Automatic intrusion response decision making method based on Q-learning

Abstract

The invention belongs to the technical field of information security, and particularly relates to an automatic intrusion response decision making method based on Q-learning. The method comprises the following steps: scanning system vulnerability, constructing an attack graph, and establishing a network state layer, an attack pattern matching layer and a response measure layer according to the attack graph; establishing a mapping relationship among the network state layer, the attack pattern matching layer and the response measure layer; receiving an intrusion alarm from a network defense device, and mapping the intrusion alarm to a corresponding network state; selecting a defense action according to the mapping relationship, and notifying the system of the result; performing online learning by using the execution result of the defense action, and updating the mapping relationship between the attack pattern matching layer and the response measure layer; and returning to the step of mapping the intrusion alarm to the corresponding network state, and performing automatic response decision marking and online learning, until a defender terminates the defense. By adoption of the automatic intrusion response decision making method based on Q-learning provided by the invention, evaluation of multiple response purposes of the strategy can be achieved, the demand of multiple response purposes can be met, the instantaneity and accuracy of the intrusion detection are improved, the network resource consumption is reduced, and the overall performance of the system is improved.

Description

technical field [0001] The invention belongs to the technical field of information security, in particular to a Q-learning-based automatic intrusion response decision-making method. Background technique [0002] With the continuous strengthening of social informatization, network attacks are becoming more and more frequent, causing huge losses to defenders. Network security issues are getting more and more attention, and intrusion detection and response technology has become one of the research hotspots. Compared with intrusion detection technology which has been widely used and achieved good results, although intrusion response is not a new technology, its development is lagging behind. The purpose of detection is to respond, and detection can only discover attacks, and only correct response can effectively protect the security of the system. In recent years, attacks have become more and more automated and complex. Manual responses can no longer meet the security requirem...

AI Technical Summary

Problems solved by technology

[0004] Aiming at the deficiencies in the prior art, the present invention provides a Q-learning-based automatic intrusion response decision-making method, adopts a revenue-based mapping method, introduces Q-learning into automatic intrusion response decision-making, and maximizes the defender's revenue as Purpose, to solve the problems of inaccurate intrusion detection, poor real-time performance and large resource consumption

Images