In the cloud-edge collaborative network, advanced persistent threats (APTs) pose a serious security risk to critical network assets. Although network deception defense can mislead attackers’ cognition, its effectiveness depends on dynamically selecting appropriate rotation timings of the deception defense. However, the deployment of deception resources and state updates is not completed instantaneously, and existing methods ignore the state transition delay and the dynamic interaction between the attackers and defenders during the real attack and defense process. To address this, we propose a deception defense timing selection method based on the time-delayed FlipIt game. Firstly, a network state evolution model integrating state transition delay is constructed, and the dynamic transfer process between node states is characterized by a set of delay differential equations. Secondly, a cloud-edge collaborative defense architecture is designed. On this basis, a time-delayed FlipIt game model (TD-FlipIt) is established, and the gate control mechanism is introduced to formalize the defense cooling period as a constraint for the rotation action of deception resources. Subsequently, we use the multi-agent deep deterministic policy gradient (MADDPG) algorithm to solve the rotation strategy for deception defense timing. Experimental results show that the proposed method can effectively optimize the selection of defense timing, ensuring defense effectiveness while reducing resource consumption, and providing effective support for defense in the cloud-edge collaborative environment.
Pei et al. (Thu,) studied this question.