作者投稿和查稿 主编审稿 专家审稿 编委审稿 远程编辑

计算机工程 ›› 2022, Vol. 48 ›› Issue (11): 145-151. doi: 10.19678/j.issn.1000-3428.0063866

• 网络空间安全 • 上一篇    下一篇

基于时机博弈的网络安全防御决策方法

孙鹏宇1,2, 张恒巍1, 谭晶磊1, 李晨蔚1, 马军强1, 王晋东1   

  1. 1. 中国人民解放军战略支援部队信息工程大学 三院, 郑州 450001;
    2. 中国人民解放军 91451部队, 河北 邯郸 056000
  • 收稿日期:2022-01-28 修回日期:2022-04-16 发布日期:2022-05-02
  • 作者简介:孙鹏宇(1993—),男,硕士研究生,主研方向为网络与信息安全;张恒巍(通信作者),副教授、博士;谭晶磊,博士研究生;李晨蔚,硕士研究生;马军强,副教授;王晋东,教授。
  • 基金资助:
    国家重点研发计划(2017YFB0801900)。

Network Security Defense Decision Method Based on Time Game

SUN Pengyu1,2, ZHANG Hengwei1, TAN Jinglei1, LI Chenwei1, MA Junqiang1, WANG Jindong1   

  1. 1. The Third Institute, Information Engineering University of the PLA Strategic Support Force, Zhengzhou 450001, China;
    2. PLA 91451 Unit, Handan, Hebei 056000, China
  • Received:2022-01-28 Revised:2022-04-16 Published:2022-05-02

摘要: 现有的网络防御决策模型大多基于攻防行为进行建模分析,忽视了攻防时机对网络安全产生的影响,且对网络攻防时机的选取大多依赖经验和主观判断,导致网络安全管理者在进行防御决策时难以提供可信的理论支撑。然而网络攻防的时机因素对网络防御决策的意义重大,在面对外部攻击时能否进行实时决策,决定了网络在攻防对抗中能否掌握主动,以最小的代价将攻击危害降到最低。针对网络安全中的时机策略选取问题,提出一种网络安全防御决策方法,基于SIR传染病模型并加以改进,构造描述网络安全状态的微分方程,实现对系统安全状态的实时度量。借鉴FlipIt博弈方法构建攻防时机博弈模型,提出攻防收益量化与计算方法,通过求解不同攻防周期策略下的纳什均衡,获得最优防御时间策略。实验结果表明,当攻击策略一定时,使用该方法动态选择最优防御策略的平均收益为0.26,相比固定周期的防御方法,平均防御收益提高了23.81%。

关键词: 网络安全, 网络攻防, 传染病模型, 时机博弈, 最优防御策略

Abstract: Currently major network assessment models focus on the intensity of attack and defense, often ignoring the impact of timing on network security.While selecting attack and defense timing, mostly relying on subjective experience and judgement, network managers lack quantitative analysis and credible theoretical support on making defense decisions.A key factor in network defense is timing decision against various attacks to seize the initiative with lower cost and damage, which is significant in protecting network resource.To effectively solve the problem of time strategy selection in network security, this study proposes a network security defense decision-making method, an improved Susceptible-Infectious-Removed (SIR) epidemic model that is used to characterize differential equations of network real-time security states.We present a method to quantify and calculate utilities of attack and defense with a FlipIt game method.An optimal defense time strategy is proposed via calculating the Nash equilibrium under different periodic strategies of attack and defense.The experimental results show that, when the attack strategy is constant, the dynamic optimal defense strategy in this study is 0.26.Compared with periodic defense strategy, the average utility is improved by 23.81%.

Key words: network security, network attack and defense, epidemic model, time game, optimal defense strategy

中图分类号: