Dynamic defense switching cycle optimization methods, devices, media and electronic equipment

Abstract

This invention provides a method, apparatus, medium, and electronic device for optimizing dynamic defense switching cycles, including: initializing defense resources and attack surface reset time; defining strategy space constraints for the defense switching cycle; defining a game framework; constructing attack and defense payoff functions; initializing a particle swarm; calculating the fitness value of each particle; iteratively updating the particle's velocity and position and calculating the updated particle's fitness value; determining whether to update the individual optimal solution and the global optimal solution based on the updated particle fitness value, the original individual optimal solution, and the global optimal solution; terminating the iteration when a preset iteration termination condition is met, thus obtaining the Nash equilibrium strategy of both the attacker and defender; and extracting the switching cycle from the Nash equilibrium strategy as the optimal dynamic defense switching cycle. Applying this method enables a comprehensive analysis of the dynamic balance between the strategies of both the attacker and defender, yielding an optimal dynamic defense switching cycle that balances defense effectiveness and system stability.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a method for optimizing dynamic defense switching cycles. Background Technology

[0002] In the field of cybersecurity, Advanced Persistent Threats (APTs) are a highly challenging type of attack. They are highly covert, have long attack cycles, and attackers typically possess ample resources and clear objectives, specifically targeting critical objectives for precise penetration. Traditional static defense methods are ineffective in countering them. To address APT threats, network defense has shifted towards a proactive defense approach, with Moving Target Defense (MTD) emerging as a core technology. MTD dynamically adjusts the system's attack surface (such as IP addresses and ports) to continuously disrupt the attacker's reconnaissance and attack chain stability, increasing the difficulty of penetration and becoming a crucial means of combating APTs. When using MTD technology to address Advanced Persistent Threats (APTs), the scientific setting of the defense switching cycle is a core issue in ensuring the effectiveness of the defense.

[0003] The defense switching cycle, as a key parameter of the MTD strategy, directly determines the frequency of dynamic adjustment of the attack surface. The length of the cycle directly affects the balance of two core dimensions. On the one hand, the cycle needs to be short enough to compress the attacker's effective attack window and prevent them from establishing a stable attack chain through continuous reconnaissance and penetration. On the other hand, the cycle cannot be too short, otherwise frequent attack surface migration will lead to system resource overload, service interruption or stability degradation, increasing the system's own operating costs and availability loss.

[0004] The impact of the defense switching cycle on the core dimensions of MTD technology directly reveals the core contradiction in setting the defense switching cycle. Meanwhile, the characteristics of APT attacks further exacerbate the complexity of cycle setting: APT attacks are highly stealthy and persistent, and the time it takes for an attack to succeed is significantly random (i.e., the time it takes for an attacker to successfully control the target from initiating an attack is not a fixed value, but a random variable influenced by various factors such as attack intensity and the target system's defense status). This means that the setting of the defense cycle must fully consider the uncertainty of the attack process in order to accurately match the attack rhythm and effectively reset the attack process. Therefore, how to comprehensively weigh the randomness of the attack success time and the system availability loss during defense switching in dynamic attack and defense scenarios, and establish a scientific and quantitative theoretical model to determine the optimal defense switching cycle, has become a key problem that urgently needs to be solved in the practical application of mobile target defense technology.

[0005] Therefore, it is necessary to provide a dynamic defense switching cycle optimization method that can balance defense effectiveness and system stability. Summary of the Invention

[0006] The purpose of this invention is to provide a method for optimizing the dynamic defense switching cycle, so as to select the optimal dynamic defense switching cycle that balances defense effectiveness and system stability.

[0007] In a first aspect, the dynamic defense switching cycle optimization method provided by this invention includes: initializing defense resources and attack surface reset time, defining the strategy space constraints of the defense switching cycle; defining a game framework, including defining the strategy space of the defender and the attacker, the attack activation delay, the attack initiation mechanism, and the duration of the attacker's control over resources; constructing an attack and defense benefit function based on the effective time ratio of the defender's actual control over resources within a unit cycle and the net benefit of the attacker successfully controlling resources; initializing a particle swarm, calculating the fitness value of each particle, setting each particle as the individual optimal solution, comparing and determining the global optimal solution, iteratively updating the velocity and position of the particles and calculating the updated particle fitness value, determining whether to update the individual optimal solution and the global optimal solution based on the updated particle fitness value, the original individual optimal solution, and the global optimal solution, terminating the iteration when a preset iteration termination condition is met, and obtaining the Nash equilibrium strategy of both the attacker and the defender; and extracting the switching cycle from the Nash equilibrium strategy as the optimal dynamic defense switching cycle.

[0008] The beneficial effects of the dynamic defense switching cycle optimization method provided by this invention are as follows: When designing the dynamic defense switching cycle optimization, the migration time of the defense switching (i.e., the attack surface reset time) is considered as a defense cost, breaking the assumption of "instantaneous switching" in traditional methods. This makes the cost calculation of the defense strategy more closely aligned with actual system service interruption scenarios. Furthermore, it considers the time required for an attacker to successfully launch an attack. The randomness of this approach, compared to the traditional fixed attack time setting, better aligns with the multi-stage randomness of attack behavior in the network kill chain. The resulting game theory framework, when applied, can comprehensively analyze the dynamic balance between the strategies of both attackers and defenders, providing more precise theoretical guidance for selecting the optimal defense cycle and yielding the optimal dynamic defense switching cycle that balances defense effectiveness and system stability.

[0009] In one possible embodiment, defining the policy spaces of the defender and the attacker includes: defining the defender's action as performing attack surface switching at a set switching period, requiring the switching period to be greater than the attack surface reset time, and the defender's policy space is a set of legal switching periods; defining the attacker's action as selecting an attack rate to launch an attack, and the attacker's policy space is a set of valid attack rates.

[0010] In another possible embodiment, the calculation of the duration of the attacker's control over the resources satisfies the following formula: ,in, Indicates the switching cycle. Indicates the migration time. This indicates the time it took for the attacker to successfully compromise the system. The probability density function represents the time it takes for an attack to succeed.

[0011] Other possible embodiments, constructing an attack-defense benefit function based on the effective time percentage of resources actually controlled by the defender within a unit period and the net gain of the attacker successfully controlling resources, includes: defining the defender's benefit function as the proportion of the effective time the defender controls resources within a switching period, and the calculation of the defender's benefit function satisfies the following formula: ,in, Indicates the switching cycle. This indicates the duration for which the attacker controls the resources. This represents the attack surface reset time; the attacker's profit function is defined as the net gain the attacker gains from successfully controlling resources during an effective defense period. The attacker's profit function is calculated according to the following formula: = - ,in, This represents the unit revenue from controlled resources. This represents the cost per unit rate of the attack. Indicates the attack rate.

[0012] Calculating the fitness value of each particle includes: calculating the particle's fitness value based on the attack / defense payoff function and the particle's attack / defense strategy solution; the fitness value calculation satisfies the following formula: F( )= ,in, Indicates the first One particle, Represents the defender's profit function. Indicates the first Solution to the attack and defense strategies of individual particles. This represents the attacker's profit function.

[0013] The decision to update the individual optimal solution and the global optimal solution is based on the updated particle fitness value, the original individual optimal solution, and the global optimal solution. This includes: comparing the updated particle fitness value with the fitness value of the original individual optimal solution, and updating the individual optimal solution if the updated particle fitness value is larger; comparing the updated particle fitness value with the fitness value of the original global optimal solution, and updating the global optimal solution if the updated particle fitness value is larger.

[0014] Iteration is terminated when the preset iteration termination conditions are met, including when the number of iterations reaches the preset maximum number of iterations or when the change in the fitness value of the global optimal solution is less than a preset threshold.

[0015] Secondly, the present invention also provides a dynamic defense switching cycle optimization device, comprising: an initialization unit for initializing defense resources and attack surface reset time, and defining the strategy space constraints of the defense switching cycle; a game framework construction unit for defining the game framework, including defining the strategy space of the defender and the attacker, the attack activation delay, the attack initiation mechanism, and the duration of the attacker's control over resources; a payoff function construction unit for constructing an attack and defense payoff function based on the effective time ratio of the defender's actual control over resources within a unit cycle and the net payoff of the attacker's successful control over resources; a solution unit for initializing the particle swarm, calculating the fitness value of each particle, setting each particle as the individual optimal solution, comparing and determining the global optimal solution, iteratively updating the velocity and position of the particles and calculating the updated particle fitness value, determining whether to update the individual optimal solution and the global optimal solution based on the updated particle fitness value, the original individual optimal solution, and the global optimal solution, terminating the iteration when a preset iteration termination condition is met, and obtaining the Nash equilibrium strategy of the attacker and the defender; and a switching cycle extraction unit for extracting the switching cycle from the Nash equilibrium strategy as the optimal dynamic defense switching cycle.

[0016] Thirdly, the present invention also provides a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the above-described dynamic defense switching cycle optimization method.

[0017] Fourthly, the present invention also provides an electronic device, comprising: a processor and a memory; the memory being used to store a computer program; the processor being used to execute the computer program stored in the memory, so that the electronic device performs the above-described dynamic defense switching cycle optimization method.

[0018] For the beneficial effects of the second to fourth aspects mentioned above, please refer to the description of the first aspect mentioned above. Attached Figure Description

[0019] Figure 1 A flowchart illustrating a dynamic defense switching cycle optimization method provided in an embodiment of the present invention;

[0020] Figure 2 A schematic diagram of a dynamic defense model provided in an embodiment of the present invention;

[0021] Figure 3 A schematic diagram of a dynamic defense switching cycle optimization device provided in an embodiment of the present invention;

[0022] Figure 4 This is a schematic diagram of an electronic device structure provided in an embodiment of the present invention. Detailed Implementation

[0023] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions in the embodiments of this invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this invention. All other embodiments obtained by those skilled in the art based on the embodiments of this invention without inventive effort are within the scope of protection of this invention. Unless otherwise defined, the technical or scientific terms used herein should have the ordinary meaning understood by those skilled in the art. The terms "comprising" and similar expressions used herein mean that the element or object preceding the word covers the element or object listed following the word and its equivalents, but do not exclude other elements or objects.

[0024] This embodiment provides a method for optimizing the dynamic defense switching cycle. See the appendix to the specification. Figure 1 The method includes:

[0025] S101: Initialize defense resources and attack surface reset time, and define the policy space constraints of the defense switching cycle.

[0026] In one possible embodiment, system resources are reset using Mobile Target Defense (MTD) technology to determine the attack surface transition time (i.e., the service interruption time during defense switching) and define the policy space constraints of the defense switching cycle—the cycle must be a positive real number greater than the transition time (only a feasible range is set, without presetting a specific cycle value).

[0027] For example, for host resources that both the attacker and defender can seize (i.e., hosts that both sides may gain control of through attack or defense), the defender performs an initial resource reset operation before the game begins. This involves selecting mobile target defense technologies such as IP hopping and system version switching to fully reset the host resources, clearing old system information and updating it to a new state. This ensures that the core characteristics of the host (such as network identifiers and system configurations) have been refreshed after the reset, and the game begins with the defender stably gaining control of the resource.

[0028] Because the process of switching and resetting the attack surface of host resources using mobile target defense technology is not instantaneous, it takes a certain amount of time. During this time, the host resources cannot provide services, so the defender does not gain any benefit, and attackers cannot perform attack detection. The reset time is determined by the specific mobile target defense technology used, and is usually set to a fixed value based on practical experience. Taking "dynamic port switching" as an example: To prevent attacks, the server periodically switches its external service ports from old ports to new ports (e.g., from port 8080 to port 9090). During the switch, the old port listening must first be closed, and the new port service must be configured and started. During the period from when the old port is closed to when the new port provides a stable response, the server cannot receive client requests, and attackers cannot perform scans or attacks through the old or new ports. If the process of switching and resetting the host resource attack surface takes 15 seconds, then the set attack surface reset time... .

[0029] After completing the initial resource reset, the policy space constraints for the defense switching cycle need to be defined. The defense switching cycle refers to the time interval between two adjacent host resource attack surface reset operations. Its policy space must satisfy two constraints: the cycle must be a positive real number greater than 0, and it must be strictly greater than the switching time of a single reset. This is to avoid the period being less than or equal to If the previous reset is not completed before the next operation is triggered, the host resources will remain unavailable. At the same time, during the reset, the host is in a state where it cannot provide services or has a temporarily interrupted network connection because it needs to shut down old services and configure new features (such as changing IP, port, etc.). During this time, the defender cannot obtain service benefits through the host.

[0030] S102: Define the game theory framework, including defining the strategy space of the defender and the attacker, the attack activation delay, the attack initiation mechanism, and the duration of the attacker's control over resources.

[0031] In one possible embodiment, defining the policy spaces of the defender and the attacker includes: defining the defender's action as performing attack surface switching at a set switching period, requiring the switching period to be greater than the attack surface reset time, and the defender's policy space is a set of legal switching periods; defining the attacker's action as selecting an attack rate to launch an attack, and the attacker's policy space is a set of valid attack rates.

[0032] In one possible embodiment, the calculation of the duration of the attacker's control over the resources satisfies the following formula: ,in, Indicates the switching cycle. Indicates the migration time. This indicates the time it took for the attacker to successfully compromise the system. The probability density function represents the time it takes for an attack to succeed.

[0033] For example, see the appendix to the specification. Figure 2 The defenders use a fixed period Take action to switch the system's attack surface; after each switch, resource ownership reverts to the defender. The defender's actions are defined as periodic... The attack surface should be switched periodically, requiring... > The defender's policy space is the set of all legal switching cycles, mathematically represented as: ={ | ∈ , > },in For positive real numbers, the constraints are... > Ensure that the switching cycle is longer than the conversion time to guarantee the feasibility of the strategy.

[0034] The attack effectiveness delay is defined as follows: when the attack surface transition is complete and system services recover, the attacker can launch an attack on host resources. After the attacker launches the attack, their acquisition of control over the resources is not instantaneous but delayed. Specifically, if the attack is launched at time t, the time at which they successfully establish control and acquire ownership of the resources is t+... ,in Representing a random time variable, from a probability distribution It was extracted from [the source].

[0035] In one possible implementation, the probability distribution is set to follow a Weibull probability distribution. The Weibull probability distribution satisfies the non-negativity of attack time, and when the shape parameter of the probability distribution is greater than 1, it can characterize the attack success rate as increasing over time ("the later it goes, the easier it is to succeed"), which conforms to the attack characteristics.

[0036] The attack initiation mechanism is defined as follows: Because the defender's resource reset process causes the host to... The system is unable to provide services for a period of time (manifested as network connection interruption, service unresponsiveness, or failure of old access paths). Attackers can perceive changes in resource status through continuous network scanning, service probing, and other means. When the target resource is detected to switch from an unresponsive state to an accessible state (such as a new IP / port responding to the request, or service features becoming visible again), the attacker determines that the defender's resource reset operation has been completed, and the attacker launches an attack after the resource switch is completed.

[0037] An attacker's action is defined as choosing to launch an attack at an attack rate r, where the attack rate r is the delay that controls the attack's effectiveness. The core parameters of the probability distribution shape directly determine its value. The specific characteristics of the probability distribution. When the attack rate *r* is low, it indicates a weaker attack intensity. At this time, the probability density of the probability distribution within the small value range (i.e., effective in the short term) is significantly reduced, meaning the attacker is less likely to successfully establish resource control in a short period. A lower attack rate results in the following shape of the probability distribution: the peak of the probability density curve shifts towards a greater delay and the peak becomes lower; the probability of short-term effectiveness decreases significantly, while the probability of long-term effectiveness increases significantly, resulting in a longer distribution "tail." Conversely, an increased attack rate results in the following shape: the peak of the probability density curve shifts towards a smaller delay and the peak becomes higher; the probability of short-term effectiveness increases significantly, while the probability of long-term effectiveness decreases significantly, resulting in a shorter distribution "tail." Adjusting *r* directly controls the probability density distribution characteristics for different delay values. The attacker's policy space is defined as the set of all effective attack rates, i.e. ={r|r∈ This set encompasses all strategy choices that can influence the probability distribution of attack effectiveness delay by adjusting the attack rate.

[0038] In one possible implementation, the attack rate r is defined to satisfy r a / rc, where r a `r` represents the number of requests sent per second, while `rc` represents the target system's defense criticality rate, i.e., the attack rate threshold that triggers the alarm system (assuming this parameter is known to both parties). The value of `r` ranges from [0, 1]. When `r ∈ [0, 0.3]`, it is defined as a low attack rate, where the attack intensity is far below the target system's defense criticality, and the attacker is less likely to successfully establish resource control in a short period of time. When `r ∈ [0.8, 1]`, it is defined as a high attack rate, where the attack intensity is close to or reaches the target system's defense criticality, and the attacker is more likely to successfully establish resource control in a short period of time.

[0039] Attacker controls resource duration This refers to the expected duration for which an attacker successfully controls resources within each game (i.e., one defense switching cycle). When the defender uses a cycle... ( > When switching defenses, or when an attacker launches an attack at an attack rate r, Specifically, this refers to the effective defense time during the switching cycle ( - Within a given period, this represents the average duration for which an attacker successfully controls a resource. The duration of resource control is calculated using the following formula: ,in, Indicates the switching cycle. Indicates the migration time. This indicates the time it took for the attacker to successfully compromise the system. The honeycomb function represents the probability of a successful attack. Let r be the corresponding cumulative distribution function, and r represent the attack rate. This represents a measure of attack surface security. The calculation of attacker control time over resources quantifies the average control time of the attacker within a defense cycle through integration, taking into account attack rate. and attack surface security metrics The impact.

[0040] S103: Construct an attack and defense benefit function based on the effective time percentage of resources actually controlled by the defender within a unit period and the net gain of the attacker successfully controlling resources.

[0041] In one possible embodiment, the defender's profit function is defined as the proportion of the effective time the defender controls resources within a given period to the switching period. The calculation of the defender's profit function satisfies the following formula: ,in, Indicates the switching cycle. This indicates the duration for which the attacker controls the resources. This indicates the attack surface reset time. The attacker's profit function is defined as the net gain the attacker receives from successfully controlling resources during an effective defense period. The attacker's profit function is calculated according to the following formula: = - ,in, This represents the unit revenue from controlled resources. This represents the cost per unit rate of the attack. Indicates the attack rate.

[0042] For example, the defender's profit function The net gain in resource control during dynamic defense is represented by the proportion of the effective time the defender actually controls the resources within the switching cycle. Game theory calculates the average gain within a switching cycle, assuming the defender uses a strategy... Execute system attack surface switching (migration time) (Including the cost of the defender), the duration for which the attacker successfully controls the resource within a cycle is... Then the time the defending side controls the resources is The defender's profit function expression is: .

[0043] Attacker's Profit Function The net gain from successfully controlling resources in an offensive-defensive game is defined as the gain from successfully controlling resources minus the attack cost. If the attacker chooses to launch an attack at an attack rate r, the cost per unit rate is... The unit revenue of controlled resources is And the duration of a successful attack is Then during the effective defense period - The gain function expression for an insider attacker is: = - .

[0044] S104: Initialize the particle swarm, calculate the fitness value of each particle, set each particle as the individual optimal solution, compare and determine the global optimal solution, iteratively update the velocity and position of the particles and calculate the updated particle fitness value, determine whether to update the individual optimal solution and the global optimal solution based on the updated particle fitness value, the original individual optimal solution and the global optimal solution, terminate the iteration when the preset iteration termination condition is met, and obtain the Nash equilibrium strategy of the attacking and defending sides.

[0045] In one possible implementation, the fitness function of a particle is defined as the sum of the gains for both attackers and defenders, specifically satisfying the following formula: F( )= ,in, Indicates the first One particle, Represents the defender's profit function. Indicates the first Solution to the attack and defense strategies of individual particles. This represents the attacker's profit function.

[0046] The decision to update the individual optimal solution and the global optimal solution is based on the updated particle fitness value, the original individual optimal solution, and the global optimal solution. This includes: comparing the updated particle fitness value with the fitness value of the original individual optimal solution, and updating the individual optimal solution if the updated particle fitness value is larger; comparing the updated particle fitness value with the fitness value of the original global optimal solution, and updating the global optimal solution if the updated particle fitness value is larger.

[0047] The preset iteration termination conditions include the maximum number of iterations and the fitness value change threshold. That is, the iteration will terminate when the number of iterations reaches the maximum number of iterations or the fitness value change of the global optimal solution is less than the set threshold.

[0048] For example, applying the particle swarm optimization algorithm to iteratively optimize the solution includes setting a maximum number of iterations and a fitness value change threshold.

[0049] Initialize the particle swarm: Set the particle swarm size to N, where each particle represents a set of attack and defense strategy solutions, including the defender's switching cycle. And the attacker's attack rate r. Let the first... One particle is =( , ), =1,2,⋯,N, and ∈ , ∈ Randomly initialize the particle's position in the solution space, and simultaneously initialize the particle's velocity. =( , ),in, Let represent the initial velocity of the i-th particle in the strategy dimension of "defender switching cycle". Let represent the initial velocity of the i-th particle in the policy dimension of "attacker's attack rate". Define the global optimal solution. =( , and the individual optimal solution for each particle. =( , In this process, the initial position of each particle is set as its individual optimal solution. The fitness values ​​of all particles are compared, and the position of the particle with the highest fitness value is set as the global optimal solution. The fitness value of a particle is calculated using the following formula: F( )= ,in, Indicates the first One particle, Represents the defender's profit function. Indicates the first Solution to the attack and defense strategies of individual particles. This represents the attacker's profit function.

[0050] Particle updates and optimal solution iterations include updating the particle velocity and position in each iteration according to the following formula: ,in, This represents the updated velocity of the i-th particle in the (k+1)-th iteration, corresponding to the "defense switching cycle" strategy dimension. Indicates inertia weight, Indicates the number of iterations. and Represents the learning factor. and express Random numbers within a range Indicates the first In each iteration, the switching cycle of the individual optimal solution corresponding to the "individual optimal solution" of the i-th particle. Indicates the first In the next iteration, the switching cycle corresponding to the "global optimal solution" of the i-th particle. Indicates the first In each iteration, the switching period corresponding to the "global optimal solution" for all particles. This represents the updated velocity of the i-th particle in the (k+1)-th iteration, corresponding to the policy dimension of "attacker's attack rate". This represents the attacker's attack rate corresponding to the "individual optimal solution" of the i-th particle in the k-th iteration. This represents the current attacker attack rate (the policy value before update) of the i-th particle in the k-th iteration. This represents the attacker's attack rate corresponding to the "global optimal solution" for all particles in the k-th iteration. After the update, if the particle position exceeds the policy space range (i.e., ... or If the boundary condition is not met, then boundary adjustments are performed. The fitness value of the updated particles is then calculated. ,like Then update the individual optimal solution. Simultaneously, if a particle's fitness value is better than the current global optimum, then update... .

[0051] The iteration terminates when the maximum number of iterations is reached, or when the fitness value of the global optimal solution changes less than a set threshold over several consecutive iterations.

[0052] When the iteration terminates, the globally optimal solution is obtained as the Nash equilibrium strategy of both the attacker and defender, that is, the optimal strategy combination is obtained. The optimal strategy combination obtained by this method The following conditions must be met: ( , )≥ ( , ), , ( , )≥ ( , ), r .

[0053] S105: Extract the switching cycle from the Nash equilibrium strategy as the optimal dynamic defense switching cycle.

[0054] In one possible embodiment, applying the switching cycle extracted from the Nash equilibrium strategy as the optimized dynamic defense switching cycle can balance the defense effectiveness of the moving target defense technology with system stability.

[0055] In a specific embodiment, the process of selecting the optimal dynamic defense switching cycle using the dynamic defense switching cycle optimization method is as follows: During the initialization phase, the defender selects IP hopping technology as the initial strategy. This technology has a security metric of 98. For example, by switching the server IP address from 192.168.1.100 to 192.168.1.150, resource state initialization is completed. The migration time t for this technology... m Set to 3 seconds, which is the attack surface reset time. Defender strategy space. Defined as all that satisfy A set of switching cycles of >15 seconds.

[0056] After the attack surface conversion is completed (i.e., t) m An attack can be launched after 15 seconds. Assuming the attack is successful, the time taken is t. a If it follows a Weiber distribution, then its probability density function is... With cumulative distribution function P for: = P = ,in, Indicates the scale parameter.

[0057] Define the attacker's unit rate cost based on the actual situation. Controlling the unit revenue of resources 1.5, the shape parameter k=2 in the probability distribution (this parameter describes the trend of attack success probability over time; when k=2, the attack success rate increases over time, which conforms to the actual law of most network attacks that "accumulate attack resources over time and gradually increase the success probability"), and the scale parameter λ= = .

[0058] Calculate the average time an attacker controls resources over a game cycle: )- .

[0059] Define the payoff functions for defenders and attackers. and :

[0060] = t c - t m -[ ( t c - t m ) - ∫ 0 t c - t m e -( r · t a T AS ¯ ) k d t a ] t c ,

[0061] .

[0062] In the iterative phase of the particle swarm optimization algorithm for attack and defense game, the system sets the maximum number of iterations Max_iter=1000, the fitness change threshold ε=0.01, the particle swarm size N=30, and each particle represents a set of attack and defense strategy solutions. Initially, particle positions are randomly generated, with the defender switching cycle... ∈(15,100) seconds (ensure) >t m =15 seconds), the attacker's attack rate r∈[0,1], and the particle velocity is initialized to a random value within the range [0,1]. The algorithm uses the standard particle swarm optimization algorithm update formula, with inertia weight w=0.7 and learning factors c1=c2=1.5. In each iteration, the particles are updated according to the current global optimal solution. and individual historical optimal solution Adjust speed and position. The fitness function is defined as the sum of the gains for both attackers and defenders, i.e., F( )= .

[0063] The optimal strategy obtained by joint solution is The Nash equilibrium strategy combination of the offensive and defensive sides The following conditions must be met: ( , )≥ ( , ), , ( , )≥ ( , ), r .

[0064] The dynamic defense switching cycle optimization method provided by this invention abstracts the dynamic confrontation between offense and defense into a game process, clarifying the strategy space and interaction rules of both parties. The defender's core strategy is to select a defense switching cycle (dynamically adjusting the frequency of the system's attack surface), and the cycle must be greater than the attack surface transition time to ensure feasibility. The attacker's core strategy is to select an attack rate, which directly affects the time characteristics of their successful resource control. Through this framework, offensive and defensive behaviors are transformed into a quantifiable strategy interaction model. The definition of the game framework fully considers the uncertainty of the attack process, defining the time from the attacker initiating an attack to successfully controlling resources as a random variable, using a probability distribution to describe its randomness, reflecting the success time pattern under different attack intensities. Simultaneously, the service interruption time during defense switching (attack surface transition time) is included in the defense cost considerations, ensuring that the model fits the actual scenario where system availability is affected. This solves the problems of experience-dependent strategy rigidity, key assumptions of theoretical models being out of touch with reality, and the imbalance between system availability and defense effectiveness in existing dynamic defense switching cycle design schemes, leading to a lack of scientific rigor and effectiveness in defense cycle selection.

[0065] When applying the method of this invention to optimize the dynamic defense switching cycle, the migration time of the defense switching (i.e., the attack surface reset time) is considered as part of the defense cost. This breaks the assumption of "instantaneous switching" in traditional methods, making the cost calculation of the defense strategy more closely reflect actual system service interruption scenarios. Furthermore, it considers the time required for an attacker to successfully launch an attack. The randomness, through probability distribution Characterizing the uncertainty of the attack process, compared to the traditional fixed attack time setting, better reflects the multi-stage randomness of attack behavior in the network kill chain. Furthermore, by using the attacker's attack rate *r* as a policy variable, the dual impact of attack intensity on success probability and attack cost is quantified. This allows the constructed game theory framework to comprehensively analyze the dynamic balance between the strategies of both attackers and defenders, providing more precise theoretical guidance for selecting the optimal defense cycle and yielding the optimal dynamic defense switching cycle that balances defense effectiveness and system stability.

[0066] See the instruction manual appendix Figure 3 This embodiment also provides a dynamic defense switching cycle optimization device, which is used to implement the above method embodiment. The device includes:

[0067] Initialization unit 201 is used to initialize defense resources and attack surface reset time, and to define the policy space constraints of the defense switching cycle.

[0068] Game framework construction unit 202 is used to define the game framework, including defining the strategy space of the defender and the attacker, the attack activation delay, the attack initiation mechanism, and the duration of the attacker's control over resources.

[0069] The revenue function construction unit 203 is used to construct the attack and defense revenue function based on the effective time percentage of resources actually controlled by the defender within a unit period and the net revenue of the attacker successfully controlling resources.

[0070] Solver 204 is used to initialize the particle swarm, calculate the fitness value of each particle, set each particle as the individual optimal solution, compare and determine the global optimal solution, iteratively update the velocity and position of the particles and calculate the updated particle fitness value, and determine whether to update the individual optimal solution and the global optimal solution based on the updated particle fitness value, the original individual optimal solution and the global optimal solution. When the preset iteration termination condition is met, the iteration terminates and the Nash equilibrium strategy of the attacking and defending sides is obtained.

[0071] The switching cycle extraction unit 205 is used to extract the switching cycle from the Nash equilibrium strategy as the optimal dynamic defense switching cycle.

[0072] All relevant content of each step involved in the above method embodiments can be referenced from the functional description of the corresponding functional module, and will not be repeated here.

[0073] In other embodiments of this application, an electronic device is disclosed, such as... Figure 4 As shown, the electronic device 300 may include: one or more processors 301; a memory 302; a display 303; one or more application programs (not shown); and one or more computer programs 304. These devices can be connected via one or more communication buses 305. The one or more computer programs 304 are stored in the memory and configured to be executed by the one or more processors 301. The one or more computer programs 304 include instructions that can be used to perform actions such as... Figure 1 And the various steps in the corresponding embodiments.

[0074] Through the above description of the embodiments, those skilled in the art will clearly understand that, for the sake of convenience and brevity, only the division of the above functional modules is used as an example. In practical applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above. The specific working process of the system, device, and unit described above can be referred to the corresponding process in the foregoing method embodiments, and will not be repeated here.

[0075] In the embodiments of this application, the functional units can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0076] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solutions of the embodiments of this application, essentially, or the parts that contribute to the prior art, or all or part of the technical solutions, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) or processor to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as flash memory, portable hard disk, read-only memory, random access memory, magnetic disk, or optical disk.

[0077] The above description is merely a specific implementation of the embodiments of this application, but the protection scope of the embodiments of this application is not limited thereto. Any changes or substitutions within the technical scope disclosed in the embodiments of this application should be covered within the protection scope of the embodiments of this application. Therefore, the protection scope of the embodiments of this application should be determined by the protection scope of the claims.

Claims

1. A method for optimizing dynamic defense switching cycles, characterized in that, The method comprises the following steps: initializing a defense resource and an attack surface reset time, and defining a strategy space constraint of a defense switching period; defining a game framework, including defining a strategy space of a defender and an attacker, an attack effective time delay, an attack starting mechanism, and an attack resource control time length, wherein defining the strategy space of the defender and the attacker comprises: defining an action of the defender as performing attack surface switching at a set switching period, requiring that the switching period is greater than the attack surface reset time, and the strategy space of the defender is a set of legal switching periods; and defining an action of the attacker as selecting an attack rate to launch an attack, and the strategy space of the attacker is a set of effective attack rates; constructing an attack-defense benefit function according to an effective time proportion of the actual resource control of the defender in a unit period and a net benefit of the successful resource control of the attacker; initializing a particle swarm, calculating an adaptability value of each particle, setting each particle as an individual optimal solution, comparing and determining a global optimal solution, iteratively updating the speed and position of the particle and calculating the adaptability value of the updated particle, judging whether to update the individual optimal solution and the global optimal solution according to the adaptability value of the updated particle, the original individual optimal solution and the global optimal solution, terminating iteration when a preset iteration termination condition is met, and obtaining a Nash equilibrium strategy of the attack and defense sides; extracting the switching period from the Nash equilibrium strategy as an optimal dynamic defense switching period.

2. The method of claim 1, wherein, The calculation of the attacker control resource duration satisfies the following formula: wherein denotes the switching period, denotes the migration time, denotes the time taken by the attacker to successfully attack the system, denotes the probability density function of the attack success time.

3. The method of claim 1, wherein, The method comprises the following steps: The defender benefit function is defined as the proportion of the effective time of the defender controlling the resource in a switching cycle. The calculation of the defender benefit function satisfies the following formula: wherein, represents the switching cycle, represents the duration of the attacker controlling the resource, represents the attack surface reset time; The attacker benefit function is defined as the net benefit of the attacker successfully controlling the resource in the effective defense period, and the calculation of the attacker benefit function satisfies the following formula: = - , wherein represents the unit benefit of the controlled resource, represents the unit rate cost of the attack, represents the attack rate.

4. The method of claim 1, wherein, calculating the adaptability value of each particle comprises: calculating the adaptability value of the particle according to the attack-defense benefit function and the attack-defense strategy solution of the particle; Fitness values ​​are calculated according to the following formula: F( )= ,in, Indicates the first One particle, Represents the defender's profit function. Indicates the first Solution to the attack and defense strategies of individual particles. This represents the attacker's profit function.

5. The method of claim 1, wherein, judging whether to update the individual optimal solution and the global optimal solution according to the adaptability value of the updated particle, the original individual optimal solution and the global optimal solution, comprising: comparing the adaptability value of the updated particle with the adaptability value of the original individual optimal solution, updating the individual optimal solution when the adaptability value of the updated particle is greater, and comparing the adaptability value of the updated particle with the adaptability value of the original global optimal solution, updating the global optimal solution when the adaptability value of the updated particle is greater.

6. The method of claim 1, wherein, terminating iteration when a preset iteration termination condition is met comprises: terminating iteration when the number of iterations reaches a preset maximum number of iterations or the adaptability value of the global optimal solution changes by less than a preset threshold.

7. A dynamic defense handoff period optimization apparatus, comprising: The apparatus comprises: an initialization unit, configured to initialize a defense resource and an attack surface reset time, and define a strategy space constraint of a defense switching period; a game framework construction unit, configured to define a game framework, including defining a strategy space of a defender and an attacker, an attack effective time delay, an attack starting mechanism, and an attack resource control time length, wherein defining the strategy space of the defender and the attacker comprises: defining an action of the defender as performing attack surface switching at a set switching period, requiring that the switching period is greater than the attack surface reset time, and the strategy space of the defender is a set of legal switching periods; and defining an action of the attacker as selecting an attack rate to launch an attack, and the strategy space of the attacker is a set of effective attack rates; a benefit function construction unit, configured to construct an attack-defense benefit function according to an effective time proportion of the actual resource control of the defender in a unit period and a net benefit of the successful resource control of the attacker; A solving unit is configured to initialize a particle swarm, calculate a fitness value of each particle, set each particle as an individual optimal solution, compare and determine a global optimal solution, iteratively update a velocity and a position of each particle and calculate a fitness value of the updated particle, judge whether to update the individual optimal solution and the global optimal solution according to the fitness value of the updated particle, the original individual optimal solution and the global optimal solution, terminate the iteration when a preset iteration termination condition is met, and obtain a Nash equilibrium strategy of the attack and defense sides. A switching period extraction unit is configured to extract a switching period from the Nash equilibrium strategy as an optimal dynamic defense switching period.

8. A computer-readable storage medium having stored thereon a computer program, characterized in that, The computer program is executed by a processor to implement the dynamic defense switching period optimization method in any one of claims 1 to 6.

9. An electronic device, comprising: The computer program is executed by a processor to implement the dynamic defense switching period optimization method in any one of claims 1 to 6. The computer program is executed by a processor to implement the dynamic defense switching period optimization method in any one of claims 1 to 6. The computer program is executed by a processor to implement the dynamic defense switching period optimization method in any one of claims 1 to 6. ​

Images