A simulation method and system for network attack and defense in asymmetric game situations

Abstract

This application provides a simulation method and system for network attack and defense in an asymmetric game scenario. The method includes: generating relevant attack and defense parameters based on the attack and defense requirements of the simulated network attack and defense; generating a corresponding attack and defense scenario based on the relevant parameters; and controlling the attacking and defending agents in the attack and defense scenario through preset functional functions to perform attack and defense simulation. By capturing and simulating the interaction between attackers and defenders, network defense strategies in game-based confrontation scenarios can be optimized, applying theoretical knowledge to real-world scenarios and providing dynamic feedback for system performance optimization.

Description

Technical Field

[0001] The present application relates to the field of machine learning, and in particular to a simulation method and system for network attack and defense in an asymmetric game situation. Background Art

[0002] Cybersecurity is a new frontier for national security and a fundamental guarantee for the normal development and operation of the information society. With the rapid development of network information technology and the increasing complexity of the network environment, cybersecurity has become a key issue facing the global information society. In the process of protecting information network systems, studying the patterns and strategies of attack and defense behavior is crucial for improving network security and enabling decision-makers to respond to targeted threats in a timely manner. One effective approach is to use a network attack and defense game model to simulate the attack and defense game processes in real-world cybersecurity issues.

[0003] Game theory, the study of interactions between two or more individuals, has been widely applied to the analysis of competition, cooperation, and other behaviors in various fields since its introduction in the 1930s. In the study of cyber attack and defense games, simulating the interactions between attackers and defenders and studying their strategic choices and the motivations behind their actions can help understand and predict their behavior and optimize cyber defense measures. Partially observable random games, a game theory approach that does not restrict the order of interactions between agents or their observation capabilities, can effectively reflect the asymmetries in action types, observation capabilities, and spatiotemporal constraints between attackers and defenders during cyber attack and defense.

[0004] Compared to traditional cyber attack and defense game description tools that tend to focus on static utility analysis and lack a practical, operational, and dynamic simulation environment, the cyber attack and defense game platform based on partially observable random games is dedicated to combining game theory with dynamic models as an experimental platform to address the complexity, randomness, and uncertainty in the attack and defense decision-making process. It enables more targeted design of attack and defense game mechanisms and modeling elements, reflects the dynamic and complex interactive characteristics of cyber attack and defense, and fully simulates the real-time dynamic state of cyber attack and defense interactions. This is of great help in improving the empirical research of theory and the intuitiveness of practice.

[0005] By capturing and simulating the interaction between attackers and defenders, we can optimize network defense strategies in game confrontation scenarios, apply theoretical knowledge to real-world scenarios, and provide dynamic feedback for system performance optimization. Summary of the Invention

[0006] The main purpose of the embodiments of the present invention is to provide a simulation method and simulation system for network attack and defense in an asymmetric game situation. By capturing and simulating the interaction between attackers and defenders, it is possible to optimize network defense strategies in game confrontation scenarios, apply theoretical knowledge to real-world scenarios, and provide dynamic feedback for system performance optimization.

[0007] In a first aspect, a simulation method for network attack and defense in an asymmetric game is provided, the simulation method comprising:

[0008] Generate relevant parameters for attack and defense based on the attack and defense requirements of the network to be simulated. The relevant parameters include the lag time of defense decision, the step size of the attack and defense agent action, the size of the network, and other parameters to build an asymmetric network attack and defense game scenario;

[0009] Generate a corresponding attack and defense scenario according to the relevant parameters;

[0010] In the attack and defense scenario, the attacking agent and the defending agent are controlled by a preset function to perform attack and defense simulation.

[0011] In a possible implementation, the relevant parameters include: game mechanism, network environment model parameters, and system configuration file.

[0012] In another possible implementation, the functional functions include: a begin function, a proceed function, and a success function.

[0013] In another possible implementation, the action types of the intelligent agent include: remote account login action, remote vulnerability attack action, system local privilege escalation action, trace cleaning action, and host search action.

[0014] In a second aspect, a simulation system for network attack and defense in an asymmetric game is provided, the simulation system comprising:

[0015] A related parameter generation module is used to generate related parameters for attack and defense according to the attack and defense requirements of the network attack and defense to be simulated. The related parameters include the lag time of defense decision, the step size of the attack and defense agent action, the size of the network, and other parameters to build an asymmetric network attack and defense game scenario;

[0016] An attack and defense scenario generation module, configured to generate a corresponding attack and defense scenario according to the relevant parameters;

[0017] The attack and defense simulation module is used to control the attacking intelligent agent and the defending intelligent agent to perform attack and defense simulation in the attack and defense scenario through preset functional functions.

[0018] In a possible implementation, the relevant parameters include: game mechanism, network environment model parameters, and system configuration file.

[0019] In another possible implementation, the functional functions include: a begin function, a proceed function, and a success function.

[0020] In another possible implementation, the action types of the intelligent agent include: remote account login action, remote vulnerability attack action, system local privilege escalation action, trace cleaning action, and host search action.

[0021] In a third aspect, an electronic device is provided, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the program, a simulation method for network attack and defense in an asymmetric game situation as provided in the first aspect is implemented.

[0022] In a fourth aspect, a non-transitory computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the simulation method of network attack and defense in an asymmetric game situation as provided in the first aspect is implemented. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the following briefly introduces the drawings required for describing the embodiments of the present application.

[0024] Figure 1 A flowchart of a method for simulating network attack and defense in an asymmetric game situation provided by the first embodiment of the present invention;

[0025] Figure 2 A structural diagram of a simulation system for network attack and defense in an asymmetric game scenario provided by a second embodiment of the present invention;

[0026] Figure 3 This is a schematic diagram of the physical structure of an electronic device provided by the present invention.

[0027] Specific implementation method

[0028] The following will be combined with the accompanying drawings in the embodiments of the present disclosure to clearly and completely describe the technical solutions in the embodiments of the present disclosure. Obviously, the embodiments described are only part of the embodiments of the present disclosure, not all of them. Based on the embodiments of the present disclosure, all other embodiments obtained by those skilled in the art without making any creative efforts shall fall within the scope of protection of the present disclosure.

[0029] The embodiments of the present disclosure provide a simulation method and a simulation system for network attack and defense under asymmetric game conditions. Specifically, a simulation method for network attack and defense under asymmetric game conditions according to an embodiment of the present disclosure can be executed by a computer device, wherein the computer device can be a terminal or a server. The terminal can be a terminal device such as a smart phone, a tablet computer, a laptop computer, a touch screen, a game console, a personal computer (PC, Personal Computer), a personal digital assistant (Personal Digital Assistant, PDA), etc. The terminal can also include a client, which can be an application client, a browser client with an application program, or an instant messaging client, etc. The server can be an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, CDN, and big data and artificial intelligence platforms.

[0030] For example, when the simulation method for network attack and defense in the asymmetric game situation is run on a terminal, the terminal device stores an application and is used to present the operation interface or application page provided by the application. The terminal device is used to interact with the user through a graphical user interface, a merchant page, or an associated page in other applications, for example, by downloading, installing, and running the application through the terminal device. The terminal device may provide the graphical user interface, the merchant page, or an associated page in other applications to the user in a variety of ways, for example, it may be rendered and displayed on the display screen of the terminal device, or the graphical user interface may be presented through holographic projection. For example, the terminal device may include a touch screen and a processor, the touch screen being used to present the graphical user interface and receive operation instructions generated by the user acting on the graphical user interface, the processor being used to run the application, generate the graphical user interface, respond to the operation instructions, and control the display of the graphical user interface on the touch screen.

[0031] The embodiments of the present disclosure provide a simulation method and system for network attack and defense in an asymmetric game situation, and the simulation method can be executed by a terminal or a server. The embodiments of the present disclosure are described by taking an example of a simulation method for network attack and defense in an asymmetric game situation executed by a terminal. The terminal may include a touch screen and a processor (of course, the terminal may also use peripherals such as a mouse and keyboard as input devices, and the touch screen is only used as an example for description here). The touch screen is used to present a graphical user interface and receive operation instructions generated by the user acting on the graphical user interface. When the user operates the graphical user interface through the touch screen, the graphical user interface can control the local content of the terminal by responding to the received operation instructions, and can also control the content of the opposite server by responding to the received operation instructions. For example, the operation instruction generated by the user acting on the graphical user interface includes an instruction for starting an application, and the processor is configured to start the application after receiving the instruction to start the application provided by the user. In addition, the processor is configured to render and draw the graphical user interface associated with the application on the touch screen. The touch screen is a multi-touch sensitive screen that can sense touch or sliding operations performed simultaneously on multiple points on the screen. The user performs a touch operation on the graphical user interface using a finger. When the graphical user interface detects the touch operation, it controls the graphical user interface to perform and display an action corresponding to the touch operation.

[0032] like Figure 1 FIG2 is a flow chart of a method for simulating network attack and defense in an asymmetric game according to an embodiment of the present invention. The method includes:

[0033] Step 101, generating relevant parameters for attack and defense according to the attack and defense requirements of the network attack and defense to be simulated;

[0034] Step 102: Generate a corresponding attack and defense scenario based on the relevant parameters;

[0035] Step 103: In the attack and defense scenario, the attacking agent and the defending agent are controlled by a preset function to perform attack and defense simulation.

[0036] In step 101, by separating parameters from the model, scenario parameters related to the attack and defense simulation can be generated more flexibly. These parameters include, but are not limited to, the game mechanism, network environment model parameters, and system configuration files. The system configuration file is used to control the entire attack and defense simulation, including the number of simulation training rounds, number of simulation training steps, number of simulation test rounds, number of simulation test steps, agent actions, and strategy-related hyperparameters. These parameters, acting as global variables, directly influence the parameter configuration of each sub-simulation, making it easier to control the simulation process.

[0037] In step 102, after receiving the generated relevant parameters, the relevant parameters are loaded into a preset model to generate a corresponding attack and defense scenario.

[0038] In step 103, the functions used to control the attacking agent and the defending agent include: begin, proceed, and success. These functions operate as follows: the begin function determines whether the agent's pending steps meet the preconditions in its current state. If so, the pending steps are passed to the proceed function. The proceed function determines the reliability of the pending actions and the likelihood of them being recorded. The success function is used to update the state of the attack and defense scenario. This control method effectively improves the limitation of the original OpenAI gym platform, which does not support multi-timestep actions, and further reflects the actual observation delay in network intrusion defense problems.

[0039] This application also uses a judgment function to judge the return results of the agent's actions. Combining the judgment function, the reliability of the attack action of the attacking agent and the defense detection rate of the defending agent can obtain the state transition of the attack and defense scenario, the execution results of the agent's actions and the observable results.

[0040] Among them, the action types of the agent include:

[0041] lateralAndScan(X,Y,A): A remote account login action. This action initiates a remote account login from source host X to target host Y, using credential A. If exploitation is successful, the attacker gains access to account A on host Y and can then scan for hosts connected to it, identifying vulnerabilities within those hosts. Upon initiating this action, regardless of success, the attack counts for nodes X and Y are incremented by one. If this action succeeds, the attacker agent can see subsequent hosts it can connect to.

[0042] exploitAndScan(X,Y,E): A remote vulnerability attack action. This action initiates a vulnerability exploit from source host X to target host Y, using vulnerability E. If the exploit succeeds, the attacker gains access to vulnerability E on host Y. Furthermore, if the exploit succeeds, the attacker gains access to account A on host Y, allowing the attacker to further scan host Y's connectable hosts and identify the vulnerabilities on those hosts. Once this action is initiated, regardless of success, the attack counts for nodes X and Y are incremented by 1. Once the action succeeds, the attacker agent can see the hosts it can subsequently connect to.

[0043] escalateAndScan(X,E): This is a local privilege escalation action. This action is initiated on node X, exploiting vulnerability E. If exploited successfully, the attacker gains access to vulnerability E on host X and can further scan host Y for connectable hosts and the vulnerabilities present on those hosts. Once this action is initiated, regardless of success, the attack count on node X increases by 1. If this action succeeds, the attack agent can see the hosts it can subsequently connect to.

[0044] cleanup(X): Cleanup action. When the attacking agent executes this action, the attack count of host X is reduced by 1.

[0045] search(X): Search host action. Search for node X in the target network and return the result of whether the detection is successful.

[0046] Among them, the observation factors that the attacking agent can obtain include: the authority of the attacking agent on the host, the account of the attacking agent on the host, and whether the vulnerability can be exploited.

[0047] The defense agent can observe factors such as the number of attacks on the attacked node and the number of alarms per host. However, since the defense agent cannot observe the attacking agent's local privilege escalation and cleanup actions, the number of alarms does not equal the actual number of attacks.

[0048] As an optional embodiment of the present invention, the simulation method further includes:

[0049] Record the attack and defense data of the attack and defense simulation.

[0050] The attack and defense data includes action information, reward information, game information, process status information and observation information, and can be used for subsequent simulation analysis.

[0051] like Figure 2 FIG. 1 is a structural diagram of a simulation system for network attack and defense in an asymmetric game according to an embodiment of the present invention. The simulation system includes:

[0052] Related parameter generation module 201, used to generate related parameters for attack and defense according to the attack and defense requirements of the network attack and defense to be simulated;

[0053] An attack and defense scenario generating module 202, configured to generate a corresponding attack and defense scenario according to the relevant parameters;

[0054] The attack and defense simulation module 203 is used to control the attacking agent and the defending agent to perform attack and defense simulation in the attack and defense scenario through preset functional functions.

[0055] Separating parameters from the model allows for more flexible generation of scenario parameters related to attack and defense simulations. These parameters include, but are not limited to, game mechanisms, network environment model parameters, and system configuration files. The system configuration file controls the entire attack and defense simulation, including the number of simulation training rounds, steps, test rounds, steps, agent actions, and strategy-related hyperparameters. These parameters, acting as global variables, directly influence the configuration parameters of each sub-simulation, enabling easier control of the simulation process.

[0056] After receiving the generated relevant parameters, the relevant parameters are loaded into the preset model to generate the corresponding attack and defense scenario.

[0057] The functions used to control the attacking and defending agents include begin, proceed, and success. These functions operate as follows: the begin function determines whether the agent's pending steps meet the preconditions in its current state. If so, the pending steps are passed to the proceed function. The proceed function determines the reliability and likelihood of the pending actions being recorded. The success function updates the state of the attack and defense scenario. This control method effectively improves the limitations of the original OpenAI gym platform, which does not support multi-timestep actions, and further reflects the actual observation delay in network intrusion defense problems.

[0058] This application also uses a judgment function to judge the return results of the agent's actions. Combining the judgment function, the reliability of the attack action of the attacking agent and the defense detection rate of the defending agent can obtain the state transition of the attack and defense scenario, the execution results of the agent's actions and the observable results.

[0059] Among them, the action types of the agent include:

[0060] lateralAndScan(X,Y,A): A remote account login action. This action initiates a remote account login from source host X to target host Y, using credential A. If exploitation is successful, the attacker gains access to account A on host Y and can then scan for hosts connected to it, identifying vulnerabilities within those hosts. Upon initiating this action, regardless of success, the attack counts for nodes X and Y are incremented by one. If this action succeeds, the attacker agent can see subsequent hosts it can connect to.

[0061] exploitAndScan(X,Y,E): A remote vulnerability attack action. This action initiates a vulnerability exploit from source host X to target host Y, using vulnerability E. If the exploit succeeds, the attacker gains access to vulnerability E on host Y. Furthermore, if the exploit succeeds, the attacker gains access to account A on host Y, allowing the attacker to further scan host Y's connectable hosts and identify the vulnerabilities on those hosts. Once this action is initiated, regardless of success, the attack counts for nodes X and Y are incremented by 1. Once the action succeeds, the attacker agent can see the hosts it can subsequently connect to.

[0062] escalateAndScan(X,E): This is a local privilege escalation action. This action is initiated on node X, exploiting vulnerability E. If exploited successfully, the attacker gains access to vulnerability E on host X and can further scan host Y for connectable hosts and the vulnerabilities present on those hosts. Once this action is initiated, regardless of success, the attack count on node X increases by 1. If this action succeeds, the attack agent can see the hosts it can subsequently connect to.

[0063] cleanup(X): Cleanup action. When the attacking agent executes this action, the attack count of host X is reduced by 1.

[0064] search(X): Search host action. Search for node X in the target network and return the result of whether the detection is successful.

[0065] Among them, the observation factors that the attacking agent can obtain include: the authority of the attacking agent on the host, the account of the attacking agent on the host, and whether the vulnerability can be exploited.

[0066] The defense agent can observe factors such as the number of attacks on the attacked node and the number of alarms per host. However, since the defense agent cannot observe the attacking agent's local privilege escalation and cleanup actions, the number of alarms does not equal the actual number of attacks.

[0067] As an optional embodiment of the present invention, the simulation system further includes:

[0068] Recording module, used to record the attack and defense data of the attack and defense simulation

[0069] Figure 3 An example of a physical structure diagram of an electronic device is shown below. Figure 3As shown, the electronic device may include: a processor (processor) 301, a communications interface (Communications Interface) 302, a memory (memory) 303, and a communication bus 304, wherein the processor, the communications interface, and the memory communicate with each other via the communication bus. The processor can call logic instructions in the memory to execute a simulation method for network attack and defense in an asymmetric game, the method comprising: generating relevant parameters for attack and defense based on the attack and defense requirements of the network attack and defense to be simulated; generating a corresponding attack and defense scenario based on the relevant parameters; and controlling the attacking intelligent agent and the defending intelligent agent to perform attack and defense simulation in the attack and defense scenario through preset functional functions.

[0070] In addition, the logical instructions in the above-mentioned memory can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when sold or used as an independent product. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes several instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0071] On the other hand, an embodiment of the present invention also provides a computer program product, which includes a computer program stored on a non-transitory computer-readable storage medium, and the computer program includes program instructions. When the program instructions are executed by a computer, the computer can execute a simulation method for network attack and defense under an asymmetric game situation provided by the above-mentioned method embodiments. The method includes: generating relevant parameters for attack and defense according to the attack and defense requirements of the network attack and defense to be simulated; generating corresponding attack and defense scenarios according to the relevant parameters; and controlling the attacking intelligent agent and the defending intelligent agent to perform attack and defense simulation in the attack and defense scenario through preset functional functions.

[0072] On the other hand, an embodiment of the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, it is implemented to execute a simulation method of network attack and defense under an asymmetric game situation provided by the above-mentioned embodiments. The method includes: generating relevant parameters for attack and defense according to the attack and defense requirements of the network attack and defense to be simulated; generating a corresponding attack and defense scenario according to the relevant parameters; and controlling the attacking intelligent agent and the defending intelligent agent to perform attack and defense simulation in the attack and defense scenario through preset functional functions.

[0073] It should be understood that although the steps in the flowcharts of the accompanying drawings are shown in sequence as indicated by the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless otherwise specified herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some of the steps in the flowcharts of the accompanying drawings may include multiple sub-steps or multiple stages, and these sub-steps or stages are not necessarily executed at the same time, but can be executed at different times, and their execution order is not necessarily sequential, but can be executed in turn or alternately with other steps or at least a portion of the sub-steps or stages of other steps.

[0074] The above is only a partial implementation of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

Claims

1. A simulation method for network attack and defense in an asymmetric game, characterized in that: The simulation method comprises: Generate relevant parameters for attack and defense based on the attack and defense requirements of the network to be simulated. The relevant parameters include the lag time of defense decision, the step size of the attack and defense agent action, the size of the network, and other parameters to build an asymmetric network attack and defense game scenario; Generate a corresponding attack and defense scenario according to the relevant parameters; In the attack and defense scenario, the attacking agent and the defending agent are controlled by preset function functions to perform attack and defense simulation. The preset function functions include: begin function, proceed function, and success function. The operation of the above function functions is as follows: the begin function is used to determine whether the step to be implemented by the agent meets the precondition in the current state. If so, the step to be implemented is passed to the proceed function; the proceed function is used to determine the reliability of the action to be implemented and the possibility of being recorded; and the success function is used to update the status of the attack and defense scenario. The return results of the actions of the attacking and defensive agents are judged through the judgment function. Combining the judgment function, the reliability of the attacking agent's attack actions and the defense detection rate of the defensive agent, the state transition of the attacking and defensive scenarios, the execution results of the agent's actions and the observable results can be obtained. The action types of the attacking and defensive agents include: remote account login actions, remote vulnerability attack actions, system local privilege escalation actions, trace cleaning actions, and host search actions.

2. The simulation method according to claim 1, wherein: The relevant parameters include: game mechanism, network environment model parameters, and system configuration files.

3. A simulation system for network attack and defense in an asymmetric game, characterized by: The simulation system comprises: A related parameter generation module is used to generate related parameters for attack and defense according to the attack and defense requirements of the network attack and defense to be simulated. The related parameters include the lag time of defense decision, the step size of the attack and defense agent action, the size of the network, and other parameters to build an asymmetric network attack and defense game scenario; An attack and defense scenario generation module, configured to generate a corresponding attack and defense scenario according to the relevant parameters; The attack and defense simulation module is used to control the attacking intelligent agent and the defending intelligent agent to perform attack and defense simulation in the attack and defense scenario through preset function functions. The preset function functions include: begin function, proceed function and success function; the operation of the above function functions is specifically as follows: obtain whether the steps to be implemented by the intelligent agent meet the prerequisites in the current state through the begin function, and if so, pass the steps to be implemented to the proceed function; the proceed function determines the reliability of the action to be implemented and the possibility of being recorded; the success function is used to update the state of the attack and defense scenario; it is also used to judge the return result of the action of the attack and defense intelligent agent through the judgment function, and combine the judgment function, the reliability of the attack action of the attacking intelligent agent and the defense detection rate of the defending intelligent agent to obtain the state transfer of the attack and defense scenario, the execution result of the intelligent agent action and the observable result. The action types of the attack and defense intelligent agent include: remote account login action, remote vulnerability attack action, system local privilege escalation action, trace cleaning action, host search action.

4. The simulation system according to claim 3, wherein: The relevant parameters include: game mechanism, network environment model parameters, and system configuration files.

5. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the program, the simulation method for network attack and defense in an asymmetric game situation according to any one of claims 1 to 2 is implemented.

6. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the simulation method of network attack and defense in an asymmetric game situation according to any one of claims 1 to 2 is implemented.

Images