基于博弈论框架的自适应网络入侵检测与响应  

Game theoretical framework for adaptive intrusion detection and response

作　　者：郭渊博[1] 马建峰[1] 

机构地区：[1]解放军信息工程大学电子技术学院

出　　处：《系统工程与电子技术》2005年第5期914-917,共4页Systems Engineering and Electronics

基　　金：国家自然科学基金重大研究计划项目(90204012);"863"高技术计划基金(2002AA143021);教育部优秀青年教师资助计划;教育部科学技术重点研究项目;总装备部武器装备基金项目资助课题

摘　　要：首先建立了一个简单的入侵者与入侵检测及响应系统之间的博弈模型,推导出博弈双方的最优混合策略,得到模型中各方参与者的优化问题的解,并给出了相应的物理解释。通过对参与人的成本收益情况进行分析,得到系统在各种入侵情况下报警率、响应率、惩罚尺度等因素之间的函数关系,从而给出能够动态调整安全策略的自适应入侵响应策略。然后,考虑到现有商用入侵检测及响应系统中固有的缺陷,例如不可能百分之百对入侵做出成功响应等问题,对上述模型进行了扩展。A universal game model of perfect information between the attacker and the intrusion detection and response system is built to deal with the intrusion detection, response and countermeasure problem. On the basis of this model, the mixed strategy equilibriums and their properties are derived. Then, a comprehensive cost-benefit analysis of both players is given, thus enabling us to understand the relationships between alarm rate, response rate and punitive measure, and thus an adaptive intrusion response framework is designed. Finally, an extension of this model is also proposed and analyzed considering the inherent limitations of commercial intrusion detection and response systems.

关 键 词：博弈论 入侵检测与响应 对抗 纳什均衡 

分 类 号：TP393.4[自动化与计算机技术—计算机应用技术]