Network threat analysis method and system based on learning evolutionary game
By learning from evolutionary game theory, a network threat analysis method and system have been established, which solves the problem of enterprises struggling to share and utilize network threat intelligence in a big data environment, thereby improving network security defense capabilities and intelligence sharing efficiency.
Patent Information
- Application Number
- CN202411714424.4
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-11-27
- Publication Date
- 2026-02-06
AI Technical Summary
Enterprises face difficulties in effectively sharing and utilizing cyber threat intelligence in a big data environment, making it hard to defend against large-scale and continuous cyberattacks.
By employing a learning-based evolutionary game theory approach, we can establish reasonable incentive strategies through modeling and analyzing the expected returns of sharing, thereby promoting the sharing and utilization of cyber threat intelligence. We can also use blockchain to store smart contracts to automatically approve enterprises joining the open community, and create a sharing model through learning-based evolutionary game theory to calculate expected returns to incentivize enterprises to share and query threat intelligence.
It improves cybersecurity defense capabilities, enhances intelligence sharing efficiency, reduces the resources required to acquire intelligence, and enables enterprises to better deploy cybersecurity defense measures.
Smart Images
Figure CN121485949A_ABST
Abstract
Description
TECHNICAL FIELD
[0001] The present application relates to the technical field of network security, and particularly relates to a network threat analysis method and system based on learning evolutionary game. BACKGROUND
[0002] With more and more network threat types in the big data environment, the static security control measures relying on border defense in the prior art are gradually being replaced by intelligent security means based on big data analysis, and gradually evolving from passive post-analysis to active pre-defense. Network threat intelligence sharing can improve the efficiency of network defense, however, many enterprises are difficult to provide a large amount of resources, and the data sharing and exchange ability is weak, and it is difficult to defend against a large number of and continuous network attacks.
[0003] Therefore, there is an urgent need for a network threat analysis method and system based on learning evolutionary game. SUMMARY
[0004] The present application aims to provide a network threat analysis method and system based on learning evolutionary game, by modeling and analyzing the expected income of sharing, using learning evolutionary game for quantitative analysis, obtaining a reasonable incentive strategy, so as to promote the sharing and utilization efficiency of network threat intelligence, and improve the network security defense capability.
[0005] In a first aspect, the present application provides a network threat analysis method based on learning evolutionary game, the method comprising:
[0006] An entity enterprise submits a registration request to an authentication server, the authentication server returns a digital certificate to the entity enterprise, the entity enterprise can perform encrypted communication with other entities according to the digital certificate, and can create a shared model and share threat intelligence with other entities;
[0007] According to the digital certificate, the entity enterprise joins an open community, the joining of the open community is automatically audited by a smart contract, and the smart contract is stored on a blockchain chain and provided for user calling;
[0008] The entity enterprise shares the threat intelligence obtained by itself with the open community, the threat intelligence comes from one or more of the following: self-network monitoring, intrusion detection system, intrusion prevention system, security information, event management system, network traffic, log data, and returns an incentive from the open community;
[0009] The open community first creates a sharing model based on a learning evolutionary game in the process of returning incentives, each entity carries its own digital certificate C in the shared threat intelligence, assuming that each entity is a bounded rationality participant, each entity selects to share threat intelligence with a certain probability P in the initial stage of the game, participating in the sharing of threat intelligence can obtain a certain income U, the higher the quality of the threat intelligence, the greater the coefficient w related to it, the above digital certificate C, probability P and coefficient w are input items of the sharing model, income U is the output item of the sharing model, and the optimal income U is the target for training the sharing model; each entity with bounded rationality participates in repeated game by using the sharing model, and the open community calculates the expected income of sharing according to the output income U, and returns it to each entity as an incentive;
[0010] The open community evaluates the quality of the threat intelligence shared by each entity, and shares the quality evaluation results in the open community, and the quality evaluation results are positively correlated with the coefficient w;
[0011] Each entity initiates a query request, and after identity verification, the open community returns threat intelligence meeting the query conditions to the entity, and the entity analyzes the threat intelligence obtained by querying and deploys its own network defense measures according to the analysis results.
[0012] In a second aspect, the application provides a network threat analysis system based on a learning evolutionary game, the system comprising: an entity, an authentication server, an open community and a blockchain;
[0013] The entity submits a registration request to the authentication server, and the authentication server returns a digital certificate to the entity, and the entity can communicate with other entities by encryption according to the digital certificate, and can create a sharing model and share threat intelligence with other entities;
[0014] According to the digital certificate, the entity joins the open community, and the joining of the open community is automatically audited by a smart contract, which is stored on a blockchain chain and provided for user calling;
[0015] The entity shares the threat intelligence obtained by itself to the open community, and the threat intelligence comes from one or more of the following: self-network monitoring, intrusion detection system, intrusion prevention system, security information, event management system, network traffic, log data, and returns an incentive from the open community;
[0016] In the process of returning incentives, the open community first creates a sharing model by the entities, the sharing model is based on a learning evolutionary game, each entity carries its own digital certificate C in the shared threat intelligence, it is assumed that each entity is a bounded rationality participant, in the initial stage of the game, each entity selects to share threat intelligence with a certain probability P, participating in sharing threat intelligence can obtain a certain benefit U, the higher the quality of the threat intelligence, the greater the coefficient w related to it, the above digital certificate C, probability P and coefficient w are used as input items of the sharing model, the benefit U is used as an output item of the sharing model, and the sharing model is trained to obtain the best benefit U as the goal; each entity with bounded rationality participates in repeated game by using the sharing model, and the open community calculates the expected benefit of sharing according to the output benefit U, and returns it to each entity as an incentive;
[0017] The open community evaluates the quality of the threat intelligence shared by each entity, and shares the quality evaluation result in the open community, and the quality evaluation result is positively correlated with the coefficient w;
[0018] Each entity initiates a query request, after identity verification, the open community returns threat intelligence meeting the query conditions to the entity, the entity analyzes the threat intelligence obtained by querying, and deploys its own network defense measures according to the analysis result.
[0019] In a third aspect, the application provides a network threat analysis system based on a learning evolutionary game, the system comprises: an entity, an authentication server, an intermediate device and a blockchain, the intermediate device comprises: a processor and a memory:
[0020] The memory is used to store program code and transmit the program code to the processor;
[0021] The processor is used to execute the method of any one of the various possibilities of the first aspect according to the instructions in the program code.
[0022] In a fourth aspect, the application provides a computer readable storage medium for storing program code, the program code is used to be executed by a processor to realize the method of any one of the various possibilities of the first aspect.
[0023] Advantages
[0024] The application provides a network threat analysis method and system based on learning evolutionary game, which models and analyzes shared expected income, adopts learning evolutionary game for quantitative analysis, and obtains reasonable incentive strategy, so as to promote the sharing and utilization efficiency of network threat intelligence, and each entity enterprise inquires the required threat intelligence from an open community, analyzes the threat intelligence, deploys own network defense measures, improves network security defense capability, and overcomes the problems that the prior art is difficult to provide a large amount of resources, has weak data sharing and exchange capability, and is difficult to defend against a large amount of and continuous network attacks.
[0025] The application has the following advantages and effects:
[0026] Through reasonable incentive, the sharing and utilization efficiency of network threat intelligence can be promoted.
[0027] Each entity enterprise obtains as much as possible corresponding detailed threat intelligence from an open community, can better deploy own network defense measures, improves defense capability, and reduces resources required for obtaining intelligence.
[0028] Intelligence sharing efficiency is improved. BRIEF DESCRIPTION OF DRAWINGS
[0029] In order to more clearly illustrate the technical solutions in the embodiments of the application, the following will briefly introduce the drawings needed to be used in the embodiments, and obviously, other drawings can also be obtained by those of ordinary skill in the art without any creative effort on the premise of not paying creative effort.
[0030] Figure 1 The flowchart of the network threat analysis method based on learning evolutionary game of the application;
[0031] Figure 2 The architecture diagram of the network threat analysis system based on learning evolutionary game of the application. DETAILED DESCRIPTION
[0032] The preferred embodiments of the application will be described in detail below with reference to the drawings, so that the advantages and features of the application can be more easily understood by those skilled in the art, and the protection scope of the application can be more clearly and definitely defined.
[0033] Figure 1 The rough flowchart of the network threat analysis method based on learning evolutionary game provided by the application, the method comprises:
[0034] An entity enterprise submits a registration request to an authentication server, the authentication server returns a digital certificate to the entity enterprise, the entity enterprise can perform encrypted communication with other entities according to the digital certificate, and can create a shared model and share threat intelligence together with other entities;
[0035] According to the digital certificate, the entity enterprise joins the open community, and the joining of the open community is automatically audited by a smart contract stored on a blockchain chain and provided for user calling;
[0036] The entity enterprise shares respective obtained threat intelligence with the open community, the threat intelligence coming from one or more of the following: own network monitoring, intrusion detection system, intrusion prevention system, security information, event management system, network traffic, log data, and returning incentives from the open community;
[0037] In the process of returning incentives, the open community first creates a sharing model together with the entity enterprises, the sharing model being based on a learning evolutionary game, each entity enterprise carrying its own digital certificate C in the shared threat intelligence, assuming that each entity enterprise is a limited rational participant, in the initial stage of the game, each entity enterprise selects to share threat intelligence with a certain probability P, participating in sharing threat intelligence can obtain a certain benefit U, the higher the quality of the threat intelligence, the greater the coefficient w related thereto, taking the above digital certificate C, probability P and coefficient w as input items of the sharing model, taking benefit U as an output item of the sharing model, and taking the best benefit U as a target to train the sharing model; each entity enterprise with limited rationality participates in repeated game by using the sharing model, and the open community calculates the expected benefit of sharing according to the output benefit U, and returns it to each entity enterprise as an incentive;
[0038] The open community evaluates the quality of the threat intelligence shared by each entity enterprise, and shares the quality evaluation results in the open community, the quality evaluation results being positively correlated with the coefficient w;
[0039] Each entity enterprise initiates a query request, after identity verification, the open community returns threat intelligence meeting the query conditions to the entity enterprise, the entity enterprise analyzes the threat intelligence obtained by querying, and deploys its own network defense measures according to the analysis results.
[0040] In some preferred embodiments, the network defense measures include data encryption, firewall settings, intrusion blocking, and redirection.
[0041] In some preferred embodiments, the threat intelligence further includes daily data and event behavior, the daily data and event behavior having a mapping relationship, the same event data feature vector being associated according to the mapping relationship, and the quality of the threat intelligence being improved.
[0042] The entity enterprise can also query the open community for threat intelligence quality evaluation results to determine whether the returned threat intelligence is the threat intelligence it needs. If so, analyze the threat intelligence and deploy appropriate defense measures. If not, feedback to the open community that the threat intelligence is too biased, adjust the coefficient w, restart the evolutionary game, calculate the new shared expected return, and get new incentives for each entity enterprise. Here, the incentive also includes punishment. For the entity enterprise that provides threat intelligence with too much bias, appropriate punishment will be imposed to improve the intelligence reliability of the entire system.
[0043] Figure 2 The architecture of the network threat analysis system based on learning evolutionary game provided in the present application includes entity enterprises, an authentication server, an open community, and a blockchain.
[0044] The entity enterprise submits a registration request to the authentication server, which returns a digital certificate to the entity enterprise. Based on the digital certificate, the entity enterprise can communicate with other entities in encrypted form and create a shared model with other entities and share threat intelligence.
[0045] According to the digital certificate, the entity enterprise joins the open community, which is automatically audited by a smart contract stored on the blockchain for user calls.
[0046] The entity enterprise shares its own threat intelligence with the open community, which comes from one or more of the following: its own network monitoring, intrusion detection system, intrusion prevention system, security information, incident management system, network traffic, and log data. The open community returns incentives to the entity enterprise.
[0047] In the process of returning incentives, the open community first creates a shared model with the entity enterprises. The shared model is based on learning evolutionary game. Each entity enterprise carries its own digital certificate C in the shared threat intelligence. Assuming that each entity enterprise is a limited rational participant, each entity enterprise selects to share threat intelligence with a certain probability P in the initial stage of the game. Participating in the sharing of threat intelligence can obtain a certain return U. The higher the quality of the threat intelligence, the greater the coefficient w related to it. The above digital certificate C, probability P, and coefficient w are used as input items of the shared model, and the return U is used as the output item of the shared model. The shared model is trained to achieve the best return U. Each entity enterprise with limited rationality uses the shared model to participate in repeated games. The open community calculates the expected return of sharing based on the output return U and returns it to each entity enterprise as an incentive.
[0048] The open community performs quality assessment on threat intelligence shared by each entity enterprise, and shares the quality assessment result in the open community, and the quality assessment result is positively correlated with the coefficient w;
[0049] Each entity enterprise initiates a query request, and after authentication, the open community returns threat intelligence meeting the query condition to the entity enterprise, and the entity enterprise analyzes the threat intelligence obtained through the query, and deploys network defense measures according to the analysis result.
[0050] The application provides a network threat analysis system based on learning evolution game, the system comprises an entity enterprise, an authentication server, an intermediate device and a blockchain, the intermediate device comprises a processor and a memory:
[0051] The memory is used for storing program code and transmitting the program code to the processor;
[0052] The processor is used for executing the method according to the instructions in the program code.
[0053] The application provides a computer readable storage medium for storing program code, the program code is used for being executed by a processor to realize the method in any one of all embodiments of the first aspect.
[0054] In specific implementation, the application further provides a computer storage medium, wherein the computer storage medium can store a program, and the program can include part or all steps in various embodiments of the application when executed. The storage medium can be a magnetic disk, an optical disk, a read-only memory (ROM) or a random access memory (RAM) and the like.
[0055] Those skilled in the art can clearly understand that the technology in the embodiments of the application can be realized by means of software and necessary general hardware platforms. Based on such understanding, the technical solutions in the embodiments of the application can be embodied in the form of a software product, which can be stored in a storage medium, such as a ROM / RAM, a magnetic disk, an optical disk and the like, and includes a plurality of instructions for causing a computer device (which can be a personal computer, a server or a network device and the like) to execute the method described in various embodiments or some parts of the embodiments of the application.
[0056] The same or similar parts of each embodiment of the present specification can be referred to each other. Especially, for the embodiments, since they are basically similar to the method embodiments, the description is relatively simple, and the related parts can be referred to the description in the method embodiments.
[0057] The above-described embodiments of the present application are not intended to limit the scope of the present application.
Claims
1. A network threat analysis method based on learning evolutionary game theory, characterized in that, The method includes: An entity submits a registration request to an authentication server, which returns a digital certificate to the entity. Based on this digital certificate, the entity can communicate encrypted with other entities and create shared models and share threat intelligence with other entities. Based on the digital certificate, the entity joins the open community. This joining is automatically verified by a smart contract, which is stored on the blockchain and made available for user access. The entities share their threat intelligence with the open community. The threat intelligence comes from one or more of the following: their own network monitoring, intrusion detection system, intrusion prevention system, security information, event management system, network traffic, and log data, and returns incentives from the open community. In the process of returning incentives, the open community first has each entity jointly create a shared model based on learning evolutionary game theory. Each entity carries its own digital certificate C in the shared threat intelligence. Assuming that each entity participates with bounded rationality, in the initial stage of the game, each entity chooses to share threat intelligence with a certain probability P. Participating in sharing threat intelligence can obtain a certain payoff U. The higher the quality of the threat intelligence, the larger the coefficient w associated with it. The aforementioned digital certificate C, probability P, and coefficient w are used as the input terms of the shared model, and the payoff U is used as the output term of the shared model. The shared model is trained with the goal of maximizing the payoff U. Each entity with bounded rationality uses the shared model to participate in repeated games. The open community calculates the expected payoff of sharing based on the output payoff U and returns it as an incentive to each entity. The open community conducts a quality assessment of the threat intelligence shared by various entities and shares the assessment results within the open community. The quality assessment results are positively correlated with the coefficient w. Each entity initiates a query request. After identity verification, the open community returns threat intelligence that meets the query criteria to the entity. The entity then analyzes the threat intelligence obtained from the query and deploys its own network defense measures based on the analysis results.
2. The method according to claim 1, characterized in that: The network defense measures include: data encryption, firewall settings, intrusion blocking, and redirection.
3. The method according to claim 1, characterized in that: The threat intelligence also includes daily data and event behavior, which are mapped to each other. Based on the mapping relationship, the data feature vectors of the same event can be associated to improve the quality of threat intelligence.
4. A network threat analysis system based on learning evolutionary game theory, characterized in that, The system includes: physical enterprises, authentication servers, open communities, and blockchain; An entity submits a registration request to an authentication server, which returns a digital certificate to the entity. Based on this digital certificate, the entity can communicate encrypted with other entities and create shared models and share threat intelligence with other entities. Based on the digital certificate, the entity joins the open community. This joining is automatically verified by a smart contract, which is stored on the blockchain and made available for user access. The entities share their threat intelligence with the open community. The threat intelligence comes from one or more of the following: their own network monitoring, intrusion detection system, intrusion prevention system, security information, event management system, network traffic, and log data, and returns incentives from the open community. In the process of returning incentives, the open community first has each entity jointly create a shared model based on learning evolutionary game theory. Each entity carries its own digital certificate C in the shared threat intelligence. Assuming that each entity participates with bounded rationality, in the initial stage of the game, each entity chooses to share threat intelligence with a certain probability P. Participating in sharing threat intelligence can obtain a certain payoff U. The higher the quality of the threat intelligence, the larger the coefficient w associated with it. The aforementioned digital certificate C, probability P, and coefficient w are used as the input terms of the shared model, and the payoff U is used as the output term of the shared model. The shared model is trained with the goal of maximizing the payoff U. Each entity with bounded rationality uses the shared model to participate in repeated games. The open community calculates the expected payoff of sharing based on the output payoff U and returns it as an incentive to each entity. The open community conducts a quality assessment of the threat intelligence shared by various entities and shares the assessment results within the open community. The quality assessment results are positively correlated with the coefficient w. Each entity initiates a query request. After identity verification, the open community returns threat intelligence that meets the query criteria to the entity. The entity then analyzes the threat intelligence obtained from the query and deploys its own network defense measures based on the analysis results.
5. A network threat analysis system based on learning evolutionary game theory, implementing the method of any one of claims 1-3, characterized in that, The system includes: a physical enterprise, an authentication server, an intermediate device, and a blockchain. The intermediate device includes: a processor and a memory. The memory is used to store program code and transmit the program code to the processor; The processor is used to execute instructions in the program code to implement the open community function in the method of any one of claims 1-3.
6. A computer-readable storage medium, characterized in that, The computer-readable storage medium is used to store program code, which is executed by a processor to implement the method of any one of claims 1-3.