Malicious software propagation control method based on dynamics and game theory in cloud environment

Abstract

The invention relates to a malicious software propagation control method based on dynamics and a game theory in a cloud environment, and belongs to the field of network propagation and control. The method comprises the following steps: 1) performing state division on a virtual machine according to an actual application scene, and constructing a dynamic model to describe a propagation process of malicious software in a network; 2) determining strategy forms of a malicious software attacker and a malicious software defender, and quantifying attack income and defense loss; 3) establishing a dynamic game model according to the attack and defense confrontation relationship; 4) according to a Pontryagin maximum / minimum principle, deriving an optimality system for solving the game model; 5) based on a forward and backward scanning method, designing an algorithm to provide a numerical solution for the optimality system; and 6) comparing a plurality of methods, and giving an optimal defense strategy. The defense problem is researched under the attack of the malicious software, the actual malicious software propagation condition is better met, and the provided defense method can effectively control the propagation of the malicious software in the cloud environment.

Description

Technical Field

[0001] The present invention belongs to the field of network propagation and control, and relates to a malware propagation control method based on dynamics and game theory in a cloud environment. Background Art

[0002] As an advanced computer technology, cloud computing divides a physical server into multiple virtual servers by utilizing virtualization technology, which reduces service costs while solving the problem of limited resources, and brings many benefits to people's daily life and work. Specifically, cloud platforms can provide virtual machines of various specifications and configurations to meet the needs of users in different scenarios. At the same time, these platforms allow users to install various software applications and seamlessly migrate large amounts of data to cloud storage, which greatly simplifies data management and ensures convenient access to data. However, the openness and virtualization characteristics of cloud computing also introduce more complex and changeable network security challenges, especially the significantly increased risk of malware intrusion. Malware can penetrate the network, steal sensitive data, and destroy system integrity, posing a serious threat to the security of the cloud environment. Therefore, while enjoying the convenience brought by cloud computing, maintaining the security of the cloud environment has become an important and urgent issue that cannot be ignored.

[0003] At present, researchers at home and abroad have developed various detection and removal technologies to solve the problem of malware intrusion. However, malware technology is also evolving rapidly, and its concealment, variability and adaptability are constantly increasing, making traditional detection and removal methods often unable to keep up with the emergence of new threats. Therefore, it is of great significance to deeply study the propagation law of malware in the network and find effective defense methods. Modeling analysis is a very effective method. It divides the device into different states and constructs a dynamic model to study the propagation behavior of malware on the network, providing a scientific basis for formulating defense strategies. The epidemic model is widely used to study the propagation of malware. Based on this, researchers have proposed a large number of propagation models from different perspectives to curb the spread of malware. However, most of the existing models only focus on the propagation characteristics of malware, or explore how to curb the spread of malware from the perspective of defenders. In fact, attack and defense behaviors affect each other, and changes in either side may have a profound impact on the overall security situation. Therefore, it is necessary to study defense methods from the perspective of both attack and defense to effectively control the spread of malware in cloud environments. Summary of the invention

[0004] In view of this, an object of the present invention is to provide a malware propagation control method based on dynamics and game theory in a cloud environment.

[0005] In order to achieve the above object, the present invention provides the following technical solutions:

[0006] The malware propagation control method based on dynamics and game theory in cloud environment includes the following steps:

[0007] Step 1: Divide the virtual machine states according to the actual application scenario and build a dynamic model to describe the spread of malware in the network;

[0008] Step 2: Determine the strategies of malware attackers and defenders, and quantify the gains from attacks and losses from defenses.

[0009] Step 3: Establish a dynamic game model based on the confrontational relationship between attack and defense;

[0010] Step 4: According to Pontryagin's maximum / minimum principle, derive the optimal system to solve the game model;

[0011] Step 5: Based on the forward and backward scanning method, design an algorithm to provide a numerical solution for the optimal system;

[0012] Step 6: Compare multiple methods and provide the best defense strategy.

[0013] Optionally, the specific process of step 1 includes: based on the idea of ​​graph theory, let the undirected graph G = {V, E} represent the topological structure of the communication network, and the node V = {v1, v2, ..., v N} represents the set of virtual machines, and edge E represents the information interaction relationship between virtual machines. i ,v j )∈E represents that virtual machines i and j can exchange information through the network. A=[a ij ] N×N To represent the adjacency matrix of the propagation network, if (v i ,v j )∈E, then a ij =1, indicating that virtual machines can exchange information, a ij =0 otherwise.

[0014] Based on the application scenario analysis, in a cloud environment, each virtual machine may be in one of the following three states:

[0015] Susceptible state (S): The state in which a virtual machine in the cloud is vulnerable to malware attacks but is not infected.

[0016] Infection status (I): The status of a virtual machine in the cloud being infected by malware.

[0017] Protected state (P): The state in which a virtual machine in the cloud is not infected and is immune to malware attacks.

[0018] Let X i (t) = 0, X i (t) = 1 and X i(t) = 2 indicates that virtual machine i is in susceptible, infected and protected states respectively. i (t), I i (t) and P i (t) represent the probability of virtual machine i being in susceptible, infected and protected states at time t, respectively. i (t)+I i (t)+P i (t) = 1, then the vector E(t) = {S1(t),…,S N (t),I1(t),…,I N (t),P1(t),…,P N (t)} represents the network status at time t.

[0019] Under the influence of various factors, the states of nodes will transform into each other. We introduce the following assumptions to describe the state transfer process:

[0020] (i)γ: The probability that a susceptible VM in the cloud becomes infected due to information interaction with an infected VM.

[0021] (ii) α: the probability that a virtual machine changes from a susceptible state to an infected state due to an attacker launching an attack on the virtual machine.

[0022] (iii)δ: the probability that a VM changes from infected state to susceptible state due to system reinstallation.

[0023] (iv) ε: the probability that a virtual machine changes from a protected state to a vulnerable state due to the inability of the antivirus software to work effectively.

[0024] (v)η: The probability that a virtual machine changes from a vulnerable state to a protected state due to the defender installing the latest antivirus software.

[0025] (vi) β: The probability that a VM changes from an infected state to a protected state due to the defender repairing the infected VM.

[0026] Based on the above assumptions, the differential equation corresponding to the malware propagation dynamics model is as follows:

[0027]

[0028] Optionally, in step 2, we need to determine the strategy forms of the attacker and defender, and quantify the attack benefits and defense losses: let A and D represent the malware attacker and defender respectively, and we need to give the strategies of A and D.

[0029] It can be seen from the dynamics model that the malware attack rate α i (t) Antivirus software installation rate η under the control of the attacker i(t) and malware repair rate β i (t) is under the control of the defender. On this basis, let the piecewise continuous function S A and S D Representing the strategies of attacker and defender respectively:

[0030] S A =(α1(t),...,α N (t))

[0031] S D =(η1(t),...,η N (t),β1(t),...,β N (t))

[0032] Since the control resources and costs are limited, the control function is bounded. Let and Represents α i (t),η i (t) and β i (t) is an upper bound. We can get and The feasible strategy sets for the attacker and defender are:

[0033]

[0034] Furthermore, we quantify the attack benefits and defense losses: In order to measure the expected net benefits of the attacker and the expected total losses of the defender, we assume that w A is the average profit brought to the attacker by an infected virtual machine per unit time, w D is the average loss caused to the defender by an infected virtual machine per unit time. At any time, let ρ i (α(t)) represents the cost of malware attacking a susceptible virtual machine, θ i (η(t)) and ξ i (β(t)) represents the cost of installing antivirus software for vulnerable virtual machines and repairing infected virtual machines. The net benefit of the attacker is equal to the benefit from a successful attack minus the cost of executing the attack strategy. The attack benefit G A =(S A ,S D )for:

[0035]

[0036] The total loss of the defender is equal to the loss caused by a successful attack plus the cost of executing the defense strategy, so the defense loss L D =(S A ,S D )for:

[0037]

[0038] Optionally, in step 3, a dynamic game model is established based on the attack and defense confrontation relationship: in the malware attack and defense process, the attacker hopes to maximize its profit G A (S A ,S D ), the defender hopes to minimize its loss L D (S A ,S D ). Therefore, we model this problem as a differential game model and solve it from the concept of Nash equilibrium solution. Nash equilibrium is a solution concept in game theory, representing a stable equilibrium state where both participants cannot unilaterally change their strategies to obtain higher returns.

[0039] If the strategy is If the following conditions are met, then it is the Nash equilibrium of the game:

[0040]

[0041] On the one hand, when the defender chooses a defensive strategy In order to maximize its benefits, the attacker must choose an attack strategy Similarly, when the attacker chooses an attack strategy The defender cannot deviate To reduce losses. Therefore, the strategy is It is acceptable to both the attacker and the defender.

[0042] Based on the above discussion, the malware attack and defense dynamic game model can be represented by the following 14-tuple:

[0043]

[0044] Optionally, in step 4, according to the Pontryagin maximum / minimum principle, an optimality system is derived to solve the game model:

[0045] According to differential game theory, the Hamiltonian function of the malware attacker is constructed as:

[0046]

[0047] At the same time, the Hamiltonian function of the malware defender is constructed as:

[0048]

[0049] in, and HA and H D The companion vector of .

[0050] According to Pontryagin's maximum / minimum principle, we can get the optimal system for solving the game model:

[0051]

[0052] Its boundary conditions are:

[0053]

[0054] The differential equations corresponding to the dynamic model and the above formula constitute an optimality system. By solving this optimality system, the best defense strategy can be obtained.

[0055] Optionally, in step 5, based on the forward and backward scanning method, an algorithm is designed to provide a numerical solution for the optimal system, specifically including:

[0056]

[0057] Optionally, in step six, multiple methods are compared to give the best defense strategy: We executed the proposed algorithm on three real network structures: Facebook, Twitter and P2P, and obtained the best defense strategy by solving the optimal system, verifying the effectiveness of the method.

[0058] The beneficial effects of the present invention are as follows: the present invention proposes a malware propagation control method based on dynamics and game theory in a cloud environment, comprising: 1) constructing a dynamic model to characterize the propagation process of malware in a network in a cloud environment; 2) using game theory to analyze the malware attack and defense process, and establishing a dynamic game model; 3) according to the Pontryagin maximum / minimum principle, deriving an optimal system for solving the game model, and designing an algorithm to provide a numerical solution for it; 4) proving the effectiveness of the proposed method through a variety of comparative experiments, and providing the best defense method that can effectively reduce the losses of the defender.

[0059] Other advantages, objectives and features of the present invention will be described in the following description to some extent, and to some extent, will be obvious to those skilled in the art based on the following examination and study, or can be taught from the practice of the present invention. The objectives and other advantages of the present invention can be realized and obtained through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0060] In order to make the purpose, technical solutions and advantages of the present invention more clear, the present invention will be described in detail below in conjunction with the accompanying drawings, wherein:

[0061] Figure 1 A flowchart of a method for defending against malware propagation in a cloud environment;

[0062] Figure 2 State transition diagram for malware propagation. DETAILED DESCRIPTION

[0063] The following describes the embodiments of the present invention by specific examples, and those skilled in the art can easily understand other advantages and effects of the present invention from the contents disclosed in this specification. The present invention can also be implemented or applied through other different specific embodiments, and the details in this specification can also be modified or changed in various ways based on different viewpoints and applications without departing from the spirit of the present invention. It should be noted that the illustrations provided in the following embodiments only illustrate the basic concept of the present invention in a schematic manner, and the following embodiments and features in the embodiments can be combined with each other without conflict.

[0064] Among them, the drawings are only used for illustrative explanations, and they only represent schematic diagrams rather than actual pictures, and should not be understood as limitations on the present invention. In order to better illustrate the embodiments of the present invention, some parts of the drawings may be omitted, enlarged or reduced, and do not represent the size of actual products. For those skilled in the art, it is understandable that some well-known structures and their descriptions in the drawings may be omitted.

[0065] The same or similar numbers in the drawings of the embodiments of the present invention correspond to the same or similar parts; in the description of the present invention, it should be understood that if the terms "upper", "lower", "left", "right", "front", "rear", etc. indicate the orientation or position relationship, they are based on the orientation or position relationship shown in the drawings, which is only for the convenience of describing the present invention and simplifying the description, rather than indicating or implying that the device or element referred to must have a specific orientation, be constructed and operate in a specific orientation. Therefore, the terms describing the position relationship in the drawings are only used for illustrative purposes and cannot be understood as limiting the present invention. For ordinary technicians in this field, the specific meanings of the above terms can be understood according to specific circumstances.

[0066] See also Figure 1-2 The present invention provides a malware propagation control method based on dynamics and game theory in a cloud environment. Figure 1 The following is a flowchart for the specific implementation.

[0067] Figure 2 This is a malware propagation state transition diagram of the present invention. The following is an explanation with reference to the accompanying drawings, including the following steps:

[0068] Optionally, step 1 specifically includes: in a cloud environment, classifying virtual machines into susceptible, infected, and protected states according to whether they are invaded by malware. Based on graph theory, let the undirected graph G = {V, E} represent the topological structure of the propagation network, and the nodes V = {v1, v2, ..., v N} represents the set of virtual machines, and edge E represents the information interaction relationship between virtual machines. Then, the model hypothesis is introduced to establish the transition relationship between states, and a dynamic model is constructed to simulate the spread of malware in the network.

[0069] Each VM can be in one of the following three states: Susceptible state (S): The state in which the VM in the cloud is vulnerable to malware attacks but is not infected. Infected state (I): The state in which the VM in the cloud is infected by malware. Protected state (P): The state in which the VM in the cloud is not infected and is immune to malware attacks.

[0070] (i)γ: The probability that a susceptible VM in the cloud becomes infected due to information interaction with an infected VM.

[0071] (ii) α: the probability that a virtual machine changes from a susceptible state to an infected state due to an attacker launching an attack on the virtual machine.

[0072] (iii)δ: the probability that a VM changes from infected state to susceptible state due to system reinstallation.

[0073] (iv) ε: the probability that a virtual machine changes from a protected state to a vulnerable state due to the inability of the antivirus software to work effectively.

[0074] (v)η: The probability that a virtual machine changes from a vulnerable state to a protected state due to the defender installing the latest antivirus software.

[0075] (vi) β: The probability that a VM changes from an infected state to a protected state due to the defender repairing the infected VM.

[0076] Figure 2 is a state transition diagram, then the evolution of malware propagation on the network obeys the following differential dynamic system:

[0077]

[0078] Optionally, step two specifically includes: determining the strategy forms of the attacker and the defender, measuring the attack gain and defense loss, and establishing a game model.

[0079] α i (t) is the malware attack rate, η i (t) is the anti-virus software installation rate, β i (t) is the malware repair rate. Since the control resources and costs are limited, the control function is bounded. Let and Represents α i (t),η i (t) and β i (t) is an upper bound. We can get and The feasible strategy sets for the attacker and defender are:

[0080]

[0081] Further, quantify the attack benefits and defense losses:

[0082] The net profit of the attacker is equal to the profit from a successful attack minus the cost of executing the attack strategy. The attack profit G A =(S A ,S D )for:

[0083]

[0084] Among them, w A is the average benefit that an infected virtual machine brings to the attacker per unit time, ρ i (α(t)) represents the cost of malware attacking a susceptible virtual machine.

[0085] The total loss of the defender is equal to the loss caused by a successful attack plus the cost of executing the defense strategy, so the defense loss L D =(S A ,S D )for:

[0086]

[0087] Among them, w D is the average loss caused to the defender by an infected virtual machine per unit time, θ i (η(t)) and ξ i (β(t)) represents the cost for the defender to install antivirus software for susceptible virtual machines and repair infected virtual machines, respectively.

[0088] In the malware attack and defense process, the attacker hopes to maximize his profit G A (S A ,S D ), the defender hopes to minimize its loss L D (S A ,S D). Therefore, we model this problem as a differential game model and solve it from the concept of Nash equilibrium solution. Nash equilibrium is a solution concept in game theory, representing a stable equilibrium state where both participants cannot unilaterally change their strategies to obtain higher returns.

[0089] If the strategy is If the following conditions are met, then it is the Nash equilibrium of the game:

[0090]

[0091] On the one hand, when the defender chooses a defensive strategy In order to maximize its benefits, the attacker must choose an attack strategy Similarly, when the attacker chooses an attack strategy The defender cannot deviate To reduce losses. Therefore, the strategy is It is acceptable to both the attacker and the defender.

[0092] Based on the above discussion, the malware attack and defense dynamic game model can be represented by the following 14-tuple:

[0093]

[0094] Optionally, step three specifically includes: according to the Pontryagin maximum / minimum principle, deriving an optimality system for solving the game model, and designing an algorithm to provide a numerical solution for the optimality system.

[0095] According to Pontryagin's maximum / minimum principle, we can get the optimal system for solving the game model:

[0096]

[0097] Its boundary conditions are:

[0098]

[0099] The differential equations corresponding to the dynamic model and the above formula constitute the optimality system. The best defense strategy can be obtained by solving the optimality system.

[0100] Furthermore, an algorithm is designed to solve the optimal system, that is, to find the Nash equilibrium.

[0101]

[0102] Optionally, step 4 specifically includes: executing the proposed algorithm in three real network structures of Facebook, Twitter and P2P to obtain Nash strategy pairs. On this basis, by comparing with random and uniform strategies, the effectiveness of the proposed method is verified and the corresponding optimal defense strategy is given.

[0103] Finally, it should be noted that the above embodiments are only used to illustrate the technical solution of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solution of the present invention can be modified or replaced by equivalents without departing from the purpose and scope of the technical solution, which should be included in the scope of the claims of the present invention.

Claims

1. A malware propagation control method based on dynamics and game theory in a cloud environment, characterized by: The method comprises the following steps: Step 1: Divide the virtual machine states according to the actual application scenario and build a dynamic model to describe the spread of malware in the network; Step 2: Determine the strategies of malware attackers and defenders, and quantify the gains from attacks and losses from defenses. Step 3: Establish a dynamic game model based on the confrontational relationship between attack and defense; Step 4: According to Pontryagin's maximum / minimum principle, derive the optimal system to solve the game model; Step 5: Based on the forward and backward scanning method, design an algorithm to provide a numerical solution for the optimal system; Step 6: Compare multiple methods and provide the best defense strategy.

2. The malware propagation control method based on dynamics and game theory in a cloud environment according to claim 1 is characterized by: The specific process of step 1 includes: based on the idea of ​​graph theory, let the undirected graph G = {V, E} represent the topological structure of the communication network, and the node V = {v1, v2, ..., v N } represents the set of virtual machines, and edge E represents the information interaction relationship between virtual machines. i ,v j )∈E represents that virtual machines i and j can exchange information through the network. A=[a ij ] N×N To represent the adjacency matrix of the propagation network, if (v i ,v j )∈E, then a ij =1, indicating that virtual machines can exchange information, a ij =0 otherwise. Based on the application scenario analysis, in a cloud environment, each virtual machine may be in one of the following three states: Susceptible state (S): The state in which a virtual machine in the cloud is vulnerable to malware attacks but is not infected. Infection status (I): The status of a virtual machine in the cloud being infected by malware. Protected state (P): The state in which a virtual machine in the cloud is not infected and is immune to malware attacks. Let X i (t) = 0, X i (t) = 1 and X i (t) = 2 indicates that virtual machine i is in susceptible, infected and protected states respectively. i (t), I i (t) and P i (t) represent the probability of virtual machine i being in susceptible, infected and protected states at time t, respectively. i (t)+I i (t)+P i (t) = 1, then the vector E(t) = {S1(t),…,S N (t),I1(t),…,I N (t),P1(t),…,P N (t)} represents the network status at time t. Under the influence of various factors, the states of nodes will transform into each other. We introduce the following assumptions to describe the state transfer process: (i)γ: The probability that a susceptible VM in the cloud becomes infected due to information interaction with an infected VM. (ii) α: the probability that a virtual machine changes from a susceptible state to an infected state due to an attacker launching an attack on the virtual machine. (iii)δ: the probability that a VM changes from infected state to susceptible state due to system reinstallation. (iv) ε: the probability that a virtual machine changes from a protected state to a vulnerable state due to the inability of the antivirus software to work effectively. (v)η: The probability that a virtual machine changes from a vulnerable state to a protected state due to the defender installing the latest antivirus software. (vi) β: The probability that a VM changes from an infected state to a protected state due to the defender repairing the infected VM. Based on the above assumptions, the differential equation corresponding to the malware propagation dynamics model is as follows:

3. The malware propagation control method based on dynamics and game theory in a cloud environment according to claim 2, characterized in that: In the step 2, let A and D represent the malware attacker and defender respectively, and we need to give the strategies of A and D. It can be seen from the dynamics model that the malware attack rate α i (t) Antivirus software installation rate η under the control of the attacker i (t) and malware repair rate β i (t) is under the control of the defender. On this basis, let the piecewise continuous function S A and S D Representing the strategies of attacker and defender respectively: S A =(α1(t),...,α N (t)) S D =(η1(t),...,η N (t),β1(t),...,β N (t)) Since the control resources and costs are limited, the control function is bounded. Let and Represents α i (t),η i (t) and β i The upper bound of (t) can be obtained and The feasible strategy sets for the attacker and defender are: Furthermore, we quantify the attack benefits and defense losses: In order to measure the expected net benefits of the attacker and the expected total losses of the defender, we assume that w A is the average profit brought to the attacker by an infected virtual machine per unit time, w D is the average loss caused to the defender by an infected virtual machine per unit time. At any time, let ρ i (α(t)) represents the cost of malware attacking a susceptible virtual machine, θ i (η(t)) and ξ i (β(t)) represents the cost of installing antivirus software for vulnerable virtual machines and repairing infected virtual machines. The net benefit of the attacker is equal to the benefit from a successful attack minus the cost of executing the attack strategy. The attack benefit G A =(S A ,S D )for: The total loss of the defender is equal to the loss caused by a successful attack plus the cost of executing the defense strategy, so the defense loss L D =(S A ,S D )for:

4. The malware propagation control method based on dynamics and game theory in a cloud environment according to claim 3 is characterized by: In step 3, a dynamic game model is established based on the attack and defense confrontation relationship: in the malware attack and defense process, the attacker hopes to maximize its profit G A (S A ,S D ), the defender hopes to minimize its loss L D (S A ,S D ). Therefore, we model this problem as a differential game model and solve it from the concept of Nash equilibrium solution. Nash equilibrium is a solution concept in game theory, representing a stable equilibrium state in which both participants cannot unilaterally change their strategies to obtain higher returns. If the strategy is If the following conditions are met, then it is the Nash equilibrium of the game: On the one hand, when the defender chooses a defensive strategy In order to maximize its benefits, the attacker must choose an attack strategy Similarly, when the attacker chooses an attack strategy The defender cannot deviate To reduce losses. Therefore, the strategy is It is acceptable to both the attacker and the defender. Based on the above discussion, the malware attack and defense dynamic game model can be represented by the following 14-tuple:

5. The malware propagation control method based on dynamics and game theory in a cloud environment according to claim 4, characterized in that: In the step 4, according to the Pontryagin maximum / minimum principle, an optimal system is derived to solve the game model. According to Pontryagin's maximum / minimum principle, we can get the optimal system for solving the game model: Its boundary conditions are: The optimality system is composed of the differential equations corresponding to the dynamic model and the above formula.

6. The malware propagation control method based on dynamics and game theory in a cloud environment according to claim 5, characterized in that: In the step five, based on the forward and backward scanning method, an algorithm is designed to provide a numerical solution for the optimal system, and the best defense strategy can be obtained by solving the algorithm.

7. The method for controlling malware propagation based on dynamics and game theory in a cloud environment according to claim 6, characterized in that: In step six, multiple methods are compared to give the best defense strategy: We execute the proposed algorithm on three real network structures: Facebook, Twitter and P2P, and obtain the best defense strategy by solving the optimal system, thus verifying the effectiveness of the method.

Images