Communication network defense processing method, storage medium and electronic device

Abstract

The application discloses a defense processing method of a communication network, a storage medium and an electronic device. It relates to the technical field of network security, and the method comprises the following steps: determining a plurality of initial attack resource quantities based on the respective corresponding traffic data of a plurality of device nodes in a target communication network within a preset time window; determining a plurality of initial defense resource quantities based on the plurality of initial attack resource quantities and the respective corresponding node importance degrees of the plurality of device nodes; determining a target function of the target communication network based on the plurality of initial attack resource quantities, the respective corresponding node importance degrees of the plurality of device nodes and the plurality of initial defense resource quantities; and optimizing the plurality of initial defense resource quantities to obtain a plurality of target defense resource quantities, with the maximum function value of the target function as the optimization target. The application solves the technical problem that, due to the fact that the related art does not comprehensively consider factors when facing a complex attack-defense scene, the adaptability of a defense strategy in an actual network environment is insufficient.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and more specifically, to a defense processing method, storage medium, and electronic device for communication networks. Background Technology

[0002] With the deepening development of digital information, cyberattacks on critical information infrastructure, industrial control systems, and core enterprise business systems are becoming increasingly complex, intelligent, and collaborative. In multi-node network attack and defense scenarios, defense systems are evolving from single-point protection to multi-entity collaborative defense. Related technologies employ security game theory to model the asymmetric adversarial relationship between attackers and defenders, where the attacker, as the leader, deploys attack resources first, and the defender, as the follower, responds by allocating defense resources, aiming to achieve Nash equilibrium or the optimal strategy combination under limited resource constraints. Such models theoretically provide an effective framework for defense decision-making under resource-constrained conditions. However, the attack-defense alliance game theory methods of related technologies have significant shortcomings, mainly in the following aspects:

[0003] First, defensive coordination mechanisms rely excessively on average allocation or static weights. This means that related technologies assume all nodes have equal value or allocate resources based solely on fixed importance, ignoring the non-linear impact of key nodes' success or failure on the overall network utility. This results in defense resources not being precisely focused on high-efficiency devices, making them vulnerable to precise attacks. Second, alliance stability lacks effective incentive and constraint mechanisms. Utility allocation mechanisms often employ uniform distribution or allocation based solely on the proportion of defense input, failing to consider the externalities of defensive actions. This leads to dual opportunistic behavior on the part of defenders: on the one hand, some defenders choose to free-ride to avoid risk, contributing only symbolically or not participating at all; on the other hand, when a node's utility is extremely high, defenders may defect from the alliance to monopolize all utility, defending that node alone, causing the alliance structure to collapse and creating a blind spot. Furthermore, game theory models are out of touch with the real network environment. Related technologies often abstract parameters such as attack intensity and defense costs into idealized values ​​or random variables, causing strategy generation to deviate from realistic attack and defense scenarios and lacking engineering feasibility. Although the attack-defense alliance game method in related technologies can achieve basic attack and defense strategy response within a certain range, it suffers from problems such as poor alliance stability and defense strategies that cannot be adapted to real network dynamic attack and defense scenarios when facing complex scenarios of multi-defender collaborative defense.

[0004] There is currently no effective solution to the above problems. Summary of the Invention

[0005] This invention provides a defense processing method, storage medium, and electronic device for communication networks, to at least solve the technical problem that the defense strategy is not adaptable to the actual network environment due to the incomplete consideration of factors when facing complex attack and defense scenarios in related technologies.

[0006] According to one aspect of the present invention, a defense processing method for a communication network is provided, comprising: determining multiple initial attack resource quantities based on traffic data corresponding to multiple device nodes in a target communication network within a preset time window, wherein the traffic data includes at least packet length, traffic duration, and packet arrival interval, the multiple initial attack resource quantities correspond one-to-one with the multiple device nodes, and the multiple initial attack resource quantities respectively represent the attack resources allocated by the attacker to the corresponding device node within the preset time window; determining multiple initial defense resource quantities based on the multiple initial attack resource quantities and the node importance corresponding to each of the multiple device nodes, wherein the multiple initial defense resource quantities correspond one-to-one with the multiple device nodes. Multiple initial defense resource quantities represent the defense resources allocated to corresponding device nodes by multiple defenders within a preset time window. Node importance is used to quantify the impact of the corresponding device node on the target communication network when the defense is successful or unsuccessful. Based on multiple initial attack resource quantities, the node importance of each device node, and multiple initial defense resource quantities, the objective function of the target communication network is determined. The objective function is used to indicate the total utility of multiple defenders in the attack and defense confrontation process. With maximizing the function value of the objective function as the optimization objective, the multiple initial defense resource quantities are optimized to obtain multiple target defense resource quantities, where each target defense resource quantity corresponds one-to-one with a device node.

[0007] According to another aspect of the present invention, a defense processing apparatus for a communication network is also provided, comprising: an initial attack resource quantity determination module, configured to determine multiple initial attack resource quantities based on traffic data corresponding to multiple device nodes in a target communication network within a preset time window, wherein the traffic data includes at least packet length, traffic duration, and packet arrival interval, the multiple initial attack resource quantities correspond one-to-one with multiple device nodes, and the multiple initial attack resource quantities respectively represent the attack resources allocated by the attacker to the corresponding device node within the preset time window; and an initial defense resource quantity determination module, configured to determine multiple initial defense resource quantities based on the multiple initial attack resource quantities and the node importance corresponding to each of the multiple device nodes, wherein the multiple initial defense resource quantities correspond one-to-one with the multiple device nodes. The system comprises several modules: a first module and a second module. The first module represents the initial defense resources allocated to corresponding device nodes by multiple defenders within a preset time window. The second module quantifies the impact of a device node on the target communication network when the defense is successful or unsuccessful. The third module determines the objective function of the target communication network based on the initial attack resources, the node importance of each device node, and the initial defense resources. The objective function indicates the total utility of the multiple defenders during the attack and defense process. The fourth module optimizes the initial defense resources by maximizing the objective function value to obtain multiple target defense resources, each corresponding to a specific device node.

[0008] According to another aspect of the present invention, a non-volatile storage medium is also provided, the non-volatile storage medium storing a plurality of instructions adapted for loading by a processor and executing any one of the defense processing methods of the communication network described herein.

[0009] According to another aspect of the present invention, an electronic device is also provided, including one or more processors and a memory, the memory being used to store one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors cause the one or more processors to implement the defense processing method of any one of the claims.

[0010] According to another aspect of the present invention, a computer program product is also provided, including a computer program that, when executed by a processor, implements the steps of the defense processing method for any of the communication networks described in the present invention.

[0011] In this embodiment of the invention, multiple initial attack resource quantities are determined based on the traffic data corresponding to multiple device nodes in the target communication network within a preset time window. The traffic data includes at least packet length, traffic duration, and packet arrival interval. Each initial attack resource quantity corresponds one-to-one with a multiple device node, and each initial attack resource quantity represents the attack resources allocated by the attacker to the corresponding device node within the preset time window. Based on the multiple initial attack resource quantities and the node importance corresponding to each device node, multiple initial defense resource quantities are determined. Each initial defense resource quantity corresponds one-to-one with a multiple device node, and each initial defense resource quantity represents the defense resources allocated by the defender to the corresponding device node within the preset time window. The node importance is used to quantify the impact of the corresponding device node on the target communication network when the defense is successful or unsuccessful. Based on the multiple initial attack resource quantities and the node importance corresponding to each device node... Based on the corresponding node importance and multiple initial defense resource quantities, the objective function of the target communication network is determined. This objective function indicates the total utility of multiple defenders during the attack and defense confrontation process. The optimization objective is to maximize the function value of the objective function, thereby optimizing the multiple initial defense resource quantities to obtain multiple target defense resource quantities. These target defense resource quantities correspond one-to-one with multiple device nodes. This achieves the goal of generating the initial attack resource quantity for each device node from traffic data of multiple device nodes in the target communication network, and combining this with the node importance to generate the initial defense resource quantity for each device node. This determines the optimization objective and accurately determines the target defense resource quantity for each device node, thus improving the adaptability of the defense strategy in the actual network environment. This solves the technical problem of insufficient adaptability of defense strategies in actual network environments due to incomplete consideration of factors in complex attack and defense scenarios in related technologies. Attached Figure Description

[0012] The accompanying drawings, which are included to provide a further understanding of the invention and form part of this application, illustrate exemplary embodiments of the invention and, together with their description, serve to explain the invention and do not constitute an undue limitation thereof. In the drawings:

[0013] Figure 1 This is a flowchart of a defense processing method for a communication network according to an embodiment of the present invention;

[0014] Figure 2 This is a flowchart of an optional method for determining the threat value of any device node according to an embodiment of the present invention;

[0015] Figure 3 This is a flowchart of an optional attack-defense alliance game method according to an embodiment of the present invention;

[0016] Figure 4This is a flowchart of an optional defense processing method for a communication network according to an embodiment of the present invention;

[0017] Figure 5 This is a schematic diagram of a defense processing device for a communication network according to an embodiment of the present invention. Detailed Implementation

[0018] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0019] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0020] First, to facilitate understanding of the embodiments of the present invention, some terms or nouns involved in the present invention will be explained below:

[0021] The Stackelberg equilibrium is a Nash equilibrium solution in asymmetric dynamic games, with its core structure being a "leader-follower" decision-making paradigm. In this equilibrium, one decision-maker (the leader) commits to and publicly discloses its strategy, and one or more other decision-makers (followers), after observing the leader's strategy, choose their optimal response strategy based on rational reactions. When formulating its strategy, the leader can anticipate and utilize the followers' optimal response function, thereby maximizing its own utility globally.

[0022] A defense alliance refers to a non-coercive, self-organizing, and rationally cooperative decision-making community formed by multiple defense nodes (such as firewalls and security servers) with independent control in a network attack and defense scenario, based on common security goals and through policy coordination, resource planning, and utility sharing mechanisms.

[0023] According to an embodiment of the present invention, a method embodiment for defense processing of a communication network is provided. It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions. Furthermore, although a logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in a different order than that shown here.

[0024] Figure 1 This is a flowchart of a defense processing method for a communication network according to an embodiment of the present invention, such as... Figure 1 As shown, the method includes the following steps:

[0025] Step S102: Based on the traffic data of multiple device nodes in the target communication network within a preset time window, determine multiple initial attack resource quantities. The traffic data includes at least the packet length, traffic duration, and packet arrival interval. The multiple initial attack resource quantities correspond one-to-one with the multiple device nodes. The multiple initial attack resource quantities represent the attack resources allocated by the attacker to the corresponding device nodes within the preset time window.

[0026] Optionally, traffic data within a preset time window is collected from the edge side of each device node in the target communication network. This traffic data is then processed to generate initial attack resources corresponding to each device node. The target communication network can be an enterprise office network, industrial control system network, data center intranet, power dispatch automation network, or a communication subnet of critical information infrastructure. Multiple device nodes include, but are not limited to, host servers, virtualization hosts, industrial control terminals, network boundary firewalls, core switches, database service nodes, business system application servers, subnet segments, and critical data storage areas. These multiple device nodes not only serve as information entities carrying business functions and protected by security within the target communication network, but also as the basic units for attack and defense game and resource allocation. This step ensures that the attacker's behavior is no longer a theoretical assumption, but is driven by observable, calculable, and reproducible traffic data, guaranteeing that the generation of game strategies has data support and scenario adaptability, thereby significantly improving the accuracy and real-time nature of defense strategies.

[0027] In one optional embodiment, when there are multiple traffic data, multiple initial attack resource quantities are determined based on the traffic data corresponding to each of the multiple device nodes in the target communication network within a preset time window. This includes: determining target traffic data corresponding to each of the multiple device nodes from the traffic data of the multiple device nodes within the preset time window, wherein the target traffic data is traffic data associated with the attack behavior; determining the threat value corresponding to each of the multiple device nodes based on the target traffic data corresponding to each of the multiple device nodes, wherein the threat value represents the risk value of the corresponding device node being attacked within the preset time window; and obtaining multiple initial attack resource quantities based on a preset attack budget and the threat values ​​corresponding to each of the multiple device nodes, wherein the preset attack budget represents the total attack resource quantity allocated by the attacker to the multiple device nodes within the preset time window.

[0028] Optionally, in complex network environments with multiple device nodes and heterogeneity, this step can achieve dynamic modeling and computable prediction of attacker behavior by accurately constructing a quantitative mapping link from traffic to threat value and then to attack resource allocation. Specifically, firstly, from multiple traffic data, metadata fields unrelated to attack behavior (such as flow identifiers) are removed, retaining only core data with attack characterization capabilities (including but not limited to traffic intensity and scale data, packet length structure data, time structure and burst data, and protocol behavior data), thereby filtering out target traffic data strongly correlated with attack behavior. Among them, traffic intensity and scale data are used to characterize the traffic volume and rate of flooding attacks, such as flow duration, total forward packets, total backward packets, total length of forward packets, total length of backward packets, flow byte rate, flow packet rate, subflow forward packets, subflow forward bytes, subflow backward packets, and subflow backward bytes.Packet length structure data is used to characterize the size patterns and return packet differences of packets generated by attack tools, such as the maximum forward packet length (FwdPacket Length Max), minimum forward packet length (Fwd Packet Length Min), mean forward packet length (Fwd Packet Length Mean), standard deviation of forward packet length (Fwd Packet Length Std), maximum reverse packet length (Bwd Packet Length Max), minimum reverse packet length (Bwd Packet Length Min), mean reverse packet length (Bwd Packet Length Mean), standard deviation of reverse packet length (Bwd Packet Length Std), minimum of all packet lengths (Min Packet Length), maximum of all packet lengths (Max Packet Length), mean of all packet lengths (Packet Length Mean), standard deviation of all packet lengths (Packet Length Std), variance of all packet lengths (Packet Length Variance), average packet size (Average PacketSize), and average forward packet segment size (Avg Fwd). Segment Size and Average Reverse Segment Size (Avg BwdSegment Size).Temporal structure and burst data are used to characterize short-period high-frequency impacts and session intervals, such as Flow IAT Mean, Flow IAT Std, Flow IAT Max, Flow IAT Min, Total Forward IAT (Fwd IAT Total), Total Backward IAT (Bwd IAT Total), Total Backward IAT Mean, Total Backward IAT Mean, Total Backward IAT Std, Total Backward IAT Max, Total Backward IAT Min, Total Active Duration Mean, Total Active Duration Std, Total Active Duration Max, Total Active Duration Min, Total Active Duration Mean, Total Active Duration Std, Total Active Duration Max, Total Active Duration Min, Total Active Duration Std ... The idle time includes the mean idle time (Idle Mean), the standard deviation of idle time (Idle Std), the maximum idle time (Idle Max), and the minimum idle time (Idle Min).Protocol behavior data is used to characterize abnormal handshakes and flag distributions during scanning or flooding, such as FIN flag count, SYN flag count, RST flag count, PSH flag count, ACK flag count, URG flag count, CWE flag count, ECE flag count, number of forward PSH flags (Fwd PSH Flags), number of reverse PSH flags (Bwd PSH Flags), number of forward URG flags (Fwd URG Flags), and number of reverse URG flags (Bwd URG Flags). Flags, Init_Win_bytes_forward, Init_Win_bytes_backward, Act_data_pkt_fwd, Min_seg_size_forward, Fwd Header Length, Bwd Header Length, and Down / Up Ratio.

[0029] Next, after obtaining the target traffic data, the data is normalized to eliminate dimensional differences. Then, a weighted summation of threat contributions is performed on the target traffic data using preset weights to obtain the threat value for each device node. This threat value is not subjectively set but is a quantifiable risk indicator driven by real network behavior data and possessing interpretability. It objectively reflects the attack intensity and urgency faced by each node in the current offensive and defensive situation, providing a basis for the allocation of attack resources. Finally, based on the attacker's preset attack budget within a preset time window, the threat value of each device node is normalized, and attack resources are allocated proportionally to generate a set of initial attack resource quantities corresponding one-to-one with each device node. The initial attack resource quantity for any device node at any moment within the preset time window can be obtained as follows: ,in, This represents the initial attack resource quantity of any device node at any given time within a preset time window, where t represents the index at any given time. This indicates the preset attack budget. Let represent the threat value of any device node, and 'i' represent the index of any device node. By obtaining the initial attack resource quantity of any device node at any given moment within a preset time window, multiple initial attack resource quantities can be obtained. This step transforms the determination of which device nodes in the target communication network are most dangerous into a computable decision of which device nodes the attacker is most likely to prioritize attacking. The resulting initial attack resource quantities constitute the initial strategy input adopted by the attacker in a Stackelberg game, thus avoiding the shortcomings of related technologies that rely on static assumptions or manually set attack strengths, thereby realizing the transformation of attack strategy from empirical speculation to data deduction.

[0030] In one optional embodiment, when there are multiple target traffic data, the threat value corresponding to each of the multiple device nodes is determined based on the target traffic data corresponding to each of the multiple device nodes. This includes: normalizing the multiple target traffic data of any device node to obtain multiple normalized traffic data of any device node; performing a weighted summation operation based on the multiple normalized traffic data and the weights corresponding to each of the multiple normalized traffic data to obtain the threat value of any device node; and obtaining the threat value corresponding to each of the multiple device nodes by using the same method as obtaining the threat value of any device node.

[0031] Optionally, to achieve accurate mapping from traffic data to attack and defense strategies, this step constructs a threat quantification mechanism for multiple device nodes. Figure 2 This is a flowchart of an optional threat value determination method for any device node according to an embodiment of the present invention. As can be seen from the figure, for any device node, when multiple target traffic data are captured within a preset time window, step S202 involves extracting any target traffic data of any device node to obtain a feature vector of any target traffic data. Where f represents the index of any target traffic data, and k represents the index of any feature of any target traffic data. Step S204 involves normalizing the feature vector of any target traffic data to obtain (multiple normalized traffic data sets) for that target traffic data set. Normalization is performed to eliminate numerical bias caused by differences in the dimensions of different features. ,in, This represents any normalized traffic data for any target traffic data. Step S206: Perform a weighted summation operation on any normalized traffic data and the feature vectors of any target traffic data to obtain the threat value of any target traffic data. Where d represents the number of features of any target traffic data. This represents the threat value of any normalized traffic data for any target traffic data. This represents the weight of any normalized traffic data for any target traffic data. Step S208: The threat values ​​of multiple target traffic data under any device node are summed to obtain the threat value of any device node. ,in, This represents the set of target traffic data for any device node at any given moment within a preset time window, where t represents the index of that moment and i represents the index of that device node. This threat value serves as input for the attacker to generate the initial attack resource quantity, ensuring that the attack strategy is based on real traffic conditions, rather than arbitrary assumptions.

[0032] Step S104: Based on multiple initial attack resource quantities and the node importance of each of the multiple device nodes, determine multiple initial defense resource quantities. Each of the multiple initial defense resource quantities corresponds to a single device node. Each of the multiple initial defense resource quantities represents the defense resources allocated to the corresponding device nodes by the multiple defenders within a preset time window. The node importance is used to quantify the degree of impact of the corresponding device node on the target communication network when the defense is successful or unsuccessful.

[0033] Optionally, to achieve dynamic allocation of defense resources, this step constructs an initial defense resource allocation mechanism based on the initial amount of attack resources generated by the attacker and the node importance corresponding to each device node in the target communication network. This mechanism ensures that defense resources are preferentially concentrated on nodes with high utilization and nodes currently under high attack intensity, avoiding the shortcomings of uniform allocation or focusing only on attack while neglecting utility in related technologies.

[0034] In one optional embodiment, multiple initial defense resource quantities are determined based on multiple initial attack resource quantities and the node importance corresponding to each of the multiple device nodes, including: determining the defense resource allocation ratio corresponding to each of the multiple device nodes based on multiple initial attack resource quantities and the node importance corresponding to each of the multiple device nodes; obtaining multiple initial defense resource quantities based on a preset defense budget and the defense resource allocation ratio corresponding to each of the multiple device nodes, wherein the preset defense budget represents the total defense resources allocated to multiple device nodes by multiple defenders within a preset time window.

[0035] Optionally, the defense resource allocation ratio of any device node at any time within a preset time window can be obtained in the following way: ,in, This represents the importance of any device node. This calculation method ensures that high-utility and high-risk device nodes receive higher allocation weights. Subsequently, combining the preset defense budgets available to multiple defenders (i.e., defense alliances) within a preset time window, the initial defense resource quantity of any device node at any moment within the preset time window can be obtained through linear scaling as follows: = ,in, This represents the preset defense budget. Multiple initial defense resource amounts can be obtained by acquiring the initial defense resource amount of any device node at any given moment within a preset time window. These initial defense resource amounts serve as the starting point for subsequent iterative responses from multiple defenders, ensuring a fair game and significantly improving defense efficiency.

[0036] Step S106: Based on multiple initial attack resource quantities, the node importance corresponding to each of the multiple device nodes, and multiple initial defense resource quantities, determine the objective function of the target communication network, wherein the objective function is used to indicate the total utility of multiple defenders in the attack and defense confrontation process.

[0037] Optionally, to maximize the overall utility of multiple defenders, an objective function is constructed to quantify the total utility during the attack and defense confrontation process. This objective function nonlinearly couples attack intensity, defense investment, and node importance, ultimately leading to the optimal overall utility of multiple defenders. This can resolve the contradiction of individual damage to the collective in multi-entity collaborative defense, thereby significantly improving the overall anti-attack capability of the target communication network and the stability of the alliance.

[0038] In one optional embodiment, the objective function of the target communication network is determined based on multiple initial attack resource quantities, the node importance of each of the multiple device nodes, and multiple initial defense resource quantities. This includes: determining the success probability of defense for each of the multiple device nodes based on the initial attack resource quantities and the initial defense resource quantities; determining the total synergistic utility for each of the multiple device nodes based on the initial attack resource quantities, the node importance of each of the multiple device nodes, and the multiple initial defense resource quantities, where the total synergistic utility represents the additional utility gained by multiple defenders if the corresponding device node's defense is successful; determining the total synergistic penalty for each of the multiple device nodes based on the initial attack resource quantities, the node importance of each of the multiple device nodes, and the multiple initial defense resource quantities, where the total synergistic penalty represents the additional penalty gained by multiple defenders if the corresponding device node's defense fails; and obtaining the objective function based on the success probability of defense for each of the multiple device nodes, the total synergistic utility for each of the multiple device nodes, and the total synergistic penalty for each of the multiple device nodes.

[0039] Optionally, firstly, based on the attack resources and defense resources of any device node, the success rate of defense for any device node can be obtained in the following way. = ,in, Indicates the preset mapping function. Represents the smoothing constant. This represents the amount of attack resources available for any given device node. This represents the defensive resource quantity of any device node. The probabilistic calculation model uses a logistic response function, with the output being a continuous value between 0 and 1, serving as the weighting basis for subsequent utility and penalty calculations. Building upon this, two dimensions—total collateral utility and total collateral penalty—are further introduced to achieve collaborative incentives and risk-sharing within the alliance. When a device node successfully defends itself, in addition to the local utility gained by the directly participating defender, all members of the alliance gain positive externalities due to the preservation of that device node, i.e., total collateral utility. Conversely, when a device node fails to defend itself, although the directly participating defender bears the primary responsibility, the overall reputation of the alliance is damaged, the security baseline is lowered, and all members also bear collateral penalties, i.e., total collateral penalty. Finally, the objective function is constructed as the total utility of multiple defenders, i.e., the sum of collateral utility and collateral penalty under both successful and failed defense scenarios. This objective function not only considers the individual defense results of each device node, but also deeply binds individual behavior with the overall fate of the alliance through a linkage mechanism. This ensures that any defender who attempts to defend a high-value node alone or passively defend a low-risk node will suffer systemic losses due to the imbalance in the distribution of linkage benefits, thereby achieving a collaborative alliance mechanism of shared progress and shared honor and disgrace.

[0040] In one optional embodiment, based on multiple initial attack resource quantities, the node importance of each of the multiple device nodes, and multiple initial defense resource quantities, the total associated utility corresponding to each of the multiple device nodes is determined, including: based on any initial attack resource quantity, any node importance of any device node, and any initial defense resource quantity, the associated utility of any device node for any defender is determined in the following manner:

[0041] ;

[0042] in, This represents the collateral effect of any defending party on any device node. It represents a set of multiple defenders. This represents any initial amount of defense resources, and i represents the index of any device node. Let m represent the initial attack resource quantity, m represent the number of multiple defenders, and k represent the index of any defender. This indicates the importance of any given device node. This indicates the preset defense effectiveness coefficient. This indicates the preset attack damage coefficient. This represents a preset positive externality coefficient, used to indicate the proportion of utility shared by the non-defending parties when any device node successfully defends; the total joint utility of any device node is obtained by summing the joint utility of each of the multiple defending parties; and the total joint utility of multiple device nodes is obtained by using the method of obtaining the total joint utility of any device node.

[0043] Optional, in the formula This represents the preset defense effectiveness coefficient, used to amplify the positive contribution of defense resources to the security situation; This represents a preset attack damage coefficient, used to amplify the negative impact of attack resources on the security posture. Through a cascading utility mechanism, it quantifies the indirect utility gained by defenders who did not directly participate in the defense of a particular device node when that node is successfully defended, thereby suppressing non-cooperative behaviors such as free-riding and defection from the alliance. The calculation method of this step firstly breaks the zero-sum game mentality of "whoever defends benefits" in related defense models, making all defenders common beneficiaries of security achievements through a positive externality design of shared success, greatly enhancing the cohesion and willingness to cooperate within the alliance; secondly, cascading utility is directly related to the initial amount of defense resources, forcing defenders to pursue optimal defense effectiveness rather than minimum investment in resource allocation, effectively curbing opportunistic behaviors such as symbolic defense and reducing investment to avoid responsibility; thirdly, this mechanism, through the weighting of node importance, ensures that the cascading utility of highly efficient nodes is far higher than that of other nodes. Furthermore, by obtaining the cascading utility of any defender for any device node, the cascading penalty of any defender for any device node can be obtained, thus obtaining the total cascading penalty for each of the multiple device nodes. ,in, This represents the preset penalty externality coefficient, used to indicate the proportion of penalty shared by the non-participating defenders when any device node fails to defend.

[0044] In an optional embodiment, the objective function is obtained based on the defense success probability of each of the multiple device nodes, the total synergistic utility of each of the multiple device nodes, and the total synergistic penalty of each of the multiple device nodes. This objective function is obtained as follows: ;in, This represents the function value of the objective function. This represents the probability of successful defense for any one of the multiple device nodes. This represents the collateral effect of any defending party on any device node. This represents the collateral penalty for any defender on any device node, where i represents the index of any device node, N represents the number of multiple device nodes, k represents the index of any defender, and m represents the number of multiple defenders.

[0045] Optionally, in the multi-defender Stackelberg network attack-defense coalition game model, the objective function is the core of the defense coalition's strategy optimization under conditions of complete information. Its role is to abstract the complex dynamic process of attack-defense confrontation into a computable, maximizable, and optimizable unified utility function, thereby guiding all defenders to collaboratively select the optimal defense resource allocation strategy within the coalition framework. The construction of this objective function does not consider individual utility in isolation, but rather organically integrates the probability of successful defense, the total collateral utility upon successful defense, and the total collateral penalty upon failure, forming a complete mathematical expression reflecting the overall expected utility of the coalition, thus achieving a leap from local confrontation to global collaboration.

[0046] Step S108: Taking the maximization of the objective function value as the optimization objective, optimize multiple initial defense resource quantities to obtain multiple target defense resource quantities, wherein the multiple target defense resource quantities correspond one-to-one with multiple device nodes.

[0047] Optionally, in a multi-party collaborative defense framework, maximizing the objective function is the optimization goal. This allows for an automated and intelligent transition of defense resources from initial allocation to optimal configuration, significantly improving defense efficiency and alliance stability. Optimization transforms defense resource allocation from experience-driven or static rule-driven to mathematically optimized, ensuring that each resource allocation aims to maximize the overall alliance utility and avoiding resource misallocation, redundant investment, or omissions of critical nodes due to human judgment biases in related technologies.

[0048] In one optional embodiment, the optimization objective is to maximize the function value of the objective function, and multiple initial defense resource quantities are optimized to obtain multiple target defense resource quantities. This includes: optimizing multiple initial defense resource quantities to maximize the function value of the objective function, resulting in multiple optimized defense resource quantities, wherein each optimized defense resource quantity corresponds to a specific device node; determining the optimization utility of each defender and the optimization utility of the attacker based on the multiple optimized defense resource quantities, wherein the optimization utility of each defender is used to quantify the utility obtained by the corresponding defender participating in the defense of multiple device nodes, and the optimization utility of the attacker is used to quantify the utility obtained by the attacker attacking multiple device nodes; repeating the optimization process until a preset termination condition is reached, wherein the preset termination condition includes one of the following: the optimization utility of each defender and the optimization utility of the attacker reach a Stackelberg equilibrium, or a preset number of iterations; and obtaining multiple target defense resource quantities based on the multiple optimized defense resource quantities obtained when the preset termination condition is reached.

[0049] Optional, Figure 3 This is a flowchart of an optional attack-defense alliance game method according to an embodiment of the present invention. The flowchart illustrates the specific implementation process of determining the target defense resource quantity. First, in the optimization process, the attacker, acting as the leader, uses a mapping algorithm in the traffic processing module to analyze traffic data and generate a pre-attack vector. (Initial Attack Resources) Multiple defenders, acting as followers, determine the initial defense resources based on complete observation of the attack strategy and node importance. In the traffic capture module, traffic data can be captured using tools such as NetFlow. Then, in the strategy-solving game theory module, the initial defense resources are optimized by maximizing the objective function value, resulting in the optimized defense resources. Simultaneously, the corresponding defense resources are updated to obtain the final optimized defense resources. The optimization utility of any defender can be calculated as follows: ,in, , , It represents the local utility of any defender of any device node, which is the utility obtained by any defender who participated in the defense of the device node when the device node is successfully defended; This represents the local penalty for any defender of any device node, which is the penalty received by any defender participating in the defense of that device node when the defense fails. This represents the set of defenders participating in the defense of any given device node. By obtaining the optimized utility of any one defender, the optimized utility of multiple defenders can be obtained. The optimized utility of the attacker can be calculated as follows: ,in, The scaling factor representing the utility of the attack. The scaling coefficients represent the cost of attack resource consumption, and these two scaling coefficients are used to balance the relative weights of attack utility and resource cost in the utility function. Furthermore, the optimal utility for each of the multiple defenders and the optimal utility for the attacker are determined. This optimization process is not completed all at once, but rather converges gradually through multiple rounds of interactive responses. After each round of optimization, the multiple defenders update their resource configurations based on the obtained optimal utility and expose this configuration to the attacker. The attacker then reassesses its optimal utility and updates its attack resource allocation accordingly, thus forming a closed-loop game between defense and attack responses. The optimization process continues until a preset termination condition (i.e., convergence) is met. If the preset termination condition is not met, manual intervention is performed until it is reached. The termination condition includes any of the following: the optimal utility of the defense alliance and the attacker tends to stabilize, reaching a Stackelberg equilibrium, indicating that neither side can obtain higher efficiency by unilaterally changing their strategy; or the preset maximum number of iterations has been executed, and iteration is terminated even if complete convergence has not yet occurred to ensure system real-time performance. When the termination condition is met, the optimized defense resource quantity for the final round is determined as the target defense resource quantity, and the optimized attack resource quantity for the final round is also determined as the target attack resource quantity. This step, by taking the maximization of the total utility of multiple defenders as the optimization objective and multi-round interactive response as the implementation path, constructs the first multi-defender collaborative defense decision engine with game-theoretic convergence capability, which can solve the problems of poor stability of defense alliances and unbalanced resource allocation.

[0050] Through the above steps S102 to S108, the initial attack resource quantity of each device node can be generated by using traffic data from multiple device nodes in the target communication network, and the initial defense resource quantity of each device node can be generated by combining the node importance. This determines the optimization target and aims to accurately determine the target defense resource quantity of each device node. This achieves the technical effect of improving the adaptability of the defense strategy in the actual network environment, and solves the technical problem that the defense strategy is not adaptable to the actual network environment due to the incomplete consideration of factors when facing complex attack and defense scenarios in related technologies.

[0051] Based on the above embodiments and optional embodiments, the present invention proposes an optional implementation method. Figure 4 This is a flowchart of an optional defense processing method for a communication network according to an embodiment of the present invention, such as... Figure 4 As shown, the method includes:

[0052] S1: Within a preset time window, traffic data is acquired from edge acquisition devices at each device node of the target communication network. Specifically, this includes raw network packet sequences collected by edge probes or mirror ports at each device node. Each packet contains a timestamp, source network address, destination network address, source port, destination port, transport layer protocol number, and packet length field. Node affiliation mapping is performed on each packet, mapping it to the corresponding device node according to predefined node partitioning rules.

[0053] S2: Extract target traffic data that is strongly correlated with the attack behavior from the traffic data of each device node. The specific implementation process is the same as the previous embodiment, and will not be repeated here.

[0054] S3: Normalize the target traffic data of each device node and calculate the threat value of each device node. The specific implementation process is the same as the aforementioned embodiment, and will not be repeated here.

[0055] S4: Based on the preset attack budget and the threat value of each device node, the initial attack resource amount of each device node is obtained. The specific implementation process is the same as the aforementioned embodiment, and will not be repeated here.

[0056] S5: Multiple defenders obtain the initial defense resources of each device node based on the initial attack resources of each device node and the node importance of each device node. The specific implementation process is the same as the aforementioned embodiment, and will not be repeated here.

[0057] S6: Based on the initial attack resources, initial defense resources, and node importance of each device node, simulate attack and defense confrontation and calculate the success probability of defense for each device node. The specific implementation process is the same as the aforementioned embodiment, and will not be repeated here.

[0058] S7: Based on the initial attack resources and initial defense resources of each device node, determine the total synergistic effect and total synergistic penalty of each device node. The specific implementation process is the same as the aforementioned embodiment, and will not be repeated here.

[0059] S8: Based on the success probability of defense, total synergistic utility and total synergistic penalty of each device node, the optimization objective is determined to maximize the total utility of multiple defenders in the attack and defense confrontation process. The specific implementation process is the same as the aforementioned embodiment, and will not be repeated here.

[0060] S9: Based on the optimization objective, the initial defense resource quantity and initial attack resource quantity of each device node are optimized to obtain the target defense resource quantity and target attack resource quantity of each device node. The specific implementation process is the same as the aforementioned embodiment, and will not be repeated here.

[0061] This embodiment can achieve at least one of the following effects: (1) Improved stability of the defense alliance (multiple defense parties). This embodiment designs a multi-utility mechanism. Through this mechanism of externality utility and punishment, individual utility and the overall defense result of the alliance are effectively bound together, thereby curbing the bad behavior of defense parties monopolizing the utility of key nodes and not participating in defense, and further improving the stability of the alliance. (2) Stronger implementation capability of game theory scheme. This embodiment designs a traffic sample and attack vector mapping mechanism. By collecting real traffic data in a specific time window of a multi-node network, extracting attack-related features and quantifying the degree of threat, a pre-attack vector highly adapted to the actual attack and defense scenario is generated, effectively opening up the connection channel between the theoretical game theory model and the real network environment, thereby getting rid of the limitation of relying on abstract numerical modeling in related technologies, allowing the defense resource allocation strategy to have real data support, and further improving the feasibility of the engineering implementation of the game theory scheme. (3) More adaptable to the differentiated deployment of importance in actual scenarios. This embodiment introduces the concept of node importance, clearly quantifies the impact of different nodes on the overall utility when the defense is successful or unsuccessful, especially the correlation between the importance of nodes and the investment of defense resources. This design allows the defenders to allocate defense resources reasonably based on the function and security importance of nodes, thereby avoiding defection due to unequal distribution of benefits within the alliance (multiple defenders).

[0062] This embodiment also provides a defense processing device for a communication network, which is used to implement the above embodiments and preferred embodiments; details already described will not be repeated. As used below, the terms "module" and "device" can refer to a combination of software and / or hardware that performs a predetermined function. Although the device described in the following embodiments is preferably implemented in software, hardware implementation, or a combination of software and hardware, is also possible and contemplated.

[0063] According to an embodiment of the present invention, an apparatus embodiment for implementing the above-described defense processing method for communication networks is also provided. Figure 5 This is a schematic diagram of the structure of a defense processing device for a communication network according to an embodiment of the present invention, as shown below. Figure 5 As shown, the defense processing device for the aforementioned communication network includes: an initial attack resource quantity determination module 500, an initial defense resource quantity determination module 502, an objective function construction module 504, and an objective defense resource quantity determination module 506, wherein:

[0064] The initial attack resource quantity determination module 500 is used to determine multiple initial attack resource quantities based on the traffic data of multiple device nodes in the target communication network within a preset time window. The traffic data includes at least the packet length, traffic duration and packet arrival interval. The multiple initial attack resource quantities correspond one-to-one with the multiple device nodes. The multiple initial attack resource quantities represent the attack resources allocated by the attacker to the corresponding device nodes within the preset time window.

[0065] The initial defense resource quantity determination module 502 is connected to the initial attack resource quantity determination module 500. It is used to determine multiple initial defense resource quantities based on multiple initial attack resource quantities and the node importance of each of the multiple device nodes. The multiple initial defense resource quantities correspond one-to-one with multiple device nodes. The multiple initial defense resource quantities represent the defense resources allocated to the corresponding device nodes by multiple defenders within a preset time window. The node importance is used to quantify the degree of impact of the corresponding device node on the target communication network when the defense is successful or unsuccessful.

[0066] The objective function construction module 504 is connected to the initial defense resource quantity determination module 502. It is used to determine the objective function of the target communication network based on multiple initial attack resource quantities, the node importance corresponding to each of multiple device nodes, and multiple initial defense resource quantities. The objective function is used to indicate the total utility of multiple defenders in the attack and defense confrontation process.

[0067] The target defense resource quantity determination module 506 is connected to the target function construction module 504. It is used to optimize multiple initial defense resource quantities with the maximum function value of the target function as the optimization objective, and obtain multiple target defense resource quantities. Among them, the multiple target defense resource quantities correspond one-to-one with multiple device nodes.

[0068] It should be noted that the above modules can be implemented by software or hardware. For example, for the latter, it can be implemented in the following ways: the above modules can be located in the same processor; or the above modules can be located in different processors in any combination.

[0069] It should be noted that the initial attack resource quantity determination module 500, the initial defense resource quantity determination module 502, the target function construction module 504, and the target defense resource quantity determination module 506 correspond to steps S102 to S108 in the embodiments. The instances and application scenarios implemented by the above modules and corresponding steps are the same, but are not limited to the content disclosed in the above embodiments. It should be noted that the above modules, as part of the device, can run on a computer terminal.

[0070] It should be noted that the optional or preferred implementation methods of this embodiment can be found in the relevant descriptions in the embodiments, and will not be repeated here.

[0071] The aforementioned defense processing device for the communication network may further include a processor and a memory. The aforementioned initial attack resource quantity determination module 500, initial defense resource quantity determination module 502, target function construction module 504, target defense resource quantity determination module 506, etc., are all stored in the memory as program modules, and the processor executes the aforementioned program modules stored in the memory to realize the corresponding functions.

[0072] The processor contains a core that retrieves the corresponding program modules from memory. One or more cores may be configured. Memory may include non-persistent memory in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory includes at least one memory chip.

[0073] According to an embodiment of this application, an embodiment of a non-volatile storage medium is also provided. Optionally, in this embodiment, the non-volatile storage medium includes a stored program, wherein, when the program runs, it controls the device where the non-volatile storage medium is located to execute any of the aforementioned communication network defense processing methods.

[0074] Optionally, in this embodiment, the non-volatile storage medium may be located in any computer terminal in a group of computer terminals in a computer network, or in any mobile terminal in a group of mobile terminals, and the non-volatile storage medium includes stored programs.

[0075] Optionally, during program execution, the device containing the non-volatile storage medium performs the following functions: Based on the traffic data corresponding to multiple device nodes in the target communication network within a preset time window, determine multiple initial attack resource quantities. The traffic data includes at least packet length, traffic duration, and packet arrival interval. Each initial attack resource quantity corresponds one-to-one with a specific device node, representing the attack resources allocated by the attacker to the corresponding device node within the preset time window. Based on the multiple initial attack resource quantities and the node importance corresponding to each device node, determine multiple initial defense resource quantities. Each initial defense resource quantity corresponds one-to-one with a specific device node. The initial defense resource quantities represent the defense resources allocated to corresponding device nodes by multiple defenders within a preset time window. Node importance is used to quantify the impact of the corresponding device node on the target communication network when the defense is successful or unsuccessful. Based on the multiple initial attack resource quantities, the node importance of each device node, and the multiple initial defense resource quantities, the objective function of the target communication network is determined. The objective function is used to indicate the total utility of multiple defenders in the attack and defense confrontation process. With maximizing the function value of the objective function as the optimization objective, the multiple initial defense resource quantities are optimized to obtain multiple target defense resource quantities, which correspond one-to-one with multiple device nodes.

[0076] According to an embodiment of this application, an embodiment of a processor is also provided. Optionally, in this embodiment, the processor is used to run a program, wherein the program executes any of the aforementioned communication network defense processing methods.

[0077] According to an embodiment of this application, an embodiment of a computer program product is also provided. Optionally, in this embodiment, the computer program product includes a computer program that, when executed by a processor, implements the steps of the communication network defense processing method described above.

[0078] Optionally, when the aforementioned computer program product is executed on a data processing device, it is suitable to execute an initialization program with the following method steps: Based on the traffic data corresponding to multiple device nodes in the target communication network within a preset time window, determine multiple initial attack resource quantities, wherein the traffic data includes at least packet length, traffic duration, and packet arrival interval; the multiple initial attack resource quantities correspond one-to-one with the multiple device nodes, and each initial attack resource quantity represents the attack resource allocated by the attacker to the corresponding device node within the preset time window; based on the multiple initial attack resource quantities and the node importance corresponding to each of the multiple device nodes, determine multiple initial defense resource quantities, wherein the multiple initial defense resource quantities correspond to the multiple device nodes... In a one-to-one correspondence, multiple initial defense resource quantities represent the defense resources allocated to corresponding device nodes by multiple defenders within a preset time window. Node importance is used to quantify the impact of the corresponding device node on the target communication network when the defense is successful or unsuccessful. Based on multiple initial attack resource quantities, the node importance of each device node, and multiple initial defense resource quantities, the objective function of the target communication network is determined. The objective function is used to indicate the total utility of multiple defenders in the attack and defense confrontation process. With maximizing the function value of the objective function as the optimization objective, multiple initial defense resource quantities are optimized to obtain multiple target defense resource quantities, where multiple target defense resource quantities correspond one-to-one with multiple device nodes.

[0079] This invention provides an electronic device, including a processor, a memory, and a program stored in the memory and executable on the processor. When the processor executes the program, it performs the following steps: Based on the traffic data corresponding to multiple device nodes in a target communication network within a preset time window, it determines multiple initial attack resource quantities. The traffic data includes at least packet length, traffic duration, and packet arrival interval. Each initial attack resource quantity corresponds one-to-one with a multiple device node, and each initial attack resource quantity represents the attack resources allocated by the attacker to the corresponding device node within the preset time window. Based on the multiple initial attack resource quantities and the node importance corresponding to each of the multiple device nodes, it determines multiple initial defense resource quantities. Each set of defense resources corresponds one-to-one with multiple device nodes. Multiple initial defense resource sets represent the defense resources allocated to corresponding device nodes by multiple defenders within a preset time window. Node importance is used to quantify the impact of a corresponding device node on the target communication network when the defense is successful or unsuccessful. Based on multiple initial attack resource sets, the node importance of each device node, and multiple initial defense resource sets, the objective function of the target communication network is determined. The objective function indicates the total utility of multiple defenders during the attack and defense confrontation process. The multiple initial defense resource sets are optimized with the objective function's maximum value as the optimization objective, resulting in multiple target defense resource sets, each corresponding one-to-one with multiple device nodes.

[0080] The order of the above embodiments of the present invention is merely for description and does not represent the superiority or inferiority of the embodiments.

[0081] In the above embodiments of the present invention, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0082] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. The device embodiments described above are merely illustrative; for example, the division of modules described above can be a logical functional division, and in actual implementation, there may be other division methods. For example, multiple modules or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces, or indirect coupling or communication connection between modules, and may be electrical or other forms.

[0083] The modules described above as separate components may or may not be physically separate. Similarly, the components shown as modules may or may not be physical modules; they may be located in one place or distributed across multiple modules. Some or all of the modules can be selected to achieve the purpose of this embodiment, depending on actual needs.

[0084] Furthermore, the functional modules in the various embodiments of the present invention can be integrated into one processing module, or each module can exist physically separately, or two or more modules can be integrated into one module. The integrated modules described above can be implemented in hardware or as software functional modules.

[0085] If the aforementioned integrated modules are implemented as software functional modules and sold or used as independent products, they can be stored in a computer-readable non-volatile storage medium. Based on this understanding, the technical solution of this invention, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a non-volatile storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of the various embodiments of this invention. The aforementioned non-volatile storage medium includes various media capable of storing program code, such as USB flash drives, read-only memory (ROM), random access memory (RAM), portable hard drives, magnetic disks, or optical disks.

[0086] The above are merely preferred embodiments of the present invention. It should be noted that those skilled in the art can make various improvements and modifications without departing from the principle of the present invention, and these improvements and modifications should also be considered within the scope of protection of the present invention.

Claims

1. A defense processing method for a communication network, characterized in that, include: Based on the traffic data of multiple device nodes in the target communication network within a preset time window, multiple initial attack resource quantities are determined. The traffic data includes at least message length, traffic duration and message arrival interval. The multiple initial attack resource quantities correspond one-to-one with the multiple device nodes. The multiple initial attack resource quantities represent the attack resources allocated by the attacker to the corresponding device nodes within the preset time window. Based on the multiple initial attack resource quantities and the node importance of each of the multiple device nodes, multiple initial defense resource quantities are determined. The multiple initial defense resource quantities correspond one-to-one with the multiple device nodes. The multiple initial defense resource quantities represent the defense resources allocated to the corresponding device nodes by multiple defenders within the preset time window. The node importance is used to quantify the degree of impact of the corresponding device node on the target communication network when the defense is successful or unsuccessful. Based on the multiple initial attack resource quantities, the node importance corresponding to each of the multiple device nodes, and the multiple initial defense resource quantities, the objective function of the target communication network is determined, wherein the objective function is used to indicate the total utility of the multiple defenders in the attack and defense confrontation process; With the objective function value being maximized as the optimization objective, the multiple initial defense resource quantities are optimized to obtain multiple target defense resource quantities, wherein each of the multiple target defense resource quantities corresponds one-to-one with the multiple device nodes.

2. The method according to claim 1, characterized in that, When the traffic data includes multiple components, the determination of multiple initial attack resource quantities based on the traffic data corresponding to each of the multiple device nodes in the target communication network within a preset time window includes: From the traffic data of the plurality of device nodes within the preset time window, determine the target traffic data corresponding to each of the plurality of device nodes, wherein the target traffic data is traffic data associated with the attack behavior; Based on the target traffic data corresponding to each of the multiple device nodes, the threat value corresponding to each of the multiple device nodes is determined, wherein the threat value represents the risk value of the corresponding device node being attacked within the preset time window; Based on the preset attack budget and the threat values ​​corresponding to each of the multiple device nodes, the multiple initial attack resource amounts are obtained, wherein the preset attack budget represents the total attack resource amount allocated by the attacker to the multiple device nodes within the preset time window.

3. The method according to claim 2, characterized in that, When the target traffic data includes multiple nodes, determining the threat value corresponding to each of the multiple device nodes based on the target traffic data corresponding to each of the multiple device nodes includes: Normalize the multiple target traffic data of any device node to obtain multiple normalized traffic data of the device node. Based on the multiple normalized traffic data and their respective weights, a weighted summation operation is performed to obtain the threat value of any device node. The threat values ​​for each of the multiple device nodes are obtained by using the method of obtaining the threat value of any one of the device nodes.

4. The method according to claim 1, characterized in that, The determination of multiple initial defense resource quantities based on the multiple initial attack resource quantities and the node importance corresponding to each of the multiple device nodes includes: Based on the initial attack resource quantities and the node importance of each of the multiple device nodes, the defense resource allocation ratio for each of the multiple device nodes is determined. Based on the preset defense budget and the defense resource allocation ratio corresponding to each of the multiple device nodes, the multiple initial defense resource amounts are obtained, wherein the preset defense budget represents the total defense resources allocated to the multiple device nodes by the multiple defenders within the preset time window.

5. The method according to claim 1, characterized in that, The objective function for determining the target communication network based on the multiple initial attack resource quantities, the node importance corresponding to each of the multiple device nodes, and the multiple initial defense resource quantities includes: Based on the initial attack resource quantity and the initial defense resource quantity corresponding to each of the multiple device nodes, the defense success probability corresponding to each of the multiple device nodes is determined. Based on the multiple initial attack resource quantities, the node importance corresponding to each of the multiple device nodes, and the multiple initial defense resource quantities, the total associated utility corresponding to each of the multiple device nodes is determined, wherein the total associated utility represents the total additional utility obtained by the multiple defenders when the corresponding device node is successfully defended; Based on the multiple initial attack resource quantities, the node importance corresponding to each of the multiple device nodes, and the multiple initial defense resource quantities, the total cascading penalty corresponding to each of the multiple device nodes is determined, wherein the total cascading penalty represents the total additional penalty obtained by the multiple defenders in the event that the defense of the corresponding device node fails. The objective function is obtained based on the defense success probability of each of the multiple device nodes, the total synergistic utility of each of the multiple device nodes, and the total synergistic penalty of each of the multiple device nodes.

6. The method according to claim 5, characterized in that, The determination of the total synergistic effect of each of the multiple device nodes based on the multiple initial attack resource quantities, the node importance of each of the multiple device nodes, and the multiple initial defense resource quantities includes: Based on any initial attack resource quantity, any device node's node importance, and any initial defense resource quantity, the collateral utility of any defender for any device node is determined as follows: ； in, This indicates the collateral effect of any defender on any of the aforementioned device nodes. This refers to the set of the multiple defending parties. This represents the initial amount of defense resources, and i represents the index of any device node. Let m represent the initial attack resource quantity, m represent the number of the multiple defenders, and k represent the index of any defender. This indicates the node importance of any of the aforementioned device nodes. This indicates the preset defense effectiveness coefficient. This indicates the preset attack damage coefficient. This represents a preset positive externality coefficient, which is used to indicate the proportion of utility shared by the defenders who did not participate in the defense when any of the device nodes successfully defends. The total associated utility of any device node is obtained by summing the associated utility of each of the multiple defenders. The total synergistic utility of each of the multiple device nodes is obtained by using the method of obtaining the total synergistic utility of any one of the device nodes.

7. The method according to claim 5, characterized in that, The objective function, derived based on the defense success probability of each of the multiple device nodes, the total cascading utility of each of the multiple device nodes, and the total cascading penalty of each of the multiple device nodes, includes: Based on the defense success probability of each of the multiple device nodes, the total cascading utility of each of the multiple device nodes, and the total cascading penalty of each of the multiple device nodes, the objective function is obtained as follows: ； in, This represents the function value of the objective function. This represents the probability of successful defense for any one of the plurality of device nodes. This indicates the collateral effect of any defender on any of the aforementioned device nodes. The denoting signifies the collateral penalty of any defending party for any device node, where i represents the index of any device node, N represents the number of the plurality of device nodes, k represents the index of any defending party, and m represents the number of the plurality of defending parties.

8. The method according to any one of claims 1 to 7, characterized in that, The optimization objective is to maximize the function value of the objective function, thereby optimizing the multiple initial defense resource quantities to obtain multiple target defense resource quantities, including: With the objective function value being maximized as the optimization objective, the multiple initial defense resource quantities are optimized to obtain multiple optimized defense resource quantities, wherein each of the multiple optimized defense resource quantities corresponds one-to-one with the multiple device nodes; Based on the multiple optimized defense resource quantities, the optimization utility corresponding to each of the multiple defenders and the optimization utility of the attacker are determined. The optimization utility corresponding to each of the multiple defenders is used to quantify the utility obtained by the corresponding defenders participating in the defense of the multiple device nodes, and the optimization utility of the attacker is used to quantify the utility obtained by the attackers attacking the multiple device nodes. The optimization process is repeated until a preset termination condition is reached, wherein the preset termination condition includes one of the following: the optimization utility of each of the multiple defenders and the optimization utility of the attacker reach a Stackelberg equilibrium, or a preset number of iterations; Based on the multiple optimized defense resource quantities obtained when the preset termination condition is met, the multiple target defense resource quantities are obtained.

9. A non-volatile storage medium, characterized in that, The non-volatile storage medium stores multiple instructions adapted for loading by a processor and executing the defense processing method for the communication network according to any one of claims 1 to 8.

10. An electronic device, characterized in that, It includes one or more processors and a memory, the memory being used to store one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors cause the one or more processors to implement the defense processing method for the communication network as described in any one of claims 1 to 8.

Images