Journals
  Publication Years
  Keywords
Search within results Open Search
Please wait a minute...
For Selected: Toggle Thumbnails
Cyber anti-mapping method based on adaptive perturbation
Chengyi WANG, Lei XU, Jinyin CHEN, Hongjun QIU
Journal of Computer Applications    2025, 45 (12): 3896-3908.   DOI: 10.11772/j.issn.1001-9081.2024121733
Abstract23)   HTML1)    PDF (1770KB)(9)       Save

The intelligent cyber mapping methods based on Deep Reinforcement Learning (DRL) model the cyber mapping process as a Markov Decision Process (MDP) and train the attacking agents using error-driven learning to identify critical network paths and obtain network topology information. However, traditional cyber anti-mapping methods are usually based on fixed rules, making them difficult to face the dynamic behavioral strategies of DRL agents during the mapping process. Therefore, a cyber anti-mapping method based on adaptive perturbation, named AIP (Adaptive Interference Perturbation), was proposed to defend against intelligent cyber mapping attacks. Firstly, the traffic conditions were predicted by using historical traffic sequence information, the gradient information was calculated according to the differences between the predicted conditions and real traffic data, and the gradient information was used to generate adversarial perturbations, which were injected back into the original traffic samples to produce adversarial examples. Then, a feature reconstruction method combining traffic posture and routing state was adopted to optimize the sparse dictionary dynamically through iteration, thereby realizing sparse transformation of traffic data. Finally, the sparse adversarial traffic was used as the observable traffic information of the network topology, and the defense performance of the AIP method was evaluated by analyzing the changes in the link-weight distribution assigned by the mapping agent and the variations in network latency. Experimental results show that compared to traditional perturbation defense methods such as Fast Gradient Sign Method (FGSM)and Random Attack (RA), AIP increases the attacker’s susceptibility to perturbations significantly when the network traffic intensity exceeds 25%, resulting in greater changing amplitude in the link weights of the network topology and a noticeable impact on network delay. Furthermore, compared with Static Honeypot Deployment (SHD) and Dynamic Honeypot Deployment based on Q-Learning (DHD-Q) methods, according to the comparison of delay trends, AIP demonstrates continuous confusion of attackers, making it difficult to identify critical network paths, which ensures network delays remained within a controlled range and achieves better performance in defense efficiency and stability.

Table and Figures | Reference | Related Articles | Metrics