Network attack defense method and device and electronic equipment

Abstract

The invention provides a network attack defense method and device and electronic equipment. The method comprises the following steps: constructing a camouflage network; obtaining an attack strategy and a defense strategy; resource costs and attack and defense benefits corresponding to different attack strategies and defense strategies are obtained; constructing constraint conditions of strong epsilon equilibrium of the Stackelberg game based on the camouflage network, the attack strategies, the defense strategies, resource costs corresponding to different attack strategies and defense strategies and attack and defense benefits; respectively calculating and determining strong epsilon equilibrium corresponding to different attack strategies and defense strategies by combining constraint conditions for different attack strategies and defense strategies; establishing a matching relationship between an attack strategy and a defense strategy corresponding to strong epsilon equalization meeting a preset requirement; and when the target attack strategy attacks, determining a target defense strategy based on the matching relationship, and executing the target defense strategy. According to the method, effective defense can be carried out when an attacker in any condition issues an attack, and the defense effect is improved.

Description

Technical Field

[0001] The present invention belongs to the field of computer technology, and in particular relates to a network attack defense method, device and electronic equipment. Background Art

[0002] As the basic support for social production and operation activities, failures in critical infrastructure networks will seriously affect people's daily lives. Infrastructure is a facility system composed of buildings and base station equipment distributed throughout the country connected by pipelines and pipes. The relationship between a large number of node facilities forms an infrastructure network. In recent years, many methods have been proposed for the protection of infrastructure networks such as transportation, communications, and power grids, including probabilistic risk assessment, historical data assessment, threat modeling, and security testing. However, these methods all require the failure probability of nodes in the network to be defined as static inputs, which cannot model the behavior of participants well, and the entire process is not considered in the network attack and defense confrontation, and can only be used as a passive compensation measure. Therefore, how to protect critical infrastructure from paralysis is still a practical problem that needs to be solved urgently.

[0003] Network attack and defense need to accurately model key factors such as multi-party interaction, non-cooperation, incomplete information and strategy optimization in the confrontation process, and provide decision support through the prediction of confrontation behavior on this basis. Complex networks can provide suitable modeling tools for describing complex systems such as human infrastructure, and game theory can provide a mathematical framework for describing the confrontation process. Therefore, by establishing a complex network attack and defense game model and using mathematical methods to calculate the game equilibrium, it is possible to effectively predict and derive the optimal strategy of the defender, so as to take the initiative and avoid being passive in the confrontation.

[0004] In the research on infrastructure network protection, some researchers use game theory to study infrastructure networks, and some researchers use complex networks to analyze infrastructure systems. At the same time, there are also a large number of studies that combine network science and game theory to analyze the role of game models in infrastructure protection from a network perspective, and preliminarily explore the strategy choices of attackers and defenders in network confrontation. The composition of modern social infrastructure is becoming larger and larger, and the structure is becoming more and more complex, showing the complex characteristics of the network. The function of the infrastructure network depends to a large extent on the topological structure composed of node facilities and the connections between them. The failure of a single node facility may have a destructive effect on the system. Therefore, it is necessary to model the infrastructure as a network system for research. Most of the game research is based on simultaneous games, but in reality, in order to prevent infrastructure damage, security departments always defend before the attack occurs. Therefore, it is more realistic to use the Stackelberg Security Game (SSG) model that conforms to the actual situation of network attack and defense confrontation to carry out infrastructure network protection research. Specifically, after the leader submits a mixed strategy, the follower chooses its own pure strategy after observing and mastering the leader's strategy. In a network attack and defense environment, when defenders have limited resources and cannot fully protect key targets, they must rationally allocate limited resources.

[0005] Active defense is to help defenders develop targeted defense strategies. When studying infrastructure network protection based on network attack and defense confrontation, it is usually assumed that all structural information of the network is known. However, the network information of the defender obtained by the attacker may contain both missing information and false information. Incomplete information and false information themselves will interfere with the attacker's judgment, the attacker's actual attack effect will be discounted, and the defender's defense resources can be reduced accordingly. Summary of the invention

[0006] The technical problem to be solved by the present invention is to provide a network attack defense method, device and electronic equipment that can effectively defend against attacks launched by an attacker in any situation and improve the defense effect.

[0007] The present invention includes a network attack defense method, comprising:

[0008] constructing a camouflage network, the camouflage network corresponding to a critical infrastructure network within the target node set;

[0009] Obtain attack and defense strategies;

[0010] Obtain resource costs and attack and defense benefits corresponding to different attack strategies and defense strategies, where the resource cost is the price to be paid for attacking or protecting each node, and the attack and defense benefit is the benefit that can be obtained by attacking or protecting each node;

[0011] Based on the camouflage network, attack strategy, defense strategy, resource costs corresponding to different attack strategies and defense strategies, and attack and defense benefits, a constraint condition of a strong ε equilibrium of the Stackelberg game is constructed, and the constraint condition is used to solve the strong ε equilibrium;

[0012] For different attack strategies and defense strategies, respectively, the strong ε equilibrium corresponding to the different attack strategies and defense strategies is calculated and determined in combination with the constraint conditions;

[0013] Establishing a matching relationship between the attack strategy and the defense strategy corresponding to the strong ε equilibrium that meets the preset requirements, wherein the defense strategy in the matching relationship can ensure that when the camouflage network is attacked by the attack strategy in the matching relationship, the minimum benefit of the defender can be maximized;

[0014] When it is determined that the camouflaged network is attacked by the target attack strategy, a corresponding target defense strategy is determined based on the matching relationship, and the target defense strategy is executed.

[0015] In some embodiments, the step of constructing a camouflage network includes:

[0016] Determine the structure of critical infrastructure networks;

[0017] Changing the edges between different nodes in the structure of the critical infrastructure network to obtain the changed critical infrastructure network and the missing information ratio, wherein the edges represent the association relationship, and the missing information ratio represents the difference between the critical infrastructure network before and after the change;

[0018] Performing recovery processing on the changed structure of the critical infrastructure network based on the missing information ratio to obtain recovery process data;

[0019] Processing the recovery process data based on a graph convolutional network model to obtain a camouflage strategy for constructing a camouflage network, wherein different camouflage strategies change different edge types;

[0020] The critical infrastructure network is processed based on the camouflage strategy to obtain a camouflage network.

[0021] In some embodiments, obtaining the attack strategy includes:

[0022] Obtaining a first attack strategy, wherein the first attack strategy is a degree attack, and selecting some nodes to attack according to the degree ranking result of the nodes in the detected network;

[0023] Obtaining a second attack strategy, the second attack strategy is used to select a set of vulnerable nodes in the network for attack, the vulnerable nodes being a suitable control matrix consisting of a minimum number of nodes and having a minimum control cost;

[0024] A third attack strategy is obtained, wherein the third attack strategy selects nodes with low degree values ​​in the network in ascending order of degree values ​​to attack.

[0025] In some embodiments, obtaining resource costs corresponding to different attack strategies and defense strategies includes:

[0026] The resource cost c of attacking or defending each node is calculated based on the following formula: i :

[0027]

[0028] The α1∈[0,1] is the cost coefficient, β1∈[0,∞] is the feature correlation index, is the sum of the in-degree and out-degree of the node, and f[·] performs global normalization.

[0029] In some embodiments, corresponding to different types of attackers, obtaining the attack and defense benefits corresponding to different attack strategies and defense strategies includes:

[0030] When the type of the attacker is an immediate type, obtaining the change of the largest connected slice of the network involved before and after the disguised network attack and defense;

[0031] Determine the attack and defense benefits based on the analysis of the changes; or

[0032] When the type of the attacker is a long-term type, obtaining the sum of the maximum capacity of the nodes before and after the attack and defense of the camouflaged network;

[0033] The attack and defense benefits are determined based on the sum of the maximum capacities of the nodes.

[0034] In some embodiments, the attack and defense benefits include defender benefits and attacker benefits. When the attacker is of the instant type, the defender benefits are D and the attacker's payoff U A The calculations are based on the following formulas:

[0035]

[0036] When the attacker is of long-term type, the defender's gain is U D， Attacker benefits Determined based on the following calculation:

[0037]

[0038] Among them, G is the largest connected piece of the camouflage network in which the game formed by attack and defense is in equilibrium, CP i is the capacity limit of node i in network A, indicating the maximum load that node i can bear at the current time, CP j is the capacity limit of node j in network B, L i is the load of node i, L i (0) is the initial load, which is used to balance the relationship between the internal degree of the same network nodes and the coupling degree between different network nodes. remove is the set of nodes that are in a failed state and fail to distribute the load successfully from the attacker's perspective, and V is the set of nodes.

[0039] In some embodiments, the strong ε equilibrium is characterized by a set of attack strategies that the attacker can choose when faced with a specified defense strategy given a condition of ε≥0.

[0040] In some embodiments, the constraints include:

[0041] Indicates that the defender has adopted a mixed strategy i ∈S D , S D is the defender strategy set, is the probability of selecting a node for defense;

[0042] Used to ensure that all available strategies s against an attacker of type h j The sum of the ε-optimal strategies is at least 1, is the probability of all ε-optimal strategies available to the h-type attacker, S A is the attacker’s strategy set;

[0043] Used to ensure the best strategy s against an attacker of type h j Probability The sum of the distributions is 1;

[0044] The optimality conditions for solving the linear programming problem for all different types of attackers are as follows: j When it is the optimal strategy for the h-type attacker, we can get =1, m h is the upper limit of the profit that the h-type attacker can obtain, is the profit function of the h-type attacker, H is a positive number, and m is a constant;

[0045] The payoff for constraining the defender should be within the range of ε;

[0046] To ensure that the defender's total payoff is always greater than or equal to δ h , δ h is the defender's optional strategy with the lowest payoff. is the profit function when the attacker adopts the strategy;

[0047] Used to constrain the attacker to choose the best strategy s j Probability The probability that the strategy is selected as the ε-optimal strategy cannot exceed To ensure that the attacker's actual selected strategy should be within the range of ε strategies;

[0048] They are used to constrain the upper limit of resources used by attackers and defenders, r i A For attacker strategies j Node v in j The amount of resources that need to be allocated, r i D Strategies for defenders i Node v in i The amount of resources that need to be allocated, C A and C D are the total amount of resources available to the attacker and defender, respectively;

[0049] Among them, d i = [0,1],

[0050] Another embodiment of the present invention also provides a network attack defense device, including:

[0051] A first construction module is used to construct a camouflage network, where the camouflage network corresponds to a key infrastructure network in the target node set;

[0052] The first acquisition module is used to obtain attack strategies and defense strategies;

[0053] The second acquisition module is used to obtain the resource cost and attack and defense benefits corresponding to different attack strategies and defense strategies, wherein the resource cost is the price to be paid for attacking or protecting each node, and the attack and defense benefits are the benefits that can be obtained by attacking or protecting each node;

[0054] The second construction module is used to construct the constraint conditions of the strong ε equilibrium of the Stackelberg game according to the camouflage network, the attack strategy, the defense strategy, the resource costs corresponding to different attack strategies and defense strategies, and the attack and defense benefits, and the constraint conditions are used to solve the strong ε equilibrium;

[0055] A calculation module, used for respectively calculating and determining the strong ε equilibrium corresponding to different attack strategies and defense strategies in combination with the constraint conditions;

[0056] An establishment module is used to establish a matching relationship between the attack strategy and the defense strategy corresponding to the strong ε equilibrium that meets the preset requirements, and the defense strategy in the matching relationship can ensure that when the camouflage network is attacked by the attack strategy in the matching relationship, the minimum benefit of the defender can be maximized;

[0057] The execution module is used to determine a corresponding target defense strategy based on the matching relationship and execute the target defense strategy when it is determined that the disguised network is attacked by the target attack strategy.

[0058] Another embodiment of the present invention further provides an electronic device, comprising:

[0059] one or more processors;

[0060] a memory configured to store one or more programs;

[0061] When the one or more programs are executed by the one or more processors, the one or more processors implement the network attack defense method as described in any one of the embodiments above.

[0062] The beneficial effects of the present invention include solving the problems of incomplete information, multiple attacker types and insufficient rationality in existing schemes based on reverse thinking when facing attackers monitoring and attacking critical infrastructure networks. Specifically, a camouflage network setting method based on a graph convolutional network is proposed through the idea of ​​active defense, which can change the key goals and vulnerable characteristics of the network and prevent attackers from easily obtaining real network information; secondly, a strong ε equilibrium is designed to obtain the strategy preferences of defenders and attackers under different available resources, which provides a more valuable reference for the reasonable allocation of defender resources, thereby improving the scope and intensity of network attack defense.

[0063] Other features and advantages of the present application will be described in the following description, and partly become apparent from the description, or be understood by practicing the present application. The purpose and other advantages of the present application can be realized and obtained by the structures specifically pointed out in the written description, claims, and drawings.

[0064] The technical solution of the present application is further described in detail below through the accompanying drawings and embodiments. BRIEF DESCRIPTION OF THE DRAWINGS

[0065] In order to more clearly illustrate the specific implementation methods of the present invention or the technical solutions in the prior art, the drawings required for use in the specific implementation methods or the description of the prior art will be briefly introduced below. Obviously, the drawings in the following description are some implementation methods of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0066] Figure 1 It is a flowchart of the network attack defense method of the present invention.

[0067] Figure 2 The figure is a flowchart of a network attack defense method according to another embodiment of the present invention.

[0068] Figure 3 The figure is a flowchart of a network attack defense method according to another embodiment of the present invention.

[0069] Figure 4 It is a structural block diagram of the network attack defense device of the present invention. DETAILED DESCRIPTION

[0070] The specific embodiments of the present invention are described in detail below with reference to the accompanying drawings, but are not intended to limit the present invention.

[0071] It should be understood that various modifications may be made to the embodiments disclosed herein. Therefore, the following description should not be considered as limiting, but merely as an example of an embodiment. Other modifications within the scope of the present disclosure will occur to those skilled in the art.

[0072] The accompanying drawings, which are incorporated in and constitute a part of the specification, illustrate embodiments of the present disclosure and, together with the general description of the present disclosure given above and the detailed description of the embodiments given below, serve to explain the principles of the present disclosure.

[0073] These and other characteristics of the invention will become apparent from the following description of a preferred form of embodiment given as a non-limiting example, with reference to the accompanying drawings.

[0074] It should also be understood that, although the invention has been described with reference to some specific examples, those skilled in the art will be able to realize many other equivalent forms of the invention that have the characteristics recited in the claims and are therefore within the scope of protection defined thereby.

[0075] The above and other aspects, features and advantages of the present disclosure will become more apparent from the following detailed description when taken in conjunction with the accompanying drawings.

[0076] Specific embodiments of the present disclosure are described hereinafter with reference to the accompanying drawings; however, it should be understood that the disclosed embodiments are merely examples of the present disclosure, which may be implemented in a variety of ways. Well-known and / or repeated functions and structures are not described in detail to avoid obscuring the present disclosure with unnecessary or redundant details. Therefore, the specific structural and functional details disclosed herein are not intended to be limiting, but merely serve as a basis and representative basis for the claims to teach those skilled in the art to use the present disclosure in a variety of ways with substantially any suitable detailed structure.

[0077] This specification may use the phrases "in one embodiment," "in another embodiment," "in a further embodiment," or "in other embodiments," all of which may refer to one or more of the same or different embodiments according to the present disclosure.

[0078] The embodiments of the present invention are described in detail below with reference to the accompanying drawings.

[0079] like Figure 1 As shown, the present invention provides a network attack defense method, comprising:

[0080] S1: constructing a camouflage network, wherein the camouflage network corresponds to a key infrastructure network in a target node set;

[0081] S2: Obtain attack strategy and defense strategy;

[0082] S3: Obtain resource costs and attack and defense benefits corresponding to different attack strategies and defense strategies. The resource cost is the price to be paid for attacking or protecting each node, and the attack and defense benefit is the benefit that can be obtained by attacking or protecting each node. The attack and defense benefit is related to the attacker type.

[0083] S4: constructing constraints of a strong ε equilibrium of the Stackelberg game based on the camouflage network, the attack strategy, the defense strategy, the resource costs corresponding to different attack strategies and defense strategies, and the attack and defense benefits, wherein the constraints are used to solve the strong ε equilibrium;

[0084] S5: for different attack strategies and defense strategies, respectively calculate and determine the strong ε equilibrium corresponding to the different attack strategies and defense strategies in combination with the constraint conditions;

[0085] S6: Establishing a matching relationship between the attack strategy and the defense strategy corresponding to the strong ε equilibrium that meets the preset requirements, wherein the defense strategy in the matching relationship can ensure that when the camouflage network is attacked by the attack strategy in the matching relationship, the minimum benefit of the defender can be maximized;

[0086] S7: When it is determined that the disguised network is attacked by the target attack strategy, a corresponding target defense strategy is determined based on the matching relationship, and the target defense strategy is executed.

[0087] The critical infrastructure network in this embodiment may include, but is not limited to, a network formed by association of multiple physical facilities, such as communication buildings, server facilities, power supply stations, combat equipment, etc. When facing monitoring and attacks by competitors in the mall or enemies on the battlefield, the network attack defense method provided in this embodiment can be used to achieve effective defense.

[0088] Real infrastructure networks are generally not single networks. They are more or less physically attached to other networks, have coupling relationships such as information exchange, etc., and are interdependent and mutually influential with other networks, and work together, such as power grids and computer networks, air route networks and railway networks. Some power outages are caused by the failure of power grid nodes, which leads to the failure of computer network nodes, and the inability to effectively regulate the power grid, which in turn causes large-scale power outages. Studying such dependent networks can deepen the deep understanding of the network attack and defense confrontation process. At present, the defense method for network attacks is usually a passive static defense method, but this passive static defense method does not fully use the attacker's observation bias to actively affect the attacker itself, and consumes huge defense resources, making this type of method difficult to apply in practice. In order to solve this problem, a protection method that does not change the original network structure is needed. Therefore, this embodiment proposes to achieve network protection under incomplete information conditions by camouflaging a network. A camouflaged network is a network in which the defender adds interference information during the attack and defense confrontation process, so that the attacker observes the wrong network structure. The attacker observes this information and believes that the camouflaged network is the real infrastructure network, thereby interfering with his judgment and decision-making, and ultimately reducing the threat of the attacker. The definition of a camouflage network in this embodiment is: in the process of network attack and defense confrontation under conditions of incomplete information, in order to interfere with the attacker's judgment and decision-making from the observation link, the defender actively and selectively changes the structural information represented by the network by hiding some information, adding false information, etc., to form a new observation network.

[0089] In this embodiment, based on the functional element network and the organizational structure network, the multi-coupled dependent network model of the infrastructure network is constructed by combining the node functional attributes and the network topology. The multi-coupled dependent network model consists of two single-layer networks A and B, including nodes, intra-node edges, and multi-coupled edges between sub-networks. Specifically, when constructing a camouflage network, the method used in this embodiment includes:

[0090] S9: Determine the structure of critical infrastructure networks;

[0091] S10: changing the edges between different nodes in the structure of the critical infrastructure network to obtain the changed critical infrastructure network and the missing information ratio, wherein the edges represent the association relationship, and the missing information ratio represents the difference between the critical infrastructure network before and after the change;

[0092] S11: restoring the changed structure of the critical infrastructure network based on the missing information ratio to obtain restoration process data;

[0093] S12: Processing the recovery process data based on the graph convolutional network model to obtain a camouflage strategy for building a camouflage network, where different camouflage strategies change different edge types;

[0094] S13: Process the critical infrastructure network based on the camouflage strategy to obtain a camouflage network.

[0095] For example, a multi-coupled dependent network model of the infrastructure is established, and then on this basis, the target network and the proportion of missing information are determined by removing and adding node edges. Then, the missing structural information of the target network is restored based on the Logical-default Attention Graph Convolution Neural Network (DA-GCN), and then the predicted edges are classified to form a camouflage strategy. Finally, based on the camouflage strategy, different camouflage requirements are combined, such as changes to different types of edges, to obtain a camouflaged network.

[0096] Further, the network attack and defense confrontation model is used to describe and analyze the model of strategic interaction and reaction relationship between attackers and defenders in terrorist attacks. The defense strategy may trigger a change in the attack strategy, and the attack strategy may also force the defense strategy to adjust. This interaction is similar to the leader-follower interaction in the Stackelberg game, in which the follower reacts according to the leader's actions. In this embodiment, a network attack and defense game model is established with reference to the basic settings of the Stackelberg game model to formally describe the node interaction relationship. Considering that cascading failures will occur after the nodes in the network are attacked, this process is also added to the game. At the same time, under the guidance of the active defense idea, the camouflage network is designed in combination with the vulnerable characteristics to solve the problem of unknown attacker type and changing rationality. In the process of modeling the Stackelberg game, the participants, strategy sets, utility functions, etc. in the game model are generally formally described, and then the optimal strategies of the defender and attacker and the corresponding utility values ​​and other related issues can be obtained by solving the game model. Based on the Stackelberg game model, the defender will first commit to adopting its mixed strategy, and then actively reveal the strategy to force the attacker to choose a pure strategy. Rational attackers and defenders do not formulate strategies randomly, but follow certain rules to attack the vulnerable parts of the network. Existing studies have shown that the degree attack method can reduce the absolute capacity of the network, and the vulnerable attack method has a high cost-effectiveness. Therefore, in the modeling of network games, that is, in the modeling process of the model used in the system to execute the above method of this embodiment, this embodiment proposes to define three attack and defense strategies that can be selected in the game based on random attack, degree attack and betweenness attack methods, including:

[0097] Obtaining a first attack strategy, wherein the first attack strategy is a degree attack, and selecting some nodes to attack according to the degree ranking result of the nodes in the detected network;

[0098] The first attack strategy (DA for short) is a degree attack, which selects some nodes for attack according to the degree value of the nodes in the network. Attackers who choose the DA strategy often do not consider the issue of attack resources, hoping to minimize the defender's capabilities. In order to avoid inconsistent attack resource allocation, it is required to complete the attack strategy distribution in the form of total resource settings under different attack methods. The attack resources are related to the cost of the node. The total attack cost under the vulnerable attack method is taken as the benchmark cost. The total attack resources of the selected nodes under the degree attack method are greater than or equal to the benchmark cost. However, after removing a node with the smallest attack cost, the attack cost of this method is less than the total attack resources. Finally, the nodes to be attacked under the three attack methods can be obtained.

[0099] Obtaining a second attack strategy, the second attack strategy is used to select a set of vulnerable nodes in the network for attack, the vulnerable nodes being a suitable control matrix consisting of a minimum number of nodes and having a minimum control cost;

[0100] The second attack strategy (PA for short) first selects a set of vulnerable nodes in the network for attack. A vulnerable node is a suitable control matrix composed of the least number of nodes and has the minimum control cost. Vulnerable nodes can be obtained using precise controllability methods. The vulnerable node attack method aims to launch an attack on the nodes in the vulnerable node set at the same time. On this basis, the remaining resources are then ordered from large to small in degree value, and some high-value nodes are selected for attack. The PA strategy combines the advantages of degree value attack and vulnerable attack. Attackers who choose this strategy are often limited to certain attack resources, but hope that the remaining resources can achieve better attack effects.

[0101] A third attack strategy is obtained, wherein the third attack strategy selects nodes with low degree values ​​in the network in ascending order of degree values ​​to attack.

[0102] Similar to the PA strategy, the third attack strategy (NA for short) also first selects the vulnerable attack method, but the difference is that this strategy selects nodes with low degree values ​​to attack in order from small to large. The NA strategy is an extension of the vulnerable attack method. Attackers who choose this strategy use the remaining resources after the vulnerable attack to attack more nodes, hoping to achieve the maximum cost-effectiveness of the attack method.

[0103] Furthermore, resource cost is generally positively correlated with the importance of the node. The attack cost of a node is the price to be paid for causing the node to fail due to an attack. The node degree value reflects the importance of the node to a certain extent. Therefore, based on a directed network, the attack cost of a node is measured by the degree value. That is, the larger the degree, the more edges the node is connected to, the wider the impact on the directed network, and the greater the difficulty of the attack. Similarly, the defense cost refers to the resource cost required by the defender to respond to the attacker's node attack and prevent the node from failing. Its value is the same as the attack cost. Therefore, the resource cost corresponding to different attack strategies and defense strategies includes:

[0104] S14: Determine the resource cost c of attacking or defending each node based on the following calculation: i :

[0105]

[0106] The α1∈[0,1] is the cost coefficient, β1∈[0,∞] is the feature correlation index, is the sum of the in-degree and out-degree of the node, and f[·] performs global normalization.

[0107] The adversarial game process needs to consider the interaction between nodes. In the game, when the attacker chooses the attack strategy s j ∈S A Afterwards, we can obtain the strategy set s for multi-coupled dependent networks: j =[a1, a2, ···, a N ], when a i =1 indicates node v i will be attacked, otherwise, a i = 0. Similarly, the defender adopts a mixed strategy s i ∈S D The defense strategy set is defined as s i =[d1, d2, ···, d N ], where d i =1 means selecting node v in the network i Defend, otherwise, d i = 0. The attacker and defender use their own strategies and existing resources R D and R A Take action. Use C D and C A It represents the total cost required for the attacker to attack the node and the defender to choose the defense strategy, as shown in the formula:

[0108]

[0109] The attacker should take a cost no less than the cost of destroying the node to attack. If the node is not a defensive node d i =1, the attack is successful and the node and its related connections are deleted from the network; on the contrary, if the node is a defensive node, the attack fails and the node will not be removed. i The resource cost is used to measure the attack success rate η i , the probability of successfully attacking a non-defense node to failure is defined as: is the attack node v i The attack cost, is the node v i The cost of defensive resources paid.

[0110] In one embodiment, corresponding to different types of attackers, obtaining the attack and defense benefits corresponding to different attack strategies and defense strategies includes:

[0111] S15: When the type of the attacker is an immediate type, obtaining the change of the largest connected slice of the network involved before and after the disguised network attack and defense;

[0112] Determine the attack and defense benefits based on the analysis of the changes; or

[0113] S16: When the type of the attacker is a long-term type, obtaining the sum of the maximum capacity of the front and rear nodes of the disguised network attack and defense;

[0114] The attack and defense benefits are determined based on the sum of the maximum capacities of the nodes.

[0115] Specifically, the attack and defense benefits include the defender's benefits and the attacker's benefits. When the attacker is of the instant type, the defender's benefits U D and the attacker's payoff U A The calculations are based on the following formulas:

[0116]

[0117] When the attacker is of long-term type, the defender's gain is U D， Attacker benefits Determined based on the following calculation:

[0118]

[0119] Among them, G is the largest connected piece of the camouflage network in which the game formed by attack and defense is in equilibrium, CP i is the capacity limit of node i in network A, indicating the maximum load that node i can bear at the current time, CP j is the capacity limit of node j in network B, L i is the load of node i, L i (0) is the initial load, which is used to balance the relationship between the internal degree of the same network nodes and the coupling degree between different network nodes. remove is the set of nodes that are in a failed state and fail to distribute the load successfully from the attacker's perspective, and V is the set of nodes.

[0120] In this example, the defender's benefits come from three aspects: (1) the attacker attacks the already defended node; (2) the node with cascading failure is defended; (3) the isolated node is defended. The change of the largest connected piece of the network before and after the game is used to measure the benefits of the defender and the attacker, and the defender adopts a mixed strategy s i ∈S D When the attacker adopts the pure strategy s j ∈S A The calculation method of the defender's payoff function is U D , Similarly, define the attacker's profit function as U A , the specific calculation is shown in the above formula.

[0121] Furthermore, the network game model established in this embodiment is based on the Bayesian game to describe the game process, so it is necessary to judge the type of attacker. The type of attacker is derived from the measurement method of the attacker's maximum destructive ability to the network, and the measurement method is divided into two types: 1) The size of the change in the maximum connected set of the network; 2) The sum of the maximum capacity of the nodes before and after the network changes. Measurement method one corresponds to the immediate type of attacker ST, hoping to reduce the current maximum capacity of the network, and measurement method two corresponds to the long-term type of attacker LT, hoping to reduce the potential capacity of the network. For a given attacker type h∈H, the corresponding defender adopts a strategy, and the profit function when the attacker adopts the strategy is When calculating the attacker's payoff function, the calculation method is different for the two types of attackers: immediate type and long-term type. Assume that the attacker adopts strategy s j hour, is the instant type attacker's profit function, and the defender's profit is still U D , is the profit function of the long-term attacker, and the calculation method is:

[0122]

[0123] V remove It is the set of nodes that are in a failed state and fail to distribute the load successfully from the attacker's perspective.

[0124] In one embodiment, the strong ε equilibrium is characterized as the set of attack strategies that the attacker can choose when facing a specified defense strategy given ε≥0. In the game based on network attack and defense confrontation, the defender induces the attacker to strictly prefer the equilibrium strategy by choosing a strategy that is arbitrarily close to the equilibrium strategy he expects, and chooses the strategy that is more favorable to the defender when there are two indifferent strategies. During the game, the attacker observes the defender's strategy s i ∈S D After that, select strategy s j ∈S A , and finally reach the strong Stackelberg equilibrium solution Under the strong Stackelberg equilibrium, a pair of strategy combinations should at least meet the following three conditions to reach equilibrium:

[0125] (1) The defender executes the best response:

[0126]

[0127] (2) The attacker performs the best response:

[0128]

[0129] (3) When a tie occurs, the attacker chooses the strategy that is most beneficial to the defender:

[0130]

[0131] in, and The best set of responses for defenders and attackers respectively.

[0132] As one of the important factors affecting the outcome of the confrontation, the rationality of the participants is the basis for making decisions to best respond to changes in the offensive and defensive situation. In the game process, rational behavior can often optimize decisions and maximize their own interests. In the decision-making process, the attacker will consider various factors and choose the best action plan. Through rational decision-making, the attacker can reduce risks and uncertainties, improve the efficiency and success probability of the attack, and reduce the cost of the attack. In reality, the attacker may face problems such as incomplete information, cognitive limitations, and decision-making time limits. Heuristics, rules, or experience may be used to make decisions, and not necessarily comprehensive and detailed calculations and analysis, resulting in limited rationality decisions. In addition, the rationality of the attacker may also involve the constraints of many other factors, such as politics, history, culture, morality, etc. In the previous game modeling process, it is assumed that the attacker is rational and can make the best strategy. However, if the attacker is irrational due to various reasons, takes irrational or impulsive actions, and chooses strategies that are not in line with the maximum interest, then the rational strategy may not be able to adapt to the attacker's behavior pattern. If the Stackelberg game equilibrium is solved according to the rational attacker strategy, it may bring unexpected huge losses to the defender. Therefore, in order to avoid greater losses when facing irrational attackers, it is necessary to expand the range of equilibrium solutions, reduce the changes in defender benefits when facing attackers with different rationality, and finally find the optimal strategy combination. Based on this, this embodiment establishes a strong ε equilibrium based on the strong Stackelberg equilibrium. The strong ε equilibrium is a game equilibrium that only considers the changes in the rationality of the attacker while the defender remains completely rational. The strong ε equilibrium is not a fixed equilibrium point, but an optimal solution set, which means that the attacker can choose any strategy response within the solution set. For a given defender strategy s i ∈S D have:

[0133] Specifically, assuming that the attacker is bounded and rational, and does not necessarily adopt a completely utility-maximizing response strategy, then for any ε ≥ 0, the strong ε optimal solution set is:

[0134]

[0135] For a given ε ≥ 0, the defender strategy s i ∈SD , there exists an optimal solution set for the attacker The strong ε equilibrium of the Bayesian Stackelberg game can be obtained for:

[0136]

[0137] Using the network attack and defense confrontation model to protect infrastructure, it is necessary to avoid irrational attackers from bringing the worst results, which is in the best interests of the defender. Given multiple optimal responses belonging to the ε equilibrium, the strong ε equilibrium of the game considers that the attacker chooses the strategy that provides the lowest benefit to the defender, which can prevent the worst results.

[0138] In one embodiment, solving the strong ε equilibrium is solving the objective function Based on the above formula, the strong ε equilibrium can be obtained by substituting it into the objective function and combining it with the following constraints, where h is the type of attacker and p is h is the prior probability of the defender facing an attacker of type h, is the profit function when the attacker adopts the strategy, δ is the minimum profit of the defender, a and b are probabilities, and m is a constant. is a variable used for function linearization quadratic programming, H is a positive number, and the constraints involved in solving the strong ε equilibrium include:

[0139] Indicates that the defender has adopted a mixed strategy i ∈S D , S D is the defender strategy set, is the probability of selecting a node for defense;

[0140] Used to ensure that all available strategies s against an attacker of type h j The sum of the ε-optimal strategies is at least 1, is the probability of all ε-optimal strategies available to the h-type attacker, S A is the attacker’s strategy set;

[0141] Used to ensure the best strategy s against an attacker of type h j Probability The sum of the distributions is 1;

[0142] The optimality conditions for solving the linear programming problem for all different types of attackers are as follows: j When it is the optimal strategy for the h-type attacker, we can get =1, m his the upper limit of the profit that the h-type attacker can obtain, is the payoff function of the h-type attacker;

[0143] The payoff for constraining the defender should be within the range of ε;

[0144] To ensure that the defender's total payoff is always greater than or equal to δ h , δ h The strategy with the lowest payoff among the defender's available strategies;

[0145] Used to constrain the attacker to choose the best strategy s j Probability The probability that the strategy is selected as the ε-optimal strategy cannot exceed To ensure that the attacker's actual selected strategy should be within the range of ε strategies;

[0146] They are used to constrain the upper limit of resources used by attackers and defenders, r i A For attacker strategies j Node v in j The amount of resources that need to be allocated, r i D Strategies for defenders i Node v in i The amount of resources that need to be allocated, C A and C D are the total amount of resources available to the attacker and defender, respectively;

[0147] Among them, d i = [0,1],

[0148] After the strong ε equilibrium of each solution strategy under different attack strategies is determined based on the above constraints, the defense strategy with the maximum strong ε equilibrium is determined as the optimal strategy. At this time, the optimal strategy is matched and recorded with the attack strategy. The above steps are repeated until the optimal strategy corresponding to all attack strategies is determined. Then, an attack and defense strategy correspondence table can be formed. The subsequent system can quickly determine the defense strategy based on the correspondence table for defense.

[0149] Based on the above content, it can be seen that this embodiment solves the problems of incomplete information, multiple attacker types and insufficient rationality in existing solutions when facing attackers monitoring and attacking critical infrastructure networks based on reverse thinking. Specifically, it proposes a camouflage network setting method based on a graph convolutional network through active defense ideas, which can change the key goals and vulnerable characteristics of the network and prevent attackers from easily obtaining real network information; secondly, it designs a strong ε equilibrium and obtains the strategy preferences of defenders and attackers under different available resources, which provides a more valuable reference for the reasonable allocation of defender resources, thereby improving the scope and intensity of network attack defense.

[0150] like Figure 4 As shown, another embodiment of the present invention also provides a network attack defense device 100, including:

[0151] A first construction module is used to construct a camouflage network, where the camouflage network corresponds to a key infrastructure network in the target node set;

[0152] The first acquisition module is used to obtain attack strategies and defense strategies;

[0153] The second acquisition module is used to obtain the resource cost and attack and defense benefits corresponding to different attack strategies and defense strategies, wherein the resource cost is the price to be paid for attacking or protecting each node, and the attack and defense benefits are the benefits that can be obtained by attacking or protecting each node;

[0154] The second construction module is used to construct the constraint conditions of the strong ε equilibrium of the Stackelberg game according to the camouflage network, the attack strategy, the defense strategy, the resource costs corresponding to different attack strategies and defense strategies, and the attack and defense benefits, and the constraint conditions are used to solve the strong ε equilibrium;

[0155] A calculation module, used for respectively calculating and determining the strong ε equilibrium corresponding to different attack strategies and defense strategies in combination with the constraint conditions;

[0156] An establishment module is used to establish a matching relationship between the attack strategy and the defense strategy corresponding to the strong ε equilibrium that meets the preset requirements, and the defense strategy in the matching relationship can ensure that when the camouflage network is attacked by the attack strategy in the matching relationship, the minimum benefit of the defender can be maximized;

[0157] The execution module is used to determine a corresponding target defense strategy based on the matching relationship and execute the target defense strategy when it is determined that the disguised network is attacked by the target attack strategy.

[0158] Another embodiment of the present invention further provides an electronic device, comprising:

[0159] one or more processors;

[0160] a memory configured to store one or more programs;

[0161] When the one or more programs are executed by the one or more processors, the one or more processors implement the network attack defense method as described in any one of the above.

[0162] Furthermore, an embodiment of the present invention also provides a storage medium on which a computer program is stored, and when the program is executed by a processor, the network attack defense method described above is implemented. It should be understood that each solution in this embodiment has the corresponding technical effect in the above method embodiment, which will not be repeated here.

[0163] Furthermore, an embodiment of the present invention also provides a computer program product, which is tangibly stored on a computer-readable medium and includes computer-readable instructions, which, when executed, cause at least one processor to execute a network attack defense method such as that in the embodiment described above.

[0164] It should be noted that the computer storage medium of the present invention may be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, system or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access storage medium (RAM), a read-only storage medium (ROM), an erasable programmable read-only storage medium (EPROM or flash memory), an optical fiber, a portable compact disk read-only storage medium (CD-ROM), an optical storage medium, a magnetic storage medium, or any suitable combination of the above. In the present invention, a computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in combination with an instruction execution system, system or device. In the present invention, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, wherein a computer-readable program code is carried. This propagated data signal may take a variety of forms, including but not limited to an electromagnetic signal, an optical signal, or any suitable combination of the above. A computer-readable signal medium may also be any computer-readable medium other than a computer-readable storage medium that can send, propagate or transmit a program configured to be used by or in conjunction with an instruction execution system, system or device. The program code contained on the computer-readable medium may be transmitted using any appropriate medium, including but not limited to: wireless, antenna, optical cable, RF, etc., or any suitable combination of the above.

[0165] In addition, it will be appreciated by those skilled in the art that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage and optical storage, etc.) containing computer-usable program code.

[0166] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A system that specifies the functions of a box or multiple boxes.

[0167] These computer program instructions may also be stored in a computer-readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer-readable memory produce a product including an instruction system, which is implemented in the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0168] A person skilled in the art should understand that the discussion of any of the above embodiments is merely illustrative and is not intended to imply that the scope of protection of the present application is limited to these examples. In line with the concept of the present application, the technical features in the above embodiments or different embodiments may be combined, the steps may be implemented in any order, and there are many other variations of different aspects of one or more embodiments of the present application as described above, which are not provided in detail for the sake of simplicity.

Claims

1. A network attack defense method, characterized in that: include: constructing a camouflage network, the camouflage network corresponding to a critical infrastructure network within the target node set; Obtain attack and defense strategies; Obtain resource costs and attack and defense benefits corresponding to different attack strategies and defense strategies, where the resource cost is the price to be paid for attacking or protecting each node, and the attack and defense benefit is the benefit that can be obtained by attacking or protecting each node; Based on the camouflage network, attack strategy, defense strategy, resource costs corresponding to different attack strategies and defense strategies, and attack and defense benefits, a constraint condition of a strong ε equilibrium of the Stackelberg game is constructed, and the constraint condition is used to solve the strong ε equilibrium; For different attack strategies and defense strategies, respectively, the strong ε equilibrium corresponding to the different attack strategies and defense strategies is calculated and determined in combination with the constraint conditions; Establishing a matching relationship between the attack strategy and the defense strategy corresponding to the strong ε equilibrium that meets the preset requirements, wherein the defense strategy in the matching relationship can ensure that when the camouflage network is attacked by the attack strategy in the matching relationship, the minimum benefit of the defender can be maximized; When it is determined that the camouflaged network is attacked by the target attack strategy, a corresponding target defense strategy is determined based on the matching relationship, and the target defense strategy is executed.

2. The network attack defense method according to claim 1, characterized in that: The step of constructing a camouflage network includes: Determine the structure of critical infrastructure networks; Changing the edges between different nodes in the structure of the critical infrastructure network to obtain the changed critical infrastructure network and the missing information ratio, wherein the edges represent the association relationship, and the missing information ratio represents the difference between the critical infrastructure network before and after the change; Performing recovery processing on the changed structure of the critical infrastructure network based on the missing information ratio to obtain recovery process data; Processing the recovery process data based on a graph convolutional network model to obtain a camouflage strategy for constructing a camouflage network, wherein different camouflage strategies change different edge types; The critical infrastructure network is processed based on the camouflage strategy to obtain a camouflage network.

3. The network attack defense method according to claim 1, characterized in that: The obtaining of the attack strategy comprises: Obtaining a first attack strategy, wherein the first attack strategy is a degree attack, and selecting some nodes to attack according to the degree ranking result of the nodes in the detected network; Obtaining a second attack strategy, the second attack strategy is used to select a set of vulnerable nodes in the network for attack, the vulnerable nodes being a suitable control matrix consisting of a minimum number of nodes and having a minimum control cost; A third attack strategy is obtained, wherein the third attack strategy selects nodes with low degree values ​​in the network in ascending order of degree values ​​to attack.

4. The network attack defense method according to claim 1, characterized in that: The resource costs corresponding to different attack strategies and defense strategies are obtained, including: The resource cost c of attacking or defending each node is calculated based on the following formula: i : The α1∈[0,1] is the cost coefficient, β1∈[0,∞] is the feature correlation index, is the sum of the in-degree and out-degree of the node, and f[·] performs global normalization.

5. The network attack defense method according to claim 1, characterized in that: Corresponding to different types of attackers, the offensive and defensive benefits corresponding to different attack strategies and defensive strategies include: When the type of the attacker is an immediate type, obtaining the change of the largest connected slice of the network involved before and after the disguised network attack and defense; Determine the attack and defense benefits based on the analysis of the changes; or When the type of the attacker is a long-term type, obtaining the sum of the maximum capacity of the nodes before and after the attack and defense of the camouflaged network; The attack and defense benefits are determined based on the sum of the maximum capacities of the nodes.

6. The network attack defense method according to claim 5, characterized in that: The attack and defense benefits include the defender's benefits and the attacker's benefits. When the attacker is of the instant type, the defender's benefits U D and attacker benefits The calculations are based on the following formulas: When the attacker is of long-term type, the defender's gain is U D , the attacker's profit Determined based on the following calculation: Among them, G is the largest connected piece of the camouflage network in which the game formed by attack and defense is in equilibrium, CP i is the capacity limit of node i in network A, indicating the maximum load that node i can bear at the current time, CP j is the capacity limit of node j in network B, L i is the load of node i, L i (0) is the initial load, which is used to balance the relationship between the internal degree of the same network nodes and the coupling degree between different network nodes. remove is the set of nodes that are in a failed state and fail to distribute the load successfully from the attacker's perspective, and V is the set of nodes.

7. The network attack defense method according to claim 1, characterized in that: The strong ε equilibrium is characterized by a set of attack strategies that the attacker can choose when facing a specified defense strategy given a given ε≥0.

8. The network attack defense method according to claim 7, characterized in that: The constraints include: Indicates that the defender has adopted a mixed strategy i ∈S D , S D is the defender strategy set, is the probability of selecting a node for defense; Used to ensure that all available strategies s against an attacker of type h j The sum of the ε-optimal strategies is at least 1, is the probability of all ε-optimal strategies available to the h-type attacker, S A is the attacker’s strategy set; Used to ensure the best strategy s against an attacker of type h j Probability The sum of the distributions is 1; The optimality conditions for solving the linear programming problem for all different types of attackers are as follows: j When it is the optimal strategy for the h-type attacker, we can get =1, m h is the upper limit of the profit that the h-type attacker can obtain, is the profit function of the h-type attacker, H is a positive number, and m is a constant; The payoff for constraining the defender should be within the range of ε; To ensure that the defender's total payoff is always greater than or equal to δ h , δ h is the defender's optional strategy with the lowest payoff. is the profit function when the attacker adopts the strategy; Used to constrain the attacker to choose the best strategy s j Probability The probability that the strategy is selected as the ε-optimal strategy cannot exceed To ensure that the attacker's actual selected strategy should be within the range of ε strategies; They are used to constrain the upper limit of resources used by attackers and defenders, r i A For attacker strategies j Node v in j The amount of resources that need to be allocated, r i D Strategies for defenders i Node v in i The amount of resources that need to be allocated, C A and C D are the total amount of resources available to the attacker and defender, respectively; Among them, d i = [0,1], 9. A network attack defense device, characterized in that: include: A first construction module is used to construct a camouflage network, where the camouflage network corresponds to a key infrastructure network in the target node set; The first acquisition module is used to obtain attack strategies and defense strategies; The second acquisition module is used to obtain resource costs and attack and defense benefits corresponding to different attack strategies and defense strategies. The resource cost is the price to be paid for attacking or protecting each node, and the attack and defense benefit is the benefit that can be obtained by attacking or protecting each node; The second construction module is used to construct the constraint conditions of the strong ε equilibrium of the Stackelberg game according to the camouflage network, the attack strategy, the defense strategy, the resource costs corresponding to different attack strategies and defense strategies, and the attack and defense benefits, and the constraint conditions are used to solve the strong ε equilibrium; A calculation module, used for respectively calculating and determining the strong ε equilibrium corresponding to different attack strategies and defense strategies in combination with the constraint conditions; An establishment module is used to establish a matching relationship between the attack strategy and the defense strategy corresponding to the strong ε equilibrium that meets the preset requirements, and the defense strategy in the matching relationship can ensure that when the camouflage network is attacked by the attack strategy in the matching relationship, the minimum benefit of the defender can be maximized; The execution module is used to determine a corresponding target defense strategy based on the matching relationship and execute the target defense strategy when it is determined that the disguised network is attacked by the target attack strategy.

10. An electronic device, characterized in that: include: one or more processors; a memory configured to store one or more programs; When the one or more programs are executed by the one or more processors, the one or more processors implement the network attack defense method according to any one of claims 1 to 8.

Images