means adopted). By solving the linear programming, the system can optimize the defense configuration without exceeding the resource budget.

[0227] R D The specific value of comes from the actual bandwidth of the network, computing power and other hardware resource limitations. Based on this, the system constructs an optimization objective function O(R d ), to minimize the cost of defense resources and maximize the defense effectiveness.

[0228] Through this model, the system can automatically allocate network resources to ensure that the resource budget does not exceed R D This dynamic optimization mechanism can make real-time adjustments based on the risk assessment results of current network attacks to improve defense effectiveness.

[0229] 5. Security situation awareness and data processing

[0230] The security situation awareness module collects real-time data through network sensors, including traffic monitoring, user behavior, system logs, etc. The system processes this data through big data analysis technology to form a network security situation map. Let the situation map be mathcal{S}={s1,s2,…,s k}, each s i The security status of a node in the network. The data is processed through the Hadoop distributed computing framework, and feature extraction methods such as principal component analysis (PCA) are used to extract key features. The extracted feature data will be used as the input of the game model to adjust the defense strategy in real time.

[0231] As the core innovation of this invention, the security situation awareness and data processing module aims to provide comprehensive real-time monitoring and analysis capabilities for network security defense, thereby providing data support for dynamically adjusting defense strategies. Through comprehensive analysis of multi-dimensional data, the module can accurately perceive the security situation of the network environment, discover potential threats in a timely manner, and guide the system to make the best defense decisions through game models. The details are as follows:

[0232] 1. Data collection and monitoring

[0233] The security situation awareness module first collects a large amount of real-time data through a variety of sensors deployed in the network. These sensors include traffic monitoring devices, intrusion detection systems, user behavior monitoring systems, and system log collection tools. The collected data content is very extensive, covering changes in network traffic, user access behavior, abnormal events in system logs, and the operating status of network nodes. Through the comprehensive collection of these data, the system can grasp the operating status and security status of the entire network in real time.

[0234] 2. Distributed computing and big data analysis

[0235] The amount of data collected is huge and complex, and the system uses the Hadoop distributed computing framework to process and analyze this data. Hadoop's parallel processing capabilities can effectively process large-scale, multi-dimensional security data, ensuring the real-time and efficient data processing. At the same time, the system also integrates big data analysis technologies, such as principal component analysis (PCA). PCA reduces the dimensionality of multi-dimensional data, extracts key features that reflect the network security status, removes redundant information, and makes subsequent analysis more accurate and efficient.

[0236] 3. Situational awareness and security situation map construction

[0237] Based on the processed data, the system will construct a network security situation map. Let the situation map be S = {S i , S2,…,s k}, where each S i Indicates the security status of a node in the network. The security situation diagram can intuitively reflect the security status of the entire network, such as which nodes are attacked, which nodes have high-risk vulnerabilities, which nodes have abnormal traffic, etc. Through this graphical method, administrators can quickly understand the overall situation of the network and decide whether to take corresponding defense measures.

[0238] 4. Security situation assessment and feature extraction

[0239] In order to more accurately assess the security situation of the network, the system extracts important security features through data analysis. Principal component analysis (PCA) is used to extract key factors that affect network security, such as abnormal traffic patterns, user behavior deviations, system error rates, etc. Through feature extraction, the system can transform complex raw data into feature vectors that can be used for decision support, thereby significantly reducing computing overhead and improving the processing efficiency of the model.

[0240] 5. Linking situational awareness with defense strategies

[0241] The security situation awareness module is not only used for network monitoring and risk assessment, but its output data will also be used as the input of the game model to provide decision-making basis for the system. i The defense strategy will be adjusted in real time in combination with the defense resources and attack paths in the network. By closely combining situational awareness with game decision-making, the system can respond quickly when a network threat is detected and dynamically allocate defense resources, thus achieving smarter and more efficient network defense.

[0242] 6. Real-time dynamic adjustment

[0243] Since the security situation is changing dynamically, the system can capture and process these changes in real time. Whenever a node in the network has a security risk, the situation awareness module will immediately update the network's security situation map and trigger the recalculation of the defense strategy based on the latest situation map information. This dynamic adjustment mechanism ensures that the system can respond to sudden network attacks in a timely manner and minimize potential security threats.

[0244] The security situation awareness and data processing module provides efficient data support and decision-making basis for network security defense through large-scale data collection, distributed computing, big data analysis, situation map construction and dynamic adjustment. This module not only improves the real-time and accuracy of network security defense, but also provides a basis for continuous optimization of the system's dynamic game model, ensuring that defense measures can respond to various network threats in a timely and effective manner.

[0245] 7. Deep learning and automatic defense rule generation

[0246] The system uses convolutional neural networks (CNN) or deep neural networks (DNN) to conduct deep learning on historical attack data and automatically generate a defense rule base. The feature extraction model of CNN for attack data is:

[0247] F(x) = ReLU(W*x+b),

[0248] Where W is the convolution kernel, x is the input attack data, and b is the bias term. After multiple layers of convolution and pooling operations, CNN extracts key features from the attack data and uses them to automatically generate defense rules. By automatically updating the defense rule library, the system can respond to new attack patterns and improve the network's defense capabilities.

[0249] In the present invention, the system uses a convolutional neural network (CNN) or a deep neural network (DNN) to perform deep learning on historical attack data and automatically generates a defense rule base. Here, CNN is used as an example to illustrate that its feature extraction model is used to extract key features from a large amount of complex attack data. The structure of the model is as follows:

[0250] 1. CNN feature extraction model

[0251] Let W be the convolution kernel, x be the input attack data, and b be the bias term. In the network security scenario, the convolution kernel W corresponds to a filter used to identify attack patterns, which is used to detect certain specific features in attack behaviors, such as traffic anomalies, attack paths at the protocol level, or structural features of data packets. The role of the bias term b in the network is to adjust the detection sensitivity to ensure that the diverse attack data changes are considered when matching features.

[0252] 2. Key feature extraction

[0253] After multiple layers of convolution and pooling operations, CNN can extract key features from attack data, including:

[0254] -Attack traffic pattern: such as abnormal changes in data packet size, interval time, etc.

[0255] - Attack Paths: Identify the network paths used by attackers, especially in multi-stage attacks.

[0256] -Protocol anomalies: Detect non-standard behaviors that occur during the use of network protocols, such as port scanning, unexpected packet formats, etc.

[0257] After these features are extracted, they enter the defense rule generation module.

[0258] 3. Defense rule generation and examples

[0259] Defense rules are system-generated response strategies based on attack data that guide network defense operations. Specific examples include:

[0260] - Abnormal traffic blocking: For example, when a traffic peak exceeding a preset threshold is detected, the system will automatically generate rules to limit the traffic source.

[0261] -Port closure or IP blacklist: When an IP address attempts abnormal access multiple times, the system can automatically add the IP to the blacklist and generate a rule to prohibit access.

[0262] -Deep protocol inspection: For abnormal protocol behavior, corresponding rules are generated to detect the integrity and protocol specifications of data packets.

[0263] By automatically generating and updating these defense rules, the system can continuously adapt to new attack patterns and keep the defense mechanism forward-looking and effective.

[0264] 4. Update of defense rule base

[0265] The system automatically updates the defense rule base through the continuous learning mechanism of CNN and the new features in the attack data. The continuous expansion and optimization of the defense rule base ensures that the system can respond to new attack modes in real time and enhance the dynamic adjustment capability of network defense. Whenever the system detects unknown attack features, the defense rule base will generate adaptive rules based on the new features and immediately deploy them to network defense.

[0266] Through CNN's feature extraction of attack data and automatic generation of defense rules, the system of the present invention can greatly improve the intelligence level of the defense mechanism. The role of the convolution kernel and bias term in the network is not limited to simple feature recognition, but also through the continuous update of the rule base, it ensures that the system has the ability to respond quickly when facing unknown threats.

[0267] This solution achieves dynamic and efficient network security assessment and defense through the combination of game theory, reinforcement learning, deep learning and situational awareness technology, and improves the ability to respond to diverse attack scenarios in complex network environments.

[0268] The above description is only a specific implementation mode of the present invention, but the protection scope of the present invention is not limited thereto. Any modifications, equivalent substitutions and improvements made by any technician familiar with the technical field within the technical scope disclosed by the present invention and within the spirit and principle of the present invention should be covered by the protection scope of the present invention.

Claims

1. A network security assessment system based on a dynamic attack and defense game model, characterized in that: include: The attack-defense game construction module is used to collect historical network attack data, network topology information, and data in the defense strategy library to build a multi-level attack path model and a defender response strategy model; the attack-defense game model simulates the attacker's selection of different attack paths and attack tools, and the defender deploys defense measures according to the attack path, generates an attack-defense game equilibrium solution, and provides preliminary defense suggestions; A risk prediction module, connected to the attack and defense game building module, is used to perform risk assessment on potential attack behaviors by simulating different attack scenarios multiple times, generate predicted risk values, and provide a detailed risk assessment report; The dynamic defense optimization module receives the output results of the risk prediction module, dynamically adjusts the network defense strategy according to the game model results, optimizes resource allocation, and reduces potential losses; Through sensors, network traffic, user behavior analysis, system logs and other information are collected and used as input to the game model to update the input parameters of risk assessment and realize dynamic adjustment of defense strategies. The security situation awareness module is used to collect sensor data such as network traffic monitoring, user behavior analysis, and system logs, generate a real-time security situation map, dynamically adjust the parameters in the game model, and optimize the defense strategy; receive the security situation map generated by the security situation awareness module, adjust the defense strategy in real time, and feed back the defense strategy to devices such as firewalls, intrusion detection systems, and traffic controllers to ensure that the defense strategy matches the current network environment.

2. The network security assessment system based on the dynamic attack and defense game model as claimed in claim 1, characterized in that: Implementation of the attack and defense game building module: Collection and analysis of historical data: Collect historical attack data in the network, including the attack methods, attack paths, network vulnerabilities, and intrusion points used by attackers; combine network topology information to establish a potential attack path library for attackers; The defender's strategy includes the configuration of each protection node, the allocation strategy of network resources, the rules of firewalls and intrusion detection systems, and defense measures to deal with different types of attacks.

3. The network security assessment system based on the dynamic attack and defense game model as claimed in claim 1, characterized in that: Implementation of the attack and defense game building module: Use game theory models to define the action space of the attacker and defender, i.e. the attacker's attack path selection and the defender's defense measures deployment, and convert them into the state space of the attack and defense game; The utility functions of the attacker and defender are set, that is, the attacker tries to maximize the destructive benefits through attack means, while the defender minimizes the losses by deploying defense strategies; the strategies of both parties in action selection can be solved through Nash equilibrium.

4. The network security assessment system based on the dynamic attack and defense game model as claimed in claim 1, characterized in that: Implementation of the risk prediction module: (1) Multi-scenario game simulation Multi-scenario simulation: By simulating multiple possible attack scenarios, the system can pre-consider the paths and strategies that attackers may take under different conditions. Specifically, this can include the attacker's intrusion path, attack target, and means used, such as DDOS attacks, SQL injections, data theft, etc., as well as how the system responds to these attacks; Game model: The system regards the attacker and the defender as two parties in the game, and uses game theory strategies to simulate the attacker's decision-making process and the defender's response behavior; Through multiple simulations, the system can evaluate the attacker's success probability and calculate the risk value of the network system under different attack scenarios; (2) Training of risk prediction models This multi-scenario simulation does not directly train the model, but provides the model with rich data and scenarios for risk assessment. By simulating the game model, the system can generate a variety of possible attack data and use this data to assess the weaknesses and potential risks of the network system. Training of machine learning models: For the risk prediction module, the trained machine learning model can be a model based on small sample training. When the amount of sample data is limited, this small sample training model uses existing attack and defense data, and through methods such as transfer learning or reinforcement learning, the model can also obtain good generalization capabilities on data generated by multi-scenario simulation. This method can improve the performance of the model by combining limited real data with simulated data; Multi-scenario simulation generates a large amount of data on different attack paths, which is used to train machine learning models. Even if the real attack samples are limited, the data set can be expanded through simulation to improve the learning effect of the model. The small sample training model uses these limited data, combined with methods such as transfer learning or reinforcement learning, to predict future attacks and assess risks, helping administrators take preventive measures in advance; (3) Risk assessment and prediction The system uses a trained machine learning model to predict the risk of attack behaviors. This model will combine the results of game simulation to evaluate the potential risks of each attack path and provide strategic recommendations to the defender. Output results: Ultimately, the risk prediction module will output the evaluation of potential attack paths under the current network status, the probability of success, the possible risk value, and provide response suggestions; this can not only help network administrators understand the weak points in the current network, but also take measures in advance to reduce the success rate of attacks; (4) Applicability and performance optimization Since this method relies on data generated by multi-scenario game simulation when the data sample is limited, the model can still have high practicality and accuracy under small sample conditions.

5. The network security assessment system based on the dynamic attack and defense game model as claimed in claim 1, characterized in that: Implementation of the dynamic defense optimization module: Optimized configuration of defense resources: Based on the risk assessment results and current network resources, the system automatically optimizes the allocation of defense resources, including computing resources and bandwidth, to minimize defense costs while maintaining the best protection effect. The system converts different defense strategies, including adjusting firewall rules, IDS detection modes, malicious code detection rules, etc., into executable defense tasks, and deploys them to the entire network through the central control system; Generation of defense rule base based on deep learning: The system automatically generates a defense rule library suitable for different attack strategies through deep learning analysis of historical attack data; it uses deep neural networks or convolutional neural networks for feature extraction; The defense rules refer to the specific protection measures taken by the system in response to different attack strategies. By analyzing historical attack data, the system identifies common attack patterns and characteristics and automatically generates corresponding response rules. These rules include protection strategies, traffic filtering rules, access control strategies, etc., which are used to respond quickly when similar attacks are detected to reduce potential damage. The system continuously self-learns and iteratively optimizes defense strategies to respond to new and unknown threats.

6. The network security assessment system based on the dynamic attack and defense game model as claimed in claim 1, characterized in that: Implementation of the security situation awareness module: Network situation awareness: Through various sensor data including network traffic monitors, behavior analysis systems, and system logs; real-time monitoring of the security status of each node in the network, and generating a real-time situation map to display the security threats currently facing the network; the system will dynamically adjust the parameters in the attack and defense game model according to the real-time network situation, and recalculate the optimal defense strategy based on new threat information. Dynamic update and analysis of situation maps: Implement dynamic situation map update technology and use distributed computing platforms to quickly process massive data; display situation maps to administrators through visualization technology; the system will automatically feed back threat information in the situation map to the game model as a reference for the next round of defense strategy adjustments.

7. A network security assessment method based on a dynamic attack and defense game model according to any one of claims 1 to 6, characterized in that: include: Step 1: Introduce the game theory model into the system through the attack and defense game building module to simulate the dynamic interaction process between attackers and defenders; This module first builds a multi-level attack path model for attackers and a response strategy model for defenders based on historical attack data and network topology information. The strategies of both attackers and defenders include attack path selection, defense measures deployment, and resource allocation. Step 2: The risk prediction module uses the game model to perform multiple simulations to predict the risk value that the network may suffer under different attack scenarios; the most likely attack behavior is analyzed through the equilibrium solution of the game, and the optimal response strategy is provided to the defender; the system also introduces a real-time monitoring module to dynamically adjust the input parameters of the risk assessment model by monitoring network traffic and system logs, so as to track and respond to the attacker's action changes in real time; Step 3: During the evolution of network attacks, the system will dynamically adjust the network's defense strategy based on the results of the attack and defense game through the dynamic defense optimization module. The module will allocate and optimize network resources based on the evaluation results to minimize possible losses. The system combines deep learning models to mine and analyze historical attack data and automatically generate a defense rule library for different attack strategies. Step 4: The security situation awareness module collects various sensor data in the network, including traffic monitoring, user behavior analysis, and system logs, to generate a real-time security situation map of the network; the system will dynamically adjust the parameters in the game model according to the real-time situation map, and recalculate the optimal strategy between the attacker and the defender to ensure that the defense strategy is consistent with the current network environment.

8. A computer device, characterized in that: The computer device includes a memory and a processor, the memory stores a computer program, and when the computer program is executed by the processor, the processor executes the steps of the network security assessment method based on attack and defense game as claimed in claim 7.

9. A computer-readable storage medium storing a computer program, wherein when the computer program is executed by a processor, the processor executes the steps of the network security assessment method based on dynamic attack and defense game as claimed in claim 7.

10. An information data processing terminal, characterized in that: The information data processing terminal is used to implement a network security assessment system based on a dynamic attack and defense game model as described in any one of claims 1-6.

Images