Design method of deception defense system based on heterogeneous fusion

Abstract

The invention relates to the technical field of network security, and discloses a deception defense system design method based on heterogeneous fusion, and the method comprises the steps: receiving a network access request sent by a client, carrying out the recognition of the network access request through an attack recognition model, and obtaining a recognition result, wherein the attack recognition model comprises a data processing module and an attack recognition module; when the network access request in the identification result is identified as a normal request, forwarding the network access request to the simulation model; when the network access request in the recognition result is recognized as an attack operation request for service target defect utilization, key parameters and loads are extracted from attack operation to automatically initialize a remote control execution environment, and then an attack behavior is redirected to a high-interaction remote control execution environment unit to be executed; according to the method, automatic and intelligent simulation of a complex service system is realized, deep trapping of highly-hidden unknown attacks is formed, and the problem that highly-hidden unknown network attack threats are difficult to find and capture can be effectively solved.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a deception defense system design method based on heterogeneous fusion. Background Art

[0002] Deception defense (commonly known as honeypot) technology has made great progress in recent years. It is an emerging network security defense tactic based on the idea of ​​attack and defense confrontation, allowing defenders to observe the behavior of attackers. In particular, as attack and defense drills are carried out regularly in various industries, honeypot products are widely used to build a deception defense system in attack and defense confrontation, realize active defense against attacks, and enable defenders to achieve good results in attack and defense drills.

[0003] Honeypot technology is essentially a deception defense technology. By placing some hosts, network services or information as bait, it can induce attackers to access and attack them. In this way, the attack behavior can be captured and analyzed, the tools and methods used by the attackers can be understood, and the attack intentions and technical means can be identified, thereby achieving security protection through technical and management means.

[0004] Although honeypot products have been widely used, the core capabilities of honeypot technology such as business system simulation, attack trapping, threat analysis, and traceability evidence collection still require a lot of manual operation when applied. The lack of intelligent and automated methods has resulted in high technical difficulty and workload in the deployment and application of honeypots, which has seriously restricted the further promotion and application of honeypots. At the same time, in recent years, the use of machine learning methods, especially the latest large models, has demonstrated outstanding knowledge mining, reasoning, planning, question-answering and other capabilities, fully demonstrating the infinite possibilities of artificial intelligence.

[0005] By adopting machine learning methods and large models, we can solve the key capabilities of honeypot products in system simulation, attack trapping, threat analysis, etc., realize intelligent and automated honeypot applications, fully reduce the level of manual intervention in product applications, greatly improve product utilization efficiency, and is also the key to product expansion to 5G, industrial control, Internet of Things, medical equipment networks, etc.

[0006] The main problems of current honeypot products are as follows:

[0007] When the honeypot is deployed on-site, engineers need to investigate the network topology of on-site users and detailed information on assets in the network, including the operating system, software and hardware information, database, business system protocols, port information, etc., and then create and save them one by one based on the hardware resource situation of the honeypot; because the business system feature identification is mainly based on manual investigation and manual simulation, the feature analysis of the business system is low and unstable, and the analysis efficiency is low. Generally, it takes 3-7 man-days to identify the business system of a thousand-point device network, and the adequacy of the business system feature analysis is less than 70%.

[0008] In the daily use of honeypots, when a large number of network attacks against certain specific business systems are discovered, due to the limited hardware resources of the honeypot, on-site engineers need to manually adjust the honeypot network, shut down some simulation nodes for other systems to save hardware resources, and open more simulation nodes for the attacked business systems to achieve a higher capture rate, thereby obtaining more comprehensive attack information to achieve tracing and countermeasures. Since the adjustment operation is mainly performed manually, the response time is generally more than 1 day, which cannot meet the hour-level response requirements for major attack incidents. Summary of the invention

[0009] The purpose of the present invention is to solve the above problems and to design a deception defense system design method based on heterogeneous fusion.

[0010] The present invention provides a deception defense system design method based on heterogeneous fusion, and the deception defense system design method based on heterogeneous fusion comprises the following steps:

[0011] Receive a network access request sent by a client, and identify the network access request through an attack identification model to obtain an identification result, wherein the attack identification model includes two modules: a data processing module and an attack identification module;

[0012] When the network access request in the identification result is identified as a normal request, it is forwarded to the simulation model, wherein the simulation model is built based on the AI ​​big model and provides a response to the normal service request;

[0013] When the network access request in the identification result is identified as an attack operation request for exploiting a business target defect, key parameters and payload are first extracted from the attack operation to automatically initialize the remote control execution environment, and then the attack behavior is redirected to the high-interaction remote control execution environment unit for execution, wherein the high-interaction remote control execution environment unit provides responses to operation requests related to defect or vulnerability exploitation.

[0014] Optionally, in a first implementation of the present invention, receiving a network access request sent by a client, and identifying the network access request by using an attack identification model includes:

[0015] receiving a network access request, inputting the network access request into the attack identification model, and performing data cleaning on the network access request using the data processing module, wherein the data cleaning includes missing value processing and deduplication processing;

[0016] One-hot encoding is used to perform feature encoding on the network access request after data cleaning, and the string feature of the network access request is converted into 0 / 1 encoding;

[0017] Sum the One-Hot encoding of the network access request:

[0018]

[0019] Among them, C represents the window size, x i Represents the One-Hot encoding of the i-th string;

[0020] Take the maximum and minimum values ​​of the One-Hot encoding summation result and normalize the summation result:

[0021]

[0022] Among them, x represents the summation result of One-Hot encoding, x norm represents the normalized result, x max and x min Represent the maximum and minimum values ​​respectively;

[0023] The network access request processed by the data processing module is transmitted to the attack identification module for identification to obtain an identification result.

[0024] Optionally, in a second implementation of the present invention, transmitting the network access request processed by the data processing module to the attack identification module for identification to obtain an identification result includes:

[0025] According to the isolation forest algorithm, multiple isolated trees are constructed, and the path length of each isolated tree is calculated. According to the calculation results on each isolated tree, the average path length is normalized to obtain the abnormal score value:

[0026] s(x,n)=2 -E(h(x)) / c(n)

[0027] Wherein, s(x, n) represents the abnormal score value, E(h(x)) represents the expected path length of the sample point x in all isolated trees in the isolation forest in the network access request processed by the data processing module, and c(n) represents the average path length;

[0028] Using the LOF algorithm to calculate the local anomaly factor of the sample point in the network access request processed by the data processing module, and normalizing the calculated local anomaly factor;

[0029] The calculated anomaly score and the normalized local anomaly factor are weightedly fused, and the fusion score is judged using the Raida criterion to obtain the recognition result.

[0030] Optionally, in a third implementation of the present invention, the attack identification module is constructed by an isolation forest algorithm, and its construction method includes the following steps:

[0031] Use historical access requests as training data sets, randomly select a feature f from all features of the current node, and randomly select a value v within the value range of feature f as a split point.

[0032] According to the split point v, the training data set is divided into two parts: samples with feature f values ​​less than v enter the left child node; samples with feature f values ​​greater than f enter the right child node;

[0033] Repeat the feature selection, segmentation point selection and sub-node division process for the two subsets after segmentation until the maximum depth is reached or the data volume is 1, generating multiple isolated trees.

[0034] Optionally, in a fourth implementation of the present invention, when the network access request in the identification result is identified as a normal request, forwarding it to the simulation model includes:

[0035] Copying a network access request determined to be normal, and using traffic mirroring technology to capture all network communication data related to the network access request, wherein the network communication data at least includes a request message and an expected response message;

[0036] The captured network communication data is input into the business target simulation model based on the T5 large model, and the simulation model is used to generate highly simulated response data according to the network access request, and the response data generated by the simulation model is returned to the client.

[0037] Optionally, in a fifth implementation of the present invention, when the network access request in the identification result is identified as an attack operation request for exploiting a service target defect, firstly extracting key parameters and payload from the attack operation to automatically initialize the remote control execution environment, and then redirecting the attack behavior to the high-interaction remote control execution environment unit for execution, including:

[0038] When the network access request in the identification result is identified as an attack operation request for exploiting a service target defect, the identification result is notified to a high-interaction configuration parameter generator, and the generator processes parameter information of the network access request, determines a high-interaction model modeling parameter, and sends the parameter to a high-interaction remote control execution environment unit to generate a high-interaction model;

[0039] When the high-interaction remote control execution environment unit receives the high-interaction modeling parameters, it creates a corresponding real high-interaction environment and redirects the attack to this high-interaction environment. The remote control execution environment records the running status data and various attack operation behaviors, and based on the ATT&CK model, performs attack chain restoration and full-process attack map drawing, where the map content includes attack trajectory identification, attack payload extraction, TTP profiling, etc.

[0040] Optionally, in a sixth implementation of the present invention, the attack chain restoration and the drawing of the whole attack process map based on the ATT&CK model include:

[0041] Map the detected attack operation requests to the ATT&CK model, classify and label the tactics and techniques in the ATT&CK framework, and analyze the tools and vulnerability exploits used by attackers for each mapped technique.

[0042] Obtain log data and build a timeline of events based on the timestamps of the log data, display the attacker's actions in chronological order, connect each attack link in the order of technology, and form a map of the entire process.

[0043] Optionally, in a seventh implementation of the present invention, the ATT&CK model is improved by using agglomerative hierarchical clustering, including the following steps:

[0044] Initialize an empty list p, set the number of clusters k to 2-100, use a hierarchical clustering algorithm to generate a first tree structure for the data in the network access request, and truncate the first tree structure according to the number of clusters k to obtain a first truncation height;

[0045] Set the variable to 1-100 and use Bernoulli distribution to generate a random data set, where the random data set has the same variance as the data in the network access request;

[0046] Using a hierarchical clustering algorithm to generate a second tree structure for the random data set, and truncating the second tree structure according to the number of clusters k to obtain a second truncation height;

[0047] Determine the number of values ​​whose second cutoff height is less than or equal to the first cutoff height, and store the values ​​that meet the requirement into a list p, until the first value less than 0.05 is found, and the corresponding number of clusters is obtained.

[0048] In the technical solution provided by the present invention, a network access request sent by a client is received, and the network access request is identified by an attack identification model to obtain an identification result, wherein the attack identification model includes two modules: a data processing module and an attack identification module; when the network access request in the identification result is identified as a normal request, it is forwarded to a simulation model; when the network access request in the identification result is identified as an attack operation request for exploiting a business target defect, key parameters and payloads are first extracted from the attack operation to automatically initialize the remote control execution environment, and then the attack behavior is redirected to a high-interaction remote control execution environment unit for execution; the present invention realizes automated and intelligent simulation of complex business systems, forms deep trapping for highly concealed unknown attacks, can effectively solve the problem that highly concealed unknown network attack threats are difficult to discover and capture, deeply traps highly concealed unknown network attacks, further improves the cognition and control of unknown attacks, and adopts an AI method to build, which greatly improves the automation, intelligent deployment, and application capabilities of honeypots, effectively reduces the technical threshold and workload of system promotion, thereby greatly improving the economic benefits of technology applications. BRIEF DESCRIPTION OF THE DRAWINGS

[0049] Various other advantages and benefits will become apparent to those of ordinary skill in the art by reading the following detailed description of the preferred embodiment.The drawings are only for the purpose of illustrating the preferred embodiments and are not to be construed as limiting the invention.

[0050] Figure 1 A first schematic diagram of a deception defense system design method based on heterogeneous fusion provided by an embodiment of the present invention;

[0051] Figure 2 A second schematic diagram of a method for designing a deception defense system for remote printing based on heterogeneous fusion provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0052] The terms "first", "second", "third", "fourth", etc. (if any) in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments described herein can be implemented in an order other than that illustrated or described herein. In addition, the terms "including" or "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, device, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0053] For ease of understanding, the specific process of the embodiment of the present invention is described below. Figure 1-Figure 2 A schematic diagram of a deception defense system design method based on heterogeneous fusion provided in an embodiment of the present invention. The deception defense system design method based on heterogeneous fusion designed in the present invention is an intelligent and automated simulation technology for deception defense, which solves two key scientific problems: "the problem of being difficult to simulate when facing highly complex business scenarios and dynamic business behavior characteristics" and "the problem that the deception trap network can only be adjusted manually when facing attacks, resulting in high resource usage and low network adjustment efficiency."

[0054] The deception defense system design method based on heterogeneous fusion designs two heterogeneous units, namely, a simulation model unit and a high-interaction remote control execution environment, and a front-end attack identification unit, a total of three units. The deception defense system design method based on heterogeneous fusion specifically includes the following steps:

[0055] Receive a network access request sent by a client, and identify the network access request through an attack identification model to obtain an identification result, wherein the attack identification model includes two modules: a data processing module and an attack identification module;

[0056] When the network access request in the identification result is identified as a normal request, it is forwarded to the simulation model, where the simulation model is built based on the AI ​​big model to provide a response to the normal business request;

[0057] When a network access request is identified in the recognition result as an attack operation request for exploiting a business target defect, the key parameters and payload are first extracted from the attack operation to automatically initialize the remote control execution environment, and then the attack behavior is redirected to the high-interaction remote control execution environment unit for execution, where the high-interaction remote control execution environment unit provides responses to operation requests related to defect or vulnerability exploitation.

[0058] In this embodiment, from the attacker's perspective, the business target and real business system constructed by heterogeneous fusion can achieve a realistic effect in terms of business operation response and defect or vulnerability exploitation.

[0059] In this embodiment, a network access request is received, the network access request is input into the attack identification model, and a data processing module is used to clean the network access request, wherein the data cleaning includes missing value processing and deduplication processing; One-Hot coding is used to perform feature coding on the cleaned network access request, and the string feature of the network access request is converted into 0 / 1 coding; and the One-Hot coding of the network access request is summed:

[0060]

[0061] Among them, C represents the window size, x iRepresents the One-Hot encoding of the i-th string;

[0062] Take the maximum and minimum values ​​of the One-Hot encoding summation result and normalize the summation result:

[0063]

[0064] Among them, x represents the summation result of One-Hot encoding, x norm represents the normalized result, x max and x min Represent the maximum and minimum values ​​respectively;

[0065] The network access request processed by the data processing module is transmitted to the attack identification module for identification to obtain the identification result.

[0066] In this embodiment, multiple isolated trees are constructed according to the isolation forest algorithm, and the path length of each isolated tree is calculated. According to the calculation results on each isolated tree, the average path length is normalized to obtain the abnormal score value:

[0067] s(x,n)=2 -E(h(x)) / c(n)

[0068] Among them, s(x, n) represents the anomaly score value, E(h(x)) represents the expected path length of the sample point x in the network access request processed by the data processing module in all isolated trees in the isolation forest, and c(n) represents the average path length; the LOF algorithm is used to calculate the local anomaly factor of the sample point in the network access request processed by the data processing module, and the calculated local anomaly factor is normalized; the calculated anomaly score and the normalized local anomaly factor are weightedly fused, and the obtained fusion score is judged by the Raida criterion to obtain the recognition result.

[0069] In this embodiment, data cleaning mainly focuses on two aspects: missing value processing and duplicate data processing. Missing value processing is because the collected traffic data may be missing some characteristic attributes. In order to ensure the stable operation of the program in the subsequent modeling and prediction process, the missing characteristic attributes are filled with default values. Duplicate data processing mainly considers the retransmission of sessions. In order to ensure the accuracy of model training, deduplication operations are performed.

[0070] Feature encoding uses two methods: One-Hot and normalization. One-Hot is mainly used for data flattening, converting string features into 0 / 1 encoding; normalization mainly considers the difference in the numerical range between features, so that model training will not be biased towards features with a larger range.

[0071] In this embodiment, historical access requests are used as training data sets, a feature f is randomly selected from all features of the current node, a value v is randomly selected within the value range of feature f as a split point, and the training data set is divided into two parts according to the split point v: samples with feature f values ​​less than v enter the left child node; samples with feature f values ​​greater than f enter the right child node; feature selection, split point selection and child node division are repeated for the two subsets after segmentation until the maximum depth is reached or the data volume is 1, generating multiple isolated trees.

[0072] In this embodiment, a copy of the network access request determined to be normal is made, and traffic mirroring technology is used to capture all network communication data related to the network access request, where the network communication data at least includes a request message and an expected response message; the captured network communication data is input into a business target simulation model based on the T5 large model, and the simulation model is used to generate highly simulated response data according to the network access request, and the response data generated by the simulation model is returned to the client.

[0073] In this embodiment, the simulation model design obtains the request and response data of the core business interaction interface of the business system through the traffic mirror data, and constructs a data set for model training; designs a business target simulation modeling method of generative artificial intelligence, combines the characteristics of industry scenarios and business dynamic behavior characteristics, and designs a knowledge graph suitable for business targets; generates a simulation model of the business system by learning and modeling the interactive data set of the business system, and the same request can output highly simulated response data of the original business system through the simulation model, automatically realizing intelligent simulation of the business system; business target simulation model design: adopts the T5 (Text-to-Text Transfer Transformer) large model, the T5 large model processes all natural language processing tasks as "text to text" conversion, and the main architecture is in the form of "encoder-decoder", in which the encoder and decoder both contain multi-layer Transformer modules; business target simulation model training data set design: by capturing the traffic mirror data to obtain the request and response data of the core business interaction interface of the business system to construct a business system access interaction data set, the data is cleaned to generate the original document set and vector database, and at the same time, the model knowledge base is constructed based on artificial experience; business target simulation model training design: training includes two stages: pre-training and fine-tuning. In the pre-training phase, unlabeled text data is used for training to learn general language representation. In the fine-tuning phase, labeled data of specific tasks is used in combination with the knowledge base for fine-tuning, thereby achieving performance improvement based on specific business systems.

[0074] In this embodiment, when the network access request in the identification result is identified as an attack operation request for exploiting a business target defect, the identification result is notified to the high-interaction configuration parameter generator, the generator processes the parameter information of the network access request, determines the high-interaction modeling parameters, and sends them to the high-interaction remote control execution environment unit to generate a high-interaction model; when the high-interaction remote control execution environment unit receives the high-interaction modeling parameters, it creates a corresponding real high-interaction environment and redirects the attack to this high-interaction environment. The remote control execution environment records the running status data and various attack operation behaviors, and based on the ATT&CK model, performs attack chain restoration and full attack process map drawing, where the map content includes attack trajectory identification, attack payload extraction, TTP profiling, etc.

[0075] In this embodiment, the detected attack operation request is mapped to the ATT&CK model, and the tactics and techniques in the ATT&CK framework are classified and labeled. For each mapped technology, the tools and vulnerability exploitation methods used by the attacker are analyzed; log data is obtained, and a timeline of events is established based on the timestamp of the log data, showing the attacker's action trajectory in chronological order, and connecting each attack link in the order of technology to form a full process map.

[0076] In this embodiment, an empty list p is initialized, the number of clusters k is set to 2-100, a hierarchical clustering algorithm is used to generate a first tree structure for the data in the network access request, and the first tree structure is truncated according to the number of clusters k to obtain a first truncation height; the variable is set to 1-100, and a random data set is generated using a Bernoulli distribution, wherein the random data set has the same variance as the data in the network access request; a second tree structure is generated for the random data set using a hierarchical clustering algorithm, and the second tree structure is truncated according to the number of clusters k to obtain a second truncation height; the number of values ​​whose second truncation height is less than or equal to the first truncation height is determined, and the values ​​that meet the requirements are stored in the list p until the first value less than 0.05 is found, and the corresponding number of clusters is obtained.

[0077] In this embodiment, the attack behavior pattern model is modeled based on the common attack features of WEB-type business systems, and attack behaviors such as webshell are identified based on the model, and key parameters and attack payloads in webshell attack operations are extracted; a typical high-interaction remote control execution environment is designed, including PHP, JSP, ASP and other high-interaction remote control execution environments, and an environment initialization function is designed. The environment can be quickly initialized based on webshell parameters and attack payloads, so that the webshell attack payload uploaded by the attacker can run normally in the matching environment; when the attacker performs an attack operation on the business target, the normal request Use the simulation model to respond, extract key parameters and payloads from the attack operations to automatically initialize the remote control execution environment for attack operations such as webshells that exploit business target defects, and redirect the attack behavior to the high-interaction remote control execution environment for execution and response; when the customer network node scale is calculated according to the scale of 10,000 points, the mirror traffic of the network core interaction is generally 5Gbps. Compared with the manual simulation method of the traditional honeypot, the business network simulation workload is not less than 3 man-days, and the simulation degree is <60%; the business network simulation of the present invention is <90s, and for the simulation degree>80%, the high-interaction remote control execution environment unit generation speed is <30s. The actual attack event capture rate is >90%.

[0078] Through the implementation of the above scheme, automation and intelligent simulation of complex business systems can be achieved, and deep trapping of highly concealed unknown attacks can be formed; the present invention can effectively solve the problem that highly concealed unknown network attack threats are difficult to discover and capture; highly concealed unknown network attacks are deeply trapped, and the cognition and control of unknown attacks are further improved; the present invention is constructed using AI methods, which greatly improves the automation, intelligent deployment and application capabilities of honeypots, effectively reduces the technical threshold and workload of system promotion, thereby greatly improving the economic benefits of technology applications.

[0079] The above shows and describes the basic principles, main features and advantages of the present invention. Those skilled in the art should understand that the present invention is not limited by the above embodiments. The above embodiments and descriptions are only preferred examples of the present invention and are not intended to limit the present invention. Without departing from the spirit and scope of the present invention, the present invention may have various changes and improvements, which fall within the scope of the present invention. The scope of protection of the present invention is defined by the attached claims and their equivalents.

Claims

1. A deception defense system design method based on heterogeneous fusion, characterized in that: The deception defense system design method based on heterogeneous fusion includes the following steps: Receive a network access request sent by a client, and identify the network access request through an attack identification model to obtain an identification result, wherein the attack identification model includes two modules: a data processing module and an attack identification module; When the network access request in the identification result is identified as a normal request, it is forwarded to the simulation model, wherein the simulation model is built based on the AI ​​big model and provides a response to the normal service request; When the network access request in the identification result is identified as an attack operation request for exploiting a business target defect, key parameters and payload are first extracted from the attack operation to automatically initialize the remote control execution environment, and then the attack behavior is redirected to the high-interaction remote control execution environment unit for execution, wherein the high-interaction remote control execution environment unit provides responses to operation requests related to defect or vulnerability exploitation.

2. A deception defense system design method based on heterogeneous fusion as claimed in claim 1, characterized in that: Receiving a network access request sent by a client, and identifying the network access request through an attack identification model, including: receiving a network access request, inputting the network access request into the attack identification model, and performing data cleaning on the network access request using the data processing module, wherein the data cleaning includes missing value processing and deduplication processing; One-hot encoding is used to perform feature encoding on the network access request after data cleaning, and the string feature of the network access request is converted into 0 / 1 encoding; Sum the One-Hot encoding of the network access request: Among them, C represents the window size, x i Represents the One-Hot encoding of the i-th string; Take the maximum and minimum values ​​of the One-Hot encoding summation result and normalize the summation result: Among them, x represents the summation result of One-Hot encoding, x norm represents the normalized result, x max and x min Represent the maximum and minimum values ​​respectively; The network access request processed by the data processing module is transmitted to the attack identification module for identification to obtain an identification result.

3. A deception defense system design method based on heterogeneous fusion as claimed in claim 1, characterized in that: The transmitting the network access request processed by the data processing module to the attack identification module for identification to obtain an identification result includes: According to the isolation forest algorithm, multiple isolated trees are constructed, and the path length of each isolated tree is calculated. According to the calculation results on each isolated tree, the average path length is normalized to obtain the abnormal score value: s(x,n)=2 -E(h(x)) / c(n) Wherein, s(x,n) represents the abnormal score value, E(h(x)) represents the expected path length of the sample point x in all isolated trees in the isolation forest in the network access request processed by the data processing module, and c(n) represents the average path length; Using the LOF algorithm to calculate the local anomaly factor of the sample point in the network access request processed by the data processing module, and normalizing the calculated local anomaly factor; The calculated anomaly score and the normalized local anomaly factor are weightedly fused, and the fusion score is judged using the Raida criterion to obtain the recognition result.

4. A deception defense system design method based on heterogeneous fusion as claimed in claim 3, characterized in that: The attack identification module is constructed by an isolation forest algorithm, and its construction method includes the following steps: Use historical access requests as training data sets, randomly select a feature f from all features of the current node, and randomly select a value v within the value range of feature f as a split point. According to the split point v, the training data set is divided into two parts: samples with feature f values ​​less than v enter the left child node; samples with feature f values ​​greater than f enter the right child node; Repeat the feature selection, segmentation point selection and sub-node division process for the two subsets after segmentation until the maximum depth is reached or the data volume is 1, generating multiple isolated trees.

5. The method for designing a deception defense system based on heterogeneous fusion according to claim 1, characterized in that: When the network access request in the identification result is identified as a normal request, forwarding it to the simulation model includes: Copying a network access request determined to be normal, and using traffic mirroring technology to capture all network communication data related to the network access request, wherein the network communication data at least includes a request message and an expected response message; The captured network communication data is input into the business target simulation model based on the T5 large model, and the simulation model is used to generate highly simulated response data according to the network access request, and the response data generated by the simulation model is returned to the client.

6. A deception defense system design method based on heterogeneous fusion as claimed in claim 1, characterized in that: When the network access request in the identification result is identified as an attack operation request for exploiting a service target defect, firstly extract key parameters and payload from the attack operation to automatically initialize the remote control execution environment, and then redirect the attack behavior to the high-interaction remote control execution environment unit for execution, including: When the network access request in the identification result is identified as an attack operation request for exploiting a service target defect, the identification result is notified to a high-interaction configuration parameter generator, and the generator processes parameter information of the network access request, determines a high-interaction model modeling parameter, and sends the parameter to a high-interaction remote control execution environment unit to generate a high-interaction model; When the high-interaction remote control execution environment unit receives the high-interaction modeling parameters, it creates a corresponding real high-interaction environment and redirects the attack to this high-interaction environment. The remote control execution environment records the running status data and various attack operation behaviors, and based on the ATT&CK model, performs attack chain restoration and full-process attack map drawing, where the map content includes attack trajectory identification, attack payload extraction, TTP profiling, etc.

7. A deception defense system design method based on heterogeneous fusion as claimed in claim 6, characterized in that: The attack chain restoration and the whole attack process map drawing based on the ATT&CK model include: Map the detected attack operation requests to the ATT&CK model, classify and label the tactics and techniques in the ATT&CK framework, and analyze the tools and vulnerability exploits used by attackers for each mapped technique. Obtain log data and build a timeline of events based on the timestamps of the log data, display the attacker's actions in chronological order, connect each attack link in the order of technology, and form a map of the entire process.

8. A deception defense system design method based on heterogeneous fusion as claimed in claim 7, characterized in that: The ATT&CK model is improved using agglomerative hierarchical clustering, including the following steps: Initialize an empty list p, set the number of clusters k to 2-100, use a hierarchical clustering algorithm to generate a first tree structure for the data in the network access request, and truncate the first tree structure according to the number of clusters k to obtain a first truncation height; Set the variable to 1-100 and use Bernoulli distribution to generate a random data set, where the random data set has the same variance as the data in the network access request; Using a hierarchical clustering algorithm to generate a second tree structure for the random data set, and truncating the second tree structure according to the number of clusters k to obtain a second truncation height; Determine the number of values ​​whose second cutoff height is less than or equal to the first cutoff height, and store the values ​​that meet the requirement into a list p, until the first value less than 0.05 is found, and the corresponding number of clusters is obtained.

Images