Intrusion prediction and defense method based on genetic evolution and two-stage stochastic programming
By constructing an attack path prediction model using a genetic algorithm and combining it with two-stage stochastic programming, the optimal defense strategy and resource allocation scheme are output. This solves the problems of lag and high false alarm rate in existing network security defense technologies, and achieves proactive and effective network security defense.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-12-19
- Publication Date
- 2026-04-10
AI Technical Summary
Existing cybersecurity defense technologies rely on prior knowledge, resulting in delayed defenses, high false alarm rates, and passive responses. They lack proactive defense capabilities and are unable to effectively respond to new and variant attacks.
An intrusion prediction and defense method based on genetic evolution and two-stage stochastic programming is adopted. An attack path prediction model is constructed through a genetic algorithm to simulate the attacker's strategy selection and evolution process, outputting an elite set. A two-stage stochastic programming model is established with the total expected cost as the objective function, taking into account both attack logic constraints and resource constraints, to output the optimal defense strategy and resource allocation scheme.
It achieves proactive defense, improves the foresight and accuracy of threat identification, reduces operation and maintenance costs, improves the utilization efficiency of security resources, avoids resource waste and policy conflicts, and enhances the rationality and feasibility of defense strategies.
Smart Images
Figure CN121841698A_ABST
Abstract
Description
TECHNICAL FIELD
[0001] The present application relates to the technical field of network security, and particularly relates to an intrusion prediction and defense method based on genetic evolution and two-stage stochastic programming. BACKGROUND
[0002] The existing network security defense technology mainly relies on the following methods: 1. Feature library-based matching technology, which identifies and alarms by comparing the inherent patterns of known attacks; 2. Static rule-based analysis technology, which triggers events that meet specific conditions according to pre-defined rules based on expert experience.
[0003] However, these mainstream technologies have obvious limitations. First, their detection capability is highly dependent on prior knowledge, and they cannot effectively deal with new attacks that have never occurred or variants of known attacks, and the defense capability has serious lag; second, these technologies usually generate a large number of low signal-to-noise ratio security alerts, many of which are triggered by normal business operations or system misconfigurations, resulting in real high-risk threat signals being overwhelmed, not only increasing the analysis load of security personnel, but also increasing the risk of missing critical threats. Most importantly, the existing technology framework lacks proactive defense capabilities, and its core logic focuses on post-event alarm and response to security incidents, which is essentially a passive response mode and cannot predict and deduce the attacker's behavior intention and potential attack path in advance, making the security protection work always in a passive disadvantageous position. SUMMARY
[0004] The purpose of the present application is to provide an intrusion prediction and defense method based on genetic evolution and two-stage stochastic programming to solve the technical problems of defense lag caused by reliance on prior knowledge, high false alarm rate caused by rigid detection mechanism, and passive response state caused by lack of prediction capability.
[0005] To achieve the above purpose, the present application adopts the following technical solutions: An intrusion prediction and defense method based on genetic evolution and two-stage stochastic programming, comprising the following steps: S1: Constructing an attack path prediction model based on genetic algorithm, simulating the strategy selection and evolution process of the attacker, and outputting an elite set of higher threat attack paths; S2: Establishing a two-stage stochastic programming model based on the elite set, taking the total expected cost as the objective function, and introducing attack logic constraints and resource constraints, and outputting the optimal defense strategy and resource allocation scheme; The two-stage stochastic programming model comprises: a first stage of making an advance decision and deploying a defense strategy; a second stage of calculating an expected loss based on probabilities of different attack paths occurring; and a total expected cost being a sum of a cost of deploying the defense strategy and the expected loss calculated based on the probabilities. S3: deploying defense measures according to the optimal defense strategy and resource allocation scheme and implementing active defense.
[0006] To optimize the above technical solution, the specific limitations taken further comprise: In step S1, when the attack path prediction model is constructed, an initial population composed of multiple attack path chromosomes is generated by random initialization; an integer coding method is used to represent the attack path by chromosomes, and the life cycle of the attack is encoded into an integer sequence with a length of M , wherein a value of an M th gene bit represents a specific technology selected by the attacker in the i th stage; a fitness function i is defined to evaluate a threat level of an attack path represented by a chromosome, and the fitness function is: x
[0007] , wherein represents an attack impact value, represents a probability of path occurrence; is a weight coefficient of , and is a weight coefficient of ; Through genetic operations, the final output is an elite set containing the top attack paths sorted in descending order of threat level E .
[0008] Further, in step S2, the objective function is
[0009] , wherein y is a defense strategy, is a total expected cost, is a cost of deploying the defense strategy, is an expected loss after deploying the defense strategy.
[0010] The cost of deploying the defense strategy is:
[0011] , wherein D represents a total number of optional defense measures,K Indicates the total number of available resources. To deploy the first The fixed costs of such defensive measures; For binary decision variables, it represents whether to deploy the first... Such defensive measures, when This indicates the deployment of defensive measures, when This indicates that no defensive measures have been deployed. Indicates the first The unit cost of a resource; Indicates the first The amount of resources used.
[0012] Furthermore, the expected loss is:
[0013] in, attack path The probability of occurrence attack path The influence value is predicted by the genetic algorithm model; Indicates defense strategy For the first i The blocking effect of each attack path is in the range of [0,1], where 1 means completely effective and 0 means completely ineffective. For defensive strategies For the first i The failure rate of each attack path; Indicates defense strategy After deployment, if the attack path The occurrence and the resulting residual losses.
[0014] Furthermore, in step S2, the attack logic constraints are implemented through an attack tactical relationship matrix, which is a... A matrix, where elements Indicates the attack phase and stages The logical sequence between them; if stages Must be in the stage If it happens afterward, then ,otherwise The attack logic constraint function is defined as follows:
[0015] in, and It is an indicator variable, representing the defense strategy. Does it cover the stage? and Corresponding attack behaviors; The resource constraints are implemented through a resource demand matrix, which is a single... A matrix, in which elements Indicates the implementation of defensive measures For the first The demand for a certain resource; the resource constraint function is defined as:
[0016] Among them, This represents the total number of optional defense measures. K Indicates the total number of available resources. Represent each resource Available quantity, It is a binary decision variable. Indicates the adoption of defensive measures , This indicates that it will not be adopted.
[0017] Preferably, in step S2, the Lagrange multiplier method is used to solve the two-stage stochastic programming model, outputting the optimal defense strategy and resource allocation scheme; the Lagrange function is defined as:
[0018] in, , , , These are Lagrange multipliers. By differentiating the Lagrange function and setting the derivative to zero, a set of equations is obtained. Solving these equations yields the optimal solution to the objective function, which serves as the optimal defense strategy. and its resource allocation plan.
[0019] This invention also proposes an intrusion prediction and defense system based on genetic evolution and two-stage stochastic programming, comprising: The attack path prediction module is used to simulate the attacker's strategy selection and evolution process based on genetic algorithms, and output an elite set of high-threat attack paths. The decision-making module is used to establish a two-stage stochastic programming model based on the elite set output by the attack path prediction module. The model uses the total expected cost as the objective function and incorporates attack logic constraints and resource constraints to output the optimal defense strategy and resource allocation scheme. The two-stage stochastic programming model includes: a first stage: making a decision in advance and deploying the defense strategy; and a second stage: calculating the expected loss based on the probability of different attack paths occurring. The total expected cost is the sum of the cost of deploying the defense strategy and the expected loss calculated based on the probability. The defense execution module is used to deploy defense measures and implement proactive defense based on the optimal defense strategy and resource allocation plan obtained from the decision module.
[0020] The present invention also proposes an electronic device, comprising: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, it implements the intrusion prediction and defense method based on genetic evolution and two-stage stochastic programming as described above.
[0021] The present invention also proposes a computer-readable storage medium storing a computer program that enables a computer to execute the intrusion prediction and defense method based on genetic evolution and two-stage stochastic programming as described above.
[0022] Compared with the prior art, the beneficial effects of the present invention are: This invention provides an intrusion prediction and defense method based on genetic evolution and two-stage stochastic programming. It constructs an attack path prediction model based on a genetic algorithm to generate future attack path sequences and predict their probabilities. Based on the prediction results, it constructs a two-stage stochastic programming model with total expected cost as the objective function. Taking into account multiple constraints such as the logical relationships between attack stages, various resource budget constraints, and the effectiveness of defense measures, it solves for the optimal and most cost-effective proactive defense strategy and resource allocation scheme, thus completing proactive defense. This overcomes the lag in passive response of traditional network security technologies, significantly improving the foresight and accuracy of threat identification, while also increasing the utilization efficiency of security resources and reducing operational costs and potential losses.
[0023] Furthermore, the attack path prediction model comprehensively considers the impact of attacks and their probability of occurrence based on a fitness function. By adjusting the weights, it reflects the actual security strategy and outputs an elite set of threat attack paths, making the prediction results fit actual security needs and providing a basis for the formulation of defense strategies.
[0024] By using an attack tactical relationship matrix to ensure that the defense strategy covers the logical sequence of the attack chain, and combining it with a resource demand matrix to limit resource consumption, the defense strategy not only conforms to the logic of attack behavior but also meets actual resource constraints. This effectively enhances the rationality and feasibility of the defense strategy and avoids resource waste and strategy conflicts.
[0025] Furthermore, the probability of attack paths is incorporated into the optimization objective through a two-stage stochastic programming framework, with the core objective of minimizing the expected total cost. Optimization algorithms such as the Lagrange multiplier method are used to solve for the optimal solution under complex constraints, ensuring the stability of the defense strategy in uncertain environments. Moreover, it does not rely on subjective probability threshold constraints, and automatically balances security investment and risk loss through optimization algorithms, thereby improving the system's proactive defense capabilities and resource adaptability. Attached Figure Description
[0026] Figure 1The flowchart of the intrusion prediction and defense method based on genetic evolution and two-stage stochastic programming of the present invention is shown in the figure. Figure 2 The diagram illustrates the process of constructing an attack path prediction model for the intrusion prediction and defense method based on genetic evolution and two-stage stochastic programming of this invention.
[0027] Figure 3 The present invention provides a schematic diagram of the process for constructing a two-stage stochastic programming model for an intrusion prediction and defense method based on genetic evolution and two-stage stochastic programming. Detailed Implementation
[0028] The technical solution of the present invention will be further described in detail below with reference to specific embodiments: In one embodiment, this invention proposes an intrusion prediction and defense method based on genetic evolution and two-stage stochastic programming, the flowchart of which is shown below. Figure 1 As shown, the entire method includes the following steps: S1: Based on genetic algorithms, an attack path prediction model is constructed to simulate the attacker's strategy selection and evolution process, and output an elite set of high-threat attack paths; S2: Based on the elite set, a two-stage stochastic programming model is established with the total expected cost as the objective function. Attack logic constraints and resource constraints are introduced to output the optimal defense strategy and resource allocation scheme. The two-stage stochastic programming model includes: Stage 1: making decisions and deploying defense strategies in advance; Stage 2: calculating the expected loss based on the probability of different attack paths occurring; The total expected cost is the sum of the cost of deploying the defense strategy and the expected loss calculated based on the probability. S3: Deploy defensive measures based on the optimal defense strategy and resource allocation plan, and implement proactive defense.
[0029] In step S1, when constructing the attack path prediction model, the population is first initialized by randomly generating an initial population composed of chromosomes representing multiple attack paths; the attack paths are represented by chromosomes using integer encoding, and the attack lifecycle is... M Each stage is encoded as having a length of M A sequence of integers, where the first integer is... i The value of the gene locus indicates the attacker's _th ... i Select the specific technologies to use at each stage; define the fitness function. assess chromosomes x The threat level represented by the attack path is determined by the fitness function, which is designed based on a multi-dimensional consideration of the attack path, such as the impact of a successful attack and the probability of the path occurring. The fitness function is defined as follows:
[0030] in Indicates the impact value of the attack. It represents the probability of the path occurring, and the attack impact value is quantified based on the potential loss of confidentiality, integrity, and availability; the probability of the path occurring is estimated based on historical attack data, vulnerability exploitation difficulty, or expert assessment. for The weighting coefficients, for The weighting coefficients are used to adjust the importance of different factors in the fitness function. These weighting coefficients are set based on actual security strategies and expert experience.
[0031] After defining the fitness function, a tournament selection method is used. Each time, a random selection is made from the population. One chromosome, This is a tournament-style competition where the individual with the highest fitness wins and is selected for the next generation. This method does not strictly require the fitness value to be positive or negative, and selection pressure can be mitigated. Adjustment.
[0032] Then, a single-point crossover method is used to perform the crossover operation. Two chromosomes are randomly selected as the parent chromosomes, denoted as . and Their gene sequences are respectively and At a random location on the chromosome. Crossover occurs, generating two new offspring chromosomes. and .
[0033] To ensure the effectiveness and diversity of crossover operations, a crossover probability can be set. In each iteration, a random number is generated. Uniformly distributed random numbers within the interval ,if If so, then crossover operations will be performed.
[0034] Then, with a certain mutation probability Mutate certain genes in a chromosome. For a selected chromosome, randomly select a gene locus. Its value is randomly transformed into one of the other possible technical options for this stage, namely 1 to Another integer between these two values. Mutation operations are used to increase population diversity, prevent the algorithm from converging prematurely to a local optimum, and thus discover more possible variants of attack techniques.
[0035] like Figure 2 As shown, a population is initialized, where each chromosome in the population represents a randomly generated, possible attack path, and the population size is set to... Then, the population is continuously updated through an iterative process using a genetic algorithm. In each iteration, the fitness value of each chromosome in the population is calculated, and selection, crossover, and mutation operations are performed to generate a new population. The process continues until a preset number of iterations is reached. When the time comes, stop iterating. Finally, the final output contains the top results sorted by threat level from highest to lowest. An elite group with multiple attack paths This set represents the predicted sequence of high-threat attack paths, which serves as input for subsequent defense planning models.
[0036] The attack path prediction model built on the genetic algorithm simulates the attacker's strategy selection and evolution process through chromosome encoding, fitness function evaluation, and genetic operations. It searches for and evaluates the techniques that the attacker may use at each stage, and finally obtains a set of high-threat attack paths.
[0037] Based on the attack path prediction model, it includes High-threat attack path elite collection Based on the influence value and probability of occurrence of each path, a two-stage stochastic programming model is established.
[0038] This model divides defense decisions into two phases: The first phase involves making advance decisions and deploying defense strategies, such as whether to deploy a particular defense measure. This decision incurs defense costs. This decision must be made without knowing which attacks will actually occur in the future.
[0039] The second phase, in the future, when the attack path... When it actually happens, the deployed defense strategies It will have a certain blocking effect. This results in a corresponding residual loss. The cost at this stage is the expected loss calculated based on the probability of different attack paths occurring.
[0040] Therefore, this model aims to minimize the total expected cost, which includes the cost of deploying the defense strategy in the first phase and the expected loss from probabilistic calculations in the second phase. Simultaneously, this decision must comprehensively consider practical constraints such as attack logic and resource limitations.
[0041] In step S2, the objective function is defined as follows:
[0042] in, y As a defensive strategy, For the total expected cost, The cost of deploying a defense strategy, The expected losses to be incurred after deploying a defense strategy.
[0043] Expected loss Specifically, it refers to an elite group. The sum of the expected residual losses that may be caused by all attack paths:
[0044] in, attack path The probability of occurrence attack path The influence value is predicted by the genetic algorithm model; Indicates defense strategy For the first i The blocking effect of the attack path is in the range of [0,1], where 1 means completely effective and 0 means completely ineffective. This parameter needs to be predefined or modeled based on security control effectiveness data, expert evaluation or simulation test, etc. For defensive strategies For the first i The failure rate of each attack path; Indicates defense strategy After deployment, if the attack path The occurrence and the resulting residual losses.
[0045] The cost of deploying a defense strategy This indicates the implementation of a defensive strategy. Required resource consumption. Assume there are... Optional defense measures include deploying a new firewall, purchasing threat intelligence services, and hiring an analyst, as well as... Various types of resources, such as budget, manpower, and computing resources. Deploy defensive measures. The fixed cost is This cost can be determined through financial budgeting and resource accounting data. It also takes into account the various resource consumption required for the operation of defensive measures.
[0046] The cost of deploying a defense strategy is:
[0047] in, D This indicates the total number of available defensive measures. K Indicates the total number of available resources. To deploy the first The fixed costs of such defensive measures; For binary decision variables, it represents whether to deploy the first... Such defensive measures, when This indicates the deployment of defensive measures, when This indicates that no defensive measures have been deployed. Indicates the first The unit cost of a resource; Indicates the first The amount of resources used.
[0048] In step S2, to ensure the logical consistency of the defense strategy, attack logic constraints are implemented through an attack tactical relationship matrix, which is a... A matrix, where elements Indicates the attack phase and stages The logical sequence between them; if stages Must be in the stage If it happens afterward, then ,otherwise The attack logic constraint function is defined as follows:
[0049] in, and It is an indicator variable, representing the defense strategy. Does it cover the stage? and The corresponding attack behavior, this constraint ensures that for all logically related stages... If the defense strategy covers the pre-construction phase Therefore, it must also cover the subsequent stages. This ensures the logical consistency of the defense strategy; consider Security resources are defined, and resource constraints are implemented through a resource demand matrix, which is a... A matrix, in which elements Indicates the implementation of defensive measures For the first The demand for each resource; then for each resource The resource constraint function is defined as follows:
[0050] Among them, This represents the total number of optional defense measures. K Indicates the total number of available resources. Represent each resource Available quantity, It is a binary decision variable. Indicates the adoption of defensive measures , This indicates that it will not be adopted.
[0051] Finally, by defining the objective function and constraints described above, a complete two-stage stochastic programming model is constructed. The goal of this model is to find a defense strategy while satisfying the attack logic and resource constraints. This makes the total expected cost Minimum.
[0052] To solve this model, various optimization algorithms are employed, such as the Lagrange multiplier method and the interior point method.
[0053] In step S2, the Lagrange multiplier method is used to solve the two-stage stochastic programming model, outputting the optimal defense strategy and resource allocation scheme; the Lagrange function is defined as:
[0054] in, , , , These are Lagrange multipliers. By differentiating the Lagrange function and setting the derivative to zero, a set of equations is obtained. Solving these equations yields the optimal solution to the objective function, which serves as the optimal defense strategy. and its resource allocation plan.
[0055] like Figure 3 As shown, in step S2, based on the prediction results of the attack path prediction model constructed using a genetic algorithm, a two-stage stochastic programming model is built. Its decision variables and parameters are defined, and a comprehensive objective function including defense costs and expected residual losses is considered, taking into account practical constraints such as attack logic consistency and resource limitations. The model is then solved and optimized using the Lagrange multiplier method to output the optimal strategy and resource allocation scheme for implementing defense. It incorporates the prediction information from the genetic algorithm, optimizing the allocation of defense strategies to achieve the optimal objective function. This ensures that defense measures not only conform to attack logic and resource limitations but also accurately target high-probability threats, achieving proactive and efficient security protection.
[0056] This invention also proposes an intrusion prediction and defense system based on genetic evolution and two-stage stochastic programming, comprising: The attack path prediction module is used to simulate the attacker's strategy selection and evolution process based on genetic algorithms, and output an elite set of high-threat attack paths. The decision-making module is used to establish a two-stage stochastic programming model based on the elite set output by the attack path prediction module. The model uses the total expected cost as the objective function and incorporates attack logic constraints and resource constraints to output the optimal defense strategy and resource allocation scheme. The two-stage stochastic programming model includes: a first stage: making a decision in advance and deploying the defense strategy; and a second stage: calculating the expected loss based on the probability of different attack paths occurring. The total expected cost is the sum of the cost of deploying the defense strategy and the expected loss calculated based on the probability. The defense execution module is used to deploy defense measures and implement proactive defense based on the optimal defense strategy and resource allocation plan obtained from the decision module.
[0057] The present invention also proposes an electronic device, comprising: a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it implements the above-mentioned intrusion prediction and defense method based on genetic evolution and two-stage stochastic programming.
[0058] The present invention also proposes a computer-readable storage medium storing a computer program that enables a computer to execute the above-described intrusion prediction and defense method based on genetic evolution and two-stage stochastic programming.
[0059] In the embodiments disclosed in this application, a computer storage medium may be a tangible medium that may contain or store programs for use by or in conjunction with an instruction execution system, apparatus, or device. The computer storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination of the foregoing. More specific examples of computer storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fibers, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.
[0060] The above description is merely a preferred embodiment of the present invention and is not intended to limit the present invention in any way. Any simple modifications, equivalent substitutions, and improvements made by those skilled in the art to the above embodiments without departing from the scope of the technical solution of the present invention, based on the technical essence of the present invention, shall still fall within the protection scope of the technical solution of the present invention.
Claims
1. An intrusion prediction and defense method based on genetic evolution and two-stage stochastic programming, characterized in that, Includes the following steps: S1: Based on genetic algorithms, an attack path prediction model is constructed to simulate the attacker's strategy selection and evolution process, and output an elite set of high-threat attack paths; S2: Based on the elite set, establish a two-stage stochastic programming model with the total expected cost as the objective function, and introduce attack logic constraints and resource constraints to output the optimal defense strategy and resource allocation scheme; The two-stage stochastic programming model includes: a first stage: making decisions and deploying defense strategies in advance; a second stage: calculating the expected loss based on the probability of different attack paths occurring; the total expected cost is the sum of the cost of deploying the defense strategy and the expected loss calculated based on the probability. S3: Deploy defensive measures and implement proactive defense based on the optimal defense strategy and resource allocation scheme described above.
2. The intrusion prediction and defense method based on genetic evolution and two-stage stochastic programming according to claim 1, characterized in that: In step S1, when constructing the attack path prediction model, the population is first initialized by randomly generating an initial population composed of chromosomes representing multiple attack paths; the attack paths are represented by chromosomes using integer encoding, and the attack lifecycle is... M Each stage is encoded as having a length of M A sequence of integers, where the first integer is... i The value of the gene locus indicates the attacker's _th ... i Select the specific technologies to use at each stage; define the fitness function. assess chromosomes x The threat level of the attack path represented, and the fitness function is: in Indicates the impact value of the attack. Indicates the probability of the path occurring; for The weighting coefficients, for Weighting coefficients; Through iterative optimization using genetic operations, the final output includes the top performers sorted by threat level from highest to lowest. An elite group with multiple attack paths E .
3. The invasion prediction and defense method based on genetic evolution and two-stage stochastic programming according to claim 1, characterized in that: In step S2, the objective function is in, y As a defensive strategy, For the total expected cost, The cost of deploying a defense strategy, The expected losses to be incurred after deploying a defense strategy.
4. The intrusion prediction and defense method based on genetic evolution and two-stage stochastic programming according to claim 1, characterized in that: The cost of deploying the aforementioned defense strategy is: in, D This indicates the total number of available defensive measures. K Indicates the total number of available resources. To deploy the first The fixed costs of such defensive measures; For binary decision variables, it represents whether to deploy the first... Such defensive measures, when This indicates the deployment of defensive measures, when This indicates that no defensive measures have been deployed. Indicates the first The unit cost of a resource; Indicates the first The amount of resources used.
5. The intrusion prediction and defense method based on genetic evolution and two-stage stochastic programming according to claim 1, characterized in that: The expected loss is: in, attack path The probability of occurrence attack path The influence value is predicted by the genetic algorithm model; Indicates defense strategy For the first i The blocking effect of each attack path is in the range of [0,1], where 1 means completely effective and 0 means completely ineffective. For defensive strategies For the first i The failure rate of each attack path; Indicates defense strategy After deployment, if the attack path The occurrence and the resulting residual losses.
6. The intrusion prediction and defense method based on genetic evolution and two-stage stochastic programming according to claim 1, characterized in that: In step S2, the attack logic constraints are implemented through an attack tactical relationship matrix, which is a... A matrix, where elements Indicates the attack phase and stages The logical sequence between them; if stages Must be in the stage If it happens afterward, then ,otherwise The attack logic constraint function is defined as follows: in, and It is an indicator variable, representing the defense strategy. Does it cover the stage? and Corresponding attack behaviors; The resource constraints are implemented through a resource demand matrix, which is a single... A matrix, in which elements Indicates the implementation of defensive measures For the first The demand for a certain resource; the resource constraint function is defined as: Among them, This represents the total number of optional defense measures. K Indicates the total number of available resources. Represent each resource Available quantity, It is a binary decision variable. Indicates the adoption of defensive measures , This indicates that it will not be adopted.
7. The intrusion prediction and defense method based on genetic evolution and two-stage stochastic programming according to claim 1, characterized in that: In step S2, the Lagrange multiplier method is used to solve the two-stage stochastic programming model, outputting the optimal defense strategy and resource allocation scheme; the Lagrange function is defined as: in, , , , These are Lagrange multipliers. By differentiating the Lagrange function and setting the derivative to zero, a set of equations is obtained. Solving these equations yields the optimal solution to the objective function, which serves as the optimal defense strategy. and its resource allocation plan.
8. An intrusion prediction and defense system based on genetic evolution and two-stage stochastic programming, characterized in that, include: The attack path prediction module is used to simulate the attacker's strategy selection and evolution process based on genetic algorithms, and output an elite set of high-threat attack paths. The decision module is used to establish a two-stage stochastic programming model based on the elite set output by the attack path prediction module. It takes the total expected cost as the objective function, introduces attack logic constraints and resource constraints, and outputs the optimal defense strategy and resource allocation scheme. The two-stage stochastic programming model includes: a first stage: making decisions and deploying defense strategies in advance; a second stage: calculating the expected loss based on the probability of different attack paths occurring; the total expected cost is the sum of the cost of deploying the defense strategy and the expected loss calculated based on the probability. The defense execution module is used to deploy defense measures and implement proactive defense based on the optimal defense strategy and resource allocation plan obtained from the decision module.
9. An electronic device, characterized in that, include: The memory, the processor, and the computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, it implements the intrusion prediction and defense method based on genetic evolution and two-stage stochastic programming as described in any one of claims 1-7.
10. A computer-readable storage medium storing a computer program that causes a computer to perform the intrusion prediction and defense method based on genetic evolution and two-stage stochastic programming as described in any one of claims 1-7.