基于Cheat-FlipIt博弈的网络安全对抗建模与分析

Modeling and analysis of network security adversarial behavior based on Cheat-FlipIt game

摘要:

针对网络空间安全中的建模问题，以典型的高级持续威胁(advanced persisted threat, APT)攻击中对目标的隐蔽控制为背景，将FlipIt博弈模型进行扩展，引入攻击者的欺骗能力，提出Cheat-FlipIt博弈模型。并基于该模型，探索深度强化学习防御决策对具有一定欺骗能力攻击者的鲁棒性和适用性。理论分析和实验结果表明，所建立的Cheat-FlipIt博弈模型较好地反映了APT的欺骗过程和特点。

Abstract:

Addressing the issue of security adversarial modeling in cyberspace security, this paper expanded upon the FlipIt game model against the backdrop of covert control over targets in typical advanced persistent threat (APT) attacks. It introduced the deceptive capabilities of attackers and proposed the Cheat-FlipIt game model. Based on this model, the study explored the robustness and applicability of deep reinforcement learning (DRL) defense decisions to attackers with certain deceptive capabilities. Theoretical analysis and experimental results indicate that the established Cheat-FlipIt game model aptly reflects the deception process and characteristics of APTs.