基于网络安全风险评估的攻防博弈模型

如何量化网络安全风险评估的威胁概率是一个亟需解决的重要问题。网络安全攻防对抗的本质可以抽象为攻防双方的策略的相互影响。防御者所采取的防御策略是否有效,不应该只取决于其自身的行为,还应取决于攻击者和防御系统的策略。执行攻击的决定是在攻击收益和被检测可能带来的后果之间进行权衡,防御者的安全策略主要取决于对攻击者意图的了解程度。本文提出一种博弈攻防模型,量化了威胁的可能性,构建了一个风险评估框架。根据成本效益分析,笔者定义了制定支付矩阵的方法并分析该模型的平衡性。

Attack and Defensive Game Model Based on Network Security Risk Assessment

How to quantify the threat probability of network security risk is an important problem to be solved.The nature of attack and defense against network security can be abstracted as mutual influence of both strategies.Whether the defense strategy adopted by defenders is valid not only depend on their own behavior,but also depend on the strategy of the attacker and the defense system.The decision to implement the attack of an attack is a trade-off between income and the potential consequences.The defender＇s security strategy depends on understanding of the intent of the attacker.This paper presents the possibility of an offensive and defensive game model to quantify the threat to construct a risk assessment framework.Based on cost-benefit analysis,we define the payoff matrix method developed and analyzed the balance of the model.