Web honeypot system based on intelligent questions and answers

Abstract

The invention relates to a self-adaptive Web honeypot system based on an intelligent question and answer technology. The self-adaptive Web honeypot system is used for deep complete attack chain capture. An intelligent question-answering technology is utilized, the system is composed of three main algorithm models, question analysis is carried out on attacker messages based on an LSTM model of an attention mechanism, and key attack vectors in the attacker messages are extracted; dynamically generating deception feedback according to the attack vector based on a sensitive information counterfeiting model of the SeqGAN; the Web application learning model based on external observation uses an external observation mode to self-adaptively learn application features. According to the honeypot system, context semantics are used for replacing traditional honeypot spoofing, and generative intelligent question and answer response can be carried out.

Description

technical field [0001] The invention relates to an adaptive WEB honeypot system based on intelligent question answering technology, which is used for deep-level complete attack chain capture. Using intelligent question answering technology, the system is composed of three main algorithm models. The LSTM model based on the attention mechanism analyzes the attacker's message and extracts the key attack vectors; the sensitive information forgery model based on SeqGAN is dynamically generated according to the attack vector. Deception feedback; Web application learning model based on external observation uses external observation to adaptively learn application features. The honeypot system uses contextual semantics to replace traditional honeypot deception, and can generate intelligent question-answer responses. Background technique [0002] Cyberspace has become an important factor affecting national security, international relations, and the political landscape. The Internet...

AI Technical Summary

Problems solved by technology

However, there are still many deficiencies in existing research results and engineering practices. High-interaction honeypots can attract deeper attacks, but they have disadvantages such as high deployment risks and complex deployment configurations; low-interaction honeypots can be quickly deployed, but But it's just a simple response to the attack request

At this stage, the research on deception technology mainly focuses on the perspective of deception in the protocol stack, and lacks research on deception at the strategy level.

Images