The invention discloses an APT (
Advanced Persistent Threat)
attack defense method based on edge intelligence, which aims to improve the dynamic
perception capability, strategy response capability and resource adaptability of an edge network to APT attacks, and comprises the following steps of: firstly, constructing a topological
adjacency matrix of an
edge node communication network and defining five states and state conversion processes of a life cycle of edge equipment; the method comprises the following steps: firstly, designing an
attack defense model based on
optimal control and
differential game, then introducing a
system evolution model based on hidden confrontation, and accurately simulating dynamic interaction of
attack and defense in an actual edge network, secondly, designing an attack defense model based on
optimal control and
differential game, and finally, adopting a Nash strategy
reinforcement learning mechanism based on a multi-agent deep Q network, optimizing an edge
game strategy, and finally, obtaining an attack defense result. And the attack
detection performance is improved. According to the method disclosed by the invention, the modeling precision and defense effectiveness of the
system in a complex APT attack scene are remarkably improved, and the method is suitable for key
infrastructure network environments with relatively high requirements on safety, timeliness and expandability, such as
industrial Internet and
Internet of Things.