Double-layer particle swarm network security game problem decision-making method

Abstract

The invention provides a double-layer particle swarm network security game problem decision-making method, which comprises the following steps of: constructing an attack and defense master-slave game model of a double-layer substructure, and converting a multi-attacker generalized game problem into a nonlinear equation problem through the attack and defense master-slave game model; introducing an immune memory mechanism and a selection mechanism based on antibody concentration into a particle swarm algorithm to obtain an immune particle swarm algorithm; and solving the total utility of the nonlinear equation problem through an immune particle swarm algorithm. According to the method, the effective Nash equilibrium and Stackelberg equilibrium solutions of the network security game are solved by constructing the master-slave game model and combining with the improved immune particle swarm algorithm, so that the scientificity and accuracy of network security defense decision and the anti-attack ability of the system are improved.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a decision-making method for a two-layer particle swarm optimization network security game problem. Background Technology

[0002] Security game theory provides a feasible research method for analyzing the interaction between defenders and attackers. In interconnected network systems, the "game" between defenders and attackers manifests as follows: on the one hand, attackers attempt to exploit weaknesses in the system to maximize system losses; on the other hand, defenders adopt appropriate protection strategies to enhance system security. In this context, using security game models to study network security issues and derive equilibrium solutions can predict deliberate attack behavior, assess system weaknesses, and provide guidance for system defense deployment decisions, thereby improving system security and reliability. Based on the different decision-making sequences, there are three common types of security game models: Attacker-Defender (AD) models, Defender-Attacker (DA) models, and Defender-Attacker-Defender (DAD) models. All three types of game models can be categorized as master-slave games. Generally speaking, most system security problems, such as system vulnerability assessment under deliberate attacks and optimal defense resource allocation, can be modeled as security games.

[0003] The single-leader multiple-followers game is a special form of defender-attacker game, also known as a bilevel programming problem. It is widely applied in resource coordination, energy scheduling, cellular data traffic and 5G networks, and even to aircraft with tilting helical propellers. A single-leader multiple-followers game involves one defender and multiple attackers. The defender has the ability to control and anticipate the attackers' reactions, choosing the optimal strategy from its feasible strategy space by understanding the attackers' responses. The attackers make the optimal response based on the strategy given by the defender. The attacker-defender security problem can be viewed as a bilevel programming problem with a defender-attacker hierarchy. Currently, research on linear bilevel programming is relatively mature, but research on nonlinear bilevel programming is lacking. Nonlinear bilevel programming is an NP-hard problem.

[0004] While existing technologies offer various solutions to cybersecurity game theory problems, significant shortcomings remain. Firstly, traditional mathematical analysis methods suffer from extremely high computational complexity and slow convergence when solving nonlinear bilevel programming problems. They also struggle to obtain optimal solutions that balance the interests of all parties, leading to large disparities in attacker payoffs and excessively high overall payoffs, thus failing to achieve optimal social welfare. Secondly, existing swarm intelligence methods are prone to getting trapped in local optima and lack the ability to maintain population diversity, impacting global optimization accuracy and efficiency. This fails to fully meet the dual requirements of effectiveness and speed in cybersecurity game theory. Furthermore, existing methods are insufficient in optimizing Nash equilibrium, failing to effectively screen for efficient Nash equilibria that benefit all participants. This results in weak practicality and specificity of equilibrium solutions, making it difficult to directly provide precise guidance for defense decisions. Summary of the Invention

[0005] The purpose of this invention is to provide a decision-making method for a two-layer particle swarm optimization (PSO) network security game problem. By constructing a master-slave game model and combining it with an improved immune particle swarm optimization algorithm, the method aims to solve the effective Nash equilibrium and Stackelberg equilibrium solutions of the network security game, thereby improving the scientific nature, accuracy, and anti-attack capability of network security defense decisions.

[0006] To achieve the above objectives, the present invention provides the following solution: A decision-making method for a two-layer particle swarm optimization cybersecurity game problem includes the following steps: A two-level attack-defense master-slave game model is constructed, and the multi-attacker generalized game problem is transformed into a nonlinear equation problem through the attack-defense master-slave game model; By incorporating the immune memory mechanism and the antibody concentration-based selection mechanism into the particle swarm algorithm, an immune particle swarm algorithm is obtained. The overall utility of solving nonlinear equation problems using the immune particle swarm optimization algorithm.

[0007] Optionally, a two-level attack-defense master-slave game model is constructed, and the multi-attacker generalized game problem is transformed into a nonlinear equation problem through the attack-defense master-slave game model, including: The attacker's objective function and the attacker's objective function are derived from the attacker's strategy set and the defender's strategy set. Determine the mapping relationship of Nash equilibrium point set values ​​based on the attacker's policy set and the defender's policy set; The equilibrium point of the master-slave game is obtained by solving the defender's objective function; Determine the effective Nash equilibrium based on the master-slave game equilibrium point.

[0008] Optionally, the immune memory mechanism and antibody concentration-based selection mechanism are introduced into the particle swarm optimization algorithm to obtain the immune particle swarm optimization algorithm, including: The fitness distance is calculated based on the fitness value of the attacker using the fitness function; A particle concentration formula is constructed based on fitness distance; Construct a probability set selection function for attackers based on the particle concentration formula.

[0009] Optionally, the total utility of solving nonlinear equation problems using the immune particle swarm optimization algorithm includes: Initialize the parameters of the immune particle swarm algorithm; The optimal attacker strategy in solving nonlinear equation problems based on the immune particle swarm optimization algorithm; Solving the optimal defender strategy in a nonlinear equation problem using the immune particle swarm optimization algorithm; Based on the effective Nash equilibrium, the optimal strategies for attackers and defenders are selected to obtain the total utility.

[0010] Optionally, the attacker's optimal strategy in solving nonlinear equation problems using the immune particle swarm optimization algorithm includes: The attacker's initial position and initial velocity are randomly generated using the immune particle swarm optimization algorithm; The fitness function value of each particle relative to the attacker is calculated using the immune particle swarm optimization algorithm to obtain the optimal position of the individual attacker and the optimal position of the attacker population. Calculate the inertial weights of the attacking particles, update the particle velocity and position, compare the updated particle fitness function values, and retain the best position of the particle population in the memory bank. Randomly generate a new attacker population of size Q; A second attack population with an initial size of M is selected from the new attacker population using a probability-based selection function. New particles are selected from the memory bank to replace the old particles in the second attack population, and the particle velocity and particle position are updated to generate the third attack population and repeat the population iteration process. The iteration stops when the population reaches the maximum number of iterations or the population accuracy meets the preset termination condition, and the attacker's optimal particle is output.

[0011] Optionally, the optimal defender strategy in solving nonlinear equation problems using the immune particle swarm optimization algorithm includes: The attacker's optimal particle is fed back to the defender, and the fitness function value of each particle to the defender is calculated by the immune particle swarm algorithm to obtain the best position of the individual defender and the best position of the defender population. Calculate the inertial weights of the defensive particles, update the particle velocity and position, compare the updated particle fitness function values, and retain the optimal position of the particle population in the memory bank. Randomly generate a new population of defenders of size Q; A second defensive population with an initial size of M is selected from the new defensive population using a probability-based selection function. New particles are selected from the memory bank to replace the old particles in the second defense population, and the particle velocity and particle position are updated to generate the third defense population and repeat the population iteration process. The iteration stops when the population reaches the maximum number of iterations or the population accuracy meets the preset termination condition, and the optimal particle for the defender is output.

[0012] According to specific embodiments provided by the present invention, the following technical effects are disclosed: The two-layer particle swarm optimization (PSO) network security game problem decision-making method provided by the present invention includes: constructing a two-layer attack-defense master-slave game model, and transforming the multi-attacker generalized game problem into a nonlinear equation problem through the attack-defense master-slave game model; introducing an immune memory mechanism and an antibody concentration-based selection mechanism into the particle swarm optimization algorithm to obtain an immune particle swarm optimization algorithm; and solving the total utility of the nonlinear equation problem through the immune particle swarm optimization algorithm. This method, by constructing a master-slave game model and combining it with the improved immune particle swarm optimization algorithm, solves the effective Nash equilibrium and Stackelberg equilibrium solutions of the network security game, thereby improving the scientific nature, accuracy, and system anti-attack capability of network security defense decisions. Attached Figure Description

[0013] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0014] Figure 1 This is a flowchart of the two-layer particle swarm optimization network security game problem decision-making method of the present invention; Figure 2 This is a flowchart illustrating the implementation of the IPSO algorithm in an embodiment of the present invention. Figure 3 This is an offline performance graph of the attacker obtained by solving the IPSO algorithm in an embodiment of the present invention; Figure 4 This is the offline performance graph of the defender obtained by solving the IPSO algorithm in an embodiment of the present invention; Figure 5 This is a graph showing the change in attack consequences as a function of total defense costs in an embodiment of the present invention. Detailed Implementation

[0015] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0016] To make the above-mentioned objects, features and advantages of the present invention more apparent and understandable, the present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments.

[0017] like Figure 1 As shown, this invention provides a decision-making method for a two-layer particle swarm optimization network security game problem, comprising the following steps: Step 100: Construct a two-level attack-defense master-slave game model, and transform the multi-attacker generalized game problem into a nonlinear equation problem through the attack-defense master-slave game model; Step 200: Introduce the immune memory mechanism and the antibody concentration-based selection mechanism into the particle swarm algorithm to obtain the immune particle swarm algorithm; Step 300: Calculate the total utility of solving the nonlinear equation problem using the immune particle swarm optimization algorithm.

[0018] Preferably, a two-level attack-defense master-slave game model is constructed, and the multi-attack generalized game problem is transformed into a nonlinear equation problem through the attack-defense master-slave game model, including: The attacker's objective function and the attacker's objective function are derived from the attacker's strategy set and the defender's strategy set. Determine the mapping relationship of Nash equilibrium point set values ​​based on the attacker's policy set and the defender's policy set; The equilibrium point of the master-slave game is obtained by solving the defender's objective function; Determine the effective Nash equilibrium based on the master-slave game equilibrium point.

[0019] In the specific implementation process, step 100 defines an effective Nash equilibrium by improving upon the traditional efficient Nash equilibrium. An effective Nash equilibrium is beneficial to all participants and significantly reduces the number of Nash equilibria, reflecting the maximization of social welfare. Furthermore, through the Karush-Kuhn-Tucker (KKT) conditions and the complementary function method, the generalized game problem involving multiple attackers is transformed into a nonlinear equation problem. Specifically, the construction process of the attack-defense master-slave game model is as follows: Let... , , It is the defender's strategy set. It is the first The attack strategy set of an attacker, denoted as... , The defender's objective function is , No. The attacker's objective function is Define parameters containing the defender strategy. The attacker's Nash equilibrium point set value mapping relationship is as follows: The expression is: ; in The defender determines the selection strategy. After that Attacker Selection Strategy Except for the first Attacker selection strategy The payment received later This indicates that the defender has determined the selection strategy. After that, the Attacker Selection Strategy And other attacker selection strategies The defender then receives the largest payout. The defender makes the first strategic decision. , A non-cooperative attacker engages in competition; assuming an equilibrium point exists, i.e., there exists... ,make ,make ,have Equilibrium points are generally not unique; the set of all equilibrium points depends on... Let the attacker's equilibrium point set be . ,Depend on This defines a set-valued mapping. The defender, too, seeks to maximize their own interests, represented as... ,remember Then calculate This makes the master-slave game equilibrium point satisfy: ; and ; .

[0020] The Nash equilibrium in step 100 is as follows: Let the defender's decision variable be... The attacker's decision variables are ,if and Satisfy the following equation: ; in This represents an efficient Nash equilibrium in a single-defense, multi-attack game. This indicates the strategy overview... Under the following conditions, the attacker's total payoff is minimized, the defender's reward is maximized, and neither the defender nor the attacker can gain additional rewards by unilaterally changing their existing strategies. If a strategy maximizes social welfare across the entire feasible strategy space by maximizing the defender's reward and minimizing the attacker's total reward, it is called an efficient strategy. The efficient Nash equilibrium is: Let... For all Nash equilibrium strategies in a single-defense, multi-attack game, the function mapping is: , Represents all Nash equilibrium strategies The total revenue, of which This represents the total payoff of the defender's strategy. This represents the total gain from the attacker's strategy. If the gain... Then for any other strategy, the payoff is... and satisfying the conditions ,but This is called an effective Nash equilibrium, which embodies the maximization of social welfare, and where no participant can gain an additional advantage by unilaterally changing their existing strategy.

[0021] It should be noted that the attack-defense master-slave game model (attacker-defender security game model) is a typical bilevel programming model. The solution obtained is the Stackelberg equilibrium strategy formed by the game between attacker A and defender D. Therefore, the vulnerability and importance of components in the system can be evaluated through the Stackelberg equilibrium strategy of attacker A.

[0022] Furthermore, the core of the attacker-defender (AD) model is solving the optimization problem involved in the defense strategy. The objective function of this optimization problem is the relevant costs and consequences of implementing the defense strategy. Taking a power system as an example, the objective function of its optimization problem is often the system's power generation cost and load loss. From the perspective of the system operator, i.e., defender D, the goal is to minimize this cost while defending the system against external attacks. Therefore, the mathematical model is: ; in, Represents the defense cost vector. Represents the defense strategy vector. These represent the constraints for the secure operation of the system. Attacker A aims to maximize costs and thereby limit defender D's strategies. The formulation of the order. This represents the attack decision column vector, i.e., the relevant strategies of attacker A. If attacker A attacks the system's... Each component, then let ,otherwise .like Then the first in the system If a component fails or ceases operation, and the controller D's control strategy relies on that failed or ceased-operational component, then the strategy cannot be executed, and consequently... Therefore, the attacker-defender (AD) model is represented as: ; in, This indicates the resource cost limit required for attacker A to launch an attack. , To make attack decisions by attacker A Under the constraints, the set of feasible strategies for defender D.

[0023] Furthermore, from the perspective of mathematical programming, the attacker-defender (AD) model is a typical bilevel programming problem, which can be reduced to a class of two-stage complete information dynamic game problems, namely, the Stackelberg game. In this model, the first decision-maker (defender) is attacker A, and the subsequent decision-maker (follower) is defender D. Considering the sequential nature of the decisions made by attacker A and defender D, as well as attacker A's complete control over defender D's strategy and its motivation to deliberately maximize disruption, the attacker-defender (AD) modeling method based on master-follower game theory is considered reasonable. In short, the optimal solution obtained from the bilevel programming problem is the Stackelberg equilibrium strategy generated by the game pattern between attacker A and defender D.

[0024] Specifically, the attacker-defender (AD) model has several improved forms. From the attacker A's perspective, an attack strategy can be designed to degrade the performance of the attacked component, rather than causing it to completely fail. From the defender D's perspective, given its informational limitations—that is, it does not fully understand the attacker A's attack capabilities and resource constraints—it can be assumed that any component in the system, in an unprotected state, will fail or cease operation due to an attack. The optimization model of defender D's behavior can be described by a linear programming problem, and the optimization model of defender D's decision-making behavior is expressed as: ; Among these, equality constraints represent normal system operation constraints; for example, in a power system, this constraint represents the power balance limitations at each node. Inequality constraints represent the constraints on any element in the system. Capacity and operational limitations, such as the upper and lower limits of generator output in a power system, and transmission capacity limitations of transmission lines, including transmission lines, oil pipelines, power sources, and communication lines. Assuming for components... After the attack is launched, the system completely shuts down. In this case, the attacker-defender (AD) model can be represented as a two-level optimization problem: ; in, It should be noted here that the system can still maintain normal operation under any possible attack, and it is assumed that system components do not completely stop operating after being attacked, but only their performance is reduced, that is, some capacity is retained. Thus, the inequality can be rewritten as: .

[0025] It should be noted that assessing the vulnerability of components in a system by using attacker A's strategy is, in other words, assessing the vulnerability of components... ,like If this is not the case, the component is highly vulnerable to attack and has significant weaknesses; if If the vulnerability is low, then the component is less vulnerable. This model can be used to assess the vulnerability and importance of each component of the defended system under deliberate attack.

[0026] Preferably, the immune memory mechanism and the antibody concentration-based selection mechanism are introduced into the particle swarm optimization algorithm to obtain the immune particle swarm optimization algorithm, including: The fitness distance is calculated based on the fitness value of the attacker using the fitness function; A particle concentration formula is constructed based on fitness distance; Construct a probability set selection function for attackers based on the particle concentration formula.

[0027] Specifically, the particle swarm optimization algorithm finds the optimal solution through cooperation and shares information among the individuals. In the particle swarm optimization method, the solution to each optimization problem can be viewed as a particle in the search space. The total size is, For spatial dimension PSO method, For particles The position vector, Represents particles The velocity vector. Based on the model constructed in step 100, each particle moves towards its current optimal position. (Personal best) and global best particles (Globally optimal) movement. In the... Step, particle The basic velocity and position are updated using expressions (1) and (2), which are as follows: ; in It is a cognitive factor. It is a public factor. and There are two The diagonal elements are evenly distributed in the interval [0,1]. For inertial weights, It affects both the global and local detection capabilities of particles. When When the size is large, the overall exploration capability is strong in the early stages of the process, when When the weight is smaller, the local mining capability in the search space is stronger than when the weight is larger. As the dynamic inertia weight value increases, the weight strategy decreases linearly, as expressed in expression (3): ; in For maximum inertia weight, For minimum inertia weight, and These are the maximum number of iterations and the current number of iterations, respectively.

[0028] In its implementation, step 200 treats the optimal solution in the particle swarm optimization algorithm as an antibody, and the objective function and constraint terms as antigens, resulting in the Immune Particle Swarm Optimization (IPSO) algorithm, a combination of probabilistic selection function and particle swarm optimization. During particle (antibody) population updates, it's always desirable to leave the more adaptable particles (antibodies) at the back. If a particle (antibody) becomes too concentrated, it's difficult to guarantee particle (antibody) diversity, potentially leading to local optima. Therefore, an antibody probability concentration selection formula is used to maintain particles with lower fitness but better evolutionary trends. From non-empty set Composition, antibodies The distance calculation formula is: ; Thus, particles are obtained. Concentration formula: ; The expression (4) for the attacker's probability set selection function is further constructed as follows: ; in Indicates the particle position of the attacker. This represents the fitness value of the function for the attacker. Adding a new population. Its main function is to maintain the dynamic balance of the population and regulate its concentration. Specifically, when the evolutionary population has poor diversity and weak global search capability, the IPSO method allows the population to migrate to regions with better evolutionary tendencies.

[0029] Preferably, the total utility of solving nonlinear equation problems using the immune particle swarm optimization algorithm includes: Initialize the parameters of the immune particle swarm algorithm; The optimal attacker strategy in solving nonlinear equation problems based on the immune particle swarm optimization algorithm; Solving the optimal defender strategy in a nonlinear equation problem using the immune particle swarm optimization algorithm; Based on the effective Nash equilibrium, the optimal strategies for attackers and defenders are selected to obtain the total utility.

[0030] Preferably, the optimal attacker strategy in solving nonlinear equation problems using the immune particle swarm optimization algorithm includes: The attacker's initial position and initial velocity are randomly generated using the immune particle swarm optimization algorithm; The fitness function value of each particle relative to the attacker is calculated using the immune particle swarm optimization algorithm to obtain the optimal position of the individual attacker and the optimal position of the attacker population. Calculate the inertial weights of the attacking particles, update the particle velocity and position, compare the updated particle fitness function values, and retain the best position of the particle population in the memory bank. Randomly generate a new attacker population of size Q; A second attack population with an initial size of M is selected from the new attacker population using a probability-based selection function. New particles are selected from the memory bank to replace the old particles in the second attack population, and the particle velocity and particle position are updated to generate the third attack population and repeat the population iteration process. The iteration stops when the population reaches the maximum number of iterations or the population accuracy meets the preset termination condition, and the attacker's optimal particle is output.

[0031] Preferably, the optimal defender strategy in solving nonlinear equation problems using the immune particle swarm optimization algorithm includes: The attacker's optimal particle is fed back to the defender, and the fitness function value of each particle to the defender is calculated by the immune particle swarm algorithm to obtain the best position of the individual defender and the best position of the defender population. Calculate the inertial weights of the defensive particles, update the particle velocity and position, compare the updated particle fitness function values, and retain the optimal position of the particle population in the memory bank. Randomly generate a new population of defenders of size Q; A second defensive population with an initial size of M is selected from the new defensive population using a probability-based selection function. New particles are selected from the memory bank to replace the old particles in the second defense population, and the particle velocity and particle position are updated to generate the third defense population and repeat the population iteration process. The iteration stops when the population reaches the maximum number of iterations or the population accuracy meets the preset termination condition, and the optimal particle for the defender is output.

[0032] In the specific implementation process, the steps for implementing step 300 are as follows: Figure 2 As shown, it includes: 1) Initialize parameters: Assume the attacker's maximum number of iterations is... The maximum number of iterations for the defender is The acceleration constant is and The inertia weight value is and The accuracy is The randomly generated population size is Initial values ​​are randomly generated based on the defender's feasible domain. .

[0033] 2) Randomly generate the attacker's initial location using the IPSO algorithm. and initial velocity .

[0034] 3) Calculate the fitness function value of each particle relative to the attacker using the IPSO algorithm to obtain the optimal position of each individual particle. and overall best position .

[0035] 4) Calculate the inertia weight using expression (3) .

[0036] 5) Update the velocity and position of the following particles using expressions (1) and (2) respectively, compare the fitness functions of the particles, and retain the best position of the population in the memory bank.

[0037] 6) Randomly generate attackers to obtain a scale of A new population.

[0038] 7) From the new group via expression (4) Select group .

[0039] 8) The immune system selects particles from the memory bank to replace those with poor fitness, generating the next generation of particles. Then, the velocity and position of the particles are updated using expressions (1) and (2).

[0040] 9) By calculating particles The fitness value of the current position will fitness value and The fitness values ​​are compared, if ,but ;otherwise .

[0041] 10) Calculate the fitness function value of each particle against the attacker to obtain the individual's optimal position. and the best position of the group , to particles fitness value and global Compare the fitness values; if ,but ;otherwise .

[0042] 11) When the maximum number of iterations is reached Or meet the accuracy When the termination condition is met, the optimal particle is output. (An approximate solution from the attacker); otherwise, return to step 4.

[0043] 12) The attacker's optimal particle This feedback is returned to the defender.

[0044] 13) The IPSO algorithm is used to calculate the fitness function value of each particle relative to the defender, thus obtaining the optimal position for each individual particle. and the best position of the group .

[0045] 14) Randomly generate the initial position of the leader particle. and initial velocity For each particle The velocity of the particle is updated using expression (1), and the position of the particle is updated using expression (2).

[0046] 15) Randomly generate a size of The new total number.

[0047] 16) From the new group via expression (4) Select group .

[0048] 17) From the memory bank, particles are selected to replace those with poor fitness in the population, and the immune system generates a new generation of particles. Then, the velocity and position of the particles are updated using expressions (1) and (2).

[0049] 18) Calculate the fitness function value of each particle relative to the defender to obtain the optimal position for each individual particle. and the best position of the group Therefore, particles can be... Fitness value and global optimal particle Compare the fitness values; if ,but ;otherwise .

[0050] 19) When the maximum number of iterations is reached Or the accuracy meets the conditions At that time, output the optimal particle. Otherwise, return to step 14).

[0051] 20) If If the definition of an effective Nash balancer is met, then use This represents the efficient Nash equilibrium set in a single-defense, multi-attack game.

[0052] This invention also provides a performance evaluation process for the IPSO algorithm, namely, evaluating convergence based on the offline performance of the IPSO algorithm. In the IPSO algorithm, the offline performance functions for the attacker and defender are respectively... and The final expression is: ; Offline performance represents the cumulative average of the optimal fitness function. When a particle is closer to the fitness function value, it can better adapt to the single-defense multi-attack game problem, thus making the particle more suitable for the objective function under certain constraints.

[0053] This invention provides several specific embodiments in which the IPSO algorithm is applied to solve for the optimal strategy of a defender. Optimal strategy for attackers The IPSO algorithm parameters are set as follows: overall size Learning factor , , The maximum number of attackers and defenders are respectively... and The new group size is The precision of the fitness function is set to The IPSO algorithm is used to solve the Nash equilibrium of a single-defense multi-attack game, and an efficient Nash equilibrium that is beneficial to all participants is calculated through improvements to the Nash equilibrium.

[0054] Example 1: Suppose there is a single-defense, multi-attack game, and the defender's strategy is... The attacker's strategy is and The defender's payoff function is The attacker's payoff function is and Then we have: ; The corresponding values ​​for this embodiment are shown in Tables 1 and 2, and the offline performance is as follows: Figure 3 and Figure 4 As shown.

[0055] Table 1 Solution Results

[0056] Table 2 Solution Results

[0057] In Table 1, the average number of iterations for the attacker problem is 283, and an approximate solution for the attacker with 298 iterations is (4, 5). T In Table 2, the average number of iterations for the defender problem is 98, and the approximate efficient Nash equilibrium obtained for the defender is 7.5. An efficient Nash equilibrium minimizes the attacker's income gap and maximizes the defender's reward; therefore, strategy (7.5, 4, 5) is an efficient Nash equilibrium. This embodiment is the only Nash equilibrium, requires fewer iterations during computation, and the convergence of the IPSO algorithm does not depend on the choice of the initial point, significantly reducing the algorithm's computation time and making it less prone to getting trapped in local optima.

[0058] Example 2: Suppose there is a single-defense, multi-attack game, where the defender's strategy is... The attacker's strategy is and The defender's payoff function is The attacker's payoff function is and Then we have: ; Decision vector for the defender The attacker's corresponding strategy is When the defender's strategy is fixed, the attacker's optimal decision vector may not be unique. Therefore, the effective Nash equilibrium is also not unique, and may even be multiple, but this significantly reduces the number of Nash equilibrium options, thus effectively refining the Nash equilibrium. Attacker Strategy Solved using the IPSO algorithm, the defender strategy is determined. The solution was obtained using the IPSO algorithm. The numerical results are shown in Table 3.

[0059] Table 3 Solution Results

[0060] The IPSO algorithm was executed for 178 iterations for the attacker and 105 iterations for the defender; the results are shown in Table 3. Dynamic competition exists between attackers when the defender's payoff is maximized; that is, when one participant's payoff increases, another participant's payoff decreases. The total CPU time was 41 seconds. Based on the definitions of efficiency and effective Nash balance, the defender chooses a strategy that maximizes the total payoff and minimizes the gap between the defender's payoff and the attacker's payoff. This means maximizing social welfare, and each participant cannot gain additional rewards by individually changing their current strategy. Table 3 shows the minimum total payoff for the attacker. Equals 54, minimum income gap The value equals 4. At this point, an effective Nash equilibrium solution can be obtained as follows: The target value of the defender The target values ​​of the two attackers are respectively and .

[0061] Example 3: For most malicious premeditated attacks and probability-based premeditated attacks, the attacker chooses the target based on their own motivation, while the defender selects the configuration of defense resources to counter the network attack from the attacker. The interaction between the two can be described as a two-person zero-sum master-slave game problem, which can be transformed into a minimax optimization problem, and then the Stackelberg equilibrium strategy can be solved. The equilibrium strategy solution methods for the corresponding attacker-defender (AD) security game model for different types of attacks are as follows: (1) Most malicious and deliberate attack Under the most malicious and deliberate attack, the attacker attempts to maximize the downtime loss caused by the attack, while the defender attempts to minimize this loss. Therefore, the game model can be described as the following minima optimization problem: ; If the target of the attack Contains only a single component The damage caused by the attack is: ; Similarly, it can be calculated when the target is attacked. Includes The corresponding failure loss for each component. For example, if the target of the attack Contains two components Then there is .

[0062] (2) Probability-based deliberate attacks In probabilistic attacks, the attacker's payment becomes the target of the attack. The losses caused by its failure and shutdown are greater than the minimum power outage losses. probability The attacker attempts to maximize this probability, while the defender aims to minimize it. Therefore, this game model can be transformed into the following optimization problem: ; In this attacker pattern, an attacker's single attack target often includes multiple components. This represents a subset of components within the target set, specifically the set of components that fail or stop working during the attack. Define an indicator variable. ,when Losses caused by component failure and downtime Greater than hour, ;on the contrary, ,Right now Furthermore, the objective function under the most malicious deliberate attack... Replace with This yields the objective function expression for the security game problem under probabilistic deliberate attacks. As for the defender, they can repair resources for network components. Adjustments, changes The value of .

[0063] (3) Random attack If an attacker randomly selects targets, it can be assumed that the probability of attacking each target is the same in their strategy. This indicates that the attacker's strategy has been determined. For the defender, this model is an optimization problem, with the goal of minimizing the losses caused by the network attack. This embodiment determines the distribution range boundary of losses that may be caused by unknown attack strategies by separately solving for the losses caused by the most malicious deliberate attack and random attack.

[0064] Based on the attacker-defender (AD) security game model, a component criticality assessment was also conducted on a high-voltage transmission network. Typical attacker scenarios and simulated attacker behavior are shown in Table 4.

[0065] Table 4. Typical Attack Scenarios of Attackers in Attacker-Defender (AD) Security Games

[0066] Based on the N-1 criterion, calculate the optimal defense strategies D1 to D6 under different attacks A1 to A6. Assume the total defense cost. The consequences of employing different defense strategies for the above 12 attack scenarios. The values ​​of are shown in Table 5.

[0067] Table 5. Values ​​of Attack Consequences under Different Attacker and Defense Strategies

[0068] It should be noted that the attacker-defender (AD) security game can be viewed as a two-level programming problem. In other embodiments, the IPSO algorithm parameters are set as follows: overall size Learning factor , , The maximum number of iterations is The precision of the fitness function is set to In the worst-case scenario of a deliberate attack, as the total defense cost changes, the consequences of the attack are as follows: Figure 5 As shown in the figure, the horizontal axis determines the priority of protection for components based on their criticality, i.e., prioritizing the protection of components whose downtime would have relatively severe consequences. In this cybersecurity game, the finite Nash equilibrium is (D5, A5) and (D5, A4), where the required defense cost is lower when the attack consequences are relatively severe.

[0069] The beneficial effects of this invention are as follows: 1) By improving the traditional Nash equilibrium, an effective Nash equilibrium is defined, which greatly reduces the number of equilibria and maximizes social welfare (i.e., the defender's profit is maximized, the attacker's total profit is minimized, and the profit gap is minimized). This ensures that the equilibrium solution is beneficial to all participants, and that participants cannot gain additional advantages by unilaterally changing their strategies, thereby improving the practicality and relevance of the equilibrium solution. 2) The immune memory mechanism and antibody concentration selection mechanism were introduced into the particle swarm optimization (PSO) algorithm, forming the improved IPSO algorithm. It retains the characteristics of PSO being simple to implement and fast to converge, while effectively maintaining population diversity, avoiding getting trapped in local optima, and significantly improving global optimization ability and convergence efficiency. 3) For the nonlinear bi-level programming corresponding to network security games, a swarm intelligence method is used to achieve efficient solution, which has the characteristics of few iterations and short computation time, and the convergence does not depend on the choice of initial point, and has strong stability. 4) The improved IPSO algorithm is suitable for network security game scenarios involving single defenders and multiple attackers. It can be extended to multiple fields such as power systems, 5G networks, and resource coordination. It can achieve smaller attacker payoff gaps, lower total payoffs, and better defender payoffs. It has a wide range of applicable scenarios and better performance.

[0070] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on the differences from other embodiments. The same or similar parts between the various embodiments can be referred to each other.

[0071] Specific examples have been used to illustrate the principles and implementation methods of this invention. The descriptions of the above embodiments are only for the purpose of helping to understand the method and core ideas of this invention. Furthermore, those skilled in the art will recognize that, based on the ideas of this invention, there will be changes in the specific implementation methods and application scope. Therefore, the content of this specification should not be construed as a limitation of this invention.

Claims

1. A decision-making method for a two-layer particle swarm optimization cybersecurity game problem, characterized in that, Includes the following steps: A two-level attack-defense master-slave game model is constructed, and the multi-attacker generalized game problem is transformed into a nonlinear equation problem through the attack-defense master-slave game model; By incorporating the immune memory mechanism and the antibody concentration-based selection mechanism into the particle swarm algorithm, an immune particle swarm algorithm is obtained. The overall utility of solving the nonlinear equation problem using the immune particle swarm optimization algorithm.

2. The decision-making method for the two-layer particle swarm optimization network security game problem according to claim 1, characterized in that, A two-level attack-defense master-slave game model is constructed, and the multi-attack generalized game problem is transformed into a nonlinear equation problem through the attack-defense master-slave game model, including: The attacker's objective function and the attacker's objective function are derived from the attacker's strategy set and the defender's strategy set. Determine the Nash equilibrium point set value mapping relationship based on the attacker's strategy set and the defender's strategy set; The equilibrium point of the master-slave game is obtained by solving the objective function of the defender. The effective Nash equilibrium is determined based on the master-slave game equilibrium point.

3. The decision-making method for the two-layer particle swarm optimization network security game problem according to claim 2, characterized in that, By incorporating immune memory mechanisms and antibody concentration-based selection mechanisms into the particle swarm optimization algorithm, an immune particle swarm optimization algorithm is obtained, which includes: The fitness distance is calculated based on the fitness value of the attacker using the fitness function; A particle concentration formula is constructed based on the fitness distance; Construct a probability set selection function for the attacker based on the particle concentration formula.

4. The decision-making method for the two-layer particle swarm optimization network security game problem according to claim 3, characterized in that, The total utility of solving the nonlinear equation problem using the immune particle swarm optimization algorithm includes: Initialize the parameters of the immune particle swarm optimization algorithm; The optimal attacker strategy in the nonlinear equation problem is solved using the immune particle swarm optimization algorithm. The optimal defender strategy in the nonlinear equation problem is solved using the immune particle swarm optimization algorithm. Based on the effective Nash equilibrium, the optimal strategies for the attacker and the defender are selected to obtain the total utility.

5. The decision-making method for the two-layer particle swarm optimization network security game problem according to claim 4, characterized in that, Solving the nonlinear equation problem using the immune particle swarm optimization algorithm includes: The attacker's initial position and initial velocity are randomly generated using the immune particle swarm optimization algorithm. The fitness function value of each particle relative to the attacker is calculated using the immune particle swarm optimization algorithm to obtain the optimal position of the individual attacker and the optimal position of the attacker population. Calculate the inertial weights of the attacking particles, update the particle velocity and position, compare the updated particle fitness function values, and retain the best position of the particle population in the memory bank. Randomly generate a new attacker population of size Q; A second attack population with an initial size of M is selected from the new attacker population using the probability set selection function; New particles are selected from the memory bank to replace the old particles in the second attack population, and the particle velocity and particle position are updated to generate a third attack population and repeat the population iteration process. The iteration stops when the population reaches the maximum number of iterations or the population accuracy meets the preset termination condition, and the attacker's optimal particle is output.

6. The decision-making method for a two-layer particle swarm optimization network security game problem according to claim 5, characterized in that, Solving the optimal defender strategy in the nonlinear equation problem using the immune particle swarm optimization algorithm includes: The attacker's optimal particle is fed back to the defender, and the fitness function value of each particle to the defender is calculated by the immune particle swarm algorithm to obtain the best position of the individual defender and the best position of the defender population. Calculate the inertial weights of the defensive particles, update the particle velocity and position, compare the updated particle fitness function values, and retain the optimal position of the particle population in the memory bank. Randomly generate a new population of defenders of size Q; A second defense population with an initial size of M is selected from the new defense population using the probability set selection function; New particles are selected from the memory bank to replace the old particles in the second defense population, and the particle velocity and particle position are updated to generate a third defense population and repeat the population iteration process. The iteration stops when the population reaches the maximum number of iterations or the population accuracy meets the preset termination condition, and the optimal particle for the defender is output.

Images