Network intrusion defense strategy generation method based on instantaneous state Markov modeling

Abstract

The invention discloses a method for generating a network intrusion defense strategy based on instantaneous state Markov modeling, comprising: step 1, performing Markov modeling according to the instantaneous state of a computer, and obtaining the computer's shutdown probability based on the Markov modeling; step 2, correcting the current network intrusion defense strategy of the computer according to the shutdown probability, specifically as follows: judging whether the current shutdown probability is greater than a preset threshold value, if so, increasing the preset number of intrusion attacks N, and executing step 3, otherwise, maintaining the current network intrusion defense strategy, and when the shutdown probability does not exceed the preset threshold value within a preset time, reducing the preset number of intrusion attacks N to reduce the computer load, and executing step 3; step 3, judging whether the computer is shut down, if so, ending the process, otherwise, returning to execute step 1.

Description

Technical Field

[0001] The invention belongs to the technical field of network security, and in particular relates to a network intrusion defense strategy generation method based on instantaneous state Markov modeling. Background Art

[0002] Network intrusion prevention strategy aims to protect computer networks, systems and data from unauthorized access, damage or theft. Network intrusion prevention strategy is a key component of protecting the security of organizational networks and systems, and is essential to maintaining the stable operation and sustainable development of the organization.

[0003] Existing technologies use a variety of strategy generation methods in network intrusion defense, including signature-based detection, behavioral analysis, machine learning models, rule definition, and policy configuration. Signature-based detection relies on known attack features to identify threats, which is suitable for the detection of known threats, but requires continuous updating of the signature library. Behavioral analysis monitors abnormal patterns and can detect unknown attacks, but generally produces a high false alarm rate. Machine learning models build complex detection systems through training data and can identify new attacks, but have high requirements for data quality and model training. Rule definition and policy configuration defend against attacks by setting predefined rules or policies, which are easy to implement but generally cannot cover all threats. Therefore, a network intrusion defense strategy generation method based on instantaneous state Markov modeling is proposed. Summary of the invention

[0004] The purpose of the present invention is to address the above problems and propose a network intrusion defense strategy generation method based on instantaneous state Markov modeling, which has a wider coverage scenario and versatility, can support flexible adjustment of strategies, thereby effectively saving resources and improving overall defense efficiency.

[0005] To achieve the above object, the technical solution adopted by the present invention is:

[0006] The network intrusion defense strategy generation method based on instantaneous state Markov modeling proposed by the present invention comprises the following steps:

[0007] Step 1: Perform Markov modeling based on the instantaneous state of the computer, and obtain the computer's shutdown probability based on Markov modeling , as follows:

[0008] Step 1.1, define the computer to have M instantaneous states, which are respectively recorded as: normal working state I, N non-stop repair state A 0 ,…,A j ,…,A N-1 and shutdown repair state S, where M=N+2, j=0~N-1, N is the preset number of intrusion attacks during the non-stop repair period, A jThe jth non-stop repair state, that is, the computer is repairing one intrusion attack but there are still j intrusion attacks that need to be repaired;

[0009] Step 1.2: Establish state transition rules. The state transition rules are normal working state I and the 0th non-stop repair state A. 0 To the N-1th non-stop repair state A N-1 The shutdown repair state S is transferred to the normal working state I only after all intrusion attacks are repaired;

[0010] Step 1.3: Establish the differential equation of the corresponding state space according to the state transition rule. The state space is divided into the normal working state I, the 0th non-stop repair state A. 0 , the jth non-stop repair state A j , stay in the 0th non-stop repair state A 0 Cumulative time is less than , stay in the jth non-stop repair state A j Cumulative time is less than , downtime repair status S, represents the preset time interval starting from time t;

[0011] Step 1.4: Obtain the shutdown probability of the computer based on the differential equation system formed by each differential equation , as follows:

[0012] Step 1.4.1, perform Laplace transform on the differential equation system formed by each differential equation;

[0013] Step 1.4.2, solve the Laplace transformed differential equations;

[0014] Step 1.4.3: Use the solution of the differential equations after Laplace transformation to obtain the computer shutdown probability ;

[0015] Step 2: Based on downtime probability Modify the computer's current network intrusion prevention policy as follows:

[0016] Determine the current downtime probability Is it greater than the preset threshold? If so, increase the preset number of intrusion attacks N and execute step 3. Otherwise, maintain the current network intrusion defense strategy and shut down the network within the preset time. If the number of intrusion attacks does not exceed the preset threshold, the preset number of intrusion attacks N is reduced to reduce the computer load, and step 3 is executed;

[0017] Step 3: Determine whether the computer is turned off. If so, end the process; otherwise, return to step 1.

[0018] Preferably, the differential equation corresponding to the state space is established according to the state transfer rule, as follows:

[0019] Step 1.3.1, differential equation of normal working state I:

[0020] Normal working state I means that the computer is in Normal operation includes three situations: a. The computer is at Working normally and b. The computer has not been attacked by an intrusion within the time period; b. In the 0th non-stop repair state A 0 The cumulative repair time of the intrusion attack being repaired is x at time t The internal repair is completed and The computer has not been attacked by an intrusion within 10 days; c. In the downtime repair state S, the cumulative repair time of the intrusion attack is x. Internal repair completed;

[0021] Adding the probabilities of the three situations under normal working state I, we can get:

[0022] (1);

[0023] in,

[0024] ;

[0025] In the formula, it is assumed that the computer intrusion attack is a Poisson process with a rate of λ. In normal working state, the computer is at time The probability, P a represents the probability under situation a, P b represents the probability under situation b, P c represents the probability under situation c, In normal working state, the computer is at time The probability of express The infinitesimal amount of represents the differential of x, where x is the first preset time period and is greater than or equal to zero, Indicates that the computer in downtime repair state S is at time The probability of Indicates that at time t and the cumulative repair time is x, it is in the 0th non-stop repair state A 0 The probability density function of represents the hazard function when the cumulative repair time is x, that is, the instantaneous rate of intrusion attack repair completion when the cumulative repair time is x, g(x) is the density function, is the distribution function of g(x);

[0026] Differentiate (1), that is, subtract both sides of the equal sign and divided by , we can get:

[0027] (2);

[0028] By shifting the terms in equation (2), we can finally obtain:

[0029] (3);

[0030] In the formula, Express Derivation;

[0031] Step 1.3.2, No. 0 non-stop repair state A 0 The differential equation is:

[0032] Computer at all times In the 0th non-stop repair state A 0 The cumulative repair time is , that is, the computer at time In the 0th non-stop repair state A 0 And the cumulative repair time is x, and There has been no intrusion attack, and the intrusion attack that is being repaired is still being repaired;

[0033] We can get:

[0034] (4);

[0035] in,

[0036] ;

[0037] ;

[0038] In the formula, Indicates that at time t and when the cumulative repair time is x, it is in the jth non-stop repair state A j The probability density function of Indicates at time The cumulative repair time is It is in the 0th non-stop repair state A 0 The probability density function of X(t) represents the repair time consumed by the current intrusion attack up to time t. Indicates the end time The time spent repairing the current intrusion attack, represents the instantaneous state of the computer at time t, Indicates that the computer is at time The instantaneous state, P r {} is used to describe the probability of the initial state or the probability of the state occurring;

[0039] Substituting both sides of equation (4) and j=0, we can obtain:

[0040] ;

[0041] ;

[0042] (5);

[0043] In the formula, It means that at time t, the cumulative repair time is It is in the 0th non-stop repair state A 0 The probability density function of

[0044] Taking partial derivative of (5), we can finally get:

[0045] (6);

[0046] In the formula, Express middle Find the partial derivative, Express middle Find the partial derivative, ;

[0047] Step 1.3.3: The jth non-stop repair state A j The differential equation is:

[0048] Computer at all times In the jth non-stop repair state A j The cumulative repair time is , that is, the computer at time In the jth non-stop repair state A j The cumulative repair time is , and in There has been no intrusion attack, and the intrusion attack that is being repaired is still being repaired;

[0049] Similar to step 1.3.2, we can get:

[0050] (7);

[0051] In the formula, Express middle Find the partial derivative, Express middle Find the partial derivative, j=1,2,…,N-1, ;

[0052] Step 1.3.4: Stay in the 0th non-stop repair state A 0 Cumulative time is less than The differential equation is:

[0053] Computer at all times In the 0th non-stop repair state A 0 The cumulative repair time is s, where s is the second preset time period and , that is, the moment In the first non-stop repair state A 1 And the cumulative repair time is x, and There is no intrusion attack, the intrusion attack being repaired has been repaired; or In normal working condition I, and An intrusion attack occurred within the

[0054] We can get:

[0055] (8);

[0056] In the formula, Indicates at time When the cumulative repair time is s, it is in the 0th non-stop repair state A 0 The probability density function of Indicates that at time t and the cumulative repair time is x, it is in the first non-stop repair state A 1 The probability density function of

[0057] Replace the left side of the equal sign in equation (8) with Then both parties will go at the same time , we can get:

[0058] ;

[0059] when hour, , we can get:

[0060] (9);

[0061] In the formula, Indicates that at time t and when the cumulative repair time is 0, it is in the 0th non-stop repair state A 0 The probability density function of

[0062] Step 1.3.5: Stay in the jth non-stop repair state A j Cumulative time is less than The differential equation is:

[0063] Computer at all times In the jth non-stop repair state A j And the cumulative repair time is s, that is, the time In the j+1th non-stop repair state A j+1 And the cumulative repair time is x, and There has been no intrusion attack, and the intrusion attack being repaired has been repaired;

[0064] We can get:

[0065] ;

[0066] In the formula, Indicates that the computer is at time When the cumulative repair time is s, it is in the jth non-stop repair state A j The probability density function of Indicates that the computer is in the j+1th non-stop repair state A at time t and the cumulative repair time is x j+1 The probability density function under ;

[0067] when , When , and the left side of the equation is Substituting dx, we get:

[0068] (10);

[0069] In the formula, Indicates that the computer is in the jth non-stop repair state A at time t and the cumulative repair time is 0 j The probability density function of

[0070] Step 1.3.6, differential equation of shutdown repair state S:

[0071] Computer at all times In the downtime repair state S, that is, at time In the N-1th non-stop repair state A N-1 And the cumulative repair time is x, and The system is attacked again within 10 days and the attack being repaired has not been completed;

[0072] We can get:

[0073] ;

[0074] when When , we can get:

[0075] (11);

[0076] In the formula, Indicates that the computer in downtime repair state S is at time The probability of Indicates that the computer is at time When the cumulative repair time is x, it is in the N-1th non-stop repair state A N-1 The probability density function of .

[0077] Preferably, Laplace transform is performed on the differential equation system formed by each differential equation, specifically as follows:

[0078] The Laplace transform is:

[0079] ;

[0080] ;

[0081] ;

[0082] Where u is the variable in Laplace transform, for The image function, is the original function, is the derivative of the original function, is the value of the original function when the independent variable t is 0;

[0083] The differential equations (3), (7), (9), (10), and (11) are summarized into a differential equation system:

[0084] ;

[0085] In the formula, , , ;

[0086] And through Laplace transform, we can get:

[0087] (12);

[0088] (13);

[0089] (14);

[0090] (15);

[0091] (16);

[0092] In the formula, for The image function, for The image function, At time 0, the computer is in the 0th non-stop repair state A 0 The probability of for The image function, for The image function, A is in the jth non-stop repair state at time 0 and the cumulative repair time is x j The probability of for The image function, for The image function, for The image function, for The image function, for The image function.

[0093] Preferably, the Laplace transformed differential equations are solved as follows:

[0094] Step 1.4.2.1. Solve equation (13) in the Laplace transformed differential equation system:

[0095] ;

[0096] (17);

[0097] Where C is a constant;

[0098] make , perform exponential transformation on formula (17), and we can get:

[0099] ;

[0100] (18);

[0101] set up (19);

[0102] Substituting x=0 into (19), we can obtain:

[0103] (20);

[0104] In the formula, is a constant;

[0105] Using equation (14) to solve equation (20):

[0106] (twenty one);

[0107] In the formula, is a constant, is a constant, is the image function of g(x), is the Laplace operator;

[0108] Using the Laplace transformed differential equation (15) to solve (20), we can obtain:

[0109] (twenty two);

[0110] In the formula, is a constant;

[0111] Step 1. 4.2.2. Solve the Laplace transformed differential equation (12) to obtain:

[0112] ;

[0113] Finally, we can get:

[0114] (twenty three);

[0115] Solving the Laplace transformed differential equation (16), we can obtain:

[0116] (twenty four);

[0117] In the formula, is a constant;

[0118] Substituting (24) into (23), we can obtain:

[0119] (25);

[0120] Preferably, the shutdown probability of the computer is obtained by using the solution of the differential equation group after Laplace transformation , that is, according to equations (18), (19), (21), (22), and (25), the probability of each instantaneous state is solved to obtain the shutdown probability of the computer , as follows:

[0121] Step 1. 4.3.1. Solve the jth non-stop repair state A j Probability :

[0122] ;

[0123] make Defined as ,but:

[0124] (26);

[0125] In the formula, is the intermediate variable, j=0,1,2,…,N-1, is the image function of g(x);

[0126] Step 1. 4.3.2. Calculate the probability of normal working state I :

[0127] ;

[0128] (27);

[0129] Multiply both sides of equation (14) by u, and :

[0130] ;

[0131] Finally, we can get:

[0132] (28);

[0133] make Defined as , process (15) and get:

[0134] ;

[0135] Right now:

[0136] (29);

[0137] In the formula, is an intermediate variable;

[0138] Step 1. 4.3.3. Obtain downtime probability :

[0139] (30);

[0140] In summary, the probability of normal working state I Substituting into (28), we can obtain:

[0141] ;

[0142] In summary, combining equations (26), (27), and (30) yields:

[0143] ;

[0144] (31);

[0145] According to equation (29), equation (31) is transformed into The expression is:

[0146] (32);

[0147] Finally, according to equations (29), (30), and (32), we can obtain the computer shutdown probability :

[0148] ;

[0149] (33).

[0150] Preferably, after the state transfer rule is established, a state label is added to the node corresponding to each instantaneous state.

[0151] Preferably, the state label is an identifier corresponding to the transient state or a transition condition between transient states.

[0152] Preferably, the network intrusion defense strategy generation method based on instantaneous state Markov modeling includes six instantaneous states: normal working state I, non-stop repair state A 0 ~A 3 And the shutdown repair state S, that is, the preset number of intrusion attacks N during the non-stop repair period is 4.

[0153] Compared with the prior art, the present invention has the following beneficial effects:

[0154] The network intrusion defense strategy generation method based on instantaneous state Markov modeling provided by the present invention assumes that the intrusion attack on a computer is a Poisson process with a rate of λ, so that once the computer is attacked by the intrusion, it will not be shut down for repair. The length of time for the computer to be repaired without stopping due to a hacker intrusion is a random variable with a density function of g(x). If the computer encounters N consecutive intrusion attacks during a non-stop repair period, the computer will enter the shutdown repair period. During the shutdown repair period, the computer is not attacked by the intrusion, and it resumes work after the repair is completed. By using the instantaneous state-based Markov modeling to calculate the situation to obtain the corresponding shutdown probability to better correct the network intrusion defense strategy, the core idea is to use the Markov model to describe the change process of the computer state, and the probability of the computer being shut down for repair under different circumstances can be obtained, thereby providing an important reference for the generation of network intrusion defense strategies, having a wider coverage scenario and versatility, based on a global perspective, providing high-precision modeling capabilities, and supporting flexible adjustment of strategies, thereby effectively saving resources and improving overall defense efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0155] Figure 1 A flowchart of a network intrusion defense strategy generation method based on instantaneous state Markov modeling according to the present invention;

[0156] Figure 2 This is a schematic diagram of the state transition rule when N is 4 according to the present invention. DETAILED DESCRIPTION

[0157] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0158] It should be noted that, unless otherwise defined, all technical and scientific terms used herein have the same meaning as those commonly understood by those skilled in the art in the technical field of this application. The terms used herein in the specification of this application are only for the purpose of describing specific embodiments and are not intended to limit this application.

[0159] Markov modeling is a mathematical method for describing random processes, in which the state of a system changes at discrete time points, and the probability of each state transition depends only on the previous state and is not affected by the historical state. It is often used to model and predict changes in system states.

[0160] The Markov model is a mathematical model that describes random processes. Its core feature is the Markov modeling property, that is, the probability of the future state is only related to the current state, but not to the historical state. The Markov chain is a special form of the Markov model, which describes the transition process between a series of states. The probability of each state transition depends only on the current state and is independent of the sequence of past states. The Markov model describes the state of the system and the transition between states through state space and transition probability. The state space is the set of all possible states, and the transition probability describes the probability of going from one state to another. The Markov model has the advantages of being simple, intuitive, easy to understand and calculate. It provides an effective way to analyze and predict the evolution of random processes.

[0161] Therefore, based on the characteristics and advantages of Markov modeling, it can be applied to the generation of computer network intrusion defense strategies. In the field of computer network security, intrusion detection and defense are crucial tasks. By using the Markov model, the state changes in the computer network can be modeled and a suitable defense strategy can be generated based on the current state.

[0162] like Figure 1-Figure 2 As shown, the network intrusion defense strategy generation method based on instantaneous state Markov modeling includes the following steps:

[0163] Step 1: Perform Markov modeling based on the instantaneous state of the computer, and obtain the computer's shutdown probability based on Markov modeling , as follows:

[0164] Step 1.1, define the computer to have M instantaneous states, which are respectively recorded as: normal working state I, N non-stop repair state A 0 ,…,A j ,…,A N-1 and shutdown repair state S, where M=N+2, j=0~N-1, N is the preset number of intrusion attacks during the non-stop repair period, A j It is the jth non-stop repair state, that is, the computer is repairing one intrusion attack but there are still j intrusion attacks that need to be repaired.

[0165] Among them, I represents the normal working state, that is, the computer is not attacked by intrusion; A j The jth non-stop repair state is represented by S, which means that the computer is repairing an intrusion attack but still has j intrusion attacks to repair. S represents the shutdown repair state, when the computer is not attacked by intrusion. By defining the instantaneous state of the computer, the complex state is abstracted into a set of discrete states, which is conducive to simplifying the modeling and analysis of the computer system.

[0166] This embodiment determines that the computer includes six transient states: I (normal working state), A0 ~A 3 (non-stop repair state) and S (stop repair state), that is, the preset number of intrusion attacks during the non-stop repair period is 4. Specifically, computer intrusion attack is a Poisson process with a rate of λ. Once a computer is attacked by a hacker, it will not be stopped for repair. The length of time for non-stop repair of the computer caused by a hacker intrusion attack is a random variable with a density function of g(x), that is, the density function g(x) is a random variable that conforms to the Poisson distribution when the cumulative repair time is x, which belongs to the prior probability. If there are 4 consecutive hacker intrusion attacks during a non-stop repair period, the computer will enter the shutdown repair state. During the shutdown repair period, the computer is not attacked by hackers, and the computer returns to normal working state after the repair is completed.

[0167] Step 1.2: Establish state transition rules. The state transition rules are normal working state I and the 0th non-stop repair state A. 0 To the N-1th non-stop repair state A N-1 The shutdown repair state S is transferred to the normal working state I only after all intrusion attacks are repaired.

[0168] For example, in this embodiment, the normal working state I can be transferred to the 0th non-stop repair state A 0 , the 0th non-stop repair state A 0 Can be transferred to the first non-stop repair state A 1 , the first non-stop repair state A 1 Can be transferred to the second non-stop repair state A 2 , the second non-stop repair state A 2 Can be transferred to the third non-stop repair state A 3 , the shutdown repair state S is not attacked by hackers during the shutdown repair period, and can only be converted from the shutdown repair state S to the normal working state I after all the intrusion attacks are repaired. It is easy to understand that the normal working state I, the 0th non-stop repair state A 0 To the N-1th non-stop repair state A N-1 , the shutdown and repair states S are transferred in sequence, which can be forward or reverse order. If the attack is continuous, the state will be transferred backward (forward order); if the attack is repaired in time, the state will be transferred forward (reverse order, such as Figure 2 shown), Figure 2 In the figure, the arrow indicates the transfer direction, repair indicates repair, and attack indicates intrusion attack.

[0169] In one embodiment, after the state transition rule is established, a state label is added to the node corresponding to each instantaneous state. The state label facilitates a clearer understanding of the state transition rule, making the subsequent state conversion more intuitive and facilitating instantaneous state Markov modeling.

[0170] In one embodiment, the state tag is an identifier of the corresponding transient state or a transition condition between transient states, which can be set according to actual needs to identify the corresponding transient state and indicate the meaning of the corresponding transient state, such as the transition condition between transient states can be being attacked by an intrusion or being repaired.

[0171] Step 1.3: Establish a differential equation for the corresponding state space according to the state transfer rule. The state space is divided into a normal working state I, a zeroth non-stop repair state A, and a 0 , the jth non-stop repair state A j , stay in the 0th non-stop repair state A 0 Cumulative time is less than , stay in the jth non-stop repair state A j Cumulative time is less than , shutdown repair state S, represents the preset time interval starting from time t, and tends to infinitesimal, as follows:

[0172] Step 1.3.1, differential equation of normal working state I:

[0173] Normal working state I means that the computer is in Normal operation includes three situations: a. The computer is at Working normally and b. The computer has not been attacked by an intrusion within the time period; b. In the 0th non-stop repair state A 0 The cumulative repair time of the intrusion attack being repaired is x at time t The internal repair is completed and The computer has not been attacked by an intrusion within 10 days; c. In the downtime repair state S, the intrusion attack that is being repaired with a cumulative repair time of x is Internal repair completed;

[0174] Adding the probabilities of the three situations under normal working state I, we can get:

[0175] (1);

[0176] in,

[0177] ;

[0178] In the formula, it is assumed that the computer intrusion attack is a Poisson process with a rate of λ. In normal working state, the computer is at time The probability, P a represents the probability under situation a, P b represents the probability under situation b, P c represents the probability under situation c, In normal working state, the computer is at time The probability of express The infinitesimal amount of represents the differential of x, where x is the first preset time period and is greater than or equal to zero, Indicates that the computer in downtime repair state S is at time The probability of Indicates that at time t and the cumulative repair time is x, it is in the 0th non-stop repair state A 0 The probability density function of represents the hazard function when the cumulative repair time is x, that is, the instantaneous rate of intrusion attack repair completion when the cumulative repair time is x, g(x) is the density function, is the distribution function of g(x);

[0179] Differentiate (1), that is, subtract both sides of the equal sign and divided by , we can get:

[0180] (2);

[0181] By shifting the terms in equation (2), we can finally obtain:

[0182] (3);

[0183] In the formula, Express Derivation;

[0184] Step 1.3.2, No. 0 non-stop repair state A 0 The differential equation is:

[0185] Computer at all times In the 0th non-stop repair state A 0 The cumulative repair time is , that is, the computer at time In the 0th non-stop repair state A 0 And the cumulative repair time is x, and There has been no intrusion attack, and the intrusion attack that is being repaired is still being repaired;

[0186] We can get:

[0187] (4);

[0188] in,

[0189] ;

[0190] ;

[0191] In the formula, Indicates that at time t and when the cumulative repair time is x, it is in the jth non-stop repair state A j The probability density function of Indicates at time The cumulative repair time is It is in the 0th non-stop repair state A 0 The probability density function of X(t) represents the repair time consumed by the current intrusion attack up to time t. Indicates the end time The time spent repairing the current intrusion attack, represents the instantaneous state of the computer at time t, Indicates that the computer is at time The instantaneous state, P r {} is used to describe the probability of the initial state or the probability of the state occurring;

[0192] Substituting both sides of equation (4) and j=0, we can obtain:

[0193] ;

[0194] ;

[0195] (5);

[0196] In the formula, It means that at time t, the cumulative repair time is It is in the 0th non-stop repair state A 0 The probability density function of

[0197] Taking partial derivative of (5), we can finally get:

[0198] (6);

[0199] In the formula, Express middle Find the partial derivative, Express middle Find the partial derivative, ;

[0200] Step 1.3.3: The jth non-stop repair state A j The differential equation is:

[0201] Computer at all times In the jth non-stop repair state A j The cumulative repair time is , that is, the computer at time In the jth non-stop repair state A j The cumulative repair time is , and in There has been no intrusion attack, and the intrusion attack that is being repaired is still being repaired;

[0202] Similar to step 1.3.2, we can get:

[0203] (7);

[0204] In the formula, Express middle Find the partial derivative, Express middle Find the partial derivative, j=1,2,…,N-1, ;

[0205] Step 1.3.4: Stay in the 0th non-stop repair state A 0 Cumulative time is less than The differential equation is:

[0206] Computer at all times In the 0th non-stop repair state A 0 The cumulative repair time is s, where s is the second preset time period and , that is, the moment In the first non-stop repair state A 1 And the cumulative repair time is x, and There is no intrusion attack, the intrusion attack being repaired has been repaired; or In normal working condition I, and An intrusion attack occurred within the

[0207] We can get:

[0208] (8);

[0209] In the formula, Indicates at time When the cumulative repair time is s, it is in the 0th non-stop repair state A 0 The probability density function of Indicates that at time t and the cumulative repair time is x, it is in the first non-stop repair state A 1 The probability density function of

[0210] Replace the left side of the equal sign in equation (8) with Then both parties will go at the same time , we can get:

[0211] ;

[0212] when hour, , we can get:

[0213] (9);

[0214] In the formula, Indicates that at time t and when the cumulative repair time is 0, it is in the 0th non-stop repair state A 0 The probability density function of

[0215] Step 1.3.5: Stay in the jth non-stop repair state A j Cumulative time is less than The differential equation is:

[0216] Computer at all times In the jth non-stop repair state A j And the cumulative repair time is s, that is, the time In the j+1th non-stop repair state A j+1 And the cumulative repair time is x, and There has been no intrusion attack, and the intrusion attack being repaired has been repaired;

[0217] We can get:

[0218] ;

[0219] In the formula, Indicates that the computer is at time When the cumulative repair time is s, it is in the jth non-stop repair state A j The probability density function of Indicates that the computer is in the j+1th non-stop repair state A at time t and the cumulative repair time is x j+1 The probability density function under ;

[0220] when , When , and the left side of the equation is Substituting dx, we get:

[0221] (10);

[0222] In the formula, Indicates that the computer is in the jth non-stop repair state A at time t and the cumulative repair time is 0 j The probability density function of

[0223] Step 1.3.6, differential equation of shutdown repair state S:

[0224] Computer at all times In the downtime repair state S, that is, at time In the N-1th non-stop repair state A N-1 And the cumulative repair time is x, and The system is attacked again within 10 days and the attack being repaired has not been completed;

[0225] We can get:

[0226] ;

[0227] when When , we can get:

[0228] (11);

[0229] In the formula, Indicates that the computer in downtime repair state S is at time The probability of Indicates that the computer is at time When the cumulative repair time is x, it is in the N-1th non-stop repair state A N-1 The probability density function of

[0230] Step 1.4: Obtain the shutdown probability of the computer based on the differential equation system formed by each differential equation , as follows:

[0231] Step 1.4.1: Perform Laplace transform on the differential equation system formed by each differential equation, as follows:

[0232] The Laplace transform is:

[0233] ;

[0234] ;

[0235] ;

[0236] Where u is the variable in Laplace transform, for The image function, is the original function, is the derivative of the original function, is the value of the original function when the independent variable t is 0;

[0237] The differential equations (3), (7), (9), (10), and (11) are summarized into a differential equation system:

[0238] ;

[0239] In the formula, , , ;

[0240] And through Laplace transform, we can get:

[0241] (12);

[0242] (13);

[0243] (14);

[0244] (15);

[0245] (16);

[0246] In the formula, for The image function, for The image function, At time 0, the computer is in the 0th non-stop repair state A 0 The probability of for The image function, for The image function, A is in the jth non-stop repair state at time 0 and the cumulative repair time is x j The probability of for The image function, for The image function, for The image function, for The image function, for The image function of

[0247] Step 1. 4.2, solve the Laplace transformed differential equations as follows:

[0248] Step 1. 4.2.1. Solve equation (13) in the Laplace transformed differential equation system:

[0249] ;

[0250] (17);

[0251] Where C is a constant;

[0252] make , perform exponential transformation on formula (17), and we can get:

[0253] ;

[0254] (18);

[0255] set up (19);

[0256] Substituting x=0 into (19), we can obtain:

[0257] (20);

[0258] In the formula, is a constant;

[0259] Using equation (14) to solve equation (20):

[0260] (twenty one);

[0261] In the formula, is a constant, is a constant, is the image function of g(x), is the Laplace operator;

[0262] Using the Laplace transformed differential equation (15) to solve (20), we can obtain:

[0263] (twenty two);

[0264] In the formula, is a constant;

[0265] Step 1. 4.2.2. Solve the Laplace transformed differential equation (12) to obtain:

[0266] ;

[0267] Finally, we can get:

[0268] (twenty three);

[0269] Solving the Laplace transformed differential equation (16), we can obtain:

[0270] (twenty four);

[0271] In the formula, is a constant;

[0272] Substituting (24) into (23), we can obtain:

[0273] (25);

[0274] Step 1.4.3: Use the solution of the differential equations after Laplace transformation to obtain the computer shutdown probability , as follows:

[0275] According to equations (18), (19), (21), (22), and (25), the probability of each instantaneous state is solved respectively:

[0276] Step 1. 4.3.1. Solve the jth non-stop repair state A j Probability :

[0277] ;

[0278] make Defined as ,but:

[0279] (26);

[0280] In the formula, is the intermediate variable, j=0,1,2,…,N-1, is the image function of g(x);

[0281] Step 1. 4.3.2. Calculate the probability of normal working state I :

[0282] ;

[0283] (27);

[0284] Multiply both sides of equation (14) by u, and :

[0285] ;

[0286] Finally, we can get:

[0287] (28);

[0288] make Defined as , process (15) and get:

[0289] ;

[0290] Right now:

[0291] (29);

[0292] In the formula, is an intermediate variable;

[0293] Step 1. 4.3.3. Obtain downtime probability :

[0294] (30);

[0295] In summary, the probability of normal working state I Substituting into (28), we can obtain:

[0296] ;

[0297] In summary, combining equations (26), (27), and (30) yields:

[0298] ;

[0299] (31);

[0300] According to equation (29), equation (31) is transformed into The expression is:

[0301] (32);

[0302] Finally, according to equations (29), (30), and (32), we can obtain the computer shutdown probability :

[0303] ;

[0304] (33).

[0305] Step 2: Based on downtime probability Modify the computer's current network intrusion prevention policy as follows:

[0306] Determine the current downtime probability Is it greater than the preset threshold? If so, increase the preset number of intrusion attacks N and execute step 3. Otherwise, maintain the current network intrusion defense strategy and shut down the network within the preset time. If the number of intrusion attacks does not exceed the preset threshold, the preset number of intrusion attacks N is reduced to reduce the computer load, and step 3 is performed.

[0307] According to the probability of downtime Modify the network intrusion defense strategy, that is, abstract the process of several computer intrusion attacks and repairs according to the above operations, convert them into several instantaneous states for Markov modeling, and calculate the downtime probability To adjust the network intrusion defense strategy. In order to ensure a good user experience, while ensuring security, the downtime probability must not be too high to affect the actual use of users. For example, if the preset threshold is set to 5%, the downtime event will be a low-probability event. If the downtime probability is greater than 5%, the maximum number of unrepaired intrusion attacks that the network intrusion defense strategy can withstand at the same time is increased, that is, N is increased, so that more intrusion attacks can be in a repair state at the same time to ensure the normal working experience of users. Furthermore, if the downtime probability does not exceed the preset threshold within the preset time, N is appropriately reduced to reduce the computer load.

[0308] Step 3: determine whether the computer is turned off. If so, end the process. Otherwise, return to step 1. Repeat the judgment until the computer is turned off. The network intrusion defense strategy can be corrected in real time during the computer operation, ensuring security while improving the user experience.

[0309] The technical features of the above-described embodiments may be arbitrarily combined. To make the description concise, not all possible combinations of the technical features in the above-described embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0310] The above-described embodiments only express the more specific and detailed embodiments described in this application, but they cannot be understood as limiting the scope of the patent application. It should be pointed out that for ordinary technicians in this field, several modifications and improvements can be made without departing from the concept of this application, which all belong to the protection scope of this application. Therefore, the protection scope of the patent application shall be based on the attached claims.

Claims

1. A network intrusion defense strategy generation method based on instantaneous state Markov modeling, characterized by: The network intrusion defense strategy generation method based on instantaneous state Markov modeling comprises the following steps: Step 1: Perform Markov modeling based on the instantaneous state of the computer, and obtain the computer's shutdown probability based on Markov modeling , as follows: Step 1.1, define the computer to have M instantaneous states, which are respectively recorded as: normal working state I, N non-stop repair states A0,…,A j ,…,A N-1 and shutdown repair state S, where M=N+2, j=0~N-1, N is the preset number of intrusion attacks during the non-stop repair period, A j The jth non-stop repair state, that is, the computer is repairing one intrusion attack but there are still j intrusion attacks that need to be repaired; Step 1.2, establish a state transition rule, the state transition rule is normal working state I, the 0th non-stop repair state A0 to the N-1th non-stop repair state A N-1 The shutdown repair state S is transferred to the normal working state I only after all intrusion attacks are repaired; Step 1.3: Establish a differential equation for the corresponding state space according to the state transfer rule. The state space is divided into a normal working state I, a zeroth non-stop repair state A0, and a jth non-stop repair state A j , the cumulative time of staying in the 0th non-stop repair state A0 is less than , stay in the jth non-stop repair state A j Cumulative time is less than , shutdown repair state S, represents the preset time interval starting from time t; Step 1.4: Obtain the shutdown probability of the computer based on the differential equation system formed by each differential equation , as follows: Step 1.4.1, perform Laplace transform on the differential equation system formed by each differential equation; Step 1.4.2, solve the Laplace transformed differential equations; Step 1.4.3: Use the solution of the differential equations after Laplace transformation to obtain the computer shutdown probability ; Step 2: Based on downtime probability Modify the computer's current network intrusion prevention policy as follows: Determine the current downtime probability Is it greater than the preset threshold? If so, increase the preset number of intrusion attacks N and execute step 3. Otherwise, maintain the current network intrusion defense strategy and shut down the network within the preset time. If the number of intrusion attacks does not exceed the preset threshold, the preset number of intrusion attacks N is reduced to reduce the computer load, and step 3 is executed; Step 3: Determine whether the computer is turned off. If so, end the process; otherwise, return to step 1.

2. The method for generating a network intrusion defense strategy based on instantaneous state Markov modeling as claimed in claim 1, characterized in that: The differential equation corresponding to the state space is established according to the state transfer rule, which is as follows: Step 1.3.1, differential equation of normal working state I: Normal working state I means that the computer is in Normal operation includes three situations: a. The computer is at Working normally and b. The computer has not been attacked by an intrusion within the time period; b. The intrusion attack in the 0th non-stop repair state A0 and the cumulative repair time is x at time t The internal repair is completed and The computer has not been attacked by an intrusion within 10 days; c. In the downtime repair state S, the cumulative repair time of the intrusion attack is x. Internal repair completed; Adding the probabilities of the three situations under normal working state I, we can get: (1)； in, ； In the formula, it is assumed that the computer intrusion attack is a Poisson process with a rate of λ. In normal working state, the computer is at time The probability, P a represents the probability under situation a, P b represents the probability under situation b, P c represents the probability under situation c, In normal working state, the computer is at time The probability of express The infinitesimal amount of represents the differential of x, where x is the first preset time period and is greater than or equal to zero, Indicates that the computer in downtime repair state S is at time The probability of represents the probability density function of the zeroth non-stop repair state A0 at time t and when the cumulative repair time is x, represents the hazard function when the cumulative repair time is x, that is, the instantaneous rate of intrusion attack repair completion when the cumulative repair time is x, g(x) is the density function, is the distribution function of g(x); Differentiate (1), that is, subtract both sides of the equal sign and divided by , we can get: (2)； By shifting the terms in equation (2), we can finally obtain: (3)； In the formula, Express Derivation; Step 1.3.2, the differential equation of the 0th non-stop repair state A0: Computer at all times It is in the 0th non-stop repair state A0 and the cumulative repair time is , that is, the computer at time It is in the 0th non-stop repair state A0 and the cumulative repair time is x, and There has been no intrusion attack, and the intrusion attack that is being repaired is still being repaired; We can get: (4)； in, ； ； In the formula, Indicates that at time t and when the cumulative repair time is x, it is in the jth non-stop repair state A j The probability density function of Indicates at time The cumulative repair time is The probability density function of the zeroth non-stop repair state A0 is given by X(t), and X(t) represents the repair time consumed by the current intrusion attack up to time t. Indicates the end time The time spent repairing the current intrusion attack, represents the instantaneous state of the computer at time t, Indicates that the computer is at time The instantaneous state, P r {} is used to describe the probability of the initial state or the probability of the state occurring; Substituting both sides of equation (4) and j=0, we can obtain: ； ； (5)； In the formula, It means that at time t, the cumulative repair time is The probability density function of being in the 0th non-stop repair state A0 at time; Taking partial derivative of (5), we can finally get: (6)； In the formula, Express middle Find the partial derivative, Express middle Find the partial derivative, ; Step 1.3.3: The jth non-stop repair state A j The differential equation is: Computer at all times In the jth non-stop repair state A j The cumulative repair time is , that is, the computer at time In the jth non-stop repair state A j The cumulative repair time is , and in There has been no intrusion attack, and the intrusion attack that is being repaired is still being repaired; Similar to step 1.3.2, we can get: (7)； In the formula, Express middle Find the partial derivative, Express middle Find the partial derivative, j=1,2,…,N-1, ; Step 1.3.4: Stay in the 0th non-stop repair state A0 for a cumulative time less than The differential equation is: Computer at all times The system is in the 0th non-stop repair state A0 and the cumulative repair time is s, where s is the second preset time period and , that is, the moment In the first non-stop repair state A1 and the cumulative repair time is x, and There is no intrusion attack, the intrusion attack being repaired has been repaired; or In normal working condition I, and An intrusion attack occurred within the We can get: (8)； In the formula, Indicates at time The probability density function of the zeroth non-stop repair state A0 when the cumulative repair time is s is: represents the probability density function of being in the first non-stop repair state A1 at time t and the cumulative repair time is x; Replace the left side of the equal sign in equation (8) with Then both parties will go at the same time , we can get: ； when hour, , we can get: (9)； In the formula, It represents the probability density function of being in the 0th non-stop repair state A0 at time t and the cumulative repair time is 0; Step 1.3.5: Stay in the jth non-stop repair state A j Cumulative time is less than The differential equation is: Computer at all times In the jth non-stop repair state A j And the cumulative repair time is s, that is, the time In the j+1th non-stop repair state A j+1 And the cumulative repair time is x, and There has been no intrusion attack, and the intrusion attack being repaired has been repaired; We can get: ； In the formula, Indicates that the computer is at time When the cumulative repair time is s, it is in the jth non-stop repair state A j The probability density function of Indicates that the computer is in the j+1th non-stop repair state A at time t and the cumulative repair time is x j+1 The probability density function under ; when , When , and the left side of the equation is Substituting dx, we get: (10)； In the formula, Indicates that the computer is in the jth non-stop repair state A at time t and the cumulative repair time is 0 j The probability density function of Step 1.3.6, differential equation of shutdown repair state S: Computer at all times In the downtime repair state S, that is, at time In the N-1th non-stop repair state A N-1 And the cumulative repair time is x, and The system is attacked again within 10 days and the attack being repaired has not been completed; We can get: ； when When , we can get: (11)； In the formula, Indicates that the computer in downtime repair state S is at time The probability of Indicates that the computer is at time When the cumulative repair time is x, it is in the N-1th non-stop repair state A N-1 The probability density function of .

3. The method for generating a network intrusion defense strategy based on instantaneous state Markov modeling as claimed in claim 2, characterized in that: The Laplace transform of the differential equation system formed by each differential equation is specifically as follows: The Laplace transform is: ； ； ； Where u is the variable in Laplace transform, for The image function, is the original function, is the derivative of the original function, is the value of the original function when the independent variable t is 0; The differential equations (3), (7), (9), (10), and (11) are summarized into a differential equation system: ； In the formula, , , ; And through Laplace transform, we can get: (12)； (13)； (14)； (15)； (16)； In the formula, for The image function, for The image function, is the probability that the computer is in the zeroth non-stop repair state A0 at time 0, for The image function, for The image function, A is in the jth non-stop repair state at time 0 and the cumulative repair time is x j The probability of for The image function, for The image function, for The image function, for The image function, for The image function.

4. The method for generating a network intrusion defense strategy based on instantaneous state Markov modeling as claimed in claim 3, characterized in that: The differential equations after solving the Laplace transformation are as follows: Step 1.4.2.

1. Solve equation (13) in the Laplace transformed differential equation system: ； (17)； Where C is a constant; make , perform exponential transformation on formula (17), and we can get: ； (18)； set up (19); Substituting x=0 into (19), we can obtain: (20)； In the formula, is a constant; Using equation (14) to solve equation (20): (21)； In the formula, is a constant, is a constant, is the image function of g(x), is the Laplace operator; Using the Laplace transformed differential equation (15) to solve (20), we can obtain: (22)； In the formula, is a constant; Step 1. 4.2.

2. Solve the Laplace transformed differential equation (12) to obtain: ； Finally, we can get: (23)； Solving the Laplace transformed differential equation (16), we can obtain: (24)； In the formula, is a constant; Substituting (24) into (23), we can obtain: (25)。 5. The method for generating a network intrusion defense strategy based on instantaneous state Markov modeling as claimed in claim 4, characterized in that: The shutdown probability of the computer is obtained by solving the differential equation group after Laplace transformation. , that is, according to equations (18), (19), (21), (22), and (25), the probability of each instantaneous state is solved to obtain the shutdown probability of the computer , as follows: Step 1. 4.3.

1. Solve the jth non-stop repair state A j Probability : ； make Defined as ,but: (26)； In the formula, is the intermediate variable, j=0,1,2,…,N-1, is the image function of g(x); Step 1. 4.3.

2. Calculate the probability of normal working state I : ； (27)； Multiply both sides of equation (14) by u, and : ； Finally, we can get: (28)； make Defined as , process (15) and get: ； Right now: (29)； In the formula, is an intermediate variable; Step 1. 4.3.

3. Obtain downtime probability : (30)； In summary, the probability of normal working state I Substituting into (28), we can obtain: ； In summary, combining equations (26), (27), and (30) yields: ； (31)； According to equation (29), equation (31) is transformed into The expression is: (32)； Finally, according to equations (29), (30), and (32), we can obtain the computer shutdown probability : ； (33)。 6. The method for generating a network intrusion defense strategy based on instantaneous state Markov modeling as claimed in claim 1, characterized in that: After the state transfer rule is established, a state label is added to each node corresponding to the instantaneous state.

7. The method for generating a network intrusion defense strategy based on instantaneous state Markov modeling as claimed in claim 6, characterized in that: The state label is an identifier corresponding to a transient state or a transition condition between transient states.

8. The method for generating a network intrusion defense strategy based on instantaneous state Markov modeling as claimed in claim 1, characterized in that: The network intrusion defense strategy generation method based on instantaneous state Markov modeling includes six instantaneous states: normal working state I, non-stop repair states A0-A3 and non-stop repair state S, that is, the preset number of intrusion attacks N during the non-stop repair period is 4.

Images