Network key vulnerability determination method and device, electronic equipment and storage medium

Abstract

The invention discloses a network analysis method, and particularly relates to a network key vulnerability determination method and device, electronic equipment and a storage medium, and the method comprises the steps: calculating a structure index and a function index of a target network; constructing a vulnerability function based on the structure index and the function index; maximizing the vulnerability function as a target function, solving the target function based on a genetic algorithm under a preset constraint condition to obtain a key vulnerability set of the target network, the step comprising: determining an initial population; calculating a fitness value of the initial chromosome based on the vulnerability function; performing genetic manipulation on the initial population based on the fitness value of the initial chromosome; and converting the chromosome with the highest fitness value in the final population obtained by the genetic manipulation into a key vulnerability set of the target network and outputting the key vulnerability set under the condition of meeting a termination condition. The method can improve the efficiency and accuracy of determining the key vulnerabilities of the network.

Description

Technical Field

[0001] The present invention relates to a network analysis method, and in particular to a method, device, electronic device and storage medium for determining key network vulnerabilities. Background Art

[0002] The combat system of systems (CSoS) is an organic whole composed of multiple types of combat systems according to certain command relationships, organizational relationships and operating mechanisms. From a topological perspective, the combat system can be simplified into a complex network model, with nodes including sensors, communication hubs, command centers and firepower platforms, and the information, resources and energy interactions between nodes constitute the edges of the network. In a complex electromagnetic environment, identifying and protecting key nodes in the system is crucial to ensuring the reliability and survivability of the combat network.

[0003] When exploring strategies to improve the effectiveness or disrupt the functionality of combat systems, existing research is widely based on complex network theory, and by constructing metrics such as robustness, resilience, and vulnerability, the stability, resilience, and potential weaknesses of target networks facing different threats and attack scenarios are analyzed. Traditional complex network robustness quantification tools, such as vertex / edge connectivity, fault diameter, rigidity, and expansion parameters, perform well in static homogeneous networks, but are difficult to directly apply to highly dynamic and heterogeneous target networks.

[0004] Compared with the system's ability to survive in adversity, which is emphasized by robustness, vulnerability research focuses on quantifying the degree of damage to the system when it encounters anomalies or attacks. As a complementary perspective to robustness research, it provides an important perspective for understanding the security of combat networks. In view of the characteristics of heterogeneous combat networks, existing technical research has made significant progress in structural connectivity, but the deconstruction strategy from a functional perspective is still insufficient. Most existing studies focus on the single-dimensional evaluation of network topology or functional characteristics, and rarely consider the two comprehensively to comprehensively analyze the overall effectiveness of the combat system, resulting in poor accuracy of the evaluation results. Summary of the invention

[0005] The technical problem to be solved by the present invention is that most of the existing technologies focus on the single-dimensional evaluation of network topology or functional characteristics, and rarely take the two into comprehensive consideration to comprehensively analyze the overall performance of the network, resulting in poor accuracy of the evaluation results. In order to solve the above problem, the present invention provides a method, device, electronic device and storage medium for determining key network vulnerabilities.

[0006] The content of the present invention includes:

[0007] In a first aspect, an embodiment of the present invention provides a method for determining a key vulnerability of a network, comprising:

[0008] Calculate the structural index and functional index of the target network, the target network includes N nodes, the structural index is determined based on the network topology of the target network, the functional index is used to characterize the effectiveness of the target network in performing tasks, and N is a positive integer;

[0009] constructing a vulnerability function based on the structural index and the functional index;

[0010] Taking maximizing the vulnerability function as the objective function, solving the objective function based on a genetic algorithm under preset constraints to obtain a set of key vulnerable points of the target network, wherein the set of key vulnerable points includes K nodes, where K is a positive integer less than N;

[0011] The objective function is to maximize the vulnerability function, and the objective function is solved based on a genetic algorithm under preset constraints to obtain a set of key vulnerable points of the target network, including:

[0012] Determine an initial population, the initial population includes N p Initial chromosomes, N p is a positive integer and an even number;

[0013] Calculating the fitness value of the initial chromosome based on the fragility function;

[0014] Performing genetic operations on the initial population based on the fitness value of the initial chromosome;

[0015] When the termination condition is met, the chromosome with the highest fitness value in the final population obtained by genetic operation is converted into a set of key vulnerable points of the target network for output.

[0016] Optionally, determining the initial population includes:

[0017] Based on the node extraction probability, a sampling operation is performed on the N nodes to obtain 3n p The initial chromosomes, n p is a positive integer, and the extraction probability of the node is positively correlated with the importance of the node;

[0018] Execute N on the N nodes p -3n p Rounds of random sampling operations, get N p -3n p The initial chromosome.

[0019] Optionally, the sampling operation is performed on the N nodes based on the node extraction probability to obtain 3np The initial chromosomes include:

[0020] For each of the N nodes, determining a first importance of the node based on the degree centrality of the node, determining a second importance of the node based on the betweenness centrality of the node, and determining a third importance of the node based on the clustering coefficient of the node;

[0021] Determine a first extraction probability of the node based on a first importance of the node, determine a second extraction probability of the node based on a second importance of the node, and determine a third extraction probability of the node based on a third importance of the node;

[0022] Based on the first extraction probability of the node, a sampling operation is performed on the N nodes to obtain n p The initial chromosomes are sampled based on the second extraction probability of the nodes to obtain n p The initial chromosomes are sampled based on the third extraction probability of the nodes to obtain n p The initial chromosome.

[0023] Optionally, performing a genetic operation on the initial population based on the fitness value of the initial chromosome includes:

[0024] Based on the fitness value of the initial chromosome, selecting a plurality of the initial chromosomes from the initial population as parents to enter the mating pool;

[0025] The initial chromosomes in the mating pool are subjected to a crossover operation according to a preset crossover strategy and a mutation operation according to a preset mutation strategy until the termination condition is met.

[0026] Optionally, the chromosome comprises a plurality of genes, each of which is coded as 1 or 0;

[0027] The preset crossover strategy includes: when performing a crossover between a first chromosome and a second chromosome, if an exchange of a gene coded as 1 and a gene coded as 0 occurs at a first position, then an exchange of a gene coded as 0 and a gene coded as 1 is performed at a second position, the first chromosome and the second chromosome are any pair of chromosomes, and the first position and the second position are symmetrical;

[0028] and / or;

[0029] The preset mutation strategy includes: if a mutation operation is performed at the third position to change a gene coded as 0 to a gene coded as 1, a gene coded as 1 with a symmetric feature is randomly determined and the code is changed to 0.

[0030] Optionally, performing a crossover operation according to a preset crossover strategy includes:

[0031] Determine the crossover probability P c , the initial values ​​of the first counter cn1 and the second counter cn2;

[0032] Execute N p Iterative cross processing, wherein the cross processing includes:

[0033] Generate a first random number r in the interval [0,1]. If r is less than P c , then execute the current cross processing, otherwise, execute the next cross processing;

[0034] Generate a random position array to determine the intersection point c; traverse the random position array, if the gene code of the first chromosome at the first position is 0 and the gene code of the second chromosome is 0, cn1=cn1+1; if the gene code of the first chromosome at the first position is 0 and the gene code of the second chromosome is 1, cn2=cn2+1;

[0035] Determine the number k of gene pairs that need to be exchanged simultaneously, k takes the smaller value of cn1 and cn2, perform symmetric crossover at the corresponding k positions, and then reset cn1=0, cn2=0.

[0036] Optionally, the mutation operation according to a preset mutation strategy includes:

[0037] Determine the mutation probability P m The initial value of

[0038] For each pair of chromosomes after the crossover operation, a second random number d is generated with a coding range between 0 and 1. <P m When , the mutation operation is performed on the pair of chromosomes, otherwise, the next pair of chromosomes is processed;

[0039] Create two arrays loc0 and loc1 respectively to record the positions of all genes coded as 0 and 1 in the chromosome; randomly select a position lj0 from loc0, change the gene code at lj0 from 0 to 1, check whether loc1 is not empty, and randomly select a position lj1 and change its gene code from 1 to 0.

[0040] In a second aspect, an embodiment of the present invention provides a device for determining a key vulnerability of a network, including:

[0041] A calculation module, used to calculate the structural index and functional index of the target network, the target network includes N nodes, the structural index is determined based on the network topology of the target network, and the functional index is used to characterize the effectiveness of the target network when performing tasks, and N is a positive integer;

[0042] A construction module, used for constructing a vulnerability function based on the structural index and the functional index;

[0043] A solution module, used for taking maximization of the vulnerability function as an objective function, solving the objective function based on a genetic algorithm under preset constraints, and obtaining a set of key vulnerable points of the target network, wherein the set of key vulnerable points includes K nodes, where K is a positive integer less than N;

[0044] Wherein, the solution module includes:

[0045] A determination unit, configured to determine an initial population, wherein the initial population includes N p Initial chromosomes, N p is a positive integer and an even number;

[0046] A calculation unit, used for calculating the fitness value of the initial chromosome based on the fragility function;

[0047] An execution unit, configured to perform a genetic operation on the initial population based on the fitness value of the initial chromosome;

[0048] The output unit is used to convert the chromosome with the highest fitness value in the final population obtained by genetic operation into a set of key vulnerable points of the target network for output when the termination condition is met.

[0049] In a third aspect, an embodiment of the present invention provides an electronic device, comprising: a memory, a processor, and a program stored in the memory and executable on the processor; the processor is used to read the program in the memory to implement the steps in the method for determining key network vulnerabilities as described in the first aspect.

[0050] In a fourth aspect, an embodiment of the present invention provides a readable storage medium for storing a program, which, when executed by a processor, implements the steps in the method for determining key network vulnerabilities as described in the first aspect.

[0051] The beneficial effect of the present invention is that, in an embodiment of the present invention, the structural index and the functional index of the target network are first calculated, and the target network can be better described from different angles through the structural index and the functional index. The two are comprehensively considered to comprehensively analyze the overall performance of the target network, and the state of the target network can be described more accurately; then, maximizing the vulnerability function is used as the objective function, and the objective function is solved based on a genetic algorithm under preset constraints to obtain a set of key vulnerable points of the target network. Solving the objective function through a genetic algorithm improves the efficiency of the algorithm solution. BRIEF DESCRIPTION OF THE DRAWINGS

[0052] Attached Figure 1 A flow chart of a method for determining key network vulnerabilities provided by an embodiment of the present invention;

[0053] Attached Figure 2 This is an example diagram of the task system network structure;

[0054] Attached Figure 3 A schematic diagram of a crossover operation provided by an embodiment of the present invention;

[0055] Attached Figure 4 A schematic diagram of a mutation operation provided by an embodiment of the present invention;

[0056] Attached Figure 5a It is a trend chart showing the changes of structural indicators with the number of key vulnerable points;

[0057] Attached Figure 5b It is a trend chart showing the functional indicators changing with the number of key vulnerable points;

[0058] Attached Figure 5c It is a trend graph of the ratio of the number of nodes in the maximum connected subgraph changing with the number of key vulnerable points;

[0059] Attached Figure 5d The trend graph of the average number of nodes participating in the kill chain and the number of key vulnerabilities;

[0060] Attached Figure 6 It is a trend chart showing the consequences of network damage under different attack modes as the number of key vulnerabilities changes;

[0061] Attached Figure 7 A schematic diagram of a device for determining key network vulnerabilities provided by an embodiment of the present invention;

[0062] Attached Figure 8 A schematic diagram of the structure of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0063] In the embodiments of the present application, the term "and / or" describes the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B may represent: A exists alone, A and B exist at the same time, and B exists alone. The character " / " generally indicates that the objects associated before and after are in an "or" relationship. In the embodiments of the present application, the term "multiple" refers to two or more, and other quantifiers are similar. The terms "first", "second", etc. in the specification and claims of the present application are used to distinguish similar objects, and are not used to describe a specific order or sequence. It should be understood that the terms used in this way can be interchangeable under appropriate circumstances, so that the embodiments of the present application can be implemented in an order other than those illustrated or described here, and the objects distinguished by "first" and "second" are generally of the same type, and the number of objects is not limited. For example, the first object can be one or more.

[0064] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0065] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those commonly understood by those skilled in the art to which this application belongs. The terms used herein are only for the purpose of describing the embodiments of this application and are not intended to limit this application.

[0066] First, some nouns involved in this application are analyzed:

[0067] Genetic Algorithm (GA) is a search algorithm used in computational mathematics to solve optimization problems. It is a type of evolutionary algorithm. In a genetic algorithm, a population is a set of multiple chromosomes, each of which is used to represent a candidate solution. When a candidate solution includes multiple elements, each chromosome includes multiple genes, and a gene is a part of a chromosome that corresponds to an element of the candidate solution.

[0068] Each independent entity in the task system network is represented by a node, and the relationship between nodes is represented by edges. Based on this, the task system network is described as a complex network G = (V, E). For details, see Figure 1 According to the role of the entity in the task system network, the network nodes are divided into four categories:

[0069] Intelligence node (Intelligence, I). Intelligence node (reconnaissance node) is used to collect target and battlefield information. Its main functions are target reconnaissance, intelligence acquisition and battlefield monitoring.

[0070] Command and Control (C): Command and Control nodes have the functions of information processing and analysis, decision support and control entity.

[0071] Firepower node (Firepower, F). Firepower node (strike node) refers to a node that operates to attack and destroy targets, and has specific functions such as precision strike, fire strike and electronic jamming.

[0072] Target node (Target, T). The target node refers to the goal of the task.

[0073] The set of all nodes is denoted as V = I∪C∪F∪T, and the number of nodes of the four categories I, C, F and T are denoted as n I 、n C 、n F and n T E represents the edge set between nodes, including seven types of edge relationships, as follows: Figure 2 As shown in Table 1:

[0074] Table 1. Task system network edge relationship types

[0075]

[0076] Based on this, the embodiments of the present application provide a method, device, electronic device and storage medium for determining key network vulnerabilities. Figure 1 , Figure 1 A flow chart of a method for determining a key vulnerability of a network provided by an embodiment of the present invention, wherein the method specifically comprises the following steps:

[0077] Step 101, calculating the structural index and functional index of the target network, the target network includes N nodes, the structural index is determined based on the network topology structure of the target network, the functional index is used to characterize the performance of the target network when performing tasks, and N is a positive integer.

[0078] Step 102, constructing a vulnerability function based on the structural index and the functional index;

[0079] Step 103, taking maximizing the vulnerability function as the objective function, solving the objective function based on a genetic algorithm under preset constraints to obtain a set of key vulnerable points of the target network, wherein the set of key vulnerable points includes K nodes, where K is a positive integer less than N;

[0080] Wherein, the step 103 specifically includes:

[0081] Determine an initial population, the initial population includes N pInitial chromosomes, N p is a positive integer and an even number;

[0082] Calculating the fitness value of the initial chromosome based on the fragility function;

[0083] Performing genetic operations on the initial population based on the fitness value of the initial chromosome;

[0084] When the termination condition is met, the chromosome with the highest fitness value in the final population obtained by genetic operation is converted into a set of key vulnerable points of the target network for output.

[0085] In this embodiment, the target network is a complex network including N nodes, and the N nodes have different performances. Exemplarily, the N nodes of the target network can be divided into four different types of nodes according to their specific functions. The first type of node is used to collect information, the second type of node is used to process information, the third type of node is used to perform target tasks, and the fourth type of node is the target of the target task.

[0086] In step 101, the structural index and functional index of the target network are first calculated. The structural index and functional index are described below respectively.

[0087] Given the complexity of network topology and the diversity of potential threats, the key to building the target network structure index is to accurately identify and protect those nodes that are critical to the overall connectivity of the system. By quantitatively analyzing the changes in network connectivity efficiency, we can more scientifically identify the key nodes and weak links in the target network, so as to formulate targeted protection measures to ensure that the target network can still maintain unimpeded information links under extreme conditions, thereby improving the reliability and survivability of the entire target network.

[0088] Structural indicators focus on the integrity of network topology, such as the connectivity between nodes and the connectivity of the network. Structural damage will directly affect the flow of information and the allocation of resources. A fully connected network is the most compact network with the strongest anti-destruction ability. The greater the structural difference between a network and a fully connected network, the looser its structure and the worse its anti-destruction ability.

[0089] In some embodiments, the connectivity efficiency index of the target network is used as a structural index, and the specific calculation method of the connectivity efficiency index is as follows:

[0090] Assume d ij is the node V in the network G i 、V j The length of the shortest path between ij For node V i 、V j The length between them is d ij The number of shortest paths, μ(dij ) is a fully connected network G0 with the same number of nodes N as the network G, with nodes Vi, V j The length between them is not greater than d ij The number of paths of node V i 、V j The number of equivalent shortest paths between is:

[0091]

[0092] In formula (1), m ij and μ(d ij ) are all elements a in the adjacency matrix A of the network G ij When there is a direct edge between two nodes, r ij =1; for all node pairs (V i , V j ), if r ij =1, the network is a fully connected network.

[0093] The structural difference between network G and the fully connected network can be quantitatively calculated by the number of equivalent shortest paths between nodes, and the connectivity efficiency index that characterizes the effectiveness of the target network structure is defined as:

[0094]

[0095] The number of equivalent shortest paths between any nodes in a fully connected network is 1, so S(G0)=1, which has the strongest invulnerability. The connectivity efficiency of any non-fully connected network is S(G)∈(0,1). The larger S(G) is, the more compact its network structure is and the stronger its invulnerability is.

[0096] In the process of the network completing the corresponding task, even if the network structure maintains a certain connectivity, if the key functional nodes or links fail, the task may not be effectively executed. As a specific embodiment, the target network can be the task system network introduced above, and the N nodes included in the target network are the above-mentioned intelligence nodes, accusation nodes, firepower nodes and target nodes. For the convenience of description, the target network will be taken as the task system network as an example in the subsequent embodiments.

[0097] According to the "Observation-Orientation-Decision-Action" (OODA) cycle theory, the task completion process can be described as an action loop consisting of a series of activities: observation, judgment, decision and action. Accordingly, the specific process can be described as a series of activities in which the reconnaissance node detects the opponent's target and transmits the obtained intelligence to the command center, the decision-making entity analyzes and processes the intelligence information and formulates an action, and the firepower entity strikes the target according to the attack command issued by the command center. This is defined as a kill chain. The kill chain can be understood as a complete link that must include four types of nodes, namely "target-reconnaissance-command-attack", and there are communication links between the nodes. A kill chain can pass through multiple intelligence nodes I and command nodes C, but can only pass through one firepower node F; the starting node and the end node of the kill chain are both target node types. Table 2 shows seven different kill chains.

[0098] Table 2 Kill chain types in the mission system network

[0099]

[0100] In the target network, the ability to complete the task not only depends on the quantity advantage of the kill chain, but is also closely linked to the quality of the kill chain, which is directly reflected in the efficient information processing capability. Specifically, the increase in the number of kill chains not only broadens the scope of executable tasks, but also improves the redundancy of the network and the flexibility of resource allocation, thereby enhancing the network's anti-destruction ability. At the same time, the information transmission efficiency of the link, as a key indicator to measure quality, is directly related to the reaction agility and responsiveness of the kill chain. High-quality information processing can significantly improve the accuracy and efficiency of command, and ultimately enhance the overall effectiveness and combat effectiveness of the target network. Therefore, in this embodiment, the number and length of the kill chain, the information processing efficiency of the C node, and the collaborative relationship between the nodes are considered at the same time, and the following steps are used to construct the functional indicators of the target network.

[0101] In the process of executing a mission, there is a high requirement for the timeliness of information. The success or failure of an operation depends largely on whether the information can be transmitted accurately and quickly. The length of the kill chain is an important measure of the speed of action. Its shortening directly corresponds to the improvement of efficiency.

[0102] The standard kill chain T→I→C→F→T passes through one I, one C, and one F respectively, and has the shortest transmission path 2 (not considering the two paths connected to the target node T), and only two steps are needed to complete the flow of information. Therefore, the information transmission efficiency of the kill chain can be defined as:

[0103]

[0104] Among them, d ijis the path length from the first reconnaissance node i to the attack node j in the kth kill chain.

[0105] In the kill chain k, the command node C plays a core role, and it is responsible for processing reconnaissance information from multiple I nodes. As the number of I nodes connected to it increases, the amount of information that the C node needs to process also increases, which often leads to a slowdown in information processing. At the same time, the C node also bears the responsibility of assigning strike tasks to the F nodes. When it is connected to more F nodes, it can assign tasks more quickly, thereby accelerating the execution of strike operations. Therefore, when evaluating link efficiency, the information processing capability of the C node has become a key factor that cannot be ignored.

[0106] In order to quantify this impact, this embodiment uses node degree as a measurement standard. Specifically, the number of F nodes connected to the C node (num CF ) is defined as the information processing capacity of the C node, which reflects its potential parallel processing capability; and the number of I nodes connected to the C node (num IC ) is defined as the actual information processing capacity of node C, which directly reflects its current information processing burden. Based on these two indicators, the information processing capacity of node C is expressed as:

[0107]

[0108] If there are multiple C nodes in a kill chain, the minimum value is taken.

[0109] Therefore, considering the impact of the information processing capability of node C on efficiency, the corrected link efficiency is defined as:

[0110]

[0111] The capability of the kill chain depends not only on the efficiency of link information transmission, but also on the capability of individual functional nodes and the collaborative relationship between nodes. Assuming that the capability of all nodes is the same, which is 1, that is, CA i =1,i∈I∪C∪F.

[0112] Secondly, consider the impact of edge relationships between different nodes on network capabilities:

[0113] If there is an intelligence sharing relationship (II), the accuracy of information can be improved and the ability of the network to complete tasks can be enhanced. The improvement factor CA is defined as I-I ~U(1,1.25);

[0114] If there is a collaborative command relationship (CC), the decision quality can be improved and the network's ability to complete tasks can be increased. The improvement factor CA is defined as C-C ~U(1,1.5);

[0115] If there is an information feedback relationship (CI), the accuracy of intelligence can be improved to a certain extent. The improvement coefficient CA is defined C-I ~U(1,1.25).

[0116] Therefore, the kill chain capability is expressed as:

[0117] Ca k ×Eff k =(CA I-I ×CA C-C ×CA C-I )×Eff k (6)

[0118] As the length of the kill chain increases, its efficiency will show a decreasing trend. When evaluating the effect, the adverse effects of longer kill chains must be fully considered and measures must be taken to mitigate them. To this end, a length-based weight allocation strategy is adopted for kill chains with a link length of more than 2: the longer the kill chain, the smaller the weight it is assigned. This strategy aims to more accurately reflect the difference in their capabilities in actual tasks by adjusting the weights of kill chains of different lengths, thereby providing strong support for optimizing mission plans.

[0119] According to the above content, the functional indicators of the target network are:

[0120]

[0121] in Indicates a standard kill chain with a link length of 2. Represents a kill chain with a link length of l (l ≥ 3).

[0122] After determining the structural and functional indicators of the target network, the structural vulnerability of the network can be measured based on the structural indicators, and the functional vulnerability of the network can be measured based on the functional indicators. Structural vulnerability considers the problem from a passive perspective, that is, after the key nodes in the structure of the target network fail, can the target network ensure the smooth flow of the entire information link system. Functional vulnerability considers the problem from an active perspective, that is, the ability of the target network to complete the task in the event of the failure of the key nodes in the target network.

[0123] In step 102, a vulnerability function is constructed based on the structural index and the functional index. In order to specifically quantify the degree of loss caused by the event of a node being attacked to the performance of the entire target network, this embodiment sets two sets of comparison parameters:

[0124] For the original target network that has not been attacked, its structural index and functional index are represented as S(G) and R(G) respectively; for the target network after being attacked, its structural index and functional index are represented as S(G') and R(G') respectively.

[0125] The network vulnerability (NV) function is constructed as follows:

[0126]

[0127] Here, α is a proportional parameter that expresses the preference between the two measures of structural vulnerability and functional vulnerability.

[0128] In this embodiment, network vulnerability is taken as the starting point, aiming to find key vulnerable points (i.e., nodes with higher vulnerability) that have a significant impact on the overall performance by analyzing the importance of each node in the target network and their mutual correlation, and obtain a set of key vulnerable points of the target network.

[0129] Taking the task system network as an example, the decision variables in the key vulnerability determination problem of the above network are defined as:

[0130]

[0131] In actual tasks, attacks on nodes will bring corresponding attack costs, which may include resource consumption, time cost, risk of being discovered, etc. Assume that the attack cost consumed by each node is c i =d i λ . Where d i It represents the degree of each node, and the parameter λ is used as an adjustment factor to flexibly reflect the cost considerations when attacking the node.

[0132] According to the actual situation, this embodiment sets a clear upper limit of attack cost C max , specifically:

[0133]

[0134] Among them, ρ∈[0,1] is the proportional parameter of the total attack cost.

[0135] For the task system, taking maximizing the vulnerability function as the objective function, we can get:

[0136]

[0137] The preset constraints include:

[0138]

[0139] Formula (12) in the preset constraint condition is used to limit the total attack cost of attacking the key vulnerable points to not exceed the upper limit of the attack cost. Formula (13) is used to limit the number K of key vulnerable points, and K nodes are selected from N nodes as key vulnerable points. The number K of selected nodes represents the "strike intensity". Formula (14) is the feasible domain of the decision variable, which is used to characterize the selection range of key vulnerable points as intelligence nodes, command nodes, and firepower nodes.

[0140] The above problem is essentially a network collapse optimization problem. When dealing with large-scale or complex problems, the amount of computation of exact algorithms (such as branch-and-bound method, enumeration algorithm, etc.) increases dramatically, and the time complexity soars, making the solution process impractical. More importantly, the objective function value is not directly available or explicitly expressed, but requires an independent calculation process, which further increases the difficulty of solving.

[0141] In order to solve the above function more quickly and efficiently, this embodiment takes maximizing the vulnerability function as the objective function, solves the objective function based on a genetic algorithm under preset constraints, and obtains a set of key vulnerable points of the target network, wherein the set of key vulnerable points includes K nodes, where K is a positive integer less than N;

[0142] The specific steps of step 103 can be described as follows:

[0143] S1: Determine the initial population, which includes N p Initial chromosomes, N p is a positive integer and an even number;

[0144] S2: Calculating the fitness value of the initial chromosome based on the fragility function;

[0145] S3: performing genetic operations on the initial population based on the fitness value of the initial chromosome;

[0146] S4: When the termination condition is met, the chromosome with the highest fitness value in the final population obtained by the genetic operation is converted into a set of key vulnerable points of the target network for output.

[0147] In this embodiment, based on the idea of ​​genetic algorithm, each step is adaptively adjusted according to the above objective function. The implementation method of each step will be described in detail below, taking the target network as the task system network as an example.

[0148] In this embodiment, a one-dimensional 0-1 vector L is used to encode the adjacency matrix A of the target network G, and the elements in the adjacency matrix are encoded as 0 or 1: according to the edge relationship type shown in the aforementioned Table 1, a corresponding connection between two nodes is represented by 1; a connection between two nodes without any relationship is represented by 0. Therefore, the target network G is represented as a directed network.

[0149] When establishing the adjacency matrix A, it is necessary to establish corresponding sub-matrices for different types of connection relationships, namely, intelligence-intelligence matrix (II), intelligence-command matrix (IC), command-command matrix (CC), command-intelligence matrix (CI), command-fire matrix (CF), fire-target matrix (FT), target-intelligence matrix (TI), and then merge the 7 sub-matrices to form the relationship matrix A of all nodes. The encoding of the 7 types of matrices is similar. Taking the intelligence-command relationship as an example, the matrix W I-C (Dimension n I ×n C ) is expressed as:

[0150]

[0151] By traversing the matrix W row by row I-C , and put the elements of each row into the one-dimensional vector L in order I-C In the conversion from matrix to one-dimensional vector, the vector L I-C The length is n I ×n C The encoding vector corresponding to the adjacency matrix A is finally expressed as L = [L I-I ,L I-C ,L C-C ,L C-I ,L C-F ,L F-T ,L T-I ].

[0152] After the adjacency matrix A is constructed, due to the random generation characteristics of the connections between nodes, a special situation may occur: some target type nodes are isolated due to the lack of a complete strike chain (that is, there is no at least one path starting from the firepower node, passing through the command node, and finally pointing to the target node). This type of problem mainly exists in the target-intelligence matrix (TI).

[0153] In some embodiments, after constructing the target-intelligence matrix, the method further includes: traversing all target type nodes to check whether they are connected to any intelligence node. For isolated target nodes, a connection with an existing intelligence node is randomly selected and established, thereby ensuring that each target node in the network is at least connected to the intelligence system, avoiding the isolation of the node.

[0154] In the specific calculation, all nodes with a value of 1 in each feasible solution of the above model constitute the key vulnerable point set Q. In order to avoid directly performing complex operations on the adjacency matrix of the complex network, the nodes of the target network are first encoded to identify the nodes that need to be attacked and their associated lines. Then, the destructive effect of deleting the nodes on the target network can be calculated, providing the necessary input data for the subsequent fitness value evaluation and algorithm iterative optimization process.

[0155] The implementation process of the encoding algorithm is specifically described as follows: Initialize a length of n I +n C +n F A one-dimensional vector X is represented by X=[x I1 ,x I2 ,..,x C1 ,x C2 ,..x F1 ,x F2 ,..]=[0,0,...,0], traverse the set of key vulnerable points Q that need to be attacked, and set the corresponding position of each node in Q in vector X to 1, so as to complete the encoding of the attack plan. The decoding algorithm operates in the opposite way, taking vector X as input, and mapping the result back to the node in the target network by parsing the position of the 1 value therein, to form the set of key vulnerable points Q that need to be attacked. The specific encoding process can be found in the description of the relevant content, which is not limited here.

[0156] In step S1, firstly, an initial population needs to be determined, and the initial population is used to characterize the initial candidate solution set of the above objective function. As an optional implementation, the initial population can be constructed by random sampling or the like, which is not specifically limited here.

[0157] As another optional implementation, the determining the initial population includes:

[0158] Based on the node extraction probability, a sampling operation is performed on the N nodes to obtain 3n p The initial chromosomes, n p is a positive integer, and the extraction probability of the node is positively correlated with the importance of the node;

[0159] Execute N on the N nodes p -3n p Rounds of random sampling operations, get N p -3n p The initial chromosome.

[0160] In this embodiment, the node extraction probability is used to describe the chance of the node being selected during the sampling process. Based on the node extraction probability, the row sampling operation is performed to obtain 3n pThe initial chromosomes constitute the core component of the initial population diversity. Since the importance of a node is positively correlated with the probability of node extraction, the more important nodes in the target network are more likely to be selected, making the quality of the initial population higher. p -3n p ) chromosomes and adopt a random sampling strategy to maintain the diversity and randomness of the population and ensure the extensiveness of the algorithm's exploration space.

[0161] Further, in some other embodiments, the sampling operation is performed on the N nodes based on the node extraction probability to obtain 3n p The initial chromosomes include:

[0162] For each of the N nodes, determining a first importance of the node based on the degree centrality of the node, determining a second importance of the node based on the betweenness centrality of the node, and determining a third importance of the node based on the clustering coefficient of the node;

[0163] Determine a first extraction probability of the node based on a first importance of the node, determine a second extraction probability of the node based on a second importance of the node, and determine a third extraction probability of the node based on a third importance of the node;

[0164] Based on the first extraction probability of the node, a sampling operation is performed on the N nodes to obtain n p The initial chromosomes are sampled based on the second extraction probability of the nodes to obtain n p The initial chromosomes are sampled based on the third extraction probability of the nodes to obtain n p The initial chromosome.

[0165] In this embodiment, degree centrality, betweenness centrality and clustering coefficient are used to evaluate the importance of nodes respectively. The above evaluation methods not only ensure the rationality of the initial population, but also ensure the diversity of the evaluation methods, thereby improving the accuracy of the evaluation results.

[0166] In a specific embodiment, K rounds of non-repetitive sampling are performed to select K nodes from the target network as key vulnerable points. Each round of sampling is performed independently based on the above three evaluation methods (degree centrality, betweenness centrality and clustering coefficient), and each method generates n p Initial chromosomes, generating 3n p The initial chromosome.

[0167] It should be understood that, in a specific implementation, N p Represents the total number of individuals in the population, N p Should be an even number to ensure the smooth progress of subsequent genetic operations (such as crossover operations), where n p It is used to control the ratio of initial chromosomes obtained by different extraction methods, and its value is not limited here. p =100,n p =N p / 4, and construct the initial population accordingly.

[0168] In step S2, the fitness value of the initial chromosome is calculated based on the fragility function. The fitness value is used to judge the quality of the chromosome. Since the objective function is to maximize the fragility function, in some embodiments, the fragility function can be directly used as the calculation function of the fitness value, and at the same time, it should be ensured that the calculation result meets the preset constraints.

[0169] In other embodiments, a penalty function-based strategy is provided to evaluate the fitness value of the chromosome, which can effectively guide the algorithm search process and avoid generating unrealistic solutions. The specific process is as follows:

[0170] First, for each chromosome in the algorithm, calculate its corresponding total attack cost, and then evaluate whether the chromosome meets the cost constraint, that is, the formula (12) in the above preset constraint. Then, compare the calculated total cost with the attack cost upper limit C max If the total cost does not exceed C max , then the chromosome is deemed to meet the preset constraints, and its fitness value will be directly calculated based on its performance index without additional adjustment. For individuals that violate the cost constraint, that is, the total cost exceeds C max Individuals with high costs are directly subtracted from the original fitness value, that is, NV=NV-1, to ensure that the fitness values ​​of these violating individuals are significantly lower than those of individuals that meet the constraints. The above embodiment can gradually eliminate high-cost individuals in subsequent iterations through a negative feedback mechanism, thereby leading to a solution that better meets actual needs.

[0171] In step S3, a genetic operation is performed on the initial population based on the fitness value of the initial chromosome, specifically including a selection operation, a crossover operation and a mutation operation. In some embodiments, the genetic operation is performed on the initial population based on the fitness value of the initial chromosome, including:

[0172] Based on the fitness value of the initial chromosome, selecting a plurality of the initial chromosomes from the initial population as parents to enter the mating pool;

[0173] The initial chromosomes in the mating pool are subjected to a crossover operation according to a preset crossover strategy and a mutation operation according to a preset mutation strategy until the termination condition is met.

[0174] For the initial population, the fitness values ​​are ranked and evaluated, and then the elite selection strategy is implemented, that is, multiple individuals with the best fitness are selected as parents to enter the mating pool. In this way, the high-quality genotypes in the population can be retained, laying the foundation for subsequent genetic operations.

[0175] According to the above content, each chromosome includes multiple genes, and the code of any gene is 1 or 0. The code of the gene is 1 to indicate that the node corresponding to the gene is a key vulnerable point. In the process of performing genetic operations, the number of key vulnerable points in each chromosome should be a fixed value. Therefore, in order to ensure that the total number of genes coded "1" remains unchanged during the genetic process, a preset crossover strategy and a preset mutation strategy are proposed in this embodiment.

[0176] In some embodiments, the preset crossover strategy includes: when crossing over between a first chromosome and a second chromosome, if an exchange of a gene coded as 1 and a gene coded as 0 occurs at the first position, then an exchange of a gene coded as 0 and a gene coded as 1 is performed at the second position, the first chromosome and the second chromosome are any pair of chromosomes, and the first position and the second position are symmetrical.

[0177] Optionally, performing a crossover operation according to a preset crossover strategy includes:

[0178] Determine the crossover probability P c , the initial values ​​of the first counter cn1 and the second counter cn2;

[0179] Execute N p Iterative cross processing, wherein the cross processing includes:

[0180] Generate a first random number r in the interval [0,1]. If r is less than P c , then execute the current cross processing, otherwise, execute the next cross processing;

[0181] Generate a random position array to determine the intersection point c; traverse the random position array, if the gene code of the first chromosome at the first position is 0 and the gene code of the second chromosome is 0, cn1=cn1+1; if the gene code of the first chromosome at the first position is 0 and the gene code of the second chromosome is 1, cn2=cn2+1;

[0182] Determine the number k of gene pairs that need to be exchanged simultaneously, k takes the smaller value of cn1 and cn2, perform symmetric crossover at the corresponding k positions, and then reset cn1=0, cn2=0.

[0183] See also Figure 3 As a specific embodiment, the specific implementation process of the crossover operation is as follows:

[0184] Initialize the crossover probability P c =0.9, and initialize counters cn1, cn2 and iteration index i to 0.

[0185] Repeat the following steps ac until the termination condition is met:

[0186] a. Let i = i + 1, generate a random number r in the interval [0,1]. If r is less than P c , then perform the crossover operation; otherwise, continue to the next iteration.

[0187] b. Generate a random position array place to determine the intersection point c. Traverse the array, if the chromosome gene code at position c is 1 and the other chromosome gene code is 0, cn1 = cn1 + 1; if the chromosome gene code at this position is 0 and the other chromosome gene code is 1, cn2 = cn2 + 1.

[0188] c. Determine the number of gene pairs k that need to be exchanged simultaneously, where k is the smaller value of cn1 and cn2. Perform symmetric crossover at the corresponding k positions, i.e., ensure that the exchange of genes 1 and 0 is reflected in the opposite direction on the other chromosome, and then reset cn1=0, cn2=0.

[0189] When i=N p The crossover operation ends when .

[0190] In some embodiments, the preset mutation strategy includes: if a mutation operation is performed at the third position and a gene coded as 0 is changed to a gene coded as 1, a gene coded as 1 with a symmetric feature is randomly determined and the code is changed to 0.

[0191] Optionally, the mutation operation according to a preset mutation strategy includes:

[0192] Determine the mutation probability P m The initial value of

[0193] For each pair of chromosomes after the crossover operation, a second random number d is generated with a coding range between 0 and 1. <P m When , the mutation operation is performed on the pair of chromosomes, otherwise, the next pair of chromosomes is processed;

[0194] Create two arrays loc0 and loc1 respectively to record the positions of all genes coded as 0 and 1 in the chromosome; randomly select a position lj0 from loc0, change the gene code at lj0 from 0 to 1, check whether loc1 is not empty, and randomly select a position lj1 and change its gene code from 1 to 0.

[0195] After completing the crossover operation of the chromosome pair, the mutation operation is then performed on these newly generated chromosomes. Figure 4 As a specific embodiment, the specific implementation process of the mutation operation is as follows:

[0196] Initialize mutation probability P m =0.1.

[0197] For each pair of chromosomes after the crossover operation, a random number d is generated between 0 and 1. <P m When , the mutation operation is performed on the chromosome; otherwise, the next pair of chromosomes is processed.

[0198] Create two arrays, loc0 and loc1, to record the positions of all gene bits in the chromosome that are coded as 0 and 1. Randomly select a position lj0 from loc0 and change the gene value at lj0 from 0 to 1; to keep the total number of "1" unchanged, check whether loc1 is non-empty, and randomly select a position lj1 (if it has not been used for this purpose before), and change its gene value from 1 to 0, so as to adjust the symmetry.

[0199] In the above embodiment, for solving the objective function, the selection operation, crossover operation and mutation operation are adaptively set accordingly based on the basic idea of ​​genetic algorithm. The above method can improve the efficiency and convenience of solving the above objective function.

[0200] The following is a description of the beneficial effects of the method of the embodiment of the present application in conjunction with a specific experiment. In this experiment, the target network is the above-mentioned task system network, including 22 intelligence nodes, 16 command nodes, 22 fire nodes, and 10 target nodes, i.e., n I =22,n C =16,n F =22,n T =10, the total number of network nodes NodeTNum = 70. In the experiment, the attack cost parameter λ of the individual node is set to 0.2, and the total cost parameter is as follows:

[0201]

[0202] This experiment uses ER random network to initialize the adjacency matrix. In the ER random network initialization, the edges between nodes are randomly generated with a certain probability. The generation probability parameter is set as: II =0.06, f IC =0.06, f CC =0.06, f CF =0.06, f CI =0.06, f FT =0.10, f TI =0.10. For example, f IC Indicates that the edge from type I node to type C node is randomly generated with a probability of 0.06. In order to reduce the random deviation of the experimental results, we independently repeated the generation of the network 50 times and averaged the output results of these instances to ensure the robustness and reliability of the experimental conclusions. Among them, the value range of the number of key vulnerable points (in the specific embodiment, it can refer to the number of attack nodes) K is set to K = {1, 2, ..., 15}.

[0203] The evaluation indicators used in this embodiment, in addition to the aforementioned structural indicators and functional indicators, also include:

[0204] Maximum connected subgraph node number ratio (Ratio):

[0205]

[0206] Where N represents the total number of nodes in the original complete target network, K is the number of nodes under attack, and C is the number of nodes in the largest connected subgraph after the attack. Ratio is a direct indicator of the remaining connectivity of the network after the attack. When this ratio is low, it indicates that the structure of the network is severely damaged, which may lead to the formation of a large number of information islands, seriously affecting efficiency.

[0207] Average number of kill chains involved per node (No.kc): This indicator is a functional indicator, which refers to the average number of kill chains formed by each node in the network for executing tasks. When the value of this indicator is high, it means that the nodes in the network can participate more in the task. Even if some nodes fail, other nodes can quickly take over the task to ensure the continuity and effectiveness of the task.

[0208] As shown in the above formula (8), the parameter α represents the decision maker's preference for the two metrics of structural indicators and functional indicators. This section systematically compares the impact of various parameter values ​​on the network attack response effect by adjusting the preference coefficient variable, in order to reveal the mechanism of the preference mechanism in the target network. Specifically, the experimental analysis is carried out for the preference coefficient value α = {0.2, 0.4, 0.6, 0.8}. Figure 5a-5d The trend of the four types of indicator values ​​changing with the number of key vulnerable points K is shown.

[0209] according to Figure 5a-5d The results shown can lead to the following conclusions:

[0210] As K increases, Figure 5a and Figure 5c Two structural indicators, Figure 5b and Figure 5d The two functional indicators showed high similarity in their changing trends.

[0211] On the one hand, the structural indicators S(G') and Ratio are closely related to the reduction of connected paths in the network, which is a key factor in evaluating network invulnerability. The S(G') indicator directly reflects the robustness of the network structure by quantifying the degree of structural deviation of the network from the fully connected state. The Ratio indicator provides a direct measure of the network's ability to remain connected after damage by calculating the ratio of the number of nodes in the largest connected subgraph to the number of remaining undamaged nodes. The high similarity between the two shows that the structural stability and connectivity of the network show a consistent downward trend after damage.

[0212] On the other hand, the functional index R(G') comprehensively considers the number and length of the kill chain, the information processing efficiency of the command node, and the coordination relationship between nodes. These factors jointly determine the network's ability to complete tasks immediately after being hit. The change trend of R(G') is similar to that of No.kc, indicating that the activity of nodes participating in the kill chain is an important indicator for measuring the functional status of the network.

[0213] As K increases, Figure 5a and 5c The structural index values ​​gradually decrease (showing a diagonal shape), while Figure 5b and 5d The functional index value decreases sharply when K=1,2,3.

[0214] On the one hand, the structural index S(G') and Ratio value gradually decrease with the increase of K, indicating that the connectivity of the network is gradually decreasing. This is because each attack removes nodes in the network, thereby destroying the topological structure of the network and reducing the size of available paths and connected subgraphs. This decreasing trend presents a diagonal shape, indicating that the decline in network connectivity is continuous and predictable, and is proportional to the increase in K.

[0215] On the other hand, the functional index R(G') and No.kc values ​​decrease sharply when K = 1, 2, and 3, indicating that the functional state of the network is very sensitive to the failure of a few key nodes. These key nodes may be hub nodes, command nodes, or nodes with special functions in the network, and their failure will quickly affect the network's capabilities, information processing efficiency, and synergy. The sharp decrease in the value of functional indicators indicates that there may be a nonlinear relationship between functional decline and structural change, which may be caused by the complex dependencies and synergies in the network. For example, the failure of a key node may not only affect its directly connected nodes, but may also trigger a chain reaction through the break of synergy, leading to a rapid decline in the function of the entire network.

[0216] Although the weights of the indicators in assessing network vulnerability are different, the ranking of the degree of network damage they reflect is relatively consistent, which further verifies the close connection between network structure and function. Although the focus of the assessment is different, the objective fact of the failure of key nodes makes the indicators consistent in reflecting the network damage.

[0217] Specifically, the consequences of network attacks reach their maximum values ​​when the preference coefficient α = 0.4, indicating that under this weight, the structural and functional indicators have reached a good balance. When α = 0.8, the indicators Ratio, S(G') and R(G') all perform poorly, reflecting that the attack effect on the task system network under this preference coefficient is the most limited. This shows that when evaluating network vulnerability, it is necessary to consider both the structural integrity of the network (to ensure the smooth transmission of information) and the functional effectiveness of the network (to ensure the smooth execution of tasks). If the α value is too high (biased towards structural indicators), the physical connectivity of the network may be overemphasized, thereby underestimating the vulnerability of the network. For example, even if the network structure maintains a high degree of connectivity, the failure of key functional nodes may still result in the inability to complete the task. On the contrary, if the α value is too low (biased towards functional indicators), the survivability of the network may be overestimated. Although the network functions are diverse and flexible, if the structure is severely damaged, information flow and resource allocation will be seriously affected.

[0218] In summary, the task system network vulnerability measurement index constructed in this application is reasonable and effective. In particular, among all the preset preference coefficients, α = 0.4 has been proven to be the most destructive to the task system network and the best overall response effect, which provides a strong theoretical basis and practical guidance for the optimization design and protection strategy of the actual task system network. In practical applications, the weights of structural indicators and functional indicators should be reasonably adjusted according to the specific characteristics of the network and the task requirements, so as to achieve a comprehensive and accurate assessment of network vulnerability and the consequences of the attack.

[0219] Furthermore, by setting the preference coefficient α = 0.4, we can further analyze the impact of the attack modes represented by different initialization strategies in the GA algorithm on the consequences of the task system network attack. The following is a detailed description of the five node attack modes used:

[0220] Random attack. This strategy is used as a benchmark comparison method. In the initialization phase of the algorithm, each node in the network is given an equal probability of being selected to simulate attack behavior without prior knowledge or with limited information.

[0221] Degree-prioritized attack. Assuming that the other party has full knowledge of the network structure, this strategy selects the initial attack target based on the node's degree under the condition of cost constraints. The degree reflects the number of direct connections of a node in the network. The larger the value, the greater the probability of being selected as the attack target.

[0222] Betweenness-first attack. Similar to the degree-first attack mode, the betweenness-first strategy focuses on the betweenness value of the node during algorithm initialization, that is, the number of times the node appears on all shortest paths in the network.

[0223] Clustering coefficient priority attack. Similar to the degree priority attack mode, this strategy focuses on the clustering coefficient value of the node to select the initial attack target during algorithm initialization.

[0224] maxNV attack. This strategy is the attack mode under the hybrid initialization strategy proposed in this application, which integrates multi-dimensional information such as node degree value, betweenness value, clustering coefficient and randomness, and selects the initial attack node in a more flexible and comprehensive way.

[0225] Figure 6 The changing trend of the consequences of network attacks under different attack modes with the number of attacked nodes K is depicted, from which the following key conclusions can be drawn:

[0226] The maxNV attack mode can cause a higher network vulnerability (NV) value with the same number of attack nodes, and its convergence speed is significantly higher than other attack modes. The reason why the maxNV attack mode performs well is that this strategy combines the consideration of multiple network characteristics, and may be close to the optimal solution at the time of initialization, or its iteration process is more efficient, so that it can more accurately identify the key nodes in the network.

[0227] Overall, the attack mode based on the clustering coefficient value has the worst effect, while the attack modes based on the degree value, betweenness value, and random attack have similar effects. The clustering coefficient mainly reflects the local clustering degree of network nodes, but these local connections may not play a decisive role in the global connectivity of the network. Therefore, selecting the initial attack node based only on the clustering coefficient may not effectively destroy the overall structure of the network, resulting in poor attack results. Strategies such as degree value, betweenness value, and random attack focus more on the global characteristics or randomness of the network, which are often more related to the overall connectivity and function of the network. Therefore, they are similar in attack efficiency, but to some extent, they fail to consider the network characteristics as comprehensively as maxNV.

[0228] As the number of attack nodes increases, the overall destructive effect of all attack modes on the network tends to be consistent. This may be because when the number of attack nodes is large, the network's R(G') gradually approaches 0 (e.g. Figure 5a-5d As shown in Figure 2, the change in the overall objective function comes more from the connectivity efficiency index S(G'). As the number of attack nodes increases, the network structure gradually collapses, making the differences between different strategies less significant.

[0229] In summary, the experimental results verify the effectiveness of the maxNV hybrid initialization strategy for attack, and also provide corresponding inspiration for us to understand and design more robust network systems. For example, by increasing redundant connections, optimizing node layout, or introducing defense mechanisms to improve network resilience, we can enhance the ability of the task system network to resist different types of attacks.

[0230] See also Figure 7 The embodiment of the present invention further provides a device 700 for determining a key vulnerability of a network, comprising:

[0231] A calculation module 701 is used to calculate the structural index and functional index of the target network, the target network includes N nodes, the structural index is determined based on the network topology of the target network, and the functional index is used to characterize the effectiveness of the target network when performing a task, and N is a positive integer;

[0232] A construction module 702 is used to construct a vulnerability function based on the structural index and the functional index;

[0233] A solution module 703 is used to maximize the vulnerability function as an objective function, solve the objective function based on a genetic algorithm under preset constraints, and obtain a set of key vulnerable points of the target network, wherein the set of key vulnerable points includes K nodes, where K is a positive integer less than N;

[0234] Wherein, the solution module 703 includes:

[0235] A determination unit, configured to determine an initial population, wherein the initial population includes N p Initial chromosomes, N p is a positive integer and an even number;

[0236] A calculation unit, used for calculating the fitness value of the initial chromosome based on the fragility function;

[0237] An execution unit, configured to perform a genetic operation on the initial population based on the fitness value of the initial chromosome;

[0238] The output unit is used to convert the chromosome with the highest fitness value in the final population obtained by genetic operation into a set of key vulnerable points of the target network for output when the termination condition is met.

[0239] Optionally, the determining unit includes:

[0240] The first sampling subunit is used to perform a sampling operation on the N nodes based on the node extraction probability to obtain 3n p The initial chromosomes, n p is a positive integer, and the extraction probability of the node is positively correlated with the importance of the node;

[0241] The second sampling subunit is used to perform N on the N nodes. p -3n p Rounds of random sampling operations, get N p -3n p The initial chromosome.

[0242] Optionally, the first sampling subunit is specifically used for:

[0243] For each of the N nodes, determining a first importance of the node based on the degree centrality of the node, determining a second importance of the node based on the betweenness centrality of the node, and determining a third importance of the node based on the clustering coefficient of the node;

[0244] Determine a first extraction probability of the node based on a first importance of the node, determine a second extraction probability of the node based on a second importance of the node, and determine a third extraction probability of the node based on a third importance of the node;

[0245] Based on the first extraction probability of the node, a sampling operation is performed on the N nodes to obtain n p The initial chromosomes are sampled based on the second extraction probability of the nodes to obtain n p The initial chromosomes are sampled based on the third extraction probability of the nodes to obtain n pThe initial chromosome.

[0246] Optionally, the execution unit includes:

[0247] A selection subunit, for selecting a plurality of the initial chromosomes from the initial population as parents to enter a mating pool based on the fitness value of the initial chromosome;

[0248] The execution subunit is used to perform a crossover operation on the initial chromosomes in the mating pool according to a preset crossover strategy and a mutation operation according to a preset mutation strategy until the termination condition is met.

[0249] Optionally, the chromosome comprises a plurality of genes, each of which is coded as 1 or 0;

[0250] The preset crossover strategy includes: when performing a crossover between a first chromosome and a second chromosome, if an exchange of a gene coded as 1 and a gene coded as 0 occurs at a first position, then an exchange of a gene coded as 0 and a gene coded as 1 is performed at a second position, the first chromosome and the second chromosome are any pair of chromosomes, and the first position and the second position are symmetrical;

[0251] and / or;

[0252] The preset mutation strategy includes: if a mutation operation is performed at the third position to change a gene coded as 0 to a gene coded as 1, a gene coded as 1 with a symmetric feature is randomly determined and the code is changed to 0.

[0253] Optionally, performing a crossover operation according to a preset crossover strategy includes:

[0254] Determine the crossover probability P c , the initial values ​​of the first counter cn1 and the second counter cn2;

[0255] Execute N p Iterative cross processing, wherein the cross processing includes:

[0256] Generate a first random number r in the interval [0,1]. If r is less than P c , then execute the current cross processing, otherwise, execute the next cross processing;

[0257] Generate a random position array to determine the intersection point c; traverse the random position array, if the gene code of the first chromosome at the first position is 0 and the gene code of the second chromosome is 0, cn1=cn1+1; if the gene code of the first chromosome at the first position is 0 and the gene code of the second chromosome is 1, cn2=cn2+1;

[0258] Determine the number k of gene pairs that need to be exchanged simultaneously, k takes the smaller value of cn1 and cn2, perform symmetric crossover at the corresponding k positions, and then reset cn1=0, cn2=0.

[0259] Optionally, the mutation operation according to a preset mutation strategy includes:

[0260] Determine the mutation probability P m The initial value of

[0261] For each pair of chromosomes after the crossover operation, a second random number d is generated with a coding range between 0 and 1. <P m When , the mutation operation is performed on the pair of chromosomes, otherwise, the next pair of chromosomes is processed;

[0262] Create two arrays loc0 and loc1 respectively to record the positions of all genes coded as 0 and 1 in the chromosome; randomly select a position lj0 from loc0, change the gene code at lj0 from 0 to 1, check whether loc1 is not empty, and randomly select a position lj1 and change its gene code from 1 to 0.

[0263] The network key vulnerability determination device 700 provided in the embodiment of the present application can execute the above method embodiment, and its implementation principle and technical effect are similar, which will not be repeated in this embodiment.

[0264] It should be noted that the division of units in the embodiments of the present application is schematic and is only a logical function division. There may be other division methods in actual implementation. In addition, each functional unit in each embodiment of the present application may be integrated into a processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0265] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a processor-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions to enable a computer device (which can be a personal computer, a server, or a network device, etc.) or a processor (processor) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (Read-Only Memory, ROM), random access memory (Random Access Memory, RAM), disk or optical disk and other media that can store program codes.

[0266] like Figure 8 As shown, an embodiment of the present application provides an electronic device 800, including: a memory 802, a processor 801, and a program stored in the memory 802 and executable on the processor 801; the processor 801 is used to read the program in the memory 802 to implement the steps in the method for determining key network vulnerabilities as described above.

[0267] The embodiment of the present application also provides a readable storage medium, on which a program is stored. When the program is executed by a processor, each process of the embodiment of the method for determining key network vulnerabilities described above is implemented, and the same technical effect can be achieved. To avoid repetition, it will not be repeated here. Among them, the readable storage medium can be any available medium or data storage device that can be accessed by the processor, including but not limited to magnetic storage (such as floppy disk, hard disk, magnetic tape, magneto-optical disk (MO), etc.), optical storage (such as compact disk (CD), digital video disc (DVD), Blu-ray Disc (BD), high-definition versatile disc (HVD), etc.), and semiconductor memory (such as read-only memory (ROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read only memory (EEPROM), non-volatile memory (NAND FLASH), solid-state drive (Solid State Disk or Solid State Drive, SSD)), etc.

[0268] It should be noted that, in this article, the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the sentence "comprises a ..." does not exclude the existence of other identical elements in the process, method, article or device including the element.

[0269] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, disk, CD), and includes a number of instructions for a terminal (which can be a mobile phone, computer, server, air conditioner, or network device, etc.) to execute the methods described in each embodiment of the present application.

[0270] The embodiments of the present application are described above in conjunction with the accompanying drawings, but the present application is not limited to the above-mentioned specific implementation methods. The above-mentioned specific implementation methods are merely illustrative and not restrictive. Under the guidance of the present application, ordinary technicians in this field can also make many forms without departing from the purpose of the present application and the scope of protection of the claims, all of which are within the protection of the present application.

Claims

1. A method for determining key network vulnerabilities, characterized in that: include: Calculate the structural index and functional index of the target network, the target network includes N nodes, the structural index is determined based on the network topology of the target network, the functional index is used to characterize the effectiveness of the target network in performing tasks, and N is a positive integer; constructing a vulnerability function based on the structural index and the functional index; Taking maximizing the vulnerability function as the objective function, solving the objective function based on a genetic algorithm under preset constraints to obtain a set of key vulnerable points of the target network, wherein the set of key vulnerable points includes K nodes, where K is a positive integer less than N; The objective function is to maximize the vulnerability function, and the objective function is solved based on a genetic algorithm under preset constraints to obtain a set of key vulnerable points of the target network, including: Determine an initial population, the initial population includes N p Initial chromosomes, N p is a positive integer and an even number; Calculating the fitness value of the initial chromosome based on the fragility function; Performing genetic operations on the initial population based on the fitness value of the initial chromosome; When the termination condition is met, the chromosome with the highest fitness value in the final population obtained by genetic operation is converted into a set of key vulnerable points of the target network for output.

2. The method according to claim 1, characterized in that: The determining of the initial population comprises: Based on the node extraction probability, a sampling operation is performed on the N nodes to obtain 3n p The initial chromosomes, n p is a positive integer, and the extraction probability of the node is positively correlated with the importance of the node; Execute N on the N nodes p -3n p Rounds of random sampling operations, get N p -3n p The initial chromosome.

3. The method according to claim 2, characterized in that: The sampling operation is performed on the N nodes based on the node extraction probability to obtain 3n p The initial chromosomes include: For each of the N nodes, determining a first importance of the node based on the degree centrality of the node, determining a second importance of the node based on the betweenness centrality of the node, and determining a third importance of the node based on the clustering coefficient of the node; Determine a first extraction probability of the node based on a first importance of the node, determine a second extraction probability of the node based on a second importance of the node, and determine a third extraction probability of the node based on a third importance of the node; Based on the first extraction probability of the node, a sampling operation is performed on the N nodes to obtain n p The initial chromosomes are sampled based on the second extraction probability of the nodes to obtain n p The initial chromosomes are sampled based on the third extraction probability of the nodes to obtain n p The initial chromosome.

4. The method according to claim 1, characterized in that: The performing genetic operation on the initial population based on the fitness value of the initial chromosome comprises: Based on the fitness value of the initial chromosome, selecting a plurality of the initial chromosomes from the initial population as parents to enter the mating pool; The initial chromosomes in the mating pool are subjected to a crossover operation according to a preset crossover strategy and a mutation operation according to a preset mutation strategy until the termination condition is met.

5. The method according to claim 4, characterized in that: The chromosome includes a plurality of genes, each of which is coded as 1 or 0; The preset crossover strategy includes: when performing a crossover between a first chromosome and a second chromosome, if an exchange of a gene coded as 1 and a gene coded as 0 occurs at a first position, then an exchange of a gene coded as 0 and a gene coded as 1 is performed at a second position, the first chromosome and the second chromosome are any pair of chromosomes, and the first position and the second position are symmetrical; and / or; The preset mutation strategy includes: if a mutation operation is performed at the third position to change a gene coded as 0 to a gene coded as 1, a gene coded as 1 with a symmetric feature is randomly determined and the code is changed to 0.

6. The method according to claim 5, characterized in that: The performing the crossover operation according to the preset crossover strategy includes: Determine the crossover probability P c , the initial values ​​of the first counter cn1 and the second counter cn2; Execute N p Iterative cross processing, wherein the cross processing includes: Generate a first random number r in the interval [0,1]. If r is less than P c , then execute the current cross processing, otherwise, execute the next cross processing; Generate a random position array to determine the intersection point c; traverse the random position array, if the gene code of the first chromosome at the first position is 0 and the gene code of the second chromosome is 0, cn1=cn1+1; if the gene code of the first chromosome at the first position is 0 and the gene code of the second chromosome is 1, cn2=cn2+1; Determine the number k of gene pairs that need to be exchanged simultaneously, k takes the smaller value of cn1 and cn2, perform symmetric crossover at the corresponding k positions, and then reset cn1=0, cn2=0.

7. The method according to claim 5, characterized in that: The mutation operation according to the preset mutation strategy includes: Determine the mutation probability P m The initial value of For each pair of chromosomes after the crossover operation, a second random number d is generated with a coding range between 0 and 1. <P m When , the mutation operation is performed on the pair of chromosomes, otherwise, the next pair of chromosomes is processed; Create two arrays loc0 and loc1 respectively to record the positions of all genes coded as 0 and 1 in the chromosome; randomly select a position lj0 from loc0, change the gene code at lj0 from 0 to 1, check whether loc1 is not empty, and randomly select a position lj1 and change its gene code from 1 to 0.

8. A device for determining key network vulnerabilities, characterized in that: include: A calculation module, used to calculate the structural index and functional index of the target network, the target network includes N nodes, the structural index is determined based on the network topology of the target network, and the functional index is used to characterize the effectiveness of the target network when performing tasks, and N is a positive integer; A construction module, used for constructing a vulnerability function based on the structural index and the functional index; A solution module, used for taking maximization of the vulnerability function as an objective function, solving the objective function based on a genetic algorithm under preset constraints, and obtaining a set of key vulnerable points of the target network, wherein the set of key vulnerable points includes K nodes, where K is a positive integer less than N; Wherein, the solution module includes: A determination unit, configured to determine an initial population, wherein the initial population includes N p Initial chromosomes, N p is a positive integer and an even number; A calculation unit, used for calculating the fitness value of the initial chromosome based on the fragility function; An execution unit, configured to perform a genetic operation on the initial population based on the fitness value of the initial chromosome; The output unit is used to convert the chromosome with the highest fitness value in the final population obtained by genetic operation into a set of key vulnerable points of the target network for output when the termination condition is met.

9. An electronic device, comprising: A memory, a processor, and a program stored in the memory and executable on the processor; wherein the processor is used to read the program in the memory to implement the steps in the method for determining key network vulnerabilities as described in any one of claims 1 to 7.

10. A readable storage medium for storing a program, characterized in that: When the program is executed by a processor, the steps of the method for determining a critical network vulnerability point according to any one of claims 1 to 7 are implemented.

Images