A Multi-Agent Network Security Defense Method and System Based on Consensus Game

Abstract

This application discloses a multi-agent network security defense method and system based on consensus game. First, a consensus game model is established, and the consensus, game participants, groups participating in the game, and network status are initialized, and the participant strategy space is established. Then, preprocessing and analysis are performed through intelligent perception agents to locate the group of game participants where the attack is located, and the identified attack events are input into the consensus game model to calculate the game cost-benefit. Finally, based on the game cost-benefit, the optimal cost-benefit of the multi-party consensus game is quantitatively calculated to obtain the defense strategy with the minimum cost. Through the establishment and analysis of the consensus game model, unified game modeling and analysis are carried out on the three parties according to the analysis of the attack and defense cost-benefit. From the perspective of the least impact or loss on the protected party, the optimal strategies that the defender and the network system itself should adopt are analyzed, the defense strategy is dynamically and actively adjusted, and the network risks and security threats are controlled within an acceptable range.

Description

Technical Field

[0001] This application relates to the field of network security technology. Specifically, it relates to a multi-agent network security defense method and system based on consensus game. Background Art

[0002] The current network space security defense system is mainly based on the event response-driven model of cybernetics, taking the defense side as the only decision-making subject, and uniformly abstracting attack behaviors, protected systems, and non-malicious abnormal events as environmental variables. This model has significant defects: First, it has strong perception dependence and requires complete and noise-free attack state information for response decision-making, making it difficult to cope with data loss, noise interference, and dynamically changing attack means, resulting in delayed or ineffective defense; Second, the behavior modeling is insufficient, only unilaterally considering defense strategies, without quantitatively analyzing the attacker's behavior logic, the state evolution of the protected system, and the counter-effect of defense behaviors on system availability (performance degradation caused by resource preemption), making it difficult to achieve precise defense; Third, the centralized decision-making has limitations, relying on machine learning and a centralized security management center, resulting in poor real-time defense response and weak cross-node linkage capabilities, and being unable to adapt to the high-dynamic characteristics and new threats of virtualized and software-defined networks; Fourth, the game relationship is ignored. In actual attack and defense scenarios, there are complex interactions of competition (attack and defense confrontation) and cooperation (goal coordination between defenders and system maintainers) among the attacker, the defense side, and the protected object. Existing technologies have not constructed a mathematical representation of such multi-role dynamic games, resulting in one-sided strategy optimization.

[0003] Although multi-agent technology has shown advantages in the field of complex system collaboration, the existing security architecture still lacks the ability to uniformly model multi-party game relationships. As an emerging branch of game theory, consensus game can perform mathematical abstraction and equilibrium solution for the complex relationship of coexistence of competition and cooperation, providing a theoretical breakthrough point for constructing a precise and adaptive defense system. Therefore, there is an urgent need for a defense architecture based on consensus game and multi-agent collaboration to solve the above technical bottlenecks and achieve dynamic equilibrium and intelligent efficiency improvement of network security. Summary of the Invention

[0004] The purpose of this application is to provide a multi-agent network security defense method and system based on consensus game to overcome the existing technical defects. By establishing a consensus game model for analysis and calculation, and conducting unified game modeling analysis on the three parties according to the analysis of attack and defense cost-benefit, from the perspective of minimizing the impact or loss on the protected party, the optimal strategies that the defender and the network system itself should adopt are analyzed, and the defense strategy is dynamically and actively adjusted to control network risks and security threats within an acceptable range.

[0005] The purpose of this application is achieved through the following technical solutions:

[0006] In a first aspect, the present application proposes a multi-agent network security defense method based on consensus game, and the method includes:

[0007] Establish a consensus game model;

[0008] Initialize consensus, game participants, groups participating in the game, and network status, and establish a participant strategy space;

[0009] Preprocess and analyze the attack perception information, network entity topology, and operating status information based on traffic and log analysis through an intelligent perception agent, locate the group of game participants where the attack is located, and input the identified attack event into the consensus game model;

[0010] Construct a utility function of the consensus game model, and calculate the game cost-benefit using a defense graph and an attack-defense cost quantification benefit analysis model;

[0011] Quantitatively calculate the optimal cost-benefit of the multi-party consensus game for the attacker, defender, and protected party based on the game cost-benefit, obtain the defense strategy with the minimum cost, and send it to each defense execution intelligent agent in the group for execution.

[0012] In a possible implementation, the steps for each defense execution intelligent agent to execute the defense strategy with the minimum cost include:

[0013] Each defense execution intelligent agent automatically arranges a defense chain and generates device-level control instructions based on the defense strategy with the minimum cost, and dynamically adjusts the security resource allocation, routing strategy, and operating status of the protected object;

[0014] Run an attack-defense trend prediction algorithm through a trend prediction agent to predict the next actions of the attacker and generate a set of preset defense strategies;

[0015] The trend intelligent prediction and evaluation agent conducts a multi-dimensional review and analysis of historical attack-defense data, identifies optimization points of the defense system, and inputs the feedback results into the consensus game model to trigger the construction of the next defense graph and game calculation.

[0016] In a possible implementation, the consensus game model is defined as: , where is the consensus, is the set of all game participants, is a group partition of is each participant, represents the strategy space of the th participant determined by the rules of the consensus and represents the benefit function of the th participant.

[0017] In a possible implementation, the participant strategy space includes a defense strategy set, an attack strategy set, and a business strategy set. The defense strategy set is a combination of security defense strategies and resource management strategies. The attack strategy set contains feasible attack actions against network threats. The business strategy set includes the resource management strategies of the protected object during the defense process.

[0018] In a possible implementation, the steps of initializing the consensus, game participants, groups participating in the game, and network state include:

[0019] Initializing the consensus: Establish an attack and defense knowledge base and a consensus on the rules followed by the attacker, defender, and protected object, and input them into the consensus game model and the payoff function;

[0020] Initializing the game participants: According to the actual scale and category of the network, perform granularity abstraction on the entities therein to form a set of game participants;

[0021] Initializing the groups participating in the game: Generate a set of participants according to the network entity type and granularity abstraction;

[0022] Initializing the network state: Construct a defense graph through the information collected by the intelligent perception agent , is the node set of the defense graph, represents the network state transition relationship, represents the set of initial states of the network, represents the set of target states of the attacker, is the strategy set of the attacker, is the strategy set of the defender, is the management strategy set of the business information system.

[0023] In a possible implementation, the method further includes:

[0024] Establish a hierarchical and regional distributed defense system architecture, and divide the security domain into endpoint-side intelligent agents and center-side intelligent agents. The endpoint-side intelligent agents are responsible for state perception and defense execution, and the center-side intelligent agents are responsible for game decision-making and attack prediction.

[0025] In a second aspect, the present application proposes a multi-agent network security defense system based on consensus game. The system includes:

[0026] A model establishment module, used to establish a consensus game model;

[0027] An initialization module, used to initialize the consensus, game participants, groups participating in the game, and network state and establish a participant strategy space;

[0028] A preprocessing and analysis module, which is used to preprocess and analyze the attack perception information, network entity topology and operation status information based on traffic and log analysis through an intelligent perception agent, locate the group of game participants where the attack is located, and input the identified attack events into the consensus game model;

[0029] A calculation module, which is used to construct the utility function of the consensus game model and calculate the game cost-benefit by using the defense graph and the attack-defense cost quantification benefit analysis model;

[0030] A quantification calculation module, which is used to quantitatively calculate the optimal cost-benefit of the multi-party consensus game for the attacker, the defender and the protected party based on the game cost-benefit, obtain the defense strategy with the minimum cost, and send it to each defense execution intelligent agent in the group for execution.

[0031] In a possible implementation manner, the quantification calculation module further includes:

[0032] An adjustment sub-module, which is used for each defense execution intelligent agent to automatically arrange the defense chain and generate device-level control instructions based on the defense strategy with the minimum cost, and dynamically adjust the security resource allocation, routing strategy and operation status of the protected object;

[0033] A generation sub-module, which is used to run the attack-defense trend prediction algorithm through the trend prediction agent, predict the next action of the attacker, and generate a set of preset defense strategies;

[0034] A review and analysis sub-module, which is used for the trend intelligent prediction and evaluation agent to conduct multi-dimensional review and analysis on historical attack-defense data, identify the optimization points of the defense system, and input the feedback results into the consensus game model to trigger the next round of defense graph construction and game calculation.

[0035] The main solution of the present application and its various further selection solutions can be freely combined to form multiple solutions, all of which are solutions that can be adopted and claimed by the present application; and in the present application, (each non-conflicting selection) selections can be freely combined with each other and with other selections. Those skilled in the art can understand that there are various combinations according to the prior art and common knowledge after understanding the solution of the present application, all of which are the technical solutions to be protected by the present application, and will not be enumerated here.

[0036] The present application discloses a multi-agent network security defense method and system based on consensus game. First, a consensus game model is established, and the consensus, game participants, groups participating in the game, and network status are initialized, and the participant strategy space is established. Then, preprocessing and analysis are performed through an intelligent sensing agent to locate the group of game participants where the attack is located, and the identified attack events are input into the consensus game model to calculate the game cost and benefit. Finally, based on the game cost and benefit, the optimal cost and benefit of the multi-party consensus game are quantitatively calculated to obtain the defense strategy with the minimum cost. Through the establishment and analysis of the consensus game model, unified game modeling and analysis are performed on the three parties according to the analysis of the attack and defense cost and benefit. From the perspective of the least impact or loss on the protected party, the optimal strategies that the defender and the network system itself should adopt are analyzed, the defense strategy is dynamically and actively adjusted, and the network risk and security threats are controlled within an acceptable range. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the following will briefly introduce the drawings required for the embodiments. It should be understood that the following drawings only show some embodiments of the present application, and therefore should not be regarded as limiting the scope. For those of ordinary skill in the art, without creative efforts, other related drawings can also be obtained based on these drawings.

[0038] Figure 1 FIG. shows a schematic flow chart of a multi-agent network security defense method based on consensus game proposed by an embodiment of the present application.

[0039] Figure 2 FIG. shows an architecture diagram of the network security defense system proposed by an embodiment of the present application. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0040] The following uses specific specific examples to illustrate the implementation manners of the present application. Those skilled in the art can easily understand the other advantages and effects of the present application from the content disclosed in this specification. The present application can also be implemented or applied through other different specific implementation manners. The details in this specification can also be modified or changed based on different viewpoints and applications without departing from the spirit of the present application. It should be noted that, without conflict, the following embodiments and the features in the embodiments can be combined with each other.

[0041] Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative efforts belong to the scope protected by the present application.

[0042] In the prior art, in the actual network security environment, from the perspectives of the attacker, the defender, and the protected object, there are both competitions (between the attacker and the defender, between the defender and the protected object) and collaborations (between the defender and the protected object), which is a complex game relationship. Therefore, there is an urgent need for a unified defense system design architecture that can fully and objectively model and implement precise, intelligent, and efficient defenses.

[0043] Therefore, to solve the above technical problems, the embodiments of the present application propose a multi-agent network security defense method and system based on consensus game. By establishing a consensus game model, attack perception information based on traffic and log analysis, network entity topology and operation status information, attack and defense knowledge graph information, etc. are used as inputs, and analyzed and calculated through the game model. According to the attack and defense cost-benefit analysis, unified game modeling and analysis are carried out for the attacker, the defender, and the protected party. From the perspective of minimizing the impact or loss on the protected party, the optimal strategies that the defender and the network system itself should adopt are analyzed, and the defense strategy is dynamically and actively adjusted. Through the multi-agent framework, different collectors, analyzers, defense tools, etc. are used as intelligent agents with different roles, and the agents cooperate through a unified interaction protocol. From perception, decision-making to defense response execution, it is all implemented based on intelligent agents, controlling network risks and security threats within an acceptable range, and timely and effectively controlling and eliminating security events and threats. By collecting and analyzing the system security status information, the security status of the system is obtained. Based on the feedback value of the reward function of the game model based on the current security status and the execution effect of the previous security defense strategy, cooperation based on the multi-agent distributed framework is carried out, and the current defense strategy set is dynamically generated in a timely manner, providing policy optimization decision suggestions for the security measures to be taken by the security administrator.

[0044] Please refer to Figure 1 , Figure 1 shows a schematic flowchart of a multi-agent network security defense method based on consensus game proposed by the embodiments of the present application. The method includes the following steps:

[0045] Step S1: Establish a consensus game model.

[0046] The definition of the consensus game model is: , where is the consensus, is the set of all game participants, is a group partition of for each participant, represents the th participant's strategy space, represents the consensus determined by the rules of the payoff function of the

[0047] Consensus Game Model is a mathematical framework that describes how multiple participants reach a consensus through strategic interaction. Its core lies in using game theory tools to transform the consensus principle into a quantifiable payoff function, ultimately guiding the system to converge to an equilibrium state. Among them, the consensus principle is the code of conduct jointly followed by game participants and consists of a set of rules or protocols.

[0048] The set of game participants includes all game players. The group division is to divide into subgroups according to the security domain, functional role, or social network relationship The strategy space is the set of actions they can choose. The specific design needs to combine the consensus principle and the actual scenario. The payoff function

[0049] Consensus Game Model provides a unified analysis framework for the cooperation and competition of multi-agent systems by transforming the consensus principle into a mathematical strategy space and payoff function. Its core value lies in proving that it can resist attacks, dynamically adjust, and reach a global optimal consensus under a reasonable incentive mechanism through the existence and stability of equilibrium solutions.

[0050] Step S2: Initialize the consensus, game participants, groups participating in the game, and network state, and establish the participant strategy space.

[0051] The steps of initializing the consensus, game participants, groups participating in the game, and network state include:

[0052] Initializing the consensus: Establish an attack and defense knowledge base and the rule settings consensus jointly followed by the attacker, defender, and protected object, and input them into the consensus game model and payoff function;

[0053] Initializing the game participants: According to the actual scale and category of the network, abstract the entities in it to form a set of game participants;

[0054] Initializing the groups participating in the game: Generate a set of participants according to the network entity type and granularity abstraction;

[0055] Initializing the network state: Construct a defense graph through the information collected by the intelligent sensing agent , is the node set of the defense graph, represents the network state transition relationship, represents the set of initial states of the network, Represents the set of target states of the attacker, is the set of strategies of the attacker, is the set of strategies of the defender, is the set of management strategies of the business information system.

[0056] Consensus is the basic rules or knowledge base that all game participants know and follow. These rules include the basic guidelines of network security, the content in the attack and defense knowledge base, etc. For example, the possibility of system vulnerabilities, the behavior patterns of attackers, the strategy choices of defenders, etc. The implementation method is: first establish an attack and defense knowledge base, which contains known attack means, defense measures and their implementation methods. Rule examples are: the attacker assumes that there must be exploitable vulnerabilities in the system, the defender assumes that the risk of being attacked can be reduced by deploying firewalls, intrusion detection systems (IDS), etc., and the protected object assumes that the normal operation of the business system takes precedence over the performance degradation caused by excessive defense. Take the consensus C as an input variable to guide the design of the payoff function in the game model. For example, according to the consensus C, the payoff function can be quantified as: the payoff of the attacker = the benefit obtained after a successful attack - the attack cost, and the payoff of the defender = the loss reduced after a successful defense - the defense cost.

[0057] Set of game participants Represents all entities participating in the game. The entities can be devices, hosts, software processes, etc. in the network. According to the actual scale and category of the network, these entities can be abstracted at different granularities. Among them, the granularity abstraction is to divide the entities in the network by function or role. For example, independently operating devices (such as servers, routers), virtual hosts (such as virtual machines, containers), software processes (such as database services, Web applications).

[0058] Initialize the group participating in the game (The elements in the group represent the number of groups, which include several participants and their corresponding intelligent agents) divides the set of participants N into multiple groups P according to security domains, user domains or other custom rules. Each group contains several intelligent agents responsible for functions such as data collection and perception, decision-making, defense execution, and prediction and evaluation. The group division rules include: division according to the security level or area of the network (security domain division), division according to user types or business requirements (user domain division), and flexible division according to actual needs (custom rules). And the intelligent agents included in each group are: intelligent data collection and perception agent, intelligent game decision-making agent, intelligent defense execution agent, and trend intelligent prediction and evaluation agent. The intelligent data collection and perception agent is responsible for collecting network status information, resource information, vulnerability information, etc. The intelligent game decision-making agent makes strategy selections based on the collected information. The intelligent defense execution agent is responsible for implementing defense measures. The trend intelligent prediction and evaluation agent evaluates the current defense effect and future risks.

[0059] Initialize the network state, and collect various state information through intelligent perception agents to construct a defense graph to describe the entities, relationships and defense means in the network environment, where the node set represents various security states in the network, and each node represents a possible state; the state transition relationship represents the transition relationship from one security state to another; the initial state set represents the initial state of the network; the target state set represents the target state of the attacker; the attacker strategy set represents the strategies that the attacker can take; the defender strategy set represents the strategies that the defender can take; the business management strategy set represents the management strategies that the business information system can take.

[0060] The steps to construct a defense graph through the information collected by intelligent perception agents include:

[0061] Collect the state information, resource information, and vulnerability information in the network through intelligent perception agents;

[0062] Construct the state information, resource information, and vulnerability information in the network into a global security state matrix and ;

[0063] Based on the global security state matrix and Generate a defense graph.

[0064] Construct the security state data collected by each security protection end device into a security state matrix , where each business system state includes the subject ID, whether an attack is locally detected, the attack type, the current availability of the device, etc. The global security state matrix is defined as: , where is the number of security protection strategies that can be adopted, is the number of attacks and vulnerabilities detected in the network information system. The global security state matrix is expressed as: , where is the number of security protection strategies that can be adopted, is the number of business strategies that can be adopted by the business system.

[0065] Collect state information, resource information, vulnerability information, etc. in the network through the intelligent sensing agent, construct the collected data into the global security state matrices τ and τ', and generate a complete defense graph DG based on the matrices τ and τ'.

[0066] Each element of is composed of the matrix and the maintenance cost of the defense strategy, the loss caused by data loss, and the recovery cost of the network information system, etc. The composition of

[0067] is similar, and is composed of the matrix and and the consumption of operation resources and configuration resources of the business system, etc. , has h rows and m columns, . Each element in and is supplemented by the minimum value of

[0068] Furthermore, each strategy may be completely effective, partially effective, or even ineffective for one or more attack actions, and can be described as the following matrix: .

[0069] In this matrix, if the element is equal to 1, then strategy j is completely effective for preventing the attacker's action k; if the element is equal to 0, then the positive effect of strategy j on action k is zero, and it cannot be considered an effective strategy for defending against the attacker's action i. Therefore, the larger the element , the better the positive effect of the strategy.

[0070] The participant strategy space includes a defense strategy set, an attack strategy set, and a business strategy set. The defense strategy set is a combination of security defense strategies and resource management strategies. The attack strategy set contains feasible attack actions against network threats. The business strategy set includes the resource management strategies of the protected object during the defense process.

[0071] Set the defense strategies related to the security defense entities of each group as the defense strategy set. Each participant has a strategy space, which represents all possible strategies that the participant can choose. The strategy set includes feasible defense strategies against various security threats in this network environment, specifically a combination of security defense strategies and network information system resource management strategies. The attack strategy set of the attacker The business strategy set of the business system The defense strategy set can be customized according to different security requirements and network information systems with different characteristics.

[0072] Step S3: The intelligent sensing agent preprocesses and analyzes the attack perception information based on traffic and log analysis, the network entity topology, and the operating status information, locates the game participant group where the attack is located, and inputs the identified attack event into the consensus game model.

[0073] The intelligent sensing agent can identify the system operating status and potential attack behaviors by collecting and analyzing various types of data. Its core goal is to timely locate the attack source and the affiliated game participant group through data analysis, and use the identified attack event as an input to provide a decision-making basis for the consensus game model. First, the intelligent sensing agent collects the attack perception information based on traffic, the attack perception information based on logs, the network entity topology information, and the operating status information, and preprocesses and analyzes them. Through the comprehensive analysis of the data, the intelligent sensing agent identifies the system operating status, determines whether the current system is in a normal operating state or under attack, locates the attack source, combines the network topology information, traces the origin of the attack, and maps it to the corresponding game participant group.

[0074] The identified attack events will be important inputs to the consensus game model, including: attack type (such as DDoS attack, malware propagation, etc.), attack intensity and scope of influence, and the group information where the attack is located. The input data will help the consensus game model dynamically adjust the defense strategy, optimize the resource allocation, and improve the overall security of the system.

[0075] In summary, the process of a perception analysis attack event is as follows: The intelligent perception agent collects and preprocesses traffic, log, topology, and running status data, comprehensively analyzes this data, identifies the system running status and potential attacks, locates the group of game participants where the attack is located, and inputs the identified attack events into the consensus game model to provide decision-making support for it.

[0076] Step S4: Construct the utility function of the consensus game model, and use the defense graph and the attack-defense cost quantification benefit analysis model to calculate the game cost and benefit.

[0077] By analyzing the defense graph and the attack-defense cost quantification benefit model, the cost and benefit in the game process can be calculated, and they can be converted into specific numerical representations, ultimately helping attackers, defenders, and business systems maximize their benefits.

[0078] When constructing the utility function of the consensus game model, first, perform the calculation and analysis of the defense graph. By analyzing the defense graph, the impact of different defense strategies on network security can be evaluated, the network topology structure and its vulnerabilities can be determined, the attack paths and possible propagation methods can be simulated, and the effectiveness of each defense strategy against attacks can be calculated. Second, establish an attack-defense cost quantification benefit analysis model. The attack-defense cost quantification benefit analysis model is used to quantify the costs and benefits of both the attacker and the defender. Through the quantification of costs and benefits, specific numerical bases can be provided for the utility function. Specifically, first define the costs and benefits of attack actions and defense actions, and then construct a cost-benefit matrix to represent the results under different strategy combinations. Third, construct a set of utility functions. The set of utility functions is a matrix that represents the benefits of the attacker, the defender, and the business system when adopting a specific strategy combination. The matrix of the set of utility functions is , respectively representing the benefits of the attacker, the defender, and the business system after the defense system takes a defense action against the attack action of the attacker and the business system takes an action . The goal of the three parties is to maximize their benefits, and the benefits of both the attacker and the defender are represented by the elements in the matrix. The goal of the three parties is to maximize their benefits, and the benefits of both the attacker and the defender are represented by the elements in the matrix. When both the attacker and the defender have 3 actions and the business system has only 1 action, an example of the benefit matrix is:

[0079] .

[0080] represents the reward value of the defense strategy against the attack strategy, expressed as: , where is the approximate strategy optimal value, is the probability distribution of adopting the strategy combination X, which can be obtained from existing empirical values, is the loss function value of the optimal strategy and the currently adopted strategy, - ), + , 1 j , ( , ), is the current utility value of the i-th strategy, is the optimal strategy utility value.

[0081] Calculate the game cost and benefit by using the defense graph and the attack-defense cost quantification benefit analysis model. First, calculate and analyze the defense graph. Based on the topological structure of the defense graph, determine the possible attack paths and defense strategies, conduct simulation tests on each defense strategy, calculate its effectiveness, and then conduct attack-defense cost quantification to obtain the attack-defense cost quantification result. Combine the defense graph analysis result with the attack-defense cost quantification result to obtain the comprehensive benefit matrix.

[0082] Step S5: Quantitatively calculate the optimal cost and benefit of the multi-party consensus game for the attacker, defender, and protected party based on the game cost and benefit to obtain the defense strategy with the minimum cost, and send it to each defense execution intelligent agent in the group for execution.

[0083] Based on the defense graph deduction and attack-defense cost quantification algorithm calculation, conduct quantitative calculation of the optimal cost and benefit of the multi-party consensus game for the attacker, defender, and protected party (business system). The defender and the protected object use the minimum-cost strategy to minimize the attack effect obtained by the attacker to the greatest extent, making it impossible for the attacker to have a better action option, and the defender and the protected party have already adopted the optimal defense action. The defender can not only resist the current attack action of the attacker but also minimize the cost. Specifically, for the three-party game, consider the iterative calculation in two stages: In the first stage, first calculate the game result between the attacker and the defender. After calculating the optimal defense strategy, in the second stage, then conduct game calculation between the strategy of this defense system and the resource management strategy of the protected object. Through multi-round iterative calculation of the loss value in the two stages ,when is the smallest, the corresponding x is the defense strategy that is optimal for both the business operation of the protected system and the defense effect of the defense system.

[0084] Preferably, the consensus rules and the defense strategy set can be customized according to different security requirements and different characteristics of network information systems.

[0085] The steps for each defense execution intelligent agent to execute the defense strategy with the minimum cost include:

[0086] Each defense execution intelligent agent, based on the minimum-cost defense strategy, automatically orchestrates the defense chain and generates device-level control instructions, dynamically adjusting the security resource allocation, routing strategy, and operating status of the protected object;

[0087] The attack and defense trend prediction algorithm is run through the trend prediction agent to anticipate the attacker's next actions and generate a set of preset defense strategies;

[0088] The historical attack and defense data is analyzed through multi-dimensional review and analysis by the trend intelligent prediction and evaluation agent to identify optimization points in the defense system, and the feedback results are input into the consensus game model to trigger the next round of defense graph construction and game calculation.

[0089] Each defense execution intelligent agent automatically completes the construction of the defense chain according to the received minimum-cost defense strategy. First, it analyzes the current network environment and threat situation, reasonably allocates the tasks of each node according to the defense strategy, and ensures the coherence and effectiveness of the defense chain. Then, the protected object reallocates firewall rules, intrusion detection system configurations, etc. according to the defense strategy, optimizes the traffic path, avoids potential attack paths, adjusts service availability, or closes high-risk ports and services. Finally, the abstract defense strategy is concretized into executable device-level control instructions.

[0090] Combined with the attack and defense trend prediction algorithm, historical data and current threat intelligence are analyzed to anticipate the attacker's possible next actions. For example, if the attacker has tried to penetrate a certain service, they may try to move laterally next. If a large number of scanning behaviors are detected, there may be a targeted attack next. According to the prediction results, a set of preset defense strategies is generated, and relevant measures are deployed in advance. Each time the consensus game equilibrium is reached, it ensures that the defense side and the protected side gain an advantage and effectively reduces the attack success rate.

[0091] The entire attack and defense process is reviewed by the trend intelligent prediction and evaluation agent to analyze: identify the attacker's main penetration paths, discover weak links in the defense system, and evaluate whether the allocation of security resources is reasonable. The review results are fed back to the consensus game model to trigger the next round of defense graph construction and game calculation. The defense system and the protected system re-enter the attack and defense preparation stage based on the updated game model, forming a closed-loop optimization.

[0092] Each defense execution intelligent agent can efficiently cooperate to execute the minimum-cost defense strategy, and at the same time, combined with attack trend prediction and defense review and evaluation, continuously optimize the defense system. This mechanism can not only resist current attacks but also improve the overall defense ability through continuous improvement, ensuring an advantageous position in network attack and defense at all times.

[0093] The multi-agent network security defense method also includes:

[0094] Establish a hierarchical and regional distributed defense system architecture, dividing the security domain into intelligent agents on the endpoint side and intelligent agents on the central side. Among them, the intelligent agents on the endpoint side are responsible for status perception and defense execution, and the intelligent agents on the central side are responsible for game decision-making and attack prediction.

[0095] The network security defense system is divided into a distributed system deployed in a hierarchical and regional manner. Each region is further subdivided into an endpoint side and a central side. The endpoint side mainly refers to various network security devices or software, which are responsible for specific security perception and execution tasks. The central side, as the core for centralized control and management of various security devices, includes functional modules of the security management system. By dividing the system into an endpoint side and a central side, an efficient division of labor for perception, decision-making, and collaborative execution is achieved, thereby enhancing the overall defense capability.

[0096] The intelligent agents on the endpoint side are deployed on various network security devices, and their core responsibilities include: 1. Status perception, real-time monitoring of threat information, traffic anomalies, attack behaviors, etc. in the network environment, and generating perception data; 2. Defense execution, executing specific defense actions according to the received policy information; 3. Information transmission, transmitting various status information (such as device operation status, threat perception results, etc.) to the perception intelligent agents on the central side, forming a closed-loop feedback mechanism. The intelligent agents on the endpoint side work directly in coordination with various security devices and their built-in management agents to ensure that defense policies can be quickly implemented.

[0097] As part of the security management center, the intelligent agents on the central side undertake analysis and decision-making tasks, including: 1. Game decision-making analysis, based on the consensus game model, analyzing the optimal defense strategy in the current network environment, dynamically adjusting the allocation of defense resources, and ensuring the minimization of defense costs while maximizing the protection effect; 2. Attack trend prediction, combining attack and defense trend prediction algorithms, predicting the next actions of attackers, and generating a set of pre-set defense strategies in advance; 3. Policy distribution, converting the formulated defense policies into device-level control instructions and sending them to the intelligent agents on the endpoint side to achieve unified coordination of defense measures across the entire network. The intelligent agents on the central side continuously optimize the defense system by comprehensively analyzing the status information uploaded by the endpoint side, forming an accurate defense capability from a global perspective.

[0098] To achieve efficient coordination between the endpoint side and the central side, the following are adopted: First, the intelligent agents on the endpoint side transmit perception data to the central side, and the intelligent agents on the central side distribute policy instructions to the endpoint side, forming a two-way information flow; Second, according to the real-time threat situation, the intelligent agents on the endpoint side can actively request additional resources or adjust the defense priority, while the intelligent agents on the central side are responsible for the overall allocation of global resources; Third, through the trend intelligent prediction and evaluation agent, a review and analysis of historical attack and defense data are carried out to identify weak links in the defense system, and optimization suggestions are fed back to the consensus game model to trigger a new round of defense strategy calculation.

[0099] By dividing the network security defense system into the endpoint side and the central side, and combining the multi-agent framework and the consensus game model, a hierarchical and regional distributed defense system architecture is constructed. This architecture can not only achieve state awareness and defense execution on the endpoint side, but also rely on the game decision-making and attack prediction capabilities of the central side to form an all-round and multi-level collaborative defense system to effectively cope with complex and changeable network security threats.

[0100] Figure 2 FIG. shows the architecture diagram of the network security defense system proposed in the embodiment of the present application. The intelligent defense execution agent is responsible for executing defense actions, interacting with the attack and defense trend prediction and evaluation agent, and receiving attack intention information. The intelligent game decision-making agent (attack and defense game model based on consensus game) makes decisions based on the consensus game theory to guide the execution of defense actions. The defense graph generation agent generates a defense graph according to the information of the attack perception agent and the situation awareness intelligent agent. The attack intelligent perception agent and the situation awareness intelligent agent are respectively responsible for attack perception and situation awareness, providing real-time attack information and system status information. Modules such as resource collection, vulnerability scanning, and anomaly detection are responsible for collecting system resource information, scanning system vulnerabilities, and detecting abnormal behaviors. The data collection intelligent agent is responsible for data collection work, providing data support for other agents. The attack and defense knowledge base stores attack and defense-related knowledge and rules, including cost-benefit quantification knowledge. Consensus game rules: Provide adjustable consensus game rules to adapt to different defense requirements.

[0101] Compared with the prior art, the embodiment of the present application has the following beneficial effects:

[0102] First, a strategy decision analysis mechanism based on the consensus game model is proposed, which can accurately describe the complex competition and cooperation relationships among the attacker, the defender, and the protected object with a unified game model. At the same time, a multi-agent cooperation framework is introduced, and combined with the security attribute state method, an intelligent defense system design method is formed. This method can adjust the defense strategy in real time according to the current network security state, actively and dynamically carry out defense, and greatly improve the dynamic adaptability of the system.

[0103] Second, through the method of group division, the defense objects are classified and managed, and personalized defense strategies are implemented for different types of defense objects. Based on the multi-agent framework, unified scheduling and encapsulation of network security perception agents, decision-making agents, defense tool agents, and prediction and evaluation agents are realized, ensuring real-time linkage between each functional module. This method not only improves the accuracy of defense, but also can quantitatively analyze and control the impact on the protected object, reducing the false alarm rate and missed alarm rate.

[0104] Third, the quantity and value of the key components of the consensus rules and reward functions can be flexibly formulated according to the actual situation, which endows the system with high scalability and adaptability. The system can be customized for different application scenarios to meet diverse requirements, such as the different security requirements for enterprise-level networks, industrial control systems, or Internet of Things environments.

[0105] Fourth, by introducing a predictive evaluation agent, the system can anticipate the attacker's next move in advance and generate a set of preset defense strategies. The system can not only respond passively to the attacks that have occurred but also actively detect potential threats and take timely measures, thereby reducing the probability of successful attacks.

[0106] Fifth, through the multi-agent collaboration framework, real-time linkage among functional modules such as network security perception, decision-making, defense, and predictive evaluation is achieved. Through information interaction and unified scheduling among agents, an efficient collaborative defense system is formed, significantly enhancing the overall defense effectiveness.

[0107] The following presents a possible implementation of a multi-agent network security defense system based on consensus games, which is used to execute each execution step and corresponding technical effects of the multi-agent network security defense method shown in the above embodiments and possible implementations. The system includes:

[0108] A model establishment module for establishing a consensus game model;

[0109] An initialization module for initializing consensus, game participants, groups participating in the game, and network status and establishing a participant strategy space;

[0110] A preprocessing and analysis module for preprocessing and analyzing attack perception information, network entity topology, and operating status information based on traffic and log analysis through intelligent sensing agents, locating the group of game participants where the attack is located, and inputting the identified attack events into the consensus game model;

[0111] A calculation module for calculating game cost-benefits using a defense graph and an attack-defense cost quantification benefit analysis model;

[0112] A quantification calculation module for quantitatively calculating the optimal cost-benefits of the multi-party consensus game for the attacker, defender, and protected party based on the game cost-benefits to obtain a defense strategy with the minimum cost and sending it to each defense execution intelligent agent in the group for execution.

[0113] An adjustment sub-module for each defense execution intelligent agent to automatically orchestrate a defense chain and generate device-level control instructions based on the defense strategy with the minimum cost, and dynamically adjust the security resource allocation, routing strategy, and operating status of the protected object;

[0114] A generation sub-module, configured to run an attack and defense trend prediction algorithm through a trend prediction agent, predict the actions of attackers in the next stage, and generate a preset defense strategy set;

[0115] A review and analysis sub-module, configured to perform multi-dimensional review and analysis on historical attack and defense data by a trend intelligent prediction and evaluation agent, identify optimization points of the defense system, and input the feedback results into the consensus game model to trigger the next round of defense graph construction and game calculation.

[0116] The above are only the preferred embodiments of the present application and are not intended to limit the present application. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principle of the present application shall be included in the protection scope of the present application.

Claims

1. A multi-agent network security defense method based on consensus game, characterized by: The method comprises: Establish a consensus game model; Initialize consensus, game participants, game groups, and network status, and establish participant strategy space; The intelligent perception agent pre-processes and analyzes attack perception information based on traffic and log analysis, network entity topology and operation status information, locates the game participant group where the attack occurs, and inputs the identified attack events into the consensus game model; Construct a utility function for the consensus game model and calculate the cost-benefit of the game using a defense graph and an attack-defense cost-benefit quantification analysis model; Based on the cost-benefit of the game, the optimal cost-benefit of the attacker, defender, and protected party in the multi-party consensus game is quantified to obtain the minimum cost defense strategy, which is then sent to the group's defense execution intelligent agents for execution.

2. The multi-agent network security defense method according to claim 1, characterized in that: Each defense execution intelligent agent executes the steps of the minimum cost defense strategy, including: Each defense execution intelligent agent automatically orchestrates the defense chain and generates device-level control instructions based on the minimum cost defense strategy, dynamically adjusting the security resource allocation, routing strategy and operating status of the protected object; The trend prediction agent runs the attack and defense trend prediction algorithm to predict the attacker's next stage of action and generate a preset defense strategy set; The trend intelligent prediction and evaluation agent conducts a multi-dimensional review and analysis of historical attack and defense data, identifies optimization points of the defense system, and inputs the feedback results into the consensus game model to trigger the next round of defense map construction and game calculation.

3. The multi-agent network security defense method according to claim 1, characterized in that: Consensus game model is defined as: ,in For consensus, is the set of all game participants, for A group division of For each participant, Indicates the The strategy space of each participant, Indicated by consensus The rules determine the The payoff function of each participant.

4. The multi-agent network security defense method according to claim 1, characterized in that: The participant policy space includes a defense policy set, an attack policy set, and a business policy set. The defense policy set is a collection of security defense policies and resource management policies. The attack policy set contains feasible attack actions against network threats. The business policy set includes the resource management policies of the protected objects during the defense process.

5. The multi-agent network security defense method according to claim 1, characterized in that: The steps to initialize consensus, game participants, groups participating in the game, and network status include: Initialize consensus: Establish an attack and defense knowledge base and a consensus on rules to be followed by the attacker, defender, and protected object, and input them into the consensus game model and profit function; Initialize the game participants: Based on the actual scale and category of the network, perform granular abstraction on the entities in it to form a set of game participants; Initialize the group participating in the game: Generate a set of participants based on the network entity type and granularity abstraction; Initialize network status: Build a defense map using information collected by the intelligent perception agent , is the set of nodes of the defense graph, Represents the network state transition relationship, represents the initial state set of the network, represents the attacker’s target state set, is the attacker’s strategy set, is the defender's strategy set, It is a collection of management strategies for business information systems.

6. The multi-agent network security defense method according to claim 5, characterized in that: The steps to construct a defense map using information collected by the intelligent perception agent include: Collect network status information, resource information, and vulnerability information through intelligent perception agents; Construct the state information, resource information, and vulnerability information in the network into a global security state matrix and ; Based on the global security status matrix and Generate a defense map.

7. The multi-agent network security defense method according to claim 1, characterized in that: The method further comprises: Establish a hierarchical and regional distributed defense system architecture, and divide the security domain into endpoint-side intelligent agents and center-side intelligent agents. The endpoint-side intelligent agents are responsible for state perception and defense execution, while the center-side intelligent agents are responsible for game decision-making and attack prediction.

8. A multi-agent network security defense system based on consensus game, characterized by: The system comprises: Model building module, used to build consensus game models; The initialization module is used to initialize consensus, game participants, groups participating in the game, and network status and establish the participant strategy space; The preprocessing and analysis module is used to preprocess and analyze the attack perception information based on traffic and log analysis, network entity topology and operation status information through the intelligent perception agent, locate the game participant group where the attack is located, and input the identified attack events into the consensus game model; The calculation module is used to construct the utility function of the consensus game model and calculate the game cost and benefit using the defense graph and the attack and defense cost quantification benefit analysis model; The quantitative calculation module is used to quantify the optimal cost-benefit of the attacker, defender, and protected party in the multi-party consensus game based on the game cost-benefit to obtain the minimum cost defense strategy and send it to the group's defense execution intelligent agents for execution.

9. The multi-agent network security defense system according to claim 8, characterized in that: The quantitative calculation module also includes: The adjustment submodule is used by each defense execution intelligent agent to automatically orchestrate the defense chain and generate device-level control instructions based on the minimum cost defense strategy, dynamically adjusting the security resource allocation, routing strategy and operating status of the protected object; The generation submodule is used to run the attack and defense trend prediction algorithm through the trend prediction agent, predict the attacker's next stage of action, and generate a preset defense strategy set; The replay analysis submodule is used by the trend intelligent prediction and evaluation agent to conduct multi-dimensional replay analysis of historical attack and defense data, identify optimization points of the defense system, and input the feedback results into the consensus game model to trigger the next round of defense map construction and game calculation.

Images