基于不完全信息随机博弈的防御决策方法

doi:10.11959/j.issn.2096-109x.2018065

Abstract

Abstract:

Most of the stochastic game models to select network defense strategies are composed of matrix game and Markov decision,which assumes that the defender has known the attacker's revenue.This assumption does not conform to the actual situation.The uncertainty of the attacker's income was converted into the indeterminacy of the attacker type,and an incomplete information stochastic game model,which was combined with the static Bias game and Markov decision,was constructed.The equilibrium solution method of the incomplete information stochastic game model was given,and the strategy selection of the defender was guided by the stable Bias Nash equilibrium.Finally,a practical example was given to demonstrate the feasibility and effectiveness of the model.

Key words: network attack-defense, stochastic game, incomplete information, bayesian nash equilibrium, defense strategies

CLC Number:

TP393.08

Junnan YANG,Hongqi ZHANG,Chuanfu ZHANG. Defense decision-making method based on incomplete information stochastic game[J]. Chinese Journal of Network and Information Security, 2018, 4(8): 12-20.

Figures/Tables 8

References 18

[1]	LIANG X , XIAO Y . Game theory for network security[J]. IEEE Communications Surveys ＆ Tutorials, 2013,15(1): 472-486.
[2]	WANG Y Z , YU J Y , WEN Q ,et al. evolutionary game model and analysis methods for network group behavior[J]. Chinese Journal of Computers, 2015.
[3]	FALLAH M S . A puzzle-based defense strategy against flooding attacks using game theory[J]. IEEE Transactions on Dependable ＆Secure Computing, 2010,7(1): 5-19.
[4]	刘玉岭, 冯登国, 吴丽辉 ,等. 基于静态贝叶斯博弈的蠕虫攻防策略绩效评估[J]. 软件学报, 2012,23(3): 712-723.
	LIU Y L , FENF D G , WU L H ,et al. Performance evaluation of worm attack and defense strategies based on static Bayesian game[J]. Journal of Software, 2012,23(3): 712-723.
[5]	GAO X , ZHU Y F . DDoS defense mechanism analysis based on signaling game model[C]// International Conference on Intelligent Human-Machine Systems and Cybernetics. IEEE, 2013: 414-417.
[6]	张恒巍, 李涛 . 基于多阶段攻防信号博弈的最优主动防御[J]. 电子学报, 2017,45(2): 431-439.
	ZHANG H W , LI T . Optimal active defense based on multi-stage attack-defense signaling game[J]. Acta Electronica Sinica, 2017,45(2): 431-439.
[7]	SHEN S , LI Y , XU H ,et al. Signaling game based strategy of intrusion detection in wireless sensor networks[J]. Computers ＆Mathematics with Applications, 2011,62(6): 2404-2416.
[8]	ALLAMIGEON X , GAUBERT S , SKOMRA M . Solving generic nonarchimedean semidefinite programs using stochastic game algorithms[C]// The ACM. ACM, 2016: 31-38.
[9]	姜伟, 方滨兴, 田志宏 ,等. 基于攻防随机博弈模型的防御策略选取研究[J]. 计算机研究与发展, 2010,47(10): 1714-1723.
	JIANG W , FANG B X , TIAN Z H ,et al. Research on defense strategies selection based on attack-defense stochastic game model[J]. Journal of Computer Research and Development, 2010,47(10): 1714-1723.
[10]	王长春, 程晓航, 朱永文 ,等. 计算机网络对抗行动策略的Markov 博弈模型[J]. 系统工程理论与实践, 2014,34(9): 2402-2410.
	WANG C C , CHENG X H , ZHU Y W ,et al. A Markov game model of computer network operation[J]. Systems Engineering - Theory ＆Practice, 2014,34(9): 2402-2410.
[11]	WEI L , SARWAT A I , SAAD W . Risk assessment of coordinated cyber-physical attacks against power grids:A stochastic game approach[C]// Industry Applications Society Meeting. IEEE, 2016: 1-7
[12]	DING K , DEY S , QUEVEDO D E ,et al. Stochastic game in remote estimation under DoS attacks[J]. IEEE Control Systems Letters, 2017,1(1): 146-151.
[13]	HARSANYI J C. . Games with Incomplete Information Played by“Bayesian” Players,I–III Part I.The Basic Model[M]. Springer Netherlands, 1982: 159-182.
[14]	LEI C , ZHANG H Q , WAN L M ,et al. Incomplete information Markov game theoretic approach to strategy generation for moving target defense[J]. Computer Communications, 2018,116: 184-199.
[15]	SHAPLEY L S . Stochastic Games[J]. Proceedings of the National Academy of Sciences of the United States of America, 1953,39(10): 1095-1100.
[16]	FILAR J , VRIEZE K . Competitive Markov decision processes[J]. Springer Berlin, 1996,36(4): 343-358.
[17]	ZHANG S , OU X , CARAGEA D . Predicting cyber risks through national vulnerability database[J]. Information Systems Security, 2015,24(4-6): 194-206.
[18]	GORDON L , LOEB M , LUCYSHYN W ,et al. 2015 CSI/FBI computer crime and security survey[C]. Proceedings of the 2014 Computer Security Institute// San Francisco:IEEE, 2015. 48-64.

Metrics

Recommended 0

No Suggested Reading articles found!

序号	主机	服务	脆弱性	CVE编号	目标权限
a₁	Web服务器	AP	Apache Chunked-Enc	CVE-2015-1635	root
a₂	内网用户	RPC	Code Injection	CVE-2017-7269	root
a₃	堡垒主机	SMTP	Remote buffer overflow	CVE-2014-8517	root
a₄	FTP服务器	FTP	Write $home/.rhost	CVE-2014-3556	root
a₅	数据库服务器	MySQL	Local buffer overflow	CVE-2013-4730	user
a₆	数据库服务器	MySQL	Local buffer overflow	CVE-2013-4730	root
a₇	数据库服务器	MySQL	Local buffer overflow	CVE-2016-6662	root

序号	防御动作
d₁	Limit packets from ports
d₂	Limit SYN/ICMP packets
d₃	Install Oracle patches
d₄	Renew root data
d₅	Uninstall delete Trojan
d₆	Limit access to MDSYS
d₇	Restart Database Server
d₈	Delete suspicious account

S₀				S₁				S₂				S₃
	S₀	S₁	S₂		S₀	S₁	S₃		S₀	S₂	S₃		S₁	S₂	S₃	S₄	S₅
(Φ,Φ)	1	0	0	(Φ,Φ)	0	1	0	(Φ,Φ)	0	1	0	(Φ,Φ)	0	0	1	0	0
(Φ,d₁)	1	0	0	(Φ,d₃)	0.6	0.4	0	(Φ,d₃)	0.5	0.5	0	(Φ,d₅)	0.4	0.4	0.2	0	0
(Φ,d₂)	1	0	0	(Φ,d ₄)	0.9	0.1	0	(Φ,d ₄)	0.7	0.3	0	(Φ,d ₆)	0.5	0.5	0	0	0
(a₁,Φ)	0.2	0.8	0	(a ₃,Φ)	0	0.4	0.6	(a ₃,Φ)	0	0.3	0.7	(a ₄,Φ)	0	0	0.2	0.8	0
(a₁,d₁)	0.7	0.3	0	(a ₃,d₃)	0.5	0.2	0.3	(a ₃,d₃)	0.4	0.3	0.3	(a ₄,d₅)	0.3	0.3	0.1	0.3	0
(a₁,d₂)	0.9	0.1	0	(a ₃,d₄)	0.7	0.1	0.2	(a ₃,d₄)	0.6	0.2	0.2	(a ₄,d₆)	0.4	0.4	0.1	0.1	0
(a₂,Φ)	0.2	0	0.8									(a ₅,Φ)	0	0	0.1	0	0.9
(a₂,d₁)	0.8	0	0.2									(a ₅,d₅)	0.3	0.3	0.2	0	0.2
(a₂,d₂)	0.9	0	0.1									(a ₅,d₆)	0.4	0.4	0.1	0	0.1
		S₄						S₅					S₆
	S₃		S₄	S₆			S₃	S₅				S₄		S₅			S₆
(Φ,Φ)	0		1	0	(Φ,Φ)		0	1			(Φ,d₃)	0.4		0.4			0.2
(Φ,d₃)	0.7		0.3	0	(Φ,d₇)		0.8	0.2			(Φ,d₄)	0.5		0.5			0
(Φ,d₄)	0.9		0.1	0	(Φ,d₈)		0.9	0.1			(Φ,d₆)	0.5		0.5			0
(a ₇,Φ)	0		0.4	0.6	(a ₆,Φ)		0	0.3
(a ₇,d₃)	0.4		0.3	0.3	(a ₆,d₇)		0.6	0.2
(a ₇,d₄)	0.6		0.3	0.1	(a ₆,d₈)		0.7	0.2
					(a ₇,Φ)		0	0.1
					(a ₇,d₇)		0.5	0.2
					(a ₇,d₈)		0.7	0.1

	S₀			S₁			S₂			S₃			S₄			S₅			S₆
(Φ,Φ)		0,0	(Φ,Φ)		15,?50	(Φ,Φ)		10,-45	(Φ,Φ)		15,-50	(Φ,Φ)		20,-55	(Φ,Φ)		20,-60	(Φ,d₃)		30,-20
(Φ,d₁)		0,?20	(Φ,d₃)		0,?25	(Φ,d₃)		0,?20	(Φ,d₅)		0,?15	(Φ,d₃)		0,?25	(Φ,d₇)		0,?20	(Φ,d ₄)		20,?15
(Φ,d₂)		0,?30	(Φ,d ₄)		0,?30	(Φ,d ₄)		0,?35	(Φ,d₆)		0,?20	(Φ,d₄)		0,?30	(Φ,d₈)		0,?25	(Φ,d ₆)		15,?10
(a₁,Φ)		60,?80	(a ₃,Φ)		65,?85	(a ₃,Φ)		70,?90	(a₄,Φ)		75,?90	(a₇,Φ)		80,?95	(a₆,Φ)		80,?95
(a ₁,d₁)		30,?20	(a ₃,d₃)		55,?15	(a ₃,d₃)		55,?15	(a₄,d₅)		60,?15	(a₇,d₃)		60,?25	(a₆,d₇)		55,?25
(a ₁,d₂)		20,?10	(a ₃,d₄)		30,?5	(a ₃,d₄)		25,?10	(a₄,d₆)		30,?15	(a₇,d₄)		30,?15	(a₆,d₈)		25,?15
(a ₂,Φ)		70,?90							(a ₅,Φ)		80,?90				(a ₇,Φ)		85,?95
(a ₂,d₁)		40,?15							(a ₅,d₅)		65,?20				(a ₇,d₇)		55,?30
(a ₂,d₂)		25,?10							(a ₅,d₆)		35,?15				(a ₇,d₈)		15,?10

S₀			S₁			S₂			S₃		S₄		S₅		S₆
(Φ,Φ)	0,0	(Φ,Φ)		10,?40	(Φ,Φ)		5,?35	(Φ,Φ)		10,?55	(Φ,Φ)	15,?35	(Φ,Φ)	10,?55	(Φ,d₃)	20,?20
(Φ,d₁)	0,?35	(Φ,d₃)		0,?35	(Φ,d₃)		0,?25	(Φ,d₅)		0,?25	(Φ,d₃)	0,?40	(Φ,d₇)	0,?25	(Φ,d ₄)	15,?15
(Φ,d₂)	0,?25	(Φ,d ₄)		0,?30	(Φ,d ₄)		0,?45	(Φ,d₆)		0,?25	(Φ,d₄)	0,?35	(Φ,d₈)	0,?30	(Φ,d ₆)	15,?5
(a₁,Φ)	50,?60	(a ₃,Φ)		45,?75	(a ₃,Φ)		65,?80	(a₄,Φ)		60,?80	(a₇,Φ)	60,?75	(a₆,Φ)	65,?75
(a ₁,d₁)	25,?25	(a ₃,d₃)		40,?15	(a ₃,d₃)		55,?20	(a₄,d₅)		55,?25	(a₇,d₃)	55,?25	(a₆,d₇)	50,?20
(a ₁,d₂)	15,?5	(a ₃,d₄)		40,?5	(a ₃,d₄)		25,?15	(a₄,d₆)		25,?20	(a₇,d₄)	25,?10	(a₆,d₈)	15,?15
(a ₂,Φ)	55,?80							(a ₅,Φ)		65,?75			(a ₇,Φ)	60,?60
(a ₂,d₁)	25,?15							(a ₅,d₅)		55,?25			(a ₇,d₇)	30,?30
(a ₂,d₂)	15,?10							(a ₅,d₆)		35,?15			(a ₇,d₈)	15,?10

Defense decision-making method based on incomplete information stochastic game

RichHTML

PDF下载

Knowledge

Abstract

Cite this article

share this article

Figures/Tables 8

References 18

Related Articles 1

Metrics

Recommended 0

网络状态	攻击者θ₁攻击策略	攻击者θ₂攻击策略	防御策略	攻击者θ₁收益	攻击者θ₂收益	防御收益
S₀	[0.3,0.1,0.6]	[0.3,0.5,0.2]	[0.1,0.4,0.5]	200.8	165.4	?170
S₁	[0.21,0.79]	[0.44,0.56]	[0.12,0.33,0.55]	193.9	173.6	?202.3
S₂	[0.17,0.83]	[0.53,0.47]	[0.03,0.48,0.49]	220.5	183.9	?213.4
S₃	[0,0.3,0.7]	[0.2,0.5,0.3]	[0,0.44,0.56]	167.1	145	?120.8
S₄	[0.4,0.6]	[0.62,0.38]	[0,0.55,0.45]	189.2	167.6	?182.2
S₅	[0.2,0.4,0.4]	[0.4,0.3,0.3]	[0,0.55,0.45]	234.4	200.7	?222.3
S₆	[1]	[1]	[0,0,1]	177.7	145.1	?230.2