Complex network defense system robustness verification method

Abstract

The invention belongs to the field of network security, and relates to a complex network defense system robustness verification method, which comprises the following steps: constructing a defense structure of a complex network defense system; determining a server matrix and a defense strategy matrix of the complex network defense system and an attack strategy matrix of an attacker; determining the defense income of the complex network defense system when the attack and defense parties interact with each other; obtaining an evolutionary defense strategy matrix and a defense strategy transition probability matrix according to the complex network defense system features; obtaining an attack strategy matrix and an attack strategy transfer prediction probability matrix of an attacker according to the features of the complex network defense system; calculating earnings of the complex network defense system for opening real services in each period; calculating expected energy consumption of the complex network defense system in each period; calculating the service quality of the complex network defense system in each period; calculating energy consumption of switching true and false service attributes in each period of the complex network defense system; calculating the total income of the complex network defense system in each period; and the robustness of the system is analyzed according to the total income of the complex network defense system. According to the design theory method, it is verified that the complex network defense system has the robust property, the robust defense system can meet the actual security requirement of the complex network system, and the defense capacity of the system for coping with malicious network attacks is remarkably improved.

Description

Technical Field

[0001] The invention belongs to the field of network security and relates to a method for verifying the robustness of a complex network defense system. Background Art

[0002] With the development and popularization of computer network technology, the Internet has been increasingly integrated into various fields such as military, government, and industry, leading the development trend of world informatization. At the same time, the large-scale increase in network device nodes has made complex network systems face severe security challenges. Due to the highly complex network structure, complex network systems are easily affected by changeable and disordered malicious network attacks, making the system vulnerable. Therefore, active network defense technology has gradually been applied to complex network defense systems to resist attack threats.

[0003] The basic idea of ​​active network defense technology is to increase the attacker's attack cost by dynamically changing and disguising the characteristics of the target network system, thereby improving the security defense capability of the target system. Network deception technology is a typical active network defense technology. This technology is usually deployed in multiple hosts working together. It increases the attacker's uncertainty by periodically switching the true and false service defense strategies deployed by the host, and tricks the attacker into having a wrong perception. Therefore, when a complex network system is attacked maliciously, network deception technology can help the system reduce the impact of vulnerability and improve the security and stability of the system.

[0004] Robustness refers to the ability of a system to maintain stable and reliable performance when facing changes in the internal and external environment, parameter disturbances, and interference from external factors. The characteristics of a robust system are mainly reflected in fault tolerance, adaptability, redundancy, stability, etc. A complex network defense system based on network deception technology has multiple servers, each of which is deployed with a variety of services with real and false attributes. Even if the defense measures are discovered by the attacker, the complex network defense system can still provide services normally through other hosts, and evolve its own defense strategy through the process of self-learning and self-adaptation, and then periodically adjust the defense strategy of true and false services, making it difficult for the attacker to predict the defense measures deployed by the system, thereby reducing the impact of the system's vulnerability. Therefore, the complex network defense system based on network deception technology is a robust system that can maintain the safe and stable operation of the system when it is threatened by attacks. However, current research on the robustness of complex network defense systems mainly focuses on the system's defense technology, defense strategy, and the types of attacks defended. These studies analyze the robustness of the system at the technical level, and do not consider how to prove that the system has robust properties at the theoretical level. Therefore, according to the theoretical method of characteristic design of complex network defense system, by analyzing the benefits of complex network defense system in the attack and defense process, it is proved that the complex network defense system has robust properties. Summary of the invention

[0005] The present invention provides a method for verifying the robustness of a complex network defense system, including: constructing a defense structure of a complex network defense system; determining a server matrix, a defense strategy matrix, and an attack strategy matrix of an attacker of the complex network defense system; determining the defense benefit of the complex network defense system when the attacker and defender interact with each other; obtaining an evolved defense strategy matrix and a defense strategy transfer probability matrix according to the characteristics of the complex network defense system; obtaining an attack strategy matrix and an attack strategy transfer prediction probability matrix of the attacker according to the characteristics of the complex network defense system; calculating the benefit of the complex network defense system starting real services per cycle; calculating the expected energy consumption of the complex network defense system per cycle; calculating the service quality of the complex network defense system per cycle; calculating the energy consumption of the complex network defense system switching between true and false service attributes per cycle; calculating the total benefit of the complex network defense system per cycle; and analyzing the robustness of the system according to the total benefit of the complex network defense system. The design theoretical method of the present invention verifies that the complex network defense system has a robust property, and the robust defense system can meet the actual security requirements of the complex network system and significantly improve the system's defense capability against malicious network attacks.

[0006] The technical solution adopted by the present invention to solve its technical problem is:

[0007] A method for verifying the robustness of a complex network defense system, the method comprising the following steps:

[0008] a. Build a complex network defense system defense structure

[0009] The defense structure of the complex network defense system is that the complex network defense system deploys n servers, n is a positive integer, and each server is represented by server i ,i∈[1,n], where each server can provide m services, m is a positive integer, and each service is represented by service j ,j∈[1,m], and each service has two attributes, real and fake. By periodically switching the real and fake service attributes, the attacker is deceived to improve the security defense capability of the system;

[0010] b. Determine the server matrix SP of the complex network defense system n×m , Defense Strategy Matrix DS n×m And the attacker's attack strategy matrix AS n×m , where the server matrix SP n×m Each element of SP ij Indicates server i Services provided j Service, Defense Strategy Matrix DS n×m Each element of DS ij Indicates the server SP ijThe defensive strategy adopted by DS ij ∈Β, attack strategy matrix AS n×m Each element of AS ij Indicates the attacker's attack on the server SP ij Attack strategy, AS ij ∈Β, Β={0,1} is a Boolean set, DS ij =1 means SP ij Provide real service, DS ij =0 means SP ij Providing false services, AS ij =1 means the attacker attacks SP ij , A.S. ij =0 means the attacker does not attack SP ij ;

[0011] c. Determine the defensive benefits of complex network defense systems when the attacker and the defender interact with each other

[0012] The interaction between the attacker and the defender is that when the attacker and the defender interact with each other, the server SP ij Interaction strategy on ij ,AS ij ) There are 4 categories, each type of interaction strategy is represented by type l , according to the attack and defense in SP ij SP ij The defense benefit of the complex network defense system in the current period t is calculated by the defense benefit:

[0013]

[0014] Among them, l∈[1,4] represents the interaction strategy type, and the four types of interaction strategies are type1 (DS ij ,AS ij )=(0,0), type2 means (DS ij ,AS ij )=(1,0), type3 means (DS ij ,AS ij )=(0,1) and type4 means (DS ij ,AS ij )=(1,1),u l Indicates that the attacker and defender have ij When executing the first type of interaction strategy on SP ij The defensive benefit, r l t Indicates the SP of the attacker and defender who execute the lth type of interaction strategy in the current period t ij quantity;

[0015] d. Obtain the evolved defense strategy matrix DS based on the characteristics of the complex network defense system t+1 And the defense strategy transition probability matrix P t

[0016] The evolved defense strategy matrix DS t+1 The complex network defense system calculates the defense strategy matrix DS of the current period t according to the network environment, the defense benefit information obtained, and the strategy information of the attacker and the defender. t Perform self-learning and adaptive evolution process to obtain the evolutionary defense strategy matrix for the next cycle t+1 The adaptive strategy adjustment process is reflected in the current cycle t system in the server matrix SP n×m The defense strategy transition probability matrix P on t , expressed as Then the defense strategy transition probability matrix P t Every element of Indicates that in the current cycle t each server SP ij The transition probability of the defense strategy on is expressed as

[0017]

[0018] Among them, P t-1 is the server matrix SP of the system in the previous period t-1 n×m The defense strategy transition probability matrix on t-1 Every element of Indicates that in the previous cycle t-1, each server SP ij The defense strategy transition probability on , function F is the strategy adjustment function, the input of this function is a probability value, if the probability value is input, the output is 1, otherwise the output is 0, function H is the defense strategy transition probability function, function sgn is the sign function;

[0019] e. Obtain the attacker's attack strategy matrix AS based on the characteristics of the complex network defense system t+1 And the attack strategy transfer prediction probability matrix * P t

[0020] The attack strategy matrix AS t+1 In the current cycle t, the attacker predicts the defense strategy matrix DS of the current cycle t by analyzing the historical defense strategy changes of the defender t , and then formulate the attack strategy matrix for the next period t+1 as The attacker obtains the attack strategy matrix of the next cycle t+1 by prediction, so the attack strategy transfer prediction probability matrix of the current cycle t is Among them, k∈[2,t] represents the kth period, DSk is the defense strategy matrix of the kth period, DS k-1 is the defense strategy matrix of the k-1th period;

[0021] f. Calculate the benefits of starting real services for the complex network defense system per cycle:

[0022]

[0023] Among them, u real For the system on each server SP ij The benefits of opening real services on The server SP that starts the real service in the current period t system ij Quantity, that is The server SP that executes the second type of interaction strategy for both the attacker and the defender in the current period t ij quantity, The server SP that executes the fourth type of interaction strategy for both the attacker and the defender in the current period t ij quantity;

[0024] g. Calculate the expected energy consumption of the complex network defense system per cycle as:

[0025]

[0026] Among them, the function ln is a penalty function, which is used to reduce high High system energy consumption caused by the value;

[0027] h. Calculate the service quality of the complex network defense system per cycle as:

[0028]

[0029] Among them, u reward For the system on each server SP ij The benefits of switching from a fake service to a real service, The server SP of the previous cycle ij The fake service provided on the SP becomes the real service in the current cycle t ij quantity;

[0030] i. Calculate the energy consumption of the complex network defense system switching true and false service attributes per cycle:

[0031]

[0032] Among them, u punish For each server SP ij The penalty value for switching between true and false service attributes, u punish >u reward , The server SP of the previous cycle ij The real service provided by the SP becomes a fake service in the current period t ij quantity;

[0033] j. Calculate the total benefit of the complex network defense system per cycle as:

[0034] k. The robustness of the system is analyzed based on the total benefit of the complex network defense system. Specifically, when threatened by malicious attacks, the complex network defense system periodically adjusts its own defense strategy through self-learning and adaptive evolutionary processes, making it difficult for the attacker to predict the defense strategy, resulting in a decrease in attack benefits and an increase in the total benefit of the defense system, proving that the complex network defense system is robust.

[0035] The present invention is a complex network defense system robustness verification method, which has the following advantages compared with the prior art:

[0036] A robustness verification method for complex network defense systems is designed. Based on the attack and defense process of complex network defense systems in reality, the attacker is designed to predict the defense strategy by analyzing the changing rules of the defender's defense strategy, and then formulate an attack strategy; the complex network defense system is designed to periodically deploy defense strategies that are more in line with actual security needs through self-learning and adaptive evolution. As the attack and defense process proceeds, it becomes increasingly difficult for the attacker to predict the defense strategy, resulting in a decrease in attack benefits and a gradual increase in the total benefits of the defense system, making the complex network defense system robust, thereby improving the security and stability of the complex network defense system. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] In order to more clearly illustrate the technical solution in the embodiment of the present invention, the present invention is further described below in conjunction with the accompanying drawings and specific implementation plans:

[0038] Figure 1 It is a flow chart of a method for robustness verification of a complex network defense system. DETAILED DESCRIPTION

[0039] In order to make the purpose, technical solutions and advantages of the present invention more clear, the present invention is further described in detail below in conjunction with embodiments and accompanying drawings, but the present application is not limited to these embodiments.

[0040] This embodiment provides a method for verifying the robustness of a complex network defense system, the method comprising the following steps:

[0041] a. Build a complex network defense system defense structure

[0042] In step a, a complex network defense system is constructed based on the network deception active defense technology. Since the network deception active defense technology refers to the system increasing the uncertainty of attackers by periodically switching the real and false service defense strategies deployed by the host in multiple hosts working together, the complex network defense system needs to deploy n servers, where n is a positive integer. The system determines the specific number of servers n according to its own situation and cost, and each server is represented by server i , i∈[1,n], where each server can provide m types of services, m is a positive integer, and the system determines the type of service m provided by the server according to its own situation. Each service is represented by service j ,j∈[1,m], and each service has two attributes, real and false. The complex network defense system deceives the attacker by periodically switching the real and false service attributes, thereby improving the security defense capability of the system.

[0043] b. Determine the server matrix SP of the complex network defense system n×m , Defense Strategy Matrix DS n×m And the attacker's attack strategy matrix AS n×m

[0044] In step b, since the n servers deployed in the complex network defense system constructed in step a can provide m services respectively, the server matrix SP can be determined. n×m , Defense Strategy Matrix DS n×m And the attacker's attack strategy matrix AS n×m are all n-row and m-column matrices, where the server matrix SP n×m The element SP in the i-th row and j-th column of ij , i.e., the server SP ij Indicates the i-th server server i The jth service provided j , defense strategy matrix DS n×m Each element of DS ij Indicates that the system is on each server SP ij The defense strategy adopted on the attack strategy matrix AS n×m Each element of AS ij Indicates that the attacker has a ij The attack strategy adopted by DS ij and AS ij The values ​​of are all Boolean sets Β={0,1}, DS ij =1 indicates the server SP ij Provide real service, DS ij =0 indicates the server SP ij Providing false services, ASij =1 means the attacker attacks the server SP ij Services provided, AS ij =0 means the attacker does not attack the server SP ij Services provided.

[0045] c. Determine the defensive benefits of complex network defense systems when the attacker and the defender interact with each other

[0046] In step c, in a real complex network defense system, the attacker and the defender interact with each other to compete for system resources. ij Interaction strategy on ij ,AS ij ) There are 4 categories, each type of interaction strategy is represented by type l , where the first type of interaction strategy type1 is (DS ij ,AS ij )=(0,0), indicating that the attacker does not attack the server SP ij The fake service provided, the second type of interaction strategy type2 is (DS ij ,AS ij )=(1,0), indicating that the attacker does not attack the server SP ij The real service provided, the third type of interaction strategy type3 is (DS ij ,AS ij )=(0,1), indicating that the attacker attacks the server SP ij The fake service provided, the fourth type of interaction strategy type4 is (DS ij ,AS ij )=(1,1), indicating that the attacker attacks the server SP ij The real service provided is based on the attack and defense parties on the server SP ij Server SP ij The defense benefits of the complex network defense system in the current period t are calculated by for:

[0047]

[0048] Among them, l∈[1,4] represents the interaction strategy type, u l Indicates that the attacker and defender have different ij When executing the first type of interaction strategy, the server SP ij The defensive benefit, r l t Indicates that the server SP that executes the type l interaction strategy between the attacker and the defender in the current period t ij quantity.

[0049] d. Obtain the evolved defense strategy matrix DS based on the characteristics of the complex network defense system t+1 And the defense strategy transition probability matrix P t

[0050] In step d, the complex network defense system has the characteristics of self-adaptation and self-learning. When the system is affected by disturbances such as attacks, it can adaptively adjust its own state. Specifically, the complex network defense system adjusts the defense strategy matrix DS of the current period t according to the network environment, the obtained defense benefit information and the strategy information of the attacking and defending parties. t Perform self-learning and adaptive evolutionary processes to obtain a safer and more reasonable evolutionary defense strategy matrix for the next cycle t+1 The complex network defense system can periodically and adaptively adjust its own defense strategy, thereby reducing the serious impact of malicious attacks on the system and ensuring the safe and stable operation of the system. The adaptive adjustment process of the complex network defense system is reflected in the system in the server matrix SP in the current period t n×m The defense strategy transition probability matrix P on t , expressed as Then the defense strategy transition probability matrix P t Every element of Indicates that in the current cycle t each server SP ij The defense strategy transition probability on is expressed as:

[0051]

[0052]

[0053] Among them, P t-1 is the server matrix SP of the system in the previous period t-1 n×m The defense strategy transition probability matrix on t-1 Every element of Indicates that in the previous cycle t-1, each server SP ij The defense strategy transition probability on , function F is the strategy adjustment function, the input of this function is a probability value, with the probability value input, the output is 1, otherwise the output is 0, function H is the defense strategy transition probability function, and function sgn is the sign function.

[0054] e. Obtain the attacker's attack strategy matrix AS based on the characteristics of the complex network defense system t+1 And the attack strategy transfer prediction probability matrix * P t

[0055] In step e, according to the characteristics of the attacker in the real complex network defense system, the attacker can obtain the system's defense information through monitoring and scanning, and then analyze the defender's historical defense strategy changes to predict the defense strategy matrix DS of the current period t. t , and then formulate the attack strategy matrix for the next period t+1 as The attacker obtains the attack strategy matrix of the next cycle t+1 by prediction, so the attack strategy transfer prediction probability matrix of the current cycle t is * P t It is expressed as:

[0056]

[0057] Where k∈[2,t] represents the kth period, k=2 means that the attacker starts to analyze the defender’s defense information from the second period, DS k is the defense strategy matrix of the kth period, DS k-1 is the defense strategy matrix for the k-1th period.

[0058] f. Calculate the benefits of enabling real services for complex network defense systems per cycle

[0059] In step f, the complex network defense system provides real services, indicating that the system can operate normally, that is, the system can provide the required service resources for normal users. The benefits of normal operation of the system are measured by calculating the benefits of the complex network defense system starting real services in the current period t. It is expressed as:

[0060]

[0061] Among them, u real For the system on each server SP ij The benefits of opening real services on The server SP that starts the real service in the current period t system ij Quantity, that is The server SP that executes the second type of interaction strategy for both the attacker and the defender in the current period t ij quantity, The server SP that executes the fourth type of interaction strategy for both the attacker and the defender in the current period t ij quantity.

[0062] g. Calculate the expected energy consumption of the complex network defense system per cycle

[0063] In step g, the defense strategy transition probability value of the complex network defense system The larger the value, the higher the switching frequency between real and fake service attributes, which is more likely to cause excessive system energy consumption and a higher defense strategy transition probability value. Will make the system's server SP ij The system is in a state of continuously switching between true and false service attributes, thereby reducing the evolutionary characteristics of the system. The penalty function can be used to suppress the problem of excessive energy consumption while ensuring the evolutionary characteristics of the system. The expected energy consumption of the complex network defense system in the current cycle t is It is expressed as:

[0064]

[0065] Among them, the function ln is a penalty function, which is used to reduce high High system energy consumption due to low values.

[0066] h. Calculate the quality of service of the complex network defense system per cycle

[0067] In step h, when the complex network defense system provides real services, the system can provide service resources for normal users and maintain normal operation. ij Switching the false service to the real service can improve the service quality of the system. In the current cycle t, the service quality of the complex network defense system can be calculated by measuring the benefits of switching the false service to the real service. t , expressed as:

[0068]

[0069] Among them, u reward For the system on each server SP ij The benefits of switching from a fake service to a real service, The server SP of the previous cycle ij The fake service "0" provided by the server becomes the real service "1" in the current cycle t. ij quantity.

[0070] i. Calculate the energy consumption of switching true and false service attributes per cycle in a complex network defense system

[0071] In step i, according to the characteristics of the complex network defense system, the system periodically updates each server SP through an adaptive and self-learning evolutionary process. ij The real service provided by the network is switched to a fake service or the fake service is switched to a real service. The switching of the real and fake service attributes will generate system energy consumption. The energy consumption E of the complex network defense system switching the real and fake service attributes in the current period t is calculated. a t It is expressed as:

[0072]

[0073] Among them, u punish For each server SP ij The penalty value for switching between true and false service attributes, u punish >u reward , The server SP of the previous cycle ij The real service "1" provided by the server is changed to the fake service "0" in the current cycle t. ij quantity.

[0074] j. Calculate the total benefit of the complex network defense system per cycle as:

[0075] k. Analyze the robustness of the system based on the total benefits of the complex network defense system

[0076] In step k, when threatened by malicious attacks, the complex network defense system periodically adjusts its own defense strategy through self-learning and adaptive evolutionary processes, making it difficult for the attacker to predict the defense strategy, resulting in a decrease in attack benefits and an increase in the total benefits of the defense system, proving that the complex network defense system has a robust nature.

Claims

1. A method for verifying the robustness of a complex network defense system, characterized in that: The following steps are involved: a. Construct a complex network defense system defense structure. Specifically, the complex network defense system deploys n servers, where n is a positive integer and each server is represented by server i ,i∈[1,n], where each server can provide m services, m is a positive integer, and each service is represented by service j ,j∈[1,m], and each service has two attributes, real and fake; b. Determine the server matrix SP of the complex network defense system n×m , Defense Strategy Matrix DS n×m And the attacker's attack strategy matrix AS n×m , where SP n×m Each element of SP ij Indicates server i Services provided j Services, DS n×m Each element of DS ij Indicates the server SP ij The defensive strategy adopted by DS ij ∈Β,AS n×m Each element of AS ij represents the attack strategy of the attacker on the server SPij, ASij∈Β, Β={0,1} is a Boolean set, DS ij =1 means SPij provides real service, DSij=0 means SP ij Providing false services, AS ij =1 means the attacker attacks SP ij , A.S. ij =0 means the attacker does not attack SP ij ; c. Determine the defense benefits of the complex network defense system when the attacker and defender interact with each other. Specifically, the attacker and defender have four types of interaction strategies on the server SPij (DS ij ,AS ij ), each type of interaction strategy is represented as typel, according to the SP when the attacker and defender interact on SPij ij The defense benefit of the complex network defense system in the current period t is calculated by the defense benefit: Among them, l∈[1,4] represents the interaction strategy type, and the four types of interaction strategies are type1 (DS ij ,AS ij )=(0,0), type2 means (DS ij ,AS ij )=(1,0), type3 means (DS ij ,AS ij )=(0,1) and type4 means (DS ij ,AS ij )=(1,1), ul means the attacker and defender in each SP ij When executing the first type of interaction strategy on SP ij The defensive benefits Indicates the SP of the attacker and defender who execute the lth type of interaction strategy in the current period t ij quantity; d. Obtain the evolved defense strategy matrix DS based on the characteristics of the complex network defense system t+1 And the defense strategy transition probability matrix P t Specifically, the complex network defense system adjusts the defense strategy matrix DS of the current period t through a self-learning and adaptive evolutionary process. t , and then obtain the evolved defense strategy matrix The adaptive strategy adjustment process is reflected in the current cycle t system in the server matrix SP n×m Defense strategy transition probability matrix on Then each SP in the current cycle t ij The probability of defense strategy transition on for: Among them, P t-1 is the server matrix SP of the system in the previous period t-1 n×m The defense strategy transition probability matrix on , For each SP in the previous cycle t-1 ij The defense strategy transition probability on , function F is the strategy adjustment function, the input of this function is a probability value, if the probability value is input, the output is 1, otherwise the output is 0, function H is the defense strategy transition probability function, function sgn is the sign function; e. Obtain the attacker's attack strategy matrix AS based on the characteristics of the complex network defense system t+1 And the attack strategy transfer prediction probability matrix * P t Specifically, in the current period t, the attacker predicts the defense strategy matrix DS of the current period t by analyzing the defender's historical defense strategies t , and then formulate the attack strategy matrix for the next period t+1 as The attack strategy transfer prediction probability matrix of the current cycle t is Among them, k∈[2,t] represents the kth period, DS k is the defense strategy matrix of the kth period, DS k-1 is the defense strategy matrix of the k-1th period; f. Calculate the benefits of starting real services for the complex network defense system per cycle: Among them, u real For each SP ij The benefits of opening real services on The SP that opens the real service for the current period t system ij quantity; g. Calculate the expected energy consumption of the complex network defense system per cycle as: Among them, function ln is the penalty function; h. Calculate the service quality of the complex network defense system per cycle as: Among them, u reward For each SP ij The benefits of switching from a fake service to a real service, The server SP of the previous cycle ij The fake service provided on the SP becomes the real service in the current cycle t ij quantity; i. Calculate the energy consumption of the complex network defense system switching true and false service attributes per cycle: Among them, u punish For each SP ij The penalty value for switching between true and false service attributes. The server SP of the previous cycle ij The real service provided by the SP becomes a fake service in the current period t ij quantity; j. Calculate the total benefit of the complex network defense system per cycle as: k. The robustness of the system is analyzed based on the total benefit of the complex network defense system. Specifically, when threatened by malicious attacks, the complex network defense system periodically adjusts its own defense strategy through self-learning and adaptive evolutionary processes, making it difficult for the attacker to predict the defense strategy, resulting in a decrease in attack benefits and an increase in the total benefit of the defense system, proving that the complex network defense system is robust.

Images