Attack-defense Confrontation Research Articles

PPSO and Bayesian game for intrusion detection in WSN from a macro perspective

The security of wireless sensor networks is a hot topic in current research. Game theory can provide the optimal selection strategy for attackers and defenders in the attack-defense confrontation. Aiming at the problem of poor generality of previous game models, we propose a generalized Bayesian game model to analyze the intrusion detection of nodes in wireless sensor networks. Because it is difficult to solve the Nash equilibrium of the Bayesian game by the traditional method, a parallel particle swarm optimization is proposed to solve the Nash equilibrium of the Bayesian game and analyze the optimal action of the defender. The simulation results show the superiority of the parallel particle swarm optimization compared with other heuristic algorithms. This algorithm is proved to be effective in finding optimal defense strategy. The influence of the detection rate and false alarm rate of nodes on the profit of defender is analyzed by simulation experiments. Simulation experiments show that the profit of defender decreases as false alarm rate increases and decreases as detection rate decreases. Using heuristic algorithm to solve Nash equilibrium of Bayesian game provides a new method for the research of attack-defense confrontation. Predicting the actions of attacker and defender through the game model can provide ideas for the defender to take active defense.

Attack–Defense Confrontation Analysis and Optimal Defense Strategy Selection Using Hybrid Game Theoretic Methods

False data injection attacks are executed in the electricity markets of smart grid systems for financial benefits. The attackers can maximize their profits through modifying the estimated transmission power and changing the prices of market electricity. As a response, defenders need to minimize expected load losses and generator trips through load and power generation adjustments. The selection of strategies of the attacking and defending sides turns out to be a symmetric game process. This article proposes a hybrid game theory method for analyzing the attack–defense confrontation: firstly, a micro-grid-based power market model considering false data injection attacks is established using the Nash equilibrium method; secondly, the attack–defense game function is constructed and solved via the Stackelberg equilibrium algorithm. The Markov game algorithm and distributed learning algorithm are used to update equilibrium function; finally, a dynamic game behavior model of the two players is constructed through simulating the attack–defense probability. The evolutionary game method is used to select the optimal defense strategy for dynamic probability changes. Modified IEEE standard bus systems are illustrated to certify the effectiveness of the proposed model.

Evolutionary Algorithm-Based Attack Strategy With Swarm Robots in Denied Environments

An attack-defense confrontation problem arises from a robot swarm attacking a territory protected by another one. In denied environments, global positioning and communication are hardly available. It becomes difficult for a swarm to realize collaboration and handle confrontation against another. Commonly-used deep reinforcement learning relies on pre-training, which is time-consuming and has strong environmental dependence, especially in denied environments. To study attack strategies in denied environments, this work proposes a novel Evolutionary Algorithm-based Attack Strategy with Swarm Robots for the first time. Each robot obtains its situation information through perceiving its nearby peers and enemies. Such information is utilized to evaluate the benefits or threats of a robot’s next perceptible attack positions. Then, each robot uses the evolutionary algorithm to optimize its fitness function and searches for its optimal position. A collision avoidance strategy is integrated into the algorithm. Hence, a robot swarm realizes collaboration and handles confrontation as long as each robot can sense its surroundings. They utilize their own sensors to detect others locally without using global positioning and communication devices. The experimental analyses show that the evolutionary algorithm-based attack strategy has better scalability and more potential in solving large-scale confrontational problems than the deep reinforcement learning-based algorithms. Rationales of the proposed method is presented to verify the great capability of the proposed method.

Security risk assessment of projects in high-risk areas based on attack-defense game model

Assessing the security risk of projects in high-risk areas is particularly important. This paper develops a security risk assessment model for projects in high-risk areas based on the target loss probability model and Bayesian game model. This model is modeled from the perspective of attack-defense confrontation and addresses the issue that traditional risk assessment focuses on the analysis of the attacker yet neglects to analyze the defender—the defender’s optimum defensive information is not quantitatively determined. The risk level, optimum defensive resource value, and optimum defensive strategy of the project are determined through the analysis of a project in the high-risk area. This enables the project’s risk manager to adjust the defensive resources reasonably and optimally, confirming the objectivity and feasibility of the model and offering a new benchmark for security risk assessment, which has significant practical implications.

A Super-Resolution Reconstruction Network of Space Target Images Based on Dual Regression and Deformable Convolutional Attention Mechanism

High-quality space target images are important for space surveillance and space attack defense confrontation. To obtain space target images with higher resolution and sharpness, this paper proposes an image super-resolution reconstruction network based on dual regression and a deformable convolutional attention mechanism (DCAM). Firstly, the mapping space is constrained by dual regression; secondly, deformable convolution is used to expand the perceptual field and extract the high-frequency features of the image; finally, the convolutional attention mechanism is used to calculate the saliency of the channel domain and the spatial domain of the image to enhance the useful features and suppress the useless feature responses. The experimental results show that the method outperforms the comparison algorithm in both objective quality evaluation index and localization accuracy on the space target image dataset compared with the current mainstream image super-resolution algorithms.

Optimal Penetration Guidance Law for High-Speed Vehicles against an Interceptor with Modified Proportional Navigation Guidance

Aiming at the penetration problem of high-speed vehicles against a modified proportional guidance interceptor, a three-dimensional mathematical model of attack–defense confrontation between the high-speed vehicle and the interceptor is established in this paper. The modified proportional navigation guidance law of the interceptor is included in the model, and control constraints, pitch angle velocity constraints, and dynamic delay are introduced. Then, the performance index of the optimal penetration of high-speed vehicles is established. Under the condition of considering the 180-degree BTT control, the analytical solutions of the optimal speed roll angle and the optimal overload of high-speed vehicles are obtained according to symmetric Hamilton principle. The simulation results show that the overload switching times of high-speed vehicles to achieve optimal penetration are N − 1, where N is the modified proportional guidance coefficient of the interceptor. When the maximum speed roll angle velocity is [60, 90] degrees per second, the penetration effect of high-speed vehicles is good. Finally, the optimal penetration guidance law proposed in this paper can achieve a miss distance of more than 5 m when the overload capacity ratio is 0.33.

A Bio-Inspired Decision-Making Method of UAV Swarm for Attack-Defense Confrontation via Multi-Agent Reinforcement Learning.

The unmanned aerial vehicle (UAV) swarm is regarded as having a significant role in modern warfare. The demand for UAV swarms with the capability of attack-defense confrontation is urgent. The existing decision-making methods of UAV swarm confrontation, such as multi-agent reinforcement learning (MARL), suffer from an exponential increase in training time as the size of the swarm increases. Inspired by group hunting behavior in nature, this paper presents a new bio-inspired decision-making method for UAV swarms for attack-defense confrontation via MARL. Firstly, a UAV swarm decision-making framework for confrontation based on grouping mechanisms is established. Secondly, a bio-inspired action space is designed, and a dense reward is added to the reward function to accelerate the convergence speed of training. Finally, numerical experiments are conducted to evaluate the performance of our method. The experiment results show that the proposed method can be applied to a swarm of 12 UAVs, and when the maximum acceleration of the enemy UAV is within 2.5 times ours, the swarm can well intercept the enemy, and the success rate is above 91%.

A method for analyzing Stackelberg attack–defense game model in 5G by tCPSO

The development of 5G brings convenience to people, but it also brings threats. It is particularly important to analyze attack–defense confrontation from a macro perspective. Network security of graph is an important research problem in current network environment. A Stackelberg game model based on 5G network graph is established to analyze the attack–defense confrontation in this paper. In order to solve the Nash equilibrium, a compact particle swarm optimization based on t-Location-Scale distribution (tCPSO) is proposed. The tCPSO uses less memory space and has better optimization performance. The experiments prove that tCPSO has better optimization performance than other heuristic algorithms on CEC2013. The clustering experiments further show that tCPSO has better optimization ability than other heuristic algorithms. The optimal defense strategies under different attack–defense resources are analyzed in this paper. It is concluded that increasing the successful defense rate is more effective for the defender to obtain greater profit than reducing the successful attack rate. Using intelligent computing to solve Nash equilibrium is a new idea for researchers to analyze attack–defense confrontation.

An Adversarial DBN-LSTM Method for Detecting and Defending against DDoS Attacks in SDN Environments

As an essential piece of infrastructure supporting cyberspace security technology verification, network weapons and equipment testing, attack defense confrontation drills, and network risk assessment, Cyber Range is exceptionally vulnerable to distributed denial of service (DDoS) attacks from three malicious parties. Moreover, some attackers try to fool the classification/prediction mechanism by crafting the input data to create adversarial attacks, which is hard to defend for ML-based Network Intrusion Detection Systems (NIDSs). This paper proposes an adversarial DBN-LSTM method for detecting and defending against DDoS attacks in SDN environments, which applies generative adversarial networks (GAN) as well as deep belief networks and long short-term memory (DBN-LSTM) to make the system less sensitive to adversarial attacks and faster feature extraction. We conducted the experiments using the public dataset CICDDoS 2019. The experimental results demonstrated that our method efficiently detected up-to-date common types of DDoS attacks compared to other approaches.

A differential game approach for real-time security defense decision in scale-free networks

The current network security defense decision method is based on the principle of attack–defense confrontation and generally uses a random network model to project the real network. Most of the existing complex network defense decision methods consider a single defender while ignoring the confrontation and dependence between network attack and defense behaviors. In addition, the pertinence and dynamics of the defense effect are also insufficient. This article comprehensively considers the structure of a scale-free network and characteristics of network attack and defense behavior and combines a complex network with differential game theory to study the real-time defense decision problem. First, a propagation model based on a scale-free network is designed to realize the real-time fluctuation analysis of a network security state. Then, the attack and defense strategy are described, and the calculation method of revenue based on the confrontation analysis of the attack and defense behavior and a change in the security state of the network nodes based on the saddle point equilibrium strategy are introduced. Finally, based on the average connection degree of the real word Internet, a simulated network is constructed to conduct experiments. By comparison with random defense strategies and several typical complex network defense decision methods, the effectiveness and advancement of the proposed method are verified.

A Decision-making Method for Swarm Agents in Attack-defense Confrontation

The cooperative decision-making of swarm agents has attracted extensive attention from researchers due to its potential applications in multidisciplinary engineering problems. This paper studies a confrontation problem called asymmetric attack-defense confrontation (i.e., considering the difference in capability and quantity between agents and targets). The objective is to develop an effective self-organized swarm confrontation decision-making method. The decision-making process consists of task allocation decision and swarm motion decision. At each decision-making step, firstly, each agent forms a coalition with other agents autonomously by using a proposed hedonic coalition formation algorithm according to the attribute of targets. Thus, the agents assigned to the same target form a coalition, and swarm agents form several disjoint coalitions. Then, based on the allocated results, the agents are steered toward the corresponding target by a combat stimulus and a proposed selected interaction swarm algorithm. Finally, while the targets are within the agents’ attack radius, the agents execute the confrontation decision. Simulation results show the effectiveness of the designed method.

Cybersecurity Threat Assessment Integrating Qualitative Differential and Evolutionary Games

Most current game theory-based cybersecurity analysis methods use traditional game models, which do not meet realistic conditions of continuous dynamic changes in attack-defense behaviors and decision makers without perfect rationality, and therefore they adapt with difficulty to the practical requirements of cybersecurity threat assessment. This paper draws on infectious disease dynamics methods to describe the cybersecurity threat propagation process. It constructs a dynamic game model of a cybersecurity threat based on continuous attack-defense confrontation and boundedly rational decision makers, combining qualitative differential and evolutionary game theories. Qualitative differential games are used to analyze the confrontation process of security threats, calculate attack-defense barriers, and construct a benchmark to measure the degree of a security threat. Evolutionary games are used to analyze the dynamic change of attack-defense strategy-selection probabilities based on replicator dynamics, and to deduce the evolutionary trajectory of the network security state. We then calculate the multidimensional Euclidean distance between the evolutionary trajectory and the attack-defense barrier metric benchmark, and use it as the basis for a dynamic threat assessment algorithm to improve the timeliness and objectivity of threat assessment. Simulation experiments show that the model and algorithm are effective and feasible.

A Defense Strategy Selection Method Based on the Cyberspace Wargame Model

Network defenders always face the problem of how to use limited resources to make the most reasonable decision. The network attack-defense game model is an effective means to solve this problem. However, existing network attack-defense game models usually assume that defenders will no longer change defense strategies after deploying them. However, in an advanced network attack-defense confrontation, defenders usually redeploy defense strategies for different attack situations. Therefore, the existing network attack-defense game models are challenging to accurately describe the advanced network attack-defense process. To address the above challenges, this paper proposes a defense strategy selection method based on the network attack-defense wargame model. We model the advanced network attack-defense confrontation process as a turn-based wargame in which both attackers and defenders can continuously adjust their strategies in response to the attack-defense posture and use the Monte Carlo tree search method to solve the optimal defense strategy. Finally, a network example is used to illustrate the effectiveness of the model and method in selecting the optimal defense strategy.

Deep reinforcement learning based multi-AUVs cooperative decision-making for attack–defense confrontation missions

This paper mainly focuses on using deep reinforcement learning (RL) to deal with the cooperative decision-making problem of multiple Autonomous Underwater Vehicles (multi-AUVs) under limited perception and limited communication in attack–defense confrontation missions. Firstly, a novel Coding-Convolutional Network (CCN) is proposed, which can encode the raw sensor information of AUVs and extract representative features from limited perception. Secondly, utilizing the approximator of the state value function and policy function composed of CCN and fully connected network, we put forward a centralized decision-making architecture for multi-AUVs system based on actor–critic framework and give the corresponding algorithm combined with asynchronous training. Moreover, with respect to multi-AUVs attack–defense confrontation tasks, we develop a simulation platform to train and evaluate the proposed algorithms under different parameters. It can be directly observed from the visualization of the simulation that the algorithm enables multi-AUVs to complete the attack–defense confrontation missions excellently and generate some interesting collaborative behaviors. The average winning probability data of the simulation results also indicate that the designed method is feasible for multi-AUVs to achieve cooperative decision-making in attack–defense confrontation missions.

Industrial Control System Defense Decision-Making Method Based on Dynamic Attack-Defense Game

Industrial control systems are different from traditional information systems and require extremely high system availability. In the face of potential attack incidents, blind defense deployment may affect system performance and efficiency, which is counterproductive. For this reason, this paper proposes a defense decision-making method for industrial control systems based on dynamic attack-defense games. This method first analyzes the actual attack-defense confrontation scenarios in the industrial control system, and constructs a dynamic attack-defense game model based on this. After that, an industrial control system attack-defense game tree defined on this model is constructed, and the game tree is used to describe the specific attack-defense confrontation process. Then the backward induction method is used in the game tree to find the equilibrium path. The information on this path is of great reference value for defenders to choose a reasonable and efficient defense plan, maintain system stability and reduce defense costs. At the end of this paper, this method is applied to a real limestone powder preparation system for experiments. The experimental results verify the effectiveness of the method in actual scenarios.

Computer Network Security Threats and Treatment Measures Based on Host Security Protection

The host computer is an important part of the computer, which is the basic location for users to store data directly. Therefore, we must strengthen the host security, which will protect the security and privacy of user information. However, hackers, Trojans, worms and other network security threats often attack the computer, which has become an important threat to the application of network security. Therefore, we must strengthen the host network security protection, which will protect the host information from illegal network behavior. By ensuring the security of user host information, we can reduce the waste of resources. In the network security attack defense confrontation, both sides have natural asymmetry, which requires us to deal with network security threats. Through a variety of processing measures, we can protect the computer host security. Firstly, this paper analyzes the decision-making framework of network security threats and protection. Then, this paper puts forward the common types of network security threats. Finally, this paper puts forward the current mainstream treatment measures.

Research on multi UAV attack defense confrontation algorithm based on machine learning

In recent years, with the continuous development and wide application of unmanned technology, the use of unmanned aircraft in various fields such as agriculture, industry, disaster, leisure and military purposes has increased, and even played an irreplaceable role in certain fields. However, the functions of a single drone are very limited and cannot meet the increasing diversified needs of people. Among the many diverse needs of people, target tracking is a very important task that unmanned aircraft systems need to undertake in future application scenarios. Therefore, how to make multiple drones work together to complete the tracking of the same target has become an important research topic. However, so far, the path planning of many unmanned cooperative tracking targets has not been well resolved. This paper combines a DQN-based MADDPG (Multi-Agent Deep Deterministic Policy Gradient) algorithm to propose a path planning method for multiple UAVs to cooperatively track targets, which can dynamically plan and adjust the flight path of multiple cooperative UAVs in real time and get better tracking effect in a period of time.

Malware propagation model in wireless sensor networks under attack–defense confrontation

An important security problem faced by wireless sensor networks (WSNs) is malware propagation. Traditional malware propagation models take less consideration of the impact of the attack and defense processes on malware propagation results. We analyzed the micro-mechanism of malware propagation in WSNs from the perspective of the game theory, established the attack–defense game model of WSNs, derived the mixed Nash equilibrium solution of the game model, and derived the contagion probability of malwares according to the mixed Nash equilibrium strategy of both sides in the game, thus establishing the malware propagation model in WSNs. From the analysis of the theoretical model, we deduced the relationship between the steady-state infection ratio and the game parameters and obtained the conditions for the long-term existence of malwares. In addition, we simulated the propagation process of malwares in WSNs with cellular automaton and the simulation results verified the correctness of the theoretical model. The results have theoretical guiding significance for suppressing the propagation of malwares in WSNs.

Efficient Defense Decision-Making Approach for Multistep Attacks Based on the Attack Graph and Game Theory

In the multistep attack scenario, each rational attack-defense player tries to maximize his payoff, but the uncertainty about his adversary prevents him from taking the favorable actions. How to select the best strategy from the candidate strategies to maximize the defense payoff becomes the core issue. For this purpose, the paper innovatively designs a game theory model from the point of network survivability in combination with the attribute attack graph. The attack graph is created based on the network connectivity and known vulnerabilities using the MulVAL toolkit, which gives the full view of all the known vulnerabilities and their interdependence. Then, we use the attack graph to extract attack-defense actions, candidate attack-defense strategies, attack-defense payoffs, and network states, as well as other game modeling elements. Afterwards, the payoffs of attack-defense strategies are quantified by integrating attack-defense strength and network survivability. In addition, we input the above elements into the game model. Through repeated learning, deduction, and improvement, we can optimize the layout of defense strategies. Finally, the efficient strategy selection approach is designed on the tradeoff between defense cost and benefit. The simulation of attack-defense confrontation in small-scale LAN shows that the proposed approach is reliable and effective.

Security Analysis for CBTC Systems under Attack–Defense Confrontation

Communication-based train controls (CBTC) systems play a major role in urban rail transportation. As CBTC systems are no longer isolated from the outside world but use other networks to increase efficiency and improve productivity, they are exposed to huge cyber threats. This paper proposes a generalized stochastic Petri net (GSPN) model to capture dynamic interaction between the attacker and the defender to evaluate the security of CBTC systems. Depending on the characteristics of the system and attack–defense methods, we divided our model into two phases: penetration and disruption. In each phase, we provided effective means of attack and corresponding defensive measures, and the system state was determined correspondingly. Additionally, a semiphysical simulation platform and game model were proposed to assist the GSPN model parameterization. With the steady-state probability of the system output from the model, we propose several indicators for assessing system security. Finally, we compared the security of the system with single defensive measures and multiple defensive measures. Our evaluations indicated the significance of the defensive measures and the seriousness of the system security situation.