基于信令博弈的网络诱骗防御策略分析与仿真

系统仿真学报 ›› 2016, Vol. 28 ›› Issue (2): 348-353.

基于信令博弈的网络诱骗防御策略分析与仿真

石乐义, 赵俊楠, 李芹, 温晓, 刘昕

中国石油大学(华东)计算机与通信工程学院青岛 266580

收稿日期:2014-07-01 修回日期:2014-11-18 出版日期:2016-02-08 发布日期:2020-08-17
作者简介:石乐义（1975-）,男,山东临朐,博士,教授,研究方向为计算机网络,信息安全,移动互联网和博弈理论;赵俊楠（1991-）,女,吉林松原,硕士生,研究方向为信息安全,博弈理论。
基金资助:
国家自然科学基金(91438117,61309024)

Signaling Game Analysis and Simulation on Network Decoy Defense Strategies

Shi Leyi, Zhao Junnan, Li Qin, Wen Xiao, Liu Xin

College of Computer and Communication Engineering, China University of Petroleum, Qingdao 266580, China

Received:2014-07-01 Revised:2014-11-18 Online:2016-02-08 Published:2020-08-17

摘要/Abstract

摘要： 将网络诱骗攻防视作一种可观察行为的多阶段信令博弈,运用信令博弈理论分步骤构建了四种网络诱骗攻防博弈模型,即正常服务系统、服务/蜜罐混合系统、两种发送信令的服务/蜜罐混合系统以及三种行动/两种信令的服务/蜜罐混合系统。信令博弈模型中,服务方发送正常信令或蜜罐信令,而攻击者选择访问、判断访问或不访问。通过求解信令博弈模型的贝叶斯均衡策略及均衡条件,推理分析了网络诱骗防御策略的有效性及其约束条件。在此基础上,进一步采用博弈仿真工具Gambit对网络诱骗攻防信令博弈过程进行了仿真测试,验证了博弈理论分析贝叶斯均衡策略的存在性和正确性。

关键词: 信令博弈, 网络诱骗防御, 贝叶斯均衡, 仿真

Abstract: The network decoy confrontation is regarded as a kind of observable behavior of a multi-stage signaling game. Four types of gaming models for decoy confrontation process were constructed step by step using signaling game theory, i.e. the normal service, the mixed system of normal service and honeypot, the mixed system with two kinds of signaling, and the mixed system with two kinds of signaling and three actions. In these signaling game models, the server sent a normal signaling or honeypot signaling as the sender, while the attacker chose to access, give up or access in condition as the receiver. The effectiveness and the effectiveness conditions of the network decoy strategy were demonstrated through solving the Bayesian equilibrium strategies and analyzing the equilibrium conditions. Gambit as a game simulation tool was used to simulate the signaling game process of network decoy confrontation, and the existence of the Bayesian equilibrium, the correctness of the theoretical analysis were validated.

Key words: signaling game, network decoy defense, Bayesian equilibrium, simulation

中图分类号:

TP393

石乐义, 赵俊楠, 李芹, 温晓, 刘昕. 基于信令博弈的网络诱骗防御策略分析与仿真[J]. 系统仿真学报, 2016, 28(2): 348-353.

Shi Leyi, Zhao Junnan, Li Qin, Wen Xiao, Liu Xin. Signaling Game Analysis and Simulation on Network Decoy Defense Strategies[J]. Journal of System Simulation, 2016, 28(2): 348-353.

参考文献 15

[1]	贾珺, 战晓苏, 程文俊. 基于灰色关联分析的网络战综合能力评估[J]. 系统仿真学报, 2012, 24(6): 1185-1188.
[2]	Hayatle O, Otrok H, Youssef A.A Game Theoretic Investigation for High Interaction Honeypots[C]// Communications (ICC), 2012 IEEE International Conference on. USA: IEEE, 2012: 6662-6667.
[3]	Wagener G, Dulaunoy A, Engel T.Self Adaptive High Interaction Honeypots Driven by Game Theory[J]. Lecture Notes in Computer Science (S0302-9743), 2009, 5873(11): 741-755.
[4]	Pibil R, Lisy V, Kiekintveld C, et al.Game theoretic model of strategic honeypot selection in computer networks[M]// Decision and Game Theory for Security. Germany: Springer Berlin Heidelberg, 2012: 201-220.
[5]	Wei L, Wang X.Research on honeypot information fusion based on game theory[C]// Computer Research and Development, 2010 Second International Conference on. USA: IEEE, 2010: 803-806.
[6]	Li H, Yang X, Qu L.On the offense and defense game in the network honeypot[M]// Advances in Automation and Robotics, Germany: Springer Berlin Heidelberg. 2012, 2: 239-246.
[7]	Cai J, Yegneswaran V, Alfeld C.Honey games: a game theoretic approach to defending network monitors[J]. Journal of Combinatorial Optimization (S1382-6905), 2011, 22(8): 305-324.
[8]	Garg N, Grosu D.Deception in honeynets: A game-theoretic analysis[C]// Proceedings of IEEE Information Assurance and Security Workshop, New York, USA. USA: IEEE, 2007: 20-22.
[9]	Pauna A.Improved self adaptive honeypots capable of detecting rootkit malware[C]// Communications (COMM), 2012 9th International Conference on. USA: IEEE, 2012: 281-284.
[10]	李娟利. 基于博弈论的网络诱骗系统研究 [D]. 西安:西安建筑科技大学, 2006: 20-26.
[11]	王霄, 薛质, 王轶骏. 基于蜜罐的入侵检测系统的博弈分析与设计[J]. 信息安全与通信保密, 2007, 12(51): 94-95.
[12]	Carroll T E, Grosu D.A game theoretic investigation of deception in network security[J]. Security and Communication Networks (S1939-0114), 2011, 4(10): 1162-1172.
[13]	石乐义, 姜蓝蓝, 贾春福, 等. 蜜罐诱骗防御机理的博弈理论分析[J]. 电子与信息学报, 2012, 34(6): 1420-1425.
[14]	石乐义, 姜蓝蓝, 刘昕, 等. 拟态式蜜罐诱骗特性的博弈理论分析[J]. 电子与信息学报, 2013, 35(5): 1063-1068.
[15]	McKelvey R, McLennan A, Turocy T. Gambit: Software Tools for Game Theory v13.1.2 [EB/OL]. (2006-01-20) [2014-06-20]. http://www.gambit-project.org, 2014.