Network defenders always face the problem of how to use limited resources to make the most reasonable decision. The network attack-defense game model is an effective means to solve this problem. However, existing network attack-defense game models usually assume that defenders will no longer change defense strategies after deploying them. However, in an advanced network attack-defense confrontation, defenders usually redeploy defense strategies for different attack situations. Therefore, the existing network attack-defense game models are challenging to accurately describe the advanced network attack-defense process. To address the above challenges, this paper proposes a defense strategy selection method based on the network attack-defense wargame model. We model the advanced network attack-defense confrontation process as a turn-based wargame in which both attackers and defenders can continuously adjust their strategies in response to the attack-defense posture and use the Monte Carlo tree search method to solve the optimal defense strategy. Finally, a network example is used to illustrate the effectiveness of the model and method in selecting the optimal defense strategy.

The key network node identification technology plays an important role in comprehending unknown terrains and rapid action planning in network attack and defense confrontation. The conventional key node identification algorithm only takes one type of relationship into consideration; therefore, it is incapable of representing the characteristics of multiple relationships between nodes. Additionally, it typically disregards the periodic change law of network node vulnerability over time. In order to solve the above problems, this paper proposes a network key node identification method based on the vulnerability life cycle and the significance of the network topology. Based on the CVSS score, this paper proposes the calculation method of the vulnerability life cycle risk value, and identifies the key nodes of the network based on the importance of the network topology. Finally, it demonstrates the effectiveness of the method in the selection of key nodes through network instance analysis.