# Mixed Strategy Analysis in Attack-Defense Game Model Based on 5G Heterogeneous Network of CPS Using ncPSO

Authors: Ning Liu; Qing-Wei Chai; Shangkun Liu; Fanying Meng; Wei-Min Zheng
Journal: Security and Communication Networks
 (2022)

---

## Abstract

The development of the 5th Generation Mobile Communication Technology not only brings convenience to people but also brings many network security problems. Based on the static game theory of complete information, a game model of attack and defense with limited resources in heterogeneous networks of Cyber Physical Systems is established. This model analyzes the basic rules of the offensive and defensive strategies of both parties when the offensive and defensive resources are limited in the 5th Generation Mobile Communication Technology network environment. The model can also describe the interaction between attackers and defenders. A novel compact particle swarm optimization algorithm is proposed to solve the difficult problem of solving the Nash equilibrium of this game model. The simulation experiment proves that novel compact particle swarm optimization algorithm has good optimization ability and shows that the algorithm can effectively solve the Nash equilibrium of the model. The simulation experiment provides a strategic reference for the attack-defense game with limited resources.


---

## Body

## 1. Introduction

In recent years, the 5th Generation Mobile Communication Technology (5G) has developed rapidly and has been widely used in many aspects of the lives of people [1]. 5G is characterized by fast transmission rate and high stability [2]. In the future, 5G will be applied in cyber physical systems (CPS), industry, education, environment, medical care, transportation, and many other aspects to achieve real full coverage [3–5]. Based on these characteristics of 5G, heterogeneous networks of CPS are also developing rapidly. The core goal of heterogeneous networks is to achieve free connectivity of devices [6]. The Internet can be composed of multiple interconnected heterogeneous networks. The devices used to connect heterogeneous networks are routers. A heterogeneous network means that two or more wireless communication systems use different access technologies or use the same wireless access technology but belong to different wireless operators [7]. Heterogeneous networks can make use of existing multiple wireless communication systems, and through the integration of systems to make the multiple systems can learn from each other to meet the needs of future mobile communication services. The intelligent access means of multimode terminals is used by heterogeneous network to make a variety of different types of networks that can jointly provide wireless access anytime and anywhere for users [8]. The CPS is closely related to heterogeneous networks. The CPS is mainly divided into three layers: the perception layer, the network layer, and the control layer. The transmission of information mainly depends on the network layer. The connection of different devices among CPS can be regarded as a heterogeneous network [9]. The significance of CPS is to connect physical devices to the Internet, which enables physical devices to have five functions: computing, communication, precise control, remote coordination, and autonomy [10]. The communication is put on the same level as computing in CPS. The network scale of CPS surpasses that of existing industrial control network. The CPS is thought to connect the whole world. The development of 5G heterogeneous networks also brings opportunities for hackers [11–13]. Hackers can use advanced persistent threat (APT), denial of service (DOS), and other attack methods to attack network devices of CPS and use eavesdropping, interference, and other attack methods to attack the information transmission links of CPS [14–16]. The attacks from hackers are characterized by diversity, large scale, and high density [17–19]. It brings great challenges for defenders to defend against attacks [20, 21]. Firewall and intrusion detection system (IDS) has a delay in attacks from hackers, and reasonable defense measures cannot be taken before attacks from hackers [22, 23]. Therefore, it is particularly important to carry out macro analysis of attack and defense behaviors of hacker and defender through game theory. Through this analysis, defenders can obtain the possible attack strategies of hackers before being attacked and then defenders can take effective defense strategies to reduce the loss.There have been many studies using game theory to analyze the behaviors of hackers and defenders [24–26]. Researchers build different models for different application environments and use game theory for macro analysis [27–30]. Li et al. propose a zero-sum complete information static game model under the network topology graph and proposes a sensitive cost parameter for attacking and defensing [31]. He only considers two attack strategies, and the model is quite different from the actual situation, so this model is not universally applicable. Min builds a Colonel Blotto game using APT attack and defense [14]. And the Nash equilibrium of the model is solved. Simulation experiments show that a “hotbooting” CPU allocation method proposed by Min has lower computational complexity. Jiang proposes a network security defense graph by the state of devices [32]. Taking into account the three attributes of information confidentiality, availability, and integrity into the model, the optimal defense strategy is obtained through game theory. Leng et al. propose a three-player complete information static game model based on white hat, black hat, and software manufacturers. The simulation experiment shows that the model provides an effective strategy for software manufacturers to reduce the risk of software vulnerabilities [33]. Attiah et al. transform the three-strategy attack-defense game model into a two-strategy game model. And the mixed strategy of the model is solved [34]. Wang and Zeng propose a two-stage game in the process of attack and defense. In the first stage, the attacker scans the port of the defender, and the defender deceives or truthfully responds to the attacker. In the second stage, the two sides play a strategic game [35]. Ferguson-Walter et al. establish an incomplete information dynamic game model for network deception attacks to analyze the strategic choices of both attackers and defenders. This model is more in line with the current offensive and defensive scenarios and has strong reference significance [36]. Shen et al. propose a signal game model for the selection of intrusion detection strategies in the wireless sensor network environment. The model uses detection rate and false alarm rate and analyzes the impact of these two parameters on strategies selection [37].Although there are many existing studies on attack-defense equilibrium based on game theory, there are not many studies on the attack and defense game in the 5G heterogeneous network environment of CPS. The biggest flaw of the existing research models is that they do not consider whether the communication links are attacked, but only consider whether the heterogeneous devices are attacked. Another flaw is that the scale of attack and defense is too small to meet the conditions of 5G. Intelligent computing provides a solution for solving Nash equilibrium of large-scale offensive and defensive games. The most used and most classic intelligent computing algorithm is the particle swarm optimization (PSO). The PSO is proposed by Kennedy and Russell in 1995 according to the foraging behavior of birds [38]. Different algorithms need to be optimized for different problems, so different heuristic algorithms are constantly proposed, such as genetic algorithm (GA) [39], whale optimization algorithm (WOA) [40], black hole (BH) [41], bat algorithm (BA) [42], and sine cosine algorithm (SCA) [43]. A novel compact particle swarm optimization (ncPSO) that uses less memory space and has stronger optimization ability is proposed to solve the Nash equilibrium of the game model proposed in this paper.The main contributions of this paper are as follows:(1)
Establish a network topology graph based on 5G heterogeneous network of CPS to analyze the attack and defense behaviors. Increase the number of offensive and defensive strategies.(2)
Consider not only network devices being attacked but also communication links between devices being attacked.(3)
A ncPSO is proposed to solve the mixed strategy Nash equilibrium of the game model.(4)
The strategy selection problem of attackers and defenders under different attack resources and different defense resources is analyzed.The rest of this paper is structured as follows. A 5G heterogeneous network topology diagram of CPS is constructed in Section2. A attack and defense game model is established in Section 3. The cPSO is proposed and a method for solving mixed strategy Nash equilibrium using the cPSO is described in Section 4. Simulation experiments to discuss the mixed strategies of attackers and defenders under different resources are conducted in Section 5. A conclusion is given in Section 6.


## 2. System Model and Symbols

A heterogeneous network of CPS based on 5G can be described as an undirected connection graph. We useG=V,E to represent the graph in this paper. V=v1,v2,…,vNV is a set containing all vertices. NV=V represents the total number of the vertices. Each vi is a vertex in G and indicates a device in heterogeneous network of CPS. Devices in a heterogeneous network can be mobile phones, servers, smart appliances, routers, etc. E=e1,e2,…,eNE is a set containing all edges. NE=E represents the total number of the edges. Each ei is an edge in G and indicates a type of communication link in heterogeneous network of CPS. Communication links in a heterogeneous network of CPS contain telephone communication, mobile communication, point to point (P2P), etc. The number of all elements in the graph G is NG=NV+NE. We can denote G=g1,g2,…,gNG by G=V,E. Every gi can be an attack target for attacker and a protective target for defender.We use a diagonal matrixCNv×Nv to describe the connectivity of graph G. The detailed representation of C is shown in (1). Let Gmax denote the maximum connectivity of graph G.(1)Cij=Cji=1,vertexiand vertexjare connected,0,vertexiand vertexjare not connected.Since different devices and different communication links have different functions and roles in heterogeneous networks, they have different importance in networks. We useIi to denote the importance of the ith element in graph G. For vertices, their importance is represented by the number of edges connected by them. For edges, their importance is represented by the smaller maximum connectivity of the subgraphs on either side of the edge. The importance of each element in graph G is shown in(2)Ii=∑j=1NVCij,ifgiisavertex,minmaxG1max,G2max,ifgiisanedge,where G1 and G2 are subgraphs on either side of the edge gi. G1max, and G2max are the maximum connectivity of the subgraph G1 and subgraph G2.Usually, the available resources for attackers and defenders to attack and defense network components are limited.SourceA and SourceD are used to denote the total available resources of attackers and defenders, respectively. An attacker can attack one or more elements according to the attack resources. For example, an attacker can use DOS to attack a server, use routing spoofing to attack a router, use flooding to attack a switch, and use APT to attack a specific device. They also can use eavesdropping, truncation, jamming, and tampering to attack the communication links between devices. The defender can defense the network elements using limited resources at the same time. For example, a defender can use blacklist to prohibit attackers attacking server, use flow cleaning to protect routers, and use protection software to defense application devices. Defenders also can use encryption, filter, and VPN to defense the communication links.


## 3. Attack and Defense Game Model

Based on the model graph proposed in Section2, we establish a game model M=A,D,SA,SD,UA,UD to analyze behaviors of attacker and defender. In this game model, the attacker and defender take measures at the same time and there is no cooperative relationship between them, but the benefit calculation is different for both attacker and defender, so this game model is a nonzero sum game model. The meanings of the six tuple in the game model M are as follows:(1)
A: An attacker in a 5G heterogeneous network. The attacker can adopt different attack strategies to attack different components in the heterogeneous network.(2)
D: A defender in a 5G heterogeneous network. The defender also can take feasible measures to protect components in the heterogeneous network.(3)
SA: SA=SA1,SA2,…SAi,…,SAM is the attack action set for attacker, where M represents the total number of the attack strategies. SAi=a1,a2,…,aj,…,aNG∈SA is an attack strategy combination in SA. The value of aj is shown in(3)aj=1,ifgjis attacked,0,ifgjis not attacked.(4)
SD: SD=SD1,SD2,…SDi,…,SDN is the defense action set for defender, where N represents the total number of the defense strategies. SDi=d1,d2,…,dj,…,dNG∈SD is a defense strategy combination in SD. The value of dj is shown in(4)dj=1,ifgjis defensed,0,ifgjis not defensed.(5)
UA: UASAi,SDj is the attack profit after the attacker and defender adopt strategy SAi and SDj.(6)
UD: UDSAi,SDj is the defense profit after the attacker and defender adopt strategy SAi and SDj.In the game, the available resources of both sides cannot be infinite. Taking human, material, and financial resources into consideration,SourceA and SourceD are used to denote the total available resources of attackers and defenders, respectively. Each element gi in G has different attack costs and defense costs for attackers and defenders according to its own characteristics, denoted by CostiA and CostiD. Therefore, the offensive and defensive behaviors must meet the following:(5)∑i=1NGai×CostiA≤SourceA,(6)∑i=1NGdi×CostiD≤SourceD.Whether a network elementgi in G is breached depends on the strategies from attacker and defender. It can be described by(7)Bi=1,ai=1&&di=0,0,ai=1&&di=1‖ai=0,where Bi=1 represents that gi is breached and Bi=0 represents that gi is not breached. When element gi is breached, we remove it from G, then we obtain a new graph G′ after the game.For the attacker, the gain function in the modelM is represented by the loss connectivity of the graph G. For the defender, the gain function is represented by the maximum connectivity of the network after the game. We have assumed the maximum connectivity before game is denoted as Gmax in Section 2. Then we assume the maximum connectivity after the game as Gmax′. So the UA and UD can be calculated by (8). The profit matrix can be represented in Table 1.(8)UA=Gmax−Gmax′,UD=Gmax′,s.t.∑i=1NGai×CostiA≤SourceA,∑i=1NGdi×CostiD≤SourceD.Table 1
The profit matrix of attacker and defender.
SD1SD2…SDNSA1UA11,UD11UA12,UD12…UA1N,UD1NSA2UA21,UD21UA22,UD22…UA2N,UD2N……………SAMUAM1,UDM1UAM2,UDM2…UAMN,UDMNIn the game, both the attacker and the defender hope to achieve their maximum benefits. So they choose to use the strategy that could maximize their benefits. They also need to consider the strategies form another on their own returns. Eventually, they will reach a strategic equilibrium. In the game, there may exist a pure strategy and a mixed strategy Nash equilibrium. We assume that the optimal policy of attacker isSA∗, and the optimal policy of defender is SD∗. If SA∗ and SD∗ satisfy (9), they are a set of Nash equilibrium solutions.(9)∀SAi,UASA∗,SD∗≥UASAi,SD∗,∀SDj,UDSA∗,SD∗≥UDSA∗,SDj.


## 4. Game Solution

A solution to solve the equilibrium strategy ofM is proposed in this section. This paper takes the attacker as an example to discuss, and the analysis method of the defender is similar to attacker. In this model game M, there may be a pure strategy and a mixed-strategy Nash equilibrium.For pure-policy Nash equilibrium, we use the traditional min-max theorem to solve [44]. The idea of this theorem is to choose the optimal strategy under various worst-case scenarios [45]. When the profit matrix of model M satisfies (10), strategy SA∗,SD∗ is a pure strategy equilibrium.(10)max1≤i≤Mmin1≤j≤NUAij=min1≤j≤Nmax1≤i≤MUAij=UAi∗j∗.Pure strategy is a special form of mixed strategy. When the probability of one strategy is 1, and the probabilities of other strategies are 0, it is a pure strategy. First of all, a strategy choice is given for one participant, another participant chooses the strategy that brings the highest profit among the different strategies. Second, the optimal strategy of another participant is given, and the first participant compare whether the strategy which another participant chooses is also optimal for him. Third, if the strategy combination is the optimal strategy for both participants, then it is a pure strategy Nash equilibrium of the game. When a Nash equilibrium is reached, both offense and defense are reluctant to change their strategies because changing strategies will make their gains less. When there is more than one pure-strategy Nash equilibrium, both sides can choose mixed strategies to maximize their gains. Mixed strategies also occur when the game does not have a pure strategy Nash equilibrium. Taking the chicken game as an example, there are two pure strategy Nash equilibrium in the chicken game. But to participants, they want to take two strategies with a certain probability combination to obtain greater benefits, so the Nash equilibrium of mixed strategies is more important. Therefore, we mainly solve the Nash equilibrium of the mixed strategy. Mixed strategy means that players choose strategies according to probability. We setP=p1,p2,…,pM and Q=q1,q2,…,qN to represent the probability of the attacker and defender using different strategies, respectively. Therefore, the P and Q should satisfy(11)∑i=1Mpi=1,∑j=1Nqj=1.According to Table1, the expected returns of the attacker UA′ and the defender UD′ can be expressed as (12). Taking the attacker as an example, if P∗ and Q∗ are a Nash equilibrium of mixed strategies, then any individual modification of P or Q alone cannot increase the profit. Another solution to mixed strategies is that optimal mixed strategy of every player must make the expected profit of another choosing different strategies the same. The strategy of attacker should consider the profit of defender, it should satisfy (13). The strategy of defender should consider the profit of attacker, it should satisfy(12)UA′=max∑i=1M∑j=1Npi·qj·UASAi,SDj,UD′=max∑i=1M∑j=1Npi·qj·UDSAi,SDj,s.t.∑i=1NGai×CostiA≤SourceA,∑i=1NGdi×CostiD≤SourceD,∑i=1Mpi=1,∑i=1Nqi=1.(13)∑i=1Mpi·UDSAi,SD1=∑i=1Mpi·UDSAi,SD2=…=∑i=1Mpi·UDSAi,SDN,(14)∑j=1Npj·UASA1,SDj=∑j=1Npj·UASA2,SDj=…=∑j=1Npj·UASAM,SDj.With the development of 5G, the means of network attack are diversified, large scale, and intelligent. The equilibrium solution under large-scale attack and defense strategies is a difficult problem. The high-speed and low-latency 5G make offensive and defensive strategies grow exponentially. Under the large-scale attack and defense strategies, the traditional Nash equilibrium solution method is no longer applicable. As an optimization algorithm, intelligent computing has a good effect on solving high-dimensional complex problems.A ncPSO is proposed to solve the Nash equilibrium of mixed strategies. The ncPSO is an improvement over PSO. The position of each particle donated asXi represents a strategic choice of the attacker. PSO will record the global optimal position gBest and the individual optimal position pBest of the particle swarm. Then particles move according to gBest and pBest, and the movement equation refers to (15) and (16). w is the inertia weight, and g is the number of iterations.(15)Vig+1=wVig+c1×rand×pBesti−Xig+c2×rand×gBest−Xig,(16)Xig+1=Xig+Vig+1.The movement process of the particle swarm is shown in Figure1. V1, V2, and V3 represent three speeds in (15). Vig+1 is the combination of the three speeds. The new position of Xig+1 is based on Xig and Vig+1.Figure 1
The movement process of the particle swarm.PSO is an iterative optimization algorithm, andgBest and pBest are updated according to the fitness value of particles. Considering that PSO requires larger memory, we apply compact strategy and propose ncPSO to optimize and reduce memory usage [46]. Instead of recording the position of each particle in each iteration, the compact strategy uses a mathematical distribution to record the position of the entire swarm of particles. The compact strategy that we proposed uses a Pareto distribution to describe the location of the particle swarm. The Pareto distribution contains three important parameters: shape parameter k, scale parameter σ, and threshold parameter θ [47]. Among the three parameters, AA and BB play a decisive role in the optimization and convergence of the algorithm, so AA and BB are used to update the particle swarm position. Taking 50 particles with 40 dimensions as an example, the original PSO needs to record the position of each particle in each dimension, so 50×40=2000 memory units are required. The ncPSO only needs to record the AA and BB of entire swarm of particles in each dimension, so the ncPSO only needs 2×40=80 memory units. Compared with traditional PSO, ncPSO can reduce a large number of memory units. The process of the compact strategy is shown as follows. First, generate a probability distribution function (PDF) according to θ and σ. Second, calculate cumulative distribution function (CDF) by PDF. Finally, a random number will be generated to calculate an inverse cumulative distribution function (iCDF). The value of iCDF is the position of the particle swarm. The figures of PDF and CDF of Pareto are shown in Figure 2. The equations of PDF and CDF of Pareto are shown in (17) and (18).(17)PDF=1σ1+kx−θσ−1−1/k,(18)CDF=1−1+kx−θσ−1/k,k≠0,1−exp−x−θσ,k=0.Figure 2
PDF and CDF of Pareto distribution. (a) PDF of Pareto distribution. (b) CDF of Pareto distribution.
(a)(b)The ncPSO generates awinner and a loser through a competitive strategy and then updates σ and θ through the winner and loser. The update formulas for σ and θ are shown in (19) and (20), where Np is the virtual number of particles. For the attacker, the condition for winning the competition in the model can be expressed as how to choose the probability of using each attack strategy to make the defender get the same benefit adopting any defensive strategy. The ith dimension of the particle represents the probability that the attacker chooses the attack strategy SAi. The fitness value of ncPSO can be expressed as the standard deviation of the profit of defender. Its mathematical representation is shown in(19)σg+1=σg2+θg2−θg+12+1Npwinner2−loser2,(20)θg+1=σg+1Npwinner−loser,(21)Total FitnessUAj=∑i=1Mpi·UDSAi,SDjj=1,2,…,NfitnessUA=stdTotal FitnessUA.For an attacker, letP∗ be the optimal probability distribution for choosing different attack strategies. The process of the ncPSO to calculate the P∗ is shown in Algorithm 1. In the same way, we can obtain the optimal probability distribution for the defender to choose different defense strategies.Algorithm 1: The process for calculating P∗ using cPSO.
Initialize theθ and σ of ParetoInitialize theX by uniform distributionInitialize theV by uniform distributionInitialize thegBest, pBest, fitnessPBest, fitnessGBestwhileg<=max_iterationdopBest  = compact θ,σ according to (17) and (18)Calculate thefitnessPBest of the pBest by (21)UpdateX and V of each particle according to (15) and (16)Calculate the fitness of the newX by (21)iffitnessX<fitnessPBestthenwinner=Xloser=pBestelsewinner=pBestloser=Xend ifUpdateθ and σ according to (19) and (20)pBest=winnerfitnessPBest=fitnesswinneriffitnessX<fitnessGBestthengBest=XfitnessGBest=fitnessXend ifg=g+1end whileThe whole algorithm can be divided into the following six parts:(1)
The network model is established according to the connection relationship between the actual heterogeneous network devices.(2)
Calculate the importance of each element.(3)
Initialize attack and defense costs for each element. Initialize the total available resources of the attacker and defender.(4)
Build a set of strategies for attacker and defender to attack and defense network element.(5)
Calculate the profit matrix for attacker and defender.(6)
Calculate the mixed strategy Nash equilibrium of attacker and defender using ncPSO.


## 5. Simulation Experiment and Analysis

In this section, the performance of ncPSO is compared with GA, PSO, WOA, BH, BA, and SCA in 28 test functions in CEC2013. CEC2013 contains 28 different performance test functions, which have good representation. Then, we research the mixed strategy Nash equilibrium using a simple topology diagram. But in real life, the topology diagram of heterogeneous network is much more complicated. Our purpose is to analyze the attack and defense behavior under different attack and defense resources, so using a simple topology diagram can also get the desired results. Four sets of simulation experiments are tested to illustrate the validity of the equilibrium solution and the feasibility of the assignment of offensive and defensive strategies in the game model. First, simulation experiments are carried out to demonstrate the effectiveness of solving Nash equilibrium using ncPSO. Second, simulation experiments are carried out to demonstrate the losses of the defender under different attack and defense resources. Third, strategies of attacker and defender with different defense resources are discussed through simulation experiments. Lastly, strategies of attacker and defender with different attack resources are discussed through simulation experiments. The simulation tools in this section all use Matlab2021B.


### 5.1. Performance Test Experiment of ncPSO and Other Algorithms

In this subsection, the performance of different algorithms is compared on 28 test functions of CEC2013. Different algorithms search for the minimum value on the test function. The smaller the function value found, the stronger the optimization ability of the algorithm. Each algorithm is run 20 times on each test function, and the mean of the 20 experimental data is taken as the final experimental result. In addition to the performance test experiments, this section also performs Wilcoxon signed rank sum test with significant levelα=0.05 on the test results to illustrate the validity of the experimental data. According to the relevant references of different algorithms, the parameter settings of different algorithms are shown in Table 2.Table 2
Parameter settings for different algorithms.
NameParameterncPSOD = 50; c1 = 2.0; c2 = 2.0;GAD = 50; N = 60; crossover rate = 0.01; mutation rate = 0.9PSOD = 50; N = 60; c1 = 1.0; c2 = 2.0WOAD = 50; N = 60; probability switch = 0.5BHD = 50; N = 60BAD = 50; N = 60; pulse rate = 0.5; loudness = 0.6; fmin = 0; fmax = 1SCAD = 50; N = 60; probability switch = 0.5In Table2, D represents the dimension of the problem, N represents the number of populations, and other parameters are unique to each algorithm and take values according to relevant references. The results of performance test experiments and rank sum verification are shown in Table 3. In Table 3, >,=,<, respectively, indicates that ncPSO has better, same, and worse optimization effects on the test function than other algorithms.Table 3
Experiment results of performance test and rank sum test.
GAPSOWOABHBASCAncPSOf11.63E + 05>−1.33E + 03>−1.34E + 03>−1.40E + 03=−1.39E + 03>2.91E + 04>−1.40E + 03f25.40E + 09>8.83E + 06>8.07E + 07>2.78E + 07>5.86E + 06>5.49E + 08>1.74E + 06f32.37E + 20>2.65E + 09>3.47E + 10>7.94E + 09>6.09E + 08<1.05E + 11>1.04E + 09f46.79E + 05>1.11E + 03<5.90E + 04<3.18E + 04<1.91E + 04<6.65E + 04<8.12E + 04f58.68E + 04>−9.76E + 02>−7.96E + 02>−9.01E + 02>−9.96E + 02>2.26E + 03>−1.00E + 03f62.78E + 04>−8.04E + 02>−6.79E + 02>−7.96E + 02>−8.28E + 02<1.12E + 03>−8.23E + 02f76.05E + 06>−6.76E + 02>9.12E + 02>−6.19E + 02>1.26E + 04>−5.81E + 02>−6.84E + 02f8−6.79E + 02=−6.79E + 02=−6.79E + 02=−6.79E + 02=−6.79E + 02=−6.79E + 02=−6.79E + 02f9−5.19E + 02>−5.44E + 02>−5.30E + 02>−5.31E + 02>−5.33E + 02>−5.26E + 02>−5.44E + 02f102.32E + 04>−4.43E + 02>−1.79E + 02>−4.67E + 02>−4.96E + 02>3.38E + 03>−4.99E + 02f112.17E + 03>5.13E + 01>4.10E + 02>4.33E + 02>7.43E + 02>3.31E + 02>−3.84E + 02f121.96E + 03>2.29E + 02<6.05E + 02>5.53E + 02>9.23E + 02>4.75E + 02>2.73E + 02f132.15E + 03>4.06E + 02>7.97E + 02>6.43E + 02>1.21E + 03>5.60E + 02>3.51E + 02f141.66E + 04>6.47E + 03>9.10E + 03>8.57E + 03>8.88E + 03>1.35E + 04>1.84E + 03f151.61E + 04>8.53E + 03<1.15E + 04>8.89E + 03<9.14E + 03<1.48E + 04>9.55E + 03f162.05E + 02>2.03E + 02>2.03E + 02>2.02E + 02>2.02E + 02>2.04E + 02>2.02E + 02f175.37E + 03>7.99E + 02>1.45E + 03>1.35E + 03>2.69E + 03>1.30E + 03>3.51E + 02f185.51E + 03>8.68E + 02<1.56E + 03>1.45E + 03>2.81E + 03>1.41E + 03>9.85E + 02f192.32E + 07>5.30E + 02>6.81E + 02>6.14E + 02>5.64E + 02>4.31E + 04>5.02E + 02f206.25E + 02=6.24E + 02=6.25E + 02=6.24E + 02=6.25E + 02=6.24E + 02=6.25E + 02f211.27E + 04>1.67E + 03>1.93E + 03>1.68E + 03>1.48E + 03<4.58E + 03>1.64E + 03f221.87E + 04>1.02E + 04>1.29E + 04>1.27E + 04>1.24E + 04>1.54E + 04>4.31E + 03f231.83E + 04>1.20E + 04<1.41E + 04>1.28E + 04<1.19E + 04<1.61E + 04>1.40E + 04f241.99E + 03>1.38E + 03>1.41E + 03>1.43E + 03>1.44E + 03>1.43E + 03>1.36E + 03f251.73E + 03>1.54E + 03<1.53E + 03>1.54E + 03<1.47E + 03<1.55E + 03>1.60E + 03f261.79E + 03>1.65E + 03>1.67E + 03>1.61E + 03>1.68E + 03>1.62E + 03>1.48E + 03f274.72E + 03>3.32E + 03<3.56E + 03>3.56E + 03>3.47E + 03>3.64E + 03>3.32E + 03f281.70E + 04>4.44E + 03<8.75E + 03>7.50E + 03>1.04E + 04>6.62E + 03>5.16E + 03>/ = /<26/2/018/2/824/2/221/3/418/3/724/2/2The last row of Table3 gives the number of better, the same, and worse performance of ncPSO compared to other algorithms in the 28 test functions. The experimental results in Table 3 show that ncPSO has the same optimization effect as all optimization algorithms on the two test functions f8 and f20. Compared with GA, ncPSO performs better than GA in other 26 test functions. Compared with PSO, ncPSO performs better than PSO on 18 test functions, but not as good as PSO on 8 test functions. Compared with WOA and SCA, ncPSO performs better than WOA and SCA on 24 test functions, but worse than WOA and SCA on f4 and f25. Compared with BH, ncPSO performs better than BH on 21 test functions, but not as good as BH on 4 test functions. Compared with BA, ncPSO performs better than BA on 18 test functions, but worse than BA on 7 test functions.In order to better show the optimization performance of the algorithms, 9 optimization process diagrams with obvious effects are selected for display in Figure3. After the algorithm iteration in each graph, the lower the curve, the stronger the optimization ability of the algorithm, and the faster the curve declines, the faster the convergence speed of the algorithm.Figure 3
Performance comparison between GA, PSO, WOA, BH, BA, SCA, and ncPSO. (a)f9. (b) f11. (c) f12. (d) f13. (e) f14. (f) f17. (g) f22. (h) f24. (i) f26.
(a)(b)(c)(d)(e)(f)(g)(h)(i)As can be seen in Figure3, ncPSO has better optimization performance and faster convergence speed than other algorithms in functions f9, f11, f13, f14, f17, f22, f24, and f26. On the function f12, ncPSO has worse optimization performance compared with PSO, but has better optimization performance than GA, WOA, BH, BA, and SCA.


### 5.2. Effectiveness of Solving Nash Equilibrium Using ncPSO

The graph that we use in the simulation experiment is shown in Figure4. Because a heterogeneous network of CPS is formed by various devices and different access technologies, the heterogeneous network of CPS is simplified as Figure 4. Each node in the diagram represents a terminal device in the network of CPS, such as terminal servers, mobile phones, sensors, and drones. Each edge in the graph represents a communication link in the network of CPS, such as optical fibers to transmit signals, radiowaves to transmit signals. We set the cost of attacking and defending each element in the graph to be 1. When the offensive and defensive resources are 2, 4, 6, 8, and 10, respectively, the number of strategies of attackers and defenders is shown in Table 4.Figure 4
The graph of the simulation experiment.Table 4
The number of strategies under different offensive and defensive resources.
246810The number of strategiesC112=55C114=330C116=462C118=165C1110=10From Table4, it can be seen that there are a large number of offensive and defensive strategies compared to previous studies. There are so many strategies in the small network in Figure 4, which is in line with the large scale of attack and defense in the 5G heterogeneous network environment.In this subsection, simulation experiments are performed to demonstrate the effectiveness of using intelligent computing to solve the Nash equilibrium. When the defense resources are 4 and 6, respectively, attack and defense experiments are performed ten times when the attack resources are 2, 4, 6, 8, and 10, respectively. A solution to mixed strategies is that optimal mixed strategy of every player must make the expected profit of another choosing different strategies the same. In other words, no single player can change the combination of strategies he adopts to increase his own profit.First of all, the defense balance strategy is found through ncPSO. Then, ten times attacks are randomly performed under the defense equilibrium strategy calculated by ncPSO, and the profit of attacker is calculated. The experimental results are shown in Tables5 and 6.Table 5
The attack profit when defense resource is 4 and attack resources are 2, 4, 6, 8, and 10, respectively.
12345678910AverageStd21.59391.57561.57761.61531.56231.57091.57611.58241.58591.57871.58190.014542.71612.70452.70132.68992.70412.69682.68702.69022.70262.70842.70010.009163.52473.52343.52403.53263.52763.52483.52923.52293.53093.51943.52590.004084.11954.12724.12714.11624.12164.12844.12254.11874.12724.12494.12330.0043104.75634.75614.75624.75644.75624.75594.75644.75614.75614.75654.75620.0002The bold values are the standard deviations of the ten experiments. The bolded data are used to show that ncPSO is effective in solving Nash equilibrium.Table 6
The attack profit when defense resource is 6 and attack resources are 2, 4, 6, 8, and 10, respectively.
12345678910AverageStd21.13811.15971.15631.16221.16361.14731.16291.16381.15441.16111.15690.008442.11602.11692.11362.12062.11882.11572.12382.12082.11832.11992.11840.003062.88212.88192.88102.87522.87502.87792.87872.88112.88092.87962.87930.002683.51713.51663.51263.51543.51443.51833.50453.51073.50873.51923.51370.0047104.09344.09324.09374.09314.09344.09394.09314.09374.09324.09304.09340.0003The bold values are the standard deviations of the ten experiments. The bolded data are used to show that ncPSO is effective in solving Nash equilibrium.The first row in Tables5 and 6 represents ten times random attacks, the average and standard deviation of these ten attacks. The first column in Tables 5 and 6 represents different attack resources. It can be seen from Tables 5 and 6 that under the condition of the same attack resources, the profit of the attacker is roughly the same in ten attacks. The values of the standard deviations of ten attacks are very small. The standard deviation indicates how spread out the data are. The smaller the standard deviation value, the smaller the difference between the data. The small standard deviation in the experimental results also indicates that the profit from ten attacks are approximately equal. This proves that using ncPSO to solve mixed-strategy Nash equilibrium is effective.


### 5.3. Losses of Defender under Different Attack and Defense Resources

In this subsection, simulation experiments are performed to discuss the losses of defender under different attack and defense resources. When the attack resources and defense resources are 2, 4, 6, 8, and 10, respectively, ten times simulation experiments are performed to calculate the losses of defender. Then the average and standard deviation of the losses of defender over ten experiments are calculated. The results of ten times experiments are shown in Table7.Table 7
The losses of defender under different attack and defense resources.
Defense resources246810AverageStdAverageStdAverageStdAverageStdAverageStdAttack resources2−2.10730.0296−1.58190.0145−1.15690.0084−0.71550.0021−0.24170.00034−3.34080.0121−2.70010.0091−2.11840.0030−1.37480.0011−0.48540.00016−4.20670.0119−3.52590.0040−2.87930.0026−1.97650.0011−0.73120.00028−4.71080.0068−4.12330.0043−3.51370.0047−2.47650.0017−0.96910.000210−4.98090.0001−4.75620.0002−4.09340.0003−3.00770.0018−1.21800.0003Table5 shows the defense losses obtained by using ncPSO to solve the Nash equilibrium under different attack and defense resources. The smaller standard deviation of each group of experiments indicates the stability of the experiment. The experimental results show that the more defense resources, the less defense loss of the defender. The more resources to attack, the greater the defense loss of the defender. At the same time, the experimental results show that when the offensive and defensive resources are equal and equal to about half of all the offensive and defensive resources, it is most unfavorable to the defender.


### 5.4. Strategies of Attacker and Defender with Different Defense Resources

In this section, the attack resource is fixed as 4, and the strategy selection of the attacker and the defender is discussed when the defense resource is 2, 4, 6, 8, and 10, respectively. In order to prevent the chance of the results, each group of experiments was carried out 10 times, and then the mean value was taken as the experimental result. After using ncPSO to calculate the mixed-strategy Nash equilibrium of both players of the game, we map it to the probability of attacking and defending each element to analyze the attack and defense behaviors. The experimental results are shown in Figure5.Figure 5
Experimental results under different defense resources. (a) Defense resources = 2. (b) Defense resources = 4. (c) Defense resources = 6. (d) Defense resources = 8. (e) Defense resources = 10.
(a)(b)(c)(d)(e)From subfigures a, b, and c, it can be seen that when there are fewer defensive resources, the defender will spend more resources on elements of higher importance. The attacker will attack less important elements to avoid the defense of defender to obtain a higher profit. As can be seen from subfigures d and e, when defense resources are sufficient, the defender will evenly allocate defense resources to each element. Because the attacker does not know the resource allocation of the defender, he will guess that the defender allocates most of the resources to the elements of high importance, so the attacker will still allocate the attack resources to the elements of lower importance.


### 5.5. Strategies of Attacker and Defender with Different Attack Resources

In this section, the defense resource is fixed as 4, and the strategy selection of the attacker and the defender is discussed when the attack resource is 2, 4, 6, 8, and 10, respectively. In order to prevent the chance of the results, each group of experiments was carried out 10 times, and then the mean value was taken as the experimental result. After using ncPSO to calculate the mixed-strategy Nash equilibrium of both players of the game, we map it to the probability of attacking and defending each element to analyze the attack and defense behaviors. The experimental results are shown in Figure6.Figure 6
Experimental results under different attack resources. (a) Attack resources = 2. (b) Attack resources = 4. (c) Attack resources = 6. (d) Attack resources = 8. (e) Attack resources = 10.
(a)(b)(c)(d)(e)As can be seen from subfigures a, b, and c, when there are few attack resources, the defender will allocate more defense resources to the elements with high importance, so that the attacker will attack the elements that allocate less defense resources to obtain profit successfully. As can be seen from subfigures d and e, when there are many attack resources, the attacker no longer considers the strategy choice of defender, but randomly attacks each element. In this case, the defender also distributes defense resources equally to defense each element.


### 5.6. Strategies of Attacker and Defender with Different Attack Resources in Another Network

In this subsection, the network scale is expanded, and a simulation experiment with 10 nodes and 19 elements is carried out. The experimental diagram is shown in Figure7. In this experiment, the defense resources are set to 15, and the attack resources are set to 5, 10, and 15, respectively. When the attack resources are set to 5, 10, and 15, the number of strategies from attacker is shown in Table 8. Compared with the network graph in Figure 4, although Figure 8 only increases a little network size, the attack and defense strategies increase a lot. The ncPSO is used to solve the Nash equilibrium of the game, and the probability of each element being attacked and defended is calculated. The average of 10 experimental results is taken to ensure the reliability of the experiment. The experimental results are shown in Figure 8.Figure 7
The graph of this simulation experiment.Table 8
The number of strategies under different attack resources.
51015The number of strategiesC195=11628C1910=92378C1915=3876Figure 8
Experimental results under different attack resources. (a) Attack resources = 5. (b) Attack resources = 10. (c) Attack resources = 15.
(a)(b)(c)As can be seen from the figure, the importance of the communication link cannot be ignored, and the importance of the communication link is not lower than that of the communication equipment. Figure8 shows that when the defense resource is 15 and the attack resource is 5, the defender will allocate resources evenly to deal with the attacks of attacker, and the attacker predicts that defender will allocates more resources to protect more important elements, so attacker will attack less important elements to obtain profit. When the defense resource is 15 and the attack resource is 15, the defender will select elements with higher importance to strengthen protection to reduce losses, and the attacker chooses the element that the defender allocates less defense resources to attack to maximize the benefit of benefit (see Table 9).


## 5.1. Performance Test Experiment of ncPSO and Other Algorithms

In this subsection, the performance of different algorithms is compared on 28 test functions of CEC2013. Different algorithms search for the minimum value on the test function. The smaller the function value found, the stronger the optimization ability of the algorithm. Each algorithm is run 20 times on each test function, and the mean of the 20 experimental data is taken as the final experimental result. In addition to the performance test experiments, this section also performs Wilcoxon signed rank sum test with significant levelα=0.05 on the test results to illustrate the validity of the experimental data. According to the relevant references of different algorithms, the parameter settings of different algorithms are shown in Table 2.Table 2
Parameter settings for different algorithms.
NameParameterncPSOD = 50; c1 = 2.0; c2 = 2.0;GAD = 50; N = 60; crossover rate = 0.01; mutation rate = 0.9PSOD = 50; N = 60; c1 = 1.0; c2 = 2.0WOAD = 50; N = 60; probability switch = 0.5BHD = 50; N = 60BAD = 50; N = 60; pulse rate = 0.5; loudness = 0.6; fmin = 0; fmax = 1SCAD = 50; N = 60; probability switch = 0.5In Table2, D represents the dimension of the problem, N represents the number of populations, and other parameters are unique to each algorithm and take values according to relevant references. The results of performance test experiments and rank sum verification are shown in Table 3. In Table 3, >,=,<, respectively, indicates that ncPSO has better, same, and worse optimization effects on the test function than other algorithms.Table 3
Experiment results of performance test and rank sum test.
GAPSOWOABHBASCAncPSOf11.63E + 05>−1.33E + 03>−1.34E + 03>−1.40E + 03=−1.39E + 03>2.91E + 04>−1.40E + 03f25.40E + 09>8.83E + 06>8.07E + 07>2.78E + 07>5.86E + 06>5.49E + 08>1.74E + 06f32.37E + 20>2.65E + 09>3.47E + 10>7.94E + 09>6.09E + 08<1.05E + 11>1.04E + 09f46.79E + 05>1.11E + 03<5.90E + 04<3.18E + 04<1.91E + 04<6.65E + 04<8.12E + 04f58.68E + 04>−9.76E + 02>−7.96E + 02>−9.01E + 02>−9.96E + 02>2.26E + 03>−1.00E + 03f62.78E + 04>−8.04E + 02>−6.79E + 02>−7.96E + 02>−8.28E + 02<1.12E + 03>−8.23E + 02f76.05E + 06>−6.76E + 02>9.12E + 02>−6.19E + 02>1.26E + 04>−5.81E + 02>−6.84E + 02f8−6.79E + 02=−6.79E + 02=−6.79E + 02=−6.79E + 02=−6.79E + 02=−6.79E + 02=−6.79E + 02f9−5.19E + 02>−5.44E + 02>−5.30E + 02>−5.31E + 02>−5.33E + 02>−5.26E + 02>−5.44E + 02f102.32E + 04>−4.43E + 02>−1.79E + 02>−4.67E + 02>−4.96E + 02>3.38E + 03>−4.99E + 02f112.17E + 03>5.13E + 01>4.10E + 02>4.33E + 02>7.43E + 02>3.31E + 02>−3.84E + 02f121.96E + 03>2.29E + 02<6.05E + 02>5.53E + 02>9.23E + 02>4.75E + 02>2.73E + 02f132.15E + 03>4.06E + 02>7.97E + 02>6.43E + 02>1.21E + 03>5.60E + 02>3.51E + 02f141.66E + 04>6.47E + 03>9.10E + 03>8.57E + 03>8.88E + 03>1.35E + 04>1.84E + 03f151.61E + 04>8.53E + 03<1.15E + 04>8.89E + 03<9.14E + 03<1.48E + 04>9.55E + 03f162.05E + 02>2.03E + 02>2.03E + 02>2.02E + 02>2.02E + 02>2.04E + 02>2.02E + 02f175.37E + 03>7.99E + 02>1.45E + 03>1.35E + 03>2.69E + 03>1.30E + 03>3.51E + 02f185.51E + 03>8.68E + 02<1.56E + 03>1.45E + 03>2.81E + 03>1.41E + 03>9.85E + 02f192.32E + 07>5.30E + 02>6.81E + 02>6.14E + 02>5.64E + 02>4.31E + 04>5.02E + 02f206.25E + 02=6.24E + 02=6.25E + 02=6.24E + 02=6.25E + 02=6.24E + 02=6.25E + 02f211.27E + 04>1.67E + 03>1.93E + 03>1.68E + 03>1.48E + 03<4.58E + 03>1.64E + 03f221.87E + 04>1.02E + 04>1.29E + 04>1.27E + 04>1.24E + 04>1.54E + 04>4.31E + 03f231.83E + 04>1.20E + 04<1.41E + 04>1.28E + 04<1.19E + 04<1.61E + 04>1.40E + 04f241.99E + 03>1.38E + 03>1.41E + 03>1.43E + 03>1.44E + 03>1.43E + 03>1.36E + 03f251.73E + 03>1.54E + 03<1.53E + 03>1.54E + 03<1.47E + 03<1.55E + 03>1.60E + 03f261.79E + 03>1.65E + 03>1.67E + 03>1.61E + 03>1.68E + 03>1.62E + 03>1.48E + 03f274.72E + 03>3.32E + 03<3.56E + 03>3.56E + 03>3.47E + 03>3.64E + 03>3.32E + 03f281.70E + 04>4.44E + 03<8.75E + 03>7.50E + 03>1.04E + 04>6.62E + 03>5.16E + 03>/ = /<26/2/018/2/824/2/221/3/418/3/724/2/2The last row of Table3 gives the number of better, the same, and worse performance of ncPSO compared to other algorithms in the 28 test functions. The experimental results in Table 3 show that ncPSO has the same optimization effect as all optimization algorithms on the two test functions f8 and f20. Compared with GA, ncPSO performs better than GA in other 26 test functions. Compared with PSO, ncPSO performs better than PSO on 18 test functions, but not as good as PSO on 8 test functions. Compared with WOA and SCA, ncPSO performs better than WOA and SCA on 24 test functions, but worse than WOA and SCA on f4 and f25. Compared with BH, ncPSO performs better than BH on 21 test functions, but not as good as BH on 4 test functions. Compared with BA, ncPSO performs better than BA on 18 test functions, but worse than BA on 7 test functions.In order to better show the optimization performance of the algorithms, 9 optimization process diagrams with obvious effects are selected for display in Figure3. After the algorithm iteration in each graph, the lower the curve, the stronger the optimization ability of the algorithm, and the faster the curve declines, the faster the convergence speed of the algorithm.Figure 3
Performance comparison between GA, PSO, WOA, BH, BA, SCA, and ncPSO. (a)f9. (b) f11. (c) f12. (d) f13. (e) f14. (f) f17. (g) f22. (h) f24. (i) f26.
(a)(b)(c)(d)(e)(f)(g)(h)(i)As can be seen in Figure3, ncPSO has better optimization performance and faster convergence speed than other algorithms in functions f9, f11, f13, f14, f17, f22, f24, and f26. On the function f12, ncPSO has worse optimization performance compared with PSO, but has better optimization performance than GA, WOA, BH, BA, and SCA.


## 5.2. Effectiveness of Solving Nash Equilibrium Using ncPSO

The graph that we use in the simulation experiment is shown in Figure4. Because a heterogeneous network of CPS is formed by various devices and different access technologies, the heterogeneous network of CPS is simplified as Figure 4. Each node in the diagram represents a terminal device in the network of CPS, such as terminal servers, mobile phones, sensors, and drones. Each edge in the graph represents a communication link in the network of CPS, such as optical fibers to transmit signals, radiowaves to transmit signals. We set the cost of attacking and defending each element in the graph to be 1. When the offensive and defensive resources are 2, 4, 6, 8, and 10, respectively, the number of strategies of attackers and defenders is shown in Table 4.Figure 4
The graph of the simulation experiment.Table 4
The number of strategies under different offensive and defensive resources.
246810The number of strategiesC112=55C114=330C116=462C118=165C1110=10From Table4, it can be seen that there are a large number of offensive and defensive strategies compared to previous studies. There are so many strategies in the small network in Figure 4, which is in line with the large scale of attack and defense in the 5G heterogeneous network environment.In this subsection, simulation experiments are performed to demonstrate the effectiveness of using intelligent computing to solve the Nash equilibrium. When the defense resources are 4 and 6, respectively, attack and defense experiments are performed ten times when the attack resources are 2, 4, 6, 8, and 10, respectively. A solution to mixed strategies is that optimal mixed strategy of every player must make the expected profit of another choosing different strategies the same. In other words, no single player can change the combination of strategies he adopts to increase his own profit.First of all, the defense balance strategy is found through ncPSO. Then, ten times attacks are randomly performed under the defense equilibrium strategy calculated by ncPSO, and the profit of attacker is calculated. The experimental results are shown in Tables5 and 6.Table 5
The attack profit when defense resource is 4 and attack resources are 2, 4, 6, 8, and 10, respectively.
12345678910AverageStd21.59391.57561.57761.61531.56231.57091.57611.58241.58591.57871.58190.014542.71612.70452.70132.68992.70412.69682.68702.69022.70262.70842.70010.009163.52473.52343.52403.53263.52763.52483.52923.52293.53093.51943.52590.004084.11954.12724.12714.11624.12164.12844.12254.11874.12724.12494.12330.0043104.75634.75614.75624.75644.75624.75594.75644.75614.75614.75654.75620.0002The bold values are the standard deviations of the ten experiments. The bolded data are used to show that ncPSO is effective in solving Nash equilibrium.Table 6
The attack profit when defense resource is 6 and attack resources are 2, 4, 6, 8, and 10, respectively.
12345678910AverageStd21.13811.15971.15631.16221.16361.14731.16291.16381.15441.16111.15690.008442.11602.11692.11362.12062.11882.11572.12382.12082.11832.11992.11840.003062.88212.88192.88102.87522.87502.87792.87872.88112.88092.87962.87930.002683.51713.51663.51263.51543.51443.51833.50453.51073.50873.51923.51370.0047104.09344.09324.09374.09314.09344.09394.09314.09374.09324.09304.09340.0003The bold values are the standard deviations of the ten experiments. The bolded data are used to show that ncPSO is effective in solving Nash equilibrium.The first row in Tables5 and 6 represents ten times random attacks, the average and standard deviation of these ten attacks. The first column in Tables 5 and 6 represents different attack resources. It can be seen from Tables 5 and 6 that under the condition of the same attack resources, the profit of the attacker is roughly the same in ten attacks. The values of the standard deviations of ten attacks are very small. The standard deviation indicates how spread out the data are. The smaller the standard deviation value, the smaller the difference between the data. The small standard deviation in the experimental results also indicates that the profit from ten attacks are approximately equal. This proves that using ncPSO to solve mixed-strategy Nash equilibrium is effective.


## 5.3. Losses of Defender under Different Attack and Defense Resources

In this subsection, simulation experiments are performed to discuss the losses of defender under different attack and defense resources. When the attack resources and defense resources are 2, 4, 6, 8, and 10, respectively, ten times simulation experiments are performed to calculate the losses of defender. Then the average and standard deviation of the losses of defender over ten experiments are calculated. The results of ten times experiments are shown in Table7.Table 7
The losses of defender under different attack and defense resources.
Defense resources246810AverageStdAverageStdAverageStdAverageStdAverageStdAttack resources2−2.10730.0296−1.58190.0145−1.15690.0084−0.71550.0021−0.24170.00034−3.34080.0121−2.70010.0091−2.11840.0030−1.37480.0011−0.48540.00016−4.20670.0119−3.52590.0040−2.87930.0026−1.97650.0011−0.73120.00028−4.71080.0068−4.12330.0043−3.51370.0047−2.47650.0017−0.96910.000210−4.98090.0001−4.75620.0002−4.09340.0003−3.00770.0018−1.21800.0003Table5 shows the defense losses obtained by using ncPSO to solve the Nash equilibrium under different attack and defense resources. The smaller standard deviation of each group of experiments indicates the stability of the experiment. The experimental results show that the more defense resources, the less defense loss of the defender. The more resources to attack, the greater the defense loss of the defender. At the same time, the experimental results show that when the offensive and defensive resources are equal and equal to about half of all the offensive and defensive resources, it is most unfavorable to the defender.


## 5.4. Strategies of Attacker and Defender with Different Defense Resources

In this section, the attack resource is fixed as 4, and the strategy selection of the attacker and the defender is discussed when the defense resource is 2, 4, 6, 8, and 10, respectively. In order to prevent the chance of the results, each group of experiments was carried out 10 times, and then the mean value was taken as the experimental result. After using ncPSO to calculate the mixed-strategy Nash equilibrium of both players of the game, we map it to the probability of attacking and defending each element to analyze the attack and defense behaviors. The experimental results are shown in Figure5.Figure 5
Experimental results under different defense resources. (a) Defense resources = 2. (b) Defense resources = 4. (c) Defense resources = 6. (d) Defense resources = 8. (e) Defense resources = 10.
(a)(b)(c)(d)(e)From subfigures a, b, and c, it can be seen that when there are fewer defensive resources, the defender will spend more resources on elements of higher importance. The attacker will attack less important elements to avoid the defense of defender to obtain a higher profit. As can be seen from subfigures d and e, when defense resources are sufficient, the defender will evenly allocate defense resources to each element. Because the attacker does not know the resource allocation of the defender, he will guess that the defender allocates most of the resources to the elements of high importance, so the attacker will still allocate the attack resources to the elements of lower importance.


## 5.5. Strategies of Attacker and Defender with Different Attack Resources

In this section, the defense resource is fixed as 4, and the strategy selection of the attacker and the defender is discussed when the attack resource is 2, 4, 6, 8, and 10, respectively. In order to prevent the chance of the results, each group of experiments was carried out 10 times, and then the mean value was taken as the experimental result. After using ncPSO to calculate the mixed-strategy Nash equilibrium of both players of the game, we map it to the probability of attacking and defending each element to analyze the attack and defense behaviors. The experimental results are shown in Figure6.Figure 6
Experimental results under different attack resources. (a) Attack resources = 2. (b) Attack resources = 4. (c) Attack resources = 6. (d) Attack resources = 8. (e) Attack resources = 10.
(a)(b)(c)(d)(e)As can be seen from subfigures a, b, and c, when there are few attack resources, the defender will allocate more defense resources to the elements with high importance, so that the attacker will attack the elements that allocate less defense resources to obtain profit successfully. As can be seen from subfigures d and e, when there are many attack resources, the attacker no longer considers the strategy choice of defender, but randomly attacks each element. In this case, the defender also distributes defense resources equally to defense each element.


## 5.6. Strategies of Attacker and Defender with Different Attack Resources in Another Network

In this subsection, the network scale is expanded, and a simulation experiment with 10 nodes and 19 elements is carried out. The experimental diagram is shown in Figure7. In this experiment, the defense resources are set to 15, and the attack resources are set to 5, 10, and 15, respectively. When the attack resources are set to 5, 10, and 15, the number of strategies from attacker is shown in Table 8. Compared with the network graph in Figure 4, although Figure 8 only increases a little network size, the attack and defense strategies increase a lot. The ncPSO is used to solve the Nash equilibrium of the game, and the probability of each element being attacked and defended is calculated. The average of 10 experimental results is taken to ensure the reliability of the experiment. The experimental results are shown in Figure 8.Figure 7
The graph of this simulation experiment.Table 8
The number of strategies under different attack resources.
51015The number of strategiesC195=11628C1910=92378C1915=3876Figure 8
Experimental results under different attack resources. (a) Attack resources = 5. (b) Attack resources = 10. (c) Attack resources = 15.
(a)(b)(c)As can be seen from the figure, the importance of the communication link cannot be ignored, and the importance of the communication link is not lower than that of the communication equipment. Figure8 shows that when the defense resource is 15 and the attack resource is 5, the defender will allocate resources evenly to deal with the attacks of attacker, and the attacker predicts that defender will allocates more resources to protect more important elements, so attacker will attack less important elements to obtain profit. When the defense resource is 15 and the attack resource is 15, the defender will select elements with higher importance to strengthen protection to reduce losses, and the attacker chooses the element that the defender allocates less defense resources to attack to maximize the benefit of benefit (see Table 9).


## 6. Conclusion

5G heterogeneous network of CPS is a more intelligent and open network system based on software defined network (SDN) and network function virtualization (NFV). The macro analysis of hacking behavior through game theory is an effective method to prevent hacking attacks. Therefore, we established a system model and a game model based on 5G heterogeneous networks of CPS, respectively. The solution of mixed-strategy Nash equilibrium in game models is the most important part of analyzing attack and defense behaviors. A ncPSO is proposed to solve the mixed-strategy Nash equilibrium and analyze the strategy choices of attacker and defender under different attack and defense resources through simulation experiments. Experiments demonstrate the effectiveness and superiority of the proposed ncPSO. The research in this paper provides a feasible macro analysis for defenders to defend against attacks of hacker.



---

*Source: 1181398-2022-11-07.xml*