An Active Deception Defense Model Based on Address Mutation and Fingerprint Camouflage

The static and predictable characteristics of cyber systems give attackers an asymmetric advantage in gathering useful information and launching attacks.To reverse this asymmetric advantage,a new defense idea,called Moving Target Defense(MTD),has been proposed to provide additional selectable measures to complement traditional defense.However,MTD is unable to defeat the sophisticated attacker with fingerprint tracking ability.To overcome this limitation,we go one step beyond and show that the combination of MTD and Deception-based Cyber Defense(DCD)can achieve higher performance than either of them.In particular,we first introduce and formalize a novel attacker model named Scan and Foothold Attack(SFA)based on cyber kill chain.Afterwards,we develop probabilistic models for SFA defenses to provide a deeper analysis of the theoretical effect under different defense strategies.These models quantify attack success probability and the probability that the attacker will be deceived under various conditions,such as the size of address space,and the number of hosts,attack analysis time.Finally,the experimental results show that the actual defense effect of each strategy almost perfectly follows its probabilistic model.Also,the defense strategy of combining address mutation and fingerprint camouflage can achieve a better defense effect than the single address mutation.

Moving target defense of routing randomization with deep reinforcement learning against eavesdropping attack

Eavesdropping attacks have become one of the most common attacks on networks because of their easy implementation. Eavesdropping attacks not only lead to transmission data leakage but also develop into other more harmful attacks. Routing randomization is a relevant research direction for moving target defense, which has been proven to be an effective method to resist eavesdropping attacks. To counter eavesdropping attacks, in this study, we analyzed the existing routing randomization methods and found that their security and usability need to be further improved. According to the characteristics of eavesdropping attacks, which are “latent and transferable”, a routing randomization defense method based on deep reinforcement learning is proposed. The proposed method realizes routing randomization on packet-level granularity using programmable switches. To improve the security and quality of service of legitimate services in networks, we use the deep deterministic policy gradient to generate random routing schemes with support from powerful network state awareness. In-band network telemetry provides real-time, accurate, and comprehensive network state awareness for the proposed method. Various experiments show that compared with other typical routing randomization defense methods, the proposed method has obvious advantages in security and usability against eavesdropping attacks.

Choosing between a rock and a hard place： Camouflage in the round-tailed horned lizard Phrynosoma modestum

The round-tailed homed lizard Phrynosoma modestum is cryptically colored and resembles a small stone when it draws legs close to its body and elevates its back. We investigated effectiveness of camouflage in P. modestum and its dependence on stones by placing a lizard in one of two microhabitats （uniform sand or sand with surface rocks approximately the same size as lizards）. An observer who knew which microhabitat contained the lizard was asked to locate the lizard visually. Latency to detec- tion was longer and probability of no detection within 60 s was higher for lizards on rock background than on bare sand. In arenas where lizards could choose to occupy rock or bare sand, much higher proportions selected rocky backgrounds throughout the day; at night all lizards slept among stones. A unique posture gives P modestum a rounded appearance similar to many natural stones. Lizards occasionally adopted the posture, but none did so in response to a nearby experimenter. Stimuli that elicit the posture are unknown. That P. modestum is better camouflaged among rocks than on bare sand and prefers to occupy rocky areas suggests that special resemblance to rocks （masquerade） enhances camouflage attributable to coloration and immobility.

基于深度强化学习的舰船导弹目标分配方法

针对对抗环境下的海上舰船防空反导导弹目标分配问题,本文提出了一种融合注意力机制的深度强化学习算法.首先,构建了舰船多类型导弹目标分配模型,并结合目标多波次拦截特点将问题建模为马尔可夫决策过程.接着,基于编码器–解码器框架搭建强化学习策略网络,融合多头注意力机制对目标进行编码,并在解码中结合整体目标和单个目标编码信息实现舰船可靠的导弹目标分配.最后,对导弹目标分配收益、分配时效以及策略网络训练过程进行了仿真实验.实验结果表明,本文方法能生成高收益的导弹目标分配方案,相较于对比算法的大规模决策计算速度提高10%~94%,同时其策略网络能够快速稳定收敛.

基于深度强化学习的防空反导智能任务分配

随着作战双方不断采用新技术,信息时代的战争呈现出强博弈对抗性。在分析防空反导任务分配过程和决策的本质基础上,从敌我两个角度深入探讨了强博弈对抗环境下防空反导任务分配所面临的挑战。讨论了基于深度强化学习的防空反导智能任务分配方法的优势,提出了其实际应用所面临的问题,有望解决相关问题的技术途径和方法评价指标,为防空反导智能任务分配提供新思路。

SGPot:一种基于强化学习的智能电网蜜罐框架

随着工业4.0的快速推进,与之互联的电力数据采集与监视控制(Supervisory Control and Data Acquisition,SCADA)系统逐渐趋于信息化和智能化。由于这些系统本身具有脆弱性以及受到攻击和防御能力的不对等性,使得系统存在各种安全隐患。近年来,针对电力攻击事件频发,亟需提出针对智能电网的攻击缓解方法。蜜罐作为一种高效的欺骗防御方法,能够有效地收集智能电网中的攻击行为。针对现有的智能电网蜜罐中存在的交互深度不足、物理工业过程仿真缺失、扩展性差的问题,设计并实现了一种基于强化学习的智能电网蜜罐框架——SGPot,它能够基于电力行业真实设备中的系统不变量模拟智能变电站控制端,通过电力业务流程的仿真来提升蜜罐欺骗性,诱使攻击者与蜜罐深度交互。为了评估蜜罐框架的性能,搭建了小型智能变电站实验验证环境,同时将SGPot和现有的GridPot以及SHaPe蜜罐同时部署在公网环境中,收集了30天的交互数据。实验结果表明,SGPot收集到的请求数据比GridPot多20%,比SHaPe多75%。SGPot能够诱骗攻击者与蜜罐进行更深度的交互,获取到的交互会话长度大于6的会话数量多于GridPot和SHaPe。

Research on active defense decision-making method for cloud boundary networks based on reinforcement learning of intelligent agent

The cloud boundary network environment is characterized by a passive defense strategy,discrete defense actions,and delayed defense feedback in the face of network attacks,ignoring the influence of the external environment on defense decisions,thus resulting in poor defense effectiveness.Therefore,this paper proposes a cloud boundary network active defense model and decision method based on the reinforcement learning of intelligent agent,designs the network structure of the intelligent agent attack and defense game,and depicts the attack and defense game process of cloud boundary network;constructs the observation space and action space of reinforcement learning of intelligent agent in the non-complete information environment,and portrays the interaction process between intelligent agent and environment;establishes the reward mechanism based on the attack and defense gain,and encourage intelligent agents to learn more effective defense strategies.the designed active defense decision intelligent agent based on deep reinforcement learning can solve the problems of border dynamics,interaction lag,and control dispersion in the defense decision process of cloud boundary networks,and improve the autonomy and continuity of defense decisions.

Adversarial attack and defense in reinforcement learning-from AI security view

Reinforcement learning is a core technology for modern artificial intelligence,and it has become a workhorse for AI applications ranging from Atrai Game to Connected and Automated Vehicle System(CAV).Therefore,a reliable RL system is the foundation for the security critical applications in AI,which has attracted a concern that is more critical than ever.However,recent studies discover that the interesting attack mode adversarial attack also be effective when targeting neural network policies in the context of reinforcement learning,which has inspired innovative researches in this direction.Hence,in this paper,we give the very first attempt to conduct a comprehensive survey on adversarial attacks in reinforcement learning under AI security.Moreover,we give briefly introduction on the most representative defense technologies against existing adversarial attacks.

俄乌冲突侦察监视与伪装对抗应用分析

在战场日臻透明和“发现即摧毁”的侦察打击背景下,伪装成为提高军事目标生存和掩护军事行动的有效手段。本研究以俄乌冲突为背景,对覆盖空-天-地-海范围的侦察监视和各类伪装对抗措施进行系统分析。最后,从自适应多谱段伪装技术开发、轻量化及大跨度伪装器材研制、多维度伪装策略应用及效果评估等方面提出伪装对抗发展方向。

弱关联节点强化下网络泛洪攻击检测方法研究

由于网络中泛洪攻击生成的恶意流量常与正常流量在一定程度上具有相似性,使得传统方法将正常流量认定为恶意攻击,定位准确性较低。为此,研究弱关联节点强化下网络泛洪攻击检测方法。构建网络弱关联节点分布模型,结合已知节点和未知节点位置关系,建立弱关联节点快速定位方程,以定位节点位置;将弱关联节点接收报文的周期性作为特征,检测泛洪攻击;通过在检测到泛洪攻击的弱关联节点伪造报警包的方式强化节点,遵循泛洪攻击报文发送的路径回溯,完成泛洪攻击防御。实验结果表明,该方法定位弱关联节点测度指标值均高于0.9,可检测到泛洪攻击,并实现泛洪攻击防御。

Adversarial attack and defense in reinforcement learning-from AI security view

Reinforcement learning is a core technology for modern artificial intelligence,and it has become a workhorse for AI applications ranging from Atrai Game to Connected and Automated Vehicle System(CAV).Therefore,a reliable RL system is the foundation for the security critical applications in AI,which has attracted a concern that is more critical than ever.However,recent studies discover that the interesting attack mode adversarial attack also be effective when targeting neural network policies in the context of reinforcement learning,which has inspired innovative researches in this direction.Hence,in this paper,we give the very first attempt to conduct a comprehensive survey on adversarial attacks in reinforcement learning under AI security.Moreover,we give briefly introduction on the most representative defense technologies against existing adversarial attacks.

国外自主防御性无人机蜂群的技术发展和启示

近年来,世界各国正大力推进无人机蜂群项目和技术的研究,那么反过来,各国在对抗大规模无人机蜂群上都面临重大的国家安全挑战。围绕有效对抗无人机蜂群的目标,提出采用自主防御性无人机蜂群进行反制的重要观点。首先,介绍了自主防御性无人机蜂群的发展现状;其次,以芬兰国家技术研究中心提出的一个自主防御性无人机蜂群作战概念为基础,思考如何利用仿真器探索蜂群反蜂群的战术;然后,重点研究了包括强化学习的相关自主性关键技术;最后,为自主防御性无人机蜂群的技术发展提出了几点启示。

基于动态伪装网络的主动欺骗防御方法

针对现有蜜罐易被攻击者识破而导致其抵御渗透攻击时经常失效的问题,提出一种基于动态伪装网络的主动欺骗防御方法。首先,给出动态伪装网络定义并描述基于动态伴随网络的主动欺骗攻防场景;然后,在分析攻防交互过程的基础上,构建信号博弈模型来指导最优欺骗策略选取;进一步,设计基于双层威胁渗透图的攻防策略收益量化方法;最后,提出一种统一纯策略与混策略的博弈均衡求解方法。实验结果表明,基于动态伪装网络,精炼贝叶斯均衡能够为防御者实施最优防御策略提供有效指导,实现防御者收益最大化。此外,还总结了利用动态伪装网络进行主动欺骗防御的特点与规律。

基于增强学习的自适应动态防御机制

动态防御技术通过持续地改变系统配置以构建动态多样性特征,增加攻击者的攻击难度,而其中的安全性与性能冲突问题尚未解决.针对SDN控制器主动防御过程中的防御代价与收益平衡问题,提出一种基于增强学习的自适应防御机制,利用异构冗余控制器架构判决反馈信息,通过量化的安全收益与防御代价提高防御策略的灵活性,实现无监督地适应性防御策略确定.仿真基于网络攻击数据集,从安全性以及防御效率等方面对比分析了不同偏向下的防御性能,验证了自适应防御机制对动态攻击者的防御能力.

玻璃纤维约束混凝土抗侵彻机理研究

本文探讨了用玻璃纤维约束混凝土构件的力学性质以及在抗侵彻方面的作用 ,研究表明玻璃纤维约束混凝土既提高了混凝土的抗压强度 ,又提高了混凝土的延性 ,从而提高了混凝土构件抗侵彻能力。

人防工程主体结构木柱加固方法探讨

人防工程平战功能转换是人防工程建设和发展的重要指导思想,人防工程主体结构加固改造必须满足可靠、迅速和经济三大指标,后加柱技术是人防工程主体结构提高结构抗力等级的比较实用的方法,木柱是一种易加工安装且经济可行的后加柱形式.采用无梁板结构,通过水囊逐级加载试验,分析了板、墙和柱上混凝土和构件内钢筋的应力-应变关系及可能的破坏特征.试验结果表明,木柱可用于人防工程主体结构的加固改造.

基于强化学习的无线传感器网络入侵检测攻防博弈研究

无线传感器网络易遭到各种内部攻击,入侵检测系统需要消耗大量能量进行攻击检测以保障网络安全。针对无线传感器网络入侵检测问题,建立恶意节点(malicious node,MN)与簇头节点(cluster head node,CHN)的攻防博弈模型,并提出一种基于强化学习的簇头入侵检测算法——带有近似策略预测的策略加权学习算法(weighted policy learner with approximate policy prediction,WPL-APP)。实验表明,簇头节点采用该算法对恶意节点进行动态检测防御,使得博弈双方快速达到演化均衡,避免了网络出现大量检测能量消耗和网络安全性能的波动。

导弹新型热隐身技术研究

对导弹热隐身技术的现状与发展趋势进行了论述。重点研究了纳米微粒、掺杂半导体涂料与相变微胶囊应用于导弹热隐身的机理和技术途径。对采用这些新材料、新技术实现导弹复合隐身的可行性进行了分析。

削弱精确制导武器打击能力的几种对策

随着高技术的迅猛发展 ,精确制导武器在现代战争中的地位越来越重要 ,根据制导武器的构造和工作原理 ,利用其弱点 ,可采取综合防护战、多层截击战、摧毁破袭战等多种措施达到削弱敌方精导武器的打击能力 ,减少我方战斗损失的目的。

陆基巡航导弹发射设备生存能力分析

针对现代战争条件下,巡航导弹发射设备可能遭到敌方攻击的课题,提出了陆基巡航导弹发射设备生存能力的问题;引入了生存概率以估算陆基巡航导弹发射设备生存能力,并分析了提高生存能力的措施;介绍了采用机动快速的发射方式及涉及的关键技术;总结了发射车辆伪装隐蔽的常用措施;阐述了采用防护加固提高生存能力的办法。为提高陆基巡航导弹发射设备生存能力,采用机动快速、伪装隐蔽和防护加固的措施,对提高巡航导弹武器系统作战效能具有重要意义。