Moving target defense method based on software defined network, software defined network and medium

Abstract

The invention belongs to the technical field of network security, and provides a moving target defense method based on a software-defined network, the software-defined network and a medium, and the method comprises the steps: firstly obtaining the state information of the software-defined network; then, in combination with an artificial intelligence model, determining a key state feature as a low-dimensional vector representation of a network state of the distributed software defined network; then, constructing a dynamic environment model of the distributed software defined network; and finally, according to an evolutionary game algorithm based on reinforcement learning and the dynamic environment model, determining a moving target defense strategy of the distributed software defined network. According to the method, the high-dimensional state information of the distributed software-defined network is converted into low-dimensional key state features through the artificial intelligence model, so that the curse of dimensionality when a traditional algorithm processes a high-dimensional state space is effectively dealt with, and the algorithm performance is improved; the network state can be accurately perceived, the defense strategy is dynamically adjusted based on a dynamic environment model and an evolutionary game algorithm of reinforcement learning, and the adaptability and effectiveness of the defense strategy are enhanced.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of network security, and particularly relates to a moving target defense method based on a software-defined network, a software-defined network and a medium. BACKGROUND

[0002] With the rapid development of the Internet, traditional network architecture faces many challenges in flexibility, manageability and adaptability. Distributed software-defined network (Distributed Software-Defined Network, DSDN) emerges as the times require, which separates the control plane and the data plane and realizes the flexible configuration and management of the network through software definition. DSDN is widely used in data centers, enterprise networks and operator networks and other fields, and can quickly adjust network strategies according to different business needs.

[0003] At the same time, network security threats are increasingly complex and diverse, such as distributed denial of service attacks, malware infections, vulnerability exploitation, etc. Traditional network security defense means are mainly based on static rules, which are difficult to cope with the changing attack patterns. Moving target defense (Moving Target Defense, MTD) as an active defense strategy, by dynamically changing the attack surface of the network, increasing the difficulty and cost of attackers, has become a research hotspot in the current network security field.

[0004] In the dynamic game process with the attacker, the defender needs to adjust the strategy according to the behavior of the attacker and the network state. The behavior of the attacker has uncertainty and diversity, and the defender needs to find the optimal defense strategy in this dynamically changing environment. Due to the complexity of the distributed SDN network, the state space dimension is very high, including network topology, traffic information, node state, security threat and other aspects. When dealing with high-dimensional state space, the existing algorithm is prone to the curse of dimensionality problem. SUMMARY

[0005] Therefore, the application provides a moving target defense method based on a software-defined network, a software-defined network and a medium, which aims to solve the problem that the existing technology is prone to the curse of dimensionality problem when dealing with high-dimensional state space due to the complexity of the distributed SDN network.

[0006] The first aspect of the embodiment of the application provides a moving target defense method based on a software-defined network, applied to a distributed software-defined network; the method comprises: obtaining state information of the software-defined network; determining key state features according to the state information and an artificial intelligence model; wherein the key state features are low-dimensional vector representations of the network state of the distributed software-defined network; According to the key state feature, a dynamic environment model of the distributed software defined network is constructed; According to the evolutionary game algorithm based on reinforcement learning and the dynamic environment model, a mobile target defense strategy of the distributed software defined network is determined.

[0007] In a possible implementation, the artificial intelligence model includes a graph neural network and a deep belief network; according to the state information and the artificial intelligence model, the key state feature is determined, including: The distributed software defined network is divided into multiple levels; According to the graph neural network, the state information is analyzed, so that the state information of each level is constructed as a subgraph of the graph neural network; The graph neural network output of each subgraph is input as input into the deep belief network for global information fusion to obtain the key state feature.

[0008] In a possible implementation, the state information includes topology state, node function and traffic state; the distributed software defined network is divided into multiple levels, including: According to the topology state, the node function and the traffic state, the distributed software defined network is initially divided; The node or link causing the hierarchical conflict is obtained and the node or link is re-layered based on a preset priority.

[0009] In a possible implementation, the initial division of the distributed software defined network according to the topology state, the node function and the traffic state includes: According to the topology structure, the distributed software defined network is divided into a core layer, an aggregation layer and an access layer; According to the node function, the distributed software defined network is divided into a control layer, a forwarding layer and a terminal layer; According to the traffic state, the distributed software defined network is divided into a real-time traffic layer, a non-real-time traffic layer and a security isolation layer.

[0010] In a possible implementation, according to the graph neural network, the state information is analyzed, so that the state information of each level is constructed as a subgraph of the graph neural network, including: According to the topology state, the node function and the traffic state of each level, the basic unit feature and the edge feature of each subgraph are determined; The basic unit feature and the edge feature are integrated to form a subgraph data structure of each level.

[0011] In a possible implementation, the graph neural network output of each subgraph is input as input into the deep belief network for global information fusion to obtain the key state feature, including: Each subgraph is uniformly arranged; The processed subgraphs are input into a deep belief network for global information fusion to obtain key state features; the deep belief network dynamically adjusts parameters through safety state labels and backpropagation algorithm.

[0012] In one possible implementation, a dynamic environment model of the distributed software-defined network is constructed based on key state characteristics, including: By inputting key state features into a pre-established Bayesian network model, a dynamic environment model of a distributed software-defined network is constructed.

[0013] In one possible implementation, a mobile target defense strategy for a distributed software-defined network is determined based on a reinforcement learning-based evolutionary game algorithm and a dynamic environment model, including: Based on the dynamic environment model, determine the state space information and action space information; Based on the state space information and action space information, the reward function of the reinforcement learning algorithm is determined; the reinforcement learning algorithm is used to adjust the game objective of the evolutionary game algorithm. Based on the evolutionary game theory algorithm, a mobile target defense strategy for distributed software-defined networks is determined.

[0014] A second aspect of the present invention provides a distributed software-defined network, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it implements the steps of the mobile target defense method based on the software-defined network of the first aspect described above.

[0015] A third aspect of the present invention provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the steps of the software-defined network-based mobile target defense method of the first aspect described above.

[0016] The mobile target defense method, software-defined network, and medium based on software-defined networks provided in this invention first acquire the state information of the software-defined network; then, based on the state information and an artificial intelligence model, key state features are determined; wherein, the key state features are low-dimensional vector representations of the network state of the distributed software-defined network; next, a dynamic environment model of the distributed software-defined network is constructed based on the key state features; finally, a mobile target defense strategy for the distributed software-defined network is determined based on an evolutionary game algorithm based on reinforcement learning and the dynamic environment model. This invention transforms the high-dimensional state information of the distributed software-defined network into low-dimensional key state features through an artificial intelligence model, effectively addressing the curse of dimensionality when traditional algorithms process high-dimensional state spaces, thus improving algorithm performance; it can accurately perceive the network state and dynamically adjust the defense strategy based on the dynamic environment model and the evolutionary game algorithm based on reinforcement learning, enhancing the adaptability and effectiveness of the defense strategy. Attached Figure Description

[0017] To more clearly illustrate the technical solutions in the embodiments of the present invention, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0018] Figure 1 This is a flowchart illustrating the implementation of the mobile target defense method based on software-defined networks provided in this embodiment of the invention. Detailed Implementation

[0019] In the following description, specific details such as particular system architectures and techniques are set forth for illustrative purposes and not for limitation, in order to provide a thorough understanding of the embodiments of the invention. However, those skilled in the art will understand that the invention can be implemented in other embodiments without these specific details. In other instances, detailed descriptions of well-known systems, apparatuses, circuits, and methods are omitted so as not to obscure the description of the invention with unnecessary detail.

[0020] Figure 1 This is a flowchart illustrating the implementation of the mobile target defense method based on software-defined networks provided in this embodiment of the invention. Figure 1 As shown, in some embodiments, the mobile target defense method based on software-defined networks is applied to distributed software-defined networks; the method includes: S110, Obtain the status information of the software-defined network; S120, Based on the state information and the artificial intelligence model, determine the key state features; whereby the key state features are low-dimensional vector representations of the network state of the distributed software-defined network. S130, Based on key state characteristics, construct a dynamic environment model for the distributed software-defined network; S140. Based on the evolutionary game algorithm and dynamic environment model based on reinforcement learning, determine the mobile target defense strategy for the distributed software-defined network.

[0021] In this embodiment of the invention, the state information of software-defined network (SDN) covers multiple aspects, and comprehensive and accurate state information acquisition is the basis for subsequent analysis and decision-making.

[0022] Network topology information can be obtained through a software-defined network controller, which has a global view of the entire network topology. For example, the OpenFlow controller can collect information such as the connection relationships between switches, link bandwidth, and latency. Using a simple network management protocol, topology data such as port status and inter-device connectivity can be obtained from network devices.

[0023] Specifically, for node status information, port traffic can be directly obtained for various nodes in the network, such as switches, routers, and servers, and metrics such as CPU utilization and memory usage can be calculated through the controller. For example, performance monitoring tools can be deployed on servers to collect system performance data in real time; for switches and routers, the device's operating status and configuration information can be obtained through their management interfaces.

[0024] The traffic status information can be read directly from the controller, and may include the source address, destination address, traffic rate, traffic type, flow duration, flow size, and number of bytes. This data reflects the flow of data in the network and user usage patterns.

[0025] In this embodiment of the invention, the artificial intelligence model, when processing high-dimensional and complex state information, can extract the most representative key features and transform them into low-dimensional vector representations. The dynamic environment model can describe the changing patterns and interrelationships of distributed software-defined networks under different states. In a dynamic network environment, it is necessary to comprehensively consider the strategy choices of both defenders and attackers to find the optimal defense strategy.

[0026] In some embodiments, the artificial intelligence model includes a graph neural network and a deep belief network; determining key state features based on state information and the artificial intelligence model includes: dividing the distributed software-defined network into multiple layers; analyzing the state information based on the graph neural network so that the state information of each layer is constructed as a subgraph of the graph neural network; and using the output of the graph neural network of each subgraph as input to the deep belief network for global information fusion to obtain the key state features.

[0027] In some embodiments, the status information includes topology status, node functionality, and traffic status; In this embodiment of the invention, the topology reflects the physical or logical connection relationships between various devices (such as switches, routers, etc.) in the network. For example, the connection method between core switches and aggregation switches, the bandwidth and latency of links, etc., all fall under the category of topology. The topology determines the basic architecture and data transmission path of the network. Different nodes in the network perform different functions. Control layer nodes are responsible for centralized management and configuration of the entire network and issuing control commands; forwarding layer nodes are responsible for data forwarding and routing; terminal layer nodes are the source and destination of network data. Traffic status reflects the characteristics of data traffic in the network, including traffic rate, direction, traffic type (such as real-time traffic, non-real-time traffic), and whether security isolation is required. Real-time traffic (such as video conferencing, voice calls) has high requirements for latency and bandwidth, while non-real-time traffic (such as file downloads) is relatively less sensitive. The security isolation layer is used to isolate sensitive data or protected network areas to prevent unauthorized access.

[0028] In some embodiments, the distributed software-defined network is divided into multiple layers, including: performing an initial division of the distributed software-defined network based on topology status, node functions, and traffic status; and obtaining nodes or links that cause layering conflicts and further layering the nodes or links based on preset priorities.

[0029] In this embodiment of the invention, during the initial partitioning process, some nodes or links may simultaneously belong to multiple different layers, resulting in a layering conflict. To resolve this conflict, it is necessary to identify the nodes or links causing the layering conflict and re-layer them based on a preset priority. The priority setting can be determined based on factors such as network service requirements, security requirements, and performance requirements. For example, for services with high real-time requirements, the priority of the real-time traffic layer can be set higher; for nodes or links involving sensitive data, the priority of the security isolation layer can be given priority. Based on the preset priority, the nodes or links causing the layering conflict are re-partitioned. If a node belongs to the access layer in terms of topology, but according to traffic status it carries real-time traffic, and the priority of the real-time traffic layer is higher than that of the access layer, then the node can be re-partitioned to the real-time traffic layer. In this way, the network layering can be ensured to be more reasonable, improving network management efficiency and performance.

[0030] In some embodiments, the initial partitioning of the distributed software-defined network based on topology, node function, and traffic status includes: partitioning the distributed software-defined network into a core layer, aggregation layer, and access layer based on topology; partitioning the distributed software-defined network into a control layer, forwarding layer, and terminal layer based on node function; and partitioning the distributed software-defined network into a real-time traffic layer, a non-real-time traffic layer, and a security isolation layer based on traffic status.

[0031] In this embodiment of the invention, the core layer is the backbone of the network, primarily responsible for high-speed data forwarding and connections between different aggregation layers. Core layer devices typically feature high bandwidth and low latency, enabling them to quickly process large volumes of data traffic. For example, in a large data center network, the core switch connects multiple aggregation switches to achieve rapid data exchange and distribution. The aggregation layer aggregates traffic from the access layer and performs certain policy control and data processing. It can perform operations such as filtering, aggregation, and load balancing on the traffic before forwarding the processed traffic to the core layer. The aggregation layer plays a crucial role in bridging the gap between the core and access layers, reducing the burden on the core layer. The access layer directly connects to end-user devices, providing network access services. It is responsible for connecting user devices to the network and authenticating and authorizing user access. Access layer devices typically have a large number of ports to meet the access needs of a large number of user devices.

[0032] In this embodiment of the invention, the control layer is the core of SDN and consists of an SDN controller. The controller communicates with forwarding layer devices through open interfaces to achieve centralized control and management of the network. The controller can dynamically adjust forwarding rules based on the real-time network status and policy requirements to optimize network performance. The forwarding layer consists of forwarding devices such as switches and routers, responsible for forwarding data according to the forwarding rules issued by the control layer. Forwarding layer devices only need to forward data according to predetermined rules, without needing to concern themselves with the overall network status and policy formulation, thus improving forwarding efficiency. The terminal layer includes various servers and user devices (such as computers and mobile phones). The terminal layer consists of the producers and consumers of network data; they connect to the network through access layer devices and interact with other terminal devices.

[0033] In this embodiment of the invention, the real-time traffic layer is specifically designed to handle real-time traffic with high latency and bandwidth requirements, such as video conferencing and voice calls. To ensure the quality of real-time traffic, the network needs to provide this layer with a low-latency, high-bandwidth transmission channel and employ appropriate scheduling algorithms and resource allocation strategies. The non-real-time traffic layer handles non-real-time traffic that is not sensitive to latency, such as file downloads and email sending and receiving. This layer can adopt a relatively relaxed resource allocation strategy to improve the utilization of network resources. The security isolation layer is used to isolate sensitive data or protected network areas to prevent unauthorized access. For example, a company's financial system or R&D department network can be assigned to the security isolation layer and protected through security mechanisms such as firewalls and access control lists.

[0034] In some embodiments, the state information is analyzed according to the graph neural network so that the state information of each level is constructed as a subgraph of the graph neural network, including: determining the basic unit features and edge features of each subgraph according to the topological state, node function and flow state of each level; and integrating the basic unit features and edge features to form the subgraph data structure of each level.

[0035] In distributed software-defined networks, the network structure is complex and contains multiple layers, each with its unique topology, node functions, and traffic status. Graph neural networks are a powerful tool capable of processing graph-structured data. By constructing the state information of each layer into a subgraph, they can more effectively analyze and mine information from each layer, providing support for subsequent network state assessment and decision-making.

[0036] In this embodiment of the invention, the basic unit typically refers to a node in the network (such as a switch, router, server, etc.). Features such as the degree of a node (i.e., the number of edges connected to that node) and its location in the network can be extracted from the topology. For example, core layer nodes typically have a high degree because they need to connect to multiple aggregation layer nodes; this degree value can be used as part of the basic unit's features. Additionally, the connection type of a node can also be used as a feature; different connection types may have different bandwidths and stability. Edges represent the connection links between nodes. Features such as bandwidth, latency, and reliability of these links can be extracted from the topology. For example, high-bandwidth links may be more suitable for transmitting large amounts of data, while low-latency links are more important for real-time traffic. The physical length of a link can also be used as an edge feature because longer physical links may introduce more signal attenuation and interference.

[0037] In this embodiment of the invention, node functionality determines a node's role and function in the network. For control layer nodes, their processing power, storage capacity, etc., can be used as basic unit characteristics. Forwarding layer nodes, their forwarding rate, supported forwarding protocol types, etc., can also be used as characteristics. Terminal layer nodes, with their CPU performance, memory size, and other computing power-related metrics, can be used as their basic unit characteristics. Edge characteristics related to node functionality can consider the communication protocols and data transmission patterns between nodes. For example, some nodes may use specific encryption protocols for communication, which can be used as an edge characteristic. In addition, the frequency of data transmission between nodes can also be used as an edge characteristic; edges between nodes that communicate frequently may be of higher importance.

[0038] In this embodiment of the invention, under traffic conditions, the characteristics of a basic unit can be related to the type and magnitude of traffic carried by the node. For nodes in the real-time traffic layer, the proportion of real-time traffic they carry and the average rate of real-time traffic can be used as characteristics. For nodes in the non-real-time traffic layer, the throughput of non-real-time traffic and traffic fluctuations can be considered. Nodes in the security isolation layer may need to consider characteristics such as the degree of traffic isolation between them and the external network. Edge traffic characteristics can include link traffic load and traffic flow direction. For example, some links may mainly carry downlink traffic from the core layer to the access layer, while other links may mainly carry uplink traffic. Link traffic utilization is also an important edge characteristic, reflecting the use of link resources.

[0039] In this embodiment of the invention, the features of each basic unit and edge are quantized to form a feature vector. For example, for the basic unit features of a node, the node's degree, position, processing power, and other features can be combined into a vector. Similarly, the features of edges can also be combined into a vector. These feature vectors can be used as inputs to nodes and edges in the graph neural network. In each layer, the basic unit is used as a node of the graph, and the edge is used as the edge connecting the nodes. The feature vectors corresponding to each node and edge are associated with the graph structure to form a complete subgraph data structure. To enable the graph neural network to better process subgraph data, the feature vectors need to be normalized. Normalization and standardization methods can be used to map the values ​​of the feature vectors to a suitable range to improve the training effect and stability of the model.

[0040] In some embodiments, the output of the graph neural network of each subgraph is used as input to a deep belief network for global information fusion to obtain key state features, including: performing consistency processing on each subgraph; inputting the processed subgraphs into the deep belief network for global information fusion to obtain key state features; wherein the deep belief network dynamically adjusts parameters through safety state labels and backpropagation algorithm.

[0041] In this embodiment of the invention, since subgraphs at different levels may differ in terms of the number of nodes, feature dimensions, data format, etc., in order for the deep belief network to better process the information of these subgraphs, it is necessary to perform consistency processing on each subgraph.

[0042] Each subgraph is constructed based on different levels of topological state, node function, and traffic state, and the dimensions of its basic unit features and edge features may differ. For example, the core layer subgraph may focus more on features related to high-bandwidth links and large-scale data forwarding, while the access layer subgraph may focus on user access and small-scale traffic features. Through feature selection and dimensionality reduction techniques, such as principal component analysis or linear discriminant analysis, the feature dimensions of each subgraph are unified to the same standard. This ensures that the deep belief network can simultaneously process feature information from different subgraphs.

[0043] Data from different subgraphs may be stored and represented using different data formats. During consistency processing, these data formats need to be unified. For example, all node and edge features of all subgraphs should be converted to the same data type and arranged in the same order. Furthermore, data normalization is required, scaling feature values ​​to a specific range to eliminate dimensional differences between features and improve the training performance of deep belief networks. In different subgraphs, nodes or edges of the same type may use different identifiers. To facilitate information fusion, the identifiers for nodes and edges need to be unified. A globally unique identifier scheme can be adopted, assigning a unique identifier to each node and edge to ensure that elements in different subgraphs can be correctly identified and associated in the deep belief network.

[0044] In this embodiment of the invention, the deep belief network is a generative neural network composed of multiple stacked Restricted Boltzmann Machines (RBMs). Each RBM consists of visible and hidden layers, and learns feature representations of the data through unsupervised learning. In this embodiment, the feature vectors of each subgraph serve as inputs to the deep belief network. After layer-by-layer learning and feature extraction, the network's global feature representation is finally obtained.

[0045] Deep belief networks (DNRs) utilize security state labels and backpropagation algorithms for dynamic parameter tuning to improve the accuracy and effectiveness of key state features. Security state labels are predefined tags representing network security status, such as "secure," "under attack," and "potential threat." During DNR training, sample data with security state labels is input into the network. A loss function is calculated by comparing the network's output with the security state labels. The loss function reflects the error between the network output and the true security state; minimizing this loss function adjusts the parameters of the DNR.

[0046] The outputs of the graph neural networks from each subgraph are consolidated and then fed into a deep belief network for global information fusion. Parameters are dynamically adjusted using security state labels and backpropagation algorithms to ultimately obtain key state features that accurately reflect the overall state of the distributed software-defined network. These key state features provide an important foundation for subsequently constructing dynamic environment models and determining mobile target defense strategies.

[0047] In some embodiments, constructing a dynamic environment model of a distributed software-defined network based on key state features includes: inputting the key state features into a pre-established Bayesian network model to construct a dynamic environment model of the distributed software-defined network.

[0048] In this embodiment of the invention, key state features are obtained by processing and fusing state information at various levels of the distributed software-defined network. They represent the core state of the network as low-dimensional vectors. These features integrate information from multiple aspects, including network topology, node functionality, and traffic status, accurately reflecting the network's operational status and security posture at different times. For example, key state features may include information such as the load status of core nodes, the degree of traffic anomalies in specific areas, and dynamic changes in the network topology. This information is crucial for understanding the overall state of the network and predicting future changes.

[0049] After key state features are input into the Bayesian network, evidence propagation is performed based on Bayesian inference rules. The probability distribution of each node in the Bayesian network is updated according to the input key state feature values. For example, if the input key state features indicate a sudden increase in the load of a node, then Bayesian inference updates the probability distribution of other nodes related to that node, such as the probability of traffic delay in downstream links and the probability of load changes in adjacent nodes.

[0050] By continuously inputting new key state features into the Bayesian network model, the network's state representation is constantly updated. Based on current state information and historical data, Bayesian networks can predict the future state of the network. For example, they can predict the probability of a node failing within a future period, or the trend of network traffic changes. This predictive information is invaluable for developing proactive defense strategies against moving targets.

[0051] As the network environment changes and new data accumulates, dynamic environment models need to be adjusted accordingly. The structure and parameters of the Bayesian network can be optimized based on actual network operation and defense effectiveness. For example, if it is found that the causal relationships between some nodes are not as strong as assumed in the model, the weights of the corresponding edges can be adjusted or unnecessary edges can be deleted; if new data shows that the conditional probability distribution of some nodes deviates significantly from the initial settings, these parameters can be re-estimated.

[0052] In some embodiments, determining a mobile target defense strategy for a distributed software-defined network based on a reinforcement learning-based evolutionary game algorithm and a dynamic environment model includes: determining state space information and action space information based on the dynamic environment model; determining a reward function for the reinforcement learning algorithm based on the state space information and action space information; wherein the reinforcement learning algorithm is used to adjust the game objective of the evolutionary game algorithm; and determining the mobile target defense strategy for the distributed software-defined network based on the evolutionary game algorithm.

[0053] In this embodiment of the invention, the dynamic environment model is a Bayesian network model constructed based on key state features, reflecting the real-time state and changing trends of the distributed software-defined network. State space information encompasses multiple aspects of the network, including topology, node states, traffic conditions, and security posture. Through Bayesian network inference and updates, the state description of the network at different times can be obtained. Action space information defines a series of moving target defense strategies that defenders can adopt when facing network security threats. These strategies aim to change the network's attack surface and increase the difficulty for attackers. Common actions include topology transformations, such as dynamically adjusting the connections between switches; each action corresponds to a way of changing the network state, and the reinforcement learning agent needs to choose from these optional actions to achieve effective defense.

[0054] The reward function is a core component of reinforcement learning algorithms, used to evaluate the merits of an agent's action in each state. In the context of mobile target defense in distributed soft-defined networks, the design of the reward function needs to comprehensively consider multiple factors such as network security, availability, and performance. The reward function is determined based on state-space and action-space information. For example, if a defensive action successfully prevents an attack and ensures the normal operation of the network, improving its security and availability, then the action should receive a higher reward; conversely, if the defensive action fails to effectively counter the attack, leading to a decline in network performance or a threat to security, then a lower reward should be given. Through such reward settings, the agent can learn which actions lead to better results, thereby gradually optimizing its decision-making strategy.

[0055] In a distributed, soft-defined network environment, there are two game participants: defenders and attackers. In evolutionary game theory, both sides strive to maximize their own interests. Reinforcement learning algorithms adjust the game objective of the evolutionary game algorithm through a reward function, making the defender's interests closely related to network security and performance. Specifically, the reward function provides the decision-making basis for the reinforcement learning agent. When the defender chooses a strategy that improves network security and performance according to the reinforcement learning algorithm, it will receive a higher reward. This guides the defender to choose strategies that are more conducive to network security and stability during the game. For example, if the reward function gives a high reward for successful defense, the defender will be more proactive in taking effective defensive actions to increase its own gains, thereby changing the overall game situation and making the evolutionary game develop in a direction more conducive to network security.

[0056] At each time step, defenders and attackers simultaneously choose their strategies, forming a strategy combination. Attackers may choose an attack method based on the current network state, such as a DDoS attack or vulnerability exploitation; defenders, on the other hand, choose a corresponding defense strategy based on state space information and a reward function, such as topology transformation or port randomization. The payoffs for both defenders and attackers under the current strategy combination are calculated according to the reward function and pre-designed rules. The defender's payoff is directly determined by the reward function, while the attacker's payoff is calculated based on the attack's success rate and the resulting benefits. A successful attack that obtains sensitive data yields a higher positive payoff, while a failed attack yields a negative payoff. The replication dynamics equation from evolutionary game theory is used to update the probabilities of different strategies chosen by defenders and attackers, with higher-paying strategies gradually becoming dominant in the population. For defenders, if a certain defense strategy yields a high payoff in the current game, the probability of choosing that strategy increases; conversely, the probability of choosing a strategy with lower payoffs gradually decreases. Attackers' strategy updates follow the same principle. Through continuous game playing and strategy updates, defenders gradually learn the optimal defense strategy for different network states. Ultimately, taking into account the possible behaviors of attackers and dynamic changes in the network, a mobile target defense strategy for a distributed, soft-defined network that can maximize network security and performance is determined.

[0057] In this embodiment of the invention, the mobile target defense strategy for the distributed software-defined network is specifically a mobile target defense instruction set of the SDN controller. This instruction set is a specific series of instructions that the SDN controller uses to guide the behavior of forwarding devices, thereby achieving network control and management. Considering potential attacker behavior and dynamic network changes, it maximizes network security and performance.

[0058] It should be understood that the sequence number of each step in the above embodiments does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present invention.

[0059] The above embodiments are only used to illustrate the technical solutions of the present invention, and are not intended to limit it. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention, and should all be included within the protection scope of the present invention.

Claims

1. A method for defending against moving targets based on software-defined networks, characterized in that, Applied to distributed software-defined networks; the method includes: Obtain the state information of the distributed software-defined network; Based on the state information and the artificial intelligence model, key state features are determined; wherein, the key state features are low-dimensional vector representations of the network state of the distributed software-defined network. Based on the aforementioned key state characteristics, a dynamic environment model for the distributed software-defined network is constructed. Based on the reinforcement learning-based evolutionary game algorithm and the dynamic environment model, the mobile target defense strategy of the distributed software-defined network is determined.

2. The mobile target defense method based on software-defined networks according to claim 1, characterized in that, The artificial intelligence model includes graph neural networks and deep belief networks; Based on the state information and the artificial intelligence model, key state characteristics are determined, including: Divide the distributed software-defined network into multiple layers; The state information is analyzed using a graph neural network so that the state information at each level is constructed as a subgraph of the graph neural network; The outputs of the graph neural networks of each subgraph are used as inputs to a deep belief network for global information fusion to obtain key state features.

3. The mobile target defense method based on software-defined networks according to claim 2, characterized in that, The status information includes topology status, node function, and traffic status; Distributed software-defined networks are divided into multiple layers, including: The distributed software-defined network is initially partitioned based on topology, node function, and traffic status. Identify the nodes or links that cause hierarchical conflicts and re-hierarchize them based on preset priorities.

4. The mobile target defense method based on software-defined networks according to claim 3, characterized in that, The initial partitioning of the distributed software-defined network based on topology, node function, and traffic status includes: Based on the topology, the distributed software-defined network is divided into a core layer, a convergence layer, and an access layer. Based on node functions, the distributed software-defined network is divided into a control layer, a forwarding layer, and a terminal layer; Based on traffic status, the distributed software-defined network is divided into a real-time traffic layer, a non-real-time traffic layer, and a security isolation layer.

5. The mobile target defense method based on software-defined networks according to claim 4, characterized in that, The state information is analyzed using a graph neural network so that the state information at each level is constructed as a subgraph of the graph neural network, including: Based on the topological state, node function, and flow state of each level, determine the basic unit characteristics and edge characteristics of each subgraph; The basic unit features and edge features are integrated to form the subgraph data structure at each level.

6. The mobile target defense method based on software-defined networks according to claim 5, characterized in that, The outputs of the graph neural networks of each subgraph are used as inputs to a deep belief network for global information fusion, resulting in key state features, including: Consistently organize all subgraphs; The processed subgraphs are input into a deep belief network for global information fusion to obtain key state features; wherein, the deep belief network dynamically adjusts parameters through safety state labels and backpropagation algorithm.

7. The mobile target defense method based on software-defined networks according to claim 1, characterized in that, Based on the aforementioned key state characteristics, a dynamic environment model for the distributed software-defined network is constructed, including: The key state features are input into a pre-established Bayesian network model to construct a dynamic environment model of a distributed software-defined network.

8. The mobile target defense method based on software-defined networks according to claim 1, characterized in that, Based on the reinforcement learning-based evolutionary game algorithm and the dynamic environment model, the moving target defense strategy of the distributed software-defined network is determined, including: Based on the dynamic environment model, determine the state space information and action space information; Based on the state space information and the action space information, the reward function of the reinforcement learning algorithm is determined; wherein the reinforcement learning algorithm is used to adjust the game objective of the evolutionary game algorithm. Based on the evolutionary game theory algorithm, the mobile target defense strategy of the distributed software-defined network is determined.

9. A distributed software-defined network, characterized in that, The distributed software-defined network is equipped with an SDN controller; the mobile target defense method based on software-defined network as described in any one of claims 1 to 8 is applied to the distributed software-defined network.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, implements the steps of the mobile target defense method based on software-defined networks as described in any one of claims 1 to 8.

Images