基于演化博弈的防火墙和入侵检测系统配置策略分析

Analysis of Configuration Strategy of Firewall and Intrusion Detection Systems Based on Evolutionary Game Theory

考虑信息安全技术特征,基于演化博弈论分析企业和黑客之间相互作用时的策略选择行为.结果表明:若只选择配置一种安全技术,当黑客期望利润、企业人工调查成本较低时或防火墙发生报警时,黑客放弃入侵必然发生;若在联动系统和仅配置一种安全技术中选择时,企业配置策略需比较联动系统和该技术的检测概率后进一步判断,黑客入侵策略则需分析联动系统或该技术检测概率的临界值.为减少入侵行为,需降低人工调查成本和黑客期望利润,提高入侵成本,加大对入侵行为的惩罚力度.

Considering the characteristics of information security technologies, the strategy selections of the interaction between the enterprises and hackers are analyzed based on evolutionary game theory. The results show that if the enterprise configures only one security technology, the intrusion is inevitably when the expected revenue of hackers is low, the manual investigation cost of enterprises is low, or the firewall is alarmed. If the enterprise selects to configure the linked system or only one security technology, the configuration strategy should compare the detection probability of the linked system with that of the technology, and the hacking strategy should analyze the critical value of the detection probability of the linked system or that of the technology. In order to attenuate the intrusion, the cost of manual investigation and the expected revenue of hackers should be reduced, the intrusion cost should be raised, and the punishment for intrusion should be increased.