Network defense method, system and readable storage medium based on game model

Abstract

The present invention provides a network defense method, system and readable storage medium based on a game model. The method includes: pre-allocating the honeypot IP and honeypot CID of the honeypot in the current cycle according to the deployment result; constructing a game model, and obtaining the probability of the defender successfully defending the attacker according to the attack strategy and the defense strategy; obtaining the game costs of the defender and the attacker in the game model respectively, so as to construct a target utility function according to the probability set and the game cost; solving the target utility function to obtain the root node utility value according to the solution result, and using the defense strategy corresponding to the root node utility value as the defense strategy for the next cycle, so as to decide whether to execute the pre-allocation according to the defense strategy for the next cycle. The present application can improve the network defense effect, improve the defense utility and minimize the attacker's utility.

Description

Technical Field

[0001] The present invention relates to the field of network security protection technology, and in particular to a network defense method, system and readable storage medium based on a game model. Background Art

[0002] In the QUIC protocol, when the honeypot's IP address is mutated, defenders need to pre-allocate idle IP addresses to prevent address conflicts. Furthermore, the device's CID needs to be modified in the QUIC protocol to ensure that the honeypot's IP address is truly mutated.

[0003] However, the current existing honeypot IP address mutation cannot effectively confuse attackers. Honeypot IP address mutation can sometimes ensure that normal services are not interrupted, but it often has the disadvantage that honeypot IP address mutation cannot prevent attackers from interrupting the attack, resulting in poor defense effect and low utility for defenders and high utility for attackers. Summary of the Invention

[0004] The purpose of the present invention is to provide a network defense method, system and readable storage medium based on a game model, aiming to solve the problem that the defender's utility is low and the attacker's utility is high in traditional defense methods.

[0005] In a first aspect, the present invention provides a network defense method based on a game model, the method comprising:

[0006] Deploy a honeypot on the target network and pre-allocate the honeypot IP and honeypot CID of the honeypot in the current cycle according to the deployment result;

[0007] Constructing a game model involving a defender and at least one attacker, adding a honeypot to the defender, and defining an attack strategy set and a defense strategy set in the game model to obtain a probability set of the defender successfully defending against the attacker based on the attack strategy set and the defense strategy set;

[0008] Obtaining the game costs of the defender and the attacker in the game model respectively, so as to construct a target utility function according to the probability set and the game costs;

[0009] The target utility function is solved to obtain a root node utility value according to the solution result, and a defense strategy corresponding to the root node utility value is used as the defense strategy for the next cycle, so as to decide whether to perform the pre-allocation according to the defense strategy for the next cycle.

[0010] In summary, according to the aforementioned game-based network defense method, a dynamic game model is constructed to dynamically modify address mutations through optimization strategies to improve defense effectiveness and minimize attacker utility. Specifically, the honeypot's IP and CID are pre-assigned beforehand. A game model is then constructed to obtain the probability that the defender can successfully defend against the attacker, i.e., the probability that the honeypot can entrap the attacker, by using multiple attack and defense strategies under the game model. The game costs of the defender and attacker are then obtained, respectively, to establish a target utility function to be optimized. This target utility function is then solved to obtain the root node utility value, so that the attacker takes the action that minimizes the defender's utility as their strategy, and the defender takes the action that maximizes their utility as their strategy, thereby effectively improving defense effectiveness. Finally, the defense strategy for the next cycle is determined based on the root node, and the decision is made whether to execute the pre-assignment, i.e., change the honeypot IP and CID. This solves the problem of low defender utility and high attacker utility in existing defense methods.

[0011] Furthermore, the step of obtaining at least one piece of monitoring data and preprocessing the monitoring data to obtain at least one security threat indicator corresponding to each piece of monitoring data, wherein the preprocessing includes feature extraction and labeling processing, comprises:

[0012] The monitoring data includes intrusion detection system alerts, honeypot logs, network traffic reports, and system call logs;

[0013] Feature extraction is performed on the monitoring data to obtain at least one data feature, wherein the data feature includes text feature, classification feature, numerical feature, sequence feature, and interactive text feature.

[0014] Furthermore, the step of deploying a honeypot on the target network and pre-allocating the honeypot IP and honeypot CID of the honeypot in the current cycle according to the deployment result includes:

[0015] Constructing a preset honeypot information pool, and randomly selecting a pre-assigned honeypot IP and honeypot CID from the preset honeypot information pool every first preset time;

[0016] Determine whether the pre-assigned honeypot IP and honeypot CID are repeated with the honeypot IP and honeypot CID in the current period;

[0017] If the pre-assigned honeypot IP and honeypot CID are repeated with the honeypot IP and honeypot CID in the current cycle, a new honeypot IP and honeypot CID are selected from the preset honeypot information pool until the new honeypot IP and honeypot CID are completely non-repeated with the honeypot IP and honeypot CID in the current cycle.

[0018] Furthermore, the steps of constructing a game model involving a defender and at least one attacker, adding a honeypot to the defender, and defining an attack strategy set and a defense strategy set in the game model to obtain a probability set of the defender successfully defending against the attacker based on the attack strategy set and the defense strategy set include:

[0019] The defender's defense strategy set is defined according to the following formula:

[0020] X=(x1,...,x i ,...,x n )

[0021] Among them, X represents the defender's defense strategy set, x1, x i 、x n They represent the probability of pre-allocating the defender's honeypot in the 1st cycle, the i-th cycle, and the n-th cycle respectively;

[0022] The attacker's attack strategy set is defined according to the following formula:

[0023] Y k =(y k1 ,...,y ki ...,y kn )

[0024] Y k represents the attack strategy set of the kth attacker, y k1 , yk i , yk n They represent the probability that the k-th attacker attacks in the i-th period;

[0025] The probability that the defender successfully defends against the attacker is obtained according to the following formula:

[0026] w(x i ,y ki )=x i +(1-x i )·(1-y ki )

[0027] Among them, w(x i ,y ki ) represents the probability that the defender successfully defends against the kth attacker in the i-th cycle.

[0028] Furthermore, the step of obtaining the game costs of the defender and the attacker in the game model includes:

[0029] The defender's game cost is obtained according to the following formula:

[0030] C d =t·r·δ

[0031] Among them, C d represents the game cost of the defender, t represents the communication overhead of the defender's honeypot when performing pre-allocation, r represents the operation and maintenance cost of the defender's honeypot when performing a pre-allocation, and δ represents the cost correlation coefficient of the defender;

[0032] The attacker's gaming cost is obtained according to the following formula:

[0033]

[0034] in, represents the attacker’s gaming cost, p k represents the attack capability of the kth attacker, and γ represents the cost correlation coefficient of the attacker.

[0035] Furthermore, the step of constructing a target utility function according to the probability set and the game cost includes:

[0036] The target utility function is constructed according to the following formula:

[0037]

[0038] in, represents the utility value of the defender in the i-th period, R d (i,k) represents the profit of the defender’s honeypot when it successfully traps the kth attacker in the i-th cycle, R a (i,k) represents the benefit of the kth attacker successfully avoiding the defender's honeypot trap, N represents the number of attackers, It refers to the attack probability set of all attackers in the i-th time slice.

[0039] Furthermore, the attacker's profit function is constructed according to the following formula:

[0040]

[0041] The defender's payoff function is constructed according to the following formula:

[0042]

[0043] Among them, m i represents the number of attack records obtained by the defender in the honeypot during the i-th cycle, and φ represents the security requirement coefficient of the target network.

[0044] Furthermore, the step of solving the target utility function to obtain the root node utility value according to the solution result includes:

[0045] The utility values ​​of all cycles are taken as leaf nodes of the game tree, and the tree height is set to H;

[0046] If H is an odd number, the attacker makes the decision first; if the height of the game tree is an even number, the defender makes the decision first.

[0047] The root node represents the defender's maximum minimum benefit and performs reverse regression to obtain the utility value of the root node.

[0048] Furthermore, the step of using the defense strategy corresponding to the utility value of the root node as the defense strategy for the next cycle and deciding whether to perform the pre-allocation according to the defense strategy for the next cycle includes:

[0049] If the pre-allocation is performed, the honeypot information in the current cycle is updated according to the pre-allocated honeypot IP and honeypot CID, and the defense strategy set is updated according to the defense strategy of the next cycle;

[0050] If the pre-allocation is not performed, the honeypot information in the current cycle is defaulted to the honeypot information in the next cycle.

[0051] In a second aspect, the present invention provides a network defense system based on a game model, the system comprising:

[0052] A honeypot deployment module is used to deploy honeypots on the target network and pre-allocate the honeypot IP and honeypot CID of the honeypot in the current cycle according to the deployment result;

[0053] a model construction module, configured to construct a game model involving a defender and at least one attacker, add a honeypot to the defender, and define an attack strategy set and a defense strategy set in the game model, so as to obtain a probability set of the defender successfully defending against the attacker based on the attack strategy set and the defense strategy set;

[0054] an objective function construction module, configured to obtain the game costs of the defender and the attacker in the game model respectively, so as to construct an objective utility function according to the probability set and the game costs;

[0055] A pre-allocation execution module is used to solve the target utility function to obtain a root node utility value according to the solution result, and use the defense strategy corresponding to the root node utility value as the defense strategy for the next cycle, so as to decide whether to execute the pre-allocation according to the defense strategy for the next cycle.

[0056] In a third aspect, the present invention provides a readable storage medium, which stores one or more programs, and when the program is executed by a processor, it implements the above-mentioned network defense method based on the game model.

[0057] In a fourth aspect, the present invention provides a computer device, comprising a memory and a processor, wherein:

[0058] The memory is used to store computer programs;

[0059] When the processor is used to execute the computer program stored in the memory, the above-mentioned network defense method based on the game model is implemented.

[0060] In addition, compared with the prior art, the present invention has the following advantages:

[0061] 1. The present invention reduces the cost of deploying honeypots by realizing dynamic transformation of honeypot IP and CID, while improving the dynamic variability of honeypots, making it easier to confuse attackers. By taking advantage of the defect of IP mutation under the original QUIC, even if the honeypot address keeps changing, once the attacker contacts the honeypot and starts to invade, the invasion can be kept uninterrupted, so that the attacker will consume a lot of attack time when contacting a honeypot with frequently changing addresses.

[0062] 2. The technical solution of the present invention can make it difficult for attackers to exclude the honeypots they have contacted. When the attacker finds that the device they are invading is a honeypot, they start to invade the next one. However, the address of the honeypot will also mutate at the same time. Therefore, in the next invasion process, the attacker may attack the previous honeypot again, effectively increasing the stickiness of the honeypot, thereby increasing the attacker's invasion time. BRIEF DESCRIPTION OF THE DRAWINGS

[0063] Figure 1 This is a flow chart of a network defense method based on a game model proposed in one embodiment of the present invention;

[0064] Figure 2 A detailed diagram of step S101 proposed in one embodiment of the present invention;

[0065] Figure 3 A detailed diagram of step S103 proposed in one embodiment of the present invention;

[0066] Figure 4 A detailed diagram of step S104 proposed in one embodiment of the present invention;

[0067] Figure 5 This is a schematic diagram of the structure of a network defense system based on a game model proposed in one embodiment of the present invention.

[0068] The following specific embodiments will further illustrate the present invention in conjunction with the above-mentioned drawings. DETAILED DESCRIPTION

[0069] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention. Unless otherwise defined, the technical terms or scientific terms used herein should be the common meanings understood by people with ordinary skills in the field to which the invention belongs. The words "including" and similar words used in this article mean that the elements or objects appearing before the word cover the elements or objects listed after the word and their equivalents, without excluding other elements or objects.

[0070] In the embodiments of the present application, the technical term "IP address" refers to the IPv4 address in the TCP / IP protocol as the unique identifier of the device. From the attacker's point of view, the IP is also an important attack clue. In mobile target defense, defenders usually confuse attackers by modifying the IP and implement active defense. Traditional IP transformation blocks the attack process by modifying the system's IP, making it impossible for attackers to penetrate a specific device in a targeted manner. However, this solution may cause service interruptions when normal users access the service. To solve the problem of service interruption, the QUIC transport protocol can be used to ensure service continuity in the event of IP mutation. QUIC uses the feature of fast connection establishment. When the IP of the server changes, the client can automatically connect to the new IP address through CID. However, according to the characteristics of QUIC, ordinary users will not have their services interrupted, but attackers will not have their penetration interrupted due to IP changes.

[0071] In the embodiments of this application, the technical term "honeypot" is the same as IP mutation. Honeypot technology can also be used as an active defense method for mobile target defense. Honeypots attract attackers by deploying fake services. When attackers invade the honeypot, the honeypot usually returns some simulated fake services, increasing the attacker's invasion cost and time, while alerting security administrators to respond to emergencies. However, traditional honeypot solutions have some shortcomings. For example, when an attacker bypasses the honeypot and turns to the real system, the honeypot cannot play a defensive role. To solve this problem, the IP address of the honeypot can be mutated to mislead the attacker more comprehensively.

[0072] See also Figure 1 , which is a flowchart of a network defense method based on a game model provided by an embodiment of the present invention, includes steps S101 to S104, wherein:

[0073] Step S101: deploying a honeypot on a target network, and pre-allocating a honeypot IP and a honeypot CID of the honeypot in a current cycle according to a deployment result.

[0074] It should be noted that the target network refers to the network for which defense measures need to be constructed. A cycle can be understood as a time slice. During the honeypot deployment process, it is necessary to check the honeypot status. If the honeypot is not enabled, it is enabled to check the attack information obtained by the honeypot to determine whether the attacker has invaded in order to calculate the defender's benefits in the subsequent game model. If there is an attacker intrusion, the defender's benefits increase, and the honeypot is more likely to not transfer the address. If the attacker has not invaded, the honeypot is more likely to transfer the address.

[0075] Step S102: Construct a game model involving a defender and at least one attacker, add a honeypot to the defender, and define an attack strategy set and a defense strategy set in the game model to obtain a probability set of the defender successfully defending against the attacker based on the attack strategy set and the defense strategy set.

[0076] In the process of building a game model, we first need to build the current attack and defense problem into a Stackelberg game model: in, are participants, is the policy set, It is the strategic utility.

[0077] Furthermore, according to the aforementioned game model, the participants are defined as a single defender as a leader and at least one attacker as a follower. The defender first specifies the optimal strategy, then the attackers select the optimal strategy based on the defender's strategy, and the defender then selects the optimal strategy again, and this cycle continues.

[0078] In addition, the attack strategy set and defense strategy set in the game model are redefined to obtain the probability set of the defender defeating the attacker in each time slice (cycle).

[0079] Step S103: Obtain the game costs of the defender and the attacker in the game model respectively, so as to construct a target utility function according to the probability set and the game costs.

[0080] It should be noted that for defenders, mutations in the honeypot IP address will lead to increased communication transmission costs and operation and maintenance costs; for attackers, the attacker's expenses mainly come from their attack capabilities, that is, the means of attack and the ability to identify honeypots. Based on this, by obtaining the game costs involved in the game between the attacker and the defender, the target utility function to be optimized is constructed based on the game cost and probability set, so as to achieve high utility for the defender and low utility for the attacker by optimizing the target utility function.

[0081] Step S104: Solve the target utility function to obtain a root node utility value according to the solution result, and use the defense strategy corresponding to the root node utility value as the defense strategy for the next cycle, so as to decide whether to perform the pre-allocation according to the defense strategy for the next cycle.

[0082] In this step, the solution algorithm adopted is the Minimax algorithm. The Minimax algorithm is applied to the game model. By constructing a game tree, the maximum minimum benefit of the game participants is obtained in sequence. Specifically, MinimaxU is used to maximize the minimum utility value of the utility. MinimaxU mainly substitutes the defender or attacker from the leaf node in turn and makes decisions alternately and gradually upwards, and finally obtains the method of maximizing the minimum utility of the game participants at the root node. In order to obtain the best strategy of the defender, it is necessary to go up in sequence and finally make the root node obtain the defender's maximum minimum benefit, and thereby obtain the optimal strategy, that is, the defense strategy corresponding to the root node utility value, and use this optimal strategy as the defense strategy for the next cycle. In this way, based on the optimal strategy, a decision is made whether to execute the pre-allocated action, thereby improving the defense effect while taking into account the defender's utility.

[0083] In some optional embodiments, see Figure 2 , step S101 further includes:

[0084] Step S1011: constructing a preset honeypot information pool, and randomly selecting a pre-assigned honeypot IP and honeypot CID from the preset honeypot information pool every first preset time.

[0085] Step S1012: Determine whether the pre-allocated honeypot IP and honeypot CID are repeated with the honeypot IP and honeypot CID in the current cycle.

[0086] Step S1013: If the pre-assigned honeypot IP and honeypot CID are repeated with the honeypot IP and honeypot CID in the current cycle, a new honeypot IP and honeypot CID are selected from the preset honeypot information pool until the new honeypot IP and honeypot CID are completely non-repeated with the honeypot IP and honeypot CID in the current cycle.

[0087] It should be noted that the first preset time is the length of a cycle or a time slice, that is, the pre-allocation action in the embodiment of the present invention is updated once every fixed time. Even in subsequent decisions, if pre-allocation is not performed, this technical solution will still update the honeypot IP and honeypot CID that have not performed the pre-allocation action. In this way, by dynamically changing the honeypot IP, it is beneficial to further improve the defense effect.

[0088] In addition, the preset honeypot information pool contains a large number of designed honeypot IPs and honeypot CIDs. In the actual network protection process, it is only necessary to regularly extract random information from the preset honeypot information pool, so that attackers cannot grasp the rules of honeypot address changes.

[0089] For example, the honeypot IPs in the preset honeypot information pool may be 192.168.1.1 to 192.168.1.254, and the first preset time may be set to 3-20 seconds, for example, a time slice of 10 seconds.

[0090] In some embodiments, when defining a strategy set, a mixed strategy is adopted, and the strategies of the attacker and defender exist in the form of probabilities. Specifically, the defender's defense strategy set is defined according to the following formula:

[0091] X=(x1,…,x i ,…,x n )

[0092] Among them, X represents the defender's defense strategy set, x1, x i 、x n They represent the probability of pre-allocating the defender's honeypot in the 1st cycle, the i-th cycle, and the n-th cycle respectively;

[0093] The attacker's attack strategy set is defined according to the following formula:

[0094] Y k =(y k1 ,…,y ki …,y kn )

[0095] Y k represents the attack strategy set of the kth attacker, y k1 、y ki 、y kn They represent the probability that the k-th attacker attacks in the i-th period;

[0096] In this game model, when an attacker invades the honeypot, the attacker is considered to have failed. The probability that the defender successfully defends against the attacker is obtained according to the following formula:

[0097] w(x i ,y ki )=x i +(1-x i )·(1-y ki )

[0098] Among them, w(x i ,yk i ) represents the probability that the defender successfully defends against the kth attacker in the i-th cycle.

[0099] In some optional embodiments, the defender uses a honeypot to capture the attacker. If the attacker is lured into the defender's honeypot, it can be considered that the defender has successfully prevented the attack, thereby protecting the security of the system. The defender's profit mainly comes from whether the attacker is successfully lured into the honeypot. For the attacker, the attacker needs to skip the honeypot and invade the real system. The attacker's profit is mainly to successfully avoid the defender's honeypot trap. Based on this, please refer to Figure 3 , step S103 further includes:

[0100] Step S1031: Construct the profit function of both parties in the game.

[0101] Step S1032: Constructing a cost function for both parties in the game.

[0102] Step S1033: Construct a target utility function.

[0103] Specifically, the attacker's profit function is constructed according to the following formula:

[0104]

[0105] The defender's payoff function is constructed according to the following formula:

[0106]

[0107] Among them, m i represents the number of attack records obtained by the defender in the honeypot during the i-th cycle, and φ represents the security requirement coefficient of the target network.

[0108] By using the natural logarithm function to construct the profit function of both the attacker and the defender, the decision-making misleading caused by the attacker's large-scale attacks can be reduced.

[0109] In addition, for defenders, IP mutation will lead to an increase in communication transmission costs and operation and maintenance costs, so the defender's game cost is obtained according to the following formula:

[0110] C d =t·r·δ

[0111] Among them, C d represents the game cost of the defender, t represents the communication overhead of the defender's honeypot when performing pre-allocation, r represents the operation and maintenance cost of the defender's honeypot when performing a pre-allocation, and δ represents the cost correlation coefficient of the defender.

[0112] For an attacker, the attacker's cost mainly comes from their attack capabilities, that is, the attack methods and the ability to identify honeypots. Therefore, the attacker's game cost is obtained according to the following formula:

[0113]

[0114] in, represents the attacker’s gaming cost, p k represents the attack capability of the kth attacker, and γ represents the cost correlation coefficient of the attacker.

[0115] In addition, considering that the game scenario is an offensive and defensive confrontation between the two parties, the design uses a zero-sum game to formulate the utility functions of both parties. Specifically, the target utility function is constructed according to the following formula:

[0116]

[0117] in, represents the utility value of the defender in the i-th period, R d (i,k) represents the profit of the defender’s honeypot when it successfully traps the kth attacker in the i-th cycle, R a (i,k) represents the payoff of the kth attacker who successfully avoids the defender's honeypot trap, and N represents the number of attackers.

[0118] In some optional embodiments, see Figure 4 , step S104 further includes:

[0119] Step S1041: The utility values ​​of all cycles are taken as leaf nodes of the game tree, and the tree height is set to H.

[0120] Step S1042: If H is an odd number, the attacker makes the decision first; if the height of the game tree is an even number, the defender makes the decision first.

[0121] Step S1043: Perform reverse regression to solve the problem of maximizing the minimum benefit of the defender with the root node as the representative, and obtain the utility value of the root node.

[0122] Step S1044: if the pre-allocation is performed, the honeypot information in the current cycle is updated according to the pre-allocated honeypot IP and honeypot CID, and the defense strategy set is updated according to the defense strategy of the next cycle;

[0123] Step S1045: If the pre-allocation is not performed, the honeypot information in the current cycle is used as the honeypot information in the next cycle by default.

[0124] Specifically, the collected defense utilities of n time slices are first used as leaf nodes of the game tree. The optimization goal is to maximize the minimum benefit of the root node representing the defender. Therefore, when the height of the game tree is an odd number, the attacker makes the decision first; when the height of the game tree is an even number, the defender makes the decision first.

[0125] Furthermore, assuming the game tree height is H, and H is an odd number, the attacker makes the first decision. Since the attacker is a rational decision-maker, they must choose the outcome that minimizes the defender's utility. Therefore, the value of the node at height H-1 is the smaller of the branch nodes at height H. Next, the defender makes the decision at height H-2. Since the defender is rational, they will choose the outcome that maximizes their utility. Therefore, the value of the node at height H-2 is the larger of the branch nodes at height H-1. The defender then makes his turn, and this process works backwards until we reach the root node. The root node's value is the utility value that maximizes the defender's own minimum utility. If H is an even number, the same principle applies, resulting in the utility value of the root node maximizing the defender's own minimum utility.

[0126] The corresponding strategy of the root node utility obtained by regression is used as the defender's strategy in the n+1 time slice (next cycle), that is, x n+1 , in order to dynamically update the Minimax U algorithm strategy, the latest n defender strategies are used as the new defender strategy set, that is, Update the defender's strategy with this kind of push.

[0127] In summary, according to the aforementioned game-based network defense method, a dynamic game model is constructed to dynamically modify address mutations through optimization strategies to improve defense effectiveness and minimize attacker utility. Specifically, the honeypot's IP and CID are pre-assigned beforehand. A game model is then constructed to obtain the probability that the defender can successfully defend against the attacker, i.e., the probability that the honeypot can entrap the attacker, by using multiple attack and defense strategies under the game model. The game costs of the defender and attacker are then obtained, respectively, to establish a target utility function to be optimized. This target utility function is then solved to obtain the root node utility value, so that the attacker takes the action that minimizes the defender's utility as their strategy, and the defender takes the action that maximizes their utility as their strategy, thereby effectively improving defense effectiveness. Finally, the defense strategy for the next cycle is determined based on the root node, and the decision is made whether to execute the pre-assignment, i.e., change the honeypot IP and CID. This solves the problem of low defender utility and high attacker utility in existing defense methods.

[0128] See also Figure 5 , which is a schematic diagram of the structure of a network defense system based on a game model in one embodiment of the present invention, the system includes:

[0129] The honeypot deployment module 10 is used to deploy honeypots on the target network and pre-allocate the honeypot IP and honeypot CID of the honeypot in the current cycle according to the deployment result;

[0130] A model building module 20 is configured to build a game model involving a defender and at least one attacker, add a honeypot to the defender, and define an attack strategy set and a defense strategy set in the game model to obtain a probability set of the defender successfully defending against the attacker based on the attack strategy set and the defense strategy set;

[0131] An objective function construction module 30 is configured to obtain the game costs of the defender and the attacker in the game model, respectively, so as to construct an objective utility function according to the probability set and the game costs;

[0132] The pre-allocation execution module 40 is used to solve the target utility function to obtain the root node utility value according to the solution result, and use the defense strategy corresponding to the root node utility value as the defense strategy for the next cycle to decide whether to execute the pre-allocation according to the defense strategy for the next cycle.

[0133] On the other hand, the present invention further provides a readable storage medium having one or more programs stored thereon, which, when executed by a processor, implement the above-mentioned network defense method based on the game model.

[0134] On the other hand, the present invention also proposes a computer device, including a memory and a processor, wherein the memory is used to store computer programs, and the processor is used to execute the computer programs stored in the memory to implement the above-mentioned network defense method based on the game model.

[0135] Those skilled in the art will appreciate that the logic and / or steps represented in the flowcharts or otherwise described herein, for example, can be considered as a sequenced list of executable instructions for implementing the logical functions, and can be embodied in any computer-readable medium for use by an instruction execution system, apparatus, or device (e.g., a computer-based system, a system including a processor, or other system that can fetch and execute instructions from an instruction execution system, apparatus, or device), or in conjunction with such instruction execution system, apparatus, or device. For purposes of this specification, "computer-readable medium" can be any device that can contain, store, communicate, propagate, or transmit a program for use by an instruction execution system, apparatus, or device, or in conjunction with such instruction execution system, apparatus, or device.

[0136] More specific examples (a non-exhaustive list) of computer-readable media include the following: an electrical connection with one or more wires (electronic devices), a portable computer disk cartridge (magnetic devices), a random access memory (RAM), a read-only memory (ROM), an erasable and programmable read-only memory (EPROM or flash memory), a fiber optic device, and a portable compact disc read-only memory (CDROM). In addition, the computer-readable medium may even be paper or other suitable medium on which the program is printed, since the program may be obtained electronically, for example, by optically scanning the paper or other medium, followed by editing, deciphering, or processing in another suitable manner as necessary, and then stored in a computer memory.

[0137] It should be understood that various parts of the present invention can be implemented using hardware, software, firmware, or a combination thereof. In the above-described embodiments, multiple steps or methods can be implemented using software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented using hardware, as in another embodiment, any one of the following technologies known in the art or a combination thereof can be used to implement the hardware: a discrete logic circuit having a logic gate circuit for implementing a logic function on a data signal, an application-specific integrated circuit having a suitable combination of logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc.

[0138] While the embodiments of the present invention have been described in detail above, it will be apparent to those skilled in the art that various modifications and variations of these embodiments are possible. However, it should be understood that such modifications and variations are within the scope and spirit of the present invention as set forth in the claims. Furthermore, the invention described herein is susceptible to other embodiments and may be practiced or implemented in a variety of ways.

Claims

1. A network defense method based on a game model, characterized in that: The method comprises: Deploy a honeypot on the target network and pre-allocate the honeypot IP and honeypot CID of the honeypot in the current cycle according to the deployment result; Constructing a game model involving a defender and at least one attacker, adding a honeypot to the defender, and defining an attack strategy set and a defense strategy set in the game model to obtain a probability set of the defender successfully defending against the attacker based on the attack strategy set and the defense strategy set; Obtaining the game costs of the defender and the attacker in the game model respectively, so as to construct a target utility function according to the probability set and the game costs; The target utility function is solved to obtain a root node utility value according to the solution result, and a defense strategy corresponding to the root node utility value is used as the defense strategy for the next cycle, so as to decide whether to perform the pre-allocation according to the defense strategy for the next cycle.

2. The network defense method based on the game model according to claim 1, characterized in that: The step of deploying a honeypot on the target network and pre-allocating the honeypot IP and honeypot CID of the honeypot in the current cycle according to the deployment result includes: Constructing a preset honeypot information pool, and randomly selecting a pre-assigned honeypot IP and honeypot CID from the preset honeypot information pool every first preset time; Determine whether the pre-assigned honeypot IP and honeypot CID are repeated with the honeypot IP and honeypot CID in the current period; If the pre-assigned honeypot IP and honeypot CID are repeated with the honeypot IP and honeypot CID in the current cycle, a new honeypot IP and honeypot CID are selected from the preset honeypot information pool until the new honeypot IP and honeypot CID are completely non-repeated with the honeypot IP and honeypot CID in the current cycle.

3. The network defense method based on the game model according to claim 2, characterized in that: The steps of constructing a game model involving a defender and at least one attacker, adding a honeypot to the defender, and defining an attack strategy set and a defense strategy set in the game model to obtain a probability set of the defender successfully defending against the attacker based on the attack strategy set and the defense strategy set include: The defender's defense strategy set is defined according to the following formula: X=(x1,…,x i ,…,x n ) Among them, X represents the defender's defense strategy set, x1, x i 、x n They represent the probability of pre-allocating the defender's honeypot in the 1st cycle, the i-th cycle, and the n-th cycle respectively; The attacker's attack strategy set is defined according to the following formula: AND k =(and k1 ,…,and ki ,…,and kn ) Y k represents the attack strategy set of the kth attacker, y k1 、y ki 、y kn They represent the probability that the k-th attacker attacks in the i-th period; The probability that the defender successfully defends against the attacker is obtained according to the following formula: w(x i ,y ki )=x i +(1-x i )·(1-y ki ) Among them, w(x i ,y ki ) represents the probability that the defender successfully defends against the kth attacker in the i-th cycle.

4. The network defense method based on the game model according to claim 3 is characterized in that: The step of obtaining the game costs of the defender and the attacker in the game model includes: The defender's game cost is obtained according to the following formula: C d =t·r·δ Among them, C d represents the game cost of the defender, t represents the communication overhead of the defender's honeypot when performing pre-allocation, r represents the operation and maintenance cost of the defender's honeypot when performing a pre-allocation, and δ represents the cost correlation coefficient of the defender; The attacker's gaming cost is obtained according to the following formula: in, represents the attacker’s gaming cost, p k represents the attack capability of the kth attacker, and γ represents the cost correlation coefficient of the attacker.

5. The network defense method based on the game model according to claim 4 is characterized in that: The step of constructing a target utility function according to the probability set and the game cost comprises: The target utility function is constructed according to the following formula: in, represents the utility value of the defender in the i-th period, R d (i,k) represents the profit of the defender’s honeypot when it successfully traps the kth attacker in the i-th cycle, R a (i,k) represents the payoff of the kth attacker who successfully avoids the defender's honeypot trap, and N represents the number of attackers.

6. The network defense method based on the game model according to claim 5, characterized in that: The attacker's profit function is constructed according to the following formula: The defender's payoff function is constructed according to the following formula: Among them, m i represents the number of attack records obtained by the defender in the honeypot during the i-th cycle, and Φ represents the security requirement coefficient of the target network.

7. The network defense method based on the game model according to claim 5, characterized in that: The step of solving the target utility function to obtain the root node utility value according to the solution result includes: The utility values ​​of all cycles are taken as leaf nodes of the game tree, and the tree height is set to H; If H is an odd number, the attacker makes the decision first; if the height of the game tree is an even number, the defender makes the decision first. The root node represents the defender's maximum minimum benefit and performs reverse regression to obtain the utility value of the root node.

8. The network defense method based on the game model according to claim 7, characterized in that: The step of using the defense strategy corresponding to the utility value of the root node as the defense strategy for the next cycle and deciding whether to perform the pre-allocation according to the defense strategy for the next cycle includes: If the pre-allocation is performed, the honeypot information in the current cycle is updated according to the pre-allocated honeypot IP and honeypot CID, and the defense strategy set is updated according to the defense strategy of the next cycle; If the pre-allocation is not performed, the honeypot information in the current cycle is defaulted to the honeypot information in the next cycle.

9. A network defense system based on a game model, characterized in that: The system comprises: A honeypot deployment module is used to deploy honeypots on the target network and pre-allocate the honeypot IP and honeypot CID of the honeypot in the current cycle according to the deployment result; a model construction module, configured to construct a game model involving a defender and at least one attacker, add a honeypot to the defender, and define an attack strategy set and a defense strategy set in the game model, so as to obtain a probability set of the defender successfully defending against the attacker based on the attack strategy set and the defense strategy set; an objective function construction module, configured to obtain the game costs of the defender and the attacker in the game model respectively, so as to construct an objective utility function according to the probability set and the game costs; A pre-allocation execution module is used to solve the target utility function to obtain a root node utility value according to the solution result, and use the defense strategy corresponding to the root node utility value as the defense strategy for the next cycle, so as to decide whether to execute the pre-allocation according to the defense strategy for the next cycle.

10. A readable storage medium, characterized in that: The readable storage medium stores one or more programs, which, when executed by a processor, implement the network defense method based on a game model according to any one of claims 1 to 8.

Images