Research on Network Attack Packet Sampling Based on Stackelberg Game Theory

Network intrusion detection is an important part of network security research. Stackelberg game theory is applied to study attack packets sampling problem in network security, and network attack packets sampling model is proposed in this paper. The network security system is regarded as the follower in this game, adjusting the strategies to maximize its benefit function according to the behavior of network attacker. We proved the existence and uniqueness of Stackelberg equilibrium in this game model. Packets sampling algorithm PSA-SM and its equivalent algorithm SPSA were designed based on linear programming. Attack packets injecting algorithm IPIA-GT is also designed. The experiment results showed that network security system can use SPSA to increase the sampling probability of attack packets, and network attacker can also use IPIA-GT to decrease the sampling probability of attack packets. When both of them used optimal strategies, the game got its equilibrium.