基于不完全信息随机博弈的防御决策方法

doi:10.11959/j.issn.2096-109x.2018065

网络与信息安全学报 ›› 2018, Vol. 4 ›› Issue (8): 12-20.doi: 10.11959/j.issn.2096-109x.2018065

基于不完全信息随机博弈的防御决策方法

杨峻楠^1,²(),张红旗^1,²,张传富^1,²

¹ 信息工程大学，河南郑州 450001
² 河南省信息安全重点实验室，河南郑州 450001

修回日期:2018-07-11 出版日期:2018-08-01 发布日期:2018-10-12
作者简介:杨峻楠（1993-），男，河北藁城人，信息工程大学硕士生，主要研究方向为网络信息安全、博弈论和强化学习。|张红旗（1962-），男，河北遵化人，博士，信息工程大学教授、博士生导师，主要研究方向为网络安全、风险评估、等级保护和信息安全管理。
基金资助:
国家高技术研究发展计划基金资助项目（“863”计划）(2014AA7116082);国家高技术研究发展计划基金资助项目（“863”计划）(2015AA7116040)

Defense decision-making method based on incomplete information stochastic game

Junnan YANG^1,²(),Hongqi ZHANG^1,²,Chuanfu ZHANG^1,²

¹ Information Engineering University,Zhengzhou 450004,China
² Henan Province Key Laboratory of Information Security,Zhengzhou,450001,China

Revised:2018-07-11 Online:2018-08-01 Published:2018-10-12
Supported by:
The National High Technology Research and Development Program of China(2014AA7116082);The National High Technology Research and Development Program of China(2015AA7116040)

摘要/Abstract

摘要：

现有防御决策中的随机博弈模型大多由矩阵博弈与马尔可夫决策组成，矩阵博弈中假定防御者已知攻击者收益，与实际不符。将攻击者收益的不确定性转换成对攻击者类型的不确定性，构建了由静态贝叶斯博弈与马尔可夫决策结合的不完全信息随机博弈模型，给出了不完全信息随机博弈模型的均衡求解方法，使用稳定贝叶斯纳什均衡指导防御者的策略选取。最后通过一个具体实例验证了模型的可行性和有效性。

关键词: 网络攻防, 随机博弈, 不完全信息, 贝叶斯纳什均衡, 防御决策

Abstract:

Most of the stochastic game models to select network defense strategies are composed of matrix game and Markov decision,which assumes that the defender has known the attacker's revenue.This assumption does not conform to the actual situation.The uncertainty of the attacker's income was converted into the indeterminacy of the attacker type,and an incomplete information stochastic game model,which was combined with the static Bias game and Markov decision,was constructed.The equilibrium solution method of the incomplete information stochastic game model was given,and the strategy selection of the defender was guided by the stable Bias Nash equilibrium.Finally,a practical example was given to demonstrate the feasibility and effectiveness of the model.

Key words: network attack-defense, stochastic game, incomplete information, bayesian nash equilibrium, defense strategies

中图分类号:

TP393.08

杨峻楠,张红旗,张传富. 基于不完全信息随机博弈的防御决策方法[J]. 网络与信息安全学报, 2018, 4(8): 12-20.

Junnan YANG,Hongqi ZHANG,Chuanfu ZHANG. Defense decision-making method based on incomplete information stochastic game[J]. Chinese Journal of Network and Information Security, 2018, 4(8): 12-20.

图/表 8

图1

图2

表1

表2

表3

表4

表5

表6

参考文献 18

[1]	LIANG X , XIAO Y . Game theory for network security[J]. IEEE Communications Surveys ＆ Tutorials, 2013,15(1): 472-486.
[2]	WANG Y Z , YU J Y , WEN Q ,et al. evolutionary game model and analysis methods for network group behavior[J]. Chinese Journal of Computers, 2015.
[3]	FALLAH M S . A puzzle-based defense strategy against flooding attacks using game theory[J]. IEEE Transactions on Dependable ＆Secure Computing, 2010,7(1): 5-19.
[4]	刘玉岭, 冯登国, 吴丽辉 ,等. 基于静态贝叶斯博弈的蠕虫攻防策略绩效评估[J]. 软件学报, 2012,23(3): 712-723.
	LIU Y L , FENF D G , WU L H ,et al. Performance evaluation of worm attack and defense strategies based on static Bayesian game[J]. Journal of Software, 2012,23(3): 712-723.
[5]	GAO X , ZHU Y F . DDoS defense mechanism analysis based on signaling game model[C]// International Conference on Intelligent Human-Machine Systems and Cybernetics. IEEE, 2013: 414-417.
[6]	张恒巍, 李涛 . 基于多阶段攻防信号博弈的最优主动防御[J]. 电子学报, 2017,45(2): 431-439.
	ZHANG H W , LI T . Optimal active defense based on multi-stage attack-defense signaling game[J]. Acta Electronica Sinica, 2017,45(2): 431-439.
[7]	SHEN S , LI Y , XU H ,et al. Signaling game based strategy of intrusion detection in wireless sensor networks[J]. Computers ＆Mathematics with Applications, 2011,62(6): 2404-2416.
[8]	ALLAMIGEON X , GAUBERT S , SKOMRA M . Solving generic nonarchimedean semidefinite programs using stochastic game algorithms[C]// The ACM. ACM, 2016: 31-38.
[9]	姜伟, 方滨兴, 田志宏 ,等. 基于攻防随机博弈模型的防御策略选取研究[J]. 计算机研究与发展, 2010,47(10): 1714-1723.
	JIANG W , FANG B X , TIAN Z H ,et al. Research on defense strategies selection based on attack-defense stochastic game model[J]. Journal of Computer Research and Development, 2010,47(10): 1714-1723.
[10]	王长春, 程晓航, 朱永文 ,等. 计算机网络对抗行动策略的Markov 博弈模型[J]. 系统工程理论与实践, 2014,34(9): 2402-2410.
	WANG C C , CHENG X H , ZHU Y W ,et al. A Markov game model of computer network operation[J]. Systems Engineering - Theory ＆Practice, 2014,34(9): 2402-2410.
[11]	WEI L , SARWAT A I , SAAD W . Risk assessment of coordinated cyber-physical attacks against power grids:A stochastic game approach[C]// Industry Applications Society Meeting. IEEE, 2016: 1-7
[12]	DING K , DEY S , QUEVEDO D E ,et al. Stochastic game in remote estimation under DoS attacks[J]. IEEE Control Systems Letters, 2017,1(1): 146-151.
[13]	HARSANYI J C. . Games with Incomplete Information Played by“Bayesian” Players,I–III Part I.The Basic Model[M]. Springer Netherlands, 1982: 159-182.
[14]	LEI C , ZHANG H Q , WAN L M ,et al. Incomplete information Markov game theoretic approach to strategy generation for moving target defense[J]. Computer Communications, 2018,116: 184-199.
[15]	SHAPLEY L S . Stochastic Games[J]. Proceedings of the National Academy of Sciences of the United States of America, 1953,39(10): 1095-1100.
[16]	FILAR J , VRIEZE K . Competitive Markov decision processes[J]. Springer Berlin, 1996,36(4): 343-358.
[17]	ZHANG S , OU X , CARAGEA D . Predicting cyber risks through national vulnerability database[J]. Information Systems Security, 2015,24(4-6): 194-206.
[18]	GORDON L , LOEB M , LUCYSHYN W ,et al. 2015 CSI/FBI computer crime and security survey[C]. Proceedings of the 2014 Computer Security Institute// San Francisco:IEEE, 2015. 48-64.

序号	主机	服务	脆弱性	CVE编号	目标权限
a₁	Web服务器	AP	Apache Chunked-Enc	CVE-2015-1635	root
a₂	内网用户	RPC	Code Injection	CVE-2017-7269	root
a₃	堡垒主机	SMTP	Remote buffer overflow	CVE-2014-8517	root
a₄	FTP服务器	FTP	Write $home/.rhost	CVE-2014-3556	root
a₅	数据库服务器	MySQL	Local buffer overflow	CVE-2013-4730	user
a₆	数据库服务器	MySQL	Local buffer overflow	CVE-2013-4730	root
a₇	数据库服务器	MySQL	Local buffer overflow	CVE-2016-6662	root

序号	防御动作
d₁	Limit packets from ports
d₂	Limit SYN/ICMP packets
d₃	Install Oracle patches
d₄	Renew root data
d₅	Uninstall delete Trojan
d₆	Limit access to MDSYS
d₇	Restart Database Server
d₈	Delete suspicious account

S₀				S₁				S₂				S₃
	S₀	S₁	S₂		S₀	S₁	S₃		S₀	S₂	S₃		S₁	S₂	S₃	S₄	S₅
(Φ,Φ)	1	0	0	(Φ,Φ)	0	1	0	(Φ,Φ)	0	1	0	(Φ,Φ)	0	0	1	0	0
(Φ,d₁)	1	0	0	(Φ,d₃)	0.6	0.4	0	(Φ,d₃)	0.5	0.5	0	(Φ,d₅)	0.4	0.4	0.2	0	0
(Φ,d₂)	1	0	0	(Φ,d ₄)	0.9	0.1	0	(Φ,d ₄)	0.7	0.3	0	(Φ,d ₆)	0.5	0.5	0	0	0
(a₁,Φ)	0.2	0.8	0	(a ₃,Φ)	0	0.4	0.6	(a ₃,Φ)	0	0.3	0.7	(a ₄,Φ)	0	0	0.2	0.8	0
(a₁,d₁)	0.7	0.3	0	(a ₃,d₃)	0.5	0.2	0.3	(a ₃,d₃)	0.4	0.3	0.3	(a ₄,d₅)	0.3	0.3	0.1	0.3	0
(a₁,d₂)	0.9	0.1	0	(a ₃,d₄)	0.7	0.1	0.2	(a ₃,d₄)	0.6	0.2	0.2	(a ₄,d₆)	0.4	0.4	0.1	0.1	0
(a₂,Φ)	0.2	0	0.8									(a ₅,Φ)	0	0	0.1	0	0.9
(a₂,d₁)	0.8	0	0.2									(a ₅,d₅)	0.3	0.3	0.2	0	0.2
(a₂,d₂)	0.9	0	0.1									(a ₅,d₆)	0.4	0.4	0.1	0	0.1
		S₄						S₅					S₆
	S₃		S₄	S₆			S₃	S₅				S₄		S₅			S₆
(Φ,Φ)	0		1	0	(Φ,Φ)		0	1			(Φ,d₃)	0.4		0.4			0.2
(Φ,d₃)	0.7		0.3	0	(Φ,d₇)		0.8	0.2			(Φ,d₄)	0.5		0.5			0
(Φ,d₄)	0.9		0.1	0	(Φ,d₈)		0.9	0.1			(Φ,d₆)	0.5		0.5			0
(a ₇,Φ)	0		0.4	0.6	(a ₆,Φ)		0	0.3
(a ₇,d₃)	0.4		0.3	0.3	(a ₆,d₇)		0.6	0.2
(a ₇,d₄)	0.6		0.3	0.1	(a ₆,d₈)		0.7	0.2
					(a ₇,Φ)		0	0.1
					(a ₇,d₇)		0.5	0.2
					(a ₇,d₈)		0.7	0.1

	S₀			S₁			S₂			S₃			S₄			S₅			S₆
(Φ,Φ)		0,0	(Φ,Φ)		15,?50	(Φ,Φ)		10,-45	(Φ,Φ)		15,-50	(Φ,Φ)		20,-55	(Φ,Φ)		20,-60	(Φ,d₃)		30,-20
(Φ,d₁)		0,?20	(Φ,d₃)		0,?25	(Φ,d₃)		0,?20	(Φ,d₅)		0,?15	(Φ,d₃)		0,?25	(Φ,d₇)		0,?20	(Φ,d ₄)		20,?15
(Φ,d₂)		0,?30	(Φ,d ₄)		0,?30	(Φ,d ₄)		0,?35	(Φ,d₆)		0,?20	(Φ,d₄)		0,?30	(Φ,d₈)		0,?25	(Φ,d ₆)		15,?10
(a₁,Φ)		60,?80	(a ₃,Φ)		65,?85	(a ₃,Φ)		70,?90	(a₄,Φ)		75,?90	(a₇,Φ)		80,?95	(a₆,Φ)		80,?95
(a ₁,d₁)		30,?20	(a ₃,d₃)		55,?15	(a ₃,d₃)		55,?15	(a₄,d₅)		60,?15	(a₇,d₃)		60,?25	(a₆,d₇)		55,?25
(a ₁,d₂)		20,?10	(a ₃,d₄)		30,?5	(a ₃,d₄)		25,?10	(a₄,d₆)		30,?15	(a₇,d₄)		30,?15	(a₆,d₈)		25,?15
(a ₂,Φ)		70,?90							(a ₅,Φ)		80,?90				(a ₇,Φ)		85,?95
(a ₂,d₁)		40,?15							(a ₅,d₅)		65,?20				(a ₇,d₇)		55,?30
(a ₂,d₂)		25,?10							(a ₅,d₆)		35,?15				(a ₇,d₈)		15,?10

S₀			S₁			S₂			S₃		S₄		S₅		S₆
(Φ,Φ)	0,0	(Φ,Φ)		10,?40	(Φ,Φ)		5,?35	(Φ,Φ)		10,?55	(Φ,Φ)	15,?35	(Φ,Φ)	10,?55	(Φ,d₃)	20,?20
(Φ,d₁)	0,?35	(Φ,d₃)		0,?35	(Φ,d₃)		0,?25	(Φ,d₅)		0,?25	(Φ,d₃)	0,?40	(Φ,d₇)	0,?25	(Φ,d ₄)	15,?15
(Φ,d₂)	0,?25	(Φ,d ₄)		0,?30	(Φ,d ₄)		0,?45	(Φ,d₆)		0,?25	(Φ,d₄)	0,?35	(Φ,d₈)	0,?30	(Φ,d ₆)	15,?5
(a₁,Φ)	50,?60	(a ₃,Φ)		45,?75	(a ₃,Φ)		65,?80	(a₄,Φ)		60,?80	(a₇,Φ)	60,?75	(a₆,Φ)	65,?75
(a ₁,d₁)	25,?25	(a ₃,d₃)		40,?15	(a ₃,d₃)		55,?20	(a₄,d₅)		55,?25	(a₇,d₃)	55,?25	(a₆,d₇)	50,?20
(a ₁,d₂)	15,?5	(a ₃,d₄)		40,?5	(a ₃,d₄)		25,?15	(a₄,d₆)		25,?20	(a₇,d₄)	25,?10	(a₆,d₈)	15,?15
(a ₂,Φ)	55,?80							(a ₅,Φ)		65,?75			(a ₇,Φ)	60,?60
(a ₂,d₁)	25,?15							(a ₅,d₅)		55,?25			(a ₇,d₇)	30,?30
(a ₂,d₂)	15,?10							(a ₅,d₆)		35,?15			(a ₇,d₈)	15,?10

基于不完全信息随机博弈的防御决策方法

Defense decision-making method based on incomplete information stochastic game

在线阅读

pdf下载

可视化

摘要/Abstract

引用本文

使用本文

图/表 8

参考文献 18

相关文章 1

Metrics

推荐阅读 0

网络状态	攻击者θ₁攻击策略	攻击者θ₂攻击策略	防御策略	攻击者θ₁收益	攻击者θ₂收益	防御收益
S₀	[0.3,0.1,0.6]	[0.3,0.5,0.2]	[0.1,0.4,0.5]	200.8	165.4	?170
S₁	[0.21,0.79]	[0.44,0.56]	[0.12,0.33,0.55]	193.9	173.6	?202.3
S₂	[0.17,0.83]	[0.53,0.47]	[0.03,0.48,0.49]	220.5	183.9	?213.4
S₃	[0,0.3,0.7]	[0.2,0.5,0.3]	[0,0.44,0.56]	167.1	145	?120.8
S₄	[0.4,0.6]	[0.62,0.38]	[0,0.55,0.45]	189.2	167.6	?182.2
S₅	[0.2,0.4,0.4]	[0.4,0.3,0.3]	[0,0.55,0.45]	234.4	200.7	?222.3
S₆	[1]	[1]	[0,0,1]	177.7	145.1	?230.2