Self-adaptive vulnerability protection method, device and equipment based on dynamic game

Abstract

The invention discloses an adaptive vulnerability protection method, device and equipment based on a dynamic game, relates to the technical field of network security protection, and aims to solve the problem of poor protection efficiency for network attacks changing in real time. The method comprises the following steps: collecting a three-dimensional feature set of network traffic through a distributed probe cluster, wherein the three-dimensional feature set comprises a protocol stack level feature, a session time sequence feature and a protocol state machine transfer feature; inputting the three-dimensional feature set into a detection engine integrated with a generative adversarial network and a transfer learning module, and outputting a dynamically weighted target anomaly score; generating an initial protection strategy based on the game tree model and the target anomaly score, wherein the initial protection strategy comprises a dynamic firewall rule, a detection sensitivity parameter and a decoy node topology configuration; and analyzing the space-time correlation characteristics of the initial protection strategy through the space-time attention network, iteratively optimizing the parameters of the initial protection strategy in combination with an incremental learning mechanism, and generating a target protection strategy.

Description

Technical Field

[0001] The present application relates to the field of network security protection technology, and in particular to a method, device and equipment for adaptive vulnerability protection based on dynamic game. Background Art

[0002] Digital development has brought severe challenges to network security, such as the diversification of attack methods and the rapid iteration of strategies.

[0003] Currently, most network security protection relies on traditional static defenses. For example, they rely on signature databases to detect known threats, failing to identify new attacks; or they employ static firewall rules, which lack flexibility. Traditional static defenses rely on pre-set rules and struggle to respond to unknown attacks. While dynamic protection technologies have been introduced, they still suffer from response delays and insufficient adaptability, limiting their effectiveness, particularly in scenarios like zero-day attacks.

[0004] Therefore, there is an urgent need to design a solution that can protect network security attacks in real time to solve the problem of poor protection efficiency of the target against real-time changing network attacks. Summary of the Invention

[0005] The purpose of this application is to provide a dynamic game-based adaptive vulnerability protection method, device and equipment, aiming to solve the problem of poor protection efficiency against real-time changing network attacks.

[0006] To achieve the above objectives, this application adopts the following technical solutions: The present application provides an adaptive vulnerability protection method based on dynamic game, which includes: collecting a three-dimensional feature set of network traffic through a distributed probe cluster, the three-dimensional feature set including protocol stack hierarchical features, session timing features and protocol state machine transition features; inputting the three-dimensional feature set into a detection engine integrated with a generative adversarial network and a transfer learning module, outputting a dynamically weighted target anomaly score, the generative adversarial network is used for protocol feature reconstruction difference detection, and the transfer learning module is used for cross-domain attack feature alignment; generating an initial protection strategy based on a game tree model and a target anomaly score, the game tree model is configured with an attack path prediction module and a defense benefit evaluation module, the initial protection strategy including dynamic firewall rules, detection sensitivity parameters and decoy node topology configuration; parsing the spatiotemporal correlation features of the initial protection strategy through a spatiotemporal attention network, iteratively optimizing the parameters of the initial protection strategy in combination with an incremental learning mechanism, and generating a target protection strategy.

[0007] The adaptive vulnerability protection method based on dynamic game provided in the embodiment of the present application collects a three-dimensional feature set of protocol stack hierarchy, session timing and protocol state machine transition through a distributed probe cluster, thereby improving the comprehensiveness of attack detection coverage; and uses a generative adversarial network to reconstruct protocol features to capture unknown attack patterns, and uses a transfer learning module to reduce the risk of misjudgment through cross-domain feature alignment; further, on the basis of a dynamic weighted scoring mechanism, combined with the adversarial deduction of the attack path prediction module and the defense benefit evaluation module in the game tree model, an initial protection strategy of linked dynamic firewall rules, detection sensitivity and decoy node topology configuration is generated, thereby realizing dynamic allocation of defense resources on demand; finally, the spatiotemporal correlation characteristics of the initial strategy parameters are analyzed through a spatiotemporal attention network, and an incremental learning mechanism is superimposed to realize online iterative optimization of the protection strategy, dynamically adapting to changes in the network environment and the evolution of attack patterns, thereby improving the dynamic response efficiency and overall energy efficiency of real-time network protection.

[0008] In some embodiments, the above-mentioned three-dimensional feature set is input into a detection engine that integrates a generative adversarial network and a transfer learning module, and outputs a dynamically weighted target anomaly score, including: reconstructing protocol features through a decoder of the generative adversarial network to calculate the protocol level anomaly score; calculating the session timing distribution anomaly score through the maximum mean difference metric of the transfer learning module; and dynamically adjusting the fusion weight coefficient of the protocol level anomaly score and the session timing distribution anomaly score according to the proportion of encryption protocols in real-time traffic.

[0009] Based on this, this application achieves accurate quantitative scoring of protocol tampering and timing anomalies by generating cross-domain distribution comparisons of protocol features reconstructed by adversarial networks and transfer learning; dynamically adjusts the weight coefficient based on the proportion of encryption protocols to enhance the detection model's adaptability to traffic encryption scenarios and effectively reduce the missed detection rate of covert attacks.

[0010] In some embodiments, the adaptive vulnerability protection method based on dynamic game provided by the present application also includes: constructing an attacker's profit function, the attacker's profit function includes the vulnerability exploitation time cost and the attack payload concealment score; constructing a defender's profit function, the defender's profit function includes the rule set coverage and the policy switching delay penalty factor; setting node expansion constraints including the maximum defense decision delay threshold and the minimum policy effective interval; generating a game tree model based on the attacker's profit function, the defender's profit function and the constraints.

[0011] Based on this, this application establishes a quantitative model of attack and defense behavior by quantifying the time cost and concealment of the attacker, and the benefit function of the defender's rule coverage and switching delay; combined with the decision delay threshold and effective interval constraints, it optimizes the game tree node expansion efficiency, avoids strategy shocks, and improves the accuracy and timeliness of dynamic game decisions.

[0012] In some embodiments, the above-mentioned spatiotemporal correlation features of the initial protection strategy are parsed through the spatiotemporal attention network, including: constructing a three-dimensional tensor containing the strategy type, time window number, and network area identification; extracting the cross-dimensional correlation features of the three-dimensional tensor through a multi-head attention mechanism to generate a strategy feature matrix with spatiotemporal encoding; using a sliding time window to detect the evolution trend of the strategy feature matrix and identify the temporal dependency between strategy parameters.

[0013] Based on this, this application constructs a spatiotemporal dimension mapping of strategy parameters through a three-dimensional tensor, and uses a multi-head attention mechanism to capture the implicit correlation between strategy types, time windows and network regions; combined with a sliding time window to detect the evolution law of the strategy matrix, it enhances the defense strategy's ability to track network topology changes and attack stage migration.

[0014] In some embodiments, the above-mentioned combination of incremental learning mechanism iteratively optimizes the parameters of the initial protection strategy to generate a target protection strategy, including: when the similarity of the strategy feature matrix of multiple consecutive time windows is less than the preset similarity, migrating the historical strategy decision model through knowledge distillation technology; incrementally learning the mutated network attack based on the migrated historical strategy decision model to generate a target protection strategy.

[0015] Based on this, this application triggers knowledge distillation migration through the strategy feature similarity threshold to retain the effective decision-making model of historical defense strategies; combines incremental learning with continuous adaptation to variant attack samples to solve the catastrophic forgetting problem of traditional models and achieve progressive optimization of protection strategies in adversarial environments.

[0016] In some embodiments, the adaptive vulnerability protection method based on dynamic game provided by the present application also includes: when an attack feature that does not hit the local policy library is detected, the cloud matching degree of the protection strategy in the cloud policy library is calculated, and the cloud matching degree includes the feature coverage overlap rate and the decision path similarity; when the cloud matching degree is greater than the matching degree of the target protection strategy, the target protection strategy is replaced with the protection strategy with the largest cloud matching degree.

[0017] Based on this, this application establishes a local and cloud defense knowledge collaboration mechanism by matching the feature coverage overlap rate of the cloud policy library with the decision path similarity; dynamically switches the optimal cloud strategy when detecting unknown attacks, breaking through the knowledge limitations of single-point defense and improving the emergency response speed to zero-day vulnerability attacks.

[0018] In some embodiments, the adaptive vulnerability protection method based on dynamic game provided in the present application also includes: executing policy rollback when any of the following items is met; the false alarm rate per unit time is greater than or equal to the preset false alarm rate, the number of compliance check failures of key business traffic is greater than or equal to the preset number, and the attack feature detection rate is less than or equal to the preset detection rate.

[0019] Based on this, this application constructs policy rollback trigger conditions through false alarm rate, compliance verification failure number and detection rate thresholds, and quickly restores to a stable policy version when defense effectiveness decreases; avoids the continued spread of erroneous policies, ensures the continuity of critical business traffic, and maintains the robustness of the protection system.

[0020] The present application provides an adaptive vulnerability protection device based on dynamic game, which includes: a collection unit, which is used to collect a three-dimensional feature set of network traffic through a distributed probe cluster, and the three-dimensional feature set includes protocol stack layer features, session timing features and protocol state machine transition features; a processing unit, which is used to input the three-dimensional feature set into a detection engine integrated with a generative adversarial network and a transfer learning module, and output a dynamically weighted target anomaly score, the generative adversarial network is used for protocol feature reconstruction difference detection, and the transfer learning module is used for cross-domain attack feature alignment; a generation unit, which is used to generate an initial protection strategy based on a game tree model and the target anomaly score, the game tree model is configured with an attack path prediction module and a defense benefit evaluation module, and the initial protection strategy includes dynamic firewall rules, detection sensitivity parameters and decoy node topology configuration; the generation unit is also used to parse the spatiotemporal correlation features of the initial protection strategy through a spatiotemporal attention network, iteratively optimize the parameters of the initial protection strategy in combination with an incremental learning mechanism, and generate a target protection strategy.

[0021] In some embodiments, the above-mentioned processing unit is specifically used to: reconstruct protocol features through the decoder of the generative adversarial network and calculate the protocol level anomaly score; calculate the session timing distribution anomaly score through the maximum mean difference metric of the transfer learning module; and dynamically adjust the fusion weight coefficient of the protocol level anomaly score and the session timing distribution anomaly score according to the proportion of encryption protocols in real-time traffic.

[0022] In some embodiments, the above-mentioned generation unit is also used to: construct an attacker's benefit function, which includes the vulnerability exploitation time cost and the attack payload concealment score; construct a defender's benefit function, which includes the rule set coverage and the policy switching delay penalty factor; set node expansion constraints including the maximum defense decision delay threshold and the minimum policy effectiveness interval; generate a game tree model based on the attacker's benefit function, the defender's benefit function and the constraints.

[0023] In some embodiments, the above-mentioned generation unit is specifically used to: construct a three-dimensional tensor containing strategy type, time window number, and network area identification; extract cross-dimensional correlation features of the three-dimensional tensor through a multi-head attention mechanism to generate a strategy feature matrix with spatiotemporal encoding; use a sliding time window to detect the evolution trend of the strategy feature matrix and identify the temporal dependency between strategy parameters.

[0024] In some embodiments, the above-mentioned generation unit is specifically used to: migrate the historical strategy decision model through knowledge distillation technology when the similarity of the strategy feature matrix of multiple consecutive time windows is less than the preset similarity; perform incremental learning on the mutated network attack based on the migrated historical strategy decision model to generate a target protection strategy.

[0025] In some embodiments, the above-mentioned processing unit is also used to: when an attack feature that does not hit the local policy library is detected, calculate the cloud matching degree of the protection strategy in the cloud policy library, and the cloud matching degree includes the feature coverage overlap rate and the decision path similarity; when the cloud matching degree is greater than the matching degree of the target protection strategy, replace the target protection strategy with the protection strategy with the largest cloud matching degree.

[0026] In some embodiments, the above-mentioned processing unit is also used to: execute policy rollback when any of the following items is met: the false alarm rate per unit time is greater than or equal to the preset false alarm rate, the number of compliance check failures of key business traffic is greater than or equal to the preset number, and the attack feature detection rate is less than or equal to the preset detection rate.

[0027] The present application provides an electronic device, comprising: a processor; a memory for storing processor-executable instructions; wherein the processor is configured to execute instructions to implement the above-described adaptive vulnerability protection method based on dynamic game.

[0028] The present application provides a computer-readable storage medium, which stores instructions. When the instructions are executed on a terminal, the terminal executes the adaptive vulnerability protection method based on dynamic game described above.

[0029] The present application provides a computer program product comprising instructions, which, when executed by a computer, enables the computer to execute the above-described adaptive vulnerability protection method based on dynamic game.

[0030] The present application provides a chip, which includes a processor and a communication interface. The communication interface and the processor are coupled, and the processor is used to run computer programs or instructions to implement the above-described adaptive vulnerability protection method based on dynamic game.

[0031] Specifically, the chip provided in the embodiment of the present application also includes a memory for storing computer programs or instructions. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0033] Figure 1 A flowchart of a method for adaptive vulnerability protection based on dynamic game provided in an embodiment of the present application; Figure 2 A training flow chart of a game tree model provided in an embodiment of the present application; Figure 3 A structural diagram of an adaptive vulnerability protection device based on dynamic game provided in an embodiment of the present application; Figure 4 A structural diagram of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0034] The following will be combined with the drawings in the embodiments of this application to clearly and completely describe the technical solutions in the embodiments of this application. Obviously, the embodiments described are only part of the embodiments of this application, not all of the embodiments. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of this application.

[0035] In the description of this application, it should be understood that the terms "upper," "lower," "left," "right," "front," "back," "inner," "outer," and the like, indicating directions or positional relationships, are based on the directions or relative positional relationships shown in the accompanying drawings and are intended solely to facilitate the description of this application and simplify the description. They do not indicate or imply that the devices or components referred to must have a specific direction, be constructed, or operate in a specific direction. Therefore, they should not be construed as limitations on this application. Unless otherwise specified, the above-mentioned directionality descriptions may be flexibly set in actual application, provided that the relative positional relationships shown in the accompanying drawings are met.

[0036] The terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of the technical features being referred to. Thus, a feature specified as "first" or "second" may explicitly or implicitly include one or more of such features. Throughout this application, unless otherwise specified, "plurality" means two or more.

[0037] In the description of this application, it should be noted that, unless otherwise expressly specified or limited, the terms "mounted," "connected," "connected," and "connected" should be understood broadly. For example, they may refer to fixed connections, detachable connections, or integral connections. They may be directly connected, indirectly connected through an intermediary, or internally connected between two components. Those skilled in the art will understand the specific meanings of these terms in this application based on the specific circumstances.

[0038] In some embodiments, the terms "comprises," "comprising," or any other variations thereof are intended to encompass non-exclusive inclusion, such that a process, article, or apparatus that includes a list of elements includes not only those elements but also other elements not explicitly listed, or elements inherent to such process, article, or apparatus. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not preclude the presence of additional identical elements in the process, article, or apparatus that includes the element.

[0039] In some embodiments, words such as "exemplary" or "for example" are used to indicate an example, illustration, or description. Any embodiment or design described as "exemplary" or "for example" in the embodiments of this application should not be construed as being preferred or advantageous over other embodiments or designs. Rather, the use of words such as "exemplary" or "for example" is intended to present the relevant concepts in a concrete manner.

[0040] In the description of this specification, specific features, structures, materials or characteristics may be combined in an appropriate manner in any one or more embodiments or examples.

[0041] Amidst increasingly severe cyberattacks, the limitations of traditional static protection strategies are becoming increasingly prominent. Existing security systems primarily rely on predefined security rules and signature libraries to identify known threats. This passive response model suffers from the following three core flaws: 1. Lagging defense against new attacks: When faced with unknown attack methods such as zero-day vulnerability exploits and advanced persistent threats, traditional rule engines are unable to intercept them in time due to a lack of prior knowledge, resulting in a longer attack window.

[0042] 2. Strategy rigidity and lack of adaptability: Static rule configuration cannot dynamically adjust defense parameters (such as firewall rules and intrusion detection thresholds) based on attack trends. In scenarios where attack methods evolve rapidly, defense effectiveness is significantly reduced.

[0043] 3. Inefficient resource allocation: Fixed strategies make it difficult to optimize defense resource investment, which can easily lead to conflicts between over-defense (affecting normal business) and under-defense (vulnerabilities being exploited).

[0044] Therefore, existing network security protection solutions have poor protection effectiveness when facing real-time changing network attacks.

[0045] In this context, to address the problem of poor protection against real-time network attacks in related technologies, this application provides an adaptive vulnerability protection method, device, and equipment based on dynamic game theory. By introducing a dynamic attack and defense game model, the network attack and defense process is transformed into a quantifiable decision-making process, breaking through the passivity of static protection strategies and providing a new technical path for network security protection.

[0046] Refer to the following Figure 1 and Figure 2 The adaptive vulnerability protection method based on dynamic game provided in an embodiment of the present application is described.

[0047] Figure 1 This is a method flow chart of an adaptive vulnerability protection method based on dynamic game provided in an embodiment of the present application. The subject executing the method can be an electronic device or various devices / modules in an electronic device, such as an integrated circuit or chip, and the embodiment of the present application does not make specific limitations on this.

[0048] For example, Figure 1 As shown, the adaptive vulnerability protection method based on dynamic game provided in the embodiment of the present application may include the following S101 to S104: S101. Collect a three-dimensional feature set of network traffic through a distributed probe cluster.

[0049] Among them, the three-dimensional feature set includes protocol stack layer features, session timing features and protocol state machine transition features.

[0050] In the embodiment of the present application, by building a multi-level, distributed network traffic feature collection system, three-dimensional capture of attack features is achieved through deep analysis of the protocol stack, timing behavior modeling and dynamic monitoring of the state machine.

[0051] In some embodiments, the distributed probe cluster may include core layer probes, edge layer probes, and cloud layer probes.

[0052] For example, core layer probes can be deployed on core switches in data centers, responsible for network-wide traffic mirroring and protocol stack metadata extraction. Edge layer probes can be deployed on branch office gateways to collect regional traffic and perform lightweight timing analysis. Cloud-based probes can run on virtualized platforms, integrating multi-source data and building global state machine models.

[0053] It should be noted that metadata can be transmitted between probes using an encrypted channel based on transport layer security (TLS) 1.3, and load balancing can be achieved through a consistent hashing algorithm.

[0054] In some embodiments, the above-mentioned protocol stack layer characteristics may include physical layer characteristics, network layer characteristics, transport layer characteristics and application layer characteristics. Physical layer features include: media access control (MAC) address hopping frequency and frame length distribution (e.g., unusual jumbo frames with Ethernet frame lengths >1500 bytes). Network layer features include: abnormal Internet Protocol (IP) fragment offsets and sudden changes in time to live (TTL) values (e.g., a TTL change from 64 to 128 within a session). Transport layer features include: abnormal scaling of the Transmission Control Protocol (TCP) window size and User Datagram Protocol (UDP) payload entropy (e.g., detecting encrypted tunnels). Application layer features include: abnormal Hypertext Transfer Protocol (HTTP) header field order (e.g., the Host field position deviates from the standard) and Domain Name System (DNS) query type distribution (e.g., a sudden increase in the proportion of text records).

[0055] In some embodiments, the above-mentioned session timing features may include time series indicator features and traffic behavior pattern features.

[0056] Time series metric features include: session establishment handshake time (e.g., TCP three-way handshake time standard deviation > 200ms), request-response interval periodicity (e.g., Fourier transform detection periodic scanning). Traffic behavior pattern features include: burst duration (e.g., 100Mbps traffic for 10 seconds), and packet size distribution (e.g., small packetization for detecting data exfiltration).

[0057] In some embodiments, the above-mentioned protocol state machine transition features may include a legal state transition library feature and an abnormal jump detection feature.

[0058] The legal state transition library features include: a state transition matrix of a predefined standard protocol. The abnormal jump detection features include: calculating the transition probability based on the hidden Markov model (HMM).

[0059] For example, consider an advanced persistent threat (APT) attack on an e-commerce platform during the holiday season. The attack chain includes initial intrusion, lateral movement, and data exfiltration.

[0060] The initial intrusion exploited an unpatched Confluence vulnerability (CVE-2021-26084) to inject a web backdoor. Lateral movement was achieved through encrypted Internet Control Message Protocol (ICMP) tunnels for command and control (anomalous protocol characteristics). Data exfiltration involved low-frequency data exfiltration disguised as normal image upload traffic (anomalous timing characteristics).

[0061] At this point, the edge probe can capture the expression injection feature in the Confluence request (at the protocol stack level); the core probe detects that the ICMP payload entropy value is greater than 7.5 (normal traffic entropy is 4.2); and the cloud probe finds that the timing pattern of the image upload session deviates from the baseline (relative entropy is greater than 3).

[0062] S102: Input the three-dimensional feature set into a detection engine that integrates a generative adversarial network and a transfer learning module, and output a dynamically weighted target anomaly score.

[0063] In an embodiment of the present application, a generative adversarial network (GAN) is used for protocol feature reconstruction difference detection. The GAN can be a generative adversarial network (GAN). A transfer learning module is used for cross-domain attack feature alignment.

[0064] In some embodiments, the protocol features can be reconstructed by the decoder of the generative adversarial network to calculate the protocol level anomaly score; then, the maximum mean difference metric of the transfer learning module is used to calculate the session timing distribution anomaly score; finally, based on the proportion of encryption protocols in real-time traffic, the fusion weight coefficient of the protocol level anomaly score and the session timing distribution anomaly score is dynamically adjusted.

[0065] For example, a GAN consists of a generator and a discriminator. The generator consists of a bidirectional long short-term memory (LSTM) network (with 256 hidden units) and a fully connected layer. Its input is a normalized agreement feature vector (dimension = 512). The discriminator uses a one-dimensional convolutional layer with an attention mechanism, and its output is the reconstruction confidence. Finally, the reconstruction error is calculated, using the Wasserstein distance to measure the distribution difference between the original and reconstructed features.

[0066] For example, the transfer learning module can first extract attack features from a public dataset and construct a source domain feature space. A domain adversarial neural network is then used to minimize the maximum mean difference between the source and target domains through a gradient reversal layer (GRL). Finally, the projected distance between the source and target domains in the reproducing kernel Hilbert space (RKHS) is calculated to generate a feature alignment metric.

[0067] Furthermore, after calculating the protocol-level anomaly score and session timing distribution anomaly score, weighted adjustments can be made. For example, by fingerprinting the client type, calculating the HTTPS traffic percentage x, and then calculating the protocol-level weight α and session timing distribution weight β using the following formulas (1) and (2), respectively.

[0068] Formula (1) Formula (2) When x is greater than 70% and α is greater than 0.8, the focus is on protocol layer detection; when x is less than 30% and β>0.7, the focus is on timing analysis.

[0069] For example, in conjunction with the e-commerce platform attack in S101 above, after feature collection, GAN reconstruction can be performed. This time, the webpage request parameters show a 28% deviation, with a protocol layer score of 0.91. The transfer learning module also determines that the MMD distance between the ICMP tunnel feature and the known sample is 0.19, with a time series score of 0.87. At this point, if the monitored encrypted traffic accounts for 45%, the dynamic weight α is calculated to be 0.55, and the final target anomaly score is 0.55*0.91 + 0.45*0.87 = 0.892.

[0070] In this way, this application achieves accurate quantitative scoring of protocol tampering and timing anomalies by generating cross-domain distribution comparisons of protocol features reconstructed by adversarial networks and transfer learning; dynamically adjusts the weight coefficient based on the proportion of encryption protocols to enhance the detection model's adaptability to traffic encryption scenarios and effectively reduce the missed detection rate of covert attacks.

[0071] S103. Generate an initial protection strategy based on the game tree model and the target anomaly score.

[0072] Among them, the initial protection strategy includes dynamic firewall rules, detection sensitivity parameters and decoy node topology configuration.

[0073] For example, dynamic firewall rules, as opposed to traditional static firewall rules, can automatically adjust filtering rules based on changes in network traffic, threat intelligence, or security policies. Specifically, dynamic firewalls integrate intrusion detection systems, intrusion prevention systems, and advanced threat protection capabilities to achieve real-time policy updates.

[0074] For example, a detection sensitivity parameter is a threshold used in cybersecurity systems (such as situational awareness platforms) to balance false positives and false negatives. The detection sensitivity parameter determines how rigorously the system identifies anomalous behavior and is typically adjusted dynamically using statistical models (e.g., mean ±2 standard deviations) or machine learning algorithms.

[0075] For example, decoy node topology configuration refers to a defense strategy that deploys honeypots or decoy nodes in the network and optimizes their topology structure to attract attackers, protect real systems, and collect attack intelligence.

[0076] In an embodiment of the present application, the game tree model is configured with an attack path prediction module and a defense benefit evaluation module.

[0077] For example, the attack path prediction module can include two parts: node generation and path weight determination. Node generation involves constructing an attack path tree based on a preset framework, with each node representing an attack phase (e.g., initial access, lateral movement). Path weighting involves dynamically adjusting the probability of path selection based on the target anomaly score (e.g., when the anomaly score is 0.9, the attack path's weight is increased to 0.9).

[0078] For example, the defense effectiveness evaluation module can include two parts: defense nodes and benefit calculation. Each attack node in the defense node corresponds to multiple defense actions (such as blocking, limiting, and trapping). Benefit calculation involves calculating the benefits of the defense action based on rule coverage, false alarm rate, and resource consumption.

[0079] In some embodiments, the attack threat level can be quantified by the target anomaly score, driving the game tree model to conduct multiple rounds of attack and defense deductions to generate a linkage strategy (i.e., an initial protection strategy) that integrates active defense and entrapment methods.

[0080] For example, the target anomaly score can be normalized to the attack probability weight of the game tree node. For example, a score of 0.8 corresponds to an attack path weight of 0.8, and the defense response priority is raised to the highest level. Specifically, the threat level can be divided according to the score.

[0081] For example, low risk (0-0.3): only logging is triggered. Medium risk (0.3-0.7): basic defense rules are activated. High risk (0.7-1.0): full policy linkage (firewall + trapping + sensitivity adjustment) is enabled.

[0082] For example, in combination with the e-commerce platform attack in S102 above, after obtaining the target anomaly score, a strategy can be generated through game tree deduction: blocking the path access to the Confluence service, deploying a fake honeypot in the isolation area, and increasing the XSS detection sensitivity to 0.95.

[0083] S104. Analyze the spatiotemporal correlation features of the initial protection strategy through the spatiotemporal attention network, and iteratively optimize the parameters of the initial protection strategy in combination with the incremental learning mechanism to generate the target protection strategy.

[0084] In some embodiments, the spatiotemporal correlation features of the initial protection policy can be analyzed by first constructing a three-dimensional tensor including the policy type, the time window number, and the network area identifier.

[0085] Dimension 1 (policy type axis) encodes policies such as firewall rules, detection sensitivity, and decoy node configuration into a 128-dimensional vector. Dimension 2 (time window axis) divides the policy's effective period into sliding windows (e.g., 5-minute windows), with each window marked with a timestamp hash value. Dimension 3 (spatial region axis) assigns location codes based on network topology partitions (e.g., an internal office network) to form a spatial coordinate matrix.

[0086] Furthermore, after constructing the three-dimensional tensor, the cross-dimensional correlation features of the three-dimensional tensor can be extracted through the multi-head attention mechanism to generate a strategy feature matrix with spatiotemporal encoding.

[0087] For example, eight attention heads can be used to parallelize the cross-dimensional correlations of a three-dimensional tensor: Head 1 focuses on the correlation between policy type and time window (e.g., "defense rules are activated during peak attack periods"); Head 2 focuses on the correlation between time window and spatial region (e.g., "abnormal login attempts to the internal office network during the midnight period"); and Head 3 analyzes the correlation between policy type and spatial region (e.g., "Application Programming Interface Gateway protection policy specific to the internal office network"). Finally, the output is the projection of the three-dimensional tensor weighted by the attention weights (e.g., compressed to (128, T, S), where T is the number of time windows and S is the number of spatial regions), which is the policy feature matrix.

[0088] Furthermore, a sliding time window is used to detect the evolution trend of the strategy feature matrix and identify the temporal dependency between strategy parameters.

[0089] For example, a dynamic time warping algorithm is used to analyze the temporal patterns of the policy feature matrix and identify dependencies between parameters. For example, if the "detection sensitivity improvement" policy is always triggered 10 time windows after the "honeypot alarm surge," it indicates a causal relationship. In this case, an autoregressive model is used to predict the need for firewall rule updates in the next window and adjust the policy parameters in advance.

[0090] In this way, this application constructs a spatiotemporal dimension mapping of strategy parameters through a three-dimensional tensor, and uses a multi-head attention mechanism to capture the implicit correlation between strategy types, time windows and network regions; combined with a sliding time window to detect the evolution law of the strategy matrix, it enhances the defense strategy's ability to track network topology changes and attack stage migration.

[0091] In some embodiments, after parsing the spatiotemporal correlation features of the initial protection strategy, the historical strategy decision model can be migrated through knowledge distillation technology when the similarity of the strategy feature matrices of multiple consecutive time windows is less than a preset similarity.

[0092] For example, a historical policy decision model (such as an LSTM time series predictor) can be used as a teacher model, and its hidden layer output can be extracted as a soft target. The current policy optimizer can be used as a student model, and the output distribution of the teacher model can be aligned using a relative entropy loss function, while retaining the historical policy decision model.

[0093] Specifically, the teacher model has learned the attack chain pattern of "common program injection after port scanning", and the student model inherits the pattern recognition ability through distillation; the weights of effective parameters in historical strategies (such as "honeypot survival time = 120 seconds") are solidified to prevent incremental learning from overwriting key configurations.

[0094] Furthermore, after model migration, incremental learning of mutated network attacks is performed based on the migrated historical strategy decision model to generate target protection strategies.

[0095] For example, based on the migrated model, an elastic weight consolidation algorithm can be used to incrementally train new attack samples. An adversarial training mechanism is introduced, using GAN to synthesize mutated attack samples and then fusing distilled knowledge with incremental learning results to generate a policy package that includes dynamic threshold adjustment, adaptive honeypot deployment, and micro-segmentation rule updates.

[0096] Specifically, when a new vulnerability exploit is detected, the model automatically increases the detection sensitivity from 0.7 to 0.9 and deploys high-interaction honeypots in the affected area. After the strategy takes effect, it evaluates the defense effect (such as the reduction ratio of the attack surface) through reinforcement learning, and iteratively optimizes the parameters until the target protection strategy is obtained.

[0097] For example, in conjunction with the e-commerce platform attack described in S103 above, after obtaining the initial protection strategy, the spatiotemporal attention network can be used to detect the attacker's shift to the object storage service. The incremental learning module then adds a rule to detect abnormal parameters in the application program interface. The attacker is then lured into a honeypot, and the attacker's fingerprint is obtained through tracing.

[0098] In the adaptive vulnerability protection method based on dynamic game provided in the embodiment of the present application, a distributed probe cluster is used to collect a three-dimensional feature set of protocol stack hierarchy, session timing and protocol state machine transition, thereby improving the comprehensiveness of attack detection coverage; and a generative adversarial network is used to reconstruct the differences in protocol features to capture unknown attack patterns, and a transfer learning module is used to reduce the risk of misjudgment through cross-domain feature alignment; further, on the basis of a dynamic weighted scoring mechanism, combined with the adversarial deduction of the attack path prediction module and the defense benefit evaluation module in the game tree model, an initial protection strategy of linked dynamic firewall rules, detection sensitivity and decoy node topology configuration is generated, thereby realizing dynamic allocation of defense resources on demand; finally, the spatiotemporal correlation characteristics of the initial strategy parameters are analyzed through a spatiotemporal attention network, and an incremental learning mechanism is superimposed to realize online iterative optimization of the protection strategy, dynamically adapting to changes in the network environment and the evolution of attack patterns, thereby improving the dynamic response efficiency and overall energy efficiency of real-time network protection.

[0099] The following describes the process of constructing the game tree model provided in the embodiments of the present application.

[0100] For example, Figure 2 As shown, the construction process of the game tree model may include the following steps: S201. Construct the attacker's profit function.

[0101] Among them, the attacker's profit function includes the time cost of vulnerability exploitation and the attack payload concealment score.

[0102] For example, the vulnerability exploitation time cost C can be calculated using the following formula (3).

[0103] Formula (3) Among them, T1 is the time consumed in the vulnerability scanning phase (such as port scanning duration), T2 is the time consumed in the vulnerability exploitation phase (such as module execution time), and T3 is the time consumed in the backdoor maintenance phase (such as residence time).

[0104] For example, the attack payload concealment score S can be calculated using the following formula (4).

[0105] Formula (4) Among them, W1 is the encryption algorithm weight, S1 is the algorithm strength score, W2 is the anti-detection technology weight, and S2 is the technology avoidance score.

[0106] S202. Construct a profit function for the defender.

[0107] The defender's profit function includes the rule set coverage and the strategy switching delay penalty factor.

[0108] Exemplarily, the rule set coverage R can be calculated using the following formula (5).

[0109] Formula (5) Among them, N1 is the number of attack features successfully intercepted, N2 is the total number of attack features, and W3 is the rule priority weight.

[0110] Exemplarily, the policy switching delay penalty factor P may be calculated using the following formula (VI).

[0111] Formula (6) Among them, T1 is the actual strategy switching time, T2 is the preset maximum tolerance delay, and K is the delay penalty coefficient.

[0112] S203: Set node expansion constraints including a maximum defense decision delay threshold and a minimum policy effective interval.

[0113] In some embodiments, node expansion constraints are used to control the growth scale of the game tree to avoid state space explosion.

[0114] For example, the maximum defense decision delay threshold and the minimum policy effectiveness interval may both be manually set values, which may be flexibly adjusted according to actual scenarios.

[0115] For example, the maximum defense decision delay threshold can be determined as 150ms based on three times the standard deviation of the network round-trip time (RTT); the minimum policy effectiveness interval can be determined as 10s based on the convergence time of the policy deployment system, such as the firewall rule effectiveness interval.

[0116] S204: Generate a game tree model based on the attacker's profit function, the defender's profit function, and the constraints.

[0117] In some embodiments, an attack step can be configured for each attack node according to the attacker's gain function, a protection strategy can be configured for each defense node according to the defender's gain function, and the node configuration can be terminated when the constraint conditions are met to obtain the final game tree model.

[0118] For example, for attacking nodes, the average duration of attack steps can be calculated from historical attack logs to obtain the time cost. The concealment of the attack step payload can then be calculated to obtain a concealment score. For defending nodes, the interception rate of the protection strategy against known attack signatures can be calculated to determine rule coverage. Performance testing can then be used to determine the strategy switching time to obtain a latency penalty factor. Finally, when the node expansion depth exceeds the maximum defense decision delay threshold, the node configuration is terminated, resulting in the final game tree model.

[0119] In this way, this application establishes a quantitative model of attack and defense behavior by quantifying the time cost and concealment of the attacker, and the benefit function of the defender's rule coverage and switching delay; combined with the decision delay threshold and effective interval constraints, it optimizes the game tree node expansion efficiency, avoids strategy shocks, and improves the accuracy and timeliness of dynamic game decisions.

[0120] Optionally, after the target protection strategy is generated, the target protection strategy may be monitored in real time, and updated in a timely manner if the target protection strategy is not applicable.

[0121] In some embodiments, when an attack feature that does not hit the local policy library is detected, the cloud matching degree of the protection policy in the cloud policy library can be calculated, and if the cloud matching degree is greater than the matching degree of the target protection policy, the target protection policy is replaced with the protection policy with the highest cloud matching degree.

[0122] In an embodiment of the present application, a cloud policy library stores a variety of protection strategies corresponding to different network attack modes.

[0123] For example, the local policy library's rule engine can perform pattern matching on network traffic. If no predefined rules are matched, the cloud-based collaborative process is triggered. Specifically, consider an attack payload that exploits the new CVE-2025-XXXX vulnerability. If no matching signature is found in the local rule library (which contains 5,000 rules), the attack payload's hash value is automatically extracted and uploaded to the cloud-based policy library.

[0124] In the embodiment of the present application, the cloud matching degree includes feature coverage overlap rate and decision path similarity.

[0125] For example, the feature coverage overlap rate H can be calculated using formula (VII).

[0126] Formula (7) Among them, F1 is the feature set covered by the local policy (such as port number and protocol type), F2 is the feature set covered by the cloud policy, and F3 is the feature set actually included in the attack payload.

[0127] For example, the decision path similarity I can be calculated using formula (8).

[0128] Formula (8) Where D is the minimum edit distance between the local and cloud policy decision trees, L max is the maximum path length between two decision trees.

[0129] For example, when there is a protection strategy A in the cloud strategy library with a feature coverage overlap rate H greater than 80% and a decision path similarity I greater than 0.5, the protection strategy A is downloaded and the current target protection strategy is replaced with the protection strategy A.

[0130] In this way, this application establishes a local and cloud defense knowledge collaboration mechanism by matching the feature coverage overlap rate of the cloud policy library with the decision path similarity; dynamically switches the optimal cloud strategy when detecting unknown attacks, breaks through the knowledge limitations of single-point defense, and improves the emergency response speed to zero-day vulnerability attacks.

[0131] Furthermore, in order to ensure the stability of network security protection, a rollback operation can also be performed on the currently adopted protection strategy.

[0132] Illustratively, policy rollback may be performed when any one of the following A, B, and C is met.

[0133] A. The false alarm rate per unit time is greater than or equal to the preset false alarm rate.

[0134] For example, the false alarm rate per unit time U can be calculated by the following formula (9).

[0135] Formula (9) Among them, N1 is the number of false alarm events, and N2 is the number of correct interception events.

[0136] B. The number of compliance check failures for critical business traffic is greater than or equal to the preset number.

[0137] For example, protocol format verification may be performed on key service traffic, and the number of times a specific standard (such as RFC) is not met may be recorded.

[0138] C. The attack signature detection rate is less than or equal to the preset detection rate.

[0139] For example, the attack signature detection rate V can be calculated using the following formula (10).

[0140] Formula (10) It should be noted that the above-mentioned preset false alarm rate, preset number of times, and preset detection rate are all manually set values and can be flexibly adjusted according to actual scenarios. For example, the preset false alarm rate can be 5%, the predicted number of times can be 3 times per minute, and the preset detection rate can be 90%.

[0141] In this way, this application constructs policy rollback trigger conditions through false alarm rate, compliance verification failure number and detection rate thresholds, and quickly restores to a stable policy version when defense effectiveness decreases; avoids the continued spread of erroneous policies, ensures the continuity of critical business traffic, and maintains the robustness of the protection system.

[0142] The above mainly introduces the solution provided by the embodiment of the present application from the perspective of the method. In order to achieve the above functions, the adaptive vulnerability protection device or electronic device based on dynamic game includes hardware structures and / or software modules corresponding to the execution of each function. Those skilled in the art should easily realize that, in combination with the units and algorithm steps of each example described in the embodiments disclosed herein, the present application can be implemented in the form of hardware or a combination of hardware and computer software. Whether a function is executed in the form of hardware or computer software driving hardware depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0143] The embodiment of the present application can, according to the above method, exemplarily divide the functional modules of the adaptive vulnerability protection device or electronic device based on dynamic game. For example, the adaptive vulnerability protection device or electronic device based on dynamic game can include various functional modules corresponding to the various functional divisions, or two or more functions can be integrated into one processing module. The above-mentioned integrated modules can be implemented in the form of hardware or in the form of software functional modules. It should be noted that the division of modules in the embodiment of the present application is schematic and is only a logical functional division. There may be other division methods in actual implementation.

[0144] Figure 3 This is a structural diagram of an adaptive vulnerability protection device based on dynamic game provided by an embodiment of the present application. The adaptive vulnerability protection device 300 based on dynamic game includes: a collection unit 301, a processing unit 302 and a generation unit 303.

[0145] Among them: the above-mentioned collection unit 301 is used to collect a three-dimensional feature set of network traffic through a distributed probe cluster, and the three-dimensional feature set includes protocol stack layer features, session timing features and protocol state machine transition features; the processing unit 302 is used to input the three-dimensional feature set into a detection engine integrated with a generative adversarial network and a transfer learning module, and output a dynamically weighted target anomaly score. The generative adversarial network is used for protocol feature reconstruction difference detection, and the transfer learning module is used for cross-domain attack feature alignment; the generation unit 303 is used to generate an initial protection strategy based on a game tree model and the target anomaly score. The game tree model is configured with an attack path prediction module and a defense benefit evaluation module. The initial protection strategy includes dynamic firewall rules, detection sensitivity parameters and decoy node topology configuration; the generation unit 303 is also used to analyze the spatiotemporal correlation features of the initial protection strategy through a spatiotemporal attention network, and iteratively optimize the parameters of the initial protection strategy in combination with an incremental learning mechanism to generate a target protection strategy.

[0146] In some embodiments, the processing unit 302 is specifically used to: reconstruct protocol features through a decoder of a generative adversarial network to calculate a protocol-level anomaly score; calculate a session timing distribution anomaly score through a maximum mean difference metric of a transfer learning module; and dynamically adjust the fusion weight coefficient of the protocol-level anomaly score and the session timing distribution anomaly score based on the proportion of encryption protocols in real-time traffic.

[0147] In some embodiments, the above-mentioned generation unit 303 is also used to: construct an attacker's benefit function, which includes the vulnerability exploitation time cost and the attack payload concealment score; construct a defender's benefit function, which includes the rule set coverage and the policy switching delay penalty factor; set node expansion constraints including the maximum defense decision delay threshold and the minimum policy effective interval; and generate a game tree model based on the attacker's benefit function, the defender's benefit function and the constraints.

[0148] In some embodiments, the above-mentioned generation unit 303 is specifically used to: construct a three-dimensional tensor containing strategy type, time window number, and network area identification; extract cross-dimensional correlation features of the three-dimensional tensor through a multi-head attention mechanism to generate a strategy feature matrix with spatiotemporal encoding; use a sliding time window to detect the evolution trend of the strategy feature matrix and identify the temporal dependency between strategy parameters.

[0149] In some embodiments, the above-mentioned generation unit 303 is specifically used to: when the similarity of the policy feature matrices of multiple consecutive time windows is less than a preset similarity, migrate the historical policy decision model through knowledge distillation technology; perform incremental learning on the mutated network attack based on the migrated historical policy decision model to generate a target protection strategy.

[0150] In some embodiments, the above-mentioned processing unit 302 is also used to: when an attack feature that does not hit the local policy library is detected, calculate the cloud matching degree of the protection strategy in the cloud policy library, and the cloud matching degree includes the feature coverage overlap rate and the decision path similarity; when the cloud matching degree is greater than the matching degree of the target protection strategy, replace the target protection strategy with the protection strategy with the largest cloud matching degree.

[0151] In some embodiments, the above-mentioned processing unit 302 is also used to: execute policy rollback when any of the following items is met: the false alarm rate per unit time is greater than or equal to the preset false alarm rate, the number of compliance check failures of key business traffic is greater than or equal to the preset number, and the attack feature detection rate is less than or equal to the preset detection rate.

[0152] In the adaptive vulnerability protection device based on dynamic game provided in the embodiment of the present application, a distributed probe cluster is used to collect a three-dimensional feature set of protocol stack hierarchy, session timing and protocol state machine transition, thereby improving the comprehensiveness of attack detection coverage; and a generative adversarial network is used to reconstruct the differences in protocol features to capture unknown attack patterns, and a transfer learning module is used to reduce the risk of misjudgment through cross-domain feature alignment; further, on the basis of a dynamic weighted scoring mechanism, combined with the adversarial deduction of the attack path prediction module and the defense benefit evaluation module in the game tree model, an initial protection strategy of linked dynamic firewall rules, detection sensitivity and decoy node topology configuration is generated, thereby realizing dynamic allocation of defense resources on demand; finally, the spatiotemporal correlation characteristics of the initial strategy parameters are analyzed through a spatiotemporal attention network, and an incremental learning mechanism is superimposed to realize online iterative optimization of the protection strategy, dynamically adapting to changes in the network environment and the evolution of attack patterns, thereby improving the dynamic response efficiency and overall energy efficiency of real-time network protection.

[0153] Regarding the apparatus in the above embodiment, the specific manner in which each module performs operations has been described in detail in the embodiment of the method, and will not be elaborated here.

[0154] Figure 4 This is a structural diagram of an electronic device provided in an embodiment of the present application. Figure 4 As shown, the electronic device 400 includes but is not limited to: a processor 401 and a memory 402 .

[0155] The memory 402 is used to store executable instructions of the processor 401. It is understandable that the processor 401 is configured to execute instructions to implement the adaptive vulnerability protection method based on dynamic game in the above embodiment.

[0156] It should be noted that those skilled in the art can understand that Figure 4 The electronic device structure shown in the figure does not limit the electronic device, and the electronic device may include Figure 4 More or fewer components may be shown, or certain components may be combined, or the components may be arranged differently.

[0157] The processor 401 is the control center of the electronic device. It connects the various parts of the entire electronic device using various interfaces and lines. By running or executing software programs and / or modules stored in the memory 402 and accessing data stored in the memory 402, it performs various functions of the electronic device and processes data, thereby monitoring the electronic device as a whole. The processor 401 may include one or more processing units. Optionally, the processor 401 may integrate an application processor and a modem processor, wherein the application processor mainly processes the operating system, user interface, and application programs, and the modem processor mainly handles wireless communications. It is understood that the modem processor may not be integrated into the processor 401.

[0158] Memory 402 can be used to store software programs and various data. Memory 402 may primarily include a program storage area and a data storage area. The program storage area may store an operating system and application programs required by at least one functional module (such as a determination unit, a processing unit, etc.). Furthermore, memory 402 may include high-speed random access memory and non-volatile memory, such as at least one disk storage device, flash memory device, or other volatile solid-state storage device.

[0159] In an exemplary embodiment, a computer-readable storage medium including instructions is also provided, such as a memory 402 including instructions. The above instructions can be executed by the processor 401 of the electronic device 400 to implement the adaptive vulnerability protection method based on dynamic game in the above embodiment.

[0160] In actual implementation, Figure 3 The steps performed by the acquisition unit 301, the processing unit 302 and the generation unit 303 can all be performed by Figure 4 The processor 401 in the embodiment calls the computer program stored in the memory 402. The specific execution process can be referred to the description of the method part in the above embodiment, which will not be repeated here.

[0161] Optionally, the computer-readable storage medium may be a non-transitory computer-readable storage medium, for example, the non-transitory computer-readable storage medium may be a read-only memory (ROM), a random access memory (RAM), a CD-ROM, a magnetic tape, a floppy disk, an optical data storage device, etc.

[0162] In an exemplary embodiment, the present application also provides a computer program product comprising one or more instructions, which can be executed by the processor 401 of the electronic device to implement the adaptive vulnerability protection method based on dynamic game in the above embodiment.

[0163] It should be noted that when the instructions in the above-mentioned computer-readable storage medium or one or more instructions in the computer program product are executed by the processor of the electronic device, the various processes of the above-mentioned method embodiment are implemented and the same technical effect as the above-mentioned method can be achieved. To avoid repetition, they will not be repeated here.

[0164] Through the description of the above implementation methods, technical personnel in the relevant field can clearly understand that for the convenience and simplicity of description, only the division of the above-mentioned functional modules is used as an example. In actual applications, the above-mentioned functions can be distributed and completed by different functional modules as needed, that is, the internal structure of the device can be divided into different functional modules to complete the full classification or partial functions described above.

[0165] In the several embodiments provided in this application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are merely schematic. For example, the division of modules or units is only a logical function division. In actual implementation, there may be other division methods, such as multiple units or components can be combined or integrated into another device, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0166] The units described as separate components may or may not be physically separate, and the components shown as units may be one physical unit or multiple physical units, that is, they may be located in one place or distributed in multiple places. Some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

[0167] In addition, the functional units in the various embodiments of the present application may be integrated into a single processing unit, or each unit may exist physically separately, or two or more units may be integrated into a single unit. The aforementioned integrated units may be implemented in the form of hardware or software functional units.

[0168] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a readable storage medium. Based on this understanding, the technical solution of the embodiment of the present application, or the part that contributes to the prior art, or the entire classification part or part of the technical solution can be embodied in the form of a software product. The software product is stored in a storage medium and includes a number of instructions for enabling a device (which can be a single-chip microcomputer, chip, etc.) or a processor to execute the entire classification part or part of the steps of the various embodiments of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, ROM, RAM, disk or optical disk, etc., various media that can store program code.

[0169] The above are only specific embodiments of the present application, but the scope of protection of this application is not limited thereto. Any changes or substitutions that can be easily conceived by a person skilled in the art within the technical scope disclosed in this application should be included in the scope of protection of this application. Therefore, the scope of protection of this application should be based on the scope of protection of the claims.

Claims

1. An adaptive vulnerability protection method based on dynamic game, characterized in that: include: Collecting a three-dimensional feature set of network traffic through a distributed probe cluster, wherein the three-dimensional feature set includes protocol stack layer features, session timing features, and protocol state machine transition features; Inputting the three-dimensional feature set into a detection engine that integrates a generative adversarial network and a transfer learning module, outputting a dynamically weighted target anomaly score. The generative adversarial network is used for protocol feature reconstruction difference detection, and the transfer learning module is used for cross-domain attack feature alignment. generating an initial protection strategy based on a game tree model and the target anomaly score, wherein the game tree model is configured with an attack path prediction module and a defense benefit evaluation module, and the initial protection strategy includes dynamic firewall rules, detection sensitivity parameters, and decoy node topology configuration; The spatiotemporal correlation features of the initial protection strategy are analyzed through the spatiotemporal attention network, and the parameters of the initial protection strategy are iteratively optimized in combination with the incremental learning mechanism to generate the target protection strategy.

2. The method according to claim 1, characterized in that Inputting the three-dimensional feature set into a detection engine integrated with a generative adversarial network and a transfer learning module, and outputting a dynamically weighted target anomaly score, includes: Reconstructing protocol features through the decoder of the generative adversarial network and calculating the protocol level anomaly score; Calculate the session timing distribution anomaly score using the maximum mean difference metric of the transfer learning module; According to the proportion of encryption protocols in real-time traffic, the fusion weight coefficient of the protocol layer anomaly score and the session timing distribution anomaly score is dynamically adjusted.

3. The method according to claim 2, characterized in that The method further comprises: Constructing an attacker's profit function, wherein the attacker's profit function includes the vulnerability exploitation time cost and the attack payload stealth score; Constructing a defender's profit function, wherein the defender's profit function includes a rule set coverage and a policy switching delay penalty factor; Set node expansion constraints including the maximum defense decision delay threshold and the minimum policy effectiveness interval; The game tree model is generated based on the attacker's gain function, the defender's gain function and the constraint conditions.

4. The method according to claim 1, wherein The step of analyzing the spatiotemporal correlation characteristics of the initial protection strategy through a spatiotemporal attention network includes: Construct a three-dimensional tensor containing the strategy type, time window number, and network region identifier; Extracting cross-dimensional correlation features of the three-dimensional tensor through a multi-head attention mechanism to generate a strategy feature matrix with spatiotemporal encoding; A sliding time window is used to detect the evolution trend of the strategy feature matrix and identify the temporal dependency between strategy parameters.

5. The method according to claim 4, characterized in that The incremental learning mechanism is combined to iteratively optimize the parameters of the initial protection strategy to generate the target protection strategy, including: When the similarity of the strategy feature matrices of multiple consecutive time windows is less than the preset similarity, the historical strategy decision model is migrated through knowledge distillation technology; Incremental learning is performed on the mutated network attack based on the migrated historical strategy decision model to generate the target protection strategy.

6. The method according to claim 1 or 5, characterized in that The method further comprises: When an attack feature that does not hit the local policy library is detected, the cloud matching degree of the protection policy in the cloud policy library is calculated. The cloud matching degree includes the feature coverage overlap rate and the decision path similarity; In the case where the cloud matching degree is greater than the matching degree of the target protection policy, the target protection policy is replaced with the protection policy with the highest cloud matching degree.

7. The method according to claim 6, characterized in that The method further comprises: If any of the following conditions are met, the policy rollback is executed: The false alarm rate per unit time is greater than or equal to the preset false alarm rate; The number of compliance check failures for critical business traffic is greater than or equal to the preset number; The attack signature detection rate is less than or equal to the preset detection rate.

8. An adaptive vulnerability protection device based on dynamic game, characterized in that: The device comprises: A collection unit, configured to collect a three-dimensional feature set of network traffic through a distributed probe cluster, wherein the three-dimensional feature set includes protocol stack layer features, session timing features, and protocol state machine transition features; a processing unit configured to input the three-dimensional feature set into a detection engine integrated with a generative adversarial network and a transfer learning module, and output a dynamically weighted target anomaly score, wherein the generative adversarial network is used for protocol feature reconstruction difference detection, and the transfer learning module is used for cross-domain attack feature alignment; a generating unit, configured to generate an initial protection strategy based on a game tree model and the target anomaly score, wherein the game tree model is configured with an attack path prediction module and a defense benefit evaluation module, and the initial protection strategy includes dynamic firewall rules, detection sensitivity parameters, and decoy node topology configuration; The generation unit is also used to analyze the spatiotemporal correlation characteristics of the initial protection strategy through the spatiotemporal attention network, iteratively optimize the parameters of the initial protection strategy in combination with the incremental learning mechanism, and generate a target protection strategy.

9. An electronic device, characterized in that: include: processor; a memory for storing instructions executable by the processor; The processor is configured to execute the instructions to implement the method according to any one of claims 1 to 7.

10. A computer-readable storage medium storing instructions, characterized in that: When a computer executes the instruction, the computer performs the method according to any one of claims 1 to 7.

Images