Research on the game of network security attack‐defense confrontation through the optimal defense strategy

Liu, Fei; Gao, Hongyan; Wei, Ze-Gang

doi:10.1002/spy2.136

Cited by 6 publications

(2 citation statements)

References 17 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Huang et al 14 modeled these competitive interactions using game theory ranging from full to partial information, one‐stage to multi‐stage transitions, and symmetric to asymmetric information structures. Reference 15 proposed and verified a most defensive strategy by analyzing the strategies in the process of offensive and defensive confrontation in cyberspace, using a Nash equilibrium with mixed strategies. Connell et al 16 proposed a model to measure the availability and performance of resources, which enabled minimizing the possibility of successful attacks.…”

Section: Related Workmentioning

confidence: 99%

An active defense model based on situational awareness and firewalls

Xiao

et al. 2023

Concurrency and Computation

View full text Add to dashboard Cite

With the rapid development of the internet, cyberspace security issues have become increasingly prominent. The importance of constructing a cyberspace security system is self-evident, but compared with attackers, defenders in cyberspace are in a castle-like passive defense state in most cases. Therefore, building a reliable, accurate, timely, and active defense system is challenging. The key is to accurately focus on defense priorities, the anticipation of attackers who will likely succeed, and blocking attacks in a timely manner. In this article, we propose an active defense model based on the interaction of situational awareness and firewalls. First, by biasing the integrity, confidentiality, and availability of assets to get the score of assets, and using the Common Vulnerability Scoring System to assess the threat level of assets, we combine the two to determine the maximum system damage that the asset will suffer if it is lost, and then focus on defense. Meanwhile, log analysis of the network situational awareness platform can predict successful attackers, and then the linked firewall strategy can block these attacks in time before the attackers obtain attack gains. After that, we force the attackers to give up their attacks on the target by increasing the attack cost.We compared our model with iptables auto-blocking and nginx auto-blocking, and our model excelled them across the board in terms of comprehensiveness and false positive rate. The experimental results verify thar our active defense model proposed in this article can better reduce the defense cost and increase the attack cost, thus achieving the relatively defense goal. K E Y W O R D Sactive defense, cyber attack and defense, defense cost, game theory INTRODUCTIONWith the development of information technology, cyberspace has become the fifth space after "land, sea, air, and sky", and the security of cyberspace is directly related to the sovereign security of the country. Cyber attack and defense have become hot spots in current cybersecurity research. The objectives of cyber attackers include collecting information about a target, paralyzing the target service, entering the target and stealing data, while the objectives of cyber defenders are to keep the service running normally and stop attackers. Scanning of the target system is something that a cyber attacker must do before launching cyber attacks, which helps the attacker gain access to exploitable vulnerabilities in the target system to compromise the network. The purpose of such a scan is to understand the configurations of target systems, including but not limited to the target system's operating system, IP address, running services, software versions, existing common vulnerabilities & exposures(CVEs), weak passwords, and so on. How to prevent attackers from obtaining the scan results or prevent the attacker from using the scan results for other benefits is the goal

show abstract

Section: Related Workmentioning

confidence: 99%

An active defense model based on situational awareness and firewalls

Xiao

et al. 2023

Concurrency and Computation

View full text Add to dashboard Cite

show abstract

“…In 2021, Fei Liu et al [7] analyzed the establishment of game model and strategy selection in the process of offense-defense confrontation in network security. They set up a new network attack and defense game model; The components of the model are analyzed.…”

Section: Research Status Of Network Security Game Theorymentioning

confidence: 99%

Current Situation and Prospect of Game Theory based Network Security Methods

Zhang,

Yang,

Zhao

et al. 2023

TCSISR

View full text Add to dashboard Cite

The attack and defense model of network security based on game theory has developed into an effective network security model. It is a hot topic in the field of network and information security to use the idea of game theory to attack and defend the network security. This paper analyzes the general model of game theory in the field of security. This paper also analyzes the general model of network security attack and defense game. This paper also analyzes the game theory model of cryptographic protocol. This paper studies the existing network security methods based on game theory, reviews the development and evolution process and technical core of network security based on game theory, and compares the specificity of network security models based on game theory. Finally, the paper discusses the problems in the field of network security based on game theory, and tries to forecast its future development trend.

show abstract