Network attack protection method fusing large model and honeypot technology

Abstract

The invention discloses a network attack protection method integrating a large model and a honeypot technology, and belongs to the field of information security. The problems that an existing network attack protection method lacks dynamic response capability and is poor in network attack protection performance when facing complex attacks are solved. The method comprises the following steps: collecting interaction data generated in an operation process of a to-be-protected system; performing data desensitization to generate a desensitized data set; based on the desensitization data set, utilizing a LoRA fine tuning method to perform fine tuning on a pre-trained large model to obtain a generative honeypot large model; the method comprises the following steps: deploying a honeypot environment in a Docker container, and constructing a honeypot system based on large model service in combination with an Ollan platform; creating a honeypot system configuration file according to the configuration information of the real system, and simulating system services and ports; attacks are attracted, when an attack instruction is received, the honeypot system based on the large model service generates a false response, and one-time response to an attack request of an attacker is completed. The method is suitable for network protection.

Description

Technical Field

[0001] The invention belongs to the field of information security. Background Art

[0002] With the accelerating digital transformation of various industries, modern network environments are becoming increasingly complex and facing diverse cybersecurity threats. Various smart devices, sensors, and control systems are interconnected via the internet, forming a complex IoT environment. While this interconnectedness greatly improves system efficiency and flexibility, it also provides new attack vectors for malicious attackers. For example, distributed denial of service (DDoS) attacks, SQL injection, and cross-site scripting (XSS) attacks are frequently used to disrupt the normal operation of information systems, potentially leading to service disruptions in critical infrastructure or the leakage of sensitive data. Furthermore, advanced persistent threats (APTs) targeting critical infrastructure are increasing. These threats are often highly covert and targeted, aiming to steal confidential information, damage national infrastructure, or disrupt public services. Their complexity and persistence make traditional security mechanisms difficult to effectively address.

[0003] To address these challenges, honeypots have become widely used as a defensive strategy to lure attackers. Honeypots simulate real-world system environments and services, attracting attackers to interact with them. This allows them to record and analyze attack behavior, ensuring the security of the actual system while providing data support for security analysis and threat attribution. However, traditional honeypot technology has limitations. Small honeypots, due to limited resources, offer limited functionality and interaction capabilities, making them easily exploited by experienced attackers. Large honeypots, while powerful, are costly and complex to deploy. Once compromised, they can serve as a springboard for attackers to further infiltrate other systems. Medium-sized honeypots fall somewhere in between, offering a balance between functionality and deployment difficulty, but remain insufficient against complex attacks. Overall, traditional honeypot systems rely on static datasets and pre-set response rules, lacking dynamic adjustment capabilities and difficulty simulating complex system behavior. This results in limited deception and defensive effectiveness against complex attack scenarios such as advanced persistent threats. Summary of the Invention

[0004] The present invention aims to address the problem that existing network attack protection methods lack dynamic response capabilities and poor network attack protection when facing complex attacks. A network attack protection method that integrates large models and honeypot technology is now provided.

[0005] The network attack protection method of the present invention, which integrates a large model and honeypot technology, includes:

[0006] Step 1: Collect interaction data generated during the operation of the protection system to be protected; and use a layered multi-model collaborative mechanism to identify sensitive data on the real system interaction data and desensitize the real system interaction data to generate a desensitized data set;

[0007] Step 2: Based on the desensitized dataset, the pre-trained large model is fine-tuned using the LoRA fine-tuning method to obtain a generative honeypot large model;

[0008] Step 3: Deploy the honeypot environment in a Docker container to form a honeypot system, and deploy the generative honeypot large model in the Ollama platform. The honeypot system uses the OpenAI library to request data interaction from the honeypot large model on Ollama, thus building a honeypot system based on the large model service.

[0009] Step 4: Create a honeypot system configuration file based on the configuration information of the real system, and deploy the honeypot system configuration file in the honeypot system based on the large model service by file mounting, so that the honeypot system simulates system services and ports using the configuration file;

[0010] Step 5. Open the honeypot system service and port described in step 4 to attract attacks. When receiving an attack command, the honeypot system uses the thinking chain prompt to combine the question and answer data of the honeypot large model during the current attacker's historical attack process to obtain the questions raised by the current attack to the honeypot large model. After analysis by the honeypot large model, the response data of the attack is obtained and transmitted, completing a response to the attacker's attack request.

[0011] Furthermore, in the present invention, in step 1, the interactive data generated by the protection system during operation includes request data and response data; the request data includes a request protocol, a request instruction, request parameters, and a request method;

[0012] The response data is the response data made by the system in response to the user request, including status code, response output and status message.

[0013] Furthermore, in the present invention, in step 1, the method for identifying sensitive data of the real system interaction data and desensitizing the real system interaction data using a layered multi-model collaborative mechanism is:

[0014] The Qwen2.5-32B large model is used to identify sensitive information in real system interaction data. The Qwen2.5-7B large model is used to perturb the identified sensitive information to generate data with the same format and precision as the sensitive information. The generated data replaces the corresponding sensitive information to generate desensitized data to be evaluated. The desensitized data is evaluated using Qwen2.5-32B to determine whether the desensitized data retains the structure and precision of the real system interaction data and the sensitive information is completely covered. If so, the data desensitization is completed. Otherwise, the identified sensitive information is perturbed again until all data in the desensitized data set completely covers the sensitive information while maintaining the original structure and precision of the real system interaction data, thus completing the data desensitization.

[0015] Furthermore, in the present invention, in step 2, the pre-trained large model is the open source large language model Qwen2.5-32B.

[0016] Furthermore, in the present invention, in step 4, the honeypot system configuration file includes the configuration file version number, service protocol type, monitoring address, port number, protocol and communication rules, response behavior and configuration file description information.

[0017] Furthermore, in step five of the present invention, after completing a response to the attacker's attack request, the present invention also includes a step of storing the question and answer data of the honeypot large model during the attack round.

[0018] Furthermore, in the present invention, the specific method for storing the question and answer data of the honeypot large model is:

[0019] The question and answer data of the honeypot big model during each round of attack by the same IP attacker are stored in the same JSON file. The question and answer data includes the number of rounds of attack by the current attacker and the question and answer data of the honeypot big model during this round of attack. At the same time, the IP address of the attacker and the total number of rounds of the attacker's attack on the honeypot system based on the big model service are recorded, and the attacker's IP information is used as the retrieval condition of the JSON file.

[0020] Furthermore, in the present invention, in step 5, the process of completing a response to an attacker's attack request includes four processes: attack intention identification, system environment analysis, false response generation, and system environment change prediction. Each process is pre-set with a fixed question corresponding to the question asked to the honeypot large model;

[0021] The specific response process to the attacker's attack request includes:

[0022] When an attack is received, first read the question and answer data of the honeypot large model during the attacker's historical attack process according to the attacker's IP address as historical question and answer data;

[0023] Combine historical question-and-answer data with fixed questions from the attack intent identification phase to reconstruct the final attack intent identification question. Then, ask the attack intent identification question to the honeypot model to obtain the attack intent identification result.

[0024] The attack intent identification results are then spliced before the fixed questions in the system environment analysis phase. The spliced questions are combined with historical question-and-answer data to reconstruct the final system environment analysis questions. The system environment analysis questions are then posed to the honeypot model to obtain the system environment analysis results.

[0025] The attack intent identification results and system environment analysis results are then sequentially spliced before the fixed questions in the false response generation phase. Combined with historical question-and-answer data, the final false response generation question is reconstructed and posed to the honeypot model to generate a false response result.

[0026] The results of the three stages of attack intention identification, system environment assessment, and false response generation are then sequentially spliced before the fixed questions in the system environment change prediction stage, and reconstructed in combination with historical question-and-answer data to obtain the final system environment change prediction question. The system environment change prediction question is then asked to the honeypot model to obtain the system environment change prediction result.

[0027] Furthermore, in the present invention, after obtaining the change response detection result, a system impact scoring process is also included. The system impact scoring process is specifically as follows:

[0028] The results of the four stages of attack intent identification, system environment analysis, false response generation, and system environment change prediction are sequentially concatenated before the fixed questions in the system impact scoring stage. The final system impact scoring question is obtained by combining historical question and answer data for reconstruction. The system impact scoring question is then asked to the honeypot model to obtain the final system impact scoring result.

[0029] Furthermore, in the present invention, each time the question and answer data of the honeypot large model in the attacker's historical attack process is read, dynamic memory technology is used to determine whether the read historical question and answer data meets the resource constraint conditions;

[0030] The resource constraint condition is: the total length of the historical question and answer data is less than or equal to the maximum length limit that the honeypot large model can process at a time, or the memory usage of the historical question and answer data is less than the memory threshold of the honeypot large model;

[0031] If the constraint condition is not met, the historical question and answer data will be deleted in order of influence weight from small to large until the historical question and answer data meets the constraint condition;

[0032] The influence weight formula for each historical question and answer data is:

[0033]

[0034] in, Indicates the influence attenuation factor, which is used to control the influence of historical rounds on weights. The value range is ; Indicates the total number of historical attack rounds of the current attacker under the corresponding index condition; Indicates the attack round number of the current single historical question-and-answer data. ; Indicates the impact score of the attack corresponding to the current historical question-and-answer data.

[0035] The present invention first uses a layered multi-model collaborative mechanism to desensitize the interactive data generated during the operation of the real system. While effectively protecting sensitive information, it ensures that the desensitized data remains consistent with the original data in structure and accuracy, thereby generating a high-quality desensitized dataset. After desensitizing the data, the desensitized dataset is used to fine-tune the large model using LoRa, generating a honeypot large model with high simulation capabilities. This model can effectively simulate the actual response behavior of the real system, helping to improve the fidelity and credibility during the interaction with the attacker, thereby effectively enhancing the honeypot system's inductive ability and camouflage effect. To improve the honeypot large model's ability to understand and analyze attack commands, the present invention uses thought chain technology to subdivide the interaction process into five key analysis links during each interaction with the attacker, improving the honeypot large model's understanding and analysis of attack commands. At the same time, when reading historical conversation data, dynamic memory technology is used to maximize the retention of historical context information that is most critical for subsequent reasoning and response generation under limited computing resources, thereby improving the honeypot large model's context understanding ability and response consistency during multiple rounds of interaction. This paper deploys a honeypot environment in a Docker container to form a honeypot system. Simultaneously, a large, retrained generative honeypot model is deployed on the Ollama platform. When the honeypot system captures attacker commands and requests, it interacts with the large model in the Ollama platform via an interface provided by the OpenAI library, generating responses that align with the characteristics of the real system and feeding them back to the attacker. The intelligent responses of the generative honeypot model enhance the honeypot system's ability to trap and confuse attackers. It can dynamically generate false responses that are highly consistent with the real system, enhancing the system's emulation and attractiveness to attackers and significantly improving the network security protection level of internet systems. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] Figure 1 The figure is a flow chart of the method of the present invention. DETAILED DESCRIPTION

[0037] The following will be combined with the accompanying drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the embodiments described are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention. It should be noted that the embodiments of the present invention and the features in the embodiments can be combined with each other in the absence of conflict.

[0038] Specific implementation method 1: refer to Figure 1 Specifically describing this embodiment, a network attack protection method integrating a large model and honeypot technology described in this embodiment includes:

[0039] Step 1: Collect interaction data generated during the operation of the protection system to be protected; and use a layered multi-model collaborative mechanism to identify sensitive data on the real system interaction data and desensitize the real system interaction data to generate a desensitized data set;

[0040] Step 2: Based on the desensitized dataset, the pre-trained large model is fine-tuned using the LoRA fine-tuning method to obtain a generative honeypot large model;

[0041] Step 3: Deploy the honeypot environment in a Docker container to form a honeypot system, and deploy the generative honeypot large model in the Ollama platform. The honeypot system uses the OpenAI library to request data interaction from the honeypot large model on Ollama, thus building a honeypot system based on the large model service.

[0042] Step 4: Create a honeypot system configuration file based on the configuration information of the real system, and deploy the honeypot system configuration file in the honeypot system based on the large model service by file mounting, so that the honeypot system simulates system services and ports using the configuration file;

[0043] Step 5. Open the honeypot system service and port described in step 4 to attract attacks. When receiving an attack command, the honeypot system uses the thinking chain prompt to combine the question and answer data of the honeypot large model during the current attacker's historical attack process to obtain the questions raised by the current attack to the honeypot large model. After analysis by the honeypot large model, the response data of the attack is obtained and transmitted, completing a response to the attacker's attack request.

[0044] Furthermore, in the present invention, in step 1, the interactive data generated by the protection system during operation includes request data and response data; the request data includes a request protocol, a request instruction, request parameters, and a request method;

[0045] The response data is the response data made by the system in response to the user request, including status code, response output and status message.

[0046] Furthermore, in the present invention, in step 1, the method for identifying sensitive data of the real system interaction data and desensitizing the real system interaction data using a layered multi-model collaborative mechanism is:

[0047] The Qwen2.5-32B large model is used to identify sensitive information in real system interaction data. The Qwen2.5-7B large model is used to perturb the identified sensitive information to generate data with the same format and precision as the sensitive information. The generated data replaces the corresponding sensitive information to generate desensitized data to be evaluated. The desensitized data is evaluated using Qwen2.5-32B to determine whether the desensitized data retains the structure and precision of the real system interaction data and the sensitive information is completely covered. If so, the data desensitization is completed. Otherwise, the identified sensitive information is perturbed again until all data in the desensitized data set completely covers the sensitive information while maintaining the original structure and precision of the real system interaction data, thus completing the data desensitization.

[0048] Furthermore, in the present invention, in step 2, the pre-trained large model is the open source large language model Qwen2.5-32B.

[0049] Furthermore, in the present invention, in step 4, the honeypot system configuration information includes the version number of the configuration file, the service protocol type, the listening address, the port number, the protocol and communication rules, the response behavior and the description information of the configuration file.

[0050] Furthermore, in step five of the present invention, after completing a response to the attacker's attack request, the present invention also includes a step of storing the question and answer data of the honeypot large model during the attack round.

[0051] Furthermore, in the present invention, the specific method for storing the question and answer data of the honeypot large model is:

[0052] The question and answer data of the honeypot big model during each round of attack by the same IP attacker are stored in the same JSON file. The question and answer data includes the number of rounds of attack by the current attacker and the question and answer data of the honeypot big model during this round of attack. At the same time, the IP address of the attacker and the total number of rounds of the attacker's attack on the honeypot system based on the big model service are recorded, and the attacker's IP information is used as the retrieval condition of the JSON file.

[0053] Furthermore, in the present invention, in step 5, the process of completing a response to an attacker's attack request includes four processes: attack intention identification, system environment analysis, false response generation, and system environment change prediction. Each process is pre-set with a fixed question corresponding to the question asked to the honeypot large model;

[0054] The specific response process to the attacker's attack request includes:

[0055] When an attack is received, first read the question and answer data of the honeypot large model during the attacker's historical attack process according to the attacker's IP address as historical question and answer data;

[0056] Combine historical question-and-answer data with fixed questions from the attack intent identification phase to reconstruct the final attack intent identification question. Then, ask the attack intent identification question to the honeypot model to obtain the attack intent identification result.

[0057] The attack intent identification results are then spliced before the fixed questions in the system environment analysis phase. The spliced questions are combined with historical question-and-answer data to reconstruct the final system environment analysis questions. The system environment analysis questions are then posed to the honeypot model to obtain the system environment analysis results.

[0058] The attack intent identification results and system environment analysis results are then sequentially spliced before the fixed questions in the false response generation phase. Combined with historical question-and-answer data, the final false response generation question is reconstructed and posed to the honeypot model to generate a false response result.

[0059] The results of the three stages of attack intention identification, system environment assessment, and false response generation are then sequentially spliced before the fixed questions in the system environment change prediction stage, and reconstructed in combination with historical question-and-answer data to obtain the final system environment change prediction question. The system environment change prediction question is then asked to the honeypot model to obtain the system environment change prediction result.

[0060] Furthermore, in the present invention, after obtaining the change response detection result, a system impact scoring process is also included. The system impact scoring process is specifically as follows:

[0061] The results of the four stages of attack intent identification, system environment analysis, false response generation, and system environment change prediction are sequentially concatenated before the fixed questions in the system impact scoring stage. The final system impact scoring question is obtained by combining historical question and answer data for reconstruction. The system impact scoring question is then asked to the honeypot model to obtain the final system impact scoring result.

[0062] Furthermore, in the present invention, each time the question and answer data of the honeypot large model in the attacker's historical attack process is read, dynamic memory technology is used to determine whether the read historical question and answer data meets the resource constraint conditions;

[0063] The resource constraint condition is: the total length of the historical question and answer data is less than or equal to the maximum length limit that the honeypot large model can process at a time, or the memory usage of the historical question and answer data is less than the memory threshold of the honeypot large model;

[0064] If the constraint condition is not met, the historical question and answer data will be deleted in order of influence weight from small to large until the historical question and answer data meets the constraint condition;

[0065] The influence weight formula for each historical question and answer data is:

[0066]

[0067] in, Indicates the influence attenuation factor, which is used to control the influence of historical rounds on weights. The value range is ; Indicates the total number of historical attack rounds of the current attacker under the corresponding index condition; Indicates the attack round number of the current single historical question-and-answer data. ; Indicates the impact score of the attack corresponding to the current historical question-and-answer data.

[0068] The honeypot model in this invention uses thought chain technology to understand and analyze attack commands, breaking the interaction process into five key analysis steps: analyzing the attacker's potential purpose for executing the command (attack intent identification), analyzing the system operating environment involved in executing the current command (system environment analysis), generating the response content returned by the honeypot system to the attacker (false response generation), predicting the potential state changes that may occur after the system executes the command (system environment change prediction), and quantifying the system impact caused by executing the command (system impact scoring). This multi-step, fine-grained analysis improves the model's understanding of attack commands and the relevance of its responses. Furthermore, this invention utilizes dynamic memory technology to dynamically manage historical Q&A data between the attacker and the honeypot model. Specifically, upon receiving each attack request, the system reads the corresponding historical Q&A data based on the attacker's IP address and makes a judgment based on preset resource constraints (such as the model's maximum processable context length or video memory threshold). If the historical Q&A data exceeds resource limits, the system sorts the historical data based on the influence weight of each Q&A record, prioritizing higher-weighted historical Q&A records and deleting lower-weighted records until resource constraints are met. Through the above-mentioned dynamic pruning mechanism, the historical context information that is most critical for subsequent reasoning and response generation can be retained to the greatest extent possible under limited computing resources, thereby improving the context understanding ability and response consistency of the honeypot large model during multiple rounds of interaction.

[0069] Compared with the prior art, the present invention has the following advantages:

[0070] (1) The present invention significantly improves the flexibility, scope of application and intelligence level of the honeypot system by introducing a large model as a means of generating responses for the honeypot. Traditional honeypot systems are usually divided into small honeypots, medium honeypots and large honeypots according to their scale and functions. Small honeypots are easy to be discovered by attackers due to their simple functions and cannot effectively capture complex attack behaviors; medium honeypots achieve a certain balance between functions and deployment complexity, but their response capabilities rely on pre-written static program logic and cannot respond flexibly to unknown attack methods; although large honeypots are comprehensive in functions, they are difficult to deploy and consume a lot of resources. Once they are compromised, they can be easily used by attackers as a springboard to attack other systems. In addition, the response content of traditional honeypots is usually generated based on fixed rules or predefined data sets, lacks dynamic generation capabilities, and is difficult to simulate the complex behavior of real systems. In contrast, the present invention utilizes the strong semantic understanding and generation capabilities of large models (such as Qwen2.5-32B) to dynamically generate highly realistic system responses based on the attacker's instructions without relying on predefined static rules or program logic. The large model can combine attack intent analysis and environmental context assessment to generate highly targeted and deceptive response content, effectively extending the attacker's stay time and capturing richer attack behavior data. At the same time, the generation capability of the large model enables the honeypot to quickly adapt to different types of attack scenarios and flexibly respond to unknown attack methods. This dynamic response mechanism not only enhances the honeypot's deceptive and entrapment capabilities, but also reduces the traditional honeypot's reliance on manually written rules, significantly improving deployment efficiency and the controllability of maintenance costs. Therefore, compared with traditional honeypot systems, the present invention has significant advantages in flexibility, intelligence, and applicability.

[0071] (2) The present invention uses a hierarchical multi-model collaborative mechanism to desensitize the interactive data of the real system, providing high-quality training data for subsequent large-scale model fine-tuning. Compared with the traditional static rule desensitization method, the present invention uses the powerful semantic understanding ability of the generative large model to accurately identify and process various forms of sensitive information. At the same time, the present invention selects a low desensitization level to desensitize the data, while eliminating sensitive information, while retaining the original data structure and accuracy to the greatest extent, so that the response generated by the honeypot large model after fine-tuning the data is more realistic. In addition, the hierarchical multi-model mechanism will allocate different model specifications and resources according to the complexity of different tasks in the desensitization process, achieving a good balance between resource consumption and effect quality, and improving the efficiency and flexibility of the desensitization process. Compared with traditional desensitization methods, this mechanism can better adapt to complex and changing data scenarios, laying a solid foundation for the efficient training of subsequent models.

[0072] (3) The present invention adopts the Chain of Thought (CoT) technology to decompose the analysis task of attack instructions into multiple logically clear reasoning steps through question enhancement. Compared with the method of directly using attacker instructions to ask questions to the large model, the Chain of Thought technology can gradually decompose complex problems and significantly improve the analysis depth and reasoning accuracy of the model. The present invention designs five progressive reasoning stages: first, the attack intention identification stage, which analyzes the core purpose and potential threats of the attack instructions; second, the system environment analysis stage, which combines the intention identification results to comprehensively analyze the system environment involved in the instruction execution and its impact range; third, the false response generation stage, which generates the simulated response content that the honeypot system needs to return to the attacker based on the results of the first two stages; fourth, the system environment change prediction stage, which infers the possible changes in the system environment after the instruction is executed, providing context for subsequent impact assessment; fifth, the system impact scoring stage, which quantitatively evaluates the potential impact of the instruction execution on the system security and stability, and outputs the scoring results. These five steps are progressive, which comprehensively improve the honeypot large model's ability to understand and analyze attack instructions, making its response more accurate and reasonable.

[0073] (4) The present invention uses dynamic memory technology to process historical question-and-answer data, significantly improving the response consistency and reasoning accuracy of the model in continuous and complex attack scenarios. In traditional methods, due to limited video memory resources and the limitation of model context length, historical question-and-answer data may be directly truncated due to exceeding the video memory threshold or the maximum context length of the model, resulting in the model being unable to obtain complete context information, thereby affecting its reasoning ability and the consistency of response generation. For example, if an attacker creates a folder in an early attack and attempts to access the folder in subsequent operations, if the relevant key historical question-and-answer data is discarded, the model will find it difficult to correctly understand the attacker's intentions, and then generate incorrect or inconsistent responses, and even expose the false nature of the honeypot system. To this end, the present invention introduces a historical conversation data value quantification mechanism, which accurately evaluates the importance of each record by comprehensively considering the impact attenuation factor, the attack round in which the historical conversation data is located, and the system impact score obtained through model reasoning. Based on this mechanism, when dynamic memory technology detects that historical conversation data exceeds resource constraints, it can prune historical Q&A data based on the importance of each piece of data. It prioritizes the most valuable conversation data for model reasoning and response generation (such as downloading files and modifying file permissions), while pruning less important conversation data (such as viewing file directories and switching folders). In this way, dynamic memory technology ensures that the model fully utilizes key contextual information and continuously generates accurate and consistent responses even under resource constraints, significantly improving the intelligence and deception capabilities of the honeypot system.

[0074] In the specific implementation process of this invention, we first collect the interaction data generated during the actual operation of the real system. To prevent the leakage of sensitive information during the interaction between the model and the attacker, we use a layered multi-model collaborative mechanism to pre-process the data to form desensitized data, specifically:

[0075] 1) Sensitive Data Identification and Extraction: Using medium-parameter models (e.g., 32B or 70B), we identify sensitive information in real-world data, primarily categorized as text and numeric. Text-based sensitive data includes geolocation, user ID, device ID, and device type; numeric-based sensitive data includes timestamps, IP addresses, and account balances. Identified sensitive data and its location within the original data are stored to provide a basis for subsequent perturbation processing.

[0076] 2) Sensitive Information Perturbation: Use a small parameter model (such as 7B or 14B) to perturb the identified sensitive information. The specific perturbation method is as follows:

[0077] For sensitive text-based data (such as geographic location, user ID, device ID, device type, etc.), a small-parameter model is used to generate replacement data with the same format and precision. For example, a user ID can be replaced with a randomly generated string, ensuring that it conforms to the format requirements of the original data.

[0078] For sensitive numerical data (such as timestamps, IP addresses, and account balances), a small-parameter model is used to generate values with the same format and precision within a reasonable range. For example, timestamps can be randomly perturbed within the same date range, IP addresses can be generated in legal but different address segments, and account balances can have random noise added while maintaining the same numerical precision.

[0079] After the perturbation is completed, the modified data is replaced back into the original dataset to generate the desensitized dataset to be evaluated.

[0080] 3) Evaluation of Sensitive Information Desensitization Results: Use a medium-parameter model (e.g., 32B or 70B) to evaluate the effectiveness of desensitization to ensure that the desensitized data retains its original structure and accuracy. The evaluation includes:

[0081] Check whether the data format remains consistent, for example, the timestamp is still in the standard format and the IP address is still a legal address.

[0082] Whether the data precision has not changed significantly, for example, whether the number of digits after the decimal point has been reduced.

[0083] 4) Qualified desensitized data is used for fine-tuning the honeypot model. If desensitization is ineffective or causes changes in data format or accuracy, return to the second step and re-perturb sensitive information.

[0084] The desensitized data is input into the open source large model Qwen2.5-32B. The honeypot large model is constructed through LoRA fine-tuning to enhance the model's ability to understand real system data. Specifically:

[0085] 1) Configure LoRA fine-tuning: Select key modules in the Qwen2.5-32B model (such as q_proj and v_proj in the attention mechanism) as the target modules for fine-tuning. Introduce low-rank matrix decomposition structures in these modules, freeze the original model weights, and only train the newly added low-rank matrix components.

[0086] 2) Training and Optimization: Using desensitized system data as training data, we define an appropriate loss function and optimizer. While freezing most model parameters, we train only the LoRA module. Through multiple rounds of iterative optimization, the model gradually adapts to the specific requirements of the system data.

[0087] 3) Model preservation and deployment: After fine-tuning is completed, the weights and model structure of the LoRA module are saved and constructed into a large honeypot model.

[0088] Through model fine-tuning and training, the large model can play the role of a honeypot and simulate the real response of the system.

[0089] The honeypot environment is then deployed using Docker containers to provide an isolated operating environment for the honeypot, ensuring system security and portability.

[0090] The honeypot environment is mainly responsible for simulating the services of the real system and exposing the specified services and ports through configuration files. The configuration files include:

[0091] 1) Version number: specifies the version of the current configuration file to facilitate subsequent iterative updates, such as v1.

[0092] 2) Service protocol type: Indicate the service protocol of the target system to be simulated, such as HTTP, SSH, etc.

[0093] 3) Address: Specify the IP address to monitor. For example, * means monitoring all IP addresses.

[0094] 4) Port number: The port assigned to each service for a specific type of communication, such as 80, 22.

[0095] 5) Protocols and communication rules: Specify the protocols used (such as TCP, UDP) and describe the specific communication rules and data formats.

[0096] 7) Response behavior: Set response strategies, such as welcome message, error message, file list, directory structure, etc. after successful login.

[0097] 8) Description: Specifies the description of the current configuration file.

[0098] The honeypot system collects the attacker's instructions and request data in real time, and uses the OpenAI library to request data interaction from the honeypot model deployed on Ollama. The Ollama should be configured as follows:

[0099] 1) Configure Ollama to receive data collected in real time from the honeypot environment, ensuring that the data format (such as JSON, XML) meets the input requirements of the large model.

[0100] 2) Configure the API or Webhook interface so that the honeypot system can send the collected instructions and request data directly to the data receiving endpoint of Ollama.

[0101] 3) Configure logging to track data transfer status, call frequency of analytical models, and response results.

[0102] This invention utilizes COT (Conceptual Ontology) thinking chain technology. During each interaction with the attacker, the complete interaction is broken down into multiple sub-processes. While refining and deepening the model's ability to understand each attack instruction, it continuously acquires more detailed interaction information. The specific links in the thinking chain and the information obtained from each interaction link are as follows:

[0103] 1) Attack intention identification link: The fixed question used in this link is "Please analyze the attacker's intention (Purpose) to execute this command?" The information obtained from this thinking chain link is "Purpose", abbreviated as " ”.

[0104] 2) System environment analysis: The fixed question used in this link is "Give the current operating environment and status of the system involved in executing the current command (Environment)?" The information obtained from this thinking chain is "Environment", which is abbreviated as " ”.

[0105] 3) False response generation: The fixed question used in this step is "What should the honeypot system output at this time (Output)? Please give the response returned to the attacker separately, without any redundant description of the response." The information obtained from this thought chain is "Output", abbreviated as " ”.

[0106] 4) System environment change prediction link: The fixed question used in this link is "What is the change (Delta) after the system executes this command?" The information obtained from this thinking chain is "Delta", which is abbreviated as " ”.

[0107] 5) System Impact Scoring: This section uses the fixed question "Score the impact of the command on the system (Score), with a score range of 0 to 10. You only need to give the score without any description or redundant content." The information obtained from this thought chain is "Score", which is abbreviated as " ”.

[0108] In the specific interaction process with the honeypot model, the final question is obtained by combining the fixed questions in each link of the COT thinking chain and the historical question and answer data read according to the attacker's IP. The final question of each link consists of three parts:

[0109] 1) Historical question-and-answer data (i.e., historical context) of the attack analysis process by the honeypot model in the honeypot system during the attacker's attack;

[0110] 2) The output of the preceding link (i.e., the results obtained by the honeypot model through the preceding response process of the honeypot system in each round of attack);

[0111] 3) Fixed question template for the current session;

[0112] The specific splicing method is as follows:

[0113] 1) First stage (Attack Intent Identification): As this is the first stage, the historical Q&A data is combined with the fixed question to form the final question. For example, Final Question 1 = Historical Q&A Data + "Please analyze the attacker's intention in executing this command."

[0114] Input the final question 1 into the honeypot model to obtain the attack intent recognition result (Purpose).

[0115] 2) The second link (system link analysis):

[0116] Based on historical Q&A data, the output of the previous step (Purpose) is combined with the current fixed question to form the final question. For example, Final Question 2 = Historical Q&A Data + Attack Intent Identification Results + "Give me the current operating environment and status of the system involved when executing the current command?"

[0117] Input the final question 2 into the honeypot model to obtain the system environment analysis results (Environment).

[0118] 3) The third step (generating fake responses):

[0119] Based on the historical Q&A data, the outputs of the first two steps (Purpose and Environment) are combined with the current question to form the final question. For example, Final Question 3 = Historical Q&A Data + Attack Intent Identification Results + System Environment Analysis Results + "What should the honeypot system output at this point? Please provide a separate response to the attacker. No redundant description of the response is required."

[0120] Input the final question 3 into the honeypot model to obtain the false response generation result (Output).

[0121] 4) The subsequent system environment change prediction and system impact scoring stages are similar:

[0122] That is, in each link, the historical question-and-answer data and the outputs of all previous links are sequentially spliced before the current fixed question to form the final question, which is then input into the large model for reasoning.

[0123] After completing a response to the attacker's attack request, the honeypot system organizes the data generated by the question and answer with the honeypot large model into a tuple , as follows:

[0124]

[0125] in , , , and Corresponding to the current attacker in The attack intention, system environment analysis, false response, system environment change and system impact score information obtained in the round of attacks. Indicates the attack round number of the current question and answer data (counting starts from 1).

[0126] In the present invention, the honeypot system will store the question and answer data of the honeypot model in each round of attack by the same IP attacker into the same JSON file. Composing the Question Answering Dataset , In addition, the system will store the attacker's IP address and the total number of rounds the attacker has attacked the honeypot system based on the large model service in a JSON file, where the attacker's IP information is used as the retrieval condition of the JSON file.

[0127] To improve the model's contextual understanding and response consistency in multiple rounds of attack interactions, the present invention uses dynamic memory technology to determine whether the historical question-and-answer data read from the attacker's historical attack process meets resource constraints each time.

[0128] The resource constraint condition is: the total length of the historical question and answer data is less than or equal to the maximum length limit that the honeypot large model can process at a time, or the memory usage of the historical question and answer data is less than the memory threshold of the honeypot large model;

[0129] If the constraint condition is not met, the historical question and answer data will be deleted in order of influence weight from small to large until the constraint condition is met;

[0130] The influence weight formula for each historical question and answer data is:

[0131]

[0132] in, Indicates the influence attenuation factor, which is used to control the influence of historical rounds on weights. The value range is ; Indicates the total number of historical attack rounds of the current attacker under the corresponding index condition; Indicates the attack round number of the current single historical question-and-answer data. ; Indicates the impact score of the attack corresponding to the current historical question-and-answer data.

[0133] The present invention uses firewalls and access control strategies to ensure that the honeypot environment is isolated from the main system and prevent attackers from affecting the actual system.

[0134] Although the present invention is described herein with reference to specific embodiments, it should be understood that these embodiments are merely illustrative of the principles and applications of the invention. It should be understood that many modifications may be made to the illustrative embodiments, and that other arrangements may be devised, without departing from the spirit and scope of the invention as defined by the appended claims. It should be understood that the various dependent claims and features described herein may be combined in ways other than those described in the original claims. It should also be understood that features described in conjunction with individual embodiments may be used in conjunction with other described embodiments.

Claims

1. A network attack protection method integrating large model and honeypot technology, characterized in that: include: Step 1: Collect interaction data generated during the operation of the protection system to be protected; A layered multi-model collaborative mechanism is used to identify sensitive data of the real system interaction data and desensitize the real system interaction data to generate a desensitized data set; Step 2: Based on the desensitized dataset, the pre-trained large model is fine-tuned using the LoRA fine-tuning method to obtain a generative honeypot large model; Step 3: Deploy the honeypot environment in a Docker container to form a honeypot system, and deploy the generative honeypot large model in the Ollama platform. The honeypot system uses the OpenAI library to request data interaction from the honeypot large model on Ollama, thus building a honeypot system based on the large model service. Step 4: Create a honeypot system configuration file based on the configuration information of the real system, and deploy the honeypot system configuration file in the honeypot system based on the large model service by file mounting, so that the honeypot system simulates system services and ports using the configuration file; Step 5. Open the honeypot system service and port described in step 4 to attract attacks. When receiving an attack command, the honeypot system uses the thinking chain prompt to combine the question and answer data of the honeypot large model during the current attacker's historical attack process to obtain the questions raised by the current attack to the honeypot large model. After analysis by the honeypot large model, the response data of the attack is obtained and transmitted, completing a response to the attacker's attack request.

2. A network attack protection method integrating large model and honeypot technology according to claim 1, characterized in that: In step 1, the interaction data generated by the protection system during operation includes request data and response data; the request data includes request protocol, request instructions, request parameters and request method; The response data is the response data made by the system in response to the user request, including status code, response output and status message.

3. A network attack protection method integrating a large model and honeypot technology according to claim 1 or 2, characterized in that: In step 1, the method of using a layered multi-model collaborative mechanism to identify sensitive data of the real system interaction data and desensitize the real system interaction data is: The Qwen2.5-32B large model is used to identify sensitive information in real system interaction data. The Qwen2.5-7B large model is used to perturb the identified sensitive information to generate data with the same format and accuracy as the sensitive information. The generated data replaces the corresponding sensitive information to generate desensitized data to be evaluated. The Qwen2.5-32B large model is used to evaluate the desensitized data to determine whether the desensitized data retains the structure and accuracy of the real system interaction data and whether the sensitive information is completely covered. If so, the data desensitization is completed. Otherwise, the identified sensitive information is perturbed again until all data in the desensitized data set completely covers the sensitive information while maintaining the structure and accuracy of the real system interaction data, thus completing the data desensitization.

4. The network attack protection method integrating large model and honeypot technology according to claim 1 is characterized in that: In step 2, the pre-trained large model is the open source large language model Qwen2.5-32B.

5. A network attack protection method integrating large model and honeypot technology according to claim 4, characterized in that: In step 4, the honeypot system configuration file includes the configuration file version number, service protocol type, listening address, port number, protocol and communication rules, response behavior and configuration file description information.

6. A network attack protection method integrating a large model and honeypot technology according to claim 1, 2, 4 or 5, characterized in that: In step five, after completing a response to the attacker's attack request, the step of storing the question and answer data of the honeypot large model during the attack process is also included.

7. A network attack protection method integrating large model and honeypot technology according to claim 6, characterized in that: The specific method for storing the question-answering data of the honeypot large model is as follows: The question and answer data of the honeypot big model during each round of attack by the same IP attacker are stored in the same JSON file. The question and answer data includes the number of rounds of attack by the current attacker and the question and answer data of the honeypot big model during this round of attack. At the same time, the IP address of the attacker and the total number of rounds of the attacker's attack on the honeypot system based on the big model service are recorded, and the attacker's IP information is used as the retrieval condition of the JSON file.

8. A network attack protection method integrating large model and honeypot technology according to claim 7, characterized in that: In step 5, the process of responding to an attacker's attack request includes four steps: attack intention identification, system environment analysis, false response generation, and system environment change prediction. Each step is pre-set with fixed questions to be asked to the honeypot model. The specific response process to the attacker's attack request includes: When an attack is received, first read the question and answer data of the honeypot large model during the attacker's historical attack process according to the attacker's IP address as historical question and answer data; Combine historical question-and-answer data with fixed questions from the attack intent identification phase to reconstruct the final attack intent identification question. Then, ask the attack intent identification question to the honeypot model to obtain the attack intent identification result. The attack intent identification results are then spliced before the fixed questions in the system environment analysis phase. The spliced questions are combined with historical question-and-answer data to reconstruct the final system environment analysis questions. The system environment analysis questions are then posed to the honeypot model to obtain the system environment analysis results. The attack intent identification results and system environment analysis results are then sequentially spliced before the fixed questions in the false response generation phase. Combined with historical question-and-answer data, the final false response generation question is reconstructed and posed to the honeypot model to generate a false response result. The results of the three stages of attack intention identification, system environment assessment, and false response generation are then sequentially spliced before the fixed questions in the system environment change prediction stage, and reconstructed in combination with historical question-and-answer data to obtain the final system environment change prediction question. The system environment change prediction question is then asked to the honeypot model to obtain the system environment change prediction result.

9. A network attack protection method integrating large model and honeypot technology according to claim 8, characterized in that: After obtaining the change response detection results, the system impact scoring process is also included. The system impact scoring process is specifically as follows: The results of the four stages of attack intent identification, system environment analysis, false response generation, and system environment change prediction are sequentially concatenated before the fixed questions in the system impact scoring stage. The final system impact scoring question is obtained by combining historical question and answer data for reconstruction. The system impact scoring question is then asked to the honeypot model to obtain the final system impact scoring result.

10. A network attack protection method integrating a large model and honeypot technology according to claim 8 or 9, characterized in that: Each time the question and answer data of the honeypot large model in the attacker's historical attack process is read, dynamic memory technology is used to determine whether the read historical question and answer data meets the resource constraint conditions; The resource constraint condition is: the total length of the historical question and answer data is less than or equal to the maximum length limit that the honeypot large model can process at a time, or the memory usage of the historical question and answer data is less than the memory threshold of the honeypot large model; If the constraint condition is not met, the historical question and answer data will be deleted in order of influence weight from small to large until the historical question and answer data meets the constraint condition; The influence weight formula for each historical question and answer data is: in, Indicates the influence attenuation factor, which is used to control the influence of historical rounds on weights. The value range is ; Indicates the total number of historical attack rounds of the current attacker under the corresponding index condition; Indicates the attack round number of the current single historical question-and-answer data. ; Indicates the impact score of the attack corresponding to the current historical question-and-answer data.

Images