Mimicry web defense scheduling method and system based on signal game

Abstract

The invention belongs to the field of network space mimicry security, and particularly relates to a mimicry web defense scheduling method and system based on a signal game. Comprising the following steps: S1, randomly selecting a group of executors as an initial executor set in a mimicry defense isomer set; s2, when an attacker attacks, a defender schedules the initial executive set to defend; s3, when one or more execution bodies in the initial execution body set are damaged under attack, the damaged execution bodies are replaced; s4, determining an optimal scheduling strategy under each type of attack strategy according to the attack and defense cost and the system defense reward; s5, selecting an optimal scheduling strategy according to historical experience and a system real-time state; and S6, randomly selecting a scheduling scheme from the optimal scheduling strategies to serve as an executive set of the next stage until attack and defense are finished. According to the method, the performance loss and the resource cost of the system caused by scheduling are reduced to the greatest extent while the system security is ensured.

Description

Technical Field

[0001] The present invention belongs to the field of cyberspace mimicry security, and specifically relates to a mimicry web defense scheduling method and system based on signal game. Background Art

[0002] At present, the global Internet cyberspace is full of loopholes, and information systems connected to the network are easily invaded by illegal persons. Traditional network defense technology is at a disadvantage when dealing with network attacks, and the diverse network attack methods make it difficult for defenders to defend. In response to this situation, Academician Wu Jiangxing proposed the mimicry defense technology, which reversed the passive situation of defenders in network security. As an active defense technology, mimicry defense mainly ensures that the system presents dynamics and uncertainty to the outside world by constantly changing the set of online execution bodies. As an important link in the mimicry defense architecture, the dynamic scheduling algorithm is a key technology to ensure the security and reliability of the system. At present, there are two main types of mimicry defense scheduling strategies: those based on randomness and heterogeneity and those based on game theory. Among them, the scheduling methods based on randomness and heterogeneity mostly use the vulnerability information of different execution bodies to reflect the heterogeneity between the systems. The system presents a certain degree of uncertainty to the outside world through the combination of random scheduling and heterogeneous maximum scheduling. However, their scheduling rules are easy to be detected and mastered by attackers, and they cannot effectively use the real-time status information of the system. When facing advanced attack methods, the probability of being broken is high. The scheduling strategy based on game theory regards the attacker and defender as participants in the game. By analyzing the behaviors and benefits of the attacker and defender during the game, the equilibrium solution of the game is further calculated, and a more reasonable defense strategy is selected to keep the mimicry web defense system in a safe state. According to the characteristics of the mimicry web defense system, Gao et al. proposed a random seed scheduling algorithm with maximum heterogeneity (GAO Yan, ZI Chen-chen, FENG Si-feng, Security Scheduling Algorithm for Web Gateways Based on Mimicry Defense Theory. Journal of Chinese Computer Systems, 2021). This algorithm combines heterogeneity and randomness to ensure that the executors selected each time have large heterogeneity. However, the scheduling cycle of this algorithm is short, and the scheduling rules are easily mastered by attackers. Chen et al. combined Markov process and incomplete information game to propose an optimal scheduling strategy selection algorithm (Z.Chen e ,Optimal Strategy for Cyberspace Mimic Defense Based on Game Theory,in IEEE Access, 2021), by analyzing the attack methods and the state transition of the mimetic defense system, a Markov model is constructed, and the optimal strategy is determined by solving the perfect Bayesian equilibrium through the attack and defense benefits. However, this model requires the attacker's prior knowledge of the attack methods against the mimetic system and the distribution probability of various attack methods. However, there are many types of attack methods against the Web, and new technologies are emerging in an endless stream. This method is not suitable for the mimetic Web scenario. Summary of the invention

[0003] The purpose of the present invention is to overcome the problems existing in the prior art and provide a mimetic web defense scheduling strategy based on signal game that takes into account the dynamics and real-time situation of the system attack and defense game, and can select a scheduling scheme with the maximum defense benefit according to different game situations.

[0004] The present invention adopts the following technical solution: a mimetic web defense scheduling method based on signal game, comprising: S1: Set the number n of the mimicry defense system isomers and the number m of online executors, and randomly select a group of executors from the mimicry defense isomer set as the initial executor set; S2: When the attacker attacks, the defender schedules the initial set of execution bodies for defense; S3: When one or more executors in the initial executor set are damaged under attack, the damaged executors need to be replaced; each combination of isomers is used as a scheduling scheme, with a total of Compare each scheduling scheme with the current execution set, and classify them into different scheduling strategies according to the number of different elements between the two. ; S4: Determine the optimal scheduling strategy for each type of attack strategy based on the attack and defense costs and system defense rewards; S5: Select the optimal scheduling strategy based on historical experience and real-time system status; S6: Randomly select a scheduling scheme from the optimal scheduling strategy as the execution set for the next stage until the attack and defense are completed.

[0005] Step S3 includes: Given an initial executable , traverse the state space of the mimicry defense system; For a certain scheduling plan , observation difference The number of elements contained in is h. If h=i, i is the number of damaged executables, then the executable set Put in the scheduling strategy middle.

[0006] In step S4, Attack and defense costs include attack costs and defense costs ; System defense rewards are those that can reduce attack strategies in a certain scheduling strategy. Bonus for damaging effects; Reward Pool There are m levels in total, and the scheduling strategy Get rewards of corresponding levels based on the defense effect; Defense Effective Probability , which means that when the attack strategy and defense strategy are determined, and When the defense strategy can change the system state from Reduce to probability; , Defense Bonus DR, ,in , Represents a hypergeometric distribution , m Indicates the size of the execution set, y Indicates the number of executables to be replaced. ji Indicates the number of replaced abnormal state executables.

[0007] Attack Types The optimal defense strategy under ; in Indicates that the attacker and defender use and When , the cost difference between the two is the relative defense benefit.

[0008] Step S5 includes: S51: Calculate the attack and defense game benefits of each defense type signal scheme and attack strategy combination; S52: Solve the refined Bayesian equilibrium based on the attack and defense game payoffs.

[0009] In step S51, the attack and defense game benefits include: Defensive benefits, Attack benefits, Where DFL and DSG represent the system defense failure loss and system defense success gain respectively. and Represent the attack cost and defense cost respectively, represents the cost for the defender to send an inducement signal, represents the cost for the attacker to analyze the signal.

[0010] Step S52 includes, The attacker determines the defender's type a priori ; The attacker determines the optimal attack strategy based on prior inference and attack benefits ; Determine the optimal strategy inferred by the defender ; According to the optimal attack and defense strategy, find the attacker's posterior probability inference of the defense type that satisfies Bayes' rule ;like and If there is no conflict, then the refined Bayesian equilibrium under the game model is obtained , m* represents the type of induction signal released by the system, Represents the scheduling strategy, Indicates the type of attack under a certain induction signal, It represents the attacker's inference of the system defense type after observing signal m; The refined Bayesian equilibrium satisfies the following conditions: According to the conditions described in S4 and S5, the optimal defense solution, that is, the optimal scheduling strategy, is obtained. , in from A scheduling scheme is randomly selected as the next execution set.

[0011] A system comprising a mimic defense architecture, and: An attack and defense information analyzer, used to analyze and record the attack and defense strategy selection information and attack and defense costs in each attack and defense game in the mimetic web defense scheduling method based on signal game; A multi-type scheduling strategy set container is used to store the physical addresses of heterogeneous servers in different types of scheduling schemes in a mimetic web defense scheduling method based on signal game.

[0012] Compared with the prior art, the present invention has the following beneficial effects: 1. The present invention introduces signal game into the selection process of mimetic Web defense scheduling strategy. The signal game model enables the mimetic defense system to autonomously choose to release the induction signal, thereby enhancing its initiative in the attack and defense process. At the same time, it does not need to count various network attack methods and their distribution probabilities, which is more practical.

[0013] 2. The present invention will dynamically select appropriate scheduling strategies according to the real-time gaming situation of the system, take targeted defense measures, and enhance the security of the system.

[0014] 3. The present invention uses the number of execution bodies scheduled each time as different scheduling schemes and selects scheduling strategies according to the system security status. While ensuring the system security, it minimizes the performance loss and resource cost caused by scheduling. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] Figure 1 It is a system structure diagram of the present invention; Figure 2 This is a flow chart of the scheduling method of the present invention; Figure 3 A schematic diagram of the scheduling strategy rules of the present invention; Figure 4 It is the original game diagram based on the characteristics of the mimicry Web defense system; Figure 5 It is the attack and defense game tree and the quantified result of the attack and defense benefits after the execution of the method of the present invention. DETAILED DESCRIPTION

[0016] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below. Obviously, the described embodiments are part of the embodiments of the present invention, rather than all the embodiments; based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

[0017] A mimetic web defense scheduling method based on signal game, comprising: S1: Set the number n of the mimicry defense system isomers and the number m of online executors. Randomly select a group of executors from the mimicry defense isomer set as the initial executor set.

[0018] S2: When the attacker attacks, the defender schedules the initial set of execution bodies for defense.

[0019] S3: When one or more executors in the initial executor set are damaged under attack, the damaged executors need to be replaced; each combination of isomers is used as a scheduling scheme, with a total of Compare each scheduling scheme with the current execution set, and classify them into different scheduling strategies according to the number of different elements between the two. .

[0020] Step S3 includes: Given an initial executable , traverse the state space of the mimicry defense system; For a certain scheduling plan , observation difference The number of elements contained in is h. If h=i, i is the number of damaged executables, then the executable set Put in the scheduling strategy middle.

[0021] S4: Determine the optimal scheduling strategy for each type of attack strategy based on the attack and defense costs and system defense rewards.

[0022] In step S4, Attack and defense costs include attack costs and defense costs ; System defense rewards are those that can reduce attack strategies in a certain scheduling strategy. Bonus for damaging effects; Reward Pool There are m levels in total, and the scheduling strategy Get rewards of corresponding levels based on the defense effect; Defense Effective Probability , which means that when the attack strategy and defense strategy are determined, and When the defense strategy can change the system state from Reduce to probability; , Defense Bonus DR, ,in ; Represents a hypergeometric distribution , m Indicates the size of the execution set, y Indicates the number of executables to be replaced. ji Indicates the number of replaced abnormal state executables.

[0023] Attack Types The optimal defense strategy under ; in Indicates that the attacker and defender use and When , the cost difference between the two is the relative defense benefit.

[0024] S5: Select the optimal scheduling strategy based on historical experience and real-time system status.

[0025] Step S5 includes: S51: Calculate the attack and defense game benefits of each defense type signal scheme and attack strategy combination; the signal scheme means that the system releases a signal that is consistent with its own defense type or a signal that is inconsistent with its own defense type. Figure 5, the combination of defense type signal scheme and attack strategy is (m1, a1), (m2, a1), etc. under t1.

[0026] In step S51, the attack and defense game benefits include: Defensive benefits, Attack benefits, Where DFL and DSG represent the system defense failure loss and system defense success gain respectively. and Represent the attack cost and defense cost respectively, represents the cost for the defender to send an inducement signal, represents the cost for the attacker to analyze the signal.

[0027] S52: Solve the refined Bayesian equilibrium based on the attack and defense game payoffs.

[0028] Step S52 includes, The attacker determines the defender's type a priori ; The attacker determines the optimal attack strategy based on prior inference and attack benefits ; Determine the optimal strategy inferred by the defender ; According to the optimal attack and defense strategy, find the attacker's posterior probability inference of the defense type that satisfies Bayes' rule ;like and If there is no conflict, then the refined Bayesian equilibrium under the game model is obtained , m* represents the type of induction signal released by the system, Represents the scheduling strategy, Indicates the type of attack under a certain induction signal, It represents the attacker's inference of the system defense type after observing signal m; The refined Bayesian equilibrium satisfies the following conditions: According to the conditions described in S4 and S5, the optimal defense solution, that is, the optimal scheduling strategy, is obtained. , in from A scheduling scheme is randomly selected as the next execution set.

[0029] S6: Randomly select a scheduling scheme from the optimal scheduling strategy as the execution set for the next stage until the attack and defense are completed.

[0030] A system, including a mimic defense architecture, further comprising: An attack and defense information analyzer, used to analyze and record the attack and defense strategy selection information and attack and defense costs in each attack and defense game in the mimetic web defense scheduling method based on signal game; A multi-type scheduling strategy set container is used to store the physical addresses of heterogeneous servers in different types of scheduling schemes in a mimetic web defense scheduling method based on signal game.

[0031] This embodiment provides a mimetic Web defense system scheduling example using the method of the present invention.

[0032] In this embodiment, the operating system uses different versions of Windows, CentOS and Ubuntu, the server software uses Apache and Nginx, the database and development language use MySQL and Java respectively, a total of 10 different isomers are constructed, and the number of online executable bodies m is set to 3.

[0033] Set the number of mimic defense system isomers to 10 and the number of online executors to 3. Randomly select a group of executors from the mimic defense isomer set as the initial executor set. Set the initial executor set to .

[0034] An attack and defense information analyzer is set up in the mimic defense architecture to analyze and record the attack and defense strategy selection information and attack and defense costs in each attack and defense game, such as Figure 1 As shown. The attack and defense information analyzer monitors each game process and analyzes the attack cost and defense costs ,The attack cost is related to the attacker’s experience and the number of ,executors broken by the attacker, and the defense cost is mainly related to the number of ,executors replaced by the system each time.,The attack and defense strategy selection information is the ,defense type and the corresponding signal scheme selected by the defender in each ,game. The attacker will continuously revise the prior judgment based on the ,historical strategy and the current strategy information, which will affect the ,equilibrium of subsequent games.

[0035] In the mimic defense architecture, a multi-type scheduling policy set container is constructed to store the physical addresses of heterogeneous servers in different types of scheduling schemes, such as Figure 1 The scheduling scheme refers to different combinations of execution sets. The cardinality of the heterogeneous set is n=10 and the cardinality of the execution set is m=3. The total number of scheduling schemes can be calculated. The scheduling strategy type indicates the number of elements in the execution set to be replaced compared with the initial execution set. , is composed of the initial execution set In comparison, the set of scheduling schemes consisting of i execution body transformations.

[0036] Given an initial executable , traverse the state space of the mimic defense system. For a certain scheduling scheme ,Observe the difference set The number of elements contained in h is as follows: Figure 3 If h=0, then the scheduling plan Put in Type strategy set, similarly, put the remaining scheduling schemes into the appropriate strategy set.

[0037] According to the attack and defense costs and system defense rewards, determine the optimal defense strategy for each type of attack strategy and simplify the game model, such as Figure 4 As shown in the figure. System defense reward DR refers to the scheduling strategy Can reduce attack strategies Rewards for damaging effects. Reward pool There are 3 levels in total, scheduling strategy Get rewards of corresponding levels based on the defense effect. Calculate the system defense benefit value of different defense strategies under the same attack strategy and determine the optimal defense strategy. Represents the probability of the defense strategy obtaining rewards at each level.

[0038] According to historical experience and the real-time status of the system, the game benefits of each defense type signal scheme and attack strategy combination are calculated, and the refined Bayesian equilibrium is solved to select the optimal signal strategy and the optimal defense strategy.

[0039] The attack and defense strategy combination is to construct all possible attack and defense situations based on the attacker's strategy space and the defender's strategy space. , Indicates that this type of attack can break through i online executors. The attacker's attack type can be reflected by the arbiter in the mimic defense framework, and the relevant information of the attack type can be recorded by the attack and defense analyzer for reference in subsequent games. Defender Type Space , indicating that according to different scheduling strategy sets D, they are divided into high defense type and low defense type. The high defense type includes the scheduling strategies in the second half of the scheduling strategy set, indicating that more execution bodies are replaced each time; the low defense type includes the scheduling strategies in the first half of the scheduling strategy set, indicating that fewer execution bodies are replaced each time. According to the type space of the defender, the signal space of the defender sending the induction signal can be determined , corresponding to high defense type and low defense type respectively. After determining the attack and defense strategy space and signal space, calculate the attack and defense benefits of each attack and defense strategy combination and , solve the game equilibrium according to the conditions of the refined Bayesian equilibrium solution.

[0040] Randomly select a scheduling scheme in the optimal defense strategy as the next stage execution set, and obtain the optimal signal strategy through the above calculation , the optimal strategy ,exist Randomly select a scheduling scheme As the next round of execution set.

[0041] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or replace some or all of the technical features therein with equivalents. However, these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention.

Claims

1. A mimetic web defense scheduling method based on signal game, characterized in that: include: S1: Set the number n of the mimicry defense system isomers and the number m of online executors, and randomly select a group of executors from the mimicry defense isomer set as the initial executor set; S2: When the attacker attacks, the defender schedules the initial set of execution bodies for defense; S3: When one or more executors in the initial executor set are damaged under attack, the damaged executors need to be replaced; each combination of isomers is used as a scheduling scheme, with a total of Compare each scheduling scheme with the current execution set, and classify them into different scheduling strategies according to the number of different elements between the two. ; S4: Determine the optimal scheduling strategy for each type of attack strategy based on the attack and defense costs and system defense rewards; S5: Select the optimal scheduling strategy based on historical experience and real-time system status; S6: Randomly select a scheduling scheme from the optimal scheduling strategy as the execution set for the next stage until the attack and defense are completed.

2. The method for mimicking web defense scheduling based on signal game according to claim 1 is characterized in that: The step S3 comprises: Given an initial executable , traverse the state space of the mimicry defense system; For a certain scheduling plan , observation difference The number of elements contained in is h. If h=i, i is the number of damaged executables, then the executable set Put in the scheduling strategy middle.

3. The method for mimicking web defense scheduling based on signal game according to claim 1 is characterized in that: In the step S4, Attack and defense costs include attack costs and defense costs ; System defense rewards are those that can reduce attack strategies in a certain scheduling strategy. Bonus for damaging effects; Reward Pool There are m levels in total, and the scheduling strategy Get rewards of corresponding levels based on the defense effect; Defense Effective Probability , which means that when the attack strategy and defense strategy are determined, and When the defense strategy can change the system state from Reduce to probability; , Defense Bonus DR, ,in ; Represents a hypergeometric distribution , m Indicates the size of the execution set, y Indicates the number of executables to be replaced. ji Indicates the number of replaced abnormal state execution bodies; Attack Types The optimal defense strategy under ; in Indicates that the attacker and defender use and When , the cost difference between the two is the relative defense benefit.

4. The method for mimicking web defense scheduling based on signal game according to claim 1 is characterized in that: The step S5 comprises: S51: Calculate the attack and defense game benefits of each defense type signal scheme and attack strategy combination; S52: Solve the refined Bayesian equilibrium based on the attack and defense game payoffs.

5. The method for mimicking web defense scheduling based on signal game according to claim 4 is characterized in that: In step S51, the attack and defense game benefits include: Defensive benefits, Attack benefits, Where DFL and DSG represent the system defense failure loss and system defense success gain respectively. and Represent the attack cost and defense cost respectively, represents the cost for the defender to send an inducement signal, represents the cost for the attacker to analyze the signal.

6. The method for mimicking web defense scheduling based on signal game according to claim 5 is characterized in that: The step S52 includes: The attacker determines the defender's type a priori ; The attacker determines the optimal attack strategy based on prior inference and attack benefits ; Determine the optimal strategy inferred by the defender ; According to the optimal attack and defense strategy, find the attacker's posterior probability inference of the defense type that satisfies Bayes' rule ;like and If there is no conflict, then the refined Bayesian equilibrium under the game model is obtained , m* represents the type of induction signal released by the system, Represents the scheduling strategy, Indicates the type of attack under a certain induction signal, It represents the attacker's inference of the system defense type after observing signal m; The refined Bayesian equilibrium satisfies the following conditions: According to the conditions described in S4 and S5, the optimal defense solution, that is, the optimal scheduling strategy, is obtained. , in from A scheduling scheme is randomly selected as the next execution set.

7. A system, comprising a mimic defense architecture, characterized in that: Also includes: An attack and defense information analyzer, used to analyze and record the attack and defense strategy selection information and the attack and defense cost in each attack and defense game in any one of claims 1 to 6 of the mimetic web defense scheduling method based on signal game; A multi-type scheduling strategy set container is used to store the physical addresses of heterogeneous servers in different types of scheduling schemes in any one of claims 1-6 of the mimetic web defense scheduling method based on signal game.

Images