A CPPS defense strategy decision-making method under DDoS attacks based on game theory

Abstract

The present invention discloses a CPPS defense strategy decision method under DDoS attack based on game theory. The present invention constructs a dynamic game model based on incomplete information, quantifies the node status by the node device task delay time, considers the resource consumption in three cases of no attack, attack failure and attack success, and designs the relevant indicators of the Bayesian model in combination with the characteristics of the integration of information domain and physical domain of information-physical system. After each action, the belief indicator is updated to reflect the knowledge update under the incomplete information of both, finally reaches the Nash equilibrium, and gives the best defense strategy decision.

Description

Technical Field

[0001] The present invention belongs to the field of smart grid security and relates to a game theory-based cyber-physical power system (CPPS) defense strategy decision method under distributed denial of service (DDoS) attacks. Background Art

[0002] With the integration of information and communication technologies (ICT) such as wide area measurement systems (WAMS) and supervisory control and data acquisition (SCADA) systems, the power grid is evolving into a complex cyber-physical power system (CPPS), which improves system efficiency and connection availability while also bringing more security risks. Since power facilities have strict requirements on latency and relay protection, network attacks such as DDoS attacks, identity authentication attacks, cross-site scripting attacks, and malware proliferation attacks have a huge impact on physical processes.

[0003] The reason why DDoS attacks are so frequent is precisely because of their low price, which also confirms the consensus that security does not mean that there will be no attacks, but that the benefits of attacks are lower than the resources spent. Unlike ordinary networks with only network nodes, a complex CPPS has a large number of physical devices. These devices have limited computing power, low memory and storage capacity, and only undertake special tasks, such as perception, measurement, braking, etc. The execution and unloading of their specific tasks are usually decided and information is transmitted through the human-machine layer and the information layer. However, the power system has strict requirements on delay and relay protection exists, so attackers can affect or confuse the transmission of information through attacks such as DDoS, thereby causing failures in the operation of CPS. The measures of relay protection refer to preferring false operation to refusal to operate; when a node is found to be under attack, a signal will be sent, or the faulty part will be directly cut off and isolated. Therefore, attackers can cause large-scale system paralysis by attacking the communication channel of a specific node, delaying the time for the device to execute tasks, and confusing the status of the device at a relatively low cost.

[0004] As a formal tool that has been proven to be effective, game theory quantifies the interaction between attackers and defenders, and provides a reasonable theoretical framework to guide defenders to make optimal allocation strategies under limited resources. Game theory can be mainly divided into cooperative games and non-cooperative games based on the relationship between the participants, and can be divided into dynamic games or static games, complete information games or incomplete information games, zero-sum games or non-zero-sum games based on the number of actions, degree of understanding and benefits of the attackers and defenders, as shown in Table 1. The benefit value of the strategy is one of the important bases for each participant in game theory to make rational decisions. Game theory can select the decision-making plan with the highest benefit for the participants through theoretical analysis and research. The correctness of this plan is mainly reflected in the fact that all rational game participants will consciously follow the equilibrium strategy derived from game theory, and no participant will deviate from the equilibrium strategy alone. Under the equilibrium strategy, the strategy of each participant must be the optimal response to the strategies of other participants.

[0005] At present, the idea of ​​applying game theory methods to the study of network attack and defense strategies in the context of CPPS is roughly as follows: use game models to model attack and defense behaviors, quantitatively evaluate attack and defense resources, consequences and action strategies; find equilibrium points and solve the optimal attack and defense strategies. Modeling from the perspective of the defender, the goal is to minimize the damage caused by the attack; or modeling from the perspective of the attacker, the damage caused by the attacker is maximized, and finally the optimized game strategy is given. Researchers have conducted a lot of research on the defense strategy of CPPS from different aspects, such as quantitative references to the impact of power grid network attacks, references to attack models, and network-physical interdependence analysis based on joint simulation test bench references. For example, a joint simulation framework for detailed examination of the impact and interdependence between the network and physical layers; a risk decision method based on a random game model; software for analyzing software-defined network security risks, etc. However, existing work does not fully consider the specific manifestations of attacks and the impact of quantifying the interaction between the attacker and the defender in the network-physical system. Moreover, for the cyberspace security strategy of the power industry system, the resources of the attacker and the defender, as well as the information obtained from the opponent, will affect the attack and defense effects and chances of success. Summary of the invention

[0006] In view of the problems in the prior art, the present invention establishes a dynamic CPPS defense strategy decision method under DDoS attacks based on game theory. Since power grid equipment has high requirements for time sensitivity, the present invention considers that when the task delay of a node is greater than a certain threshold, the node is judged to be damaged; malicious devices that attempt to destroy the normal operation of the node are attackers, and nodes that operate normally are defenders. The attacker's goal is to successfully attack the node under positive expected returns so that the node cannot operate normally, and the defender's goal is to protect more nodes with limited resources.

[0007] The technical solution of the present invention is as follows:

[0008] The present invention provides a CPPS defense strategy decision method under DDoS attack based on game theory, which comprises the following steps:

[0009] S1: Construct the CPPS information domain and physical domain dependency model based on directed acyclic graph theory;

[0010] S2: Introduce physical security and information security indicators, set Bayesian indicators, and quantify the node value of a given CPPS;

[0011] S3: Establish a game model. The game of the present invention is a Bayesian game, which is also called an incomplete information game. The node task delay time is used to quantify the node status as a profit indicator. The resource consumption in the three situations of no attack, attack failure and attack success is added to the game model and the Nash equilibrium is calculated. After each action of the participants, the belief indicators of both parties are updated to reflect the knowledge update of both parties under incomplete information, and finally the Nash equilibrium is reached, and the best defense strategy decision at the Nash equilibrium is given.

[0012] As a preferred solution of the present invention, the CPPS information domain-physical domain dependency model in step S1 includes nodes and directed connecting line segments.

[0013] For nodes that only contain information value or physical value, they are mapped to information value nodes or physical value nodes accordingly;

[0014] For nodes that contain both information value and physical value, they are mapped into information value nodes and physical value nodes. For attackers, this type of node is divided into two cases: "or" and "and". (a) When it is "or", the attacker only needs to attack one of the information value node and the physical value node; (b) When it is "and", the attacker needs to attack both the information value node and the physical value node at the same time to make the node unable to work normally.

[0015] As a preferred solution of the present invention, the physical security and information security indicators described in step S2 include the asset value / importance level of the node, attack complexity, strike effect, and attack defense strength configuration; the Bayesian model related indicators are the physical security and information security indicators;

[0016] The asset value / importance level includes the node’s own value and the influence of superiors and subordinates; the node’s own value is divided into two parts: physical value and information value, and the influence of superiors and subordinates is expressed by the degree of connection between nodes;

[0017] Attack complexity includes the cascade level, attack means complexity, attack concealment, and attack potential. The cascade level is determined by the layer where the node is located, and the attack means complexity, attack concealment, and attack potential are obtained by CVSS indicator mapping.

[0018] The strike effect reflects the damage to the target, which is numerically quantified through the impact evaluation in CVSS;

[0019] Attack and defense intensity configuration refers to the total resource allocation of the attacker and defender, which is affected by the possibility of attack and defense strategies and historical belief indicators.

[0020] As a preferred embodiment of the present invention, in step S3,

[0021] In the game model, the participants are attackers and defenders. In a single defense, the resource consumption required by the defender is:

[0022] r d =γ b b+γ s s+γ o

[0023] where γ b , γ s , and γ o They respectively represent the unit bandwidth price, single device price and other costs when the system is running normally; b and s represent the amount of bandwidth required by expanding the hardware bandwidth and the number of devices required for distributed cluster defense.

[0024] As a preferred embodiment of the present invention, in step S3,

[0025] When the task delay of a node is below the time threshold, the node is considered to be in normal operation, and its probability is set as:

[0026]

[0027] where t k is the task delay, t th is the time threshold for executing the task, obtained from historical information or experience, λ d,k is the service duration rate of stage k when the equipment is operating normally;

[0028] There are two situations for the attacker: attack failure and no attack; the probability that the attacker attacks but fails is P af,k , the probability that the attacker does not attack is P nf,k ; The defender does not know whether the node is a failed attack or safe, so a balance factor δ is introduced to represent these two situations. The balance factor is determined by the capabilities of the defender and the attacker and is a constant;

[0029]

[0030]

[0031] where λ af,k is the service duration rate when the device is attacked but the attack fails, λ nf,k is the service duration rate when the device is not under attack;

[0032] When the task delay of a node exceeds the time threshold, the node is considered to be attacked, and its probability is set as:

[0033]

[0034] When the task delay is too high, the defender node will change its defense strategy, and its resource consumption budget and the corresponding task duration will change accordingly; therefore, for a node, the resource r it needs to consume in stage k d,k for:

[0035]

[0036]

[0037] Correspondingly, the resources consumed by the attacker in stage k are recorded as r a,k .t d,k , t a,k are the defender’s defense time and the attacker’s attack time, r′ d It is the resource consumption of the defender when under attack.

[0038] As a preferred embodiment of the present invention, in step S3,

[0039] Defender belief index for node n at stage k+1 Utilize Markov belief updates through multiple stages:

[0040]

[0041]

[0042] The constant α represents the "safe" operating state, and the constant β represents the "dangerous" state; when the belief index When the threshold ω is reached, it is considered that the defender has acquired sufficient prior knowledge to be able to defend in this way, that is, when the belief index Once the set threshold is reached, this defense method is added to the optional defender strategies. are the strategy levels selected by the attacker and the defender, respectively, and Δ represents the difference between the two strategy levels.

[0043] As a preferred embodiment of the present invention, in step S3,

[0044] For node n, given the attacker defender strategy pair is the attacker's expected reward, is the expected return of the defender, expressed as:

[0045]

[0046]

[0047] Wherein, the superscript n indicates that the corresponding parameter is the parameter of node n, N is the number of nodes, and K is the number of stages; V n is the value of node n, is the resource required by the attacker to launch an attack on node n, t n nf，k is the time that node n is not attacked, t n af，k is the time when node n is attacked but the attack fails.

[0048] In the game model, both the attacker and the defender want to maximize their benefits. When they choose a strategy that neither party will change, it is called a Nash equilibrium. Assume that for any defender strategy All exist The attacker's expected profit Maximum, and for any attacker strategy All exist The defender's expected return The maximum value is the Nash equilibrium, and the defender’s strategy at the Nash equilibrium is output as the best defense strategy decision.

[0049] The present invention quantifies the node status by the device task delay time, considers the resource consumption in three situations: no attack, attack failure and attack success, and designs the relevant indicators of the Bayesian model in combination with the characteristics of the integration of the information domain and the physical domain of the information-physical system. The belief indicators are dynamically updated to reflect the interaction between the two under incomplete information, thus realizing the defense strategy decision-making for CPPS. BRIEF DESCRIPTION OF THE DRAWINGS

[0050] Figure 1 It is a schematic diagram of the CPPS system structure overview;

[0051] Figure 2 It is a mapping diagram of information value nodes and physical value nodes;

[0052] Figure 3 is the belief indicator update graph;

[0053] Figure 4 It is a graph of the experimental results of the present invention. DETAILED DESCRIPTION

[0054] The present invention is further described and illustrated below in conjunction with specific embodiments. The embodiments are merely exemplary of the present disclosure and do not define the scope of limitation. The technical features of each embodiment of the present invention may be combined accordingly without conflicting with each other.

[0055] The present invention constructs a dynamic game model based on incomplete information, and constructs a DDoS attack-targeted model. It uses the node task delay time to quantify the node status as a profit indicator, adds the resource consumption in the three cases of no attack, attack failure and attack success to the game matrix and calculates the Nash equilibrium. After each action, the belief indicator is updated to reflect the knowledge update of the two under incomplete information, and finally reaches the Nash equilibrium and gives the best defense strategy decision.

[0056] The scheme of the present invention is as follows:

[0057] S1: Construct the CPPS information domain and physical domain dependency model based on directed acyclic graph theory;

[0058] The three-layer structure of the CPPS system is as follows: Figure 1 As shown. In general, commands are passed to the information layer after being decided by the human-machine layer, and then the communication layer sends instructions to the physical layer for execution. In order to describe the interaction between the information domain and the physical domain, a CPPS information domain-physical domain dependency model is constructed based on the directed acyclic graph theory, including nodes and directed connecting segments. Among them, nodes are active electronic devices connected to the network, which can send, receive or forward information through communication channels, for example, indicating that a computer or other device is connected to a network with an independent address and the function of transmitting or receiving data. Directed connecting segments refer to segments with specified directions; they are used to represent the relationship between nodes.

[0059] In reality, a single node may not only have physical value, but also information assets. Figure 2 As shown in the figure, for a node that only contains information value or physical value, it is mapped to an information value node or a physical value node accordingly; for a node that contains both information value and physical value, it is first mapped to an information value node and a physical value node; for an attacker, the node can be divided into two situations: "or" and "and". (a) When it is "or", the attacker only needs to attack one of the two; (b) when it is "and", the attacker needs to attack both nodes at the same time to make the node unable to work normally.

[0060] S2: Introduce physical security and information security indicators, set Bayesian indicators, and quantify the node value of a given CPPS;

[0061] The physical security and information security indicators include the asset value / importance level, attack complexity, attack effect, and attack defense strength configuration of the node; the Bayesian model related indicators (value indicators) are the physical security and information security indicators; when setting the Bayesian model related indicators V of the node n n When evaluating the attack, the present invention conducts multi-dimensional evaluation from four perspectives: asset value / importance level, attack complexity, strike effect, and attack defense strength configuration. The asset value / importance level includes the node's own value and the influence of the upper and lower levels. The own value is divided into two parts: physical value and information value. The criticality level (CL) is used to quantify the importance of different assets. The influence of the upper and lower levels is mainly expressed by the degree of connection between the nodes. When a node is connected to multiple nodes at the same time, its upper and lower levels have a greater influence. The attack complexity includes the series level, the complexity of the attack means, the attack concealment, and the attack potential. The series level is determined by the layer where the node is located. Since the attack is transmitted from top to bottom, the higher the layer, the greater the impact of the node on the whole, so the series level is higher. The complexity of the attack means, the concealment of the attack, and the attack potential are obtained by mapping the CVSS indicators. The strike effect reflects the damage to the target, specifically affecting the service availability, information leakage, data tampering, permission hijacking, and operating status of the device, and is numerically quantified by the impact evaluation in CVSS. The attack and defense resource configuration refers to the total resource configuration of both the attack and defense sides, which is affected by the possibility of the attack and defense strategy and the historical belief index.

[0062] S3: Establish a game model, use the node task delay time to quantify the node status as a profit indicator, add the resource consumption in the three cases of no attack, attack failure and attack success to the game model and calculate the Nash equilibrium. After each action of the participants, update the belief indicators of both parties to reflect the knowledge update of both parties under incomplete information, and finally reach the Nash equilibrium, and give the best defense strategy decision at the Nash equilibrium.

[0063] Conventional DDoS attack and defense strategies include filtering unnecessary services and ports and limiting specific traffic, but this requires corresponding historical data and the establishment of corresponding blacklists and whitelists. Therefore, the present invention introduces belief indicators to assume the degree of mutual understanding between the two parties, simulating the behaviors of the attackers and defenders under active defense. The defender can only use this method to defend if he has sufficient prior knowledge; this method has excellent defense effect and consumes relatively few resources.

[0064] A basic game model mainly includes: participants, actions, strategy pairs, benefits, and rewards.

[0065] Participants are attackers and defenders. The resource consumption required to find the defender in a single defense is:

[0066] r d =γ b b+γ s s+γ o

[0067] where γ b , γ s , and γ o They represent the unit bandwidth price, the price of a single device, and other costs when the system is running normally. b and s represent the amount of bandwidth required by expanding the hardware bandwidth and the number of devices required for distributed cluster defense.

[0068] Due to the MMK queue theory, when the system is a single system, the mathematical model is the MM1 queue. Based on this theory, the exponential distribution will simplify the calculation form and equate task k with stage k. Therefore, in the present invention, a service duration rate λ is considered *,k A system with an exponential relationship with task delay, where the service duration rate is affected by the task offloading rate and the device service rate, and the task duration t k Depends on service efficiency and resource consumption budget.

[0069] When the task delay of a node is below the time threshold, the node is considered to be in normal operation, and its probability is set as:

[0070]

[0071] where t k is the duration of the task, t th is the time threshold for executing the task, which can be obtained from historical information or experience, d,k is the service duration rate of stage k when the equipment is operating normally.

[0072] There are two situations for the attacker: failure to attack and no attack. The probability that the attacker attacks but fails is P af,k , the probability that the attacker does not attack is P nf,k The defender does not know whether the node is a failed attack or safe, so a balance factor δ is introduced to represent these two situations.

[0073]

[0074]

[0075] where λ af,k is the service duration rate when the device is attacked but the attack fails, λ nf,kIt is the service duration rate when the device is not under attack.

[0076] When the task delay of a node exceeds the time threshold, the node can be considered to be attacked, and its probability is set as:

[0077]

[0078] When the task delay is too high, the defender node will change its defense strategy, and its resource consumption budget and the corresponding task duration will change accordingly. Therefore, for a node, the resource it needs to consume in stage k is r d,k for:

[0079]

[0080]

[0081] Similarly, the resources consumed by the attacker in stage k are r a,k .

[0082] The belief index is introduced to assume the degree of understanding of the other party's resource configuration and simulate the behavior under active defense. When the defender obtains sufficient prior knowledge, this method has good defense effect and relatively low resource consumption. According to existing work, when the attacker performs a high-rate attack for more than 10 seconds, it is easily detected, while a low-rate attack takes longer or even goes undetected. As the attacker continues to attack, the defender updates its belief index to represent the increase in prior knowledge. The update method is as follows: Figure 3 As shown. The belief indicator uses Markov belief updates in multiple stages:

[0083]

[0084]

[0085] The constant α represents the "safe" operating state, and the constant β represents the "dangerous" state. When the threshold ω is reached, it can be considered that the defender has obtained sufficient prior knowledge to provide a more effective defense strategy. The relationship between these three constants is determined by the degree of detection of DDoS attacks by the node device.

[0086] For node n, given the attacker defender strategy pair The expected return can be expressed as:

[0087]

[0088]

[0089] In the game problem, both the attacker and the defender want to maximize their benefits. When they choose a strategy that neither party will change, it is called a Nash equilibrium. Assume that for any defender strategy All exist The attacker's expected profit Maximum, and for any attacker strategy All exist The defender's expected return The maximum value is the Nash equilibrium, and the defender’s strategy at the Nash equilibrium is output as the best defense strategy decision.

[0090] Given that the attacker's goal is to successfully attack more nodes under positive expected returns, the defender's goal is to protect more nodes with limited resources. The strength of the attacker and defender is discretized into s levels. The larger the value of s, the closer the strength of both sides is to continuous, and the more complex the game process between the attacker and the defender is. K is the total number of tasks in a sampling interval. It is assumed that each task issued to the target node in the sampling interval consumes the same time and resources, but for different nodes, the task consumption may be different due to the different devices connected to the nodes. Using the method proposed in this experiment, the corresponding attack and defense strategy results can be obtained. As the game time increases, the attacker and the defender obtain more historical information to update their belief indicators, but the influence of the belief indicator will vary depending on the capabilities of the attacker and the defender. For example, when the attacker uses DDoS as a cover to steal secrets, the initial attack is the most profitable, and as time goes by, the new information that can be stolen is less and less, that is, as time goes by, the attacker's profit from a successful attack gradually decreases; if the attacker is to hinder the normal operation of the node, the longer the attack time, the higher the profit. After a period of game play, the attacker and defender reach a Nash equilibrium. Both rational parties choose not to change their strategies. Their expected returns and final strategy choices are as follows: Figure 4 As shown in the figure, it can be seen that when the attacker is stronger than the defender, even if the initial strategy is inferior, the attack is likely to succeed in the end; and when the defender is stronger than the attacker, unless the attacker can make the defender give up in a long game, it is difficult for the attacker to break through the defender's defense.

[0091] The above-mentioned embodiments only express several implementation methods of the present invention, and the description is relatively specific and detailed, but it cannot be understood as limiting the scope of the present invention. For ordinary technicians in this field, several modifications and improvements can be made without departing from the concept of the present invention, which all belong to the protection scope of the present invention.

Claims

1. A CPPS defense strategy decision method under DDoS attack based on game theory, characterized in that: The steps include: S1: Construct the CPPS information domain and physical domain dependency model based on directed acyclic graph theory; S2: Introduce physical security and information security indicators, set Bayesian indicators, and quantify the node value of a given CPPS; S3: Establish a game model, use the node task delay time to quantify the node status as a profit indicator, add the resource consumption in the three cases of no attack, attack failure and attack success to the game model and calculate the Nash equilibrium. After each action of the participants, update the belief indicators of both parties to reflect the knowledge update under incomplete information of both parties, and finally reach the Nash equilibrium, and give the best defense strategy decision at the Nash equilibrium; When the task delay of a node is below the time threshold, the node is considered to be in normal operation, and its probability is set as: ； in Delayed task, The time threshold for executing the task is obtained from historical information or experience. This is the phase when the equipment is operating normally. Service duration rate; There are two situations for the attacker: attack failure and no attack; the probability that the attacker attacks but fails is , the probability that the attacker does not attack is ; The defender does not know whether the node is a failed attack or safe, so a balance factor is introduced To represent these two situations, the balance factor is determined by the capabilities of the defender and the attacker and is a constant; ； in is the service duration rate when the device is attacked but the attack fails, is the service duration rate when the device is not under attack; When the task delay of a node exceeds the time threshold, the node is considered to be attacked, and its probability is set as: ； When the task delay is too high, the defender node will change its defense strategy, and its resource consumption budget and the corresponding task duration will change accordingly; therefore, for a node, it is in the stage The resources required for: ； Accordingly, the attacker in stage The resources required are recorded as ; , are the defender's defense time and the attacker's attack time, is the defender's resource consumption under attack; Node n stage +1 to the defender's belief indicator Utilize Markov belief updates through multiple stages: ； The constant Indicates the "safe" operating state, constant Indicates a "dangerous" state; when the belief index Reaching the set threshold , it is believed that the defender has acquired sufficient prior knowledge to be able to defend in this way, that is, when the belief index After reaching the set threshold, this defense method is added to the optional defender strategy; They are the strategy level selected by the attacker and the strategy level selected by the defender; For nodes , given the attacker-defender strategy pair , is the attacker's expected reward, is the expected return of the defender, expressed as: ； Among them, the superscript Indicates that the corresponding parameter is a node Parameters, N is the number of nodes, K is the number of stages; Is a node The value of The attacker targets the node The resources needed to launch an attack. Is a node Time without attack, Is a node The time when the attack was unsuccessful; In the game model, both the attacker and the defender want to maximize their benefits. When they choose a strategy that neither party will change, it is called a Nash equilibrium. Assume that for any defender strategy , all exist The attacker's expected profit Maximum, and for any attacker strategy , all exist The defender's expected return The maximum value is the Nash equilibrium, and the defender’s strategy at the Nash equilibrium is output as the best defense strategy decision.

2. The CPPS defense strategy decision method under DDoS attack based on game theory according to claim 1 is characterized in that: The CPPS information domain physical domain dependency model described in step S1 includes nodes and directed connecting segments. For nodes that only contain information value or physical value, they are mapped to information value nodes or physical value nodes accordingly; For nodes that contain both information value and physical value, they are mapped into information value nodes and physical value nodes. For attackers, this type of node is divided into two cases: "or" and "and". (a) When "or", the attacker only needs to attack one of the information value node and the physical value node; (b) When "and", the attacker needs to attack both the information value node and the physical value node at the same time to make the node unable to work normally.

3. The CPPS defense strategy decision method under DDoS attack based on game theory according to claim 1 is characterized in that: The physical security and information security indicators in step S2 include the asset value / importance level of the node, attack complexity, strike effect, and attack defense strength configuration; the Bayesian indicator is the physical security and information security indicator; The asset value / importance level includes the node’s own value and the influence of superiors and subordinates; the node’s own value is divided into two parts: physical value and information value, and the influence of superiors and subordinates is expressed by the degree of connection between nodes; Attack complexity includes the cascade level, attack means complexity, attack concealment, and attack potential. The cascade level is determined by the layer where the node is located, and the attack means complexity, attack concealment, and attack potential are obtained by CVSS indicator mapping. The strike effect reflects the damage to the target, which is numerically quantified through the impact evaluation in CVSS; Attack and defense intensity configuration refers to the total resource allocation of the attacker and defender, which is affected by the possibility of attack and defense strategies and historical belief indicators.

4. The CPPS defense strategy decision method under DDoS attack based on game theory according to claim 1 is characterized in that: In step S3, In the game model, the participants are attackers and defenders. In a single defense, the resource consumption required by the defender is: ； in , ,and They respectively represent the price per unit bandwidth, the price per device, and other costs when the system is operating normally; and Represents the amount of bandwidth required to defend the required number of devices by scaling hardware bandwidth and distributed clustering.

Images