WO2021180017A1

WO2021180017A1 - Data service-oriented adaptive intrusion response game method and system thereof

Info

Publication number: WO2021180017A1
Application number: PCT/CN2021/079481
Authority: WO
Inventors: 邓松; 祝展望; 张建堂; 岳东; 袁新雅; 陈福林; 蔡清媛; 董霞
Original assignee: 南京邮电大学
Priority date: 2020-03-09
Filing date: 2021-03-08
Publication date: 2021-09-16
Also published as: CN111464501A

Abstract

Disclosed are a data service-oriented adaptive intrusion response game method and a system thereof, which are mainly used for solving the problem of adaptive response for a network attack of data service. The method provided in the present invention is used to construct a game model of a detection system and a user, so as to determine whether there is a pure-strategy Nash equilibrium, and if not, a hybrid strategy of the detection system is established, and then a payoff function between the two is established to solve an optimal first-order condition, thereby deriving a Nash equilibrium value of optimal response of two parties of the game, and obtaining an optimal response policy to respond.

Description

A data service-oriented adaptive intrusion response game method and system

Technical field

The invention is a data service-oriented adaptive intrusion response game method and a system thereof, and belongs to the field of network security.

Background technique

Energy Internet is a comprehensive application of advanced power electronic technology, information technology and intelligent management technology to interconnect a large number of new power network nodes composed of distributed energy harvesting devices, distributed energy storage devices and various types of loads to achieve two-way energy Flowing energy peer-to-peer exchange and sharing network. Energy Internet is a new type of energy system structure that is compatible with traditional power grids, can fully, widely and effectively utilize distributed renewable energy, and meets the diverse power needs of users. With the continuous popularization and development of computer networks, the intrusion of energy Internet is becoming more and more rampant. As an effective method to fight against intrusions, intrusion response is becoming more and more important for protecting the security of the system. The current intrusion response is mostly implemented in the intrusion detection system, and the response method is mostly manual response, so the response capability is limited to a certain extent. In order to respond to various intrusions quickly and in time, people have studied a variety of automatic response technologies to respond to intrusions. Adaptive intrusion response means that when the system is under attack, it can effectively evaluate the potential impact of the attack on energy Internet data services such as the power grid, and then adjust the response strategy based on the loss assessment and response cost. Among modern intrusion response methods, the adaptive intrusion response game method for data services has become another detection method for network attacks against energy Internet data services. Intrusion response is mainly divided into two types: active response and passive response. Commonly used active response techniques include methods such as canceling TCP connections, disconnecting network connections, and shielding internal abnormal hosts. The most common passive response technologies include alerts and notifications, and isolation of untrusted connections. In recent years, with the rapid development of information and network technology, driven by the interests of politics, economy, and military, the risk of network intrusion has increased correspondingly, and intrusion incidents have shown a rapid growth trend. This has led to research on intrusion in the context of the energy Internet. The method of response becomes very important.

Data service-oriented adaptive intrusion response means that when the system is under attack, it can effectively evaluate the potential impact of the attack on the energy Internet data service, and then adjust the response strategy according to the loss assessment and response cost. Generally speaking, traditional intrusion detection technology is a passive defense technology, which cannot effectively monitor the activities in the energy Internet, does not have active defense capabilities, lacks adaptive response capabilities to intrusions, and can no longer prevent increasingly serious network security. threat. Compared with traditional intrusion response technologies, there are currently some new theories and new methods, such as adaptive intrusion response research based on large-scale networks, and adaptive intrusion response research based on cost analysis. While defending the system from damage by intruders, it may also have a negative impact on the activities of legitimate users of the system, and the resulting losses may be greater than the losses caused by real attacks. To solve this problem, it is proposed to first estimate the potential threats brought by the supply to the system and the cost of the system's response, and then adjust the response strategy according to the loss assessment and response cost analysis, so as to achieve the purpose of adaptive intrusion response.

The data service-oriented adaptive intrusion response game method mainly needs to consider three aspects: (1) How to build a game model between users and detection systems. Only by constructing the game model first can we judge whether there is a pure strategy Nash equilibrium between the two, and if it does not exist, then the mixed strategy Nash equilibrium can be solved. (2) What method is used to solve the Nash equilibrium point of the best response, and use the solved Nash equilibrium to adjust the response strategy, reduce manual intervention, and achieve rapid response. (3) According to the Nash equilibrium optimal strategy, how should the system respond to minimize the impact of attacks on data services in the Energy Internet.

Summary of the invention

The purpose of the present invention is to provide a data service-oriented adaptive intrusion response game method and its system to solve the problem of adaptive response to network attacks against data services. When the system is subjected to network attacks against data services, losses can be taken. Minimal response strategy.

Technical solution: A data service-oriented adaptive intrusion response game method, including the following steps:

Step 1: Discover intrusion attacks;

Step 2: Define variables based on the IDS response and the impact caused by user intrusion, and build a game model; the variables include: the positive utility that the user obtains due to the successful intrusion, the cost of performing an intrusion response, and the penalty for the intruder. Utility, recovery of data after successful detection, the cost of damage to data caused by a successful intrusion, and the probability of a successful response of the data intrusion detection system;

_{Step 3: Establish the payment functions g system} and g _{user of the} detection system and the user based on the game model and the expected utility function theory:

g _system ＝θ{[H _j +p(-K _d +N)γ+N(1-γ)]} (1)

g _user ＝γ{[pR _i +(1-p)(-B _e )]θ+(-B _e )(1-θ)} (2)

In the formula, B _e represents the positive utility obtained by the user as a result of a successful intrusion, N represents the cost of executing an intrusion response, R _i represents the negative effect of punishment on the intruder, K _d represents the recovery of data after successful detection, H _j represents the damage cost caused by a successful intrusion to the data, p represents the probability of a successful response of the data intrusion detection system, θ represents the probability that the detection system chooses to alarm, 1-θ represents the probability that the detection system chooses not to alarm, and γ represents the user's intrusion probability, 1-γ represents the probability that the user performs normal activity; _{_{wherein, B e, N, K d}} , R i> 0, B e <R i, N <K d, K d <H j; 0 <p≤ 1;

Step 4: Take the partial derivative of the payment function g _system of the detection system with respect to θ and set the equation to zero, and take the partial derivative of the payment function g _{user of the user with} respect to γ and set the equation to zero, and obtain:

Step 5: Determine whether the probability γ of the user's intrusion is less than the threshold γ ^* , if it is less, the optimal choice of the detection system is no alarm, otherwise the optimal choice of the detection system is alarm; when the detection system selects an alarm, it will serve the data Respond to the attack, if the detection system does not alarm, continue to perform normal operations;

Among them, the value of ^{γ * is equal to}

Further, in step 5, responding to the data service attack specifically includes the following steps:

S1: Collect data in the data service to form data set D, mark all data objects in data set D as unread, and filter all data objects to obtain core objects by defining ε-neighborhood;

S2: Take the subset D _i from the data set D, mark all the data objects in the subset D _i _{as read, determine whether the data object m in the subset D i} is the core object, and if so, find the data object All density-reachable data objects of m are marked as read; otherwise, the data object m is marked as noise data;

S3: Being satisfied

Under the condition of, repeat S2 until all data objects are marked as read, and execute S4;

S4: All the data objects with reachable density of each core object are classified into one category to form a data object set. After all core objects are traversed, the remaining data that is not classified into one category are abnormal data;

S5: Replace the abnormal data with the average of all density-reachable data corresponding to all core objects, perform normal operations, and end the attack response.

Furthermore, in S1, the Minkowski distance formula is used to define the ε-neighborhood:

N _ε (x _i )=(x _i ∈D|dist(x _i , x _j )≤ε) (8)

Where N _ε (x _i ) represents the collection of all data objects in the ε-neighborhood of the data object x _{i, and ε represents the radius parameter;}

When the number of data objects _{in the ε-neighborhood of the data object x i} is greater than ρ, the data object x _i is called the core object, where ρ is the minimum object parameter.

The invention also discloses a data service-oriented adaptive intrusion response game system, which includes:

A game model generator, used to define variables based on the IDS response and the impact of user intrusion to construct a game model when an intrusion attack is found;

A hybrid strategy generator, based on the game model and expected utility function theory, establishes the payment function of the detection system and the user, and obtains the mixed strategy Nash equilibrium point of the game model based on the payment function, and obtains the optimal mixed strategy according to the mixed strategy Nash equilibrium point;

An alarm responds according to the optimal mixing strategy.

Further, it also includes:

A data filter, after the alarm, filters the data collected in the data service to obtain the core object;

An object recognizer, which classifies all core objects and their corresponding density-reachable data objects, and the remaining unclassified data objects are abnormal data;

A data restorer removes the abnormal data, and replaces the abnormal data with the mean value of the normal data collection of different data types to perform normal operations.

Beneficial effects: The method of the present invention proposes a data service-oriented adaptive intrusion response game method and its system, which is mainly used to solve the problem of adaptive response to network attacks against data services. The method proposed by the present invention can be used for current The power grid environment is tested for security, and the behavior of the detection system and the attacker is quantified by quoting the idea of game theory, so that the system can get the best response, effectively using computing resources, and then further processing the attacked data through the DBSCAN algorithm. So as to ensure the safe and reliable operation of the power grid;

The mixed strategy generator of the present invention formulates the mixed strategies of the two sides of the game according to the game model of the two sides of the game. According to the profit relationship between the detection system and the user, the expected benefit function can be obtained, and then the mixed strategy is further obtained by solving the payment function of the two parties. Nash equilibrium to provide support for the follow-up response of the system;

The data filter of the present invention mainly uses the DBSCAN algorithm to cluster the data, marks all the initialized data as unread, defines the ε-neighborhood, filters out the core objects, and takes the data containing any number of data objects p from the data set D data set D _i, and D _i mark as read, the data is judged by ε p and ρ parameters, so as to filter out different types of transactions;

The target recognizer of the present invention satisfies the condition that the intersection of two adjacent data sets is an empty set, when all the data is marked as read, one of the core objects is used as a seed, and all the density reachable points of the object are Grouped into one category, forming a larger range of clusters. Repeat the cycle to finally realize the identification of abnormal data.

Description of the drawings

Figure 1 is a diagram of the architecture of the present invention;

Figure 2 is a schematic flow diagram of the present invention.

Detailed ways

The technical scheme of the present invention will be further described with reference to the drawings and embodiments.

The big data in the active distribution network has many types, multiple dimensions, and a large amount of data, which are of great value to enterprises and users. When performing data services, it is assumed that the power grid is attacked. The present invention refers to the game theory in game theory. Evaluate the potential threat of the system when it is attacked and the cost of the system's response, and then establish a mathematical model of conflict of interest between the data intrusion detection system and the end users in each link of the energy Internet, and adjust the response strategy in time, thereby To achieve the purpose of adaptive intrusion response, combined with the DBSCAN algorithm to filter out the attacked data.

As shown in Figure 2, a data service-oriented adaptive intrusion response game method of the present invention includes the following steps:

Step 1: Discover intrusion attacks;

Step 2: Based on the IDS response and the impact of user intrusion, quantitatively analyze the benefits and losses of both parties, and define the following variables: B _e represents the positive utility of the user as a result of the successful intrusion, and N represents the cost of performing an intrusion response. R _i represents the negative effect of punishment to the intruder, K _d represents the recovery of the data after the detection is successful, H _j represents the damage cost of the data caused by a successful intrusion, p represents the probability of a successful response of the data intrusion detection system, 0 <p≤1; the above parameters _{_{satisfy: B e, N, K d}} , R i> 0 and _{_{B e <R i, N <}} K d, K d <H j; build out both the game game model based on the above constraints ,As shown in Table 1:

Table 1 Game model of intrusion detection and response

Step 3: Assume that the mixed strategy of the detection system is (θ, 1-θ), that is, the system chooses to alarm with the probability of θ, and chooses not to alarm with the probability of (1-θ); the user's mixed strategy is (γ, 1-γ) ), that is, the invasion is carried out with the probability of γ, the normal activities are carried out with the probability of (1-γ), and the payment functions g _system and g _{user of the} user and the detection system are solved by the expected utility function theory;

g _system ＝θ{[H _j +p(-K _d +N)γ+N(1-γ)]} (1)

g _user ＝γ{[pR _i +(1-p)(-B _e )]θ+(-B _e )(1-θ)} (2)

Taking the partial derivative of g _system to θ and setting the equation to zero, and taking the _{partial derivative of g user} to γ and setting the equation to zero, we get:

Available:

So the Nash equilibrium of the mixed strategy is:

When p approaches 0 and the probability of a successful response of the detection system is almost 0, ^{the value of γ*} approaches 1, that is, the user will almost always choose to invade. Since N<K _D , as p increases, ^{the value of γ *} will decrease; when p increases to 1, the value of ^{γ * is equal to}

Can get the best response strategy;

When the probability γ of the user's intrusion is less than γ ^* , the optimal choice of the detection system is not to alarm; when the probability γ of the user's intrusion is greater than or equal to γ ^* , the optimal choice of the detection system is to alarm.

Step 4: Determine whether the detection system alarms, if it alarms, proceed to step 5, otherwise the system continues to detect, and when an intrusion attack is found, proceed to step 1;

Step 5: Initialize the data set D collected in the data service and mark all data objects as unread, and define the ε-neighborhood through the Minkowski distance formula:

N _ε (x _i )=(x _i ∈D|dist(x _i , x _j )≤ε) (8)

Among them, N _ε (x _i ) represents the collection of all data objects in the ε-neighborhood, ε represents the radius parameter, and defines ρ as the minimum object parameter. When the number of data objects _{in the ε-neighborhood of the data object x i} is greater than ρ, the data object x _i is called the core object.

_{Step 6: Take the data set D i} containing any number of data objects m from the data set D, where D _i ∈ D, i = 1, 2, 3..., _{mark D i} as read, and pass the radius parameter ε and the minimum object parameter ρ judge the data object m. If the data object m is the core object, find out all the density of the data object m can reach the data object, and mark it as read. If the data object m is not the core object and there is no Which data object can reach the density of data object m, and mark data object m as noise data;

Step 7: After meeting

Under the condition of, repeat step 6 until all data objects are marked as read;

Step 8: Use one of the core objects as a seed, and classify all the density-reachable data objects of the core object into one category to form a larger range of data object collections, also called clusters;

Step 9: Repeat step 8 until all core objects have been traversed, and the remaining data that is not classified into one category are abnormal data.

Step 10: Take the average of all density-reachable data of all core objects to replace abnormal data to perform normal operations.

Step 11: The loop ends.

Aiming at the above-mentioned data service-oriented adaptive intrusion response game method system, its system structure is:

As shown in Figure 1, it mainly includes four parts: game model generator, hybrid strategy generator, data filter, target recognizer, and data restorer. The game model generator is the benefit to both parties when the system detects an attack. Perform analysis to obtain the game model between the system and the user; the hybrid strategy generator is based on the game model to obtain the optimal decision of the system; the data filter is to filter out the core objects from the collected data; the target recognizer is the core of all Objects are classified, and the remaining unclassified data is abnormal data. The data restorer takes the average of normal data sets of different data types to replace abnormal data to perform normal operations. The details are as follows:

The game model generator is mainly to quantitatively analyze the benefits and losses of both parties when the data detection system detects an attack, and define variables based on the IDS response and the impact caused by the user intrusion: the positive utility obtained by the user due to the successful intrusion is represented _{by B e} ; The cost required to perform an intrusion response is denoted by N; R _i denotes the negative effect of punishment on the intruder; K _D denotes the recovery of data after successful detection; H _j denotes the cost of damage to data caused by a successful intrusion; p Indicates the probability of a successful response of the data intrusion detection system (0<p≤1). The above parameters _{_{satisfy: B e, N, R i}} , K D> 0 , and _{_{B e <R i, N <}} K D, K D <H j. Based on the above constraints between the user and the detection system, a game model between the two parties is finally built, which can be seen in Table 1.

The mixed strategy generator is mainly based on the game model of the two parties to formulate the mixed strategy of the detection system and the user. The expected utility function is used to solve the payout matrix of both parties to obtain the Nash equilibrium point of the hybrid strategy, and then the optimal strategy of the system can be known to provide support for the subsequent response of the system. The data filter mainly marks all the initialized data as unread, and defines the ε-neighborhood. When the _{number of data objects in the ε-neighborhood of the object x i} is greater than the minimum object parameter ρ, that is |N _ε (x _i )| When ＞ρ, x _i is called the core object. In a data set, not all data objects are core objects, and there are edge objects and noise objects. An edge object indicates that the data object is not a core object, but exists in the ε-neighborhood of a certain core object; a noise object indicates that the data object is not a core object, nor does it exist in the ε-neighborhood of any core object;

Taken from the data set D m contain any data objects in the data set D _i, where _{D i ∈D, i = 1,2,3 ...} , _I and D marked as read. The data m is judged by the ε and ρ parameters. If m is the core object, find all the data objects whose density can reach m and mark them as read. If m is not a core object, and no object can reach the density of m, mark m as noise data to filter out different types of data.

The target recognizer is used to satisfy

Under the condition of, when all data is marked as read, one of the core objects is used as a seed, and all the density reachable points of the object are classified into one category, forming a larger-range data object collection, also called Cluster clusters. Repeatedly loop until all core objects have been traversed, and the remaining data that is not classified into one category is abnormal data.

The data restorer is used to eliminate the identified abnormal data, and replace the abnormal data with the normal data set of different data types to take the arithmetic mean to perform normal operations.

Claims

A data service-oriented adaptive intrusion response game method is characterized in that it includes the following steps:

Step 1: Discover intrusion attacks;

Step 2: Define variables based on the IDS response and the impact caused by user intrusion, and build a game model; the variables include: the positive utility that the user obtains due to the successful intrusion, the cost of performing an intrusion response, and the penalty for the intruder. Utility, recovery of data after successful detection, the cost of damage to data caused by a successful intrusion, and the probability of a successful response of the data intrusion detection system;

Step 3: Establish the payment functions g system and g user of the detection system and the user based on the game model and the expected utility function theory:

g system ＝θ{[H j +p(-K d +N)γ+N(1-γ)]} (1)

g user ＝γ{[pR i +(1-p)(-B e )]θ+(-B e )(1-θ)} (2)

In the formula, B e represents the positive utility obtained by the user as a result of a successful intrusion, N represents the cost of executing an intrusion response, R i represents the negative effect of punishment on the intruder, K d represents the recovery of data after successful detection, H j represents the damage cost caused by a successful intrusion to the data, p represents the probability of a successful response of the data intrusion detection system, θ represents the probability that the detection system chooses to alarm, 1-θ represents the probability that the detection system chooses not to alarm, and γ represents the user's intrusion probability, 1-γ represents the probability that the user performs normal activity; wherein, B e, N, K d , R i> 0, B e <R i, N <K d, K d <H j; 0 <p≤ 1;

Step 4: Take the partial derivative of the payment function g system of the detection system with respect to θ and set the equation to zero, and take the partial derivative of the payment function g user of the user with respect to γ and set the equation to zero, and obtain:

Step 5: Determine whether the probability γ of the user's intrusion is less than the threshold γ * , if it is less, the optimal choice of the detection system is no alarm, otherwise the optimal choice of the detection system is alarm; when the detection system selects an alarm, it will serve the data Respond to the attack, if the detection system does not alarm, continue to perform normal operations;

Among them, the value of γ * is equal to
A data service-oriented adaptive intrusion response game method according to claim 1, characterized in that: in step 5, responding to a data service attack specifically includes the following steps:

S1: Collect data in the data service to form data set D, mark all data objects in data set D as unread, and filter all data objects to obtain core objects by defining ε-neighborhood;

S2: Take the subset D i from the data set D, mark all the data objects in the subset D i as read, determine whether the data object m in the subset D i is the core object, and if so, find the data object All density-reachable data objects of m are marked as read; otherwise, the data object m is marked as noise data;

S3: Being satisfied
Under the condition of, repeat S2 until all data objects are marked as read, and execute S4;

S4: All the data objects with reachable density of each core object are classified into one category to form a data object set. After all core objects are traversed, the remaining data that is not classified into one category are abnormal data;

S5: Replace the abnormal data with the average of all the density-reachable data corresponding to all core objects, perform normal operations, and end the attack response.
A data service-oriented adaptive intrusion response game method according to claim 2, characterized in that: in S1, the Minkowski distance formula is used to define the ε-neighborhood:

N ε (x i )=(x i ∈D|dist(x i , x j )≤ε) (8)

Where N ε (x i ) represents the collection of all data objects in the ε-neighborhood of the data object x i, and ε represents the radius parameter;

When the number of data objects in the ε-neighborhood of the data object x i is greater than ρ, the data object x i is called the core object, where ρ is the minimum object parameter.
An intrusion response game system based on a data service-oriented adaptive intrusion response game method according to any one of claims 1 to 3, characterized in that it comprises:

A game model generator, used to define variables based on the IDS response and the impact of user intrusion to construct a game model when an intrusion attack is found;

A hybrid strategy generator, based on the game model and expected utility function theory, establishes the payment function of the detection system and the user, and obtains the mixed strategy Nash equilibrium point of the game model based on the payment function, and obtains the optimal mixed strategy according to the mixed strategy Nash equilibrium point;

An alarm responds according to the optimal mixing strategy.
The intrusion response game system according to claim 4, characterized in that it further comprises:

A data filter, after the alarm, filters the data collected in the data service to obtain the core object;

An object recognizer, which classifies all core objects and their corresponding density-reachable data objects, and the remaining unclassified data objects are abnormal data;

A data restorer removes abnormal data, and replaces the abnormal data with the average of all the density-reachable data corresponding to all core objects to perform normal operations.