DCASR: Dynamic Multi-Type Security Resource Allocation Against APT Attack

Advanced Persistent Threat (APT) defense requires the rational allocation of multiple types of security resources. Existing research has deficiencies in the rationality of security resource allocation in multi-stage attacks like APT. Since different attack methods may be adopted in different stages, defenders need to rationally allocate various security detection resources to capture attacking behaviors. Based on the GPLADD(Graph-based Probabilistic Learning Attacker and Dynamic Defender) game and the ATT&CK framework, this paper proposes the Dynamic Collaborative Allocation of Security Resources (DCASR) model to quantify the impact among different types of defense resources. Solutions are derived using evolutionary strategies and Q-learning with sample average approximation, aiming to maximize resource utilization and minimize the consumption of security resources within the defense activity time. The results of simulation experiments show that the generated strategies possess security and economic benefits and can provide theoretical and practical references for the allocation of security resources when defending against APT attacks.