基于非零和信号博弈的主动防御模型-《郑州大学学报(工学版)》

文章信息/Info

作者:: 黄万伟¹; 袁博¹; 王苏南²; 张校辉³; 郑州轻工业大学软件学院，河南郑州 450001;深圳职业技术学院，电子与通信工程学院，广东深圳518005;河南信安通信技术股份有限公司，河南郑州 450001

Author(s):: HUANG Wanwei¹; YUAN Bo¹; WANG Sunan²; ZHANG Xiaohui³; 1.College of Software Engineering, Zhengzhou University of Light Industry, Zhengzhou 450001, China;
2.School of Electronic and Communication Engineering, Shen Zhen Polytechnic, Shenzhen 518005, China; 3.Henan Xin′an Communication Technology Co., Ltd., Zhengzhou 450001, China

Keywords:: non-zero-sum; signal game; discount factor; optimal defense strategy

摘要:: 近几年以APT为代表的网络攻击越来越频繁，危害也日趋严重，而当前网络攻防中存在防御滞后以及在对抗过程中双方收益不完全相等的问题。部分研究者们针对APT攻防过程中的特点采用了信号博弈理论进行研究，但在研究的过程中对于收益的量化采用的是零和方法以及单阶段的表示形式，忽略了攻防过程中双方收益不对等的现象以及多阶段的对抗过程。针对上述问题，本文采用非零和方法，提出了非零和信号博弈模型NSG (non-zero-sum signal game)，并引入贴现因子对攻防过程中各阶段的收益对以后阶段的影响进行描述，量化表示攻防策略，在分析不同策略收益的基础上提出当前最优防御策略算法。最后，通过仿真实验对该模型和方法进行验证，实验结果表明了本文中所提出的模型和方法的可行性和有效性，能够更全面地表示出APT多阶段博弈过程。

Abstract:: In recent years, the damages of network attacks such as launched by APT has become more and more serious. Although existing studies based on signal game theory could simulate the APT attack and defense process to a certain extent, they ignored the phenomenon of unequal benefits between the two sides in the process of attack and defense and the multi-stage confrontation process, resulting in the lack of universality of the model and method. In this paper, a proactive defense model based on non-zero-sum signal game was proposed. First of all, the attack and defense game tree was built based on the signal game theory and the analysis of network attack and defense multi-stage confrontation process. Secondly, the non-zero-sum method and discount factor were used to build the multi-stage income of model in the process of offensive and defensive based on the situation of unequal income. On this basis, a quantitative method was proposed for network attack and defense characteristics, and the current optimal defense strategy algorithm was obtained based on the Nash equilibrium and refined Bayesian equilibrium existing in the analysis model. Finally, the model and method were verified by simulation experiments. The results showed the feasibility and effectiveness of the proposed model and method.