The invention discloses a spoofing defense method for constructing a network dream based on follow-up transformation and cross-layer drowsiness, which takes a follow-up transformation
intelligent decision engine as a core, combines a high-
simulation trapping network with a preposed induction mechanism, implements
trapping and guiding on a real network side, implements transformation, stacking and
trapping in the trapping network, and realizes the spoofing defense of the network dream.
Attack paths and visible assets are continuously evolved along with
attack behaviors, a dynamically evolved and multi-layer progressive network dream environment is constructed, and aiming at the problems that bait is static, follow-
up conversion is difficult, depth defense is insufficient and the like in traditional trapping defense, continuous strategy-driven dynamic adjustment is carried out on a topological structure and bait service in a controlled
simulation environment, so that the
attack path and the visible assets are continuously evolved. According to the method, the
residence time of an attacker in a trapping environment is prolonged, the
attack cost is remarkably improved, an attack behavior chain is completely collected, support is provided for follow-up attack
traceability and deep defense optimization, and therefore the sustainable evolution systematic deception defense capability is achieved.