A network security evaluation system and method based on a dynamic attack-defense game model

Abstract

The application belongs to the field of network security, and discloses a network security evaluation system and method based on a dynamic attack-defense game model, wherein the evaluation system comprises four functional modules of attack-defense game construction, risk prediction, dynamic defense optimization and security situation awareness.The application introduces the idea of dynamic attack-defense game, carries out multi-level and multi-scene attack-defense simulation according to historical state, strategy data and real-time data, calculates and analyzes the best attack path and attack strategy through game equilibrium solution, pre-trains the generated defense rule base relying on reinforcement learning and deep learning technology, dynamically adjusts network resources and network security resources, and optimizes network configuration according to real-time evaluation results to reduce the waste of system resources.Through the execution of the system and method in the application, the security of the target network can be dynamically evaluated, the security defense strategy of the network can be real-timely adjusted, and unknown attacks such as advanced persistent threat (APT) and zero-day attack can be effectively resisted.

Description

Technical Field

[0001] The present invention belongs to the technical field of network security, and in particular relates to a network security assessment system and method based on a dynamic attack and defense game model. Background Art

[0002] Currently, the security assessment of networks under evaluation primarily relies on traditional static analysis. This involves scanning and analyzing vulnerability information such as vulnerabilities, backdoors, and weak passwords at each network node, and then assessing the security of the entire network based on a pre-defined assessment model. This approach suffers from several technical issues: The assessment data primarily relies on network status and historical traffic data, resulting in a lack of real-time results. It only considers known threats and detects them through rule or feature library comparisons, failing to incorporate attacker behavior into the model, making it difficult to address unknown attacks such as advanced persistent threats (APTs) and zero-day attacks. Furthermore, it is unable to capture dynamic changes in network attack and defense behavior, especially in the face of complex, multi-layered attacks. The lag in static analysis makes it ineffective in preventing persistent attacks.

[0003] Some studies have introduced game theory models into network threat assessment, incorporating the behavioral game characteristics of both the offensive and defensive sides into the model calculations, but failed to consider the deviations caused by the dynamic evolution of the strategies of both parties. The assessment results are one-sided and limited, making it difficult to provide a comprehensive and timely security defense strategy. Summary of the Invention

[0004] In response to existing technical problems, the present invention provides a network security assessment system and method based on a dynamic attack-defense game model from the perspective of the behavioral game between the attacker and the defender, relying on pre-trained models and real-time network data.

[0005] The present invention is implemented as follows: a network security situation assessment and defense system based on attack and defense game includes:

[0006] An attack-defense game construction module collects historical network attack data, network topology information, and data from the defense strategy library to construct a multi-level attack path model and a defender response strategy model. This attack-defense game model simulates attackers selecting different attack paths and attack tools, and defenders deploying defense measures based on the attack paths. This generates an attack-defense game equilibrium solution and provides preliminary defense recommendations.

[0007] A risk prediction module, connected to the attack-defense game building module, is used to perform risk assessment on potential attack behaviors by simulating different attack scenarios multiple times, generate predicted risk values, and provide a detailed risk assessment report;

[0008] The dynamic defense optimization module receives the output of the risk prediction module and dynamically adjusts the network defense strategy based on the game model results to optimize resource allocation and reduce potential losses.

[0009] The real-time monitoring module collects information such as network traffic, user behavior analysis, and system logs through sensors, and uses this information as input to the game model to update the input parameters of risk assessment and achieve dynamic adjustment of defense strategies.

[0010] The security situation awareness module is used to generate a real-time security situation map by collecting sensor data such as network traffic monitoring, user behavior analysis, and system logs, dynamically adjust the parameters in the game model, and optimize the defense strategy;

[0011] The defense feedback and execution module receives the security situation map generated by the security situation awareness module, adjusts the defense strategy in real time, and feeds back the defense strategy to devices such as firewalls, intrusion detection systems, and traffic controllers to ensure that the defense strategy matches the current network environment.

[0012] Furthermore, the attack and defense game building module is implemented as follows:

[0013] Collection and analysis of historical data:

[0014] Collect historical attack data on the network, including the attack methods, attack paths, network vulnerabilities, and intrusion points used by attackers; combine network topology information to establish a library of potential attack paths for attackers;

[0015] The defender's strategy includes the configuration of each protection node, the allocation strategy of network resources, the rules of firewalls and intrusion detection systems, and defense measures to deal with different types of attacks.

[0016] Furthermore, the attack and defense strategy game model is constructed:

[0017] Use game theory models to define the action space of both attackers and defenders, i.e., the attacker's attack path selection and the defender's defensive measures deployment, and convert it into the state space of the attack-defense game;

[0018] Set the utility function of the attacker and defender, that is, the attacker tries to maximize the destructive benefits through attack means, while the defender minimizes the losses by deploying defense strategies; the strategies of both parties in action selection can be solved through Nash equilibrium.

[0019] Furthermore, the risk prediction module is implemented as follows:

[0020] (1) Multi-scenario game simulation

[0021] Multi-scenario simulation: By simulating multiple possible attack scenarios, the system can anticipate the paths and strategies that attackers may adopt under different conditions. Specifically, this includes the attacker's intrusion path, attack targets, and methods used, such as DDOS attacks, SQL injections, and data theft, as well as how the system responds to these attacks.

[0022] Game model: The system treats attackers and defenders as two parties in a game and uses game theory strategies to simulate the attacker's decision-making process and the defender's response behavior. Through multiple simulations, the system can assess the attacker's success probability and calculate the risk value of the network system under different attack scenarios.

[0023] (2) Training of risk prediction models

[0024] This multi-scenario simulation doesn't directly train the model, but rather provides it with rich data and scenarios for risk assessment. By simulating the game model, the system can generate a variety of possible attack data, which can be used to assess the weaknesses and potential risks of the network system.

[0025] Machine learning model training: For the risk prediction module, the machine learning model trained can be a small-sample model. This small-sample model, with limited sample data, leverages existing attack and defense data through methods such as transfer learning or reinforcement learning, enabling the model to achieve good generalization capabilities even on data generated by multi-scenario simulations. This approach can improve model performance by combining limited real-world data with simulated data.

[0026] Multi-scenario simulations generate a large amount of data from different attack paths. This data is used to train machine learning models. Even with limited real-world attack samples, simulations can expand the dataset and improve the model's learning. Small-sample training models leverage this limited data, combined with methods such as transfer learning and reinforcement learning, to predict future attacks and assess risks, helping administrators take preventative measures.

[0027] (3) Risk assessment and prediction

[0028] The system uses a trained machine learning model to predict the risk of attack behavior. This model combines the results of game simulation to assess the potential risks of each attack path and provide strategic recommendations to the defender.

[0029] Output: Ultimately, the risk prediction module outputs an assessment of potential attack paths, success probabilities, possible risk values, and response recommendations based on the current network state. This not only helps network administrators understand network weaknesses but also allows them to take proactive measures to reduce the success rate of attacks.

[0030] (4) Applicability and performance optimization

[0031] Since this method relies on data generated by multi-scenario game simulation when the data sample is limited, the model can still have high practicality and accuracy under small sample conditions.

[0032] Furthermore, the implementation of the dynamic defense optimization module:

[0033] Optimized configuration of defense resources:

[0034] Based on risk assessment results and current network resources, the system automatically optimizes the allocation of defense resources, including computing resources and bandwidth, to minimize defense costs while maintaining optimal protection effectiveness.

[0035] The system converts different defense strategies, including adjustments to firewall rules, IDS detection modes, and malicious code detection rules, into executable defense tasks and deploys them across the entire network through a central control system.

[0036] Generation of defense rule base based on deep learning:

[0037] The system automatically generates a defense rule library suitable for different attack strategies through deep learning analysis of historical attack data; it uses deep neural networks or convolutional neural networks for feature extraction;

[0038] Defense rules refer to the specific protective measures the system takes in response to different attack strategies. By analyzing historical attack data, the system identifies common attack patterns and characteristics and automatically generates corresponding response rules. These rules include protection strategies, traffic filtering rules, and access control policies, enabling rapid response when similar attacks are detected, mitigating potential damage.

[0039] The system continuously self-learns and iteratively optimizes defense strategies to respond to new and unknown threats.

[0040] Furthermore, the implementation of the security situation awareness module:

[0041] Network situational awareness:

[0042] Through various sensor data including network traffic monitors, behavior analysis systems, and system logs, the security status of each node in the network is monitored in real time, and a real-time situation map is generated to display the security threats currently facing the network.

[0043] The system will dynamically adjust the parameters in the attack and defense game model according to the real-time network situation and recalculate the optimal defense strategy based on new threat information;

[0044] Dynamic update and analysis of situation map:

[0045] Implement dynamic situation map update technology, use distributed computing platforms to quickly process massive data, and display situation maps to administrators through visualization technology;

[0046] The system will automatically feed back the threat information in the situation map to the game model as a reference for adjusting the next round of defense strategy.

[0047] Another object of the present application is to provide a network security evaluation method based on attack-defense game, comprising:

[0048] Step 1, a game theory model is introduced into the system through an attack-defense game construction module to simulate the dynamic interaction process between attackers and defenders; the module first constructs a multi-level attack path model of the attacker and a response strategy model of the defender according to historical attack data and network topology information; the strategies of the attack-defense parties include attack path selection, defense measure deployment, and resource allocation;

[0049] Step 2, the risk prediction module uses the game model to perform multiple simulations to predict the risk value that the network may suffer under different attack scenarios; the most likely attack behavior is analyzed through the equilibrium solution of the game, and the optimal response strategy suggestion is provided for the defense party; the system also introduces a real-time monitoring module to dynamically adjust the input parameters of the risk evaluation model by monitoring network traffic and system logs, so as to track and respond to the changes in the actions of the attacker in real time;

[0050] Step 3, the dynamic defense optimization module dynamically adjusts the defense strategy of the network according to the results of the attack-defense game in the process of network attack evolution; the module allocates and optimizes network resources to minimize possible losses according to the evaluation results; the system combines a deep learning model to mine and analyze historical attack data to automatically generate a defense rule library for different attack strategies;

[0051] Step 4, the security situation awareness module collects various sensor data in the network including traffic monitoring, user behavior analysis, and system logs to generate a real-time security situation map of the network; the system dynamically adjusts the parameters in the game model according to the real-time situation map and recalculates the optimal strategies between the attacker and the defender to ensure that the defense strategy is consistent with the current network environment.

[0052] Another object of the present application is to provide a computer device comprising a memory and a processor, the memory storing a computer program, the computer program being executed by the processor to make the processor execute the steps of the network security evaluation method based on attack-defense game.

[0053] Another object of the present application is to provide a computer readable storage medium storing a computer program, the computer program being executed by a processor to make the processor execute the steps of the network security evaluation method based on attack-defense game.

[0054] Another object of the present application is to provide an information data processing terminal for implementing the network security evaluation system and method based on dynamic attack-defense game model.

[0055] In combination with the above technical solutions and the technical problems solved, the advantages and positive effects of the technical solutions to be protected by the present invention are as follows:

[0056] First, enhanced real-time performance: Compared with traditional static analysis methods, the network security assessment system based on dynamic attack and defense game can perceive the network status and attack behavior in real time, and can dynamically adjust the defense strategy, greatly improving the ability to deal with advanced persistent threats.

[0057] Intelligent defense optimization: Through the combination of attack and defense game and machine learning algorithms, the system can adaptively optimize defense strategies and resource allocation, reduce the waste of defense resources, and improve the overall defense effect.

[0058] Accurate attack prediction: The introduction of game models can more accurately predict the possible action paths of attackers, thereby providing defenders with more targeted countermeasures and reducing the probability of false positives and false negatives.

[0059] Comprehensive situational awareness capabilities: The system can perceive network situations in real time and generate dynamic security situation maps, helping administrators to more clearly understand the current network security status and make decisions quickly.

[0060] Second, the technical solution of the present invention solves several key problems in existing network security assessment and defense technologies in industrial applications and achieves significant technological progress, as shown in the following aspects:

[0061] 1) Enhanced dynamic defense capabilities

[0062] Existing technologies typically rely on static security rules and pre-set defense strategies, making it difficult to effectively respond to complex and volatile network attacks. This invention introduces a dynamic defense strategy based on an attack-defense game model, enabling dynamic adjustment of defense strategies based on historical attack data and real-time network status information. This game-equilibrium-based strategy optimization enables defense measures to adapt to changes in attacker behavior, effectively improving the flexibility and responsiveness of the defense system.

[0063] 2) Improved accuracy of multi-scenario risk assessment

[0064] Traditional risk assessment methods in network security systems are mostly based on static historical data and lack the ability to simulate and predict dynamic attack scenarios. This present invention utilizes an attack-defense game model to simulate multiple scenarios, incorporating reinforcement learning technology. This model not only relies on static historical data but also dynamically evaluates different attacker strategies. Combined with reinforcement learning, the system continuously optimizes defense strategies during simulations and learns optimal response measures. Reinforcement learning allows the system to gain experience during attack and defense simulations, improving its ability to predict and respond to risks in real time.

[0065] It can predict attacker strategies and behaviors in different scenarios and provide optimal defense recommendations based on game equilibrium solutions. This multi-scenario simulation improves the accuracy of risk prediction, enabling the system to better foresee potential attack paths and risks, helping enterprises and network administrators prepare for defenses in advance.

[0066] 3) Efficiently handle complex attack scenarios

[0067] Existing technologies are often inefficient when handling complex, multi-dimensional attack scenarios and are unable to respond promptly to multiple, simultaneous attacks. This invention, through parallel processing of massive amounts of data based on distributed computing platforms (such as Hadoop or Spark), combined with reinforcement learning algorithms and game models, can rapidly respond to multi-dimensional, complex network attack scenarios. Multiple game simulations not only improve the system's processing efficiency but also provide defenders with precise defense strategies for different attack scenarios.

[0068] Through the above-mentioned technological innovations, the present invention overcomes the shortcomings of existing network security technologies in responding to dynamic attacks, accurate risk assessment, resource optimization and intelligent defense, significantly improves the flexibility, intelligence and resource utilization efficiency of the network security assessment system, and has broad industrial application prospects in the field of network security. BRIEF DESCRIPTION OF THE DRAWINGS

[0069] Figure 1 This is a structural block diagram of a network security assessment system and method based on a dynamic attack and defense game model provided by an embodiment of the present invention.

[0070] Figure 2 It is a flow chart of the method for constructing an attack and defense strategy game model provided by an embodiment of the present invention.

[0071] Figure 3 This is a flow chart of a network security assessment method based on a dynamic attack and defense game model provided by an embodiment of the present invention.

[0072] Figure 1 In: 1. Attack and defense game construction module; 2. Risk prediction module; 3. Dynamic defense optimization module; 4. Security situation awareness module. DETAILED DESCRIPTION

[0073] In order to make the purpose, technical solutions and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention.

[0074] The network security assessment system and method implementation scheme based on the dynamic attack and defense game model can be divided into the following steps:

[0075] 1. Construction of attack and defense game model

[0076] Data Collection: First, the system collects data from historical network attack data, network topology information, and a defense policy library. Historical attack data includes known attack types, paths, and attacker behavior patterns, while network topology information includes network nodes, connections, and access permissions.

[0077] Model Construction: Based on this data, we use game theory to build a game model between attackers and defenders. The attacker's strategy involves selecting different attack paths, targets, and tools, while the defender's strategy involves deploying firewalls, intrusion detection systems, traffic filtering, and other defensive measures. A multi-layered attack path model is used to simulate the attacker's behavior, and the defender selects appropriate defensive measures based on the attack path.

[0078] Model initialization: Each game simulation initializes the network state, sets the attacker and defender strategy sets, and forms preliminary defense recommendations by calculating the optimal game equilibrium solution.

[0079] 2. Risk prediction and simulation

[0080] Multiple game simulations: Using an attack-defense game model, we simulate various possible attack scenarios. For example, in one scenario, an attacker exploits a firewall to leak data, while defenders deploy intrusion detection systems to identify this attack. Through multiple simulations, we calculate the losses associated with each attack path and defense strategy.

[0081] Risk Assessment: After each simulation, the system estimates the risk by comparing the scores of the attacker and defender in the game results. Based on the equilibrium solution of the attack-defense game, the system predicts the most likely attack path and attacker behavior. The simulation results display the potential losses that the network may suffer in different scenarios and generate a detailed risk assessment report.

[0082] 3. Real-time monitoring and dynamic adjustment

[0083] Real-time Monitoring: The system incorporates a real-time monitoring module that continuously collects data such as network traffic, user behavior analysis, and system logs. This data is captured by network sensors and intrusion detection systems and fed into the game model. The system analyzes this real-time data to identify unusual activity or potential threats, promptly updating the input parameters of the game model and maintaining the ability to dynamically adjust defense strategies.

[0084] Dynamically Adjust Defense Strategies: Based on real-time data and risk assessment results, the system adjusts defense strategies in real time. For example, if an attacker chooses a new attack path, defenders can immediately adjust firewall rules, enhance intrusion detection sensitivity, or optimize traffic filter configurations to prevent the attack. The system optimizes the allocation of network resources based on the new game equilibrium, such as increasing defense resources for high-risk nodes or adjusting access permissions.

[0085] 4. Security situation awareness and feedback

[0086] Situation Map Generation: The Security Situation Awareness module collects and analyzes network traffic monitoring, user behavior, and system logs to generate a real-time security situation map of the network. This map visually displays the current network security status, potential threat sources, and possible attacker behavior.

[0087] Dynamic optimization of the game model: The situational awareness module updates the parameters in the game model, such as the attacker's possible path and the defender's response time, through situational map information, so that the defense strategy is more in line with the current network security situation.

[0088] Defense feedback and execution: The system feeds back the optimized defense strategy to the actual defense devices (such as firewalls, intrusion detection systems, traffic controllers, etc.), making real-time defense adjustments to improve network security.

[0089] A specific application scenario is internal network security defense. Within an internal network, attackers may attempt to steal sensitive data by exploiting vulnerabilities in network nodes. The system first constructs an attack-defense game model based on historical data and the current network topology to predict possible attack paths. The system monitors network traffic in real time. Upon detecting abnormal data transmission, it dynamically adjusts firewalls and access permissions to prevent further attack expansion. Through real-time risk assessment and game optimization, the system ensures continuous monitoring and improvement of network security.

[0090] like Figure 1 As shown, an embodiment of the present invention provides a network security assessment system based on a dynamic attack and defense game model, including:

[0091] Attack and defense game construction module 1, risk prediction module 2, dynamic defense optimization module 3, security situation awareness module 4.

[0092] The attack-defense game construction module 1, connected to the risk prediction module 2, is used to introduce a game theory model into the system to simulate the dynamic interaction process between attackers and defenders. This module first constructs a multi-level attack path model for the attacker and a response strategy model for the defender based on historical attack data and network topology information. The strategies of both attackers and defenders include attack path selection, defense measure deployment, and resource allocation.

[0093] Risk prediction module 2, connected to attack-defense game construction module 1, dynamic defense optimization module 3, and security situation awareness module 4, uses the game model to conduct multiple simulations to predict the risk value that the network may suffer under different attack scenarios. It analyzes the most likely attack behavior through the equilibrium solution of the game and provides the optimal response strategy recommendations to the defender. The system also introduces a real-time monitoring module, which dynamically adjusts the input parameters of the risk assessment model by monitoring network traffic and system logs, thereby tracking and responding to changes in attackers' actions in real time.

[0094] Dynamic Defense Optimization Module 3, connected to Risk Prediction Module 2 and Security Situation Awareness Module 4, is used to dynamically adjust the network's defense strategy based on the outcome of the attack-defense game as network attacks evolve. This module allocates and optimizes network resources based on the evaluation results to minimize potential losses. The system, combined with a deep learning model, mines and analyzes historical attack data, automatically generating a defense rule library tailored to different attack strategies.

[0095] The security situation awareness module 4 is connected to the risk prediction module 2 and the dynamic defense optimization module 3. It is used to generate a real-time security situation map of the network by collecting various sensor data in the network, including traffic monitoring, user behavior analysis, and system logs. The system will dynamically adjust the parameters in the game model according to the real-time situation map and recalculate the optimal strategy between the attacker and the defender to ensure that the defense strategy is consistent with the current network environment.

[0096] The network security assessment system and method based on a dynamic attack-defense game model provided by the present invention combine game theory models, deep learning techniques, dynamic defense optimization, and security situation awareness. The system aims to improve network defense capabilities and respond to complex network attacks in real time. The system consists of multiple modules, each of which plays a role in different network security stages. The specific implementation scheme is as follows:

[0097] 1. Offense and Defense Game Building Module 1

[0098] This module first introduces a basic model of game theory to simulate the dynamic interaction between attackers and defenders. The attacker's strategy includes selecting attack paths and attack methods (such as DDoS attacks and SQL injections), while the defender responds by deploying firewalls, intrusion detection systems, and other measures. Based on a multi-level attack path model, the system analyzes the attacker's possible paths and generates an attack graph based on the network topology. At the same time, using the defender's response strategy model, in the attack-defense game, the attacker's strategy includes selecting different attack paths and attack methods, such as DDoS attacks and SQL injections; the defender defends by deploying firewalls, intrusion detection systems, and other methods. Although the number of strategies on both the offensive and defensive sides does not have to be exactly the same, it should be ensured that the system can cover a variety of possible attacks and defense methods to accurately simulate real-world scenarios.

[0099] The connotation of the multi-level attack path model in this article means that the system analyzes the multiple paths that an attacker may take from the initial location to the target location based on the network topology, including network nodes and services at different levels. These paths are combined with potential attack methods to generate an attack graph to predict the potential threat of the attack.

[0100] The defender's response strategy model simulates the strategies adopted by the defender when facing different attack scenarios, such as adjusting firewall rules and starting the intrusion detection system. This model is used to evaluate the effectiveness of the defense strategy and adjust the defense plan according to the attack dynamics.

[0101] Calculate the optimal defense deployment method. This module uses historical attack data and the system's network topology information to build strategies for both attackers and defenders, and provides a basis for subsequent simulations and risk assessments.

[0102] 2. Risk Prediction Module 2

[0103] The risk prediction module conducts multiple simulations based on an attack-defense game model to predict the risks the network may face under different attack scenarios. Using Nash equilibrium solutions, the module determines the most likely attacker actions in a given attack scenario and predicts the network risk associated with these actions. To enhance prediction accuracy, the system also incorporates a real-time monitoring module. This module leverages real-time network traffic data, system logs, and other information to dynamically adjust the game model's input parameters, enabling the risk prediction model to adapt to network changes. Furthermore, a Markov Decision Process (MDP) is used to predict the attacker's likely future actions, and through repeated game simulations, the optimal response strategy for the defender is derived.

[0104] 3. Dynamic Defense Optimization Module 3

[0105] As network attacks evolve, the dynamic defense optimization module automatically adjusts the network's defense strategy based on the outcomes of the attack-defense game. This module, combined with deep reinforcement learning models (such as DQN or A3C), analyzes historical attack data, identifies attacker behavior patterns, and automatically generates a defense rule base tailored to different attack strategies. After each attack game, the system reassesses the effectiveness of defense measures and dynamically allocates and optimizes network resources to minimize potential losses. This module also dynamically adjusts resource allocation based on real-time data analysis to ensure that critical nodes in the network have sufficient defense resources.

[0106] 4. Security Situation Awareness Module 4

[0107] The Security Situation Awareness module is responsible for generating a real-time security situation map of the network by collecting various sensor data (such as traffic monitoring, user behavior analysis, and system logs). This module uses convolutional neural networks (CNNs) to extract deep features from sensor data and identify potential threats within the network. Furthermore, by comparing historical and real-time data, the module can detect anomalous activity and assess the current network security status through a comprehensive analysis of traffic, user behavior patterns, and log records. The situation awareness map dynamically reflects attacker actions, enabling timely adjustments to the parameters in the game model to ensure that defense strategies are synchronized with the real-time network environment.

[0108] 5. Calculation of equilibrium solutions in game models

[0109] To ensure optimal strategy selection by both attackers and defenders, the attack-defense game building module uses a Nash equilibrium algorithm to determine the optimal strategy combination between defenders and attackers. In each game, the system iteratively calculates the strategy choices of both parties to arrive at the most effective equilibrium solution under the current circumstances. This process dynamically adjusts to changes in attacker strategies based on real-time network situational data, ensuring that defenders' countermeasures are always optimal.

[0110] 6. Real-time monitoring and risk feedback

[0111] During system operation, the risk prediction module continuously acquires real-time monitoring data and updates key parameters in the game model based on attacker behavior and changes in network dynamics. This module uses time series prediction models (such as LSTM) to analyze network traffic trends and predict the timing and scope of potential attacks. Dynamic adjustment of risk values ​​enables defenders to respond quickly based on the latest threat landscape, avoiding over-defense and waste of resources.

[0112] 7. Dynamic defense strategy generation

[0113] The dynamic defense optimization module automatically generates defense strategies based on a reinforcement learning algorithm. By analyzing attack history and current network status, the system uses a Q-learning algorithm to gradually learn the optimal defense measures for different attack scenarios. These defense strategies are then stored in a defense rule library, and the system automatically invokes appropriate rules based on the current network situation for rapid response. During an attack, the module can also adjust defense strategies based on the attacker's real-time behavior to achieve optimal protection.

[0114] 8. Report generation and optimization suggestions

[0115] After attack evolution and defense adjustments are complete, the system automatically generates a detailed report, including the risks faced by the network, the possible paths taken by the attacker, and the defender's response strategies. Furthermore, by incorporating machine learning models (such as decision trees and random forests), the system provides users with specific defense optimization recommendations, helping them take more effective defensive measures against future network attacks and further enhancing the overall security of the network.

[0116] This system achieves automated defense and dynamic optimization of network security through the collaborative operation of multiple modules, combined with deep learning and game theory models.

[0117] 1. Implementation of attack and defense game building block 1

[0118] The implementation of this module is based on game theory and dynamic interaction modeling in the field of network security. The specific implementation steps are as follows:

[0119] Attack Path and Strategy Modeling: The system first constructs the attacker's strategy space based on historical attack data and network topology information. This includes the attacker's chosen attack paths (e.g., network layer attacks, application layer attacks) and the attack methods used (e.g., DDoS, SQL injection, etc.). Using a multi-layered attack path model, the system generates an attack path graph, a structure that represents the multiple paths an attacker can choose and potential network vulnerabilities.

[0120] Defense Strategy Modeling: The defender's strategy includes firewall deployment, intrusion detection system (IDS) configuration, and resource allocation. By integrating the network structure, a defense strategy model is constructed to determine the countermeasures the defender can take. This module utilizes dynamic defense modeling and uses heuristic algorithms (such as genetic algorithms or simulated annealing) to optimize resource allocation and ensure the rational use of defense resources.

[0121] Construction of game model: The interaction between attackers and defenders is abstracted as a zero-sum game or a non-zero-sum game.

[0122] The construction of the game model can be selected as a zero-sum game or a non-zero-sum game according to the actual application scenario. Specifically:

[0123] Zero-sum game: If the attacker's gain is exactly equal to the defender's loss, that is, one party's gain equals the other's loss, the total gain for both parties is zero. This model is suitable for scenarios with completely opposing goals and clear objectives, such as when the attacker attempts to destroy the defender's system and the defender is fully committed to preventing this goal. Non-zero-sum game: If the gains of both parties are not strictly opposed, it is possible for both parties to gain or lose simultaneously. This model is more suitable for complex scenarios, such as network security, where attackers may explore defense strategies and defenders do not always fail or succeed completely in every attack.

[0124] Therefore, the choice of game model depends on the specific interaction between attack and defense. If the scenario is viewed as an absolute opposition, it is usually a zero-sum game; if there are complex interactions and asymmetric payoffs, it is a non-zero-sum game.

[0125] The attacker's goal is to maximize damage, while the defender's goal is to minimize losses. Mathematically, this is represented by a payoff matrix, representing the strategic choices and outcomes of both parties. The payoffs generated by the attacker's choice of specific paths and methods are calculated based on the system's historical data, while the defender deploys defensive measures to counter these attacks.

[0126] Nash equilibrium calculation: To find a balance between the strategies of both parties, the system uses Nash equilibrium solutions to determine the optimal combination of both strategies. Using linear programming or optimal response algorithms, the system automatically calculates the optimal strategies for both attackers and defenders in a given network environment. This provides a theoretical foundation for subsequent simulations and risk prediction.

[0127] 2. Implementation plan of risk prediction module 2

[0128] The core of the risk prediction module is based on multiple simulations of the game model, combined with real-time data to dynamically adjust the prediction. The specific implementation is as follows:

[0129] Multiple simulations: After determining the attacker and defender strategy models, the risk prediction module uses repeated game simulations to predict the risk value under different attack scenarios. Using Monte Carlo simulation, each simulation step generates a new game outcome based on different attacker behaviors and defender responses, assessing the system's potential risk.

[0130] Risk Calculation: After each game, the system calculates the risk value of the attack scenario based on the attack success rate, defense failure rate, and loss level. The risk value is calculated using the formula (R = P * L), where P represents the probability of attack success and L represents the potential loss caused by defense failure. This module can improve the accuracy of risk calculations by integrating historical data and probability estimation based on Bayesian networks.

[0131] Real-time Data Monitoring: To ensure more accurate risk assessments, the system integrates a real-time network monitoring module that dynamically captures network traffic data, system logs, and user behavior data. After preprocessing, this data serves as input to the game model, adjusting predictions of attacker behavior and assessments of defender responses. Through real-time feedback, the model can adapt to dynamic changes in the network, ensuring accurate risk predictions.

[0132] Markov Decision Process (MDP): To predict the attacker's future actions, the system introduces an MDP. The MDP considers the attacker's actions as a state transition process, using historical attack behavior and the current environment state to predict the next possible attack method and target. The MDP's state transition probability matrix (P(s'|s,a)) is updated after each game, continuously optimizing the strategy based on the current attacker strategy and defender response.

[0133] Optimized Strategy Generation: After each game simulation, the system uses the Bellman equation to optimize defense strategies and generate recommendations for optimal countermeasures. The recursive form of the Bellman equation helps defenders adjust resource allocation based on current status and future risks, ensuring the system's defenses are always optimal.

[0134] The present invention utilizes multiple modules working together to monitor and respond to network attack threats in real time. First, the attack-defense game construction module constructs a multi-level game model of attackers and defenders based on historical attack data and network topology information. This module processes network attack behavior, topology, and defense strategies. By analyzing historical data, it simulates multiple possible attacker paths, calculates the strategic choices of both players, and forms a decision-making framework between attackers and defenders. Each simulation generates an attack path and a corresponding defense strategy. Second, the risk prediction module uses the attack-defense game model to conduct multiple simulations, assessing the potential risks faced by the system under different attack scenarios. Data processing primarily involves attack behavior and defense strategy data from the game model. The equilibrium solution, obtained through multiple game analyses, is used to predict the attacker's most likely behavior path. Simultaneously, the real-time monitoring module incorporates current network traffic, user behavior, system logs, and other information into the game model, dynamically updating model parameters to ensure that the prediction results are consistent with the current network environment. This dynamically input data is filtered, parsed, and used to adjust the parameters of the game model. Third, the dynamic defense optimization module, based on risk assessment, utilizes deep learning models to process historical attack data. Through deep mining and pattern recognition, it generates a defense rule base. This module's data processing includes dynamic adjustments to network resource allocation and attack and defense rules. It also optimizes the network's defense configuration in real time by analyzing attack paths and defense effectiveness. Based on the risk values ​​and game results output by the model, the module readjusts the network's resource allocation and defense strategies to minimize losses in different attack scenarios.

[0135] Finally, the security situation awareness module generates a real-time network security situation map by analyzing system logs, user behavior data, and network traffic. This module preprocesses the raw data collected by sensors, including data cleaning and feature extraction, to generate a real-time network security situation map. This situation map is generated by detecting network traffic anomalies and analyzing behavioral patterns, dynamically adjusting the input parameters in the game model to optimize defense strategies in real time, ensuring continuous synchronization and adaptability between the offense and defense game and the actual network environment.

[0136] Implementation of the attack and defense game building module provided by the embodiment of the present invention:

[0137] Collection and analysis of historical data:

[0138] Collect historical attack data on the network, including the attack methods, attack paths, network vulnerabilities, and intrusion points used by attackers; combine network topology information to establish a library of potential attack paths for attackers;

[0139] The defender's strategy includes the configuration of each protection node, the allocation strategy of network resources, the rules of firewalls and intrusion detection systems, and defense measures to deal with different types of attacks.

[0140] like Figure 2 As shown, the attack and defense strategy game model provided by the embodiment of the present invention is constructed as follows:

[0141] S101, using game theory models, defines the action space of both attackers and defenders; that is, the attacker's attack path selection and the defender's defense measures deployment, and converts it into the state space of the attack-defense game;

[0142] S102, set the utility function of the attacker and defender, that is, the attacker attempts to maximize the destructive benefits through attack means, while the defender minimizes the losses by deploying defense strategies; the strategies of both parties in action selection can be solved through Nash equilibrium.

[0143] Implementation of the risk prediction module provided by the embodiment of the present invention:

[0144] Multi-scenario game simulation:

[0145] The system simulates multiple possible attack scenarios and conducts multiple simulations on the game model to evaluate the success probability of different attacker paths and attack strategies, as well as the risk value that the network system may suffer in these situations.

[0146] Based on game equilibrium solution analysis, it predicts the most likely attack paths and behaviors and provides optimal response recommendations to network defenders.

[0147] Real-time monitoring and dynamic adjustment:

[0148] The real-time monitoring module obtains real-time data through network traffic, system logs, and behavioral analysis, and continuously updates the input of the game model and adjusts the risk assessment model;

[0149] Combined with machine learning algorithms, it predicts impending attack behaviors, assesses possible risks in advance, and helps administrators take preventive measures.

[0150] Implementation of the dynamic defense optimization module provided by the embodiment of the present invention:

[0151] Optimized configuration of defense resources:

[0152] Based on risk assessment results and current network resources, the system automatically optimizes the allocation of defense resources, including computing resources and bandwidth, to minimize defense costs while maintaining optimal protection effectiveness.

[0153] The system converts different defense strategies, including adjusting firewall rules and IDS detection modes, into executable defense tasks and deploys them across the entire network through a central control system.

[0154] Generation of defense rule base based on deep learning:

[0155] The system automatically generates a defense rule library suitable for different attack strategies through deep learning analysis of historical attack data; it uses deep neural networks or convolutional neural networks for feature extraction;

[0156] The system continuously self-learns and iteratively optimizes defense strategies to respond to new and unknown threats.

[0157] Implementation of the security situation awareness module provided by the embodiment of the present invention:

[0158] Network situational awareness:

[0159] Through various sensor data including network traffic monitors, behavior analysis systems, and system logs, the security status of each node in the network is monitored in real time, and a real-time situation map is generated to display the security threats currently facing the network.

[0160] The system will dynamically adjust the parameters in the attack and defense game model according to the real-time network situation and recalculate the optimal defense strategy based on new threat information;

[0161] Dynamic update and analysis of situation map:

[0162] Implement dynamic situation map update technology, use distributed computing platforms to quickly process massive data, and display situation maps to administrators through visualization technology;

[0163] The system will automatically feed back the threat information in the situation map to the game model as a reference for adjusting the next round of defense strategy.

[0164] like Figure 3 As shown, an embodiment of the present invention provides a network security assessment method based on attack and defense game, including:

[0165] S201 introduces a game theory model into the system through the attack-defense game construction module to simulate the dynamic interaction between attackers and defenders. This module first constructs a multi-level attack path model for the attacker and a response strategy model for the defender based on historical attack data and network topology information. The strategies of both attackers and defenders include attack path selection, defense measure deployment, and resource allocation.

[0166] S202: The risk prediction module uses a game model to perform multiple simulations to predict the potential risk to the network under different attack scenarios. The equilibrium solution of the game is used to analyze the most likely attack behavior and provide the defender with optimal response strategies. The system also introduces a real-time monitoring module that monitors network traffic and system logs to dynamically adjust the input parameters of the risk assessment model, thereby tracking and responding to changes in attacker behavior in real time.

[0167] S203: As network attacks evolve, the system dynamically adjusts the network's defense strategy based on the outcome of the attack-defense game through the dynamic defense optimization module. This module allocates and optimizes network resources based on the evaluation results to minimize potential losses. The system, combined with a deep learning model, mines and analyzes historical attack data, automatically generating a defense rule library tailored to different attack strategies.

[0168] S204, through the security situation awareness module, various sensor data in the network, including traffic monitoring, user behavior analysis, and system logs, are collected to generate a real-time security situation map of the network; the system will dynamically adjust the parameters in the game model according to the real-time situation map, and recalculate the optimal strategy between the attacker and the defender to ensure that the defense strategy is consistent with the current network environment.

[0169] Another object of the present invention is to provide a computer device, comprising a memory and a processor, wherein the memory stores a computer program, and when the computer program is executed by the processor, the processor executes the steps of the network security assessment method based on attack and defense game.

[0170] Another object of the present invention is to provide a computer-readable storage medium storing a computer program, which, when executed by a processor, causes the processor to perform the steps of the network security assessment method based on attack and defense game.

[0171] Another object of the present invention is to provide an information data processing terminal, which is used to implement the network security assessment system and method based on the dynamic attack and defense game model.

[0172] To address the above issues, a network security assessment system and method based on a dynamic attack-defense game model is proposed. An improved dynamic network security assessment framework is included, which includes the following key components:

[0173] 1. Offense and defense game building module:

[0174] A game theory model is introduced into the system to simulate the dynamic interaction between attackers and defenders. This module first constructs a multi-level attack path model for attackers and a response strategy model for defenders based on historical attack data and network topology information.

[0175] The strategies of both the attacker and the defender include attack path selection, defense measures deployment, resource allocation, etc.

[0176] 2. Risk prediction module:

[0177] We use game models to conduct multiple simulations to predict the potential risk to the network under different attack scenarios. We analyze the most likely attack behavior through the game's equilibrium solution and provide the defender with optimal response strategies.

[0178] The system also introduces a real-time monitoring module that monitors network traffic and system logs and dynamically adjusts the input parameters of the risk assessment model, thereby tracking and responding to changes in attackers' actions in real time.

[0179] 3. Dynamic defense optimization module:

[0180] As network attacks evolve, the system dynamically adjusts the network's defense strategy based on the outcome of the attack-defense game. This module allocates and optimizes network resources (such as computing resources and bandwidth) based on the evaluation results to minimize potential losses.

[0181] The system combines deep learning models to mine and analyze historical attack data and automatically generates a defense rule library for different attack strategies.

[0182] 4. Security situation awareness module:

[0183] This module generates a real-time security situation map of the network by collecting various sensor data in the network (including traffic monitoring, user behavior analysis, system logs, etc.).

[0184] The system will dynamically adjust the parameters in the game model based on the real-time situation map and recalculate the optimal strategy between the attacker and the defender to ensure that the defense strategy is consistent with the current network environment.

[0185] Systematic approach steps:

[0186] 1. Initialize the network environment: Build an initial game model based on the network topology and historical attack data, and initialize the strategy sets of the attacker and defender.

[0187] 2. Real-time data collection and analysis: Monitor network traffic, node status, system logs, etc. through various sensors, and update the input of the game model in real time.

[0188] 3. Attacker strategy prediction and risk assessment: The system uses game models combined with machine learning algorithms to predict the attacker's optimal attack path and assess the attack risk that the current network may suffer.

[0189] 4. Defense strategy optimization and implementation: Generate dynamic defense strategies based on game results and risk assessment, and optimize the allocation of defense resources (such as firewall rule updates, IDS rule adjustments, etc.).

[0190] 5. Feedback and continuous improvement: By continuously collecting new network data, the game model is iteratively optimized to ensure that the system can cope with continuous and dynamic attack behaviors.

[0191] Technological advancements brought about by systems and methods:

[0192] 1. Intelligent defense optimization: By combining attack and defense game theory with machine learning algorithms, the system can adaptively optimize defense strategies and resource allocation, reduce the waste of defense resources, and improve overall defense effectiveness.

[0193] 2. Accurate attack prediction: The introduction of the game model can more accurately predict the action paths that attackers may take, thereby providing defenders with more targeted response measures and reducing the probability of false positives and missed negatives.

[0194] 3. Comprehensive situational awareness: The system can perceive network situation in real time and generate dynamic security situation maps to help administrators understand the current network security status more clearly and make decisions quickly.

[0195] The specific implementation of this system is based on attack-defense game models, reinforcement learning algorithms, deep learning technology, and security situation awareness data stream processing. The following six steps, combined with specific mathematical models and data, elaborate on the implementation of each module:

[0196] 1. Construction of the attack and defense game model

[0197] The attack-defense game model optimizes the strategies of attackers and defenders based on the Nash equilibrium in game theory. First, collect the historical attack data of the network A={a1,a2,…,a n}, including attack paths, vulnerabilities and attack methods. Then, combined with the network topology T={t1,t2,...,t n}, (here t n Represents the nth node in the grid) to generate the attack path library. Define the strategy set of the attack and defense parties as SA = {s-a1,s-a2,...,sa n} and SD={s-d1,s-d2,...,sd n}, where the attacker's strategy is to choose the attack path and the defender's strategy is to deploy defensive measures.

[0198] Attack paths and defense measures are introduced into the model in a quantitative way. The attack path can be represented by a probability matrix, and the defense measures are quantified by the defense response matrix. For example, the probability of selecting an attack path p is i The loss caused by the attack L i The combination constitutes the attacker’s utility function. The defensive measures are achieved through the defense loss D i and its deployment cost c D The combination of the two forms the utility function of the defender. In this way, the strategies and losses of the attacker and defender can be expressed in a matrix, making it easier to calculate the optimal strategy.

[0199] The system obtains the optimal game solution and optimizes the attack and defense strategy by solving the utility function UA ​​attacker's gain function and UD defender's loss function. The utility function of both the attacker and the defender can be expressed as:

[0200]

[0201] where p i is the probability of attack path selection, L i is the loss caused by the attack, D i is the defender's loss, c A and c D is the cost of attack and defense. A Can only be used once.

[0202] By solving the utility functions UA and UD, the system can calculate the optimal strategies for both attackers and defenders—that is, find the Nash equilibrium point, at which neither side can achieve greater benefits by changing their strategy alone. This attack-defense game model not only optimizes the defender's strategy but also predicts the most likely attack paths, improving overall network security.

[0203] The practical significance of the utility function in network security assessment lies in that it provides a way to quantify risks and defense effects, helping defenders deploy the most effective defense strategies at the lowest cost while reducing possible attack losses.

[0204] 2. Application of reinforcement learning in game theory

[0205] In a dynamic network environment, the Q-learning reinforcement learning algorithm is used to train attackers and defenders to learn optimal strategies. The core of Q-learning, D, is to evaluate the expected benefit (i.e., Q value) of taking an action A in each state S. Here:

[0206] S (state) refers to a specific state in the network, such as the network topology, current security situation, etc. It can be combined with the network topology T mentioned above, that is, T represents different network node states, and S is the state of these nodes at a specific moment.

[0207] A (action) represents the strategies or actions taken by both the attacker and defender in a specific state. For example, the attacker's action might be to select a specific attack path or execute a specific attack method (such as a DDoS attack or SQL injection), while the defender's action might be to choose which defensive measures to deploy (such as strengthening the firewall or enabling intrusion detection).

[0208] In this context, action A can be understood as the specific choice made by the attacker and defender in the game, associated with the strategy sets SA and SD mentioned above. In other words, A is an element in the strategy set SA or SD, representing a decision at a specific moment.

[0209] Q-learning update formula:

[0210]

[0211] α is the learning rate: it controls how quickly the Q value is updated and determines how much new experience influences the update. If Q is too high, the system will be overly dependent on the latest data and will tend to ignore long-term experience; if Q is too low, the system will be insensitive to new information.

[0212] r is the reward for the current state: the reward the system receives based on the actual outcome of executing action A in the current state. The reward value is closely related to the success of the attack and defense, the extent of the damage, and other factors. For example, successfully preventing an attack will give the defender a higher reward, while successfully breaking through the defense will also give the attacker a higher reward.

[0213] γ is the discount factor, which represents the degree of attenuation of future rewards. Its value ranges from 0 to 1. The closer it is to 1, the more the system prioritizes long-term future rewards; the smaller the value, the more the system prioritizes immediate rewards. For defenders, long-term considerations may require a larger discount value.

[0214] S' is the new state after executing the action: after action A is executed, the system will enter the new state S; this reflects the changes in the network attack and defense status, such as whether the attack is successful and whether the network defense is strengthened.

[0215] Model training process:

[0216] The system gradually updates its Q-value by repeatedly simulating the interaction between attackers and defenders. In each interaction, the attacker selects an optimal attack path and adjusts its Q-value based on the outcome. Similarly, the defender adjusts its defense strategy and learns how to more effectively respond to future attacks.

[0217] Through this reinforcement learning process, the Q-value function of the final game model will converge to the optimal strategy, allowing the attacker to learn the attack path with the highest success rate, while the defender can find the most effective defense strategy, forming the best attack and defense strategy combination.

[0218] 3. Risk prediction and multi-scenario game simulation

[0219] The system performs statistical analysis on the results of multiple game simulations to predict the risk value under different scenarios. First, set multiple scenarios C = {c1, c2, ..., c m Each scenario is defined as a different path combination chosen by the attacker. Through multiple simulations, the attack success probability P(c i ), and the defender's loss L(c i ). The risk prediction model is based on the expected loss function:

[0220]

[0221] Where R is the total risk value. The system simulates different scenarios, calculates the risk value of each scenario, and provides the defender with the optimal defense recommendation.

[0222] Set multiple scenes C = {c i ,c2,…,c m} represents a set of scenarios that may occur when the system simulates different attack and defense situations. Each scenario c i This represents a specific attack and defense scenario, such as different attack methods, path selections, or combinations of defense measures. By simulating these scenarios, the system can statistically analyze the risk value of each scenario, predict the probability of attack success and the effectiveness of defense in different situations, and provide administrators with a basis for decision-making.

[0223] 4. Dynamic defense optimization and resource allocation

[0224] After the risk assessment results are combined with the game model, the dynamic defense optimization module will dynamically allocate network resources based on the optimal game results. Set the network resource constraint R D , the system optimizes the objective function O(R D ) to minimize defense costs and maximize defense benefits. The defense's resource allocation can be achieved through a linear programming model:

[0225]

[0226] Among them C i is the cost of defense resources, R i The resource consumption of each defense measure, x i is the decision variable for whether to adopt the defense measure (0 means not adopted, 1 means adopted). By solving the linear programming, the system can optimize the defense configuration without exceeding the resource budget.

[0227] R D The specific value of comes from the actual bandwidth of the network, computing power and other hardware resource limitations. Based on this, the system constructs the optimization objective function O(R d ), to minimize the cost of defense resources and maximize the effectiveness of defense.

[0228] Through this model, the system can automatically allocate network resources to ensure that the resource budget does not exceed R D This dynamic optimization mechanism can make real-time adjustments based on the risk assessment results of current network attacks to improve defense effectiveness.

[0229] 5. Security situation awareness and data processing

[0230] The security situation awareness module collects real-time data through network sensors, including traffic monitoring, user behavior, system logs, etc. The system processes this data through big data analysis technology to form a network security situation map. Let the situation map be mathcal{S}={s1,s2,…,s k}, each s i The security status of a node in the network. Data is processed using the Hadoop distributed computing framework, using feature extraction methods such as principal component analysis (PCA) to extract key features. This extracted feature data serves as input to the game model, enabling real-time adjustments to defense strategies.

[0231] The security situation awareness and data processing module, the core innovation of this invention, aims to provide comprehensive real-time monitoring and analysis capabilities for network security defense, thereby providing data support for dynamically adjusting defense strategies. Through comprehensive analysis of multi-dimensional data, this module can accurately perceive the security situation of the network environment, promptly identify potential threats, and guide the system to make optimal defense decisions through game models. The details are as follows:

[0232] 1. Data collection and monitoring

[0233] The Security Situation Awareness module first collects a large amount of real-time data from a variety of sensors deployed throughout the network, including traffic monitoring devices, intrusion detection systems, user behavior monitoring systems, and system log collection tools. The collected data is extensive, covering changes in network traffic, user access behavior, abnormal events in system logs, and the operating status of network nodes. By comprehensively collecting this data, the system can provide real-time insights into the operational status and security status of the entire network.

[0234] 2. Distributed computing and big data analysis

[0235] The collected data is massive and complex, so the system uses the Hadoop distributed computing framework to process and analyze it. Hadoop's parallel processing capabilities effectively handle large-scale, multi-dimensional security data, ensuring real-time and efficient data processing. Furthermore, the system integrates big data analysis techniques such as principal component analysis (PCA). PCA reduces the dimensionality of multi-dimensional data, extracting key features that reflect the network security status and removing redundant information, making subsequent analysis more accurate and efficient.

[0236] 3. Situational awareness and security situation map construction

[0237] Based on the processed data, the system will construct a network security situation map. Let the situation map be S = {S i , S2,…,s k}, where each S i Indicates the security status of a node in the network. The security situation map can intuitively reflect the security status of the entire network, such as which nodes are under attack, which nodes have high-risk vulnerabilities, and which nodes have abnormal traffic. Through this graphical method, administrators can quickly understand the overall network situation and decide whether to take appropriate defensive measures.

[0238] 4. Security situation assessment and feature extraction

[0239] To more accurately assess the network's security posture, the system extracts important security features through data analysis. Principal Component Analysis (PCA) is used to identify key factors influencing network security, such as abnormal traffic patterns, user behavior deviations, and system error rates. Through feature extraction, the system transforms complex raw data into feature vectors that can be used for decision support, significantly reducing computational overhead and improving model processing efficiency.

[0240] 5. Linking Situational Awareness with Defense Strategies

[0241] The security situation awareness module is not only used for network monitoring and risk assessment, but its output data will also be used as the input of the game model to provide a basis for decision-making for the system. i The system adjusts defense strategies in real time based on the network's defense resources and attack paths. By tightly integrating situational awareness with game-based decision-making, the system can quickly respond to detected network threats and dynamically allocate defense resources, resulting in smarter and more efficient network defense.

[0242] 6. Real-time dynamic adjustment

[0243] Because security situations are constantly changing, the system is able to capture and process these changes in real time. Whenever a node in the network presents a security risk, the situational awareness module immediately updates the network's security situation map and, based on the latest information, triggers a recalculation of defense strategies. This dynamic adjustment mechanism ensures that the system can promptly respond to sudden network attacks and minimize potential security threats.

[0244] The Security Situation Awareness and Data Processing module provides efficient data support and decision-making for network security defense through large-scale data collection, distributed computing, big data analysis, situation map construction, and dynamic adjustment. This module not only improves the real-time and accuracy of network security defense, but also provides a foundation for continuous optimization of the system's dynamic game model, ensuring that defense measures can respond to various network threats in a timely and effective manner.

[0245] 7. Deep Learning and Automatic Defense Rule Generation

[0246] The system uses convolutional neural networks (CNN) or deep neural networks (DNN) to conduct deep learning on historical attack data and automatically generates a defense rule base. The CNN feature extraction model for attack data is:

[0247] F(x)=ReLU(W*x+b),

[0248] Where W is the convolution kernel, x is the input attack data, and b is the bias term. Through multiple layers of convolution and pooling operations, the CNN extracts key features from the attack data and uses them to automatically generate defense rules. By automatically updating the defense rule base, the system can respond to new attack patterns and improve the network's defense capabilities.

[0249] In this invention, the system uses a convolutional neural network (CNN) or deep neural network (DNN) to perform deep learning on historical attack data and automatically generates a defense rule base. Here, CNN is used as an example to illustrate its feature extraction model, which is used to extract key features from large amounts of complex attack data. The model structure is as follows:

[0250] 1. CNN feature extraction model

[0251] Let W be the convolution kernel, x be the input attack data, and b be the bias term. In network security scenarios, the convolution kernel W corresponds to a filter used to identify attack patterns, detecting specific features in attack behavior, such as traffic anomalies, attack paths at the protocol level, or structural characteristics of data packets. The bias term b serves to adjust detection sensitivity in the network, ensuring that diverse attack data variations are accounted for during feature matching.

[0252] 2. Key feature extraction

[0253] After multiple layers of convolution and pooling operations, CNN can extract key features from attack data, including:

[0254] -Attack traffic patterns: such as abnormal changes in data packet size, interval time, etc.

[0255] - Attack Paths: Identify the network paths used by attackers, especially in multi-stage attacks.

[0256] -Protocol anomalies: Detect non-standard behaviors that occur during the use of network protocols, such as port scanning, unexpected packet formats, etc.

[0257] After these features are extracted, they enter the defense rule generation module.

[0258] 3. Defense rule generation and examples

[0259] Defense rules are system-generated response strategies based on attack data that guide network defense operations. Examples include:

[0260] - Abnormal traffic blocking: For example, when a traffic peak exceeding a preset threshold is detected, the system will automatically generate rules to restrict the traffic source.

[0261] -Port closure or IP blacklist: When an IP address attempts abnormal access multiple times, the system can automatically add the IP to the blacklist and generate a rule to prohibit access.

[0262] -Deep protocol inspection: For abnormal protocol behavior, corresponding rules are generated to detect the integrity of data packets and protocol specifications.

[0263] By automatically generating and updating these defense rules, the system can continuously adapt to new attack patterns and keep the defense mechanism forward-looking and effective.

[0264] 4. Defense rule library update

[0265] The system automatically updates its defense rule base through the continuous learning mechanism of CNN, incorporating new features from attack data. This continuous expansion and optimization of the defense rule base ensures the system's ability to respond to new attack patterns in real time, enhancing the dynamic adjustment capabilities of network defense. Whenever the system detects an unknown attack signature, the defense rule base generates adaptive rules based on the new features and immediately deploys them to network defenses.

[0266] By using CNN to extract features from attack data and automatically generate defense rules, the system can significantly improve the intelligence of defense mechanisms. The convolution kernel and bias terms in the network go beyond simple feature recognition. Through the continuous updating of the rule base, the system ensures rapid response to unknown threats.

[0267] This solution achieves dynamic and efficient network security assessment and defense through the combination of game theory, reinforcement learning, deep learning and situational awareness technology, and improves the ability to respond to diverse attack scenarios in complex network environments.

[0268] The above description is only a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any modifications, equivalent substitutions and improvements made by any technician familiar with this technical field within the technical scope disclosed by the present invention and within the spirit and principles of the present invention should be covered by the scope of protection of the present invention.

Claims

1. A network security assessment system based on a dynamic attack-defense game model, characterized in that: include: An attack-defense game construction module collects historical network attack data, network topology information, and data from the defense strategy library to construct a multi-level attack path model and a defender response strategy model. This attack-defense game model simulates attackers selecting different attack paths and attack tools, and defenders deploying defense measures based on the attack paths. This generates an attack-defense game equilibrium solution and provides preliminary defense recommendations. A risk prediction module, connected to the attack-defense game building module, is used to perform risk assessment on potential attack behaviors by simulating different attack scenarios multiple times, generate predicted risk values, and provide a detailed risk assessment report; The dynamic defense optimization module receives the output of the risk prediction module and dynamically adjusts the network defense strategy based on the game model results to optimize resource allocation and reduce potential losses. Sensors collect network traffic, user behavior analysis, and system log information, and use this information as input to the game model to update the input parameters of risk assessment and achieve dynamic adjustment of defense strategies. The security situation awareness module is used to collect sensor data such as network traffic monitoring, user behavior analysis, and system logs to generate a real-time security situation map, dynamically adjust the parameters in the game model, and optimize the defense strategy; Receive the security situation map generated by the security situation awareness module, adjust the defense strategy in real time, and feed the defense strategy back to the firewall, intrusion detection system and traffic controller to ensure that the defense strategy matches the current network environment; Implementation of the dynamic defense optimization module: Optimized configuration of defense resources: Based on risk assessment results and current network resources, the system automatically optimizes the allocation of defense resources, including computing resources and bandwidth, to minimize defense costs while maintaining optimal protection effectiveness. The system converts different defense strategies into executable defense tasks and deploys them across the entire network through a central control system. These defense strategies include adjusting firewall rules, IDS detection modes, and malicious code detection rules. Generation of defense rule base based on deep learning: The system automatically generates a defense rule library suitable for different attack strategies through deep learning analysis of historical attack data; it uses deep neural networks or convolutional neural networks for feature extraction; Defense rules refer to the specific protective measures the system takes in response to different attack strategies. By analyzing historical attack data, the system identifies common attack patterns and characteristics and automatically generates corresponding response rules. These rules include protection strategies, traffic filtering rules, and access control policies, which are used to quickly respond to similar attacks and reduce potential damage. The system continuously self-learns and iteratively optimizes defense strategies to respond to new and unknown threats.

2. The network security assessment system based on the dynamic attack and defense game model as claimed in claim 1, characterized in that: Implementation of the attack and defense game building module: Collection and analysis of historical data: Collect historical attack data on the network, including the attack methods, attack paths, network vulnerabilities, and intrusion points used by attackers; combine network topology information to establish a library of potential attack paths for attackers; The defender's strategy includes the configuration of each protection node, the allocation strategy of network resources, the rules of firewalls and intrusion detection systems, and defense measures to deal with different types of attacks.

3. The network security assessment system based on the dynamic attack and defense game model as claimed in claim 1, characterized in that: Implementation of the attack and defense game building module: Use game theory models to define the action space of both attackers and defenders, i.e., the attacker's attack path selection and the defender's defensive measures deployment, and convert them into the state space of the attack-defense game; The utility functions of the attacker and defender are set, that is, the attacker attempts to maximize the destructive benefits through attack means, while the defender minimizes the losses by deploying defense strategies; the strategies of both parties in action selection are solved through Nash equilibrium.

4. The network security assessment system based on the dynamic attack-defense game model according to claim 1, characterized in that: Implementation of the risk prediction module: (1) Multi-scenario game simulation Multi-scenario simulation: By simulating multiple possible attack scenarios, the system can anticipate the paths and strategies that attackers may adopt under different conditions. This includes the attacker's intrusion path, attack targets, methods used, including DDOS attacks, SQL injections, data theft, and how the system responds to these attacks; Game model: The system treats attackers and defenders as two parties in a game and uses game theory strategies to simulate the attacker's decision-making process and the defender's response behavior; Through multiple simulations, the system can assess the attacker's success probability and calculate the risk value of the network system under different attack scenarios; (2) Training of risk prediction models This multi-scenario simulation does not directly train the model, but rather provides the model with rich data and scenarios for risk assessment. By simulating the game model, the system generates a variety of possible attack data, which is then used to assess the weaknesses and potential risks of the network system. Machine learning model training: For the risk prediction module, the machine learning model trained is based on small-sample training. This small-sample training model, with limited sample data, leverages existing attack and defense data through transfer learning or reinforcement learning methods, enabling the model to achieve good generalization capabilities even on data generated by multi-scenario simulations. This approach can improve model performance by combining limited real-world data with simulated data. Multi-scenario simulations generate a large amount of data from different attack paths. This data is used to train machine learning models. Even with limited real-world attack samples, simulations can expand the dataset and improve the model's learning performance. Small sample training models use this limited data, combined with transfer learning or reinforcement learning methods, to predict future attacks and assess risks, helping administrators take preventive measures in advance. (3) Risk assessment and prediction The system uses a trained machine learning model to predict the risk of attack behavior. This model combines the results of game simulation to assess the potential risks of each attack path and provide strategic recommendations to the defender. Output: Ultimately, the risk prediction module outputs an assessment of potential attack paths, success probabilities, possible risk values, and response recommendations based on the current network state. This not only helps network administrators understand network weaknesses but also enables them to take proactive measures to reduce the success rate of attacks. (4) Applicability and performance optimization Since this method relies on data generated by multi-scenario game simulation when the data sample is limited, the model still has high practicality and accuracy under small sample conditions.

5. The network security assessment system based on the dynamic attack and defense game model as claimed in claim 1, characterized in that: Implementation of the security situation awareness module: Network situational awareness: Using various sensor data, including network traffic monitors, behavior analysis systems, and system logs, the system monitors the security status of each node in the network in real time and generates a real-time situation map showing the current security threats facing the network. The system dynamically adjusts the parameters in the attack and defense game model based on the real-time network situation and recalculates the optimal defense strategy based on new threat information. Dynamic update and analysis of situation maps: Implement dynamic situation map update technology and use distributed computing platforms to quickly process massive amounts of data; display situation maps to administrators through visualization technology; the system automatically feeds threat information from the situation map into the game model as a reference for the next round of defense strategy adjustments.

6. A network security assessment method based on a dynamic attack-defense game model according to any one of claims 1 to 5, characterized in that: include: Step 1: Introduce a game theory model into the system through the attack-defense game building module to simulate the dynamic interaction process between attackers and defenders; This module first constructs a multi-level attack path model for attackers and a response strategy model for defenders based on historical attack data and network topology information. The strategies of both attackers and defenders include attack path selection, defense measure deployment, and resource allocation. Step 2: The risk prediction module uses a game model to perform multiple simulations to predict the potential risk to the network under different attack scenarios. The equilibrium solution of the game is used to analyze the most likely attack behavior and provide the defender with optimal response strategies. The system also introduces a real-time monitoring module that monitors network traffic and system logs to dynamically adjust the input parameters of the risk assessment model, thereby tracking and responding to changes in attacker behavior in real time. Step 3: As network attacks evolve, the system dynamically adjusts the network's defense strategy based on the outcome of the attack-defense game through the dynamic defense optimization module. This module allocates and optimizes network resources based on the evaluation results to minimize potential losses. The system, combined with a deep learning model, mines and analyzes historical attack data, automatically generating a defense rule library tailored to different attack strategies. Step 4: The security situation awareness module collects various sensor data in the network, including traffic monitoring, user behavior analysis, and system logs, to generate a real-time security situation map of the network. The system will dynamically adjust the parameters in the game model based on the real-time situation map and recalculate the optimal strategy between attackers and defenders to ensure that the defense strategy is consistent with the current network environment.

7. A computer device, characterized in that: The computer device includes a memory and a processor, the memory stores a computer program, and when the computer program is executed by the processor, the processor performs the steps of the network security assessment method based on dynamic attack and defense game as claimed in claim 6.

8. A computer-readable storage medium storing a computer program, wherein when the computer program is executed by a processor, the processor executes the steps of the network security assessment method based on dynamic attack and defense game according to claim 6.

9. An information data processing terminal, characterized in that: The information data processing terminal is used to implement the network security assessment system based on the dynamic attack and defense game model as described in any one of claims 1 to 5.

Images