基于定性微分博弈的网络安全威胁预警方法

doi:10.11959/j.issn.1000-436x.2018134

Abstract

Abstract:

Most current network security research based on game theory adopts the static game or multi-stage dynamic game model,which does not accord with the real-time change and continuity of the actual network attack-defense process.To make security threats warning more consistent with the attack-defense process,the threat propagation process was analyzed referring to the epidemic model.Then the network attack-defense game model was constructed based on the qualitative differential game theory,by which the evolution of the network security state could be predicted.Based on the model,the qualitative differential game solution method was designed to construct the attack-defense barrier and divide the capture area.Furthermore,the threat severity in different security states were evaluated by introducing multidimensional Euclidean distance.By designing the warning algorithm,the dynamic warning of the network security threat was realized,which had better accuracy and timeliness.Finally,simulation results verify the effectiveness of the proposed algorithm and model.

Key words: network security threat, network attack and defense, threat warning, qualitative differential game, warning algorithm

CLC Number:

TP309

Shirui HUANG,Hengwei ZHANG,Jindong WANG,Ruiyu DOU. Network security threat warning method based on qualitative differential game[J]. Journal on Communications, 2018, 39(8): 29-36.

Figures/Tables 7

References 19

[1]	HERMANOWSKI D , . Open source security information management system supporting IT security audit[C]// IEEE International Conference on Cybernetics. 2015: 336-341.
[2]	KATIPALLY R , GASIOR W , CUI X ,et al. Multistage attack detection system for network administrators using data mining[C]// BMJ. 2015: 1-4.
[3]	FUDENBERG D , TIROLE J . Game theory[M]. Boston: Massachusettes Institute of Technology PressPress, 2015.
[4]	朱建明, 王秦 . 基于博弈论的网络空间安全问题分析[J]. 通信学报, 2017,32(10): 43-49.
	ZHU J M , WANG Q . Analysis of cyberspace security based on game theory[J]. Journal on Communications, 2017,32(10): 43-49.
[5]	WHITE J , PARK J S , KAMHOUA C A ,et al. Game theoretic attack analysis in online social network (OSN) services[C]// IEEE/ACM International Conference on Advances in Social Networks Analysis and Mining. 2013: 1012-1019.
[6]	王元卓, 林闯, 程学旗 ,等. 基于随机博弈模型的网络攻防量化分析方法[J]. 计算机学报, 2015,33(9): 1748-1764.
	WANG Y Z , LIN C , CHENG X Q ,et al. Analysis for network attack-defense based on stochastic game model[J]. Chinese Journal of Computers, 2015,33(9): 1748-1764.
[7]	张恒巍, 余定坤, 韩继红 ,等. 基于攻防信号博弈模型的防御策略选取方法[J]. 通信学报, 2016,37(5): 51-61.
	ZHANG H W , YU D K , HAN J H ,et al. Defense policies selection method based on attack-defense signaling game model[J]. Journal on Communications, 2016,37(5): 51-61.
[8]	DAVID W K Y , LEON A P . Differential games theory[M]. New York: Springer PressPress, 2015.
[9]	张恒巍, 李涛 . 基于攻防微分博弈的网络安全防御决策方法[J]. 电子学报, 2017,45(2): 431-439.
	ZHANG H W , LI T . Defense strategy selection method based on attack-defense differential game model[J]. Acta Electronica Sinica, 2017,45(2): 431-439.
[10]	NILIM A , GHAOUI L E . Active defense strategy selection based on differential game[J]. Operations Research, 2016,43(12): 163-169.
[11]	范红旗, 王胜, 付强 . 二人微分对策问题信息模式的数学描述[J]. 电子学报, 2015,42(2): 1355-1361.
	FAN H Q , WANG S , FU Q . Mathematical description for information pattern of stochastic differential games[J]. Acta Electronica Sinica, 2015,42(2): 1355-1361.
[12]	NOWAK M A . Evolutionary dynamics:exploring the equations of life[M]. Boston: Harvard University PressPress, 2015.
[13]	ROESCH M , . Snort-lightweight intrusion detection for networks[C]// The 13th System Administration Conference and Exhibition. 2015: 229-238.
[14]	余定坤, 王晋东, 张恒巍 . 静态贝叶斯博弈主动防御策略选取方法[J]. 西安电子科技大学学报, 2016,43(1): 163-169.
	YU D K , WANG J D , ZHANG H W . Active defense strategy selection based on static Bayesian game[J]. Journal of Xidian University, 2016,43(1): 163-169.
[15]	石乐义, 赵俊楠, 李芹 ,等. 基于信令博弈的网络诱骗防御策略分析与仿真[J]. 系统仿真学报, 2016,28(2): 348-353.
	SHI L Y , ZHAO J N , LI Q ,et al. Signaling game analysis and simulation on network decoy defense strategies[J]. Chinese Journal of System Simulation, 2016,28(2): 348-353.
[16]	林闯, 王元卓, 汪洋 . 基于随机博弈模型的网络安全分析与评价[M]. 北京: 清华大学出版社, 2014.
	LIN C , WANG Y Z , WANG Y . Analysis and evaluation for network security based on stochastic game model[M]. Beijing: Tsinghua University PressPress, 2014.
[17]	LIU F M , DING Y S . Dynamics analysis of stochastic game based trust computing for networks[J]. Application Research of Computers, 2016,33(2): 460-463.
[18]	SUN W , KONG X W , HE D Q ,et al. Research on attack and deference in information security based on stochastic game[J]. ACM Information security Science and technology, 2016,27(9): 1408-1412.
[19]	GORDON L , LOEB M , LUCYSHYN W ,et al. 2016 CSI/FBI computer crime and security survey[C]// The 2016 Computer Security Institute. 2016: 48-66.

Metrics

Recommended 0

No Suggested Reading articles found!

威胁预警等级TL	威胁程度T
一级	-1,-0.6)
二级	-0.6,-0.2)
三级	-0.2,0.2)
四级	0.2,0.6)
五级	0.6,1]

方法	博弈类型	博弈者类型	攻防过程	时效性	模型通用性	均衡求解	具体应用
文献[5]	不完全信息动态	2	单阶段	未考虑	差	无	效能评估
文献[7]	不完全信息动态	n	离散多阶段	未考虑	较好	详细	威胁评估
文献[14]	不完全信息静态	1	-	未考虑	差	详细	策略选取
文献[15]	不完全信息动态	2	单阶段	未考虑	差	简单	机制分析
本文	定性微分博弈	n	时间连续	好	较好	详细	威胁预警

序号	攻击动作名称	攻击强度	攻击类型	平均攻击效用
1	Http LQ-sniffer	0.75
2	Install Trojan	0.80	A_H	0.73
3	CF-exploit attack	0.65
4	THS chunk overflow	0.42
5	Attack SSH on Web Sever	0.40	A_M	0.40
6	Shutdown Database server	0.40
7	Ssh buffer overflow	0.30
8	Ftp rhost attack	0.30	A_L	0.27
9	Apache chunk overflow	0.21

序号	防御动作名称	防御强度	防御类型	平均防御效用
1	Limit packets from ports	0.80
2	Install Oracle patches	0.85	D_H	0.78
3	Reinstall Listener program	0.75
4	Uninstall delete Trojan	0.70
5	Renew root data	0.60
6	Restart Database server	0.50	D_M	0.48
7	Limit SYN/ICMP packets	0.45
8	Add physical resource	0.40
9	Correct homepage	0.35
10	Delete suspicious account	0.30	D_L	0.29
11	filtrate malicious packets	0.30

安全状态	威胁程度	预警等级	安全状态	威胁程度	预警等级
（0.24,0.23,0.29）	0.041	三级预警	（0.41,0.49,0.23）	-0.033	三级预警
（0.37,0.42,0.25）	0.095	三级预警	（0.49,0.47,0.42）	0.256	四级预警
（0.14,0.24,0.64）	-0.454	二级预警	（0.61,0.43,0.41）	0.189	三级预警
（0.12,0.15,0.83）	-0.712	一级预警	（0.72,0.84,0.08）	-0.677	一级预警
#	#	#	#	#	#

Network security threat warning method based on qualitative differential game

RichHTML

PDF

Knowledge

Abstract

Cite this article

share this article

Figures/Tables 7

References 19

Related Articles 1

Metrics

Recommended 0