Adaptive vulnerability protection methods, devices, and equipment based on dynamic game theory

Abstract

This application discloses an adaptive vulnerability protection method, apparatus, and device based on dynamic game theory, relating to the field of network security protection technology, aiming to solve the problem of poor protection effectiveness against real-time changing network attacks. The method includes: collecting a three-dimensional feature set of network traffic through a distributed probe cluster, the three-dimensional feature set including protocol stack layer features, session temporal features, and protocol state machine transition features; inputting the three-dimensional feature set into a detection engine integrating generative adversarial networks and transfer learning modules, outputting a dynamically weighted target anomaly score; generating an initial protection strategy based on a game tree model and the target anomaly score, the initial protection strategy including dynamic firewall rules, detection sensitivity parameters, and decoy node topology configuration; analyzing the spatiotemporal correlation features of the initial protection strategy through a spatiotemporal attention network, and iteratively optimizing the parameters of the initial protection strategy using an incremental learning mechanism to generate a target protection strategy.

Description

Technical Field

[0001] This application relates to the field of network security protection technology, and in particular to an adaptive vulnerability protection method, apparatus and device based on dynamic game theory. Background Technology

[0002] Digital development has brought severe challenges to cybersecurity, including the diversification of attack methods and the rapid iteration of strategies.

[0003] Currently, most network security protection relies on traditional static defenses. For example, they depend on signature databases to detect known threats but cannot identify new attacks; or they use static firewall rules, which lack flexibility. Traditional static defenses rely on pre-defined rules and are difficult to deal with unknown attacks. Although there are records of introducing dynamic protection technologies, there are still problems with response delays and insufficient adaptability, especially in scenarios such as zero-day attacks where protection effectiveness is limited.

[0004] Therefore, there is an urgent need to design a solution that can protect against network security attacks in real time, in order to address the problem of poor protection effectiveness against real-time changing network attacks. Summary of the Invention

[0005] The purpose of this application is to provide an adaptive vulnerability protection method, device, and equipment based on dynamic game theory, which aims to solve the problem of poor protection effectiveness against real-time changing network attacks.

[0006] To achieve the above objectives, this application adopts the following technical solution:

[0007] This application provides an adaptive vulnerability protection method based on dynamic game theory. The method includes: collecting a three-dimensional feature set of network traffic through a distributed probe cluster, the three-dimensional feature set including protocol stack layer features, session temporal features, and protocol state machine transition features; inputting the three-dimensional feature set into a detection engine integrating a generative adversarial network (GAN) and transfer learning modules, outputting a dynamically weighted target anomaly score; using the GAN for protocol feature reconstruction difference detection, and the transfer learning module for cross-domain attack feature alignment; generating an initial protection strategy based on a game tree model and the target anomaly score, the game tree model being configured with an attack path prediction module and a defense effectiveness evaluation module; the initial protection strategy including dynamic firewall rules, detection sensitivity parameters, and decoy node topology configuration; and analyzing the spatiotemporal correlation features of the initial protection strategy through a spatiotemporal attention network, iteratively optimizing the parameters of the initial protection strategy using an incremental learning mechanism to generate a target protection strategy.

[0008] The adaptive vulnerability protection method based on dynamic game theory provided in this application improves the comprehensiveness of attack detection coverage by collecting a three-dimensional feature set of protocol stack layers, session timing, and protocol state machine transitions through a distributed probe cluster. Furthermore, it utilizes generative adversarial networks to reconstruct protocol features and capture unknown attack patterns, and employs a transfer learning module to reduce the risk of misjudgment through cross-domain feature alignment. Further, based on a dynamic weighted scoring mechanism, it combines the adversarial deduction of the attack path prediction module and the defense effectiveness evaluation module in the game tree model to generate an initial protection strategy that links dynamic firewall rules, detection sensitivity, and decoy node topology configuration, achieving on-demand dynamic allocation of defense resources. Finally, it uses a spatiotemporal attention network to analyze the spatiotemporal correlation features of the initial strategy parameters and superimposes an incremental learning mechanism to achieve online iterative optimization of the protection strategy, dynamically adapting to changes in the network environment and the evolution of attack patterns, thereby improving the dynamic response efficiency and overall energy efficiency of real-time network protection.

[0009] In some embodiments, the above-mentioned input of a three-dimensional feature set into a detection engine integrating a generative adversarial network and a transfer learning module, and output of a dynamically weighted target anomaly score, includes: reconstructing protocol features through the decoder of the generative adversarial network to calculate a protocol-level anomaly score; calculating a session temporal distribution anomaly score through the maximum mean difference measure of the transfer learning module; and dynamically adjusting the fusion weight coefficient of the protocol-level anomaly score and the session temporal distribution anomaly score according to the proportion of encrypted protocols in real-time traffic.

[0010] Based on this, this application achieves accurate quantitative scoring of protocol tampering and temporal anomalies by comparing the reconstructed protocol features of generative adversarial networks with the cross-domain distribution of transfer learning; and by dynamically adjusting the weight coefficients in combination with the proportion of encrypted protocols, it enhances the adaptability of the detection model to traffic encryption scenarios and effectively reduces the false negative rate of covert attacks.

[0011] In some embodiments, the adaptive vulnerability protection method based on dynamic game theory provided in this application further includes: constructing an attacker's payoff function, which includes vulnerability exploitation time cost and attack payload concealment score; constructing a defender's payoff function, which includes rule set coverage and policy switching latency penalty factor; setting node extension constraints including maximum defense decision delay threshold and minimum policy effective interval; and generating a game tree model based on the attacker's payoff function, the defender's payoff function, and the constraints.

[0012] Based on this, this application establishes a quantitative model of attack and defense behavior by quantifying the payoff functions of the attacker's time cost and concealment, and the defender's rule coverage and switching latency; combined with decision delay threshold and effective interval constraints, it optimizes the efficiency of game tree node expansion, avoids strategy oscillation, and improves the accuracy and timeliness of dynamic game decision-making.

[0013] In some embodiments, the above-mentioned method of parsing the spatiotemporal correlation features of the initial protection strategy through a spatiotemporal attention network includes: constructing a three-dimensional tensor containing strategy type, time window number, and network region identifier; extracting cross-dimensional correlation features of the three-dimensional tensor through a multi-head attention mechanism to generate a strategy feature matrix with spatiotemporal encoding; and using a sliding time window to detect the evolution trend of the strategy feature matrix and identify the temporal dependencies between strategy parameters.

[0014] Based on this, this application constructs a spatiotemporal dimension mapping of policy parameters using a three-dimensional tensor, and uses a multi-head attention mechanism to capture the implicit correlation between policy types, time windows, and network regions; combined with a sliding time window to detect the evolution law of the policy matrix, it enhances the ability of the defense strategy to track network topology changes and attack phase migrations.

[0015] In some embodiments, the above-mentioned combination of incremental learning mechanism to iteratively optimize the parameters of the initial protection strategy and generate the target protection strategy includes: when the similarity of the strategy feature matrix in multiple consecutive time windows is less than a preset similarity, transferring the historical strategy decision model through knowledge distillation technology; and performing incremental learning on mutated network attacks based on the transferred historical strategy decision model to generate the target protection strategy.

[0016] Based on this, this application triggers knowledge distillation transfer through a strategy feature similarity threshold to retain the effective decision-making patterns of historical defense strategies; combined with incremental learning to continuously adapt to mutated attack samples, it solves the catastrophic forgetting problem of traditional models and realizes the progressive optimization of defense strategies in adversarial environments.

[0017] In some embodiments, the adaptive vulnerability protection method based on dynamic game theory provided in this application further includes: when an attack feature that does not hit the local policy library is detected, calculating the cloud matching degree of the protection policy in the cloud policy library, wherein the cloud matching degree includes the feature coverage overlap rate and the decision path similarity; and when the cloud matching degree is greater than the matching degree of the target protection policy, replacing the target protection policy with the protection policy with the highest cloud matching degree.

[0018] Based on this, this application establishes a collaborative mechanism for local and cloud-based defense knowledge by matching the feature coverage overlap rate and decision path similarity of the cloud-based policy library; when detecting unknown attacks, it dynamically switches the optimal cloud policy, breaks through the knowledge limitations of single-point defense, and improves the emergency response speed to zero-day vulnerability attacks.

[0019] In some embodiments, the adaptive vulnerability protection method based on dynamic game theory provided in this application further includes: performing policy rollback when any of the following conditions are met: the false alarm rate per unit time is greater than or equal to the preset false alarm rate, the number of compliance verification failures of critical business traffic is greater than or equal to the preset number, and the attack feature detection rate is less than or equal to the preset detection rate.

[0020] Based on this, this application constructs policy rollback trigger conditions by using false positive rate, number of compliance verification failures and detection rate thresholds, so as to quickly restore to a stable policy version when the defense effectiveness declines; avoid the continuous spread of erroneous policies, ensure the continuity of critical business traffic, and maintain the robustness of the protection system.

[0021] This application provides an adaptive vulnerability protection device based on dynamic game theory. The device includes: a collection unit, used to collect a three-dimensional feature set of network traffic through a distributed probe cluster, the three-dimensional feature set including protocol stack layer features, session timing features, and protocol state machine transition features; a processing unit, used to input the three-dimensional feature set into a detection engine integrating a generative adversarial network and a transfer learning module, and output a dynamically weighted target anomaly score, the generative adversarial network being used for protocol feature reconstruction difference detection, and the transfer learning module being used for cross-domain attack feature alignment; a generation unit, used to generate an initial protection strategy based on a game tree model and the target anomaly score, the game tree model being configured with an attack path prediction module and a defense effectiveness evaluation module, the initial protection strategy including dynamic firewall rules, detection sensitivity parameters, and decoy node topology configuration; the generation unit is also used to parse the spatiotemporal correlation features of the initial protection strategy through a spatiotemporal attention network, and iteratively optimize the parameters of the initial protection strategy by combining an incremental learning mechanism to generate a target protection strategy.

[0022] In some embodiments, the above processing unit is specifically used to: reconstruct protocol features by the decoder of the generative adversarial network and calculate the protocol layer anomaly score; calculate the session temporal distribution anomaly score by using the maximum mean difference measure of the transfer learning module; and dynamically adjust the fusion weight coefficient of the protocol layer anomaly score and the session temporal distribution anomaly score according to the proportion of encryption protocols in real-time traffic.

[0023] In some embodiments, the above-mentioned generation unit is further configured to: construct an attacker's payoff function, which includes vulnerability exploitation time cost and attack payload concealment score; construct a defender's payoff function, which includes rule set coverage and policy switching latency penalty factor; set node extension constraints including maximum defense decision delay threshold and minimum policy effective interval; and generate a game tree model based on the attacker's payoff function, the defender's payoff function, and the constraints.

[0024] In some embodiments, the above-mentioned generation unit is specifically used to: construct a three-dimensional tensor containing policy type, time window number, and network region identifier; extract cross-dimensional correlation features of the three-dimensional tensor through a multi-head attention mechanism to generate a policy feature matrix with spatiotemporal encoding; and use a sliding time window to detect the evolution trend of the policy feature matrix and identify the temporal dependency relationship between policy parameters.

[0025] In some embodiments, the above-mentioned generation unit is specifically used to: transfer the historical policy decision model through knowledge distillation technology when the similarity of the policy feature matrix in multiple consecutive time windows is less than a preset similarity; and perform incremental learning on mutated network attacks based on the transferred historical policy decision model to generate a target protection policy.

[0026] In some embodiments, the processing unit is further configured to: when an attack feature that does not hit the local policy library is detected, calculate the cloud matching degree of the protection policy in the cloud policy library, wherein the cloud matching degree includes the feature coverage overlap rate and the decision path similarity; and if the cloud matching degree is greater than the matching degree of the target protection policy, replace the target protection policy with the protection policy with the highest cloud matching degree.

[0027] In some embodiments, the above processing unit is further configured to: perform policy rollback if any of the following conditions are met: the false alarm rate per unit time is greater than or equal to the preset false alarm rate, the number of compliance verification failures of critical business traffic is greater than or equal to the preset number, and the attack feature detection rate is less than or equal to the preset detection rate.

[0028] This application provides an electronic device, including: a processor; a memory for storing processor-executable instructions; wherein the processor is configured to execute instructions to implement the adaptive vulnerability protection method based on dynamic game theory described above.

[0029] This application provides a computer-readable storage medium storing instructions that, when executed on a terminal, cause the terminal to perform the adaptive vulnerability protection method based on dynamic game theory described above.

[0030] This application provides a computer program product containing instructions that, when executed by a computer, cause the computer to perform the adaptive vulnerability protection method based on dynamic game theory described above.

[0031] This application provides a chip including a processor and a communication interface, the communication interface and the processor being coupled together. The processor is used to run computer programs or instructions to implement the adaptive vulnerability protection method based on dynamic game theory described above.

[0032] Specifically, the chip provided in this application embodiment also includes a memory for storing computer programs or instructions. Attached Figure Description

[0033] To more clearly illustrate the technical solutions of the embodiments of this application, the drawings used in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0034] Figure 1 A flowchart illustrating an adaptive vulnerability protection method based on dynamic game theory, provided in an embodiment of this application;

[0035] Figure 2 A flowchart illustrating the training process of a game tree model provided in this application embodiment;

[0036] Figure 3 A structural diagram of an adaptive vulnerability protection device based on dynamic game theory provided in an embodiment of this application;

[0037] Figure 4 This is a structural diagram of an electronic device provided in an embodiment of this application. Detailed Implementation

[0038] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0039] In the description of this application, it should be understood that the terms "upper," "lower," "left," "right," "front," "rear," "inner," and "outer," etc., indicate the orientation or positional relationship based on the orientation or relative positional relationship shown in the accompanying drawings. They are used only for the convenience of describing this application and for simplification, and do not indicate or imply that the device or element referred to must have a specific orientation, or be constructed and operated in a specific orientation. Therefore, they should not be construed as limitations on this application. Unless otherwise specified, the above-mentioned orientational descriptions can be flexibly set in practical applications, provided that the relative positional relationships shown in the accompanying drawings are satisfied.

[0040] The terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Therefore, a feature defined as "first" or "second" may explicitly or implicitly include one or more of that feature. In the description of this application, unless otherwise stated, "a plurality of" means two or more.

[0041] In the description of this application, it should be noted that, unless otherwise expressly specified and limited, the terms "installation," "connection," "linking," and "communication" should be interpreted broadly. For example, they can refer to a fixed connection, a detachable connection, or an integral connection. They can refer to a direct connection or an indirect connection through an intermediate medium, or a connection within two components. Those skilled in the art can understand the specific meaning of the above terms in this application according to the specific circumstances.

[0042] In some embodiments, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, article, or apparatus. Without further limitation, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, article, or apparatus that includes that element.

[0043] In some embodiments, the words "exemplary" or "for example" are used to indicate that something is an example, illustration, or illustration. Any embodiment or design described as "exemplary" or "for example" in the embodiments of this application should not be construed as being more preferred or advantageous than other embodiments or designs. Specifically, the use of the words "exemplary" or "for example" is intended to present the relevant concepts in a specific manner.

[0044] In the description of this specification, specific features, structures, materials, or characteristics may be combined in any suitable manner in one or more embodiments or examples.

[0045] Faced with increasingly severe cyberattacks, the limitations of traditional static protection strategies are becoming more and more apparent. Existing security systems mainly rely on predefined security rules and signature databases to identify known threats, and their passive response model has the following three core flaws:

[0046] I. Lagging defense against new types of attacks: When faced with unknown attack methods such as zero-day exploits and advanced persistent threats, traditional rule engines are unable to intercept them in a timely manner due to a lack of prior knowledge, resulting in a prolonged attack window.

[0047] Second, rigid strategies and insufficient adaptability: Static rule configurations cannot dynamically adjust defense parameters (such as firewall rules and intrusion detection thresholds) according to the attack situation, resulting in a significant decrease in defense effectiveness in scenarios where attack methods are rapidly evolving.

[0048] 3. Inefficient resource allocation: Fixed strategies make it difficult to optimize defense resource investment, which can easily lead to contradictions such as over-defense (affecting normal business) or under-defense (vulnerabilities being exploited).

[0049] Therefore, existing network security protection solutions are less effective in the face of real-time and changing network attacks.

[0050] Against this backdrop, to address the problem of poor protection effectiveness against real-time changing network attacks in related technologies, this application provides an adaptive vulnerability protection method, apparatus, and device based on dynamic game theory. By introducing a dynamic game theory model for attack and defense, the network attack and defense process is transformed into a quantifiable decision-making process, overcoming the passivity of static protection strategies and providing a completely new technical path for network security protection.

[0051] The following is a reference. Figure 1 and Figure 2 The adaptive vulnerability protection method based on dynamic game theory provided in the embodiments of this application is described.

[0052] Figure 1 The flowchart of the adaptive vulnerability protection method based on dynamic game theory provided in this application embodiment is shown. The subject executing the method can be an electronic device or various devices / modules in the electronic device, such as integrated circuits or chips. This application embodiment does not specifically limit this.

[0053] For example, such as Figure 1 As shown, the adaptive vulnerability protection method based on dynamic game theory provided in this application embodiment may include the following S101 to S104:

[0054] S101. Collect a three-dimensional feature set of network traffic through a distributed probe cluster.

[0055] The three-dimensional feature set includes protocol stack level features, session timing features, and protocol state machine transition features.

[0056] In this embodiment of the application, a multi-level, distributed network traffic feature acquisition system is constructed, and attack features are captured in a three-dimensional manner through deep analysis of the protocol stack, time-series behavior modeling, and dynamic monitoring of the state machine.

[0057] In some embodiments, a distributed probe cluster may include core layer probes, edge layer probes, and cloud probes.

[0058] For example, core layer probes can be deployed on core switches in data centers, responsible for network-wide traffic mirroring and protocol stack metadata extraction. Edge layer probes can be deployed on branch office gateways, collecting regional traffic and performing lightweight time-series analysis. Cloud probes can run on virtualization platforms, integrating multi-source data and building a global state machine model.

[0059] It should be noted that probes can transmit metadata through an encrypted channel based on Transport Layer Security (TLS) 1.3 and achieve load balancing through a consistent hashing algorithm.

[0060] In some embodiments, the above-mentioned protocol stack layer characteristics may include physical layer characteristics, network layer characteristics, transport layer characteristics, and application layer characteristics.

[0061] The physical layer characteristics include: the frequency of Media Access Control (MAC) address hopping and frame length distribution (such as anomalously large Ethernet frames longer than 1500 bytes). The network layer characteristics include: anomalous Internet Protocol (IP) fragmentation offsets and sudden changes in Time to Live (TTL) values ​​(such as a TTL jumping from 64 to 128 within the same session). The transport layer characteristics include: anomalous scaling of the Transmission Control Protocol (TCP) window size and UDP payload entropy values ​​(such as detecting encrypted tunnels). The application layer characteristics include: anomalous order of Hypertext Transfer Protocol (HTTP) header fields (such as the Host field deviating from the standard position) and DNS query type distribution (such as a sudden increase in the proportion of text records).

[0062] In some embodiments, the above-mentioned session timing features may include time series indicator features and traffic behavior pattern features.

[0063] The time-series metrics include: session handshake time (e.g., standard deviation of TCP three-way handshake time > 200ms) and request-response interval periodicity (e.g., Fourier transform detection of periodic scans). Traffic behavior pattern features include: burst traffic duration (e.g., 100Mbps traffic lasting 10 seconds) and packet size distribution (e.g., detecting the small packet characteristics of data leakage).

[0064] In some embodiments, the above-mentioned protocol state machine transition features may include legal state transition library features and abnormal jump detection features.

[0065] The features of the legal state transition library include: a state transition matrix of a predefined standard protocol. The features of the abnormal jump detection include: calculating the transition probabilities based on a hidden markov model (HMM).

[0066] For example, consider an advanced persistent threat (APT) attack on an e-commerce platform during a holiday period. The attack chain might include three parts: initial intrusion, lateral movement, and data leakage.

[0067] The initial intrusion exploited an unpatched Confluence vulnerability (CVE-2021-26084) to inject a backdoor into a webpage. Lateral movement involved command and control via an encrypted Internet Control Message Protocol (ICMP) tunnel (anomaly in protocol characteristics). Data leakage was disguised as low-frequency data leakage masquerading as normal image upload traffic (anomaly in timing characteristics).

[0068] At this point, the edge probe can capture expression injection features (protocol stack level) in Confluence requests; the core probe detects that the ICMP payload entropy value is greater than 7.5 (normal traffic entropy value is 4.2); and the cloud probe discovers that the timing pattern of the image upload session deviates from the baseline (relative entropy greater than 3).

[0069] S102. Input the three-dimensional feature set into the detection engine that integrates generative adversarial networks and transfer learning modules, and output a dynamically weighted target anomaly score.

[0070] In this embodiment, a generative adversarial network (GAN) is used for protocol feature reconstruction difference detection. The GAN can be a generative adversarial network (GAN). A transfer learning module is used for cross-domain attack feature alignment.

[0071] In some embodiments, protocol features can be reconstructed by the decoder of the generative adversarial network to calculate the protocol layer anomaly score; then, the maximum mean difference measure of the transfer learning module can be used to calculate the session temporal distribution anomaly score; finally, the fusion weight coefficient of the protocol layer anomaly score and the session temporal distribution anomaly score can be dynamically adjusted according to the proportion of encrypted protocols in real-time traffic.

[0072] For example, a GAN includes a generator structure and a discriminator structure. The generator structure consists of a bidirectional long short-term memory (LSTM) network (256 hidden units) and fully connected layers, with the input being a standardized protocol feature vector (dimension = 512). The discriminator structure employs a one-dimensional convolutional layer and an attention mechanism, and its output is the reconstruction confidence score. Finally, the reconstruction error is calculated, and the Wasserstein distance is used to measure the difference in distribution between the original features and the reconstructed features.

[0073] For example, the transfer learning module can first extract attack features based on a public dataset to construct a source domain feature space. Then, a domain adversarial neural network is used to minimize the maximum mean difference distance between the source and target domains through a gradient reversal layer (GRL). Finally, the projection distance between the source and target domains in the reproducing kernel hilbert space (RKHS) is calculated to obtain a feature alignment metric.

[0074] Furthermore, after calculating the protocol layer anomaly score and the session timing distribution anomaly score, weight adjustments can be made. For example, by fingerprinting the client type, the proportion of HTTPS traffic x is counted, and then the protocol layer weight α and the session timing distribution weight β are calculated using the following formulas (I) and (II), respectively.

[0075] Formula (1)

[0076] Formula (II)

[0077] Specifically, when x is greater than 70%, α is greater than 0.8, and the focus is on protocol layer detection; when x is less than 30%, β is greater than 0.7, and the focus is on time series analysis.

[0078] For example, combining the e-commerce platform attack in S101 above, after feature collection, GAN reconstruction can be performed. At this point, it shows that the webpage request parameters have a 28% deviation, and the protocol layer score is 0.91. The transfer learning module is used to determine that the distance between the ICMP tunnel feature and the known sample's MMD is 0.19, and the time series score is 0.87. If the detected encrypted traffic accounts for 45%, the dynamic weight α is calculated to be 0.55, and the final target anomaly score is 0.55*0.91 + 0.45*0.87 = 0.892.

[0079] Thus, this application achieves accurate quantitative scoring of protocol tampering and temporal anomalies by comparing the reconstructed protocol features of generative adversarial networks with the cross-domain distribution of transfer learning; and by dynamically adjusting the weight coefficients based on the proportion of encrypted protocols, it enhances the adaptability of the detection model to traffic encryption scenarios and effectively reduces the false negative rate of covert attacks.

[0080] S103. Generate an initial protection strategy based on the game tree model and target anomaly score.

[0081] The initial protection strategy includes dynamic firewall rules, detection sensitivity parameters, and decoy node topology configuration.

[0082] For example, dynamic firewall rules, as opposed to traditional static firewall rules, can automatically adjust filtering rules based on changes in network traffic, threat intelligence, or security policies. Specifically, dynamic firewalls achieve real-time policy updates by integrating intrusion detection systems, intrusion prevention systems, and advanced threat protection features.

[0083] For example, the detection sensitivity parameter is a threshold used in cybersecurity systems (such as situational awareness platforms) to balance the false positive rate and the false negative rate. The detection sensitivity parameter determines how strictly the system identifies anomalous behavior and is typically dynamically adjusted through statistical models (such as mean ± 2 standard deviations) or machine learning algorithms.

[0084] For example, decoy node topology configuration refers to a defense strategy that involves deploying honeypots or decoy nodes in a network and optimizing their topology to attract attackers, protect the real system, and collect attack intelligence.

[0085] In this embodiment, the game tree model is configured with an attack path prediction module and a defense effectiveness evaluation module.

[0086] For example, the attack path prediction module may include two parts: node generation and path weight determination. Node generation refers to constructing an attack path tree based on a preset framework, where each node represents an attack stage (such as initial access or lateral movement). Path weight refers to dynamically adjusting the path selection probability based on the target anomaly score (for example, when the anomaly score is 0.9, the attack path weight is increased to 0.9).

[0087] For example, the defense effectiveness assessment module may include two parts: defense nodes and benefit calculation. Each attack node in the defense nodes corresponds to multiple defense actions (such as blocking, rate limiting, and trapping). Benefit calculation refers to the comprehensive calculation of the benefit of the defense actions based on rule coverage, false positive rate, and resource consumption.

[0088] In some embodiments, the attack threat level can be quantified by target anomaly scoring, driving the game tree model to perform multiple rounds of attack and defense simulations, and generating a linkage strategy that integrates proactive defense and trapping methods (i.e., the initial protection strategy).

[0089] For example, the target anomaly score can be normalized to the attack probability weight of the game tree node. For instance, a score of 0.8 corresponds to an attack path weight of 0.8, and the defense response priority is raised to the highest level. Specifically, threat levels can be classified based on the score.

[0090] For example, low risk (0-0.3): only triggers log recording. Medium risk (0.3-0.7): activates basic defense rules. High risk (0.7-1.0): initiates full policy linkage (firewall + trapping + sensitivity adjustment).

[0091] For example, in conjunction with the e-commerce platform attack in S102 above, after obtaining the target anomaly score, a strategy can be generated through game tree deduction: block path access to the Confluence service, deploy a fake honeypot in the isolation zone, and increase the XSS detection sensitivity to 0.95.

[0092] S104. The spatiotemporal correlation features of the initial protection strategy are analyzed by a spatiotemporal attention network, and the parameters of the initial protection strategy are iteratively optimized by an incremental learning mechanism to generate the target protection strategy.

[0093] In some embodiments, parsing the spatiotemporal correlation characteristics of the initial protection strategy can be achieved by first constructing a three-dimensional tensor containing the strategy type, time window number, and network area identifier.

[0094] Dimension 1 (Policy Type Axis) encodes firewall rules, detection sensitivity, and decoy node configurations into a 128-dimensional vector. Dimension 2 (Time Window Axis) divides the policy's effective period into sliding windows (e.g., 5 minutes), with each window marked as a timestamp hash value. Dimension 3 (Spatial Region Axis) assigns location codes to network topology partitions (e.g., internal office networks), forming a spatial coordinate matrix.

[0095] Furthermore, after constructing the three-dimensional tensor, the cross-dimensional correlation features of the three-dimensional tensor can be extracted through a multi-head attention mechanism to generate a policy feature matrix with spatiotemporal encoding.

[0096] For example, the cross-dimensional correlation of the 3D tensor can be computed in parallel using eight attention heads: Head 1 focuses on the correlation between policy type and time window (e.g., "defense rules are activated during peak attack periods"); Head 2 focuses on the correlation between time window and spatial region (e.g., "abnormal login attempts on the internal office network during midnight"); Head 3 analyzes the correlation between policy type and spatial region (e.g., "protection policy for the application programming interface gateway specific to the internal office network"). Finally, the projection of the 3D tensor under attention weights (e.g., dimension compressed to (128, T, S), where T is the number of time windows and S is the number of spatial regions) is output, i.e., the policy feature matrix.

[0097] Furthermore, a sliding time window is used to detect the evolution trend of the strategy feature matrix and identify the temporal dependencies between strategy parameters.

[0098] For example, a dynamic time warping algorithm is used to analyze the temporal pattern of the policy feature matrix and identify the dependencies between parameters. For instance, if the "detection sensitivity improvement" policy is always triggered 10 time windows after the "honeypot alarm surge," it indicates a causal relationship. In this case, an autoregressive model is used to predict the firewall rule update requirements for the next window, and the policy parameters are adjusted in advance.

[0099] Thus, this application constructs a spatiotemporal dimension mapping of policy parameters using a three-dimensional tensor, and uses a multi-head attention mechanism to capture implicit correlations between policy types, time windows, and network regions; combined with a sliding time window to detect the evolution of the policy matrix, it enhances the ability of defense strategies to track network topology changes and attack phase migrations.

[0100] In some embodiments, after parsing the spatiotemporal correlation features of the initial protection strategy, the historical strategy decision model can be transferred through knowledge distillation if the similarity of the strategy feature matrices in multiple consecutive time windows is less than a preset similarity.

[0101] For example, a historical policy decision-making model (such as an LSTM time series predictor) can be used as the teacher model, and its hidden layer output can be extracted as the soft objective. The current policy optimizer can be used as the student model, and the output distribution of the teacher model can be aligned with the relative entropy loss function to preserve the historical policy decision-making model.

[0102] Specifically, the teacher model has learned the attack chain pattern of "port scan followed by program injection", and the student model inherits the ability to identify this pattern through distillation; the effective parameters in the historical strategy (such as "honeypot survival time = 120 seconds") are weighted and solidified to prevent incremental learning from covering key configurations.

[0103] Furthermore, after model transfer, incremental learning is performed on the mutated network attacks based on the transferred historical strategy decision model to generate target protection strategies.

[0104] For example, the new attack samples can be incrementally trained using an elastic weight consolidation algorithm based on the transferred model. An adversarial training mechanism is also introduced, where mutated attack samples are synthesized using a GAN, and then distilled knowledge is fused with the incremental learning results to generate a policy package that includes dynamic threshold adjustment, adaptive honeypot deployment, and differential segmentation rule updates.

[0105] Specifically, when a new type of vulnerability is detected, the model automatically increases the detection sensitivity from 0.7 to 0.9 and deploys a highly interactive honeypot in the affected area. After the strategy takes effect, the defense effect (such as the attack surface reduction ratio) is evaluated through reinforcement learning, and the parameters are iteratively optimized until the target protection strategy is obtained.

[0106] For example, combining the e-commerce platform attack in S103 above, after obtaining the initial protection strategy, the spatiotemporal attention network can be used to detect the attacker's shift to the object storage service, and the incremental learning module adds abnormal parameter detection rules for the application interface. Then, the attacker is lured to the honeypot, and the attacker's fingerprint is obtained through source tracing.

[0107] In the adaptive vulnerability protection method based on dynamic game theory provided in this application embodiment, a three-dimensional feature set of protocol stack layer, session timing, and protocol state machine transition is collected by a distributed probe cluster to improve the comprehensiveness of attack detection coverage. Furthermore, generative adversarial networks are used to reconstruct protocol features to capture unknown attack patterns, and a transfer learning module is used to reduce the risk of misjudgment through cross-domain feature alignment. Further, based on the dynamic weighted scoring mechanism, the adversarial deduction of the attack path prediction module and the defense benefit evaluation module in the game tree model is combined to generate an initial protection strategy that links dynamic firewall rules, detection sensitivity, and decoy node topology configuration, realizing the dynamic allocation of defense resources on demand. Finally, the spatiotemporal correlation features of the initial strategy parameters are analyzed by a spatiotemporal attention network, and an incremental learning mechanism is superimposed to realize online iterative optimization of the protection strategy, dynamically adapting to changes in the network environment and the evolution of attack patterns, thereby improving the dynamic response efficiency and overall energy efficiency of real-time network protection.

[0108] The following describes the construction process of the game tree model provided in the embodiments of this application.

[0109] For example, such as Figure 2 As shown, the construction process of a game tree model may include the following steps:

[0110] S201. Construct the attacker's profit function.

[0111] The attacker's payoff function includes the time cost of exploiting the vulnerability and the stealth score of the attack payload.

[0112] For example, the exploitation time cost C can be calculated using the following formula (iii).

[0113] Formula (3)

[0114] Among them, T1 is the time spent in the vulnerability scanning phase (such as port scanning time), T2 is the time spent in the vulnerability exploitation phase (such as module execution time), and T3 is the time spent in the backdoor maintenance phase (such as dwell time).

[0115] For example, the attack payload concealment score S can be calculated using the following formula (iv).

[0116] Formula (IV)

[0117] Wherein, W1 is the encryption algorithm weight, S1 is the algorithm strength score, W2 is the anti-detection technology weight, and S2 is the technology evasion score.

[0118] S202, Construct the defender's profit function.

[0119] The defender's profit function includes rule set coverage and policy switching latency penalty factor.

[0120] For example, the rule set coverage R can be calculated using the following formula (v).

[0121] Formula (5)

[0122] Where N1 is the number of successfully intercepted attack signatures, N2 is the total number of attack signatures, and W3 is the rule priority weight.

[0123] For example, the strategy switching delay penalty factor P can be calculated using the following formula (vi).

[0124] Formula (VI)

[0125] Where T1 is the actual policy switching time, T2 is the preset maximum tolerable latency, and K is the latency penalty coefficient.

[0126] S203. Set node extension constraints that include the maximum defense decision delay threshold and the minimum policy effective interval.

[0127] In some embodiments, node expansion constraints are used to control the growth scale of the game tree and avoid state space explosion.

[0128] For example, the maximum defense decision delay threshold and the minimum policy activation interval can both be manually set values, which can be flexibly adjusted according to the actual scenario.

[0129] For example, the maximum defense decision delay threshold of 150ms can be determined based on three times the standard deviation of network round-trip time (RTT); the minimum policy effective interval can be determined as 10s based on the convergence time of the policy deployment system, such as the effective interval of firewall rules.

[0130] S204. Generate a game tree model based on the attacker's payoff function, the defender's payoff function, and the constraints.

[0131] In some embodiments, an attack step can be configured for each attack node according to the attacker's payoff function, a protection strategy can be configured for each defense node according to the defender's payoff function, and node configuration can be terminated when the constraints are met, thus obtaining the final game tree model.

[0132] For example, for attacking nodes, the average time taken for each attack step can be calculated from historical attack logs to obtain the time cost. Then, the concealment of the attack step's payload can be calculated to obtain a concealment score. For defending nodes, the interception rate of the protection strategy against known attack characteristics can be calculated to determine the rule coverage. Then, the strategy switching time can be determined through performance testing to obtain a latency penalty factor. Finally, when the node expansion depth exceeds the maximum defense decision latency threshold, the node configuration is terminated, resulting in the final game tree model.

[0133] Thus, this application establishes a quantitative model of attack and defense behavior by quantifying the attacker's time cost and concealment, and the defender's rule coverage and switching latency payoff function; combined with decision delay threshold and effective interval constraints, it optimizes the efficiency of game tree node expansion, avoids strategy oscillation, and improves the accuracy and timeliness of dynamic game decision-making.

[0134] Optionally, after generating the target protection policy, the target protection policy can be monitored in real time and updated promptly if the target protection policy is no longer applicable.

[0135] In some embodiments, when an attack signature that does not match the local policy library is detected, the cloud matching degree of the protection policy in the cloud policy library can be calculated, and if the cloud matching degree is greater than the matching degree of the target protection policy, the target protection policy can be replaced with the protection policy with the highest cloud matching degree.

[0136] In this embodiment of the application, the cloud policy library stores a variety of protection policies corresponding to different network attack modes.

[0137] For example, network traffic can be pattern matched using the rule engine of a local policy library. When no predefined rule is matched, a cloud-based collaborative process is triggered. Specifically, taking an attack payload with the attack characteristics of the CVE-2025-XXXX new vulnerability as an example, if no relevant characteristics are matched in the local rule library (containing 5000 rules), the hash value of the attack payload is automatically extracted and uploaded to the cloud policy library.

[0138] In this embodiment of the application, the cloud matching degree includes feature coverage overlap rate and decision path similarity.

[0139] For example, the feature coverage overlap rate H can be calculated using formula (vii).

[0140] Formula (VII)

[0141] Among them, F1 is the feature set covered by the local policy (such as port number and protocol type), F2 is the feature set covered by the cloud policy, and F3 is the feature set actually contained in the attack payload.

[0142] For example, the decision path similarity I can be calculated using formula (8).

[0143] Formula (8)

[0144] Where D is the minimum edit distance between the local and cloud-based policy decision trees, and L max Let be the maximum path length between the two decision trees.

[0145] For example, if there is a protection policy A in the cloud policy library with a feature coverage overlap rate H greater than 80% and a decision path similarity I greater than 0.5, download the protection policy A and replace the current target protection policy with the protection policy A.

[0146] Thus, this application establishes a collaborative mechanism for local and cloud-based defense knowledge by matching the feature coverage overlap rate and decision path similarity of the cloud-based policy library; when detecting unknown attacks, it dynamically switches the optimal cloud policy, breaking through the knowledge limitations of single-point defense and improving the emergency response speed to zero-day vulnerability attacks.

[0147] Furthermore, to ensure the stability of network security protection, a rollback operation can be performed on the currently adopted protection strategy.

[0148] For example, a policy rollback can be performed if any one of the following conditions A, B, or C is met.

[0149] A. The false alarm rate per unit time is greater than or equal to the preset false alarm rate.

[0150] For example, the false alarm rate U per unit time can be calculated using the following formula (ix).

[0151] Formula (IX)

[0152] Where N1 is the number of false alarms and N2 is the number of correctly intercepted events.

[0153] B. The number of compliance verification failures for critical business traffic is greater than or equal to the preset number.

[0154] For example, protocol format validation can be performed on critical business traffic, recording the number of times it does not conform to a specific standard (such as an RFC).

[0155] C. The attack feature detection rate is less than or equal to the preset detection rate.

[0156] For example, the attack signature detection rate V can be calculated using the following formula (x).

[0157] Formula (10)

[0158] It should be noted that the preset false alarm rate, preset number of predictions, and preset detection rate mentioned above are all manually set values, which can be flexibly adjusted according to the actual scenario. For example, the preset false alarm rate can be 5%, the preset number of predictions can be 3 times per minute, and the preset detection rate can be 90%.

[0159] Thus, this application constructs policy rollback trigger conditions by using false positive rate, number of compliance verification failures, and detection rate thresholds, so as to quickly restore to a stable policy version when the defense effectiveness declines; avoid the continuous spread of erroneous policies, ensure the continuity of critical business traffic, and maintain the robustness of the protection system.

[0160] The above primarily describes the solutions provided by the embodiments of this application from a methodological perspective. To achieve the above functions, the adaptive vulnerability protection device or electronic device based on dynamic game theory includes hardware structures and / or software modules corresponding to the execution of each function. Those skilled in the art should readily recognize that, in conjunction with the units and algorithm steps of the various examples described in the embodiments disclosed herein, this application can be implemented in hardware or a combination of hardware and computer software. Whether a function is executed in hardware or by computer software driving hardware depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0161] This application embodiment can, according to the above method, exemplarily divide the adaptive vulnerability protection device or electronic device based on dynamic game theory into functional modules. For example, the adaptive vulnerability protection device or electronic device based on dynamic game theory may include functional modules corresponding to each functional division, or two or more functions may be integrated into one processing module. The integrated module can be implemented in hardware or as a software functional module. It should be noted that the module division in this application embodiment is illustrative and only represents one logical functional division; other division methods may be used in actual implementation.

[0162] Figure 3 This is a structural diagram of an adaptive vulnerability protection device based on dynamic game theory, provided in an embodiment of this application. The adaptive vulnerability protection device 300 based on dynamic game theory includes: a data acquisition unit 301, a processing unit 302, and a generation unit 303.

[0163] The acquisition unit 301 is used to collect a three-dimensional feature set of network traffic through a distributed probe cluster. The three-dimensional feature set includes protocol stack layer features, session timing features, and protocol state machine transition features. The processing unit 302 is used to input the three-dimensional feature set into a detection engine that integrates a generative adversarial network and a transfer learning module, and output a dynamically weighted target anomaly score. The generative adversarial network is used for protocol feature reconstruction difference detection, and the transfer learning module is used for cross-domain attack feature alignment. The generation unit 303 is used to generate an initial protection strategy based on a game tree model and the target anomaly score. The game tree model is configured with an attack path prediction module and a defense effectiveness evaluation module. The initial protection strategy includes dynamic firewall rules, detection sensitivity parameters, and decoy node topology configuration. The generation unit 303 is also used to analyze the spatiotemporal correlation features of the initial protection strategy through a spatiotemporal attention network, and iteratively optimize the parameters of the initial protection strategy by combining an incremental learning mechanism to generate a target protection strategy.

[0164] In some embodiments, the processing unit 302 is specifically used to: reconstruct protocol features by the decoder of the generative adversarial network and calculate the protocol layer anomaly score; calculate the session temporal distribution anomaly score by the maximum mean difference measure of the transfer learning module; and dynamically adjust the fusion weight coefficient of the protocol layer anomaly score and the session temporal distribution anomaly score according to the proportion of encryption protocols in real-time traffic.

[0165] In some embodiments, the generation unit 303 is further configured to: construct an attacker's payoff function, which includes vulnerability exploitation time cost and attack payload concealment score; construct a defender's payoff function, which includes rule set coverage and policy switching latency penalty factor; set node extension constraints including maximum defense decision delay threshold and minimum policy effective interval; and generate a game tree model based on the attacker's payoff function, the defender's payoff function, and the constraints.

[0166] In some embodiments, the generation unit 303 is specifically used to: construct a three-dimensional tensor containing policy type, time window number, and network region identifier; extract cross-dimensional correlation features of the three-dimensional tensor through a multi-head attention mechanism to generate a policy feature matrix with spatiotemporal encoding; and use a sliding time window to detect the evolution trend of the policy feature matrix and identify the temporal dependency relationship between policy parameters.

[0167] In some embodiments, the generation unit 303 is specifically used to: transfer the historical strategy decision model through knowledge distillation technology when the similarity of the strategy feature matrix in multiple consecutive time windows is less than a preset similarity; and perform incremental learning on mutated network attacks based on the transferred historical strategy decision model to generate a target protection strategy.

[0168] In some embodiments, the processing unit 302 is further configured to: when an attack feature that does not hit the local policy library is detected, calculate the cloud matching degree of the protection policy in the cloud policy library, wherein the cloud matching degree includes the feature coverage overlap rate and the decision path similarity; and if the cloud matching degree is greater than the matching degree of the target protection policy, replace the target protection policy with the protection policy with the highest cloud matching degree.

[0169] In some embodiments, the processing unit 302 is further configured to: perform policy rollback if any of the following conditions are met: the false alarm rate per unit time is greater than or equal to the preset false alarm rate, the number of compliance verification failures of critical business traffic is greater than or equal to the preset number, and the attack feature detection rate is less than or equal to the preset detection rate.

[0170] In the adaptive vulnerability protection device based on dynamic game theory provided in this application embodiment, a three-dimensional feature set of protocol stack level, session timing and protocol state machine transition is collected by a distributed probe cluster to improve the comprehensiveness of attack detection coverage; and generative adversarial networks are used to capture unknown attack patterns by reconstructing protocol features, and a transfer learning module is used to reduce the risk of misjudgment through cross-domain feature alignment; further, based on the dynamic weighted scoring mechanism, the adversarial deduction of the attack path prediction module and the defense benefit evaluation module in the game tree model is combined to generate an initial protection strategy that links dynamic firewall rules, detection sensitivity and decoy node topology configuration, realizing the dynamic allocation of defense resources on demand; finally, the spatiotemporal correlation features of the initial strategy parameters are analyzed by a spatiotemporal attention network, and an incremental learning mechanism is superimposed to realize the online iterative optimization of the protection strategy, dynamically adapting to changes in the network environment and the evolution of attack patterns, thereby improving the dynamic response efficiency and overall energy efficiency of real-time network protection.

[0171] Regarding the apparatus in the above embodiments, the specific manner in which each module performs its operation has been described in detail in the embodiments related to the method, and will not be elaborated upon here.

[0172] Figure 4 This is a structural diagram of an electronic device provided in an embodiment of this application. Figure 4 As shown, the electronic device 400 includes, but is not limited to, a processor 401 and a memory 402.

[0173] The memory 402 described above is used to store the executable instructions of the processor 401. It is understood that the processor 401 is configured to execute instructions to implement the adaptive vulnerability protection method based on dynamic game theory in the above embodiments.

[0174] It should be noted that those skilled in the art will understand that Figure 4 The electronic device structure shown does not constitute a limitation on the electronic device; the electronic device may include, but is not limited to, other electronic devices. Figure 4 This may indicate more or fewer components, or combinations of certain components, or different component arrangements.

[0175] Processor 401 is the control center of the electronic device. It connects various parts of the electronic device via various interfaces and lines. By running or executing software programs and / or modules stored in memory 402, and by calling data stored in memory 402, it performs various functions and processes data, thereby providing overall monitoring of the electronic device. Processor 401 may include one or more processing units. Optionally, processor 401 may integrate an application processor and a modem processor. The application processor mainly handles the operating system, user interface, and applications, while the modem processor mainly handles wireless communication. It is understood that the modem processor may not be integrated into processor 401.

[0176] The memory 402 can be used to store software programs and various data. The memory 402 may primarily include a program storage area and a data storage area. The program storage area may store the operating system, application programs required by at least one functional module (such as a determination unit, processing unit, etc.), etc. Furthermore, the memory 402 may include high-speed random access memory, and may also include non-volatile memory, such as at least one disk storage device, flash memory device, or other volatile solid-state storage device.

[0177] In an exemplary embodiment, a computer-readable storage medium including instructions is also provided, such as a memory 402 including instructions, which can be executed by a processor 401 of an electronic device 400 to implement the adaptive vulnerability protection method based on dynamic game theory in the above embodiments.

[0178] In actual implementation, Figure 3 The steps performed by the acquisition unit 301, processing unit 302, and generation unit 303 can all be performed by... Figure 4 The processor 401 calls the computer program stored in the memory 402 to implement the process. The specific execution process can be found in the description of the method section in the previous embodiment, and will not be repeated here.

[0179] Optionally, the computer-readable storage medium may be a non-transitory computer-readable storage medium, such as a read-only memory (ROM), random access memory (RAM), CD-ROM, magnetic tape, floppy disk, and optical data storage device.

[0180] In an exemplary embodiment, this application also provides a computer program product including one or more instructions, which can be executed by the processor 401 of an electronic device to complete the adaptive vulnerability protection method based on dynamic game theory in the above embodiments.

[0181] It should be noted that when one or more instructions in the computer-readable storage medium or computer program product are executed by the processor of an electronic device, they implement the various processes of the above method embodiments and achieve the same technical effect as the above method. To avoid repetition, they will not be described again here.

[0182] Through the above description of the embodiments, those skilled in the art can clearly understand that, for the sake of convenience and brevity, only the division of the above functional modules is used as an example. In actual applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above.

[0183] In the several embodiments provided in this application, it should be understood that the disclosed apparatus and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of modules or units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another apparatus, or some features may be ignored or not executed. Furthermore, the mutual coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between apparatuses or units may be electrical, mechanical, or other forms.

[0184] The units described as separate components may or may not be physically separate. A component shown as a unit can be one or more physical units; that is, it can be located in one place or distributed in multiple different locations. Some or all of the classified units can be selected to achieve the purpose of this embodiment, depending on actual needs.

[0185] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0186] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a readable storage medium. Based on this understanding, the technical solution of the embodiments of this application, essentially, or the part that contributes to the prior art, or a complete or partial classification of the technical solution, can be embodied in the form of a software product. This software product is stored in a storage medium and includes several instructions to cause a device (which may be a microcontroller, chip, etc.) or processor to execute all or part of the steps of the methods of the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, ROM, RAM, magnetic disks, or optical disks.

[0187] The above are merely specific embodiments of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. An adaptive vulnerability protection method based on dynamic game theory, characterized in that, include: A three-dimensional feature set of network traffic is collected by a distributed probe cluster. The three-dimensional feature set includes protocol stack layer features, session timing features, and protocol state machine transition features. The three-dimensional feature set is input into a detection engine that integrates a generative adversarial network and a transfer learning module, and the engine outputs a dynamically weighted target anomaly score. The generative adversarial network is used for protocol feature reconstruction difference detection, and the transfer learning module is used for cross-domain attack feature alignment. An initial protection strategy is generated based on the game tree model and the target anomaly score. The game tree model is configured with an attack path prediction module and a defense effectiveness evaluation module. The initial protection strategy includes dynamic firewall rules, detection sensitivity parameters, and decoy node topology configuration. A three-dimensional tensor containing policy type, time window number, and network region identifier is constructed, and cross-dimensional correlation features of the three-dimensional tensor are extracted through a multi-head attention mechanism to generate a policy feature matrix with spatiotemporal encoding. The evolution trend of the policy feature matrix is ​​detected by using a sliding time window to identify the temporal dependencies between policy parameters; When the similarity of the strategy feature matrix is ​​less than the preset similarity in multiple consecutive time windows, the historical strategy decision-making model is transferred through knowledge distillation technology. Based on the migrated historical strategy decision model, incremental learning is performed on mutated network attacks to generate target protection strategies.

2. The method according to claim 1, characterized in that, The step of inputting the three-dimensional feature set into a detection engine integrating generative adversarial networks and transfer learning modules, and outputting a dynamically weighted target anomaly score, includes: The protocol features are reconstructed using the decoder of the generative adversarial network, and a protocol-level anomaly score is calculated. The session temporal distribution anomaly score is calculated using the maximum mean difference metric of the transfer learning module. Based on the proportion of encryption protocols in real-time traffic, the fusion weight coefficient of the protocol layer anomaly score and the session timing distribution anomaly score is dynamically adjusted.

3. The method according to claim 2, characterized in that, The method further includes: Construct an attacker's payoff function, which includes vulnerability exploitation time cost and attack payload concealment score; Construct a defender's profit function, which includes rule set coverage and policy switching latency penalty factor; Set node expansion constraints that include the maximum defense decision delay threshold and the minimum policy activation interval; The game tree model is generated based on the attacker's payoff function, the defender's payoff function, and the constraints.

4. The method according to claim 1, characterized in that, The method further includes: When an attack feature that does not hit the local policy library is detected, the cloud matching degree of the protection policy in the cloud policy library is calculated. The cloud matching degree includes feature coverage overlap rate and decision path similarity. If the cloud-based matching degree is greater than the matching degree of the target protection policy, the target protection policy is replaced with the protection policy with the highest cloud-based matching degree.

5. The method according to claim 4, characterized in that, The method further includes: A policy rollback will be executed if any of the following conditions are met: The false alarm rate per unit time is greater than or equal to the preset false alarm rate; The number of compliance verification failures for critical business traffic is greater than or equal to the preset number; The attack signature detection rate is less than or equal to the preset detection rate.

6. An adaptive vulnerability protection device based on dynamic game theory, characterized in that, The device includes: The acquisition unit is used to collect a three-dimensional feature set of network traffic through a distributed probe cluster. The three-dimensional feature set includes protocol stack level features, session timing features, and protocol state machine transition features. The processing unit is used to input the three-dimensional feature set into a detection engine that integrates a generative adversarial network and a transfer learning module, and output a dynamically weighted target anomaly score. The generative adversarial network is used for protocol feature reconstruction difference detection, and the transfer learning module is used for cross-domain attack feature alignment. The generation unit is used to generate an initial protection strategy based on the game tree model and the target anomaly score. The game tree model is configured with an attack path prediction module and a defense effectiveness evaluation module. The initial protection strategy includes dynamic firewall rules, detection sensitivity parameters and decoy node topology configuration. The generating unit is also used for: A three-dimensional tensor containing policy type, time window number, and network region identifier is constructed, and cross-dimensional correlation features of the three-dimensional tensor are extracted through a multi-head attention mechanism to generate a policy feature matrix with spatiotemporal encoding. The evolution trend of the policy feature matrix is ​​detected by using a sliding time window to identify the temporal dependencies between policy parameters; When the similarity of the strategy feature matrix is ​​less than the preset similarity in multiple consecutive time windows, the historical strategy decision-making model is transferred through knowledge distillation technology. Based on the migrated historical strategy decision model, incremental learning is performed on mutated network attacks to generate target protection strategies.

7. An electronic device, characterized in that, include: processor; Memory used to store the processor's executable instructions; The processor is configured to execute the instructions to implement the method described in any one of claims 1 to 5.

8. A computer-readable storage medium storing instructions, characterized in that, When the computer executes the instruction, the computer performs the method described in any one of claims 1 to 5.

Images