An intrusion cluster threat assessment method based on analytic hierarchy process

Abstract

The present invention relates to an intrusion cluster threat assessment method based on hierarchical analysis method, which consists of two parts: subgroup division and threat assessment. The subgroup division algorithm divides the intrusion cluster into subgroups. Since the form and number of the intrusion cluster are uncertain, an incoming intrusion cluster is divided into multiple subgroups, and then defense attacks are carried out one by one. The threat assessment algorithm constructs an intrusion threat assessment hierarchy based on the hierarchical analysis method, and proposes four influencing factors according to the characteristics of cluster attacks, and compares the four factors in pairs to obtain a pairwise comparison matrix of each factor, and then determines the weight vectors of the four factors, and finally calculates the invasion threat degree of each intrusion subgroup to the base according to the actual data of each intrusion subgroup. The base can perform hierarchical defense according to the threat assessment results; the intrusion cluster is divided into multiple intrusion subgroups, and the number of threat targets that the base needs to evaluate is reduced, so that the calculation amount of the threat assessment algorithm is effectively reduced.

Description

Technical Field

[0001] The invention belongs to the technical field of cluster intelligence and relates to an intrusion cluster threat assessment method based on hierarchical analysis method. Background Art

[0002] Swarm movement is the behavior of self-organization and emergence at the group level based on simple individual rules. Such self-organization and emergence behavior show many excellent properties at the macro level, such as making up for the lack of individual capabilities and adapting to more complex mission scenarios. Therefore, this theory is also widely used in unmanned systems, and the most typical application scenario is the execution of specific tasks by drone swarms. Due to the low cost and excellent performance of unmanned swarm systems, they are often used to attack bases or other high-value targets. Therefore, swarm attacks pose a great threat to bases or high-value targets, and how to assess threats in advance and deploy defense strategies has become an urgent problem to be solved.

[0003] The analytic hierarchy process is a decision-making method proposed by operations researcher TLSaaty that combines qualitative and quantitative evaluation. This method regards a complex multi-objective problem as a system, decomposes the system into multiple levels, and calculates the hierarchical single ranking and total ranking through the fuzzy quantification method of qualitative indicators as the target optimization decision. The problem of assessing the threat of high-value targets is also a multi-objective problem. The traditional method is to conduct a threat assessment on each invading intelligent individual in the incoming cluster to obtain the invading intelligent individual with the highest threat, thereby determining the deployment location of the defense force. However, as the number of invading intelligent individuals increases, this solution will lead to a surge in the amount of computation required by the evaluation algorithm.

[0004] Therefore, in view of the above problems, the present invention proposes an intrusion cluster threat assessment method based on the hierarchical analysis method. By dividing the intrusion cluster composed of multiple intelligent individuals into subgroups to reduce the number of targets to be evaluated, the computational complexity of the evaluation algorithm is reduced. Then, the hierarchical analysis method is used to construct a cluster intrusion threat assessment hierarchy to obtain the threat level vector of each subgroup, and then corresponding defense responses are made to subgroups with different threat levels. Summary of the invention

[0005] Technical issues to be solved

[0006] In order to avoid the shortcomings of the prior art, the present invention proposes an intrusion cluster threat assessment method based on hierarchical analysis method, which consists of two parts: subgroup division and threat assessment.

[0007] Technical Solution

[0008] An intrusion cluster threat assessment method based on hierarchical analysis method is characterized by the following steps:

[0009] Step 1, determine the number of intrusion clusters: when the number of intrusion clusters is less than the maximum set number of subgroups, execute step 2 to divide the intrusion clusters using the subgroup division algorithm to obtain the subgroup division result; if the number of intrusion clusters is greater than the maximum set number of subgroups, execute step 3 to calculate the weight of each subgroup;

[0010] The intrusion cluster is composed of multiple intelligent individuals;

[0011] Step 2: Subgroup division: The protected target divides the intruder individuals in the perceived intrusion cluster into multiple intrusion subgroups;

[0012] The subgroup is to find all interconnected individuals according to the definition of individual connectivity, and then divide the interconnected individuals into a subgroup, and there are no intrusion individuals outside the subgroup that are connected to the individuals in the subgroup;

[0013] The individuals are connected: if two intruding individuals have the same neighbor individual, and the neighbor individual is the central individual, then the two individuals are connected;

[0014] The central individual: if the number of neighbor individuals in the neighborhood of the invading individual is greater than the minimum number of neighbor individuals, then the individual is the central individual;

[0015] Step 3: Compare the four influencing factors of threat assessment in pairs to obtain a pairwise comparison matrix:

[0016]

[0017] Among them: the distance between the subgroup center and the base is B1, the number of individuals in the subgroup is B2, the angle between the subgroup average speed direction and the position line is B3, and the divergence of the subgroup center is B4;

[0018] Step 4: Calculate the weight ranking vector of each factor: solve the eigenvector of the pairwise comparison matrix and use the eigenvector as the weight vector ω of the importance of the four factors 0 ;

[0019] Step 5, calculate the weight ranking matrix of each subgroup for the four factors: obtain the values ​​of the four factors of each subgroup, and compare each factor Bi (i = 1, 2, 3, 4) of each subgroup to obtain the corresponding pairwise comparison matrix Xi; calculate the eigenvector of the pairwise comparison matrix Xi as the weight vector ω of each subgroup for the factor Bi i ; Thus, the weight ranking matrix W of each subgroup for the four factors is obtained:

[0020] W=[ω 1 ,ω 2 ,ω 3 ,ω 4 ] T

[0021] Step 6: Calculate the total weight ranking vector of each subgroup: Substitute the weight vector ω of each factor 0 Combined with the weight ranking matrix W of each subgroup for the four factors, the total weight ranking vector V of each subgroup is obtained:

[0022] V=ω 0 T W

[0023] Step 7: Get the threat level of each subgroup: The total weight ranking vector V corresponds to the threat level of each subgroup.

[0024] When the number of divided subgroups is greater than the maximum subgroup number setting value, the individual neighborhood radius in the subgroup division increases; when the number of subgroups is less than the minimum subgroup number setting value, the individual neighborhood radius in the subgroup division decreases; the neighborhood radius is the interaction radius of the invading individual, that is, other invading individuals within the interaction radius are regarded as its neighbor individuals.

[0025] The subgroup center divergence measures the density or sparseness of the subgroup, and is calculated as: Where N represents the number of invading intelligent individuals in the invading subgroup, x i Represented as the position vector of the invading intelligent individual i, x c Denoted as the invasion subgroup center.

[0026] Beneficial Effects

[0027] The invention proposes an intrusion cluster threat assessment method based on hierarchical analysis method, which consists of two parts: subgroup division and threat assessment. The subgroup division algorithm divides the intrusion cluster into subgroups. Since the form and number of the intrusion cluster are uncertain, an incoming intrusion cluster is divided into multiple subgroups, and then defensive attacks are carried out one by one. The threat assessment algorithm constructs an intrusion threat assessment hierarchy based on the hierarchical analysis method, and proposes four influencing factors according to the characteristics of cluster attacks. The four factors are compared in pairs to obtain a pairwise comparison matrix of each factor, and then the weight vectors of the four factors are determined. Finally, the invasion threat degree of each intrusion subgroup to the base is calculated according to the actual data of each intrusion subgroup.

[0028] The adoption of the intrusion cluster threat assessment method based on the hierarchical analysis method proposed by the present invention brings the following beneficial effects:

[0029] 1. Since an intrusion threat assessment structure based on the hierarchical analysis method has been constructed, the base can carry out hierarchical defense according to the threat assessment results;

[0030] 2. Due to the proposed subgroup division algorithm, the base can adaptively divide the incoming intrusion clusters and then implement adaptive adjustment strategies to deal with attacks of different intrusion scales and forms;

[0031] 3. Since the intrusion cluster is divided into multiple intrusion sub-groups, the number of threat targets that the base needs to evaluate is reduced, which effectively reduces the computational complexity of the threat assessment algorithm. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] Figure 1 The flowchart of the subgroup division algorithm in the method of the present invention is shown in Figure 2. The protected target first senses all intrusion individuals in the intrusion cluster, finds all connected individuals according to the definition of individual connectivity, and integrates the interconnected individual sets into a subgroup, thereby dividing the intrusion cluster into multiple intrusion subgroups. Considering the limited defense force of the base and the need for hierarchical defense, a reasonable range of the number of subgroups is set. When the number of subgroups is greater than the maximum subgroup number setting value, the individual neighborhood radius in the subgroup division increases; when the number of subgroups is less than the minimum subgroup number setting value, the individual neighborhood radius in the subgroup division decreases. The subgroup division process is completed until the number of divided subgroups is within the reasonable range.

[0033] Figure 2 The hierarchical structure diagram of intrusion threat assessment in the method of the present invention is divided into three parts: target layer, criterion layer, and scheme layer. The target layer is the goal to be achieved, the criterion layer is the influencing factors that need to be considered in the threat level assessment, and the scheme layer is the various subgroups that need to be evaluated.

[0034] Figure 3 The flowchart of the intrusion cluster situation assessment algorithm in the method of the present invention is shown in Figure 1. First, the base senses the intrusion cluster and determines the number of incoming intrusion clusters. If the number of incoming clusters is greater than the maximum reasonable number of subgroups, the subgroup division process is skipped directly; if the number of clusters is within a reasonable range, the subgroup division process is performed. Then, the weight ranking vectors of the four factors between each subgroup are calculated, and the obtained ranking vectors and the weight vectors between the four factors are input into the intrusion threat assessment hierarchy, and finally the threat level of each subgroup is obtained. DETAILED DESCRIPTION

[0035] The present invention will now be further described with reference to the embodiments and the accompanying drawings:

[0036] The method of the present invention consists of two parts: subgroup division and threat assessment. The subgroup division algorithm divides the intrusion cluster into subgroups. Since the form and number of the intrusion cluster are uncertain, an incoming intrusion cluster composed of multiple intelligent individuals is divided into multiple subgroups, and then defensive attacks are carried out one by one. The threat assessment algorithm constructs an intrusion threat assessment hierarchy based on the hierarchical analysis method, and proposes four influencing factors according to the characteristics of cluster attacks. These four factors are compared in pairs to obtain a pairwise comparison matrix of each factor, and then the weight vectors of the four factors are determined, and then the invasion threat degree of each intrusion subgroup to the base is calculated according to the actual data of each intrusion subgroup.

[0037] The first is the subgrouping algorithm. The purpose of subgrouping is to divide an intrusion cluster into multiple subgroups, so as to facilitate the subsequent allocation of defense forces to attack it. The flowchart of the subgrouping algorithm is as follows: Figure 1 To facilitate the subgroup division, some concepts are defined below:

[0038] Neighborhood radius: The interaction radius of the invading individual, that is, other invading individuals within the interaction radius are regarded as their neighbor individuals.

[0039] Minimum number of neighbors: This value defines the density of neighbors in the neighborhood and is set to a fixed value based on demand.

[0040] Central individual: If the number of neighbor individuals in the neighborhood of the invading individual is greater than the minimum number of neighbor individuals, then the individual is the central individual.

[0041] Individual connection: If two intruder individuals have the same neighbor individual, and the neighbor individual is the central individual, then the two individuals are connected.

[0042] Subgroup: A set of interconnected individuals from which there are no invading individuals that are connected to the individuals in the set.

[0043] Through the above definition, the subgroups are defined, in which the two parameters of the minimum number of neighbors and the neighborhood radius determine the number of subgroups and the number of intelligent individuals in the subgroup. The subgroup division proposed in this article is to facilitate the situation assessment of the intrusion cluster, so the number of subgroups needs to be controlled within a reasonable range. If the number of subgroups is too large, the situation assessment needs to evaluate many targets, the computational complexity increases, and the defense force attacking the intrusion cluster will be dispersed; if the number of subgroups is too small, it is impossible to achieve hierarchical defense of the intrusion cluster, that is, to allocate a part with strong defense force to the intrusion subgroup with the greatest threat. Therefore, the reasonable selection of the number of subgroups is of great significance to the situation assessment and even the allocation of defense force. Therefore, the present invention proposes a subgroup division algorithm that adaptively adjusts the neighborhood radius, sets a reasonable subgroup number interval according to actual conditions, and the algorithm controls the neighborhood radius to achieve adaptive adjustment of the number of subgroups. Figure 1 As shown in FIG, when the number of subgroups is less than the reasonable subgroup number interval, the neighborhood radius R increases; when the number of subgroups is greater than the reasonable subgroup number interval, the neighborhood radius R decreases.

[0044] Then an intrusion cluster threat assessment algorithm is proposed. The algorithm constructs an intrusion threat assessment hierarchy based on the hierarchical analysis method, such as Figure 2 As shown. The structure is divided into three levels: target level, criterion level and scheme level. The criterion level is also the key level in the structure. This level gives four influencing factors of threat assessment: the distance from the subgroup center to the base B1, the number of individuals in the subgroup B2, the angle between the subgroup average speed direction and the position B3, and the subgroup center divergence B4. Their definitions are as follows:

[0045] Distance from subgroup center to base: The distance from the subgroup center to the base (high-value target), where the subgroup center is the geometric center of the subgroup.

[0046] Number of individuals in a subgroup: The number of invading individuals in a subgroup. This value represents the invasion scale of the invading subgroup.

[0047] The angle between the average speed direction of the subgroup and the line connecting the positions: that is, the angle between the average speed direction of all intelligent individuals in the subgroup and the line connecting the subgroup center to the base.

[0048] Subgroup center divergence: This value measures the density or sparseness of the subgroup and is calculated as follows:

[0049]

[0050] Where N represents the number of invading intelligent individuals in the invading subgroup, x i Represented as the position vector of the invading intelligent individual i, x c Denoted as the invasion subgroup center.

[0051] By comparing the importance of these four influencing factors two by two, we can get the pairwise comparison matrix of each factor, as shown in Table 1.

[0052] Table 1 Pairwise comparison matrix of each factor

[0053]

[0054] According to the pairwise comparison matrix, the weight vector ω of the four factors can be calculated: 0 , and then obtain the values ​​of the four factors of each subgroup. By comparing the single factors between subgroups, four pairwise comparison matrices can be obtained, and then four weight ranking vectors ω are obtained respectively 1 ,ω 2 ,ω 3 ,ω 4, indicating the threat level of each subgroup to a certain factor, and finally the comprehensive weight vector ω 0 The total ranking matrix of the threat level of each subgroup can be calculated as follows:

[0055] W=[ω 1 ,ω 2 ,ω 3 ,ω 4 ] T (2)

[0056] Then, the threat level of each intrusion subgroup to the base (high-value target) can be obtained. The algorithm flow chart is as follows: Figure 3 shown.

[0057] The specific embodiment of the intrusion cluster threat assessment method based on hierarchical analysis method proposed in the present invention is divided into the following steps, and its algorithm flow chart is as follows: Figure 3 shown.

[0058] Step 1: Sense the intrusion cluster.

[0059] The algorithm proposed in the present invention can deal with not only a single intrusion cluster, but also multiple intrusion clusters. Therefore, at the beginning of the algorithm, it is necessary to judge the number of intrusion clusters. When the number is less than the maximum reasonable number of subgroups, it is necessary to execute the subgroup division algorithm to obtain a reasonable subgroup division result; if it is greater than the maximum reasonable number of subgroups, the subgroup division algorithm is skipped and the threat assessment is directly performed on each intrusion subgroup.

[0060] Step 2: Subgrouping

[0061] When the number of clusters meets the corresponding conditions, this step is executed. The algorithm flow chart is as follows Figure 1 As shown, the number of subgroups can be adaptively adjusted by controlling the neighborhood radius.

[0062] Step 3: Identify influencing factors.

[0063] Four influencing factors of threat assessment are given: the distance from the subgroup center to the base B1, the number of individuals in the subgroup B2, the angle between the subgroup average speed direction and the position B3, and the subgroup center divergence B4. The importance of the four influencing factors is inconsistent, and the pairwise comparison matrix is ​​obtained by comparing the factors one by one, as shown in Table 1.

[0064] Step 4: Calculate the weight ranking vector of each factor between subgroups

[0065] First, build an intrusion threat assessment hierarchy, such as Figure 2 Then, the subgroups are compared with each other on a single factor, and four pairwise comparison matrices are obtained, and then four weight ranking vectors ω are obtained respectively. 1 ,ω 2 ,ω3 ,ω 4 , indicating the threat level of each subgroup regarding a certain factor.

[0066] Step 5: Calculate the threat level of each intrusion subgroup

[0067] Combining steps 3 and 5, the total ranking matrix W of the threat level of each subgroup can be calculated, and then the threat level of each subgroup can be obtained.

[0068] The above algorithm is simulated. The main objects of the invention include base and intrusion cluster. The base can sense and obtain the location information and speed information of the intrusion cluster. The reasonable interval of the intrusion subgroup with the most reasonable defense force allocation is [2,4]. The individual information of the intrusion cluster at a certain moment is shown in the following table:

[0069]

[0070]

[0071] Step 1: Determine the number of intrusion clusters: Calculate the central divergence D of the intrusion clusters center =4.34<10, so this defense cluster is a defense cluster.

[0072] Step 2: Subgroup division: The defense cluster is divided into subgroups according to the division algorithm, where the neighborhood radius R is set to 3 and the minimum number of neighbor individuals is set to 3. Through the neighborhood radius adaptation of the division algorithm, the neighborhood radius R is adjusted to 6, and the intrusion subgroup is divided into 4 subgroups. The individual ID sequence is:

[0073] Subgroup 1: {1 2 5 6 8 9 10 11 12 19 20 24 25 27 28}

[0074] Subgroup 2: {3 4 13 14 15 16 17 18 26 30}

[0075] Subgroup 3: {7 21 22 23 29}

[0076] Step 3: Compare the four influencing factors of threat assessment in pairs to obtain the pairwise comparison matrix X:

[0077]

[0078] Step 4: Calculate the weight ranking vector of each factor: Calculate the eigenvector of the contrast matrix X and use it as the weight vector ω of each factor 0 =[0.51 0.82 0.21 0.13] T .

[0079] Step 5: Calculate the weight ranking matrix of each subgroup for the four factors: First, calculate the values ​​of the four factors of each subgroup, as shown in the following table:

[0080] B1 B2 B3 B4 Subgroup 1 25 15 165 5 Subgroup 2 30 10 169 3 Subgroup 3 37 5 173 3

[0081] The values ​​of the four factors are all negatively correlated with the threat level, which is a reverse indicator. Each subgroup is compared with each other on each factor, and four pairwise comparison matrices are obtained, as shown below:

[0082] B1 Subgroup 1 Subgroup 2 Subgroup 3 Subgroup 1 1 30 / 25 37 / 25 Subgroup 2 25 / 30 1 37 / 30 Subgroup 3 25 / 37 30 / 37 1

[0083] According to the above contrast matrix X1, its eigenvector can be calculated as the weight vector ω of each subgroup with respect to B1 1 =[0.47 0.55 0.69] T .

[0084] B2 Subgroup 1 Subgroup 2 Subgroup 3 Subgroup 1 1 10 / 15 5 / 15 Subgroup 2 15 / 10 1 5 / 10 Subgroup 3 15 / 5 10 / 5 1

[0085] According to the above contrast matrix X2, its eigenvector can be calculated as the weight vector of each subgroup B2: ω2 = [0.81 0.55 0.20] T .

[0086] B3 Subgroup 1 Subgroup 2 Subgroup 3 Subgroup 1 1 169 / 165 173 / 165 Subgroup 2 165 / 169 1 173 / 169 Subgroup 3 165 / 173 169 / 173 1

[0087] According to the above contrast matrix X3, its eigenvector can be calculated as the weight vector ω of each subgroup B3 3 =[0.56 0.58 0.59] T .

[0088] B4 Subgroup 1 Subgroup 2 Subgroup 3 Subgroup 1 1 3 / 5 3 / 5 Subgroup 2 5 / 3 1 3 / 3 Subgroup 3 5 / 3 3 / 3 1

[0089] According to the above contrast matrix X4, its eigenvector can be calculated as the weight vector ω of each subgroup B4 4 =[0.76 0.46 0.46] T .

[0090] The weight ranking matrix of each subgroup for the four factors is as follows:

[0091]

[0092] Step 5: Calculate the total weight ranking vector of each subgroup: Substitute the weight vector ω of each factor 0 Combined with the weight ranking matrix W of each subgroup for the four factors, we can obtain the total weight ranking vector V = [1.12 0.92 0.70] of each subgroup.

[0093] Step 6: Get the threat level of each subgroup: The total weight ranking vector V corresponds to the threat level of each subgroup.

[0094] That is, subgroup 1 poses the highest threat to the base, subgroup 2 is second, and subgroup 3 poses the least threat. Finally, defense forces are allocated to them according to their threat levels.

Claims

1. A method for assessing intrusion cluster threats based on hierarchical analysis, characterized in that Here are the steps: Step 1, determine the number of intrusion clusters: when the number of intrusion clusters is less than the maximum set number of subgroups, execute step 2 to divide the intrusion clusters using the subgroup division algorithm to obtain the subgroup division result; if the number of intrusion clusters is greater than the maximum set number of subgroups, execute step 3 to calculate the weight of each subgroup; The intrusion cluster is composed of multiple intelligent individuals; Step 2: Subgroup division: The protected target divides the intruder individuals in the perceived intrusion cluster into multiple intrusion subgroups; The subgroup is to find all interconnected individuals according to the definition of individual connectivity, and then divide the interconnected individuals into a subgroup, and there are no intrusion individuals outside the subgroup that are connected to the individuals in the subgroup; The individuals are connected: if two intruding individuals have the same neighbor individual, and the neighbor individual is the central individual, then the two individuals are connected; The central individual: if the number of neighbor individuals in the neighborhood of the invading individual is greater than the minimum number of neighbor individuals, then the individual is the central individual; Step 3: Compare the four influencing factors of threat assessment in pairs to obtain a pairwise comparison matrix: Among them: the distance between the subgroup center and the base is B1, the number of individuals in the subgroup is B2, the angle between the subgroup average speed direction and the position line is B3, and the divergence of the subgroup center is B4; Step 4, calculate the weight ranking vector of each factor: solve the eigenvector of the pairwise comparison matrix, and use the eigenvector as the weight vector ω0 of the importance of the four factors; Step 5, calculate the weight ranking matrix of each subgroup for the four factors: obtain the values ​​of the four factors of each subgroup, and compare each factor Bi (i = 1, 2, 3, 4) of each subgroup to obtain the corresponding pairwise comparison matrix Xi; calculate the eigenvector of the pairwise comparison matrix Xi as the weight vector ω of each subgroup for the factor Bi i ; Thus, the weight ranking matrix W of each subgroup for the four factors is obtained: W=[ω1,ω2,ω3,ω4] T Step 6: Calculate the total weight ranking vector of each subgroup: Combine the weight vector ω0 of each factor with the weight ranking matrix W of each subgroup for the four factors to obtain the total weight ranking vector V of each subgroup: V=ω0 T W Step 7: Get the threat level of each subgroup: The total weight ranking vector V corresponds to the threat level of each subgroup.

2. The intrusion cluster threat assessment method based on hierarchical analysis method according to claim 1 is characterized by: When the number of divided subgroups is greater than the maximum subgroup number setting value, the individual neighborhood radius in the subgroup division increases; when the number of subgroups is less than the minimum subgroup number setting value, the individual neighborhood radius in the subgroup division decreases; the neighborhood radius is the interaction radius of the invading individual, that is, other invading individuals within the interaction radius are regarded as its neighbor individuals.

3. The intrusion cluster threat assessment method based on hierarchical analysis method according to claim 1 is characterized in that: The subgroup center divergence measures the density or sparseness of the subgroup, and is calculated as: Where N represents the number of invading intelligent individuals in the invading subgroup, x i Represented as the position vector of the invading intelligent individual i, x c Denoted as the invasion subgroup center.

Images