基于博弈的蜜罐和入侵检测系统最优配置策略

Analysis on Optimal Configuration Strategies of Honeypot and Intrusion Detection Systems Based on Game Theory

根据网络攻防的工作量不对称、信息不对称和后果不对称,运用博弈理论与信息安全经济学,构建了蜜罐和入侵检测系统的信息安全技术组合模型。通过比较两种情况下公司和黑客博弈的纳什均衡混合策略,以及不同技术配置下人工调查概率的大小,探讨了入侵检测系统的检测概率和蜜罐个数对最优配置策略的影响,提出了配置两种技术时的预算范围,从而给出蜜罐和入侵检测系统技术组合的最优配置。最后,通过实例进一步验证了相关结论。

Focusing on workload asymmetry,information asymmetry,and consequences asymmetry between attackers and defenders,the model of information security technology combination of honeypot and intrusion detection systems（IDS）is constructed by using the game theory and economics of information security.The Nash equilibrium mixed strategies of the firm and hackers in two cases,and the manual investigation probabilities at different technical deployments are compared.The influence of the detection probability of the IDS and the number of honeypots on the optimal configuration strategy is discussed.Then,the range of configuration budget when deploying two technologies is proposed.Thus the optimal configuration strategy of the combination of honeypot and IDS is made.Finally,the relative conclusion is illustrated further by an example.