基于攻防信号博弈的APT攻击防御决策方法

摘要

针对APT攻击的特点, 借鉴非合作博弈理论, 从动态对抗和有限博弈信息的视角对攻防行为进行研究, 建立基于攻防信号博弈的APT防御决策模型, 设计合理的收益量化方法, 在分析攻防博弈过程的基础上, 提出精炼贝叶斯博弈均衡的求解方法;以博弈均衡为依据, 设计防御决策算法并对比分析算法的性能.实验结果表明, 该模型和算法有效且可行, 能够为抗APT攻击提供决策支持.%Aiming at the characteristics of APT attacks, the attack-defense behaviors were studied from the viewpoints of dynamic confrontation and limited game information referring to the non-cooperative game theory.On this basis, the decision-making model of APT defense based on attack-defense signaling game was established and a reasonable revenue quantification method was designed.Analyzing the game process and equilibrium, a solution method of refined Bayesian game equilibrium was proposed and the defense decision algorithm was designed, whose performance was compared and analyzed.Experimental results show that the proposed model and algorithm are effective and feasible, which can provide decision support for anti-APT attacks.