Security Decision Making Based on Domain Partitional Markov Decision Process

The research proposed an approach that based on domain partitional Markov decision process to make decisions about the protection and defense against cyber attacks. We partitioned the network into several security domains. Markov decision models were made in each domain, with each state established by situational awareness. Strategy sets were set according to the system states. Cost-benefit factors were considered comprehensively to calculate the rewards of countermeasures. On one hand, domain partition overcame the deficiency of control granularity; on the other hand the payoffs of the counter-measures were calculated comprehensively. The experimental results show that the model can effectively improve the accuracy and effectiveness of network defense.