Attack and defense differential game-based network security defense decision determination method and device

Abstract

The present invention relates to an attack and defense differential game-based network security defense decision determination method and a device. The method comprises the steps of constructing a state evolution model NIRM for network nodes according to an SIR model during the network attack and defense process; according to a network node state migration path, acquiring a node state change differential equation set based on the state evolution model NIRM; according to the node state change differential equation set, constructing an attack and defense differential game model ADDG; according to an attack and defense return strategy and a corresponding execution cost, executing a revenue function of the attack party and the defense party during the differential game process; according to the revenue function and the attack and defense differential game model ADDG, solving out a saddle point strategy for the attack party and the defense party through the dynamic planning method, determining an optimal defense strategy and outputting the optimal defense strategy. According to the technical scheme of the invention, the problem that actual requirements cannot be met through the traditional dynamic game analysis method can be solved. Compared with the existing network security defense strategy, the attack and defense process in the continuous and real-time engagement condition is analyzed. The timeliness, the pertinence and the guiding significance of network defense decision results are better.

Description

technical field [0001] The invention belongs to the technical field of network security defense, and in particular relates to a network security defense decision-making method based on attack-defense differential game and a device thereof. Background technique [0002] With the rapid development of the current network and information technology, in the face of many challenges in the field of cyberspace security, enhancing network security defense capabilities and ensuring cyberspace security has become an urgent problem to be solved. Game theory is very consistent with the goal antagonism, relationship non-cooperation and strategy dependence of network offense and defense. At present, the use of game models to analyze network offensive and defensive behaviors and carry out defensive decision-making research has achieved some results. However, most of the existing research results are based on the one-time game confrontation between the offensive and defensive sides. Networ...

AI Technical Summary

Problems solved by technology

Most of the current attack and defense analysis based on game theory assumes only one confrontation between the attacker and the defense. Even if the dynamic attack and defense game model is adopted, the network attack and defense are treated as discrete multi-stage processes. In real network attack and defense scenarios, the attack and defense process is in continuous time. In real time, the traditional dynamic game analysis can no longer meet the requirements of reality

The lack of real-time performance will have a significant impact on the final game result, making the final game equilibrium result quite different from the actual one, thereby reducing the effectiveness of the model and method

Images