CN110417733B - Attack prediction method, device and system based on QBD attack and defense random evolution game model - Google Patents

Abstract

The invention belongs to the technical field of network security, and in particular relates to an attack prediction method, device and system based on a QBD attack-defense random evolutionary game model. Describe the dynamic evolution trajectory of the strategy learning and adjustment of offense and defense participants under random disturbance, and construct the QBD random evolutionary game model of offense and defense; establish the equilibrium equation of the attack and defense confrontation process based on the QBD attack and defense random evolution game model; The strategy balance probability distribution of the attack and defense confrontation process; according to the strategy balance probability distribution, the most threatening attack strategy is obtained. The invention is closer to the actual attack and defense confrontation scene, considering the influence of random disturbance in the evolution process of attack and defense, and proposes a random evolution game model of attack and defense to be born and destroyed, which enhances the ability to predict attack behavior, and improves the accuracy of attack prediction and model validity. have important guiding significance.

Description

Attack prediction method, device and system based on QBD attack and defense random evolutionary game model

technical field

The invention belongs to the technical field of network security, and in particular relates to an attack prediction method, device and system based on a QBD attack-defense random evolutionary game model.

Background technique

In the field of network security, attackers use a variety of attack methods to attack the defense system to obtain more valuable information resources, while defenders use different defense methods to protect the defense system according to the attacker's intention to prevent information resources from being compromised. Attacker steals. In order to effectively defend information systems, defenders need to accurately predict attack behaviors in advance to avoid huge losses of information resources. In the process of network attack and defense confrontation, the goal antagonism, strategy dependence and relationship non-cooperation reflected by the two sides of the attack and defense are in perfect agreement with the basic characteristics of game theory. Therefore, the research and application of game theory in the field of network security has become the focus and hotspot of various experts and scholars in recent years.

At present, the research results of game theory in the field of network security are all based on the assumption of complete rationality. It is believed that the players in the game attack and defense fully grasp the opponent's optional strategies and income structure, and obtain the optimal response strategy by solving the Nash equilibrium. However, the above results do not take into account the bounded rationality of the actual offensive and defensive participants, that is, the security knowledge, skill level and game information obtained by the offensive and defensive participants are limited, and the reasoning is not always correct when making decisions, and it is impossible under any circumstances. The optimal response is made according to changes in the decision-making environment. The idealized assumption of complete rationality is inconsistent with the actual network attack and defense situation, and the practical effect is deviated. With the research and application of evolutionary game theory in the field of network security, the analysis of attack behavior prediction and defense strategy selection based on the evolutionary game idea based on bounded rationality is more in line with the network attack and defense confrontation scenario. The evolutionary game considers the limited rationality of the offensive and defensive participants. Through the continuous learning and adjustment of strategies, the participants gradually grasp the decision-making environment, opponent information and the income difference generated by different strategies, and finally dynamically evolve to a stable equilibrium state. In the current research, starting from the cost of attack and defense in information security, an evolutionary game model of information security attack and defense confrontation is established. According to the dynamic relationship between attack and defense groups, an evolutionary and stable strategy for information security attack and defense confrontation is obtained. Combining evolutionary game and system dynamics An evolutionary game model of offense and defense is established, and the model is tested from the aspects of system boundary, validity and parameter sensitivity, which proves that the model is objective, scientific and practical. Build an evolutionary game model of attack and defense, and use the replication dynamic learning mechanism to propose and analyze the solution method of the evolutionary stable strategy; establish a multi-stage attack and defense evolutionary game model of the Internet of Things, quantify the benefits/costs of the attack and defense strategy, and use the replication dynamic The learning mechanism determines the optimal defense strategy. However, the above studies are all based on a replicative dynamic learning mechanism, which is a deterministic, non-variant learning model of natural selection that always determines the choice of strategies with higher expected returns than average returns. However, in the actual attack-defense confrontation process, under the influence of random disturbances such as the uncertainty of attack behavior and intention, and the change of decision-making environment, it is difficult for the deterministic replication dynamic mechanism to accurately estimate and predict the dynamic evolution of attack and defense.

SUMMARY OF THE INVENTION

Therefore, the present invention provides an attack prediction method, device and system based on the QBD attack-defense random evolutionary game model, which is closer to the actual attack-defense confrontation scenario, enhances the ability to predict attack behavior, improves the accuracy and effectiveness of attack prediction, and has strong application prospects.

According to the design scheme provided by the present invention, an attack prediction method based on the QBD attack-defense random evolutionary game model includes the following contents:

Abstract the evolution process of offense and defense as a quasi-birth-death process QBD, introduce learning degree and noise factor to describe the dynamic evolution trajectory of the strategy learning adjustment of offense and defense participants under random disturbance, and build a QBD offense and defense random evolutionary game model;

According to the QBD attack-defense random evolutionary game model, the equilibrium equation of the quasi-birth-death attack-defense confrontation process is established;

Solve the balance equation to obtain the strategy balance probability distribution of the attack-defense confrontation process; according to the strategy balance probability distribution, the most threatening attack strategy is obtained.

As mentioned above, the QBD attack and defense random evolutionary game model is represented by a seven-tuple: QBD-ADSEGM=(Γ,N,S,χ(t),α,β,U), where Γ represents the attack and defense game group, and N represents the attack and defense participation The number of players, S represents the strategy space of the offense and defense participants, χ(t) represents the offense and defense state space at time t, α represents the learning degree set of the offense and defense participants, β represents the noise factor of the offense and defense participants, and U represents the benefit function set of both offense and defense.

As mentioned above, the learning level set of the attack and defense participants includes the learning parameters used to describe the attacker's mastery of the attack and defense information and the learning parameters used to describe the defender's mastery of the attack and defense information; the noise factor of the attack and defense participants is used to describe the attack and defense process. , and set the noise factor of the offensive and defensive participants to be greater than 0.

As mentioned above, according to the QBD attack-defense random evolutionary game model, the corresponding quasi-birth-death process is constructed, the state space of the quasi-birth-death process is obtained, and the equilibrium equation is established.

The above-mentioned process of establishing the balance equation is as follows: first, define the transition probability of the strategy selection of the attacker and the defender; according to the transition probability matrix, construct the evolution process of offense and defense, and obtain the balance equation of the evolution process of offense and defense.

As mentioned above, in the process of solving the equilibrium state, the equilibrium equation is first transformed and solved, and the stable probability distribution of the QBD attack and defense evolution process is obtained from the normal return condition, so as to obtain the stable probability distribution of the attack and defense random evolutionary game.

Preferably, according to the property of the non-linear homogeneous equation system of the balance equation, the Gaussian elimination method is used to perform elementary transformation on the balance equation.

Preferably, in the solution of the equilibrium equation, the game information is obtained by analyzing the confrontation analysis and mutual learning among the game groups, and the income generated by the game with different strategies is calculated, and the transition probability is determined by the expected income, the degree of learning and the noise factor.

Further, the present invention also provides an attack prediction device based on a QBD attack-defense random evolutionary game model, comprising: a model building module, an equation building module, and an analysis and solving module; wherein,

The model building module is used to abstract the evolution process of offense and defense into a quasi-birth-death process QBD, introduce the learning degree and noise factor to describe the dynamic evolution trajectory of the strategy learning adjustment of offense and defense participants under random disturbance, and build a QBD offense and defense random evolutionary game model;

The equation building module is used to establish the equilibrium equation of the attack and defense confrontation process based on the QBD attack and defense random evolution game model;

The analysis and solution module is used to solve the equilibrium equation and obtain the strategy stable probability distribution of the attack-defense confrontation process; according to the strategy stable probability distribution, the most threatening attack strategy is obtained.

Further, the present invention also provides a network security system, including the above-mentioned attack prediction device based on the QBD attack-defense random evolutionary game model.

Beneficial effects of the present invention:

The invention introduces a learning degree parameter and a noise factor to describe the dynamic evolution trajectory of the strategy learning and adjustment of the offense and defense participants under random disturbance, and by establishing the equilibrium equation of the quasi-birth-destruction attack-defense confrontation process, the strategy stable probability distribution of the quasi-birth-destruction attack-defense evolution process is solved. The most threatening attack strategy is given; for the attack and defense groups are affected by random disturbances in the game process, by introducing the learning degree parameter and noise factor, the attack and defense random evolutionary game is modeled based on the quasi-birth and death process, and the constructed attack and defense are modeled. The equilibrium equation of the game quasi-birth-death process is solved, and the stable probability distribution of the strategy under the limit of the attack and defense group is obtained, so that the most threatening attack strategy can be known to achieve the effect of attack prediction; it is closer to the actual attack and defense confrontation scenario, and the evolution process of attack and defense is considered. Based on the influence of random disturbance, a random evolutionary game model of quasi-birth-destruction attack and defense is proposed to enhance the ability to predict attack behavior, and the accuracy of attack prediction and the validity of the model are verified through simulation experiments, which has important guiding significance for the development of network security technology. .

Description of drawings:

1 is a schematic flowchart of an attack prediction method in an embodiment;

2 is a schematic diagram of an attack prediction device in an embodiment;

Fig. 3 is the network information experiment system topology diagram in the embodiment;

Fig. 4 is the stationary probability distribution of attack group when α=0.1 in the embodiment;

Fig. 5 is the stationary probability distribution of the defense population when α=0.1 in the embodiment;

Fig. 6 is the stationary probability distribution of using attack strategy A ₁ under different α values in the embodiment;

Fig. 7 is the stationary probability distribution of using defense strategy D ₁ when different α values in the embodiment;

Fig. 8 is the stationary probability distribution of attacking groups when β takes different values in the embodiment;

FIG. 9 shows the stationary probability distribution of the defense population when β takes different values in the embodiment.

Detailed ways:

In order to make the objectives, technical solutions and advantages of the present invention clearer and more comprehensible, the present invention will be described in further detail below with reference to the accompanying drawings and technical solutions.

Aiming at the situation that the deterministic replication dynamic mechanism is difficult to accurately estimate and predict the dynamic evolution of attack and defense under the influence of random disturbances such as uncertainty of attack behavior and intention, and changes in decision-making environment in the existing actual attack-defense confrontation process, the embodiment of the present invention is shown in Fig. As shown in Figure 1, an attack prediction method based on the QBD attack and defense random evolutionary game model is provided, including the following contents:

S101, abstracting the evolution process of offense and defense into a quasi-birth-death process QBD, introducing learning degree and noise factor to describe the dynamic evolution trajectory of strategy learning adjustment of offense and defense participants under random disturbance, and constructing a random evolutionary game model of offense and defense of QBD;

S102, establishing the equilibrium equation of the quasi-birth-destruction attack-defense confrontation process according to the QBD attack-defense random evolutionary game model;

S103. Solve the balance equation to obtain the strategy balance probability distribution of the quasi-birth-destruction attack-defense confrontation process; and obtain the most threatening attack strategy according to the strategy balance probability distribution.

The quasi-birth-death process is defined by a two-dimensional random variable χ(t)=(χ _A (t), χ _D (t)), which describes the number of participants in the attack and defense group who use a certain strategy, and the number of people who use the strategy changes. (Increase, decrease or unchanged) describe the state transition process. In the t+1th game, the offensive and defensive participants obtain game information directly or indirectly according to the confrontation analysis between the groups and the mutual learning in the t-th game, and calculate the income generated by different strategies to calculate the expected income, learning degree and The transition probability determined by the noise factor randomly selects high-yield strategies, and the number of participants who use high-yield strategies increases. The learning degree describes the degree of mastery of offense and defense participants on the decision-making environment, opponent information, and the income difference generated by different strategies games. , the noise factor describes the random disturbance in the attack and defense process. After many games, with the improvement of the learning level of the participants, under the mechanism of policy learning adjustment, until the policy probability distribution on the state space tends to be stable, that is, the stable probability distribution, which is the realization of Nash equilibrium in the sense of group behavior. , with the passage of time, through strategy game, learning and improvement, the proportion of each strategy selected in the final group reaches a stable state.

Further, in the embodiment of the present invention, the QBD attack and defense random evolutionary game model is represented by a seven-tuple: QBD-ADSEGM=(Γ,N,S,χ(t),α,β,U), where,

1) Γ=(attackers, defenders) represents the group participating in the game, attackers represents the attack group, and defenders represents the defense group;

2) _{N =} (NA , _ND ) represents the number of players in the game, NA represents the number of attackers in the attacking group, and _ND represents the number of defenders in the defense group;

3) S=(S _A , S _D ) represents the strategy space of attack and defense participants, wherein the attack strategy set S _A ={A ₁ ,A ₂ ,...,A _m }, the defense strategy set S _D ={D ₁ ,D ₂ ,...,D _n }, m and n represent the number of offensive and defensive strategies, satisfying m,n∈Z and m,n≥2;

表示t时刻的攻防演化的状态空间，是一个二维随机变量，其中

表示攻击群体中选择策略A_i的攻击者数量，满足

且

表示防御群体中选择策略D_j的防御者数量，满足

且

状态空间χ(t)的规模为(N_A+1)(N_D+1)；4)

The state space representing the evolution of attack and defense at time t is a two-dimensional random variable, where

Represents the number of attackers who choose strategy A _i in the attack group, satisfying

and

is the number of defenders who choose strategy D _j in the defense group, satisfying

and

The size of the state space χ(t) is (N _A +1)(N _D +1);

5) α=(α ₁ , α ₂ ) represents the learning degree set of the offense and defense participants, which is used to describe the degree of mastery of the offense and defense participants on the decision-making environment, opponent information and the difference in returns generated by different strategies games, where α ₁ is The learning degree of the attacker, α ₂ is the learning degree of the defender, and satisfies α ₁ ∈ [0,2], α ₂ ∈ [0,2];

6) β represents the noise factor of the attack and defense participants, which is used to describe the random disturbance in the attack and defense process, satisfying β>0;

7) U=(U _A , U _D ) is the set of revenue functions of both offensive and defensive parties, which is jointly determined by the strategies of both offensive and defensive parties, and the benefits obtained by different combinations of offensive and defensive strategies are also different.

和防御者在博弈中使用策略D_j的期望收益

When the attacker adopts the strategy A _i and the defender adopts the strategy D _j , the strategy benefits of the attacker and the defender are denoted by a _ij and di _ij respectively. It can be obtained that the expected payoff of the attacker using strategy A _i in the game is

and the expected payoff of using strategy D _j in the game with the defender

And in the case that the offensive and defensive players are uncertain about the opponent's game information, they all participate in the game with strategies ψ _A (t), ψ _D (t), namely:

Further, in the embodiment of the present invention, according to the QBD attack-defense random evolutionary game model, a corresponding quasi-birth-death process is constructed, the state space of the quasi-birth-death process is obtained, and a balance equation is established.

由此可知这个拟生灭过程的状态空间为：Θ＝{(0,0),(0,1)，...(0,N_D)；(1,0),(1,1),...(1,N_D)；...；(N_A,0),(N_A,1),...(N_A,N_D)}。According to the QBD attack-defense random evolutionary game model, the corresponding quasi-birth-death process is constructed, denoted as {x(t), t≥0,

It can be seen from this that the state space of this quasi-birth-death process is: Θ={(0,0),(0,1),...(0,N _D ); (1,0),(1,1), ...( ₁ , _ND ); ...;(NA,0),(NA, ₁ ),...(NA, _{ND )} }.

Further, in the embodiment of the present invention, the process of establishing the balance equation is as follows: first, define the transition probability of the strategy selection of the attacker and the defender; according to the transition probability matrix, construct the evolution process of offense and defense to be born and destroy, and obtain the balance equation of the evolution process of offense and defense. .

First, define the transition probability of the attacker's policy choice

表示A_i之外的其它策略的期望收益中的最大值，

表示选取策略A_-i的攻击者将改变策略，转而选取策略A_i的概率，

表示选取策略A_i的攻击者改变策略，转而选取策略A_-i的概率。Among them, A _-i =(A ₁ ,...,A _i-1 ,A _i+1 ,...,A _m ) represents the vector composed of all attack strategies except i,

represents the maximum value among the expected returns of other strategies other than A _i ,

represents the probability that an attacker who chooses strategy A _-i will change the strategy and choose strategy A _i instead,

Represents the probability that an attacker who chooses strategy A _i changes the strategy and chooses strategy A _-i instead.

Similarly, the transition probability of the defender's strategy choice

表示选取策略D_j的防御者将改变策略，转而选取策略D_-j的概率，

表示选取策略D_-j的防御者将改变策略，转而选取策略D_j的概率。in,

represents the probability that the defender who chooses strategy D _j will change strategy and choose strategy D _-j instead,

Denotes the probability that a defender who chooses strategy D _-j will change strategy and instead choose strategy _Dj .

的转移概率矩阵为：Then the evolution process of quasi-birth-destruction attack and defense

The transition probability matrix of is:

表示矩阵Q_β主对角线上的子矩阵，记为：In the above matrix,

Represents the submatrix on the main diagonal of the matrix Q _β , denoted as:

When k=0, record:

When _1≤k≤NA -1, record:

When _k =NA, write:

是矩阵Q_β右上次对角线的子矩阵，记为：also,

is the submatrix of the upper right diagonal of the matrix Q _β , denoted as:

表示矩阵Q_β左下次对角线的子矩阵，记为：

Represents the submatrix of the left next diagonal of the matrix Q _β , denoted as:

Further, in the embodiment of the present invention, in the process of solving the equilibrium state, the equilibrium equation is firstly transformed and solved, and the stable probability distribution of the QBD attack and defense evolution process is obtained from the normal return condition, so as to obtain the equilibrium probability distribution of the attack and defense random evolutionary game. Preferably, according to the property of the non-linear homogeneous equation system of the balance equation, the Gaussian elimination method is used to perform elementary transformation on the balance equation. Preferably, in the solution of the equilibrium equation, the game information is obtained by analyzing the confrontation analysis between the game groups and the mutual learning within the group, and the income generated by the game with different strategies is calculated, and the transition probability is determined by the expected income, the degree of learning and the noise factor.

表示QBD的平稳概率分布，其中

假定QBD过程正常返，则平衡方程P(β)Q_β＝0,P(β)e＝1，并且可知

为方便理解，令

则平衡方程等价于make

represents the stationary probability distribution of the QBD, where

Assuming that the QBD process returns normally, the equilibrium equation P( _β )Qβ=0, P(β)e=1, and it can be known that

For ease of understanding, let

Then the equilibrium equation is equivalent to

The equilibrium equation constructed in the embodiment of the present invention is actually a nonlinear homogeneous equation system. By adopting the Guass elimination method based on the block matrix, the equilibrium equation is subjected to elementary transformation, and the QBD equilibrium equation is solved. It can be known from the normal return condition P(β) is the QBD stationary probability distribution, so as to obtain the long-term stable equilibrium of the attack-defense random evolutionary game.

Further, an embodiment of the present invention also provides an attack prediction device based on a QBD attack-defense random evolutionary game model, as shown in FIG. 2 , including: a model building module 101, an equation building module 102, and an analysis and solving module 103, wherein,

The model building module 101 is used for abstracting the evolution process of offense and defense into a quasi-birth-death process QBD, introducing learning degree and noise factor to describe the dynamic evolution trajectory of strategy learning and adjustment of offense and defense participants under random disturbance, and constructing a random evolutionary game model of offense and defense of QBD;

The equation establishment module 102 is used to establish a balance equation of the quasi-birth-destruction attack-defense confrontation process according to the QBD attack-defense random evolutionary game model;

The analysis and solution module 103 is used to solve the balance equation to obtain the strategy balance probability distribution of the attack-defense confrontation process; and obtain the most threatening attack strategy according to the strategy balance probability distribution.

Further, an embodiment of the present invention also provides a network security system, including the attack prediction device based on the QBD attack-defense random evolutionary game model in the above-mentioned embodiment, which is used to predict and analyze the attack behavior in the network system.

In order to verify the validity of the QBD random evolutionary game model proposed in the embodiment of the present invention and the accuracy of the attack prediction, experiments are carried out in a specific network information system environment. As shown in Figure 3, the network system environment is mainly composed of external network attack groups, The DMZ domain and the intranet are composed of network security protection devices including firewalls, intrusion prevention devices and bastion hosts, which are used to protect the database server of the intranet and prevent data resources from being stolen. Scan the system environment through Nessus, refer to MIT's offensive and defensive behavior database, and design the set of offensive and defensive strategies used in the experiment according to the information of the National Information Security Vulnerability Database (CNNVD), that is, the attack strategies are A ₁ (database monitoring) and A ₂ ( Port scan attack), defense strategies are D ₁ (database upgrade) and D ₂ (close idle port services).

Based on the established QBD stochastic evolutionary game model, taking into account the limited rationality of the offensive and defensive participants, and under the premise of pursuing a balance between the risk and investment of information security, maximize their respective benefits. According to the characteristics of the quasi-birth-destruction process, and calculating the income generated by the game of different offensive and defensive strategies, the income matrix of the offensive and defensive strategies in Table 1 can be obtained.

Table 1. Offensive and defensive strategy benefit matrix

And assume that the number of attackers is NA ₌ 8 and the number of defenders is _ND =10.

Considering the influence of certain random disturbances in the process of attack and defense, it is assumed that the noise factor β=0.5. In such a simulation scenario, by changing the learning degree parameter α _i (i=1, 2), observe the impact of the improvement of the learning degree of the attacker and the defender on the attack prediction, that is, when α ₁ =α ₂ =α=0.1,0.5,1.0 , 2.0, study the evolution law of the game between the offense and defense.

Solve the stationary probability distribution of this group of QBD attack and defense random evolutionary game models. When α=0.1, the P matrix of the stationary probability distribution can be obtained by calculation as:

Assume:

表示攻击群体中采用策略A₁的攻击者数量为i，同时防御群体中选取策略D₁的防御者数量为j的平稳概率。

表示多次博弈后攻击群体中采用策略A₁的攻击者数量为i的平稳概率；

表示多次博弈后防御群体中采用策略D₁的防御者数量为j的平稳概率。由此可得攻防群体演化博弈的策略平稳概率分布如图4和5所示，其中，图4为α＝0.1时攻击群体的平稳概率分布，图5为α＝0.1时防御群体的平稳概率分布in,

Indicates the stationary probability that the number of attackers adopting strategy A ₁ in the attack group is i, and the number of defenders who choose strategy D ₁ in the defense group is j.

Represents the stationary probability that the number of attackers adopting strategy A ₁ is i in the attacking group after multiple games;

Represents the stationary probability that the number of defenders adopting strategy D ₁ is j in the defending group after multiple games. From this, the stationary probability distribution of the strategy of the evolutionary game of the offensive and defensive groups can be obtained as shown in Figures 4 and 5, in which Figure 4 is the stationary probability distribution of the attacking group when α=0.1, and Figure 5 is the stationary probability distribution of the defensive group when α=0.1

The stationary probability distribution of the attacking group in Fig. ₄ , the abscissa represents the number of attackers, that is, the number _of attackers who choose strategy A1 or A2, and the ordinate represents the stationary probability _of strategy A1. When α= _0.1 , the probability of all attackers choosing strategy A1 in the attack group is only 58.79%, that is to say, the probability that ₇ attackers choose strategy A1 but _one attacker chooses strategy A2 is 24.44%, The probability that 6 attackers choose strategy A ₁ but 2 attackers choose strategy A ₂ is 10.07%. Therefore, the numerical results show that there is a significant divergence in the selection of attack strategies. Similarly, it can be seen from Figure 5 that the probability of all defenders choosing strategy D ₁ is only 65.39%, while the probability of one defender choosing strategy D ₂ is 22.61%, and the strategy selection is obviously inconsistent.

表示攻击群体中选取策略A₁的攻击者数量为i；

表示防御群体中选取策略D₁的防御者数量为j。Similarly, when α=α ₁ =α ₂ =0.1, 0.5, 1.0, 2.0, that is, the stationary probability distribution results of the attack-defense group evolutionary game under different learning degree parameters, see Tables 2 and 3. in

Indicates that the number of attackers who choose strategy A ₁ in the attack group is i;

Indicates that the number of defenders who choose strategy D ₁ in the defense group is j.

Table 2. The stationary probability distribution results of the evolutionary game of the attacking group under different learning degree parameters

Table 3. The stationary probability distribution results of the defense group evolutionary game under different learning degree parameters

Through Matlab2016b simulation, the stationary probability distribution diagrams of the evolution of attack and defense groups under different learning degree parameters as shown in Figures 6 and 7 can be obtained, and the two sets of numerical results shown in Table 2 and Table 3 can be analyzed and compared intuitively.

According to the value change of the learning degree α in the interval [0, 2], it can be seen from Figures 6 and 7 that in the attack and defense group, the change trend of the stable probability distribution corresponding to the attack strategy A ₁ and the defense strategy D ₁ respectively. When α tends to 2, the attack strategy selection converges to the optimal strategy A ₁ , and the defense strategy selection converges to the optimal strategy D ₁ , that is, the probability that all attackers in the attack group choose strategy A ₁ is 96.94% (the error is less than 5% ), and the probability of all defenders in the defense group choosing strategy D ₁ is 96.61% (error less than 5%).

From the above numerical results, the following conclusions can be drawn: through the confrontation analysis between groups and mutual learning within the same group, the game information is collected and analyzed, and the understanding of the opponent's behavior and intentions as well as the decision-making environment is gradually enhanced by the offensive and defensive participants. As the learning degree α increases, the optimal attack strategy A ₁ is selected to be stable, so it can be seen that the attack strategy A ₁ is the most threatening attack strategy predicted. When the value of α is small, it indicates that the offense and defense participants lack the understanding of the game results and the decision-making environment. If there is obvious randomness in the offense and defense decision-making process, the stationary probability distribution of the evolutionary game does not necessarily converge to a specific strategy.

Assuming that the learning degree is a fixed constant α ₁ =α ₂ =0.7, β=0.2, 1.2, 2.2, 5.0, in such a simulation scenario, observe the influence of different noise factors β on the game evolution of the offensive and defensive sides. By solving the stationary probability distribution of the quasi-birth-death process corresponding to this group of models, we can get the results of the internal evolutionary game of the offensive and defensive groups under different noise factors, as shown in Table 4 and Table 5.

Table 4. The stationary probability distribution results of the evolutionary game of the attacking group under different noise factors

Table 5. The stationary probability distribution results of defense group evolutionary game under different noise factors

Figures 8 and 9 can intuitively draw the internal evolution law of the offensive and defensive groups. When β ₌ 0.2, the behavior of the attacker (defender) is less affected by random disturbance, and the strategy selection is highly consistent. The defender has a 96.15% probability of picking D ₁ . However, as β gradually increases, when β = 5.0, it is obviously affected by random disturbances, and the attackers in the group have divergences in strategy selection. The probability of all attackers in the attack group choosing A ₁ is only 49.39%, the probability of one attacker choosing strategy A ₂ is 25.41%, and the probability of 2 attackers choosing A ₂ is 12.96%; similarly, the defense group has a probability of choosing A 2. The data results also show that when β=5.0, the probability of all defenders adopting strategy D ₁ is only 59.51%, while the probability of one defender choosing strategy D ₂ in the group is 24.01%, and the strategy selection is obviously inconsistent.

Aiming at the influence of random disturbance on the offensive and defensive groups in the game process, the invention models the offensive and defensive random evolutionary game based on the pseudo-birth-death process by introducing the learning degree parameter and the noise factor, and uses the Gauss elimination method to simulate the constructed offensive and defensive game. The equilibrium equation of the birth and death process is solved, and the stable probability distribution of the strategy under the limit of the attack and defense group is obtained, so that the most threatening attack strategy can be known, and the effect of attack prediction can be achieved. The research results show that with the advancement of the evolution of offense and defense, the offense and defense groups gradually deepen their understanding of the decision-making environment and opponents by collecting information about the game characteristics of the opponent, and the degree of learning continues to increase. Tends to choose strategies that are evolutionarily stable. However, with the increase of random disturbance, the game system tends to be unstable, the game result is mainly affected by random disturbance, and the attack and defense groups have obvious differences in strategy selection. In actual attack and defense scenarios, random factors are unavoidable, but reducing the influence of random factors as much as possible and enhancing the degree of learning has guiding significance for guiding actual network attack prediction.

The relative steps, numerical expressions and numerical values of the components and steps set forth in these embodiments do not limit the scope of the invention unless specifically stated otherwise.

Based on the above method, an embodiment of the present invention further provides a server, including: one or more processors; and a storage device for storing one or more programs, when the one or more programs are stored by the one or more programs The execution of the one or more processors causes the one or more processors to implement the above-described method.

Based on the foregoing method, an embodiment of the present invention further provides a computer-readable medium on which a computer program is stored, wherein the foregoing method is implemented when the program is executed by a processor.

The implementation principle and technical effects of the device provided by the embodiment of the present invention are the same as those of the foregoing method embodiment. For brief description, for the parts not mentioned in the device embodiment, reference may be made to the corresponding content in the foregoing method embodiment.

Those skilled in the art can clearly understand that, for the convenience and brevity of description, for the specific working process of the system and device described above, reference may be made to the corresponding process in the foregoing method embodiments, which will not be repeated here.

The functions, if implemented in the form of software functional units and sold or used as stand-alone products, may be stored in a processor-executable non-volatile computer-readable storage medium. Based on this understanding, the technical solution of the present invention can be embodied in the form of a software product in essence, or the part that contributes to the prior art or the part of the technical solution. The computer software product is stored in a storage medium, including Several instructions are used to cause a computer device (which may be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, Read-Only Memory (ROM, Read-Only Memory), Random Access Memory (RAM, Random Access Memory), magnetic disk or optical disk and other media that can store program codes .

Finally, it should be noted that the above-mentioned embodiments are only specific implementations of the present invention, and are used to illustrate the technical solutions of the present invention, but not to limit them. The protection scope of the present invention is not limited thereto, although referring to the foregoing The embodiment has been described in detail the present invention, those of ordinary skill in the art should understand: any person skilled in the art who is familiar with the technical field within the technical scope disclosed by the present invention can still modify the technical solutions described in the foregoing embodiments. Or can easily think of changes, or equivalently replace some of the technical features; and these modifications, changes or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present invention, and should be covered in the present invention. within the scope of protection. Therefore, the protection scope of the present invention should be based on the protection scope of the claims.

Claims (7)

1. An attack prediction method based on a QBD attack and defense random evolution game model is characterized by comprising the following contents:

abstracting an attack and defense evolution process into a simulated life and death process QBD, introducing a learning degree and a noise factor to depict a dynamic evolution track of strategy learning adjustment of attack and defense participants under random disturbance, and constructing a QBD attack and defense random evolution game model;

establishing a balance equation of the simulated firefighting, attacking and defending and confrontation process according to the QBD attacking and defending random evolution game model;

solving a balance equation to obtain strategy balance probability distribution of the process of simulating living, fighting and defense; according to the strategy balance probability distribution, obtaining the most threatening attack strategy;

constructing a corresponding simulated birth and death process according to a QBD attack and defense random evolution game model, acquiring a state space of the simulated birth and death process, and establishing a balance equation;

the equilibrium equation is established as follows: firstly, defining the transition probability of strategy selection of an attacker and a defender; constructing a simulated elimination evolution process according to the transition probability matrix to obtain a balance equation of the attack and defense evolution process;

the QBD attack and defense random evolution game model is represented by a seven-tuple: QBD-ADSEGM (gamma, N, S, chi (t), alpha, beta, U), wherein gamma represents the attacking and defending game group, N represents the number of attacking and defending participants, S represents the strategy space of the attacking and defending participants, chi (t) represents the attacking and defending state space at the time t, alpha represents the learning degree set of the attacking and defending participants, beta represents the noise factor of the attacking and defending participants, and U represents the benefit function set of both attacking and defending parties.

2. The attack prediction method based on the QBD attack and defense random evolution game model is characterized in that the attack and defense participant learning degree set comprises learning parameters for describing the mastery degree of an attacker on attack and defense information and learning parameters for describing the mastery degree of a defender on attack and defense information; and the noise factor of the attack and defense participants is used for describing random disturbance in the attack and defense process and setting the noise factor of the attack and defense participants to be greater than 0.

3. The attack prediction method based on the QBD attack and defense random evolution game model according to claim 1, characterized in that in the equilibrium state solving process, the equilibrium equation is first transformed and solved, and the stable probability distribution of the QBD attack and defense evolution process is obtained through normal return conditions, so that the stable probability distribution of the attack and defense random evolution game is obtained.

4. The attack prediction method based on the QBD attack and defense random evolution game model is characterized in that the equilibrium equation is subjected to elementary transformation by adopting a Gaussian elimination method according to the nonlinear homogeneous equation set property of the equilibrium equation.

5. The attack prediction method based on the QBD attack and defense random evolution game model is characterized in that in the balance equation solving, game information is obtained by analyzing the confrontation analysis and mutual learning among game groups, earnings generated by games with different strategies are calculated, and the transition probability is determined according to the expected earnings, the learning degree and the noise factor.

6. An attack prediction device based on QBD attack and defense random evolution game model is characterized by comprising: a model building module, an equation building module and an analysis solving module, wherein,

the model establishing module is used for abstracting an attack and defense evolution process into a simulated life and death process QBD, introducing a learning degree and a noise factor to depict a dynamic evolution track of strategy learning adjustment of attack and defense participants under random disturbance, and establishing a QBD attack and defense random evolution game model;

the equation establishing module is used for establishing a balance equation of the simulated fighting process according to the QBD attack and defense random evolution game model;

the analysis solving module is used for solving the balance equation to obtain the strategy stable probability distribution of the process of the simulated fighting and fighting; obtaining the most threatening attack strategy according to the strategy stable probability distribution;

constructing a corresponding simulated birth and death process according to a QBD attack and defense random evolution game model, acquiring a state space of the simulated birth and death process, and establishing a balance equation;

the equilibrium equation is established as follows: firstly, defining the transition probability of strategy selection of an attacker and a defender; constructing a simulated elimination evolution process according to the transition probability matrix to obtain a balance equation of the attack and defense evolution process;

the QBD attack and defense random evolution game model is represented by a seven-tuple: QBD-ADSEGM (gamma, N, S, chi (t), alpha, beta, U), wherein gamma represents the attacking and defending game group, N represents the number of attacking and defending participants, S represents the strategy space of the attacking and defending participants, chi (t) represents the attacking and defending state space at the time t, alpha represents the learning degree set of the attacking and defending participants, beta represents the noise factor of the attacking and defending participants, and U represents the benefit function set of both attacking and defending parties.

7. A network security system, characterized by comprising the attack prediction device based on QBD attack and defense random evolution game model in claim 6.

Images