Intrusion response decision-making method based on incomplete information dynamic game

Abstract

The invention relates to an intrusion response decision-making method based on the incomplete information dynamic game, which comprises the following steps of: establishing an intrusion response decision-making model based on the incomplete information dynamic game, introducing the game theory to an intrusion response decision-making phase, considering the effects of the intrusion response cost, the misreport rate and the report missing rate of an intrusion detection system and other factors on the intrusion response, balancing negative effects on the response and the loss caused by an attack, strengthening the capabilities for anticipating and handling the policy of an attacker, and improving the response efficiency. The invention provides an attack and defense cost-income evaluation method for calculating the costs and incomes of the attacker and the defender, further establishes an attacker-defender dynamic game model, and obtains the optimum response policy by calculating the perfect Bayesian equilibrium of the attacker-defender dynamic game model.

Description

technical field [0001] The invention relates to an intrusion response decision-making method, in particular to an intrusion response decision-making method based on incomplete information dynamic game. Background technique [0002] With the automation and complexity of network attack methods increasing, the delay between the intrusion detected by the intrusion detection system and the administrator's response has become more and more prominent. The manual response system is difficult to cope with the current complex and changeable network conditions. Response system has become one of the important research directions of intrusion response. [0003] In recent years, automatic intrusion response has become one of the research hotspots in network security, and academia has proposed a variety of decision-making models for automatic intrusion response systems. At present, according to different decision-making methods, decision-making models are mainly divided into: [0004] 1....

AI Technical Summary

Problems solved by technology

In the process of network attack and defense, the choice of strategies of the attack and defense sides restricts each other, thus affecting the effect of attack and defense

Images