Adaptive platform migration defense method based on field programmable gate array

Abstract

The present disclosure relates to a field programmable gate array-based adaptive platform migration defense method, comprising the following steps: based on field programmable gate array technology, designing different software executable files and hardware configuration data to form the configuration variants required for network platform migration; constructing a platform dynamic defense evolutionary game model and initializing the parameters in the platform dynamic defense evolutionary game model; obtaining a standard defense payoff matrix according to the Nash equilibrium reached by both parties in the platform dynamic defense evolutionary game model; substituting the standard defense payoff matrix into the replicator dynamic equation to obtain the defense side game belief change rate; repeating and iterating all the above steps to obtain a set of defense side game belief change rates; and outputting a platform dynamic switching configuration variant defense strategy according to the set of defense side game belief change rates. The present disclosure can improve the defense effect of the platform under the conditions of incomplete information and limited resources in actual network attack and defense.

Description

TECHNICAL FIELD

[0001] The present disclosure relates to the technical field of computer network information security, and particularly relates to a self-adaptive platform migration defense method based on a field programmable logic gate array. BACKGROUND

[0002] Advanced Persistent Threat (APT) refers to a persistent and efficient network attack activity of an attacker on a specific object. The attacker constantly changes the intrusion path according to the detected information, so that the traditional defense technologies such as intrusion detection and firewall based on feature matching are difficult to effectively discover threats. Therefore, platform dynamic defense (PDD) has become an important means to solve practical problems such as network security.

[0003] The platform dynamic defense technology is an effective solution to reverse the problem of "strong attack and weak defense" in the current network attack and defense, but the traditional voucher dynamic defense technology has high defense cost, low cost-effectiveness, and low defense efficiency in actual network attack and defense under the conditions of incomplete information and limited resources. Therefore, it is necessary to improve one or more problems existing in the above-mentioned related technical solutions.

[0004] It should be noted that the information disclosed in the above background section is only used to strengthen the understanding of the background of the present disclosure, and therefore can include information that does not constitute prior art known to those of ordinary skill in the art. SUMMARY

[0005] The purpose of the embodiments of the present disclosure is to provide a self-adaptive platform migration defense method based on a field programmable logic gate array to improve the defense efficiency of the platform.

[0006] According to the embodiments of the present disclosure, a self-adaptive platform migration defense method based on a field programmable logic gate array is provided to improve the defense efficiency of the platform, including the following steps:

[0007] Based on the field programmable logic gate array technology, different software executable files and hardware configuration data are designed to form the configuration variants required for network platform migration;

[0008] An evolutionary game model of platform dynamic defense is constructed, and the parameters in the evolutionary game model of platform dynamic defense are initialized;

[0009] According to the Nash equilibrium reached by the two parties in the evolutionary game model of platform dynamic defense, a standard defense payoff matrix is obtained; and the standard defense payoff matrix is substituted into a replication dynamic equation for calculation to obtain a defense party game belief change rate;

[0010] Repeat the iteration of all the above steps to obtain a set of defense game belief change rates;

[0011] According to the set of defense game belief change rates, output the platform dynamic switching configuration variant defense strategy.

[0012] In an exemplary embodiment of the present disclosure, in the steps of constructing a platform dynamic defense evolutionary game model and initializing parameters in the platform dynamic defense evolutionary game model, the platform dynamic defense evolutionary game model includes a 5-tuple model PDDEGM=(N, C, S, P, U), wherein,

[0013] N=(N A ,N D ), represents the set of participants in the platform dynamic defense evolutionary game model, N A represents the attacker, and N D represents the defender;

[0014] C=(C0, C1, C2…C i ), i∈N + , represents the set of available configuration variants of the platform defense system, C0, C1, C2…C i represent different configuration variants, and C0 represents the preloaded configuration variant of the platform defense system;

[0015] S={(S Ai ,S Dj )|1≤i≤m,1≤j≤n,m,n∈N +}, represents the set of strategies of both parties in the game, S Ai represents the attack strategy presented by the attacker using different types of intrusion viruses; and S Dj represents the defense strategy presented by the defender loading different configuration variants;

[0016] P={(P Ai ,P Dj )|1≤i≤m,1≤j≤n}, represents the set of game beliefs. P Ai represents the distribution probability of the i-th virus of the attacker, P Ai ∈[0,1] and P Dj represents the probability of the defender defending the j-th configuration variant, P Dj ∈[0,1] and

[0017] represents the set of payoff functions of both parties in the game; U A represents the payoff function of the attacker, represents the payoff function of the defender when the defender adopts strategy S Dj , and the attacker adopts strategy SAi the attacker's payoff; U D representing the defender's payoff function, represents the attacker's payoff when the attacker adopts strategy S Ai , the defender adopts strategy S Dj , and the defender's payoff.

[0018] In an example embodiment of the present disclosure, the calculation formula of the attacker's payoff includes:

[0019]

[0020] The calculation formula of the defender's payoff includes:

[0021]

[0022] wherein, represents the importance of resources; δ represents the success rate of vulnerability exploitation; ε represents the immunity probability; and VITC represents the cost of vulnerability information change.

[0023] In an example embodiment of the present disclosure, according to the Nash equilibrium reached by both parties in the platform dynamic defense evolutionary game model, a standard defense payoff matrix is obtained; and the standard defense payoff matrix is substituted into the replicator dynamic equation for calculation to obtain the step of obtaining the defense party game belief change rate.

[0024] An attacker payoff matrix and a defender payoff matrix are respectively constructed;

[0025] The attacker's payoff and the defender's payoff are respectively calculated. The average attacker payoff and the average defender payoff

[0026] The defender payoff matrix is standardized to obtain a standard defense payoff matrix D;

[0027] The standard defense payoff matrix D is substituted into the replicator dynamic equation for calculation to obtain the defense party game belief change rate.

[0028] In an example embodiment of the present disclosure, in the step of respectively constructing an attacker payoff matrix and a defender payoff matrix,

[0029] The calculation formula of the attacker payoff matrix includes:

[0030]

[0031] The calculation formula of the defender payoff matrix includes:

[0032]

[0033] In an example embodiment of the present disclosure, in the step of normalizing the defense payoff matrix to obtain a standard defense payoff matrix D,

[0034] The calculation formula of the standard defense payoff matrix includes:

[0035]

[0036] Wherein,

[0037] In an example embodiment of the present disclosure, when d1>0, d2<0, the set of Nash equilibrium is (S A2 ,S D2 );

[0038] When d1>0, d2>0, the set of Nash equilibrium is (S A1 ,S D1 ), (S A2 ,S D2 ),

[0039] Wherein, represents a mixed strategy;

[0040] When d1<0, d2<0, the set of Nash equilibrium is (S A1 ,S D2 ), (S A2 ,S D1 ),

[0041] When d1<0, d2>0, the set of Nash equilibrium is (S A1 ,S D1 ).

[0042] In an example embodiment of the present disclosure, when the attack and defense are 2x2 symmetric games,

[0043] The calculation formula of the attack payoff matrix is changed to:

[0044]

[0045] The calculation formula of the defense payoff matrix is changed to:

[0046]

[0047] In an example embodiment of the present disclosure, the calculation formula of the standard defense payoff matrix is changed to:

[0048]

[0049] wherein:

[0050] In the step of substituting the standard defense payoff matrix D into the replicator dynamic equation to calculate the defense side evolutionary game belief change rate in an exemplary embodiment of the present disclosure, the replicator dynamic equation comprises:

[0051]

[0052] wherein, represents the average payoff.

[0053] The technical solution provided by the present disclosure can include the following beneficial effects:

[0054] The present disclosure provides a field programmable gate array based adaptive platform migration defense method, which can improve the defense effect of the platform under the conditions of incomplete information and limited resources in actual network attack and defense.

[0055] It should be understood that the above general description and the following detailed description are only exemplary and explanatory, and cannot limit the present disclosure. BRIEF DESCRIPTION OF DRAWINGS

[0056] The accompanying drawings, which are incorporated into the specification and constitute a part of the specification, illustrate embodiments consistent with the present disclosure and, together with the specification, serve to explain the principles of the present disclosure. It is obvious that the drawings in the following description are only some embodiments of the present disclosure, and other drawings can be obtained from these drawings without creative labor for those skilled in the art.

[0057] Figure 1 A step schematic diagram of the field programmable gate array based adaptive platform migration defense method in an exemplary embodiment of the present disclosure is shown;

[0058] Figure 2 An abstract model diagram of reconfigurable computing in the platform dynamic defense evolutionary game model in an exemplary embodiment of the present disclosure is shown;

[0059] Figure 3 A schematic diagram of platform state switching principle in the platform dynamic defense evolutionary game model in an exemplary embodiment of the present disclosure is shown;

[0060] Figure 4 A probability change trend graph of strategy selection in the field programmable gate array based adaptive platform migration defense method in an exemplary embodiment of the present disclosure is shown;

[0061] Figure 5A schematic diagram of a simulation experiment environment showing an exemplary embodiment of the present disclosure;

[0062] Figure 6 A curve graph showing the evolution trend of different initial game beliefs in a simulation experiment of an exemplary embodiment of the present disclosure;

[0063] Figure 7 A contrast graph of cumulative defense strategy income of different initial game beliefs in a simulation experiment of an exemplary embodiment of the present disclosure. DETAILED DESCRIPTION

[0064] Example implementations will now be described more fully with reference to the accompanying drawings. Example implementations can be implemented in any

[0065] In addition, the accompanying drawings are included to provide a further understanding of the present disclosure and are incorporated in and constitute a part of this specification, illustrate embodiments of the present disclosure and serve to explain the principles of the present disclosure. The same reference numbers in different drawings represent the same or similar elements.

[0066] A first aspect of the present example implementation provides a method for adaptive platform migration defense based on field programmable logic gate array, referring to Figure 1 as shown, comprising the following steps:

[0067] Step S101: Based on field programmable logic gate array technology, design different software executable files and hardware configuration data to form configuration variants required for network platform migration;

[0068] Step S102: Construct a platform dynamic defense evolution game model and initialize parameters in the platform dynamic defense evolution game model;

[0069] Step S103: According to the Nash equilibrium reached by both parties in the platform dynamic defense evolution game model, obtain a standard defense income matrix; and substitute the standard defense income matrix into the replicator dynamic equation for calculation to obtain a defense party game belief change rate;

[0070] Step S104: Repeat all the above steps to obtain a set of defense party game belief change rates;

[0071] Step S105: According to the set of defense game belief change rates, output the platform dynamic switching configuration variant defense strategy.

[0072] In the following, each step of the above method in the present example embodiment will be described in more detail.

[0073] Platform Dynamic Defense (PDD) is a platform defense technology based on reconfigurable computing. Through various software and hardware task division and differentiated logic circuit design, multiple executable files and configuration data are run in general-purpose processors and field programmable gate arrays (FPGAs) to meet application tasks. Buffer overflow vulnerability is a common vulnerability in software and operating systems, and has become a common breakthrough for attackers to invade viruses. Network attackers obtain vulnerability information through long-term reconnaissance, design targeted viruses, and launch network attacks to cause loss of important system information such as user data and privacy. The key to the idea of active defense is to break the attack chain of the attacker. The reconfigurable computing technology based on FPGA can dynamically convert configuration information during platform task running, and present irregular vulnerability information to the outside, so that the attacker cannot lock the attack target, cut off the attack path, and achieve the defense purpose.

[0074] Referring to Figure 2 In the present example step S101, the reconfigurable system randomly selects the software executable files and hardware configuration data (hereinafter collectively referred to as configuration variants) generated in advance, and loads them into the CPU and FPGA for running. Different configuration variants use different address spaces, so randomly changing the configuration variants loaded in the general-purpose processor can effectively defend against attacks on certain software vulnerabilities and buffer overflow attacks. Figure 2 The CPU contains application programs, schedulers, layouters, loaders, etc. The random access memory (RAM) exchanges data with the CPU bidirectionally, and establishes bidirectional communication with the FPGA.

[0075] The defense node cannot predict the type and characteristics of the invading virus, so it can only continuously try and error, learn and adjust the strategy of switching configuration variants according to historical information and feedback information from other defense nodes, until the defense node tends to select the strategy with the maximum defense benefit, that is, the formation process of the evolutionary stable strategy in evolutionary game.

[0076] Referring to Figure 3 In the present example step S102, the reconfigurable system randomly selects the software executable files and hardware configuration data (hereinafter collectively referred to as configuration variants) generated in advance, and loads them into the CPU and FPGA for running. Different configuration variants use different address spaces, so randomly changing the configuration variants loaded in the general-purpose processor can effectively defend against attacks on certain software vulnerabilities and buffer overflow attacks. Figure 3 In the present example step S102, the reconfigurable system randomly selects the software executable files and hardware configuration data (hereinafter collectively referred to as configuration variants) generated in advance, and loads them into the CPU and FPGA for running. Different configuration variants use different address spaces, so randomly changing the configuration variants loaded in the general-purpose processor can effectively defend against attacks on certain software vulnerabilities and buffer overflow attacks.i1 , P i2 , P i3 respectively represent that the platform is infected by the virus in the state P1, P2, P3. After the platform is infected, the general processor and the programmable logic device are reset, so that the platform is restored and loaded with other optional configuration variants. Since the platform presents different vulnerability information when loading different configuration variants, the new platform state has a certain immunity probability to the previous virus. Assuming that the initial state of the platform is P1, the defense strategies that can be selected by the platform defense system are P i1 →P2 and P i1 →P3. Similarly, when the initial state of the platform is P2 or P3, there are also two defense strategies respectively.

[0077] The platform dynamic defense starts from switching configuration variants in the defense node, and the switching probabilities corresponding to different defense strategies are not the same. Therefore, how to select a defense strategy according to the evolution of the attack virus distribution probability is the key to improving the defense efficiency. At the same time, the system overhead brought by switching configuration variants is also an important influencing factor in the attack and defense game. By establishing a network attack and defense evolutionary game model, the evolutionary stable strategy of the defense node is deduced, which is helpful for the platform dynamic defense system to predict and control the switching strategy of the configuration variant.

[0078] Referring to FIG. 1, in the step S102 of the present example, the platform dynamic defense evolutionary game model (PDDEGM) includes a 5-tuple model PDDEGM=(N,C,S,P,U), wherein, Figure 1

[0079] N=(N A ,N D ), represents the set of participants in the platform dynamic defense evolutionary game model, N A represents the attacker, and N D represents the defender;

[0080] C=(C0,C1,C2…C i ), i∈N + , represents the set of available configuration variants of the platform defense system, C0, C1, C2…C i represent different configuration variants, and C0 is the preloaded configuration variant of the platform defense system by default;

[0081] S={(S Ai ,S Dj )|1≤i≤m,1≤j≤n,m,n∈N +} represents the set of strategies of both parties in the game, S Ai ​represents the attack strategy presented by the attacker using different types of intrusion viruses; S Dj represents the defense strategy presented by the defense party loading different configuration variants;

[0082] P = {(P Ai , P Dj )|1≤i≤m,1≤j≤n} represents the set of beliefs of both parties in the game. P Ai represents the distribution probability of the i-th virus of the attacker, P Ai ∈[0,1] and P Dj represents the probability of the j-th configuration variant of the defense node of the defense party, P Dj ∈[0,1] and

[0083] represents the set of payoff functions of both parties in the game; U A represents the payoff function of the attacker, represents the payoff of the attacker when the defense party adopts the strategy S Dj , and the attacker adopts the strategy S Ai ; U D represents the payoff function of the defense party, represents the payoff of the defense party when the attacker adopts the strategy S Ai , and the defense party adopts the strategy S Dj .

[0084] The calculation formula of the payoff of the attacker U is as follows:

[0085] The calculation formula of the payoff of the defense party U is as follows:

[0086] wherein, represents the importance of resources. The importance of resources is a main index for measuring the payoffs of both the attacker and the defense party. The more important the resources are, the greater the payoffs of the intrusion success or the defense success are.

[0087] δ represents the success rate of vulnerability exploitation. The success rate of vulnerability exploitation is the probability of the attacker changing the attack strategy to exploit new vulnerabilities to launch an attack. When the platform switches the configuration variant, the vulnerability information presented by the platform will change, the attack path of the attacker will also change, and thus the success rate of vulnerability exploitation is affected.

[0088] ε represents the immunity probability. The immunity probability is the immunity probability of the platform dynamic defense system to the original virus after switching the configuration variant. In this example, ε = 1-δ.

[0089] VITC represents vulnerability information transfer cost. The vulnerability information transfer cost (VITC) refers to the additional overhead brought by the platform dynamic defense system when changing the vulnerability information presented to the outside by switching the configuration variants, that is, the time cost overhead brought by CPU reloading the execution file, the management and maintenance overhead of programmable resources, and the scheduling overhead of the scheduler.

[0090] For the attacker, the benefit depends on the importance of the occupied resources after the attack is successful and the vulnerability exploitation success rate at the time of attack. For the defender, the benefit depends on the importance of the resources after the defense is successful, the vulnerability information transfer cost paid by the defense, and the immunity probability after the defense.

[0091] In the present example step S103, the following sub-steps are included:

[0092] Step S1031: constructing an attacker benefit matrix and a defender benefit matrix respectively;

[0093] The calculation formula of the attacker benefit matrix is:

[0094]

[0095] The calculation formula of the defender benefit matrix is:

[0096]

[0097] Step S1032: calculating the attacker benefit the defender benefit the average attacker benefit and the average defender benefit

[0098] Step S1033: standardizing the defender benefit matrix to obtain a standard defender benefit matrix D. The calculation formula of the standard defender benefit matrix is:

[0099]

[0100] wherein,

[0101] Step S1034: substituting the standard defender benefit matrix D into the replicator dynamic equation to obtain the defense game belief change rate. The replicator dynamic equation can be expressed in terms of the change amount of strategy selection, that is:

[0102]

[0103] wherein, represents the average payoff. The average payoff refers to the average value of the payoffs obtained by all participants of the game, represents the average payoff of the attacker, represents the average payoff of the defender.

[0104] The obtained defender game belief change rate refers to the derivative of the probability of the defender selecting the strategy S Dj .

[0105] In step S104, all the above steps are repeated iteratively to obtain a set of defender game belief change rates;

[0106] In step S105, according to the set of defender game belief change rates, the platform dynamic switching configuration variant defense strategy is output.

[0107] Specifically, in the example, a 2x2 symmetric game between the attacker and the defender is taken as an example, the payoff of the evolutionary game between the attacker and the defender in the static case is evolved, and it is explained that the static evolutionary game will fall into which category under different conditions. In particular, in the example, since there is no time state change, the evolutionary game has no selection and mutation, and the Nash equilibrium reached by the game is the evolutionary equilibrium. The attack strategy S A1 used by the attacker is to use a buffer overflow attack virus to invade, the attack strategy S A2 is to use a virus against platform vulnerabilities to invade. The defense strategy S D1 used by the defender is to switch from the preloaded configuration variant C0 to the backup configuration variant C1, the defense strategy S D2 is to switch from the preloaded configuration variant C0 to the backup configuration variant C2.

[0108] The attacker payoff matrix and the defender payoff matrix are constructed respectively;

[0109] The calculation formula of the attacker payoff matrix is changed to:

[0110]

[0111] The calculation formula of the defender payoff matrix is changed to:

[0112]

[0113] The defender payoff matrix is standardized to obtain a standard defense payoff matrix D; the calculation formula of the standard defense payoff matrix is:

[0114]

[0115] Among them:

[0116] From equation (8), we can deduce that the 2x2 attack-defense game can be represented as a point in the plane by standardization When d1, d2 take values of different positive and negative, the game will fall into different classical game types, the following will be discussed:

[0117] Game type I: when d1>0, d2<0, in this type of game, the attack strategy S A2 is strictly better than the attack strategy S A1 , the defense strategy S D2 is also strictly better than the defense strategy S D1 . At this time, the set of Nash equilibrium is (S A2 , S D2 ).

[0118] Game type II: when d1>0, d2>0, in this type of game, there are two symmetric strictly Nash equilibrium and a mixed strategy Nash equilibrium, define the mixed strategy At this time, the set of Nash equilibrium is (S A1 , S D1 ), (S A2 , S D2 ),

[0119] Game type III: when d1<0, d2<0, in this type of game, there is no strategy dominated, so there are two asymmetric strictly Nash equilibrium and a symmetric mixed strategy Nash equilibrium. At this time, the set of Nash equilibrium is (S A1 , S D2 ), (S A2 , S D1 ),

[0120] Game type IV: when d1<0, d2>0, in this type of game, the attack strategy S A1 is strictly better than the attack strategy S A2 , the defense strategy S D1 is also strictly better than the defense strategy S D2 . The set of Nash equilibrium is (S A1 , S D1 ), similar to game type I.

[0121] Payoffs represent the incremental effect of the adaptive influence of the two participants in a game. According to evolutionary game theory, strategies that are more advantageous to an individual (i.e., strategies with higher payoffs) will be inherited by their offspring and are also more likely to be chosen by other individuals in the population. In this example, drawing on evolutionary thinking, it is assumed that in the duration state, the probability of each strategy being adopted over time is related to the payoff outcome of its first game. That is, in the dynamic evolutionary game model, the calculation of the growth rate of defense strategy selection is based on the outcome of the static evolutionary game.

[0122] Substituting the standard defense payoff matrix D obtained from formula (8) into formula (9), we can obtain: Because the sum of the defender's game beliefs is 1, i.e., P D1 +P D2 =1, formula (9) can be further expressed as:

[0123] Reference Figure 4 As shown, when d1 and d2 take different values, the trend of strategy selection in the replicative dynamic model also differs. Based on the four classifications of game types discussed above, it can be seen that...

[0124] When the game type is I After evolution, it will converge to 0, meaning the defender's evolutionary stable strategy is S. D2 .

[0125] When the game type is II, if the initial belief P D1 Greater than adopting a hybrid strategy belief but After evolution, it will converge to 1, meaning that the defender's evolutionary stable strategy at this point is S. D1 If the initial belief P D1 Smaller than adopting a hybrid strategy belief but After evolution, it will converge to 0, meaning that the defender's evolutionary stable strategy at this point is S. D2 .

[0126] When the game type is III, regardless of the initial belief P D1 If the value is greater than or less than the value, a mixed strategy is adopted. belief The defender's evolutionary stable strategy will always converge to a hybrid strategy.

[0127] When the game type is IV After evolution, it will converge to 1, meaning the defender's evolutionarily stable strategy is S. D1 .

[0128] In the case of known static game payoff results, the evolutionary game model can refine the defense strategy of the defense party. In each deterministic case, the defense party always has an evolutionary stable defense strategy. In practical applications, the model can help the platform dynamic defense system make effective decisions on defense strategies based on historical experience and adjust them at any time through continuous learning to achieve dynamic defense.

[0129] Repeat the above steps to obtain a set of defense party game belief change rates;

[0130] According to the set of defense party game belief change rates, output the platform dynamic switching configuration variant defense strategy.

[0131] In summary, the defense strategy of the platform dynamic defense system is based on the standardized payoff matrix. Both the attacker and the defender have several initial strategies to choose from. Through the replicator dynamic evolutionary game model, the defense strategy is refined, and the evolutionary stable dynamic defense strategy is finally obtained. Based on this, the platform configuration variant dynamic switching algorithm is designed to provide support for designing the optimal platform dynamic defense strategy. Combined with the example analysis, the output platform dynamic switching configuration variant defense strategy may be a pure strategy or a mixed strategy. The pure strategy can be directly used as the optimal platform dynamic defense strategy, providing theoretical support and program reference for system dynamic defense; the mixed strategy needs to be further evaluated and judged according to different decision criteria.

[0132] Simulation and analysis

[0133] For the platform dynamic defense method proposed in this example implementation, the following simulation experiments are performed, as shown in Figure 5 To verify the effectiveness and feasibility of the model and algorithm, a simulation experiment environment is constructed as shown in Figure 5

[0134] Since network security threats generally come from the external network, in the simulation experiment, a bastion host H and a web server are deployed in the DMZ (Demilitarized Zone) area. The bastion host is loaded with the platform dynamic defense system, which stores three available configuration variants C0, C1, and C2. The web server is a public server that allows all external users to access. The security policy of the firewall is to allow external users to access only the HTTP service and FTP service of the web server, as well as the SMTP service on the bastion host H. Using the Sessus tool, the simulation experiment network environment is scanned, and combined with the vulnerability information from the National Information Security Vulnerability Database (CNNVD), the vulnerability information of the three configurable variants is obtained, defined as V0, V1, and V2. In this simulation experiment, the default attack party initial exploitable vulnerability information is V0, i.e., the vulnerability information presented by the system when loading the default configuration variant C0. In the dynamic game process, the attack strategy S​A1 is V0→V1, the attack strategy S of the attacker A2 is V0→V2.

[0135] The system defaults to load the configuration variant C0, when the system takes the defense strategy S D1 , that is, the loaded configuration variant is C0→C1, the logic element change rate of the circuit implemented in the FPGA reaches 29%, and the system needs to pay an additional 15% overhead; when the system takes the defense strategy S D2 , that is, the loaded configuration variant is C0→C2, the logic element change rate of the circuit implemented in the FPGA reaches 51%, and the system needs to pay an additional 64% overhead.

[0136] The essence of the reconfigurable system to implement dynamic defense is to realize the dynamic change of the address space. The change of the address space will bring about the change of the attack path (Attack Path Variation, APV). The calculation formula of the APV metric referred to here is:

[0137]

[0138] Where, ΔAP i,i-1 represents the difference between the attack paths before and after switching the configuration variant, and |S| represents the total number of network states. In the simulation experiment in this example, ΔAP i,i-1 is quantified as the logic circuit change rate in the FPGA, and |S| = 3 。

[0139] The vulnerability information utilization power is a composite index, and its calculation formula is:

[0140]

[0141] Where, M represents a set of metric parameters; W represents a set of weight values and Σw i = 1. In the simulation experiment in this example, it is defined that m1 is the APV metric, m2 is the standardized CNNVD vulnerability score; w1 and w2 are both 0.5, and finally the following Table 1 vulnerability comprehensive information data is obtained:

[0142] Table 1: Vulnerability comprehensive information data

[0143]

[0144] In the simulation experiment in this example, the resource importance is defined as 1, and the vulnerability information change cost VITC is the additional overhead of the system. According to Table 1, the attacker payment matrix is The defense payment matrix is The standardized revenue matrix obtained is:

[0145] Will Substitute into the formula In this process, an evolutionarily stable mixing strategy is obtained.

[0146] Therefore, the simulation results are obtained, and they are analyzed in detail as follows:

[0147] Here, MATLAB is used to simulate and verify the experimental results. Initial game beliefs P are taken respectively. D1 The values ​​were 0.33, 0.50, 0.97, and 0.99, thus allowing us to observe P. D1 The changing trend. (Refer to...) Figure 6 As shown, after different evolutionary generations, regardless of P's initial game beliefs, D1 Regardless of the value of , its evolutionary stability value is always 0.9472, meaning that the defensive strategy S is adopted in the hybrid strategy. D1 The probability and the effectiveness of the dynamic evolution model have been fully verified. In addition, the initial game belief P... D1 The greater the difference between the initial value and the evolutionary stability value, the more evolutionary generations are required to achieve evolutionary stability; however, regardless of the initial value, the rate of change of game belief shows a trend of being fast at first and then slowing down. This means that in practical applications, if it is necessary to improve the speed of obtaining defense strategies, some accuracy can be sacrificed to reduce the number of evolutionary generations, thereby accelerating the algorithm's output of usable strategies. Thus, the effectiveness of the model and algorithm proposed in this disclosure has been verified.

[0148] Reference Figure 7 Traditional platform dynamic defense technologies based on reconfigurable computation employ a defense strategy that randomly switches configuration variants. To verify the enhancement of the platform dynamic defense effect by the dynamic evolutionary game model proposed in this disclosure, an evolutionary equilibrium defense strategy was compared with a random defense strategy. One hundred Monte Carlo simulation experiments were conducted to obtain the cumulative trend of defense payoffs, such as... Figure 7 As shown.

[0149] from Figure 7 It can be seen that the cumulative payoff using the evolutionary equilibrium strategy is approximately linearly related to the number of evolutions, while the cumulative payoff using the stochastic strategy exhibits a non-linear relationship with the number of evolutions, fluctuating up and down. When the initial game belief P... D1 When the values ​​are 0.33, 0.5, and 0.97, the cumulative return value at the evolutionary equilibrium is close to 2 × 10⁻⁶. 4 A unit value; when the initial game belief P D1 When the cumulative payoff is 0.99, the cumulative payoff to reach evolutionary equilibrium rises to approximately 2.5 × 10⁻⁶. 4 Unit value.

[0150] Analysis of the experimental results shows that, regardless of the initial game belief P...D1 The cumulative income of the evolution equilibrium defense strategy gradually becomes greater than the cumulative income of the random defense strategy as the number of evolution times increases, and the cumulative income of the evolution equilibrium defense strategy is about 1.43-1.67 times the cumulative income of the random defense strategy after reaching the evolution stable state. It can be seen that the more the number of evolution times, the greater the difference between the cumulative incomes of the two defense strategy selection methods.

[0151] It can be inferred that the actual defense effect of the evolution equilibrium defense strategy obtained by using the dynamic evolution model is better than the actual defense effect of the completely random defense strategy. The results of the simulation experiment prove that the platform dynamic defense evolution game model proposed in the disclosure can effectively improve the defense effect of the platform dynamic defense system.

[0152] In summary, the disclosure constructs a platform dynamic defense evolution game model, analyzes the historical situation of the attack party and the defense party, predicts the future game strategy, and obtains the defense strategy with the highest cost-effectiveness ratio based on the platform configuration variant dynamic switching algorithm. The platform dynamic defense evolution game model can give an evolution stable advantage strategy under any initial game belief, switch the configuration variant of the system, change the vulnerability information presented to the outside, and provide a reference for blocking the kill chain. In addition, the platform configuration variant dynamic switching algorithm mentioned in the disclosure can improve the defense income by 43%-67% in the same time compared with the traditional algorithm, which can effectively improve the cost-effectiveness ratio of the system dynamic defense and provide theoretical support for the application of the platform dynamic defense technology based on reconfigurable computing.

[0153] Other embodiments of the disclosure will be apparent to those skilled in the art from consideration of the specification and practice of the disclosure disclosed herein. This application is intended to cover any variations, uses or adaptive changes of this disclosure that follow, in general, the principles of this disclosure and include common knowledge or conventional technical means in the art not disclosed in this disclosure. The specification and examples are only regarded as exemplary, and the true scope and spirit of the disclosure are indicated by the appended claims.

Claims

1. An adaptive platform migration defense method based on field-programmable gate arrays, characterized in that, include: Based on field-programmable gate array (FPGA) technology, different software executable files and hardware configuration data are designed to form configuration variants required for network platform migration. Construct a platform dynamic defense evolution game model and initialize the parameters in the platform dynamic defense evolution game model; Based on the Nash equilibrium reached by both sides in the platform dynamic defense evolution game model, the standard defense payoff matrix is ​​obtained; and the standard defense payoff matrix is ​​substituted into the replication dynamic equation for calculation to obtain the rate of change of the defender's game belief. Repeat all the above steps to obtain the set of rates of change of the defender's game beliefs; Based on the set of change rates of the defender's game beliefs, the output platform dynamically switches and configures variant defense strategies. In the step of constructing a platform dynamic defense evolutionary game model and initializing the parameters in the platform dynamic defense evolutionary game model, the platform dynamic defense evolutionary game model includes a 5-tuple model PDDEGM=( ),in, , represents the set of participants in the platform's dynamic defense evolution game model. Representing the attacker, Representing the defending side; This represents the set of available configuration variants for the platform's defense system. Indicates different configuration variations, This indicates a variant of the platform's defense system preload configuration; , representing the set of strategies of both sides in a game. This indicates the attack strategies employed by the attacker using different types of intrusion viruses; This indicates the defense strategy presented by the defender loading different configuration variants; , representing the set of game-theoretic beliefs; Indicates the attacker's first i The probability distribution of each virus. and ; Indicates the defending side's defensive node j The probability of each configuration variant, and ; , representing the set of payoff functions for both sides in the game; This represents the attacker's payoff function. This indicates when the defending side adopts a strategy The attacker employs a strategy The attacker's gains at that time; Represents the payoff function for the defending side. This indicates when the attacker adopts a strategy The defending side adopts a strategy The defender's benefit at that time; Based on the Nash equilibrium reached by both sides in the platform dynamic defense evolution game model, the standard defense payoff matrix is ​​obtained; and the step of substituting the standard defense payoff matrix into the replication dynamic equation to calculate the rate of change of the defender's game beliefs includes: Construct separate attack and defense payoff matrices; Calculate the attacker's gains respectively. Defender's Benefits Average gains for attackers Average benefits for the defending side ; The defender's payoff matrix is ​​standardized to obtain the standard defense payoff matrix. D ; The standard defense benefit matrix D Substituting the values ​​into the replication dynamic equation, we obtain the rate of change of the defender's game belief. In the standard defense benefit matrix D In the step of substituting into the replication dynamic equation to calculate the rate of change of the defender's game belief, the replication dynamic equation includes: （9） in, This represents the average return. This represents the probability of the i-th configuration variant for the defender.

2. The adaptive platform migration defense method according to claim 1, characterized in that, The attacker's gains Calculation formula include: （1） The defender's benefit The calculation formulas include: （2） in, Indicates the importance of resources; Indicates the success rate of vulnerability exploitation; Indicates the probability of immunity; This indicates the cost of changing vulnerability information.

3. The adaptive platform migration defense method according to claim 1, characterized in that, In the steps of constructing the attacker's payoff matrix and the defender's payoff matrix respectively... The formula for calculating the attacker's profit matrix includes: （3） The formula for calculating the defender's profit matrix includes: （4）。 4. The adaptive platform migration defense method according to claim 3, characterized in that, After standardizing the defender's payoff matrix, a standard defense payoff matrix is ​​obtained. D In the steps, The formula for calculating the standard defense benefit matrix include: （5） in, , .

5. The adaptive platform migration defense method according to claim 4, characterized in that, when At that time, the set of Nash equilibria is ; when At that time, the set of Nash equilibria is , , ,in, , indicating a hybrid strategy; when At that time, the set of Nash equilibria is , , ; when At that time, the set of Nash equilibria is .

6. The adaptive platform migration defense method according to claim 5, characterized in that, When the attacking and defending sides are in a 2×2 symmetric game The formula for calculating the attacker's profit matrix is ​​transformed into: （6） The formula for calculating the defender's profit matrix is ​​transformed into: （7）。 7. The adaptive platform migration defense method according to claim 6, characterized in that, The formula for calculating the standard defense benefit matrix is ​​transformed into: （8） in: , .

Images