基于博弈的电力工控网络APT攻击溯源图分析方法OA

Advanced persistent threat(APT)attacks electric power industrial control networks exhibit strong concealment and long-term persistence.However,existing APT detection methods relaying on graph neural networks to match and analyze subgraphs within provenance graphs for malicious behavior identification often suffers from suboptimal subgraph recognition window sizes,which degrades detection performance.To address this,a dynamic subgraph recognition window adjustment mechanism based on the Stackelberg game is proposed.This mechanism constructs utility function models for both the defender and the attacker,dynamically optimizing the recognition window size in a game theory approach.In which the defender,as the game leader,optimizes the window size to improve the detection success rate and reduce detection costs.The attacker,on the other hand,adjusts the scale of the APT subgraph according to the defense strategy to evade detection.The game solution yields the optimal window adjustment strategy for the defender and the response strategy for the attacker.Simulation results indicate that,compared to the fixed window method,this mechanism improves detection accuracy by approximately 16%on average,enhances computational resource efficiency by about 25%,and effectively reduces both false negatives and false positives.