基于攻防信号博弈模型的防御策略选取方法

doi:11959/j.issn.1000-436x.2016092

摘要/Abstract

摘要：

当前基于博弈理论的防御策略选取方法大多采用完全信息或静态博弈模型，为更加符合网络攻防实际，从动态对抗和有限信息的视角对攻防行为进行研究。构建攻防信号博弈模型，对策略量化计算方法进行改进，并提出精炼贝叶斯均衡求解算法。在博弈均衡分析的基础上，设计了最优防御策略选取算法。通过实验验证了模型和算法的有效性，并在分析实验数据的基础上总结了攻防信号博弈的一般性规律，能够指导不同类型防御者的决策。

关键词: 动态博弈, 不完全信息, 攻防信号博弈, 精炼贝叶斯均衡, 均衡分析, 策略选取

Abstract:

Currently defense policies selection based on game theory mostly applied either the complete information game model or the static game model.In order to be more in line with the reality of network attack and defense,at-tack-defense behavior was studied by dynamic rivalry and incomplete information.The attack-defense signaling game mode was built,the method to quantify policies was improved and an algorithm to obtain the perfect Bayesian equili-brium was proposed.On the basis of analyzing equilibrium,the algorithm for selecting the optimal defense policy was proposed.The simulation experiment demonstrates that the model and algorithms are feasible and effective.By the expe-rimental data,general rules on signaling attack-defense game are summarized,which can guide defenders of different types to make decisions.

Key words: dynamic game, incomplete information, attack-defense signaling game, perfect Bayesian equilibrium, equi-librium analysis, policy selection

张恒巍,余定坤,韩继红,王晋东,李涛. 基于攻防信号博弈模型的防御策略选取方法[J]. 通信学报, 2016, 37(5): 51-61.

Heng-wei ZHANG,Ding-kun YU,Ji-hong HAN,Jin-dong WANG,Tao LI. Defense policies selection method based on attack-defense signaling game model[J]. Journal on Communications, 2016, 37(5): 51-61.

图/表 7

图1

表1

图2

表2

表3

表4

图3

参考文献 23

[1]	LIANG X N , YANG X . Game theory for network security[J]. Com-munications Surveys & Tutorials, 2014,15(1): 472-486.
[2]	ZONOUZ S A , KHURANA H , SANDERS W H . RRE:a game- theo-retic intrusion response and recovery engine[J]. Parallel and Distri-buted Systems, 2014,25(2): 395-406.
[3]	FALLAH M S . A puzzle-based defense strategy against flooding at-tacks using game theory[J]. Dependable and Secure Computing, 2013,67(1): 5-19.
[4]	姜伟, 方滨兴, 田志宏 . 基于攻防随机博弈模型的防御策略选取研究[J]．计算机研究与发展, 2013,47(10): 1714-1723. JIANG W , FANG B X , TIAN Z H . Research on defense strategies selection based on attack-defense stochastic game model[J]. Jour-nal of Computer Research and Development, 2013,47(10): 1714-1723.
[5]	LYE K , WING J . Game strategies in network security[J]. International Journal of Information Security, 2015,54(1/2): 71-82.
[6]	WHITE J , PARK J S , KAMHOUA C A , et al. Game theoretic attack analysis in online social network(OSN)services[C]// The 2014 Inter-national Conference on Social Networks Technology. Los Angeles, c2014: 1012-1019.
[7]	WANG CL , MIAO Q , DAI YQ . Network survivability analysis based on stochastic game model[J]. Multimedia Information Networking and Security, 2014,55(10): 199-204.
[8]	YU M , LIU C , QIU X L , et al. Modelling and analysis of phishing attack using stochastic game[J]. Cyberspace Technology, 2013,46(3): 300-305.
[9]	林旺群, 王慧, 刘家红 . 基于非合作动态博弈的网络安全主动防御技术研究[J]．计算机研究与发展, 2013,48(2): 306-316. LIN W Q , WANG H , LIU J H . Research on active defense technology in network security based on non-cooperative dynamic game theory[J]. Journal of Computer Research and Development, 2013,48(2): 306-316.
[10]	BURKE D. . Towards a game theory model of information warfare[D]. Montgomery:Air University, 2013.
[11]	刘玉岭, 冯登国, 吴丽辉 . 基于静态贝叶斯博弈的蠕虫攻防策略绩效评估-ABE方案软件学报[J]．软件学报, 2013,23(3): 712-723. LIU Y L , FENG D G , WU L H . Performance evaluation of worm at-tack and defense strategies based on static Bayesian game[J]. Journal of Software, 2013,23(3): 712-723.
[12]	GAO X , ZHU Y F . DDoS defense menchanism analysis based on signaling game model[C]// The 5th International Conference on the Computer Security Institute. San Francisco, c2013: 414-417.
[13]	LIN J Q , LIU P , JING J W . Using signaling games to model the mul-ti-step attack-defense scenarios on confidentiality[J]. Security Lecture Notes in Computer Science, 2014,39(6): 118-137.
[14]	石乐义, 姜蓝蓝, 贾春福 . 蜜罐诱骗防御机理的博弈理论分析[J]．电子与信息学报, 2012,34(6): 1420-1424. SHI L Y , JING L L , JIA C F . A game theoretic analysis for the honey-pot deceptive mechanism[J]. Journal of Electronics & Information Technology, 2012,34(6): 1420-1424.
[15]	王元卓, 于建业, 邱雯 . 网络群体行为的演化博弈模型与分析方法[J]．计算机学报, 2015,38(2): 282-300. WANG Y Z , YU J Y , QIU W . Evolutionary game model and analysis methods for network group behavior[J]. Chinese Journal of Computers, 2015,38(2): 282-300.
[16]	BABAR S D , PRASAD N R , PRASAD R . Game theoretic modeling of WSN jamming attack and detection mechanism[J]. Wire Multi-media Communications, 2013,6983(6): 1-5.
[17]	ROY S , ELLIS C , SHIVA S , et al. A survey of game theory as applied to network security[C]// The 47rd Hawaii International Conference on System Sciences. Washington D C, c2014: 15-24.
[18]	FUDENBERG D , TIROLE J . Game theory[M]. Boston:Massachu-settes Institute of Technology Press, 2012.
[19]	高志伟, 姚尧, 饶飞, 等. 基于漏洞严重程度分类的漏洞预测模型[J]．电子学报, 2014,41(9): 1785-1787. GAO Z W , YAO Y , RAO F , et al. Predicting model of vulnerabilities based on the type of vulnerability severity[J]. Acta Electronica Sinica, 2014,41(9): 1785-1787.
[20]	KAYODE A B , BABATUNDE I G , HARUNA D I . DGM approach to network attacker and defender strategies[C]// The 19th International Conference for Digital Object. New York, c2014: 313-320.
[21]	GORDON L , LOEB M , LUCYSHYN W , et al. 2014 CSI/FBI com-puter crime and security survey[C]// The Computer Security Institute. San Francisco, c2014: 11-34.
[22]	SI P , ZHANG Q , YV F R . QoS aware dynamic resource management in heterogeneous mobile cloud computing networks[J]. China Com-munications, 2014,41(5): 144-159.
[23]	CVSS:national Nulnerability database version 2.5[EB/OL]. .

方法	信息需求	博弈类型	博弈者类型	发送信号	模型通用性	均衡求解	具体应用
文献[4]	完全信息	静态	1	—	差	简单	策略选取
文献[11]	不完全信息	静态	2	—	差	详细	效能评估
文献[12]	不完全信息	动态	3	攻击者	一般	简单	机制分析
文献[13]	不完全信息	动态	3	攻击者	一般	无	—
本文	不完全信息	动态	n	防御者	较好	详细	策略选取

原子攻击名称	分类	AL
a₁:remote buffer overflow	Root	10
a₂:install Trojan	Probe	3
a₃:steal account and crack it	User	5
a₄:send abnormal data to GIOP	Root	10
a₅:LPC to LSASS process	Probe	4
a₆:shutdown database server	Root	10
a₇:Oracle TNS listener	Root	10
a₈:Ftp rhost attack	User	5
a₉:Sr-Hard blood	Root	10

防御原子策略				防御者
		高防御等级				低防御等级
	d₁	d₂	d₃	d₄	d₅	d₆	d₇	d₈
limit packets from ports	v	v		v	v		v
install Oracle patches	v	v	v	v			v	v
reinstall listener program	v		v				v	v
uninstall delete Trojan		v		v
limit access to MDSYS.SDO_CS		v		v		v	v	v
renew data(root)	v		v	v	v
restart database server	v	v			v	v
limit SYN/ICMP packets		v	v	v			v	v
add physical resource	v					v	v
repair database	v	v	v		v	v	v
correct homepage			v	v				v
delete suspicious account	v	v	v	v			v
redeploy firewall rule and filtrate malicious packets		v		v		v	v
address blacklist	v		v		v	v		v
patch SSH on Ftp sever			v		v			v

名称	Ocost	Ncost	Rcost中e的取值
d₁	60	200	e₂=e₅=e₆=e₇=e₈=1,e₁=e₃=e₄=e₉=0
d₂	70	240	e₁=e₄=e₅=e₈=1,e₂=e₃=e₆=e₇=e₉=0
d₃	10	50	e₁=e₂=e₃=e₄=e₆=e₈=e₉=1,e₅=e₇=0
d₄	10	60	e₁=e₃=e₄=e₅=e₆=e₇=1,e₂=e₈=e₉=0
d₅	30	80	e₁=e₃=e₄=e₅=e₇=1,e₂=e₆=e₈=e₉=0
d₆	25	110	e₁=e₃=e₄=1,e₂=e₅=e₆=e₇=e₈=e₉=0
d₇	75	180	e₁=e₂=e₅=e₆=e₇=1,e₃=e₄=e₈=e₉=0
d₈	65	260	e₁=e₂=e₈=1,e₃=e₄=e₅=e₆=e₇=e₉=0