Optimal Network Defense Strategy Selection Method Based on Evolutionary Network Game

Liu, Xiaohu; Zhang, Hengwei; Zhang, Yuchen; Shao, Lulu

doi:https://doi.org/10.1155/2020/5381495

Security and Communication Networks

On this page

Abstract Introduction Results Conclusion Data Availability Conflicts of Interest Authors’ Contributions Acknowledgments References Copyright Related Articles

Research Article | Open Access

Volume 2020 | Article ID 5381495 | https://doi.org/10.1155/2020/5381495

Optimal Network Defense Strategy Selection Method Based on Evolutionary Network Game

Xiaohu Liu,^1,2Hengwei Zhang ,^1,2Yuchen Zhang,^1,2and Lulu Shao¹

Academic Editor: Clemente Galdi

Received24 Feb 2020

Revised09 Oct 2020

Accepted17 Oct 2020

Published28 Oct 2020

Abstract

The basic hypothesis of evolutionary game theory is that the players in the game possess limited rationality. The interactive behavior of players can be described by a learning mechanism that has theoretical advantages in modeling the network security problem in a real society. The current network security evolutionary game model generally adopts a replicator dynamic learning mechanism and assumes that the interaction between players in the group conforms to the characteristics of uniform mixed distribution. However, in an actual network attack and defense scenario, the players in the game have limited learning capability and can only interact with others within a limited range. To address this, we improved the learning mechanism based on the network topology, established the learning object set based on the learning range of the players, used the Fermi function to calculate the transition probability to the learning object strategy, and employed random noise to describe the degree of irrational influence in the learning process. On this basis, we built an attack and defense evolutionary network game model, analyzed the evolutionary process of attack and defense strategy, solved the evolution equilibrium, and designed a defense strategy selection algorithm. The effectiveness of the model and method is verified by conducting simulation experiments for the transition probability of the players and the evolutionary process of the defense group strategy.

1. Introduction

Today, the trends in network attack and defense exhibit an increasingly sharp conflict, increasingly complex confrontation scenarios, and rapid development of technical methods, and as the attacks on networks become increasingly automatic and intelligent, they are also becoming increasingly sustained and dynamic. Static defense strategies based on specific rules and attack signature matching can no longer effectively cope with frequent and multiple attacks on the network. Network security is dynamic rather than static, and therefore the defense strategy should evolve dynamically with the advancement of the attack and defense process, and the return should be maximized for the given constraints of people, time, the changing situation, resources, capabilities, and preferences [1]. Network security is relative rather than absolute, and a key factor in an effective defense measure is to minimize the expected security loss for different attack scenarios and defense strategies.

In a traditional network defense decision-making process, most of the comparison and analysis are from the perspective of the defender. The optimal defense strategy is obtained collectively, with little consideration given to the effects of the attacker’s strategy and with insufficient understanding of the antagonistic relationship between the attacker and the defender of the network [2]. In fact, the essence of cybersecurity is confrontation, and the attack and defense strategies are mutually constrained and mutually influential. The selection of a defense strategy should be studied from the perspective of attack and defender confrontation. Game theory is a theoretical tool for studying the interdependence and competition among decision-making subjects. In the real world, game theory matches up well with network attack and defense in terms of the essential characteristics of target opposition, strategy dependence, and noncooperative relationship. It has been applied by some researchers to network attack and defense behavior analysis and strategy selection [3–8]. In the modeling and analysis of network attack and defense based on classical game theory, there are four possible categories according to the game information set and action sequence: complete information static game, complete information dynamic game, incomplete information static game, and incomplete information dynamic game. Classical game theory generally assumes that the players in the game are completely rational, have unlimited information processing and computing power, and will not make mistakes or be influenced by others in the decision-making process. However, in the real world, this assumption is difficult to sustain, particularly because both the attack and defense players have limited rather than complete rationality. This would weaken the theoretical value and the guiding effect of the classical game model. It is therefore necessary to construct an effective game model and analysis method for the attack and defense sides that takes into account the characteristics of limited rationality.

Drawing on the idea of biological evolution, ecologists Maynard Smith and Price proposed in 1973 the concept of evolutionary stable equilibrium. In 1978, Taylor and Jonker discovered the relationship between evolutionary equilibrium and replicator dynamics, which yielded evolutionary game theory [9]. They studied the dynamic evolution of the group, overcame the restriction of complete rationality, and made game equilibrium the result of gradual optimization in the learning process of the player. This has led to a more accurate description of the evolutionary process of the group strategy. In the evolutionary game process, which is driven by the learning mechanism and the difference of game return, the dominant strategy will gradually spread among the players before finally forming the Evolutionary Stable Strategy (ESS). Some researchers have proposed a defense strategy modeling analysis method based on evolutionary game to explore the evolution of both strategies in the process of attacker and defender confrontation, as in [10–15]. Learning mechanism is the core of the evolutionary game model, and it is also the essential feature that distinguishes it from the classical game model. At present, the replicator dynamic learning mechanism is widely used in the field of network security research. The basic principle is that the player achieves evolution by constantly imitating high-return strategies. For example, an attack-defense evolutionary game model was established and an evolutionary stable equilibrium algorithm was proposed in [16] using the replicator dynamic learning mechanism to describe the rate of change of the number of players in the group who choose a specific strategy. The work in [17] focused on the advanced persistent threat (APT) attack and defense problem in cloud storage environments and established an APT attack and defense evolutionary game model using a replicative dynamic learning mechanism. The evolutionary process of the attack and defense strategies in the continuous confrontation process was also analyzed. Reference [18] took aim at the security problems faced by intelligent networks and proposed a network attack and defense framework based on an evolutionary game model using a replicative dynamic learning mechanism and also investigated how to maximize defense return with limited node resources. The network security and defense issues for the Internet of Things were investigated in [19], a multistage evolutionary game model was established, the replicator dynamic learning mechanism was used to describe the evolutionary behavior of attack and defense, and the optimal defense strategy was obtained through dynamic analysis of the evolution process. In [20], the replicator dynamic learning mechanism was improved by introducing an excitation coefficient, by perfecting the replicator dynamic rate calculation method, and by proposing an evolutionary game strategy selection method based on improved replicator dynamics. In [21], a Bayesian evolutionary game model of attack and defense was established. The influence of irrationality in the player’s strategy selection process was modeled by choosing an intensity factor, thereby improving the replicator dynamic learning mechanism. However, the above models all assumed that the players could interact through uniform mixture and complete contact; that is, each player was fully capable of learning and could learn from any individual in the group. Because this assumption did not conform to the reality of network attack and defense, it has jeopardized the guiding value of the model.

This paper offers three main contributions. (1) It improved the learning mechanism in the network attack and defense evolution game based on topological structure of the network, established the learning object set according to the learning ability of the players, and overcame the assumption that players in the group mix and interact uniformly in accordance with the objective reality that players in the attack and defense group have limited learning capability. (2) It calculated the strategy transfer probability of players to the learning object using the Fermi function, depicted the influence of irrationality in the learning process using random noise, and reflected the process of transitioning toward a dominant strategy and successive optimization of the players in the attack-defense confrontation. (3) It analyzed the specific process of solving for equilibrium in the evolutionary network game, designed a defense strategy selection algorithm, and provided an optimal defense strategy selection method.

2. Evolutionary Network Game Process Analysis and Learning Mechanism Design

2.1. Analysis of Evolutionary Network Game Process

Network security is a dynamic process in which the attack and defense players interact with and influence each other. The state of the network is determined jointly by the strategy of both the attack and the defense. As members of the groups, the attackers and defenders usually do not exist in isolation, but are related to each other in some form of social relationship, forming an attack group and a defense group within a certain network topology. In the process of the continuous dynamic game between the attack and defense groups, driven by the learning mechanism and influenced by the difference of game return, the players in the game continuously learn from other players in the group, continually lowering the probability of choosing a strategy of low return and increasing the probability of choosing a strategy of high return. This causes the dominant strategy to gradually spread in the group until reaching equilibrium.

In actual network attack and defense, due to restrictions such as resources, capabilities, and preferences, the interaction range and learning ability of the players are usually limited; they can usually only learn from a few players nearby. To address this shortcoming, we set out in this paper to improve the learning mechanism based on network topology, in which we regard the individual players as nodes in a social network. The connections between the players are treated as network connections. On this basis, we adopted an evolutionary network game on which to model the attack and defense scenarios, to design the defense strategy selection algorithm, and to analyze the dynamic evolutionary process of attack and defense strategies that spread and stabilize in group confrontations.

Definition 1. (learning object node). A learning object node is where a player in the game can interact with and transfer the strategy according to a specific probability within the scope of that player’s learning capability. Collectively, the learning object nodes constitute a player’s learning object set. In a social network, the average distance between players is 6 [22]. In this paper, the learning range of a player in the game is defined as 3, and the learning object set are the nodes whose distance from the player’s node network is less than or equal to 3.
The learning behavior of players’ nodes in the game can lead to adjustment and optimization of the strategy, which will lead to evolution of the state of the network’s attack and defense system. The evolution of the system state will change the attack and defense returns, which will further affect the learning behavior of the players. Under normal circumstances, because the players are less than fully rational, the system cannot achieve a stable equilibrium state through just one learning behavior, but instead promotes continuous learning and gradual evolution with time until the group strategy converges to the evolutionary stable strategy. The evolutionary dynamics process is shown in Figure 1.

2.2. Evolutionary Learning Mechanism Design

Learning is the intrinsic motivation of group evolution. In the current studies of network attack and defense evolution game research, the replicator dynamic learning mechanism is the most widely used, and its core is the replicator dynamic equation [23]. This equation is used to calculate the rate of change over time of the probability that a particular strategy i is selected in a population:where indicates the probability that the group selects strategy i at time t; indicates the return that the player selects strategy i at time t; and indicates the average return that the player in the group selects different strategies.

Because the replicator dynamic learning mechanism assumes that there is no difference in the probability of interactive learning between individuals, it is particularly suitable for population evolution with uniform mixed interaction characteristics. However, whether it is an attack group or a defense group, the learning ability and resources of the players are always limited, and it is impossible to make indiscriminate interactions with all the players in the group.

Further, the decisions of the players have certain random and irrational characteristics. Therefore, there are some limitations in describing the evolution process of attack and defense groups using the replicator dynamic learning mechanism.

In the analysis given in Section 2.1, when a player is assumed to only interact with the learning object node and to transfer its strategy to the superior strategy with a certain probability after comparing the returns, the learning process is consistent with the idea of “pairing comparison” of the Fermi function. Therefore, the replicator dynamic learning mechanism can be improved on the basis of the learning object set. Assuming that player node y is the learning object node of player node x, then the probability that node x strategy is transferred to node y strategy can be obtained from Fermi function:where and represent the returns of node x and node y, respectively, and is a random noise coefficient, with > 0.

In the evolutionary network game of network attack and defense, players tend to choose high-yield strategies. The players’ preference and sensitivity to the profit margin is an important manifestation of its irrational characteristics. In this paper, random noise coefficient is used to describe it. The random noise coefficient mainly describes the scene where the player’s irrational characteristics are mainly affected by his preference and sensitivity to the difference of returns.

In the actual network attack and defense scenario, different values of random noise coefficient can be set according to the irrational characteristics of players. The bigger the is, the stronger the irrationality of the player is. When , , and it indicates that node x strategy is transferred to node y strategy in a completely random manner. When , it means that the evolutionary network game has evolved into a completely rational game, and there is no learning mechanism.

If , then , and it indicates that node x selects the node y strategy with a probability of 0.5. If , then , and gradually approaches 0 as increases, indicating that the probability that node x adopts the node y strategy diminishes. If , then and gradually approaches 1 as increases, indicating that the probability that node x adopts the node y strategy is becoming greater.

The transition probability for the player node strategy to transition to the learning object node is closely related to the return and is affected by the degree of irrationality. It is consistent with the evolution process of gradual upgrade from a low-return strategy to a high-return strategy in the attack and defense confrontation, and it can depict the evolution mechanism of group strategy.

3. Construction of Evolutionary Network Game Model

From the macro time scale level, the long-term sustained learning behavior of the player node will lead to topological changes in the group network. However, from the micro time scale level, the topological structure of the group network can be regarded as static. Micro time scale is a relative concept. In this paper, micro time scale only refers to the specific time point in which players are learning. At the specific time point, the network topology is assumed to be static, and the player uses Fermi function to calculate the strategy transition probability. Therefore, we can direct our attention to the impact of the learning mechanism on the evolution of attack and defense group strategies.

Definition 2. The evolutionary network game model is represented by five elements: .(1) is the player space of the game, and represent the attack group and the defense group, respectively, in the evolutionary network game, and both groups contain multiple player nodes.(2) is the strategic space, where and represent the attack strategy and the defense strategy, respectively. Each player in the attack and defense group has multiple optional strategies. represents a set of m attack strategies, and represents a set of n defense strategies with m, n ∈ N and m, n ≥ 2.(3) is the persuasion space. indicates the attacker’s persuasion, which is used to describe the probability that a player in the attack group chooses different strategies. is the defender’s persuasion, which is used to describe the probability that a player in the defense group chooses different strategies. The persuasion space corresponds to the strategy space, the attacker persuasion set is with , and the defense group persuasion set is with .(4) is the random noise figure, indicating the degree of irrationality of the player, corresponding to in the Fermi function. In the process of evolutionary game, the higher the irrationality of the players, the stronger the randomness of the strategy selection. It is difficult to determine the irrationality of a particular individual, and it can only be determined that it belongs to a different range. Therefore, in this paper, from the perspective of groups, describes the average irrationality of players in a group.(5) is the return space. and represent the attacker’s return and the defender’s return, respectively. In the evolutionary network game model, the returns are influenced by both the attack strategies and the defense strategies and appear in the form of a combination of returns. For example, indicates the attacker’s return and the defender’s return when the attacker adopts strategy and the defender adopts strategy .The evolutionary network game tree defined above is shown in Figure 2.

4. Solution of Evolutionary Network Game Equilibrium and Design of Defense Strategy Selection Algorithm

4.1. Evolutionary Network Game Equilibrium Solution

Before solving for the evolutionary network game equilibrium, it is necessary to first provide the strategy options for the player node. To facilitate theoretical derivation and analysis, we simplify the number of attack and defense strategies without jeopardizing generality. The strategy options open to the player nodes in the attack group are the enhanced attack strategy and the common attack strategy, designated as . Strategy options open to the player nodes in the defense group are the enhanced defense strategy and the common defense strategy, designated as .

4.1.1. Calculation of Returns

The basis for quantitative calculation and game analysis is the quantification of the player node return. For the player node to implement network attack and defense operations according to the antagonistic strategy, it takes labor, material resources, calculations, and other costs, but at the same time it also produces corresponding security return with economic ramifications. For the defender, the choices of a defense strategy must strike a balance between cost and return in order to achieve a global optimum. Table 1 shows the symbols relevant to the definitions and the descriptions. For detailed calculation methods, see [19].

The loss that was avoided due to defense strategy is counted as a defense reward DR, represented by the defense loss DL, in a positive value. In order to quantify and calculate the attack and defense return on the same scale, it is set that there is a functional relationship between the attack reward AR and the defense loss DL, which is recorded as follows:

Considering the two aspects of cost and return, the return of the attack and defense player nodes may be expressed by equations (4) and (5), respectively.

Definition 3. (strategy density). Strategy density is the ratio of the number of player nodes in a group that selects a particular strategy to the total number of player nodes in the group. From the individual perspective, the player node selects a particular strategy according to its persuasion. From the group perspective, a large number of players selecting a strategy counts as the strategy density. Hence, the evolutionary state of the group is related to the change in strategy density over time.
According to the definition, let the strategy density for player nodes selecting strategy be p:where n is the number of player nodes that select strategy , and N is the total number of player nodes in the defense group. According to the mean field approximation theory, any defense player node will select a strategy according to the strategy density. Therefore, the persuasion for selecting strategy is p, and the persuasion for selecting strategy is 1−p.
Similarly, we assume that the strategy density for an attack player node to select strategy is q:where m is the number of player nodes that select strategy , and M is the total number of player nodes in the attack group. According to the mean field approximation theory, any player node in the attack group would select strategies according to the strategy density. Hence, the persuasion for selecting strategy is q and the persuasion for selecting strategy is 1–q.
The return of the player node in the game is determined jointly by the attack and defense strategies. The player node in the attack group and the player node in the defense group each has two types of optional strategies. The attack and defense game tree is shown in Figure 3.
For the player node in the defense group, the expected return for selecting strategy is . For the player node in the attack group, the expected return for selecting strategy is .

Definition 4. (trend node). The trend node is a virtual node that represents the overall trend and direction of the evolution of the attack and defense groups. The return of the trend node is the expected return under different strategic density combinations of the attack and defense groups, and it changes dynamically with the evolution of the group strategy.
The return of trend node in the attack group isThe return of trend node in the defense group is

4.1.2. Equilibrium Solution

The learning behavior of the player node leads to dynamic changes in the group strategy density with time, and its dynamic rate of change may be used to characterize the evolution state of the group. By taking time derivatives of the strategy density p of and strategy density q of , we define an evolution equation of the attack and defense groups and form the simultaneous equations shown in the following equation:

In order to solve the equations, we introduce an auxiliary function tanhz:

Let , then equation (11) can be converted to

By combining equations (10) and (12), we have

When the rate of change of strategy density in the attack and defense group is zero, the game process reaches a state of evolutionary equilibrium [24]. At this point, the equations satisfy the following condition:

Calculations show that there are five sets of solutions for equation (14), and there may be five corresponding evolutionary equilibrium points.(1), indicating that the player node in the defense group selects pure strategy , the player node in the attack group selects pure strategy .(2), indicating that all the player nodes in the defense group adopt pure strategy , the player node in the attack group adopts pure strategy .(3), indicating that all player nodes in the defense group select pure strategy , the attack group adopts pure strategy .(4), indicating that all player nodes of the defense group select pure strategy , the attack group adopts pure strategy.(5), indicating that the strategy transition probabilities and from player node in the attack and defense group to the trend node are equal to the strategy transition probabilities and from the trend node to the player node and that the group evolution enters a dynamic equilibrium state. Solve for F₅ with MATLAB R2018A and obtain and , designated as and , respectively.

According to the evolutionary game theory, , , , and are saddle points, and F₅ is a central point. The evolutionary network game model is based on a strategy of evolutionary stability. By combining the initial states of different attack and defense groups, this method can be used to predict the possible attack strategy used by the attacker and to guide the defender in selecting the defense strategy.

4.2. Design of Defense Strategy Selection Algorithm

Based on the evolutionary network game equilibrium solution discussed in Section 4.1, a defense strategy selection algorithm is designed, as shown in Table 2.

If the number of optional strategies of the attacker is m, and the number of optional strategies of the defender is n. The time complexity of the algorithm mainly focuses on the revenue comparison of different attack and defense strategies. The time complexity of the defense strategy selection algorithm is . The space complexity of the algorithm mainly focuses on the storage of the profit value and the intermediate results of equilibrium solution. The space complexity of the defense strategy selection algorithm is . The comparison shows that the time complexity and space complexity of the algorithm are in the same order of magnitude as those in the related literature [20, 21].

The analysis shows that the more the number of attack and defense strategies, the higher the time complexity and space complexity of defense decision algorithm. Therefore, in practical application, the attack and defense strategies can be classified to reduce the number of attack and defense strategies and improve the algorithm solving speed.

4.3. Comparison of Research Results

In this section, we analyze and compare the results of this paper with those of other relevant studies in terms of five aspects: learning range, learning mechanism, random interference, detailed process, and application scenarios of the solution process. The comparison results are shown in Table 3.

Of the five aspects, the range of learning mainly examines whether the interactive objects in the model are all the players or the learning object set. The learning mechanism reflects the mechanism used by the model to describe the learning behavior of the players in the game. The random interference mainly examines whether the model takes into account the irrationality of the players in the game. The ESS solution process primarily investigates the degree of detail of the evolutionary equilibrium solution process. The more detailed the solution process, the greater the guiding effect on the practice. The application scenario is mainly distinguished according to the application object of the model. Most of the studies do not consider the topology of the group network and assume that the players in the group can interact with the whole group in a uniform and mixed manner. The learning and emulating behaviors of players are described using the replicator dynamic learning mechanism without considering the limitations on player learning ability. As a result, the influence of random interference in the selection process of the players is not taken into account. Moreover, since the ESS solution is relatively simple, it can only provide limited practical guidance for selecting ae defense strategy. The comparison shows that the security game model based on the evolutionary game network is more in line with the actual network attack and defense and can provide valuable practical guidance.

5. Analysis of Simulation Experiments and Results

In order to confirm the validity of the model and method, we conducted simulation experiments on the strategy transition probability of the players and the evolution process of the defense group strategy. The simulation experiment of the strategy transfer probability of the players was used to verify whether the learning mechanism in the model conforms to the reality of network attack and defense and to analyze the relationship between the strategy transfer probability W and the random noise coefficient of the player. The simulation experiment on the defense group strategy evolution process was used to study the relationship between the dynamic change in the group strategy and the strategy density of the attack and defense groups. The analysis provides an understanding of the behavior of dynamic evolution, diffusion, and stability of the defense group strategy for different initial conditions.

5.1. Simulation Experiment of Player Strategy Transfer Probability

Based on network topology, the evolutionary network game model improves the learning mechanism. The player node uses the Fermi function to calculate the strategy transition probability to the learning object node, and the parameters involved are the player node gain and the random noise coefficient. Therefore, the interval for and of the simulation experiments is set to (0, 10) and the random noise coefficient of the players is, respectively, 0.1, 0.5, 1, and 5. The strategy transition probability from node x to learning object node y as U_x and U_y changes is plotted in Figure 4 with MATLAB R2018 A software for four different values of .

(a)

(b)

(c)

(d)

Figure 4 contains four subgraphs of (a), (b), (c), and d, which shows the change in the strategy transition probability W for values of 0.1, 0.5, 1, and 5 as U_x and U_y change.

By analyzing the common trend of the four subgraphs, we arrived at the following conclusion on the relationship between W and the relative value of the player return: the smaller U_x is than U_y, the greater is W, and the greater U_x is than U_y, the smaller is W. The results of the simulation experiments are consistent with the actual evolution law of the network attack and defense confrontation in that the players transition from a low-return strategy to a high-return strategy.

After comparing the trends of the four subgraphs, we arrived at the following conclusion on the relationship between W and the random noise coefficient . The higher the value of , the closer the value of W to 0.5 and the smaller the fluctuation, indicating a higher randomness of the strategic transfer of the player node. The simulation results are consistent with the irrational random selection of the attack and defense cyber confrontation.

In the simulation experiments on the strategic transfer probability of the player node in the game, the learning mechanism was found to be consistent with the actual evolutionary behavior of the network attack and defense, which verified the correctness and effectiveness of the learning mechanism in the evolutionary network game model.

5.2. Simulation Experiments on Defense Group Strategy Evolution Process

Due to the confrontational nature of network attack and defense, the process of strategy evolution of the defense group is affected by both the attack and defense strategies. In order to analyze the strategy evolution of the defense group, we investigated the relationship between the rate of change dp/dt of the defense group strategy density and the defense group strategy density p and the attack group strategy density q and carried out the simulation experiment of the defense group strategy evolution process.

According to experts’ experience and historical data and [19, 20], we assigned values to the attack return and the defense return involved in the attack and defense game tree in Figure 3, as shown in Table 4.

Based on the values of the attack and defense return and the evolutionary network game equilibrium solution F_s, we obtained p = 0.7 and q = 0.6. In the simulation experiment, the values of p and q were set to the interval of (0, 1), and the change interval was 0.025. A total of 1,600 different combinations of p and q can be simulated. MATLAB R2018A software was used to simulate the rate of change dp/dt of the defense group strategy density with the changes of p and q, as shown in Figure 5.

(a)

(b)

Figure 5 shows a three-dimensional view of dp/dt with respect to p and q. For the convenience of observation and analysis, (a) and (b) represent two different side views of the three-dimensional map, respectively. The defense group strategy density p and the attack group strategy density q combined to form the initial state (p, q) of the game model. According to the relationship between (p, q) and (p, q), the evolution process of the defense group strategy can be divided into four cases:

Case 1. p < p and q < q, then dp/dt > 0 at this time. This shows that in the continuous confrontational evolution, the probability of selecting strategy by players in the defense group becomes higher and higher, and the probability of selecting strategy becomes lower and lower, and the process gradually converges to p = p. At the same time, as p gradually increases, the value of dp/dt gradually increases, indicating that the rate at which p increases becomes faster and faster.

Case 2. p < p and q > q, then dp/dt > 0 at this time. This shows that in the continuous confrontational evolution, the probability of selecting strategy by players in the defense group becomes higher and higher, the probability of selecting strategy becomes lower and lower, and the process gradually converges to p = p. At the same time, as p gradually increases, the value of dp/dt gradually decreases, indicating that the rate at which p increases becomes slower and slower.

Case 3. p > p and q < q, and dp/dt < 0 at this time. This shows that in the continuous confrontational evolution, the probability of selecting strategy by players in the defense group becomes lower and lower, the probability of selecting strategy becomes higher and higher, and the process gradually converges to p = p. At the same time, as p gradually decreases, the value of dp/dt gradually decreases, indicating that the rate at which p decreases becomes slower and slower.

Case 4. p > p and q > q, and dp/dt < 0 at this time. This shows that in the continuous confrontational evolution, the probability of selecting strategy by players in the defense group becomes lower and lower, the probability of selecting strategy becomes higher and higher, and the process gradually converges to p = p. At the same time, as p gradually decreases, the value of dp/dt gradually increases, indicating that the rate at which p decreases becomes faster and faster.
Through the simulation experiments and analysis of the results, we gained an understanding of the evolutionary process of the group strategy of the defense group. The evolutionary process of the defense group strategy is closely related to the game return and is affected by the initial state of the probability density of the attack and defense group strategies. It is therefore necessary to study the selection of defense strategy from the perspective of attack and defense confrontation and to determine the optimal defense strategy through evolutionary network game analysis.

6. Conclusion

Both the network attacker and the network defender are people of limited rationality. In the study of network attack and defense based on game theory, one must overcome the assumption of traditional game theory that people are completely rational. The evolutionary game theory breaks through the constraint that people are completely rational in the game and regards the game equilibrium as the result of the gradual optimization of the players’ learning and evolution in the game. The simulation experiment of the strategy transfer probability of the player in the game verified the effectiveness of the learning mechanism. The simulation experiment of the strategy evolution process of the defense group provided the evolutional behavior of the strategy of the defense group for different attack and defense strategy densities. The model can describe the process of dynamic evolution and more accurately depict the diffusion and equilibrium process in the group confrontation. The modeling and analysis results are closer to the essence of the network attack and defense, can more realistically explain and predict the network attack and defense behavior, and guide the defense practice.

Data Availability

The data used to support the findings of this study are available from the corresponding author upon request.

Conflicts of Interest

The authors declare that they have no conflicts of interest regarding the publication of this paper.

Authors’ Contributions

Xiaohu Liu and Hengwei Zhang contributed equally to this work.

Acknowledgments

This work was supported by the Henan Science and Technology Research Project (Nos. 182102210144 and 192102210293).

References

J. Lv and C. Zhao, “Security analysis of online digital goods business based on stochastic game net model,” Security and Communication Networks, vol. 9, no. 7, pp. 587–598, 2016.
View at: Publisher Site | Google Scholar
S. Huang, H. Zhang, J. Wang, and J. Huang, “Markov differential game for network defense decision-making method,” IEEE Access, vol. 6, pp. 39621–39634, 2018.
View at: Publisher Site | Google Scholar
H. Zhang, L. Jiang, S. Huang, J. Wang, and Y. Zhang, “Attack-defense differential game model for network defense strategy selection,” IEEE Access, vol. 7, pp. 50618–50629, 2019.
View at: Publisher Site | Google Scholar
Q. D. La, T. Q. S. Quek, J. Lee, S. Jin, and H. Zhu, “Deceptive attack and defense game in honeypot-enabled networks for the Internet of Things,” IEEE Internet of Things Journal, vol. 3, no. 6, pp. 1025–1035, 2016.
View at: Publisher Site | Google Scholar
K. Wang, M. Du, D. Yang, C. Zhu, J. Shen, and Y. Zhang, “Game-theory-based active defense for intrusion detection in cyber-physical embedded systems,” ACM Transactions on Embedded Computing Systems, vol. 16, no. 1, pp. 1–21, 2016.
View at: Publisher Site | Google Scholar
C. T. Do, N. H. Tran, C. Hong et al., “Game theory for cyber security and privacy,” ACM Computing Surveys, vol. 50, no. 2, pp. 1–37, 2017.
View at: Publisher Site | Google Scholar
S. Yang, Y. Zhang, and C. Wu, “Attack-defense quantification based on game-theory,” 2019, https://arxiv.org/abs/1902.10439.
View at: Google Scholar
S. Yang and X. Wei, “Research on optimization model of network attack-defense game,” in Proceedings of the 2017 8th IEEE International Conference on Software Engineering and Service Science (ICSESS), pp. 426–429, Beijing, China, November 2017.
View at: Publisher Site | Google Scholar
J. M. McNamara and F. J. Weissing, Evolutionary Game Theory, Springer, Berlin, Germany, 2010.
F. Saab, A. Kayssi, I. Elhajj, and A. Chehab, “Solving sybil attacks using evolutionary game theory,” in Proceedings of the 31st Annual ACM Symposium on Applied Computing–SAC’16, Pisa, Italy, 2016.
View at: Publisher Site | Google Scholar
M. A. Al-Jaoufi, Y. Liu, and Z. Zhang, “An active defense model with low power consumption and deviation for wireless sensor networks utilizing evolutionary game theory,” Energies, vol. 11, no. 5, 2018.
View at: Publisher Site | Google Scholar
D. Tosh, S. Sengupta, C. A. Kamhoua, and K. A. Kwiat, “Establishing evolutionary game models for Cyber security information EXchange (CYBEX),” Journal of Computer and System Sciences, vol. 98, pp. 27–52, 2018.
View at: Publisher Site | Google Scholar
S. Arora, P. Singh, and A. Gupta, “Adaptive selection of cryptographic protocols in wireless sensor networks using evolutionary game theory,” Procedia Computer Science, vol. 78, pp. 358–366, 2016.
View at: Publisher Site | Google Scholar
N. Ruan, L. Gao, H. Zhu, W. Jia, X. Li, and Q. Hu, “Toward optimal DoS-resistant authentication in crowdsensing networks via evolutionary game,” in Proceedings of the 2016 IEEE 36th International Conference on Distributed Computing Systems (ICDCS), pp. 364–373, Nara, Japan, June 2016.
View at: Publisher Site | Google Scholar
J.-m. Huang, J.-d. Wang, H.-w. Zhang, and N. Wang, “Network defense strategy selection based on best-response dynamic evolutionary game model,” in Proceedings of the 2017 IEEE 2nd Advanced Information Technology, Electronic and Automation Control Conference (IAEAC), pp. 2611–2615, Chongqing, China, March 2017.
View at: Publisher Site | Google Scholar
J. Huang, H. Zhang, J. Wang et al., “Defense strategies selection based on attack-defense evolutionary game model,” Journal on Communications, vol. 38, no. 1, pp. 168–176, 2017.
View at: Publisher Site | Google Scholar
A. A. Abass, L. Xiao, N. B. Mandayam, and Z. Gajic, “Evolutionary game theoretic analysis of advanced persistent threats against cloud storage,” IEEE Access, vol. 5, pp. 8482–8491, 2017.
View at: Publisher Site | Google Scholar
S. Boudko and H. Abie, “An evolutionary game for integrity attacks and defences for advanced metering infrastructure,” in Proceedings of the 12th European Conference on Software Architecture Companion Proceedings–ECSA’18, New York, NY, USA, 2018.
View at: Publisher Site | Google Scholar
Y. Yang, B. Che, Y. Zeng, Y. Cheng, and C. Li, “MAIAD: a multistage asymmetric information attack and defense model based on evolutionary game theory,” Symmetry, vol. 11, no. 2, p. 215, 2019.
View at: Publisher Site | Google Scholar
J. Huang and H. Zhang, “Improving replicator dynamic evolutionary game model for selecting optimal defense strategies,” Journal on Communications, vol. 39, no. 1, pp. 1–13, 2018.
View at: Publisher Site | Google Scholar
H. Hu, Y. Liu, H. Zhang, and R. Pan, “Optimal network defense strategy selection based on incomplete information evolutionary game,” IEEE Access, vol. 6, pp. 29806–29821, 2018.
View at: Publisher Site | Google Scholar
D. J. Watts, “Six degrees: the science of a connected age,” Complicity: An International Journal of Complexity and Education, vol. 2, 2003.
View at: Publisher Site | Google Scholar
J. Hofbauer and K. Sigmund, “Evolutionary game dynamics,” Proceedings of the Applied Mathematics, vol. 69, 2011.
View at: Publisher Site | Google Scholar
D. Fudenberg and J. . W. Weibull, Evolutionary Game Theory, Springer, Berlin, Germany, 1994.

Copyright

Copyright © 2020 Xiaohu Liu et al. This is an open access article distributed under the Creative Commons Attribution License, which permits unrestricted use, distribution, and reproduction in any medium, provided the original work is properly cited.

PDF Download Citation

Download other formats

Order printed copies