Network risk analysis method and system based on multi-level game model

Abstract

The present invention provides a network risk analysis method and system based on a multi-level game model, which relates to the technical field of network risk analysis, including constructing a multi-level dynamic game model, based on the constructed multi-level dynamic game model, using a multi-level game equilibrium solution algorithm, decomposing the multi-level game problem into a number of sub-game problems corresponding to different network levels, using a reverse induction method to solve each sub-game problem respectively, and obtaining a multi-level game equilibrium solution through iterative optimization until preset conditions are met; inputting the obtained multi-level game equilibrium solution into a pre-trained multi-level risk assessment model, outputting a risk assessment value, and triggering a strategy adjustment mechanism when the risk assessment value exceeds a preset risk warning threshold, updating the defense strategy by recalculating the multi-level game equilibrium solution, and finally obtaining the optimal defense strategy combination under risk minimization.

Description

Technical Field

[0001] The present invention relates to network risk analysis technology, and in particular to a network risk analysis method and system based on a multi-level game model. Background Art

[0002] With the rapid development of information technology and the increasing degree of networking, network security issues are becoming increasingly serious. The means of network attacks are constantly being updated, and the frequency and destructive power of attacks continue to increase, posing a huge threat to the security of individuals, enterprises and the country.

[0003] Game theory is a theoretical tool for studying the interaction and decision-making between multiple participants. It has been widely used in economics, political science, sociology and other fields. Introducing game theory into the field of network security can characterize the confrontational game process between attackers and defenders, and then design the optimal active defense strategy. However, most traditional game models are based on static games or two-party games, which makes it difficult to fully characterize the dynamic game behavior of multiple parties in cyberspace. Most of the existing network security game research is based on static games or two-party games, which makes it difficult to fully characterize the dynamic game behavior of multiple parties in cyberspace. Although multi-level dynamic games have been applied in other fields, research in the field of network security is still very limited. The network security situation is changing rapidly, and the strategies of attackers, defenders and users evolve dynamically over time. Therefore, it is urgent to build a multi-level dynamic game model for network security, design corresponding equilibrium solutions and risk assessment methods, and then realize the dynamic optimization of network security defense strategies. Summary of the invention

[0004] The embodiment of the present invention provides a network risk analysis method and system based on a multi-level game model, which can solve the problems in the prior art.

[0005] According to a first aspect of the embodiments of the present invention,

[0006] A network risk analysis method based on a multi-level game model is provided, including:

[0007] Constructing a multi-level dynamic game model, wherein the multi-level dynamic game model includes an attacker layer, a defender layer, and a user layer, wherein the attacker layer is used to describe the attacker's attack strategy, the defender layer is used to describe the defender's defense strategy, and the user layer is used to describe the user's behavior strategy;

[0008] Based on the constructed multi-level dynamic game model, the multi-level game equilibrium solution algorithm is used to decompose the multi-level game problem into several sub-game problems corresponding to different network levels. The reverse induction method is used to solve each sub-game problem separately. Through iterative optimization until the preset conditions are met, the multi-level game equilibrium solution is obtained.

[0009] The obtained multi-layer game equilibrium solution is input into the pre-trained multi-level risk assessment model, and the risk assessment value is output. When the risk assessment value exceeds the preset risk warning threshold, the strategy adjustment mechanism is triggered, and the defense strategy is updated by recalculating the multi-layer game equilibrium solution, and finally the optimal defense strategy combination under risk minimization is obtained.

[0010] In an optional embodiment,

[0011] Building a multi-level dynamic game model includes:

[0012] Construct a network layer set according to the multi-layer structure of the network, where each element represents a specific network layer;

[0013] Define the mixed strategy space of the attacker and defender at each network level, which contains discrete strategy variables and continuous strategy variables, representing the strategy set that the attacker and defender can adopt at each network level, and introduce the strategy probability distribution of the attacker and defender to represent the probability of their strategy selection at each network level;

[0014] Based on the obtained network level set and mixed strategy space, a multi-layer dynamic game model based on the Markov game process is constructed, and the state transfer matrix and utility function of the attacker and defender at each network level are defined. Among them, the state transfer matrix represents the strategy selection of the attacker and defender at each network level, and the utility function comprehensively considers the strategy probability distribution of the attacker and defender at each network level.

[0015] In an optional embodiment,

[0016] Based on the constructed multi-level dynamic game model, the multi-level game equilibrium solution algorithm is used to decompose the multi-level game problem into several sub-game problems corresponding to different network levels. The reverse induction method is used to solve each sub-game problem separately. Through iterative optimization until the preset conditions are met, the multi-level game equilibrium solution is obtained, including:

[0017] The multi-level network is divided into multiple sub-networks using a multi-level partitioning algorithm, where each sub-network corresponds to a local game problem;

[0018] In each subnet, a local strategy space is constructed and a distributed strategy optimization algorithm is designed. Through local information exchange and strategy update, the local game strategy is adaptively adjusted to obtain the local game equilibrium solution in each subnet.

[0019] A consistency optimization model of a multi-level network game is designed based on the local game equilibrium solution in each subnet, and a distributed consistency optimization algorithm based on an alternating direction multiplier method is used to decompose the consistency optimization model into multiple sub-problems, and the distributed optimization results of the consistency optimization model are obtained by alternately solving each sub-problem;

[0020] The distributed optimization steps of local game equilibrium solution and consistency optimization model are repeatedly executed until the convergence conditions are met to obtain the final multi-layer game equilibrium solution.

[0021] In an optional embodiment,

[0022] The distributed consistency optimization algorithm based on the alternating direction multiplier method is used to decompose the consistency optimization model into multiple sub-problems. The distributed optimization results of the consistency optimization model obtained by alternately solving each sub-problem include:

[0023] Decompose the consistency optimization problem into local game equilibrium subproblems, global consistent strategy optimization subproblems and dual variable update subproblems;

[0024] The global consistent strategy optimization subproblem and the dual variable update subproblem are fixed, and each subnetwork solves its own local game equilibrium subproblem to obtain the updated local strategy;

[0025] Fix the updated local strategy and dual variable update subproblem, optimize the global consistent strategy optimization subproblem, minimize the difference between it and the local strategy of each subnet, and obtain the updated global consistent strategy;

[0026] According to the updated local strategy and the global consistent strategy, the dual variable update subproblem is updated, and based on the updated dual variable obtained, the deviation between the local strategy and the global consistent strategy is adjusted;

[0027] Repeat the iteration until the convergence condition is met and obtain the distributed optimization result of the consistent optimization model.

[0028] In an optional embodiment,

[0029] The obtained multi-layer game equilibrium solution is input into the pre-trained multi-level risk assessment model. The steps before outputting the equilibrium risk level include:

[0030] Constructing a directed graph according to the multi-layer structure of the network, the directed graph includes nodes and directed edges, wherein the nodes represent game entities in the multi-layer structure of the network, the directed edges represent the strategic influence relationship between the game entities, and the weights of the directed edges represent the strength of the strategic influence relationship;

[0031] Obtain the equilibrium strategy feature vector of the game subject corresponding to each node in the directed graph, use the equilibrium strategy feature vector as the initial embedded representation of the node, and iteratively update the initial embedded representation through multiple rounds of graph convolution operations to obtain an updated embedded representation; perform a global pooling operation on the updated embedded representation to obtain a pooled graph-level embedded representation vector, input the obtained graph-level embedded representation vector into the fully connected layer, and map it to a risk assessment value through a nonlinear activation function;

[0032] Based on the directed graph, a graph neural network model is designed, and equilibrium state samples and their corresponding true risk value labels are introduced to construct a loss function of the graph neural network model. The parameters of the graph neural network model are optimized using a gradient descent optimization algorithm. The loss function is minimized through multiple iterations to obtain a trained graph neural network model.

[0033] The obtained multi-layer game equilibrium solution is input into the trained graph neural network model, and the corresponding risk assessment value is output after constructing a directed graph, obtaining the equilibrium strategy feature vector, multiple rounds of graph convolution operations, global pooling operations and fully connected layer mapping operations.

[0034] In an optional embodiment,

[0035] The calculation formula for the loss function of the graph neural network model constructed by introducing equilibrium state samples and their corresponding true risk value labels is as follows:

[0036]

[0037] Among them, L represents the loss function, n represents the number of equilibrium state samples, i represents the equilibrium state sample index, r i represents the predicted risk assessment value of the i-th equilibrium state sample, y i represents the true risk value label of the i-th equilibrium state sample, λ1 represents the regularization coefficient of the first layer weight matrix of the fully connected layer, ||·|| F represents the Frobenius norm of the matrix, represents the first layer weight matrix of the fully connected layer, λ2 represents the regularization coefficient of the second layer weight matrix of the fully connected layer, represents the second layer weight matrix of the fully connected layer, μ represents the coefficient of KL divergence regularization, represents the probability distribution p(h G ) is the value of the ith equilibrium state sample, Represents the preset prior distribution q(h G ) is the value of the ith equilibrium state sample;

[0038] The calculation formula of the risk assessment value is as follows:

[0039]

[0040] Where r represents the risk assessment value, σ(·) represents the activation function, and W r represents the weight matrix of the fully connected layer, V represents the node set of the directed graph, v represents the vth node, u represents the uth node, N(v) represents the neighbor node set of node v, α u,v represents the attention weight from node u to node v, W (k)represents the weight matrix of the k-th round of graph convolution operation, k represents the k-th round of graph convolution operation, represents the embedded representation of node u after the k-1th round of graph convolution operation, b (k) represents the bias vector of the k-th round of graph convolution operation, b r Represents the bias vector.

[0041] In an optional embodiment,

[0042] When the risk assessment value exceeds the preset risk warning threshold, the strategy adjustment mechanism is triggered. The defense strategy is updated by recalculating the multi-layer game equilibrium solution. Finally, the optimal defense strategy combination under risk minimization is obtained, including:

[0043] The game process between attackers, defenders, and users is mapped into an adversarial game process between a generator and a discriminator, where the generator network takes the attack behavior features as conditional input, extracts the latent space representation of the attack behavior features through the encoder, and generates the corresponding defense strategy based on the latent space representation of the attack behavior features through the decoder; the discriminator network extracts the defense strategy features through a convolutional neural network and outputs the effectiveness score of the defense strategy;

[0044] Construct a generator loss function that includes strategy effectiveness loss and strategy diversity loss, as well as a cross-entropy discriminator loss function, and optimize the generator network and the discriminator network by alternating training to obtain a trained conditional generative adversarial network model;

[0045] Use the trained conditional generative adversarial network model to generate multiple defense strategy candidates, conduct risk assessment on each defense strategy candidate, and obtain risk assessment results;

[0046] A strategy selection model based on game theory is constructed, and the risk assessment results are used as the strategy utility value to solve the optimal mixed strategies of attackers and defenders and obtain the optimal defense strategy combination.

[0047] According to a second aspect of the embodiments of the present invention,

[0048] A network risk analysis system based on a multi-level game model is provided, comprising:

[0049] The first unit is used to construct a multi-level dynamic game model, wherein the multi-level dynamic game model includes an attacker layer, a defender layer and a user layer, wherein the attacker layer is used to describe the attacker's attack strategy, the defender layer is used to describe the defender's defense strategy, and the user layer is used to describe the user's behavior strategy;

[0050] The second unit is used to decompose the multi-level game problem into several sub-game problems corresponding to different network levels based on the constructed multi-level dynamic game model, and use the multi-level game equilibrium solution algorithm to solve each sub-game problem separately by using the reverse induction method. Through iterative optimization until the preset conditions are met, the multi-level game equilibrium solution is obtained;

[0051] The third unit is used to input the obtained multi-layer game equilibrium solution into a pre-trained multi-level risk assessment model and output a risk assessment value. When the risk assessment value exceeds a preset risk warning threshold, the strategy adjustment mechanism is triggered to update the defense strategy by recalculating the multi-layer game equilibrium solution, and finally obtain the optimal defense strategy combination under risk minimization.

[0052] According to a third aspect of the embodiments of the present invention,

[0053] An electronic device is provided, comprising:

[0054] processor;

[0055] a memory for storing processor-executable instructions;

[0056] The processor is configured to call the instructions stored in the memory to execute the aforementioned method.

[0057] A fourth aspect of the embodiments of the present invention is:

[0058] A computer-readable storage medium is provided, on which computer program instructions are stored. When the computer program instructions are executed by a processor, the aforementioned method is implemented.

[0059] In this embodiment, by integrating the behavioral strategies of attackers, defenders, and users into a multi-level dynamic game model, the complex attack and defense game process can be dynamically described and captured, thereby improving the authenticity and accuracy of the model. Using a multi-level game equilibrium solution algorithm, a complex multi-level game problem can be decomposed into several sub-game problems, which are solved separately by the reverse induction method, and finally a multi-level game equilibrium solution is obtained, thereby effectively solving the computational complexity of the multi-level game problem. The multi-level game equilibrium solution is input into a pre-trained risk assessment model to obtain a corresponding risk assessment value. When the risk assessment value exceeds a preset threshold, the strategy adjustment mechanism will be triggered to recalculate the multi-level game equilibrium solution, thereby updating the defense strategy and achieving the optimal defense strategy combination under risk minimization. Through risk assessment and strategy adjustment mechanisms, the solution can reduce defense costs and resource consumption while ensuring the defense effect, and improve defense efficiency and cost-effectiveness. BRIEF DESCRIPTION OF THE DRAWINGS

[0060] Figure 1 A schematic diagram of a flow chart of a network risk analysis method based on a multi-level game model according to an embodiment of the present invention;

[0061] Figure 2 It is a schematic diagram of the structure of a network risk analysis system based on a multi-level game model according to an embodiment of the present invention. DETAILED DESCRIPTION

[0062] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0063] The technical solution of the present invention is described in detail with specific embodiments below. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described in detail in some embodiments.

[0064] Figure 1 FIG. 1 is a flow chart of a network risk analysis method based on a multi-level game model according to an embodiment of the present invention. Figure 1 As shown, the method includes:

[0065] S101. Construct a multi-level dynamic game model, wherein the multi-level dynamic game model includes an attacker layer, a defender layer, and a user layer, wherein the attacker layer is used to describe the attacker's attack strategy, the defender layer is used to describe the defender's defense strategy, and the user layer is used to describe the user's behavior strategy;

[0066] In an optional embodiment,

[0067] Building a multi-level dynamic game model includes:

[0068] Construct a network layer set according to the multi-layer structure of the network, where each element represents a specific network layer;

[0069] Define the mixed strategy space of the attacker and defender at each network level, which contains discrete strategy variables and continuous strategy variables, representing the strategy set that the attacker and defender can adopt at each network level, and introduce the strategy probability distribution of the attacker and defender to represent the probability of their strategy selection at each network level;

[0070] Based on the obtained network level set and mixed strategy space, a multi-layer dynamic game model based on the Markov game process is constructed, and the state transfer matrix and utility function of the attacker and defender at each network level are defined. Among them, the state transfer matrix represents the strategy selection of the attacker and defender at each network level, and the utility function comprehensively considers the strategy probability distribution of the attacker and defender at each network level.

[0071] Exemplarily, the hierarchical structure of the network system is first analyzed to identify each independent network layer, such as the physical layer, link layer, network layer, transport layer, and application layer. Based on the identified network layers, a network layer set is constructed, and each element in the set represents a specific network layer. The network layer set can be numbered or named for subsequent modeling and analysis.

[0072] For each layer in the network layer set, analyze the types of strategies that the attacker and defender may adopt, including discrete strategies (such as selecting attack targets, defensive measures, etc.) and continuous strategies (such as allocating attack resources, adjusting defense parameters, etc.). For each strategy type, define the corresponding strategy variables to represent the strategy choices of the attacker and defender at this layer. Discrete strategy variables can be represented by integer or Boolean variables, and continuous strategy variables can be represented by real variables.

[0073] The strategy probability distribution of the attacker and defender in each layer of the mixed strategy space is introduced to indicate the probability of their selection of different strategy combinations. The strategy probability distribution can be represented by a discrete probability distribution or a continuous probability density function. At the same time, the strategy probability distribution of the attacker and defender in each layer of the mixed strategy space is introduced to indicate the probability of their selection of different strategy combinations. The strategy probability distribution can be represented by a discrete probability distribution or a continuous probability density function.

[0074] Based on the network layer set and the mixed strategy space of the attacker and defender, a multi-layer dynamic game model based on the Markov game process is constructed. The state space of the model is defined to represent the different states of the attack and defense game at each network layer. The state space can be divided according to factors such as the security status of each layer and the choice of attack and defense strategies. The state transfer matrix of the attacker and defender at each layer is defined to represent the probability of the game state transferring between different layers given the strategy choices of both parties. The state transfer matrix can be estimated based on expert knowledge, historical data or simulation experiments. The utility function of the attacker and defender at each layer is defined to represent their gains or losses under different game states. The utility function should comprehensively consider the execution cost of the attack and defense strategy, the success rate of the attack, the effectiveness of the defense, and other factors, and be calculated in combination with the probability distribution of the strategies of both parties. The state transfer matrix and the utility function are integrated into the multi-layer dynamic game model to form a complete mathematical description. This model can characterize the dynamic evolution process of the attack and defense game in a multi-layer network structure.

[0075] In this embodiment, by constructing a network layer set, the scheme can effectively model the hierarchical structure of the network and capture the relationship and dependency between each layer of the network. This hierarchical modeling method is closer to the structure of the actual network, and improves the practicality and accuracy of the model. The scheme defines the strategy space of the attacker and defender as a mixed strategy space containing discrete and continuous variables, which can more comprehensively and flexibly describe the behavioral strategies that the attacker and defender can take at each network layer, and improve the expressiveness of the strategy representation. The introduction of strategy probability distribution enables the model to characterize the probability of the attacker and defender choosing different strategies at each layer, which is closer to the real strategy selection process and improves the descriptiveness and interpretability of the model. Based on the Markov game process, a multi-layer dynamic game model is constructed, which can dynamically capture the behavioral strategy changes of the attacker and defender at each layer of the network, as well as the state transfer and utility changes caused by it, and provides strong support for in-depth understanding and analysis of complex attack and defense processes. By defining the state transfer matrix and utility function, the scheme can simulate and describe the strategic dependency between the attacker and defender at different network layers, as well as the resulting inter-layer influence transmission, which helps to fully grasp network security risks.

[0076] S102. Based on the constructed multi-level dynamic game model, the multi-level game equilibrium solution algorithm is used to decompose the multi-level game problem into several sub-game problems corresponding to different network levels, and each sub-game problem is solved separately using the reverse induction method. Through iterative optimization until the preset conditions are met, a multi-level game equilibrium solution is obtained;

[0077] In an optional embodiment,

[0078] Based on the constructed multi-level dynamic game model, the multi-level game equilibrium solution algorithm is used to decompose the multi-level game problem into several sub-game problems corresponding to different network levels. The reverse induction method is used to solve each sub-game problem separately. Through iterative optimization until the preset conditions are met, the multi-level game equilibrium solution is obtained, including:

[0079] The multi-level network is divided into multiple sub-networks using a multi-level partitioning algorithm, where each sub-network corresponds to a local game problem;

[0080] In each subnet, a local strategy space is constructed and a distributed strategy optimization algorithm is designed. Through local information exchange and strategy update, the local game strategy is adaptively adjusted to obtain the local game equilibrium solution in each subnet.

[0081] A consistency optimization model of a multi-level network game is designed based on the local game equilibrium solution in each subnet, and a distributed consistency optimization algorithm based on an alternating direction multiplier method is used to decompose the consistency optimization model into multiple sub-problems, and the distributed optimization results of the consistency optimization model are obtained by alternately solving each sub-problem;

[0082] The distributed optimization steps of local game equilibrium solution and consistency optimization model are repeatedly executed until the convergence conditions are met to obtain the final multi-layer game equilibrium solution.

[0083] Exemplarily, firstly, a hierarchical adjacency matrix of a multi-level network is constructed, the interaction intensity and coupling relationship between different layers are considered, an adaptive node clustering algorithm is designed, nodes are clustered according to properties such as game roles, strategy spaces and utility functions, the granularity and number of clusters are dynamically adjusted, and a multi-objective optimization model is used to balance the scale, connectivity and independence of subnets to generate a high-quality network partitioning scheme. Finally, according to the obtained network partitioning scheme, the multi-level network is divided into multiple subnets, where each subnet corresponds to a local game problem.

[0084] For different types of game problems, such as matrix games, evolutionary games and repeated games, corresponding local strategy space representations and utility function construction methods are designed. At the same time, a consensus-based distributed strategy optimization algorithm is developed. Through local information exchange and strategy updating, while ensuring convergence and robustness, the game equilibrium utility in each subnet is maximized. A strategy learning mechanism driven by game history data is introduced, and reinforcement learning, adversarial learning and other methods are used to adaptively adjust local game strategies, improve the quality and convergence speed of game equilibrium, and obtain local game equilibrium solutions in each subnet.

[0085] In order to further improve the performance of the distributed strategy optimization algorithm, a strategy learning mechanism driven by game history data is introduced. By collecting and analyzing the decision data of the nodes in the past game process, effective strategy patterns and rules are mined to guide the strategy optimization in the current game process. The strategy learning mechanism can be implemented based on technologies such as reinforcement learning and adversarial learning. By adaptively adjusting the node strategy through the learning mechanism, the strategy convergence can be accelerated and the quality of the game equilibrium solution can be improved.

[0086] Specifically, first initialize the local strategy of each node in the subnet, calculate the local utility value of each node according to the current strategy, and determine whether the equilibrium condition is met. If it is met, output the current strategy as the equilibrium solution; otherwise, make the node update its own strategy based on the local utility value and the strategy information of the neighboring nodes using the distributed strategy optimization algorithm, and use the strategy learning mechanism to adaptively adjust the node strategy based on historical game data. Repeat the above steps until the equilibrium condition is met or the upper limit of the number of iterations is reached, and output the local equilibrium strategy of each node in the subnet.

[0087] On the basis of obtaining the local game equilibrium solution in the subnet, the consistency of the game strategies between different subnets is further considered to achieve the equilibrium of the entire multi-level network game. To this end, a consistency optimization model for multi-level network games is established. The model introduces global consistent strategy variables to minimize the deviation between the local equilibrium solution of each subnet and the global consistent strategy, while taking into account various constraints in the game process, such as strategy feasibility constraints, game equilibrium constraints, network stability constraints, etc. Through consistency optimization, the game strategies of different subnets can be coordinated to obtain an overall equilibrium solution. For the established consistency optimization model, a distributed solution algorithm based on the alternating direction multiplier method (ADMM) is proposed. The ADMM algorithm decomposes the original problem into several easy-to-solve sub-problems by introducing auxiliary variables and Lagrange multipliers, and then optimizes each sub-problem alternately through iteration to finally obtain the optimal solution of the original problem.

[0088] Optionally, the consistency optimization model is transformed into three sub-problems about local equilibrium solution, global consistent strategy and dual variables to form an iterative optimization framework of ADMM. The sub-problems can be solved efficiently in a parallel or distributed manner, reducing the computational complexity of optimization. Design corresponding solution methods for the three sub-problems decomposed by ADMM. For the local equilibrium solution optimization sub-problem, gradient descent, Newton's method, optimal response and other methods can be used to update the local strategy under the conditions of satisfying local game constraints to improve the solution efficiency. For the global consistent strategy optimization sub-problem, the projected gradient method, Frank-Wolfe algorithm and other methods can be used to update the consistent strategy under the conditions of satisfying global constraints to accelerate convergence. For the dual variable update sub-problem, an adaptive step size adjustment strategy can be designed to balance the optimization process of the original problem and the dual problem and improve the overall performance of the algorithm. By alternately solving the above three sub-problems, a distributed solution of the consistency optimization model can be obtained.

[0089] Repeat the local game equilibrium solution and consistency optimization steps until the convergence condition is met. When the difference between the local equilibrium solution and the global consistent strategy is small enough, or the number of iterations reaches the preset threshold, the iteration process is terminated. After the iteration converges, the global equilibrium solution of the multi-level network game is obtained.

[0090] In an optional embodiment,

[0091] The distributed consistency optimization algorithm based on the alternating direction multiplier method is used to decompose the consistency optimization model into multiple sub-problems. The distributed optimization results of the consistency optimization model obtained by alternately solving each sub-problem include:

[0092] Decompose the consistency optimization problem into local game equilibrium subproblems, global consistent strategy optimization subproblems and dual variable update subproblems;

[0093] The global consistent strategy optimization subproblem and the dual variable update subproblem are fixed, and each subnetwork solves its own local game equilibrium subproblem to obtain the updated local strategy;

[0094] Fix the updated local strategy and dual variable update subproblem, optimize the global consistent strategy optimization subproblem, minimize the difference between it and the local strategy of each subnet, and obtain the updated global consistent strategy;

[0095] According to the updated local strategy and the global consistent strategy, the dual variable update subproblem is updated, and based on the updated dual variable obtained, the deviation between the local strategy and the global consistent strategy is adjusted;

[0096] Repeat the iteration until the convergence condition is met and obtain the distributed optimization result of the consistent optimization model.

[0097] For example, the global consistent strategy and dual variables are fixed, and each subnet solves its own local game equilibrium subproblem to obtain an updated local strategy. This step allows each subnet to independently determine the optimal strategy based on its own situation.

[0098] Next, the updated local strategy and dual variables are fixed, and the global consistent strategy optimization subproblem is optimized to minimize the difference between it and the local strategy of each subnet, thus obtaining the updated global consistent strategy. This step ensures the consistency between the global strategy and the local strategy of each subnet.

[0099] Then, according to the updated local strategy and the global consistent strategy, the dual variable is updated. Based on the updated dual variable, the deviation between the local strategy and the global consistent strategy is adjusted. This step introduces the dual variable to coordinate the relationship between the local strategy and the global strategy.

[0100] Finally, the above steps are repeated and iterated until the convergence condition is met, and the distributed optimization result of the consistent optimization model is obtained.

[0101] In this embodiment, by dividing the multi-level network into multiple subnets, each subnet corresponds to a local game problem, and the distributed modeling of the problem is realized. At the same time, by adopting the distributed strategy optimization algorithm and the consistency optimization model, the local game equilibrium solution and the global consistent strategy of each subnet can be distributedly solved, which reduces the computational complexity and improves the scalability of the algorithm. A distributed consistency optimization algorithm based on the alternating direction multiplier method is introduced, and the consistency optimization problem is decomposed into a local game equilibrium subproblem, a global consistent strategy optimization subproblem and a dual variable update subproblem. The coordination between the local strategy and the global strategy is achieved through alternating solution, and the consistency of the overall solution is ensured. Inside the subnet, a strategy learning mechanism driven by game history data is designed, which can adaptively adjust the local game strategy according to the historical game data, and improve the adaptability and effectiveness of the strategy. By alternately executing the local game equilibrium solution and the consistency optimization model optimization, and setting reasonable convergence conditions, the convergence of the algorithm can be guaranteed, and finally the equilibrium solution of the entire multi-level network game is obtained.

[0102] S103. Input the obtained multi-layer game equilibrium solution into the pre-trained multi-level risk assessment model, and output the risk assessment value. When the risk assessment value exceeds the preset risk warning threshold, the strategy adjustment mechanism is triggered, and the defense strategy is updated by recalculating the multi-layer game equilibrium solution, and finally the optimal defense strategy combination under risk minimization is obtained.

[0103] Exemplarily, equilibrium state features are first extracted, specifically including attacker strategy features: extracting the attacker's attack targets, attack methods and other strategy information in the equilibrium state to characterize the attack behavior pattern; defender strategy features: extracting the defender's resource allocation, defense measures and other strategy information in the equilibrium state to characterize the defense capability level; user behavior features: extracting the user's risk aversion, service selection and other behavior information in the equilibrium state to characterize the user's risk preference.

[0104] Based on the extracted equilibrium state features, a multi-level risk assessment model is constructed using a feedforward neural network (FNN). The FNN consists of an input layer, a hidden layer, and an output layer. It can fit the mapping relationship from features to risks by learning a large amount of sample data.

[0105] To train the constructed multi-level risk assessment model, first generate training samples. For different game parameters (such as attack and defense utility, state transition probability, etc.), repeat the modeling and solving process of the multi-level game model to obtain a series of equilibrium solution samples. Then, for each equilibrium solution sample, give the corresponding risk value label through expert evaluation or simulation experiments to form a training sample pair.

[0106] The number of input layer nodes is set according to the sample feature dimension, the number of hidden layers and the number of nodes per layer are set according to the sample size and complexity, and the number of output layer nodes is 1, corresponding to the predicted risk value. Using the sample set, the weights and bias parameters of FNN are trained through the back propagation algorithm to make the predicted risk value as close to the real risk value as possible. The generalization performance of the model is evaluated on an independent test set, such as mean square error, determination coefficient, etc. Hyperparameters (such as the number of hidden layers, number of nodes, regularization coefficient, etc.) are optimized through methods such as cross-validation, and the model with the best generalization performance is selected as the final multi-level risk assessment model.

[0107] In an optional embodiment,

[0108] The obtained multi-layer game equilibrium solution is input into the pre-trained multi-level risk assessment model. The steps before outputting the equilibrium risk level include:

[0109] Constructing a directed graph according to the multi-layer structure of the network, the directed graph includes nodes and directed edges, wherein the nodes represent game entities in the multi-layer structure of the network, the directed edges represent the strategic influence relationship between the game entities, and the weights of the directed edges represent the strength of the strategic influence relationship;

[0110] Obtain the equilibrium strategy feature vector of the game subject corresponding to each node in the directed graph, use the equilibrium strategy feature vector as the initial embedded representation of the node, and iteratively update the initial embedded representation through multiple rounds of graph convolution operations to obtain an updated embedded representation; perform a global pooling operation on the updated embedded representation to obtain a pooled graph-level embedded representation vector, input the obtained graph-level embedded representation vector into the fully connected layer, and map it to a risk assessment value through a nonlinear activation function;

[0111] Based on the directed graph, a graph neural network model is designed, and equilibrium state samples and their corresponding true risk value labels are introduced to construct a loss function of the graph neural network model. The parameters of the graph neural network model are optimized using a gradient descent optimization algorithm. The loss function is minimized through multiple iterations to obtain a trained graph neural network model.

[0112] The obtained multi-layer game equilibrium solution is input into the trained graph neural network model, and the corresponding risk assessment value is output after constructing a directed graph, obtaining the equilibrium strategy feature vector, multiple rounds of graph convolution operations, global pooling operations and fully connected layer mapping operations.

[0113] Exemplarily, a directed graph is constructed according to the multi-layer structure of the network, and the directed graph includes nodes and directed edges, wherein the nodes represent game entities in the multi-layer structure of the network, the directed edges represent the strategy influence relationship between the game entities, and the weights of the directed edges represent the strength of the strategy influence relationship.

[0114] For each node, the equilibrium strategy feature vector of the corresponding game subject is extracted as the initial embedded representation of the node. The equilibrium strategy feature can include the subject's strategy type, strategy parameters, strategy probability distribution and other information, which are extracted and encoded through feature engineering methods. After initialization, the initial embedded representation of each node contains the local strategy information of the subject.

[0115] Through multiple rounds of graph convolution operations, the initial embeddedness of the node is iteratively updated to achieve the propagation and aggregation of strategy information among game entities. Each round of the graph convolution operation specifically includes determining the neighbor node set of the node, the neighbor node set includes the game entities that have the strategy influence relationship with the node, calculating the attention weight between each neighbor node in the neighbor node set and the node, the attention weight is used to represent the importance of different neighbor nodes to updating the embedded representation of the node, and finally updating the embedded representation of the node through a nonlinear activation function based on the embedded representation of the neighbor node, the attention weight, the weight matrix and the bias vector.

[0116] After K rounds of graph convolution updates, the updated embedded representation of each node is obtained, which contains the node features that integrate the global policy information. In order to generate a graph-level representation, it needs to be globally pooled. Common pooling methods include average pooling, maximum pooling, and attention pooling, which are mapped to the risk assessment value through one or more fully connected layers to obtain the final risk prediction result.

[0117] Based on the equilibrium state samples and their corresponding true risk value labels, the GNN model is trained using end-to-end supervised learning. The loss function can be selected from common regression or classification losses such as mean square error (MSE) or cross entropy. In order to prevent overfitting, regularization techniques such as L2 regularization and dropout can be introduced. Model optimization can use gradient descent methods, such as the Adam optimizer, to update model parameters through the back-propagation algorithm to minimize the loss function.

[0118] After training, the GNN model can be used for risk assessment of new multi-layer game equilibrium states. Given a new equilibrium state, the game graph is constructed according to the above steps, node features are initialized, and the risk value in this state can be predicted through graph convolution updates, global pooling and other operations.

[0119] In an optional embodiment,

[0120] The calculation formula for the loss function of the graph neural network model constructed by introducing equilibrium state samples and their corresponding true risk value labels is as follows:

[0121]

[0122] Among them, L represents the loss function, n represents the number of equilibrium state samples, i represents the equilibrium state sample index, r i represents the predicted risk assessment value of the i-th equilibrium state sample, y i represents the true risk value label of the i-th equilibrium state sample, λ1 represents the regularization coefficient of the first layer weight matrix of the fully connected layer, ||·|| F represents the Frobenius norm of the matrix, represents the first layer weight matrix of the fully connected layer, λ2 represents the regularization coefficient of the second layer weight matrix of the fully connected layer, represents the second layer weight matrix of the fully connected layer, μ represents the coefficient of KL divergence regularization, represents the probability distribution p(h G ) is the value of the ith equilibrium state sample, Represents the preset prior distribution q(h G ) is the value of the ith equilibrium state sample;

[0123] The calculation formula of the risk assessment value is as follows:

[0124]

[0125] Where r represents the risk assessment value, σ(·) represents the activation function, and W r represents the weight matrix of the fully connected layer, V represents the node set of the directed graph, v represents the vth node, u represents the uth node, N(v) represents the neighbor node set of node v, α u,v represents the attention weight from node u to node v, W (k) represents the weight matrix of the k-th round of graph convolution operation, k represents the k-th round of graph convolution operation, represents the embedded representation of node u after the k-1th round of graph convolution operation, b (k) represents the bias vector of the k-th round of graph convolution operation, b r Represents the bias vector.

[0126] In this embodiment, the multi-level structure of the network and the game subjects and their strategic influence relationships are modeled as a directed graph, and nodes and directed edges are used to represent the game subjects and the strategic influence relationships between them. This structured modeling method can clearly describe complex network game scenarios, capture the mutual influence between game subjects, and provide a basis for subsequent risk assessment. Through multiple rounds of graph convolution operations, the scheme can iteratively aggregate the information of node neighbors and update the embedded representation of nodes. This process can capture the mutual influence and transmission effect between game subjects, so that the representation of each node integrates the information in the entire graph structure, thereby improving the expressive power of the model. The trained graph neural network model can directly input the new multi-layer game equilibrium solution, and output the corresponding risk assessment value after a series of processing. The organic combination of graph neural network and multi-level network game modeling realizes the innovations of structured modeling, fusion of game equilibrium information, graph convolution aggregation of neighbor information, end-to-end learning risk assessment, model training and optimization, and real-time risk assessment, providing an effective solution for risk assessment in complex network environments.

[0127] In an optional embodiment,

[0128] When the risk assessment value exceeds the preset risk warning threshold, the strategy adjustment mechanism is triggered. The defense strategy is updated by recalculating the multi-layer game equilibrium solution. Finally, the optimal defense strategy combination under risk minimization is obtained, including:

[0129] The game process between attackers, defenders, and users is mapped into an adversarial game process between a generator and a discriminator, where the generator network takes the attack behavior features as conditional input, extracts the latent space representation of the attack behavior features through the encoder, and generates the corresponding defense strategy based on the latent space representation of the attack behavior features through the decoder; the discriminator network extracts the defense strategy features through a convolutional neural network and outputs the effectiveness score of the defense strategy;

[0130] Construct a generator loss function that includes strategy effectiveness loss and strategy diversity loss, as well as a cross-entropy discriminator loss function, and optimize the generator network and the discriminator network by alternating training to obtain a trained conditional generative adversarial network model;

[0131] Use the trained conditional generative adversarial network model to generate multiple defense strategy candidates, conduct risk assessment on each defense strategy candidate, and obtain risk assessment results;

[0132] A strategy selection model based on game theory is constructed, and the risk assessment results are used as the strategy utility value to solve the optimal mixed strategies of attackers and defenders and obtain the optimal defense strategy combination.

[0133] Exemplarily, the game process of attackers, defenders and users is mapped to the adversarial game process of generators and discriminators. The generator generates a defense strategy through a generative strategy network, and the discriminator evaluates the effectiveness of the defense strategy through a discriminative network. The conditional generative adversarial network (CGAN) architecture is adopted to take the attack behavior features as conditional input to generate targeted defense strategies. The generator network consists of an encoder and a decoder. The encoder extracts the latent space representation of the attack features, and the decoder generates a defense strategy based on the latent space representation.

[0134] The discriminator network structure is designed. The discriminator network extracts the feature representation of the defense strategy through a convolutional neural network and uses the attention mechanism to focus on key features. The discriminator network outputs the effectiveness score of the defense strategy to guide the generator optimization.

[0135] The loss function of the GAN model is constructed, including generator loss and discriminator loss. The generator loss includes strategy effectiveness loss and strategy diversity loss, which encourage the generator to generate effective and diverse defense strategies respectively. The discriminator loss uses cross entropy loss to measure the classification accuracy of the discriminator.

[0136] To train the GAN model, we use an alternating training method: first fix the generator, optimize the discriminator, then fix the discriminator and optimize the generator. During the training process, we can also introduce techniques such as gradient penalty and spectral normalization to improve training stability and generation quality.

[0137] Use the trained GAN model to generate defense strategy candidates, and obtain diversified defense strategies by randomly sampling the latent space vector of the generator. Perform risk assessment on the generated strategy candidates, calculate the expected utility and risk measurement of each strategy, and then select the appropriate defense strategy or strategy combination based on specific security requirements and risk preferences. Optionally, build a strategy selection model based on game theory, consider the game behavior of attackers and defenders, and solve the optimal hybrid strategy for both parties. Use the risk assessment result as the utility value of the strategy, and use game equilibrium concepts such as Nash equilibrium or Stackelberg equilibrium to solve the optimal defense strategy combination.

[0138] In this embodiment, by taking the attack behavior characteristics as conditional input, the generator network can generate corresponding defense strategies according to the specific attack behavior, realizing the ability of conditional generation. This conditional generation method is closer to the actual scenario and can better provide targeted defense strategies for different attack forms. By introducing strategy diversity loss in the generator loss function, the scheme can increase the diversity of defense strategies in the generation process, avoid being limited to a single strategy, and provide a rich strategy candidate space for the subsequent selection of the optimal strategy combination. The discriminator network extracts features and evaluates the effectiveness of the defense strategy through a convolutional neural network, providing a basis for evaluating the feasibility and effectiveness of the defense strategy. Through the adversarial game process of the generator and the discriminator and alternating training optimization, the ability to generate defense strategies and evaluate the effectiveness of defense strategies can be improved, and the robustness of the model is enhanced. The generated defense strategy candidates are risk assessed, and the optimal mixed strategy is solved based on game theory, and the defense strategy combination with the minimum risk is selected from multiple candidates to ensure the effectiveness and reliability of the defense strategy.

[0139] Figure 2 FIG. 1 is a schematic diagram of the structure of a network risk analysis system based on a multi-level game model according to an embodiment of the present invention. Figure 2 As shown, the system comprises:

[0140] The first unit is used to construct a multi-level dynamic game model, wherein the multi-level dynamic game model includes an attacker layer, a defender layer and a user layer, wherein the attacker layer is used to describe the attacker's attack strategy, the defender layer is used to describe the defender's defense strategy, and the user layer is used to describe the user's behavior strategy;

[0141] The second unit is used to decompose the multi-level game problem into several sub-game problems corresponding to different network levels based on the constructed multi-level dynamic game model, and use the multi-level game equilibrium solution algorithm to solve each sub-game problem separately by using the reverse induction method. Through iterative optimization until the preset conditions are met, the multi-level game equilibrium solution is obtained;

[0142] The third unit is used to input the obtained multi-layer game equilibrium solution into a pre-trained multi-level risk assessment model and output a risk assessment value. When the risk assessment value exceeds a preset risk warning threshold, the strategy adjustment mechanism is triggered to update the defense strategy by recalculating the multi-layer game equilibrium solution, and finally obtain the optimal defense strategy combination under risk minimization.

[0143] According to a third aspect of the embodiments of the present invention,

[0144] An electronic device is provided, comprising:

[0145] processor;

[0146] a memory for storing processor-executable instructions;

[0147] The processor is configured to call the instructions stored in the memory to execute the aforementioned method.

[0148] A fourth aspect of the embodiments of the present invention is:

[0149] A computer-readable storage medium is provided, on which computer program instructions are stored. When the computer program instructions are executed by a processor, the aforementioned method is implemented.

[0150] The present invention may be a method, an apparatus, a system and / or a computer program product. The computer program product may include a computer-readable storage medium carrying computer-readable program instructions for executing various aspects of the present invention.

[0151] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or replace some or all of the technical features therein with equivalents. However, these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention.

Claims

1. A network risk analysis method based on a multi-level game model, characterized in that: include: Constructing a multi-level dynamic game model, wherein the multi-level dynamic game model includes an attacker layer, a defender layer, and a user layer, wherein the attacker layer is used to describe the attacker's attack strategy, the defender layer is used to describe the defender's defense strategy, and the user layer is used to describe the user's behavior strategy; Based on the constructed multi-level dynamic game model, the multi-level game equilibrium solution algorithm is used to decompose the multi-level game problem into several sub-game problems corresponding to different network levels. The reverse induction method is used to solve each sub-game problem separately. Through iterative optimization until the preset conditions are met, the multi-level game equilibrium solution is obtained. The obtained multi-layer game equilibrium solution is input into the pre-trained multi-level risk assessment model, and the risk assessment value is output. When the risk assessment value exceeds the preset risk warning threshold, the strategy adjustment mechanism is triggered, and the defense strategy is updated by recalculating the multi-layer game equilibrium solution. Finally, the optimal defense strategy combination under risk minimization is obtained, which includes: The game process of attackers, defenders, and users is mapped into the adversarial game process of the generator and the discriminator. The generator loss function including the strategy effectiveness loss and the strategy diversity loss, as well as the cross entropy discriminator loss function are constructed. The generator network and the discriminator network are optimized by alternating training to obtain a trained conditional generative adversarial network model. Use the trained conditional generative adversarial network model to generate multiple defense strategy candidates, conduct risk assessment on each defense strategy candidate, and obtain risk assessment results; A strategy selection model based on game theory is constructed, and the risk assessment results are used as the strategy utility value to solve the optimal mixed strategies of attackers and defenders and obtain the optimal defense strategy combination.

2. The method according to claim 1, characterized in that Building a multi-level dynamic game model includes: Construct a network layer set according to the multi-layer structure of the network, where each element represents a specific network layer; Define the mixed strategy space of the attacker and defender at each network level, which contains discrete strategy variables and continuous strategy variables, representing the strategy set that the attacker and defender can adopt at each network level, and introduce the strategy probability distribution of the attacker and defender to represent the probability of their strategy selection at each network level; Based on the obtained network level set and mixed strategy space, a multi-layer dynamic game model based on the Markov game process is constructed, and the state transfer matrix and utility function of the attacker and defender at each network level are defined. Among them, the state transfer matrix represents the strategy selection of the attacker and defender at each network level, and the utility function comprehensively considers the strategy probability distribution of the attacker and defender at each network level.

3. The method according to claim 1, characterized in that Based on the constructed multi-level dynamic game model, the multi-level game equilibrium solution algorithm is used to decompose the multi-level game problem into several sub-game problems corresponding to different network levels. The reverse induction method is used to solve each sub-game problem separately. Through iterative optimization until the preset conditions are met, the multi-level game equilibrium solution is obtained, including: The multi-level network is divided into multiple sub-networks using a multi-level partitioning algorithm, where each sub-network corresponds to a local game problem; In each subnet, a local strategy space is constructed and a distributed strategy optimization algorithm is designed. Through local information exchange and strategy update, the local game strategy is adaptively adjusted to obtain the local game equilibrium solution in each subnet. A consistency optimization model of a multi-level network game is designed based on the local game equilibrium solution in each subnet, and a distributed consistency optimization algorithm based on the alternating direction multiplier method is used to decompose the consistency optimization model into multiple sub-problems, and the distributed optimization results of the consistency optimization model are obtained by alternately solving each sub-problem; The distributed optimization steps of local game equilibrium solution and consistency optimization model are repeatedly executed until the convergence conditions are met to obtain the final multi-layer game equilibrium solution.

4. The method according to claim 3, characterized in that The distributed consistency optimization algorithm based on the alternating direction multiplier method is used to decompose the consistency optimization model into multiple sub-problems. The distributed optimization results of the consistency optimization model obtained by alternately solving each sub-problem include: Decompose the consistency optimization problem into local game equilibrium subproblems, global consistent strategy optimization subproblems and dual variable update subproblems; The global consistent strategy optimization subproblem and the dual variable update subproblem are fixed, and each subnetwork solves its own local game equilibrium subproblem to obtain the updated local strategy; Fix the updated local strategy and dual variable update subproblem, optimize the global consistent strategy optimization subproblem, minimize the difference between it and the local strategy of each subnet, and obtain the updated global consistent strategy; According to the updated local strategy and the global consistent strategy, the dual variable update subproblem is updated, and based on the updated dual variable obtained, the deviation between the local strategy and the global consistent strategy is adjusted; Repeat the iteration until the convergence condition is met and obtain the distributed optimization result of the consistent optimization model.

5. The method according to claim 1, characterized in that The obtained multi-layer game equilibrium solution is input into the pre-trained multi-level risk assessment model. The steps before outputting the equilibrium risk level include: Constructing a directed graph according to the multi-layer structure of the network, the directed graph includes nodes and directed edges, wherein the nodes represent game entities in the multi-layer structure of the network, the directed edges represent the strategic influence relationship between the game entities, and the weights of the directed edges represent the strength of the strategic influence relationship; Obtain the equilibrium strategy feature vector of the game subject corresponding to each node in the directed graph, use the equilibrium strategy feature vector as the initial embedded representation of the node, and iteratively update the initial embedded representation through multiple rounds of graph convolution operations to obtain an updated embedded representation; perform a global pooling operation on the updated embedded representation to obtain a pooled graph-level embedded representation vector, input the obtained graph-level embedded representation vector into the fully connected layer, and map it to a risk assessment value through a nonlinear activation function; Based on the directed graph, a graph neural network model is designed, and equilibrium state samples and their corresponding true risk value labels are introduced to construct a loss function of the graph neural network model. The parameters of the graph neural network model are optimized using a gradient descent optimization algorithm. The loss function is minimized through multiple iterations to obtain a trained graph neural network model. The obtained multi-layer game equilibrium solution is input into the trained graph neural network model, and the corresponding risk assessment value is output after constructing a directed graph, obtaining the equilibrium strategy feature vector, multiple rounds of graph convolution operations, global pooling operations and fully connected layer mapping operations.

6. The method according to claim 5, characterized in that The calculation formula for the loss function of the graph neural network model constructed by introducing equilibrium state samples and their corresponding true risk value labels is as follows: ； in, L represents the loss function, n represents the number of equilibrium state samples, i represents the equilibrium state sample index, r i represents the predicted risk assessment value of the i-th equilibrium state sample, y i represents the true risk value label of the i-th equilibrium state sample, λ1 represents the regularization coefficient of the first layer weight matrix of the fully connected layer, represents the Frobenius norm of the matrix, represents the first layer weight matrix of the fully connected layer, λ2 represents the regularization coefficient of the second layer weight matrix of the fully connected layer, represents the second layer weight matrix of the fully connected layer, μ represents the coefficient of KL divergence regularization, represents the probability distribution p(h G ) is the value of the ith equilibrium state sample, Represents the preset prior distribution q(h G ) is the value of the ith equilibrium state sample; The calculation formula of the risk assessment value is as follows: ； Where r represents the risk assessment value, σ(·) represents the activation function, and W r represents the weight matrix of the fully connected layer, V represents the node set of the directed graph, v represents the vth node, u represents the uth node, N(v) represents the neighbor node set of node v, α u,v represents the attention weight from node u to node v, W (k) represents the weight matrix of the k-th round of graph convolution operation, k represents the k-th round of graph convolution operation, represents the embedded representation of node u after the k-1th round of graph convolution operation, b (k) represents the bias vector of the k-th round of graph convolution operation, b r Represents the bias vector.

7. The method according to claim 1, characterized in that: The game process of attackers, defenders and users is mapped into an adversarial game process between generators and discriminators, in which the generator network takes the attack behavior features as conditional input, extracts the latent space representation of the attack behavior features through the encoder, and generates the corresponding defense strategy based on the latent space representation of the attack behavior features through the decoder; the discriminator network extracts the defense strategy features through a convolutional neural network and outputs the effectiveness score of the defense strategy.

8. A network risk analysis system based on a multi-level game model, used to implement the method described in any one of claims 1 to 7, characterized in that: include: The first unit is used to construct a multi-level dynamic game model, wherein the multi-level dynamic game model includes an attacker layer, a defender layer and a user layer, wherein the attacker layer is used to describe the attacker's attack strategy, the defender layer is used to describe the defender's defense strategy, and the user layer is used to describe the user's behavior strategy; The second unit is used to decompose the multi-level game problem into several sub-game problems corresponding to different network levels based on the constructed multi-level dynamic game model, and use the multi-level game equilibrium solution algorithm to solve each sub-game problem separately by using the reverse induction method. Through iterative optimization until the preset conditions are met, the multi-level game equilibrium solution is obtained; The third unit is used to input the obtained multi-layer game equilibrium solution into a pre-trained multi-level risk assessment model and output a risk assessment value. When the risk assessment value exceeds a preset risk warning threshold, the strategy adjustment mechanism is triggered to update the defense strategy by recalculating the multi-layer game equilibrium solution, and finally obtain the optimal defense strategy combination under risk minimization.

9. An electronic device, characterized in that: include: processor; a memory for storing processor-executable instructions; The processor is configured to call the instructions stored in the memory to execute the method described in any one of claims 1 to 7.

10. A computer-readable storage medium having computer program instructions stored thereon, characterized in that: When the computer program instructions are executed by a processor, the method according to any one of claims 1 to 7 is implemented.

Images