Dynamic Bayesian game-based advanced persistent threat (APT) attack prediction method

Abstract

The present invention relates to a dynamic Bayesian game-based APT attack prediction method. The game two parities predict the to-be-taken behaviors of the opposite party by the currently obtained information, adopt the solutions by taking the self-interest maximization as the objective, and utilize the Bayesian game equalization to guarantee the prediction validity and rationality. The method of the present invention comprises the steps of checking the vulnerability of a network and obtaining all behavior strategies that an attacker and a defender possibly adopt according to a network topology structure; constructing an APT attack prediction model in a dynamic Bayesian game system, and analyzing the model-based composition of earnings of the game two parties; predicting the probability of the attack behaviors that are selected by the rational attacker at the next game stage by analyzing the earnings of the two parties of the attacker and the defender. The dynamic Bayesian game equalization of the present invention guarantees the prediction validity and rationality.

Description

technical field [0001] The invention relates to the field of network security, in particular to an APT attack prediction method based on dynamic Bayesian game. Background technique [0002] Advanced persistent threat (Advanced Persistent Threat, APT) attack has become a popular form of network attack. Due to its high risk, difficulty in detection, long duration and clear attack target, it has attracted widespread attention from all walks of life in the world. Before launching an attack, an APT needs to accurately collect the business process and target system of the attack target. During the collection process, this attack will actively dig out the vulnerabilities of the trusted system and application of the attacked target, use these vulnerabilities to build the network required by the attacker, and use 0day vulnerabilities to attack. [0003] The general security system is a passive defense system, that is, the corresponding defensive measures are taken after the attack o...

AI Technical Summary

Problems solved by technology

[0003] The general security system is a passive defense system, that is, the corresponding defensive measures are taken after the attack occurs, and the attack cannot be prevented in advance by predicting the attack behavior, which will reduce the security performance of the system

Images