A defense strategy selection method and device based on network attack and defense game

Abstract

This invention discloses a method and apparatus for selecting defense strategies based on network attack-defense game theory, relating to the field of network security technology. It identifies attack stages and attack method sets based on global observation information; determines a set of defense agents based on the attack stages and historical security data; for each defense agent, it determines a set of defense strategies corresponding to the attack method set; for each attack method, it searches for corresponding historical security data to obtain an attack strategy set; it substitutes the attack strategy set and defense strategy set into a preset game model for initialization to obtain a target game model; and it solves the equilibrium solution of the target game model to obtain the optimal defense strategy corresponding to each defense agent. By identifying attacks in real time through global observation, dynamically adjusting defense strategies based on historical data, responding to evolving attacks, predicting attacks using historical data, and solving the equilibrium solution of the game model, it ensures long-term effective defense and solves the problem of inability to conduct timely and effective defense.

Description

Technical Field

[0001] This invention belongs to the field of network security technology, specifically relating to a method and apparatus for selecting defense strategies based on network attack and defense game theory. Background Technology

[0002] With the rapid advancement of technology and the widespread adoption of the internet, cyberspace has become an indispensable part of modern society. However, with the rapid development of the internet, cyberattacks have become increasingly frequent and complex, posing unprecedented security challenges to organizations and individuals. The forms of cyberattacks are constantly emerging, including but not limited to computer viruses, hacker intrusions, denial-of-service (DDoS) attacks, ransomware, and phishing attacks. These attack methods can not only lead to data leaks and system paralysis, but also cause significant damage to an organization's reputation and business continuity.

[0003] In the field of cybersecurity, the game between defenders and attackers has always existed. Defenders need to formulate the optimal defense strategy with limited resources, while attackers are committed to finding and exploiting weaknesses in the system to achieve their attack objectives. The complexity and dynamism of this network attack and defense game require that defense strategies not only be effective, but also be able to respond in real time to ever-changing attack threats.

[0004] However, most current network attack and defense game models remain at a static or quasi-static level, meaning that the parameters and strategies in the model are pre-set and cannot be dynamically adjusted according to real-time attack situations. This limitation makes it impossible for network defense systems to defend against new or rapidly evolving attacks in a timely and effective manner. Summary of the Invention

[0005] The purpose of this invention is to solve the problem that network defense systems cannot defend against new or rapidly evolving attacks in a timely and effective manner, and to propose a defense strategy selection method and device based on network attack and defense game theory.

[0006] In a first aspect of this invention, a method for selecting a defense strategy based on network attack-defense game theory is first proposed, the method comprising:

[0007] Obtain global observation information of the current network, and identify the attack stage and attack method set based on the global observation information;

[0008] A set of defense proxies is determined based on the attack phase and historical security data. For the set of defense proxies, a set of defense strategies corresponding to each defense proxy is determined based on the set of attack methods.

[0009] For the set of attack methods, the corresponding historical security data is searched for each attack method to obtain the set of attack strategies;

[0010] The attack strategy set and the defense strategy set are substituted into a preset game model for initialization to obtain the target game model. The equilibrium solution of the target game model is solved to obtain the optimal defense strategy corresponding to each defense agent.

[0011] The final defense strategy is determined based on the optimal defense strategy of each defense agent.

[0012] Optionally, identifying the attack stage and attack method set based on the global observation information specifically includes:

[0013] The data in the global observation information is processed to obtain initial data;

[0014] The initial feature set is obtained by performing traffic analysis, behavior analysis, log analysis, protocol analysis, and content analysis on the initial data.

[0015] The importance score of each initial feature is obtained by calculating the importance of the initial features in the initial feature set using the random forest algorithm, and the initial features with importance scores greater than the preset scores are extracted to obtain the target feature set.

[0016] The target feature set is substituted into the attack pattern database for matching, and the attack patterns with a similarity greater than a threshold are extracted to obtain the attack pattern set; the attack pattern database is used to store the feature sets corresponding to existing attack patterns.

[0017] The attack method set is obtained by performing association rule mining on all attack patterns in the attack pattern set;

[0018] The current stage of the attack is determined based on the attack pattern set and the attack lifecycle.

[0019] Optionally, the set of defense agents determined based on the attack phase and historical security data includes:

[0020] Obtain the frequency and number of successful attacks of various types within a preset period from the historical security data;

[0021] Multiple attack combinations are generated based on the attack phase, the frequency of occurrence of various attacks, and the number of successful attacks of each type.

[0022] All attack combinations are filtered using support and confidence to obtain a target combination set. This target combination set is then compared with a preset proxy set to identify all appearing proxies, thus obtaining a defense proxy set. The preset proxy set stores the defense proxies corresponding to all attack combinations.

[0023] Optionally, the optimal defense strategy for each defense agent is obtained by solving the equilibrium solution of the target game model as follows:

[0024] For each defense agent, calculate the gain matrix between the attacker and the defender, and calculate the probability of different attack and different defense strategy selections at the current time point;

[0025] Among them, through the formula The probability of different attack strategies is obtained through the formula. The probability of obtaining different defense strategies. To select strategy a for the attacker at time t i The weight, To select strategy a for the attacker at time t-1 i The weights, where λ is the weight influence factor. To select strategy a for the attacker at time t-1 i The expected probability, Choose strategy d for the defender at time t. j The weight, To select strategy d for the attacker at time t-1 j The weight, To select strategy d for the attacker at time t-1 j The expected probability, To select strategy a for the attacker at time t i The probability, To choose strategy d for the defender at time t j The probability, where t is the current time;

[0026] Multiple strategy combinations are generated based on the probability of different attack and defense strategies, and the attack and defense benefits of different strategy combinations are calculated.

[0027] Based on the attack benefits and the defense benefits, attack decision equations and defense decision equations are constructed using an iterative reweighted least squares algorithm.

[0028] The optimal defense strategy is obtained by calculating the attack decision equation and the defense decision equation to achieve an evolutionary stable equilibrium.

[0029] Optionally, calculating the attack and defense benefits of different strategy combinations includes:

[0030] Attack benefits are expressed by formula

[0031] Gain the benefits of the attack;

[0032] Defense benefits are expressed by formula

[0033] Gain defensive benefits;

[0034] Among them, U A For the benefit of the attack, U DFor defensive benefits, m is the number of attack strategies, n is the number of defensive strategies, and a i For the i-th attack strategy, d j For the j-th defense strategy, p(a i ) Strategy a for attackers i The probability, q(d) j ) Strategies for the defender j The probability, r(a) i d j When the attacker adopts strategy a i And the defender adopts strategy q(d) j The attacker's gain at time C attack (a i To adopt attack strategy a i Cost, V asset For asset value, Defsuccess(a i d j ) for defender d j Successfully defended against a i The probability of attack, C defense (d j To adopt a defensive strategy j The cost.

[0035] In a second aspect of the present invention, a defense strategy selection device based on network attack and defense game is proposed, comprising: an attack identification module, used to acquire global observation information of the current network, and to identify the attack stage and attack method set according to the global observation information;

[0036] The defense strategy generation module is used to determine a set of defense proxies based on the attack phase and historical security data, and to determine a set of defense strategies for each defense proxy based on the set of attack methods.

[0037] The attack strategy generation module is used to find the corresponding historical security data for each attack method to obtain the attack strategy set.

[0038] The optimal defense strategy generation module is used to substitute the attack strategy set and the defense strategy set into a preset game model for initialization to obtain a target game model, and solve the equilibrium solution of the target game model to obtain the optimal defense strategy corresponding to each defense agent.

[0039] The final defense strategy generation module is used to determine the final defense strategy based on the optimal defense strategy of each defense agent.

[0040] Optionally, the attack identification module includes:

[0041] The data processing module is used to process the data in the global observation information to obtain initial data;

[0042] The data analysis module is used to perform traffic analysis, behavior analysis, log analysis, protocol analysis, and content analysis on the initial data to obtain an initial feature set;

[0043] The target feature set determination module is used to calculate the importance of each initial feature in the initial feature set using a random forest algorithm, and extract the initial features with an importance score greater than a preset score to obtain the target feature set.

[0044] The attack pattern set determination module is used to substitute the target feature set into the attack pattern database for matching, and extract the attack patterns with a similarity greater than a threshold to obtain the attack pattern set; the attack pattern database is used to store the feature sets corresponding to existing attack patterns.

[0045] The attack method set determination module is used to perform association rule mining on all attack patterns in the attack pattern set to obtain the attack method set.

[0046] The attack phase determination module is used to determine the current attack phase based on the attack pattern set and the attack lifecycle.

[0047] Optionally, the defense strategy generation module includes:

[0048] The statistics module is used to obtain the occurrence frequency and success number of various attacks within a preset period in the historical security data; the attack combination determination module is used to generate multiple attack combinations based on the attack stage, the occurrence frequency of various attacks, and the success number of various attacks.

[0049] The defense proxy set determination module is used to filter all attack combinations by support and confidence to obtain a target combination set, and then compare the target combination set with a preset proxy set to determine all appearing proxies to obtain the defense proxy set; the preset proxy set is a set of defense proxies that are stored for all attack combinations.

[0050] Optionally, the optimal defense strategy generation module includes:

[0051] The strategy probability generation module is used to calculate the gain matrix between the attacker and the defender for each defense agent, and to calculate the probability of different attack and different defense strategy selections at the current time point.

[0052] Among them, through the formula The probability of different attack strategies is obtained through the formula. The probability of obtaining different defense strategies. To select strategy a for the attacker at time ti The weight, To allow the attacker to choose strategy a at time t-1 i The weights, where λ is the weight influence factor. To select strategy a for the attacker at time t-1 i The expected probability, Choose strategy d for the defender at time t. j The weight, To select strategy d for the attacker at time t-1 j The weight, To select strategy d for the attacker at time t-1 j The expected probability, To select strategy a for the attacker at time t i The probability, To choose strategy d for the defender at time t j The probability, where t is the current time;

[0053] The revenue calculation module is used to generate multiple strategy combinations based on the probability of different attack and defense strategies, and to calculate the attack and defense revenues of different strategy combinations.

[0054] The decision equation construction module is used to construct attack decision equations and defense decision equations based on the attack benefits and the defense benefits using an iterative reweighted least squares algorithm.

[0055] The optimal defense strategy determination module is used to calculate the optimal defense strategy by achieving an evolutionary stable equilibrium between the attack decision equation and the defense decision equation.

[0056] Optionally, the revenue calculation module includes:

[0057] The attack reward calculation module is used to calculate the attack reward using a formula.

[0058] Gain the benefits of the attack;

[0059] The defense benefit calculation module is used to calculate the benefits using formulas.

[0060] Gain defensive benefits;

[0061] Among them, U A For the benefit of the attack, U D For defensive benefits, m is the number of attack strategies, n is the number of defensive strategies, and a i For the i-th attack strategy, d j For the j-th defense strategy, p(a i ) Strategy a for attackers i The probability, q(d) j ) Strategies for the defenderj The probability, r(a) i d j When the attacker adopts strategy a i And the defender adopts strategy q(d) j The attacker's gain at time C attack (a i To adopt attack strategy a i Cost, V asset For asset value, DefSuccess(a i d j ) for defender d j Successfully defended against a i The probability of attack, C defese (d j To adopt a defensive strategy j The cost.

[0062] The beneficial effects of this invention are:

[0063] This invention proposes a defense strategy selection method based on network attack-defense game theory. It acquires global observation information of the current network and identifies attack stages and attack method sets based on this information. A set of defense agents is determined based on the attack stages and historical security data. For each defense agent, a corresponding defense strategy set is determined based on the attack method set. For each attack method, corresponding historical security data is searched to obtain the attack strategy set. The attack strategy set and defense strategy set are substituted into a preset game model for initialization to obtain a target game model. The equilibrium solution of the target game model is solved to obtain the optimal defense strategy for each defense agent. By using global observation information, attack stages and attack methods can be identified in real time, enabling rapid response to various attacks. Combining attack stages and historical security data, the set of defense agents and corresponding defense strategy sets are dynamically determined to adapt to constantly evolving attack patterns. Furthermore, historical security data is used to construct the attack strategy set, enhancing the ability to learn from past attack patterns and predict future attacks. By solving the equilibrium solution of the target game model, timely and effective defense can be determined in long-term confrontation, solving the problem that network defense systems cannot effectively defend against new or rapidly evolving attacks. Attached Figure Description

[0064] The invention will now be further described with reference to the accompanying drawings.

[0065] Figure 1 A flowchart of a defense strategy selection method based on network attack and defense game theory is provided for an embodiment of the present invention;

[0066] Figure 2 This invention provides a schematic diagram of a defense strategy selection device based on network attack and defense game theory. Detailed Implementation

[0067] Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0068] This invention provides a method for selecting defense strategies based on network attack-defense game theory. See also... Figure 1 , Figure 1 A flowchart illustrating a defense strategy selection method based on network attack-defense game theory, provided as an embodiment of the present invention. The method includes the following steps:

[0069] S101: Obtain global observation information of the current network, and identify the attack stage and attack method set based on the global observation information.

[0070] S102, determine the set of defense agents based on the attack phase and historical security data, and for the set of defense agents, determine the set of defense strategies corresponding to each defense agent based on the set of attack methods.

[0071] S103, for the set of attack methods, find the corresponding historical security data for each attack method to obtain the set of attack strategies.

[0072] S104. Substitute the attack strategy set and defense strategy set into the preset game model to initialize and obtain the target game model. Solve the equilibrium solution of the target game model to obtain the optimal defense strategy corresponding to each defense agent.

[0073] S105, determine the final defense strategy based on the optimal defense strategy of each defense agent.

[0074] This invention provides a defense strategy selection method based on network attack and defense game theory. By observing global information, it can identify attack stages and attack methods in real time, thereby quickly responding to various attacks. Combining attack stages and historical security data, it dynamically determines the defense proxy set and the corresponding defense strategy set to adapt to constantly evolving attack patterns. It also utilizes historical security data to construct the attack strategy set, enhancing the ability to learn from past attack patterns and predict future attacks. By solving the equilibrium solution of the target game model, it can determine timely and effective defense in long-term confrontation, solving the problem that network defense systems cannot defend in a timely and effective manner when facing new or rapidly evolving attacks.

[0075] In one implementation, the global observation information includes: attack type: identifying whether the attack is a distributed denial-of-service (DDoS), malware, phishing attack, SQL injection, etc.; attack source: determining the origin of the attack, which may be an IP address, a domain name, or a group of devices; affected system parts: identifying which system components or services were attacked, such as specific servers, applications, or network devices; traffic anomalies: monitoring abnormal patterns in network traffic, such as a sudden increase in data packets, abnormal communication patterns, etc.; system status: assessing the usage of system resources, such as CPU and memory usage, and service response time; security event logs: collecting and analyzing security event logs, including alerts from intrusion detection systems (IDS), firewalls, and other security devices; user behavior analysis: monitoring user behavior and identifying abnormal login attempts, unauthorized access, etc.; system vulnerability information: understanding the known vulnerabilities and weaknesses of the system, and how they can be exploited.

[0076] In one implementation, historical security data is collected from sources such as internal logs, security reports, and public security incident databases, covering all historical security incidents related to the current network.

[0077] In one implementation, the defense proxy includes a perception proxy, a decoy proxy, a recovery proxy, and a sleep proxy. The perception proxy collects network situational information and identifies aggressive behaviors; the decoy proxy implements deceptive defense strategies by disguising itself as different services or processes; the recovery proxy kills malicious processes and restores the system to a good state; and the sleep proxy does not perform any operations.

[0078] In one implementation, a pre-defined game model ADEGM(N, D, β, S, U) is constructed, where N = (Na, Nd) is the player set in the network attack and defense game, Na is the attacker, and Nd is the defender; D = (A, D) represents the strategy set, A = {A1, A2, ..., Am} is the attacker's strategy set, and D = {D1, D2, ..., Dn} is the defender's strategy set; β = (p, q) is the strategy selection probability, p = (p1, p2, ..., pm) is the probability distribution of the attacker's strategy, and q = (q 1, q2, ..., qn) represent the probability distribution of the defender's strategy; S = (S1, S2, ..., St) represents the attacker's control state over the network; U = (UA, UD) represents the set of gain functions, including the gains (Asi, DSj) obtained by the attacker and defender through different strategy combinations; the attacker's control state over the network can include access privilege acquisition, data leakage, service interruption, command and control, malware implantation, internal network penetration, data tampering, network configuration changes, lateral movement, supply chain attacks, etc.

[0079] In one implementation, by acquiring global observation information of the current network, the attack stage and attack method set can be identified in real time, enabling the defense system to respond quickly to the attack and dynamically adjust the defense strategy according to the attack method set, thereby improving the adaptability of the defense.

[0080] In one implementation, when determining the set of defense agents and the set of defense strategies, historical security data is analyzed to fully utilize past experience to optimize current decisions. This not only improves the accuracy and effectiveness of defense strategies but also reduces the uncertainty brought about by new attacks.

[0081] In one implementation, decision-making is based on global observation information of the entire network, which can ensure the globality and coordination of the defense strategy. The optimal defense strategy of each defense agent is determined based on the security status of the entire network, thereby realizing the coordinated operation of the entire network defense system.

[0082] In one implementation, the optimal defense strategy is obtained by solving the equilibrium solution of the target game model, which can ensure the efficiency and targeting of the defense strategy. Each defense agent can defend according to its own optimal strategy, thereby minimizing resource waste and improving defense efficiency.

[0083] In one embodiment, identifying the attack phase and attack method set based on global observation information specifically includes:

[0084] Initial data is obtained by processing the data in the global observation information;

[0085] Initial feature sets are obtained by performing traffic analysis, behavior analysis, log analysis, protocol analysis, and content analysis on the initial data. The importance score of each initial feature is calculated by using the random forest algorithm. Initial features with importance scores greater than a preset score are extracted to obtain the target feature set.

[0086] The target feature set is substituted into the attack pattern database for matching, and the attack patterns with a similarity greater than a threshold are extracted to obtain the attack pattern set; the attack pattern database is used to store the feature sets corresponding to existing attack patterns.

[0087] The attack method set is obtained by performing association rule mining on all attack patterns in the attack pattern set;

[0088] The current stage of the attack is determined based on the attack pattern set and the attack lifecycle.

[0089] In one implementation, data processing involves cleaning the data, removing noise and irrelevant information, such as formatting errors and handling missing values.

[0090] In one implementation, the preset score and threshold are determined by technical personnel.

[0091] In one implementation, by performing traffic analysis, behavior analysis, log analysis, protocol analysis, and content analysis on the initial data, richer feature information can be obtained, thereby constructing an initial feature set, which helps to more accurately describe various aspects of network activity and thus improve the accuracy of attack identification.

[0092] In one implementation, by performing association rule mining on the attack patterns in the attack pattern set, it is possible to discover the set of attack methods hidden within them. This helps to gain a more comprehensive understanding of the attacker's intentions and attack paths, providing an important basis for formulating targeted defense strategies.

[0093] In one implementation, based on information about the attack pattern set and the attack lifecycle, it is possible to determine the current stage of the attack, thereby assessing the severity of the attack, predicting the attack's development trend, and formulating effective defense measures.

[0094] In one implementation, all attack patterns are mapped to the attack lifecycle, and the stage with the most mappings in the lifecycle is recorded as the attack stage. Alternatively, security information and event management (SIEM) systems, intrusion detection systems (IDS), and security analysis tools can be used to determine the attack stage.

[0095] In one embodiment, determining the defense agent set based on the attack phase and historical security data includes:

[0096] Obtain the frequency and success rate of various attacks within a preset historical security period;

[0097] Multiple attack combinations are generated based on the attack phase, the frequency of each type of attack, and the number of successful attacks for each type of attack.

[0098] The target combination set is obtained by filtering all attack combinations using support and confidence. The target combination set is then compared with a preset proxy set to identify all appearing proxies and obtain the defense proxy set. The preset proxy set stores the defense proxies corresponding to all attack combinations.

[0099] In one implementation, generating multiple attack combinations based on the attack stage, the frequency of various attacks, and the number of successful attacks involves: using statistical data to identify common attack patterns and combinations; selecting attack types with high frequency of occurrence for combination; using the Apriori algorithm to discover the association rules between attack types; analyzing the order of attack occurrence to identify common attack sequences; conducting a risk assessment on each generated attack combination to determine its potential threat level; and using simulation tools or a sandbox environment to test the attack combinations and observe their behavior in a real-world environment, ultimately obtaining multiple attack combinations.

[0100] In one implementation, by analyzing the frequency and number of successful attacks in historical data, the most common attack types and attack stages can be identified, which helps organizations develop more targeted defense strategies against these specific threats and improve defense efficiency.

[0101] In one implementation, by identifying which attack types pose the greatest threat to an organization, the organization can optimize the allocation of its security resources, thereby allocating more resources to defending against attack types that occur frequently and have a high success rate, thus improving overall security.

[0102] In one implementation, a minimum support threshold is set, and attack combinations with support higher than the threshold are retained, thereby removing unreasonable attack combinations. Then, for each attack combination, its confidence level is calculated and compared with a preset confidence threshold. Only combinations with confidence levels higher than the threshold are considered reliable and retained. Finally, the selected target combination set is compared with a preset proxy set to identify all proxies capable of dealing with these attack combinations, thus determining the defense proxy set. The preset proxy set is predefined and contains defense strategies or proxies corresponding to all possible attack combinations.

[0103] In one embodiment, the optimal defense strategy for each defense agent is obtained by solving the equilibrium solution of the target game model as follows:

[0104] For each defense agent, calculate the gain matrix between the attacker and the defender, and calculate the probability of different attack and different defense strategy selections at the current time point;

[0105] Among them, through the formula The probability of different attack strategies is obtained through the formula. The probability of obtaining different defense strategies. To select strategy a for the attacker at time t i The weight, To select strategy a for the attacker at time t-1 i The weights, where λ is the weight influence factor. To select strategy a for the attacker at time t-1 i The expected probability, Choose strategy d for the defender at time t. j The weight, To select strategy d for the attacker at time t-1 j The weight, To select strategy d for the attacker at time t-1 j The expected probability, To select strategy a for the attacker at time t i The probability, To choose strategy d for the defender at time tj The probability, where t is the current time;

[0106] Multiple strategy combinations are generated based on the probability of different attack and defense strategies, and the attack and defense benefits of different strategy combinations are calculated.

[0107] Based on the attack and defense benefits, attack and defense decision equations are constructed using an iterative reweighted least squares algorithm. The optimal defense strategy is obtained by calculating the evolutionary stable equilibrium of the attack and defense decision equations.

[0108] In one implementation method, the weighting influence factor can be determined by factor analysis, AHP (Analytic Hierarchy Process), Delphi method, CRITIC weighting method, etc., and the specific determination is made by technical personnel.

[0109] In one implementation, the attack decision equation is constructed using the formula Constructing the defense decision equation through formula Among them, f A (p i Choose strategy a for the attacker i The decision value, f B (q j Choose a strategy for the defender. j The decision value, λ is the weighted influence factor, p i To select strategy a i The probability, q j To select strategy d j The probability, Choose strategy a for the attacker i The expected benefits Choose strategy d for attackers j The expected return, p T Let q be the transpose of the attacker's probability under different strategies. T This represents the transpose of the defender's probabilities under different strategies. Choose strategy a for the attacker i The actual benefits brought about Choose a strategy for the defender. j The actual benefits it brings.

[0110] In one implementation, by calculating the gain matrix between the attacker and the defender and combining it with the probability of different strategy selections, it can be ensured that each defense agent adopts the optimal defense strategy for the current threat environment, thereby improving defense efficiency and reducing potential losses.

[0111] In one implementation, the solution process considers not only the attacker's behavior but also the defender's reaction, which helps to find a balance between attack and defense, preventing either side from gaining greater benefits by unilaterally changing their strategies.

[0112] In one embodiment, calculating the attack and defense gains from different strategy combinations includes:

[0113] Attack benefits are expressed by formula

[0114] Gain the benefits of the attack;

[0115] Defense benefits are expressed by formula

[0116] Gain defensive benefits;

[0117] Among them, U A For the benefit of the attack, U D For defensive benefits, m is the number of attack strategies, n is the number of defensive strategies, and a i For the i-th attack strategy, d j For the j-th defense strategy, p(a i ) Strategy a for attackers i The probability, q(d) j ) Strategies for the defender j The probability, r(a) i d j When the attacker adopts strategy a i And the defender adopts strategy q(d) j The attacker's gain at time C attack (a i To adopt attack strategy a i Cost, V asset For asset value, DefSuccess(a i d j ) for defender d j Successfully defended against a i The probability of attack, C defense (d j To adopt a defensive strategy j The cost.

[0118] In one implementation, asset value can be data value, system value, service value, operational value, etc., with the specific value determined by technical personnel. Data value includes personal identification information (PII), trade secrets, financial data, etc.; system value includes servers, databases, network equipment (routers, switches), security systems, etc.; service value includes e-commerce, customer relationship management (CRM), online banking, etc.; and operational value includes the daily operations and business processes supported by network assets.

[0119] In one implementation, by calculating the attack and defense gains of different strategy combinations, attackers and defenders can assess the effectiveness of their respective strategies and make more informed decisions.

[0120] Based on the same inventive concept, this invention also provides a defense strategy selection device based on network attack-defense game theory. See also Figure 2 , Figure 2 A schematic diagram of a defense strategy selection device based on network attack-defense game theory provided in an embodiment of the present invention includes:

[0121] The attack identification module is used to acquire global observation information of the current network and identify the attack stage and attack method set based on the global observation information;

[0122] The defense strategy generation module is used to determine the set of defense agents based on the attack phase and historical security data, and for the set of defense agents, determine the set of defense strategies corresponding to each defense agent based on the set of attack methods.

[0123] The attack strategy generation module is used to obtain an attack strategy set by searching for the corresponding historical security data for each attack method in the attack method set.

[0124] The optimal defense strategy generation module is used to substitute the attack strategy set and the defense strategy set into the preset game model to initialize and obtain the target game model, and solve the equilibrium solution of the target game model to obtain the optimal defense strategy corresponding to each defense agent.

[0125] The final defense strategy generation module is used to determine the final defense strategy based on the optimal defense strategy of each defense agent.

[0126] This invention provides a defense strategy selection device based on network attack and defense game theory. By observing global information, it can identify attack stages and attack methods in real time, thereby quickly responding to various attacks. Combining attack stages and historical security data, it dynamically determines the defense proxy set and the corresponding defense strategy set to adapt to constantly evolving attack patterns. It also utilizes historical security data to construct the attack strategy set, enhancing the ability to learn from past attack patterns and predict future attacks. By solving the equilibrium solution of the target game model, it can determine timely and effective defense in long-term confrontation, solving the problem that network defense systems cannot defend in a timely and effective manner when facing new or rapidly evolving attacks.

[0127] In one embodiment, the attack detection module includes:

[0128] The data processing module is used to process the data in the global observation information to obtain initial data;

[0129] The data analysis module is used to perform traffic analysis, behavior analysis, log analysis, protocol analysis, and content analysis on the initial data to obtain an initial feature set;

[0130] The target feature set determination module calculates the importance of each initial feature in the initial feature set using a random forest algorithm, and extracts the initial features with importance scores greater than a preset score to obtain the target feature set. The attack pattern set determination module substitutes the target feature set into an attack pattern database for matching, and extracts attack patterns with similarity scores greater than a threshold to obtain the attack pattern set. The attack pattern database stores the feature sets corresponding to existing attack patterns. The attack method set determination module performs association rule mining on all attack patterns in the attack pattern set to obtain the attack method set.

[0131] The attack phase determination module is used to determine the current stage of the attack based on the attack pattern set and the attack lifecycle.

[0132] In one embodiment, the defense strategy generation module includes:

[0133] The statistics module is used to obtain the frequency and success rate of various attacks within a preset period in historical security data;

[0134] The attack combination determination module is used to generate multiple attack combinations based on the attack stage, the frequency of occurrence of various types of attacks, and the number of successful attacks of various types of attacks.

[0135] The defense proxy set determination module is used to filter all attack combinations by support and confidence to obtain a target combination set. The target combination set is then compared with a preset proxy set to determine all appearing proxies and obtain the defense proxy set. The preset proxy set stores the defense proxies corresponding to all attack combinations.

[0136] In one embodiment, the optimal defense strategy generation module includes:

[0137] The strategy probability generation module is used to calculate the gain matrix between the attacker and the defender for each defense agent, and to calculate the probability of different attack and different defense strategy selections at the current time point.

[0138] Among them, through the formula The probability of different attack strategies is obtained through the formula. The probability of obtaining different defense strategies. To select strategy a for the attacker at time t i The weight, To select strategy a for the attacker at time t-1 i The weights, where λ is the weight influence factor. To select strategy a for the attacker at time t-1 i The expected probability, Choose strategy d for the defender at time t. j The weight, To select strategy d for the attacker at time t-1 j The weight, To select strategy d for the attacker at time t-1 j The expected probability, To select strategy a for the attacker at time t i The probability, To choose strategy d for the defender at time t j The probability, where t is the current time;

[0139] The revenue calculation module is used to generate multiple strategy combinations based on the probability of different attack and defense strategies, and to calculate the attack and defense revenues of different strategy combinations.

[0140] The decision equation construction module is used to construct attack decision equations and defense decision equations based on attack and defense gains using an iterative reweighted least squares algorithm.

[0141] The optimal defense strategy determination module is used to calculate the attack decision equation and the defense decision equation to achieve an evolutionary stable equilibrium and obtain the optimal defense strategy.

[0142] In one embodiment, the revenue calculation module includes:

[0143] The attack reward calculation module is used to calculate the attack reward using a formula.

[0144] Gain the benefits of the attack;

[0145] The defense benefit calculation module is used to calculate the benefits using formulas.

[0146] Gain defensive benefits;

[0147] Among them, U A For the benefit of the attack, U D For defensive benefits, m is the number of attack strategies, n is the number of defensive strategies, and a i For the i-th attack strategy, d j For the j-th defense strategy, p(a i ) Strategy a for attackers i The probability, q(d) j ) Strategies for the defender j The probability, r(a) i d j When the attacker adopts strategy a i And the defender adopts strategy q(d) j The attacker's gain at time C attack (a i To adopt attack strategy a i Cost, V asset For asset value, DefSuccess(a i d j ) for defender d j Successfully defended against a i The probability of attack, C defense (d j To adopt a defensive strategy j The cost.

[0148] The foregoing has provided a detailed description of one embodiment of the present invention, but this description is merely a preferred embodiment and should not be construed as limiting the scope of the invention. All equivalent variations and modifications made within the scope of the claims of this invention should still fall within the patent coverage of this invention.

Claims

1. A method for selecting a defense strategy based on network attack-defense game theory, characterized in that, The method includes: Obtain global observation information of the current network, and identify the attack stage and attack method set based on the global observation information; A set of defense proxies is determined based on the attack phase and historical security data. For the set of defense proxies, a set of defense strategies corresponding to each defense proxy is determined based on the set of attack methods. For the set of attack methods, the corresponding historical security data is searched for each attack method to obtain the set of attack strategies; The attack strategy set and the defense strategy set are substituted into a preset game model for initialization to obtain the target game model. The equilibrium solution of the target game model is solved to obtain the optimal defense strategy corresponding to each defense agent. The final defense strategy is determined based on the optimal defense strategy of each defense agent.

2. The method for selecting a defense strategy based on network attack-defense game theory according to claim 1, characterized in that, The specific aspects of identifying the attack phases and attack methods based on the global observation information include: The data in the global observation information is processed to obtain initial data; The initial feature set is obtained by performing traffic analysis, behavior analysis, log analysis, protocol analysis, and content analysis on the initial data. The importance score of each initial feature is obtained by calculating the importance of the initial features in the initial feature set using the random forest algorithm, and the initial features with importance scores greater than the preset scores are extracted to obtain the target feature set. The target feature set is substituted into the attack pattern database for matching, and the attack patterns with a similarity greater than a threshold are extracted to obtain the attack pattern set; the attack pattern database is used to store the feature sets corresponding to existing attack patterns. The attack method set is obtained by performing association rule mining on all attack patterns in the attack pattern set; The current stage of the attack is determined based on the attack pattern set and the attack lifecycle.

3. The method for selecting a defense strategy based on network attack-defense game theory according to claim 1, characterized in that, The defense proxy set, determined based on the attack phase and historical security data, includes: Obtain the frequency and number of successful attacks of various types within a preset period from the historical security data; Multiple attack combinations are generated based on the attack phase, the frequency of occurrence of various attacks, and the number of successful attacks of each type. All attack combinations are filtered using support and confidence to obtain a target combination set. This target combination set is then compared with a preset proxy set to identify all appearing proxies, thus obtaining a defense proxy set. The preset proxy set stores the defense proxies corresponding to all attack combinations.

4. The method for selecting a defense strategy based on network attack-defense game theory according to claim 1, characterized in that, Solving the equilibrium solution of the target game model to obtain the optimal defense strategy for each defense agent is specifically as follows: For each defense agent, calculate the gain matrix between the attacker and the defender, and calculate the probability of different attack and different defense strategy selections at the current time point; Among them, through the formula The probability of different attack strategies is obtained through the formula. The probability of obtaining different defense strategies. Choose a strategy for the attacker at time t The weight, To select a strategy for the attacker at time t-1 The weight, As the weighting factor, To select a strategy for the attacker at time t-1 The expected probability, Choose a strategy for the defender at time t. The weight, To select a strategy for the attacker at time t-1 The weight, To select a strategy for the attacker at time t-1 The expected probability, To select a strategy for the attacker at time t The probability, Choose a strategy for the defender at time t The probability, where t is the current time; Multiple strategy combinations are generated based on the probability of different attack and defense strategies, and the attack and defense benefits of different strategy combinations are calculated. Based on the attack benefits and the defense benefits, attack decision equations and defense decision equations are constructed using an iterative reweighted least squares algorithm. The optimal defense strategy is obtained by calculating the attack decision equation and the defense decision equation to achieve an evolutionary stable equilibrium.

5. The method for selecting a defense strategy based on network attack-defense game theory according to claim 4, characterized in that, Calculating the attack and defense gains from different strategy combinations includes: Attack benefits are expressed by formula Gain the benefits of the attack; Defense benefits are expressed by formula Gain defensive benefits; in, For the benefit of the attack, For defensive gains, m is the number of attack strategies, and n is the number of defensive strategies. For the i-th attack strategy, For the j-th defense strategy, Strategies for attackers The probability, Strategies for Defenders The probability, To what if the attacker takes a strategy And the defender adopts a strategy The gains obtained by the attacker at that time To adopt an attack strategy The cost, For asset value, For defensive strategies Successful defense The probability of an attack. To adopt a defensive strategy The cost.

6. A defense strategy selection device based on network attack-defense game theory, characterized in that, The device includes: The attack identification module is used to acquire global observation information of the current network and identify the attack stage and attack method set based on the global observation information. The defense strategy generation module is used to determine a set of defense proxies based on the attack phase and historical security data, and to determine a set of defense strategies for each defense proxy based on the set of attack methods. The attack strategy generation module is used to find the corresponding historical security data for each attack method to obtain the attack strategy set. The optimal defense strategy generation module is used to substitute the attack strategy set and the defense strategy set into a preset game model for initialization to obtain a target game model, and solve the equilibrium solution of the target game model to obtain the optimal defense strategy corresponding to each defense agent. The final defense strategy generation module is used to determine the final defense strategy based on the optimal defense strategy of each defense agent.

7. The defense strategy selection device based on network attack and defense game theory according to claim 6, characterized in that, The attack identification module includes: The data processing module is used to process the data in the global observation information to obtain initial data; The data analysis module is used to perform traffic analysis, behavior analysis, log analysis, protocol analysis, and content analysis on the initial data to obtain an initial feature set; The target feature set determination module is used to calculate the importance of each initial feature in the initial feature set using a random forest algorithm, and extract the initial features with an importance score greater than a preset score to obtain the target feature set. The attack pattern set determination module is used to substitute the target feature set into the attack pattern database for matching, and extract the attack patterns with a similarity greater than a threshold to obtain the attack pattern set; the attack pattern database is used to store the feature sets corresponding to existing attack patterns. The attack method set determination module is used to perform association rule mining on all attack patterns in the attack pattern set to obtain the attack method set. The attack phase determination module is used to determine the current attack phase based on the attack pattern set and the attack lifecycle.

8. A defense strategy selection device based on network attack-defense game theory according to claim 6, characterized in that, The defense strategy generation module includes: The statistics module is used to obtain the frequency and number of successful attacks of various types within a preset period in the historical security data; The attack combination determination module is used to generate multiple attack combinations based on the attack stage, the frequency of occurrence of various attacks, and the number of successful attacks of various attacks. The defense proxy set determination module is used to filter all attack combinations by support and confidence to obtain a target combination set, and then compare the target combination set with a preset proxy set to determine all appearing proxies to obtain the defense proxy set; the preset proxy set is a set of defense proxies that are stored for all attack combinations.

9. A defense strategy selection device based on network attack-defense game theory according to claim 6, characterized in that, The optimal defense strategy generation module includes: The strategy probability generation module is used to calculate the gain matrix between the attacker and the defender for each defense agent, and to calculate the probability of different attack and different defense strategy selections at the current time point. Among them, through the formula The probability of different attack strategies is obtained through the formula. The probability of obtaining different defense strategies. Choose a strategy for the attacker at time t The weight, To select a strategy for the attacker at time t-1 The weight, As the weighting factor, To select a strategy for the attacker at time t-1 The expected probability, Choose a strategy for the defender at time t. The weight, To select a strategy for the attacker at time t-1 The weight, To select a strategy for the attacker at time t-1 The expected probability, To select a strategy for the attacker at time t The probability, Choose a strategy for the defender at time t The probability, where t is the current time; The revenue calculation module is used to generate multiple strategy combinations based on the probability of different attack and defense strategies, and to calculate the attack and defense revenues of different strategy combinations. The decision equation construction module is used to construct attack decision equations and defense decision equations based on the attack benefits and the defense benefits using an iterative reweighted least squares algorithm. The optimal defense strategy determination module is used to calculate the optimal defense strategy by achieving an evolutionary stable equilibrium between the attack decision equation and the defense decision equation.

10. A defense strategy selection device based on network attack-defense game theory according to claim 9, characterized in that, The revenue calculation module includes: The attack reward calculation module is used to calculate the attack reward using a formula. Gain the benefits of the attack; The defense benefit calculation module is used to calculate the benefits using formulas. Gain defensive benefits; in, For the benefit of the attack, For defensive gains, m is the number of attack strategies, and n is the number of defensive strategies. For the i-th attack strategy, For the j-th defense strategy, Strategies for attackers The probability, Strategies for Defenders The probability, To what if the attacker takes a strategy And the defender adopts a strategy The gains obtained by the attacker at that time To adopt an attack strategy The cost, For asset value, For defensive strategies Successful defense The probability of an attack. To adopt a defensive strategy The cost.

Images