Dynamic honeypot deployment and optimization method and system based on intelligent flow analysis

Abstract

The invention provides a dynamic honeypot deployment and optimization method and system based on intelligent flow analysis, and belongs to the field of computer security and network security. The method comprises the following steps: collecting network traffic and preprocessing to obtain a feature vector; then, the trained random forest model is used for carrying out attack type identification on the network flow; clustering analysis is carried out on all the attack traffic, similar attack traffic forms clusters, priority ranking is carried out on the clusters, honeypots of corresponding positions and types are deployed according to matching rules in the sequence of the priorities of the clusters from high to low, and the attack traffic belonging to a certain cluster is introduced into the corresponding honeypot; a deep Q network is used in each honeypot for learning, and the optimal balance between the capture rate and the resource utilization rate is realized by modifying the configuration of the honeypot and observing the capture condition of attack traffic and the resource consumption of the honeypot. According to the method, intelligent deployment of the honeypot and dynamic configuration in the honeypot are realized, the attack capture rate of the honeypot is improved, and the resource utilization rate is maximized.

Description

Technical Field

[0001] The present invention relates to the fields of computer security and network security, and in particular to a dynamic honeypot deployment and optimization method and system based on intelligent traffic analysis. Background Art

[0002] As network environments become increasingly complex, the types and methods of cyberattacks are constantly evolving. While traditional security systems (such as firewalls and intrusion detection systems) have achieved some success in identifying and blocking attacks, they are insufficient in comprehensively capturing attack behavior and obtaining in-depth threat intelligence in the face of complex advanced persistent threats (APTs) and increasingly diverse attack methods. This is particularly true in scenarios like DDoS, web attacks, and remote access attacks, where traditional protection methods struggle to effectively guide and deeply analyze attack behavior. This results in insufficient granularity in threat analysis and delayed responses.

[0003] Honeypot technology, as an active defense measure, deceives attackers by deploying decoy hosts, network services, or information, luring them into attacking fake systems. This allows attackers to capture attack characteristics, behaviors, and techniques, making it crucial for threat intelligence acquisition. By capturing and analyzing attack behaviors, attackers' tools and methods can be understood, and their intent and motivations can be inferred. This allows defenders to gain a clearer understanding of the security threats they face, enabling them to enhance the security of their actual systems through technical and management measures. However, most traditional honeypot systems are statically configured, often running the same configuration for extended periods within the same network environment. Once attackers identify a honeypot, they often avoid it, resulting in a low honeypot capture rate. Furthermore, the fixed configuration of traditional honeypots cannot quickly adapt to new attack patterns, making it difficult to capture the latest attack methods and attacker behavior in real time. Summary of the Invention

[0004] In response to the shortcomings of the existing technology, the present invention provides a dynamic honeypot deployment and optimization method based on intelligent traffic analysis. The present invention improves the flexibility and adaptability of honeypot deployment by realizing intelligent dynamic deployment of honeypots and dynamic configuration inside the honeypot, making the honeypot system more intelligent. At the same time, it also improves the attack capture rate of the honeypot and maximizes resource utilization.

[0005] In order to achieve the above technical objectives, the present invention adopts the following technical solutions:

[0006] A dynamic honeypot deployment and optimization method based on intelligent traffic analysis is provided, comprising the following steps:

[0007] Step S1: Collect network traffic and perform preprocessing to obtain preset network traffic characteristics;

[0008] Step S2: Based on the network traffic characteristics, a data set for random forest model training is constructed, multiple decision trees are trained, and a trained random forest model is obtained;

[0009] Step S3: Use the random forest model to identify the attack type of the input network traffic data and output the corresponding attack type;

[0010] Step S4: Based on the network traffic characteristics and the attack types identified by the model, a data set for clustering is constructed, and the data set is classified using the DBSCAN clustering algorithm to obtain multiple classification clusters;

[0011] Step S5: Deploy honeypots in descending order of priority of the classification clusters. Select the deployment location of the honeypots and complete the deployment based on the network traffic characteristics within the classification clusters and the matching rules between the classification clusters and the deployment locations.

[0012] Step S6: For the attack traffic entering each honeypot, use the deep Q network to learn the attack pattern and optimize the configuration of the honeypot node to obtain the optimal capture rate.

[0013] Preferably, in step S1, the network traffic is collected and pre-processed to obtain preset network traffic characteristics, which specifically includes the following steps:

[0014] Step S11: collecting network traffic data and extracting first network traffic features;

[0015] Step S12: performing traffic classification and calculation on the non-numerical features in the first network traffic features to extract the second network traffic features;

[0016] Step S13: Perform feature engineering processing on the obtained first network traffic feature and the second network traffic feature to obtain a preset network traffic feature.

[0017] Preferably, in step S2, constructing a data set for random forest model training based on network traffic characteristics, training multiple decision trees, and obtaining a trained random forest model specifically includes the following steps:

[0018] Step S21: adding attack type labels to the feature vectors to construct a random forest model training dataset;

[0019] Step S22: randomly extract a subset from the training data set, and then randomly select some features as the training subset for each decision tree;

[0020] Step S23: construct each decision tree, use Gini impurity as the splitting criterion of the decision tree, select the feature and split point with the smallest Gini impurity to split the decision tree, until the preset stopping condition is met, and generate a complete decision tree;

[0021] Step S24: Repeat steps S22 to S23 to construct multiple decision trees. When the number of decision trees reaches the preset requirement, a trained random forest model is obtained.

[0022] Preferably, in step S23, the process of constructing each decision tree using the Gini impurity splitting criterion includes the following steps:

[0023] Step S231: For the decision tree, select a split point at each layer and divide the training subset into left child nodes D according to the split point. L and right child node D R Two subsets;

[0024] Step S232: Calculate the Gini impurities of the left and right child nodes respectively:

[0025]

[0026] Among them, Gini (D L ) is the Gini impurity of the left child node, Gini(D R ) is the Gini impurity of the right child node, D L and D R Respectively represent the proportion of samples of category i in the left child node and the right child node, and C is the number of sample categories;

[0027] Step S233: Calculate the Gini impurity after splitting:

[0028]

[0029] Among them, Gini split is the Gini impurity after splitting, |D| is the total number of samples in the current node, |D L | and |D R | are the number of samples in the left and right child nodes after splitting;

[0030] Step S234: Select the optimal split. For the current node, traverse all possible split combinations and find the one that minimizes Gini split The way of splitting;

[0031] Step S235: recursively execute the above steps S231 to S234 until the stopping condition is met, that is, the maximum tree depth is reached or the number of data set samples is insufficient to split, and a complete decision tree is generated.

[0032] Preferably, in step S4, the attack types identified based on the network traffic characteristics and the model are used to construct a data set for clustering, and the DBSCAN clustering algorithm is used to classify the data set for clustering, which specifically includes the following steps:

[0033] Step S41: constructing a data set for clustering based on the network traffic data and the attack types identified by the model;

[0034] Step S42: defining the neighborhood radius and minimum number of samples for the DBSCAN clustering algorithm;

[0035] Step S43: For each data point in the data set, calculate the number of data points within the neighborhood radius of the data point. If the number of data points is greater than or equal to the minimum number of samples, then the data point is included in the core point set. Otherwise, proceed to step S44.

[0036] Step S44: Determine whether the data point is within the neighborhood radius of a core point. If so, the data point is classified into the boundary point set; otherwise, the data point is classified into the noise point set.

[0037] Step S45: repeat steps S43 to S45 until all data points in the data set have been traversed and grouped;

[0038] Step S46: Visit any unvisited core point in the core point set, recursively visit all boundary points and core points within the neighborhood radius of the core point, and group these points into a cluster;

[0039] Step S47: Repeat step S46 until all data points in the core point set are visited and classified as points of a certain cluster or noise points, thereby obtaining multiple classification clusters.

[0040] Preferably, in step S5, the honeypots are deployed in descending order of priority of the classification clusters, and the deployment location of the honeypot is selected and the deployment is completed according to the network traffic characteristics within the classification clusters and the matching rules from the classification clusters to the deployment locations, which specifically includes the following steps:

[0041] Step S51: defining the type of honeypot deployment location according to the network structure and network security requirements;

[0042] Step S52: Based on the type of honeypot deployment location, traffic characteristics analysis is performed on each classification cluster, and matching rules between classification clusters and deployment locations are formulated;

[0043] Step S53: comprehensively scoring each classification cluster obtained by clustering, and prioritizing the classification clusters according to the scoring results;

[0044] Step S54: Deploy honeypots in descending order of priority of the classification clusters. Select the deployment location of the honeypots and complete the deployment based on the network traffic characteristics within the classification clusters and the matching rules between the classification clusters and the deployment locations.

[0045] Step S55: Repeat step S54, traverse all classification clusters in turn, and complete the honeypot deployment at the corresponding location.

[0046] Preferably, in step S53, the method for calculating the comprehensive score of each classification cluster includes the following steps:

[0047] Step S531: Set the priority score P of the classification cluster cluster As a comprehensive score, the calculation formula is:

[0048] P cluster =ω1·S severity +ω2·S scale

[0049] Among them, P cluster S is the priority score of the cluster, severity Score the severity of attack traffic within the cluster, S scale Score the traffic scale within the cluster, with ω1 and ω2 as weights;

[0050] Step S532: Calculate the severity score S of the attack traffic within the classification cluster severity , and its calculation formula is:

[0051]

[0052] Among them, G i is the severity score of the i-th attack, W i is the proportion of the attack in the cluster, and N is the total number of attack types in the cluster;

[0053] Step S533: Calculate the traffic scale score S scale , and its calculation formula is:

[0054]

[0055] Among them, N cluster is the number of traffic points in the current cluster, N total is the number of points for all traffic, It is the cluster with the largest total traffic among all clusters;

[0056] Step S544: Balance the importance of the two indicators by adjusting the weights ω1 and ω2, and combine them to obtain a comprehensive score P cluster .

[0057] Preferably, in step S6, the attack pattern is learned using a deep Q network for entering each honeypot, and the configuration of the honeypot node is optimized to obtain the optimal capture rate, which specifically includes the following steps:

[0058] Step S61: define the state space, action space and reward function of the deep Q network;

[0059] Step S62: Setting the Q-value update function Q(S,A) of the deep Q network;

[0060] Step S63: Introduce the attack traffic belonging to a certain classification cluster into the corresponding honeypot, and use the deep Q network to learn in each honeypot to obtain a trained deep Q network model;

[0061] Step S64: The deep Q network model selects the optimal honeypot configuration strategy by maximizing the Q value according to the traffic characteristics entering the honeypot.

[0062] Preferably, in step S61, the state space, action space and reward function of the deep Q network are defined as follows:

[0063] 1) State space S: The state space is defined as consisting of the collected network traffic feature information. The state space S is represented as follows

[0064] S=[f1,f2,…,f n ]

[0065] Among them, f1,f2,…,f n is the network traffic statistics data, namely, the first network traffic feature and the second network traffic feature output by the attack identification module, and n is the number of network traffic data;

[0066] 2) Action space A: The action space is defined as the set of all configuration strategies that the system can execute. There are five configuration strategies in total. The action space A is represented as follows:

[0067] A={E,I,R,D,L}

[0068] Among them, E represents service adjustment action, I represents interaction depth adjustment action, R represents resource allocation adjustment action, D represents data bait adjustment action, and L represents log capture range adjustment action;

[0069] 3) Reward function R(S,A), specifically defined as:

[0070] R(S,A)=ω1R capture +ω2R depth +ω3R resource

[0071] Among them, R(S,A) represents the immediate reward obtained after taking action A in state S, R capture R is the capture of the attack by the honeypot after taking action A in the current state S. depth is the attacker’s interaction depth in the honeypot after taking action A in the current state S, R resource The system resources consumed by capturing unit traffic after taking action A in the current S state. w1, w2, and w3 are weights, all 1 by default. If you pay more attention to the impact of a certain part on the system, increase the corresponding weight.

[0072] The present invention also provides a dynamic honeypot deployment and optimization system based on intelligent traffic analysis, using any of the dynamic honeypot deployment and optimization methods based on intelligent traffic analysis as described above, the system includes a data acquisition module, an attack behavior identification module, a honeypot intelligent deployment module, and a dynamic configuration module;

[0073] The data acquisition module is used to collect network traffic and perform preprocessing to obtain preset network traffic characteristics;

[0074] The attack behavior identification module uses the network traffic characteristics output by the data acquisition module to train a random forest model, and then uses the trained random forest model to identify the attack type of the input network traffic data;

[0075] The honeypot intelligent deployment module includes a cluster generation module and a dynamic deployment module. The cluster generation module constructs a cluster data set based on the network traffic characteristics output by the data acquisition module and the attack types identified by the random forest model, and classifies the data set using the DBSCAN algorithm to obtain multiple classification clusters. The dynamic deployment module then selects the deployment location of the honeypot and completes the deployment based on the network traffic characteristics within the classification cluster and the matching rules between the classification cluster and the honeypot deployment location.

[0076] The dynamic configuration module uses a deep Q network to learn the attack patterns of attack traffic entering each honeypot and optimizes the configuration of honeypot nodes to obtain the best capture rate.

[0077] Compared with the prior art, the present invention has the following beneficial effects:

[0078] 1) Improving the honeypot's attack capture rate: A trained random forest model identifies attack types in network traffic. Based on the identified attack types and network traffic information, the DBSCAN clustering algorithm dynamically deploys different honeypot nodes, effectively attracting attackers with specific attack types. Each honeypot node is configured based on the attack type (for example, opening specific ports, simulating specific services, etc.), making the captured attack data more accurate and effective, significantly improving the honeypot's capture rate.

[0079] 2) Improving the flexibility and adaptability of honeypot deployment, making the honeypot system more intelligent: By training honeypots using a Deep Q-Network (DQN) and adjusting strategies based on attack types, honeypots can automatically adjust their behavior and configuration based on different attack patterns, enabling them to adapt to different attack methods and changing network environments. For example, to combat DDoS attacks, network-layer honeypots are deployed, while to combat certain application-layer attacks, application-layer honeypots are deployed. This automated, dynamic adaptation makes the honeypot system more intelligent and enables it to maintain efficient operation in different scenarios.

[0080] 3) Resource optimization and cost savings to maximize resource utilization: By dynamically adjusting the configuration and deployment location of honeypots, resources can be intelligently allocated based on real-time attack traffic and threat types. This on-demand deployment of honeypot nodes avoids unnecessary resource waste and optimizes resource utilization. Furthermore, the workload of honeypots can be adjusted based on changes in attack traffic, maximizing resource utilization efficiency.

[0081] 4) Enhanced network security: This invention can provide stronger proactive defense capabilities by continuously optimizing the configuration and deployment of honeypots. By effectively capturing and analyzing attack traffic, it can provide new attack indicators to security facilities such as firewalls and intrusion detection systems, making the overall network protection system more comprehensive and intelligent.

[0082] 5) Enhanced Intelligence and Automation of Network Defense: Through the introduction of Deep Q Network, the entire honeypot system is capable of self-learning and optimization, automatically responding to changing attack patterns. This automated defense mechanism reduces the need for manual intervention and improves the response speed and accuracy of network security protection.

[0083] 6) Support for Multiple Network Environments: This honeypot system, based on traffic identification and dynamic deployment, is not limited to specific attack types or network environments. It can be widely applied to different attack types and network topologies. Whether in an enterprise, data center, or IoT device, honeypots can be deployed for targeted protection based on actual needs. BRIEF DESCRIPTION OF THE DRAWINGS

[0084] Figure 1 This is a flow chart of a dynamic honeypot deployment and optimization method based on intelligent traffic analysis according to an embodiment of the present invention;

[0085] Figure 2 A data collection and preprocessing flow chart of a dynamic honeypot deployment and optimization method based on intelligent traffic analysis according to an embodiment of the present invention;

[0086] Figure 3 A flowchart of random forest model training and attack type identification for a dynamic honeypot deployment and optimization method based on intelligent traffic analysis according to an embodiment of the present invention;

[0087] Figure 4 This is a flow chart of attack traffic classification based on the DBSCAN algorithm in a dynamic honeypot deployment and optimization method based on intelligent traffic analysis according to an embodiment of the present invention;

[0088] Figure 5 A flowchart of a dynamic honeypot deployment and optimization method based on intelligent traffic analysis according to an embodiment of the present invention;

[0089] Figure 6 This is a flowchart of deep Q network training based on attack traffic in a dynamic honeypot deployment and optimization method based on intelligent traffic analysis in an embodiment of the present invention. DETAILED DESCRIPTION

[0090] The following will combine Figures 1-6 The technical solutions in the embodiments of the present invention are clearly and completely described. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of them. All other embodiments derived by persons of ordinary skill in the art based on the embodiments of the present invention without creative effort are within the scope of protection of the present invention.

[0091] Example 1

[0092] Combine Figures 1-6 As shown, an embodiment of the present invention provides a dynamic honeypot deployment and optimization method based on intelligent traffic analysis, comprising the following steps:

[0093] Step S1: Collect network traffic and perform preprocessing to obtain preset network traffic characteristics;

[0094] Step S2: Based on the network traffic characteristics, a data set for random forest model training is constructed, multiple decision trees are trained, and a trained random forest model is obtained;

[0095] Step S3: Use the random forest model to identify the attack type of the input network traffic data and output the corresponding attack type;

[0096] Step S4: Based on the network traffic characteristics and the attack types identified by the model, a data set for clustering is constructed, and the data set for clustering is classified using the DBSCAN clustering algorithm to obtain multiple classification clusters;

[0097] Step S5: Deploy honeypots in descending order of priority of the classification clusters. Select the deployment location of the honeypots and complete the deployment based on the network traffic characteristics within the classification clusters and the matching rules between the classification clusters and the deployment locations.

[0098] Step S6: For the attack traffic entering each honeypot, use the deep Q network to learn the attack pattern and optimize the configuration of the honeypot node to obtain the optimal capture rate.

[0099] The present invention introduces a random forest model to accurately identify attack traffic, obtains high-quality classification through the DBSCAN clustering algorithm to achieve on-demand deployment of honeypots, and obtains the optimal configuration strategy of the honeypot through deep Q network learning. Ultimately, it realizes the intelligent dynamic deployment of the honeypot and the dynamic configuration inside the honeypot, improves the flexibility and adaptability of the honeypot deployment, makes the honeypot system more intelligent, and at the same time, improves the attack capture rate of the honeypot, maximizes resource utilization, and maximizes the attack and defense effectiveness.

[0100] Example 2

[0101] Combine Figures 1-6 As shown, the difference between this embodiment and embodiment 1 is that in step S1, the network traffic is collected and preprocessed to obtain preset network traffic characteristics, which specifically includes the following steps:

[0102] Step S11: Collect network traffic data and extract the first network traffic feature. In the specific implementation, the collected data sources are divided into historical data sets and real-time traffic data. The data in the historical data set contains traffic attack types and is used to train the random forest, while the real-time traffic data is used for decision-making on subsequent honeypot deployment optimization of the system. In this embodiment, the first network traffic feature obtained mainly includes the following content information:

[0103] 1) IP address (source address, destination address): helps identify the source of abnormal connections.

[0104] 2) Port information (source port, destination port): used to identify attacks on specific ports.

[0105] 3) Protocol types: transport layer, network layer and application layer protocols.

[0106] 4) Traffic packet size: measures the traffic characteristics of the connection. Attacks usually have abnormal packet transmission volume.

[0107] 5) Data packet flag fields: Some flag fields in the data packet can help identify different types of attack behaviors. The following flag fields can be used as features to input into the random forest.

[0108] i. TCP flag field. If the number of packets per unit time is particularly large, this field can be used to distinguish the type of flood attack (SYN flood attack, ACK flood attack, FIN flood attack, RST flood attack). The PSH flag that appears alone may indicate an attack because it is generally used in conjunction with other flags in normal traffic.

[0109] ii. An atypical TTL in the IP Flags field may indicate a forged source IP address.

[0110] iii. HTTP / HTTPS response code. The attack is likely to cause the server to return an error code.

[0111] 6) Traffic load: Extracts certain specified keywords from the traffic load to identify attack types such as SQL injection, command injection, directory traversal, and cross-site scripting, which require combined identification with the load content.

[0112] Step S12: Classify and calculate the non-numeric features in the first network traffic features to extract the second network traffic features. The first network traffic features are all information that can be directly obtained from a single flow, but they include information that cannot be directly used as feature values, such as IP addresses and ports. These traffic features are classified and calculated to determine which flows belong to the same request or the same session. The traffic features in the request or session are calculated to extract the second network traffic features. In this embodiment, the obtained second network traffic features mainly include the following content information:

[0113] 1) Requests per second: Attacks such as brute force or DoS attacks can manifest as abnormally high request rates.

[0114] 2) Number of traffic packets per unit time: This indicator can be divided into two different cases and used as a feature input for random forest construction:

[0115] i. Data packets with the same source IP but different destination IPs. Typical attacks in this mode include scanning attacks, brute force attacks, and port scanning.

[0116] ii. Data packets with the same source IP and destination IP. Typical attacks in this mode include DDoS attacks, data crawlers, and brute force attacks.

[0117] 3) Session connection interval similarity: This is expressed using the standard deviation of session intervals. The intervals between manually established sessions often vary widely. If the intervals between sessions are very close, it is likely that the session was established by an automated tool, which is more likely to be an attack.

[0118] Step S13: Perform characterization engineering on the obtained first network traffic feature and the second network traffic feature to obtain a preset network traffic feature. In a specific implementation, the characterization engineering process includes two parts:

[0119] Step S131: Use Z-score to normalize the numerical features to ensure that the dimensions of different features are consistent. Z-score normalization converts the data of numerical features into a standard normal distribution with a mean of 0 and a standard deviation of 1. The formula is:

[0120]

[0121] Where X represents the original data value, μ represents the mean of the feature, and σ represents the standard deviation of the feature.

[0122] Through Z-score normalization, all data points are scaled relative to their mean and standard deviation, making the ranges between features more consistent and reducing the impact of differences in the ranges of different features on the model.

[0123] Step S132: Convert non-numeric features such as protocol type and payload keywords into numeric features through One-Hot Encoding.

[0124] In the embodiment of the present invention, each network flow can be defined as a data point, and a data point can be represented as a feature vector x. The dimension of the vector is equal to the number of features, that is, it includes all processed traffic features after data collection and the attack type identified by the attack. If there are n features in total, the feature vector of the network flow data point is represented as:

[0125] x=[x1,x2,x3,…,x n ]

[0126] The specific information represented by each feature dimension of the feature vector is described in the following table:

[0127]

[0128]

[0129]

[0130] In addition to extracting the first network traffic feature from network traffic data, the present invention further extracts the second network traffic feature by classifying and calculating non-numerical network traffic data. The combination of the two constitutes a preset network traffic feature, which provides richer feature information for subsequent model training and cluster classification. More features help to improve the accuracy of the training model and cluster classification, and enhance the generalization ability of the training model.

[0131] Example 3

[0132] Combine Figures 1-6 As shown, the difference between this embodiment and embodiment 1 is that, for step S2, a data set for random forest model training is constructed based on network traffic characteristics, multiple decision trees are trained, and a trained random forest model is obtained. Specifically, the following steps are included:

[0133] Step S21: Add attack type labels to the feature vectors to construct a random forest model training dataset. The added label data is based on a known attack dataset or obtained through traffic analysis and manual annotation. After the network traffic feature extraction is completed, a training dataset for random forest model training is constructed, which is expressed as:

[0134] D={(x1,y1),(x2,y2),(x3,y3),…,(x n ,y n )}

[0135] Where: x i is a feature vector, representing the characteristics of the network traffic of the i-th item, that is, the data after the feature engineering in the data preprocessing step; y i It is the label corresponding to the network traffic, indicating the attack type. It supports distinguishing the attack type from the traffic characteristics and will be used in the random forest model training phase. n is the number of network traffic data.

[0136] Step S22: Randomly extract a subset from the training dataset and then randomly select some features as the training subset for each decision tree. Each tree in the random forest is randomly extracted from a subset of the dataset during training, and each tree is trained using only a subset of the features in the dataset, which helps reduce overfitting of the model.

[0137] Step S23: Build each decision tree, using Gini impurity as the splitting criterion for the decision tree, and select the feature and split point with the smallest Gini impurity to split the decision tree until the preset stopping condition is met to generate a complete decision tree. During the construction process, each decision tree will select a feature f and a split point t at each layer to split the data set, so that the split subsets are as "pure" as possible. In view of the higher real-time requirements of the attack type identification scenario, the present invention selects Gini impurity as the splitting criterion. Its calculation is relatively simple, does not involve logarithmic calculations, and can generate decision trees faster. The calculation formula of Gini impurity is:

[0138]

[0139] Where D is the dataset, C is the number of supported attack types, and p i is the probability of category i in the dataset D.

[0140] Step S24: Repeat steps S22 to S23 to construct multiple decision trees. When the number of decision trees reaches the preset requirement, a trained random forest model is obtained.

[0141] In the specific implementation process, the Gini impurity splitting criterion is used to construct each decision tree, including the following steps:

[0142] Step S231: For each decision tree, select a split point at each layer and split the subset. Specifically, for each feature, assuming there are multiple possible split points, calculate the splitting of the data set at each split point. For each split point, divide the training subset into left child nodes D according to the split point. L and right child node D R Two subsets.

[0143] Step S232: Calculate the Gini impurities of the left and right child nodes respectively:

[0144]

[0145] Among them, Gini (D L ) is the Gini impurity of the left child node, Gini(D R ) is the Gini impurity of the right child node, D L and D R They represent the proportion of samples of category i in the left child node and the right child node respectively, and C is the number of sample categories.

[0146] Step S233: Calculate the Gini impurity after splitting:

[0147]

[0148] Among them, Gini split is the Gini impurity after splitting, |D| is the total number of samples in the current node, |D L | and |D R | are the number of samples in the left and right child nodes after splitting.

[0149] Step S234: Select the optimal split. For the current node, traverse all possible feature and threshold combinations to find the one that minimizes Gini split way of splitting.

[0150] Step S235: recursively execute the above steps S231 to S234 until the stopping condition is met, that is, the maximum tree depth is reached or the number of data set samples is insufficient to split, and a complete decision tree is generated.

[0151] In this embodiment, step S3: uses a random forest model to identify the attack type of the input network traffic data and outputs the corresponding attack type. Specifically, the network traffic entering the system is extracted, and then input into the trained random forest model. The attack type is decided through a voting mechanism, and the model outputs a feature vector containing the corresponding attack type. In the specific implementation, 100 to 300 decision trees are generated, each tree is trained independently, and the classification result is finally selected through a voting mechanism. The final decision is made by combining the prediction results of multiple trees through the voting method:

[0152]

[0153] Among them, y1,y2,…,y T is the output of T trees, and mode is the function for finding the mode.

[0154] The present invention uses preset network traffic characteristics (i.e., the first network traffic characteristics and the second network traffic characteristics) as model inputs and uses the random forest algorithm to perform real-time or quasi-real-time attack type identification on network traffic. The random forest can quickly and efficiently filter and identify potential attack traffic, thereby providing a data basis for subsequent clustering and deep learning steps. Compared with systems such as IDS that rely on manually defined rules, the random forest algorithm constructed based on multiple decision trees has higher accuracy and stability due to its powerful autonomous learning and pattern mining capabilities.

[0155] Example 4

[0156] Combine Figures 1-6 As shown, the difference between this embodiment and embodiment 1 is that in step S4, based on the network traffic characteristics and the attack type identified by the model, a data set for clustering is constructed, and the data set is classified using the DBSCAN clustering algorithm. The specific clustering process includes the following steps:

[0157] Step S41: Based on the network traffic data and the attack types identified by the model, a data set for clustering is constructed. The data set includes the pre-processed network traffic features and the attack types identified by the random forest model. The attack types are added to the original network traffic features after hot-single encoding to obtain the latest feature vector, which can be used as the data point x i Assuming that the feature vector has a total of d features, the attack traffic constructed for clustering is expressed in the form of a data set, which can be specifically expressed as:

[0158] D={x1,x2,…x n}

[0159] Here, each data point x i have eigenvectors in the d-dimensional feature space.

[0160] Step S42: Define two key parameters for the DBSCAN clustering algorithm: the neighborhood radius ε and the minimum number of samples min_samples. The neighborhood radius ε is determined by analyzing the k-nearest neighbor graph for each data point. For each data point, the distances to its k closest neighbors are calculated and sorted in ascending order. The "inflection point" on the distance curve is the ε value. The minimum number of samples min_samples is set to twice the dataset dimension, i.e., min_samples = 2d.

[0161] Step S43: For each data point in the data set, calculate the number of data points within the neighborhood radius of the data point. If the number of data points is greater than or equal to the minimum number of samples, the data point is classified into the core point set, otherwise, proceed to step S44. i , define its ε-neighborhood as:

[0162] N ε (x i )={x j ∈D|d(x i ,x j )≤ε}

[0163] Among them, d(x i ,x j ) are two data points x i and x j The Euclidean distance between .

[0164] Step S44: Determine whether the data point is within the neighborhood radius of a core point. If so, the data point is classified into the boundary point set; otherwise, the data point is classified into the noise point set. i The number of points in the ε-neighborhood of satisfies |N ε (x i )|≥min_sample, then the data point is the core point; if a certain x j If a data point is located in the ε-neighborhood of a core point but does not meet the conditions for becoming a core point, then the data point is a boundary point; if a data point is neither a core point nor a boundary point, it is marked as a noise point.

[0165] Step S45: Repeat steps S43 to S45 until all data points in the data set have been traversed and grouped.

[0166] Step S46: Visit any unvisited core point in the core point set, recursively visit all boundary points and core points within the neighborhood radius of the core point, and group these points into a cluster.

[0167] Step S47: Repeat step S46 until all data points in the core point set are visited and classified as points of a certain cluster or noise points, and multiple classification clusters are obtained. The final result of clustering is {C1, C2, ..., C k}, k is the number of classification clusters, each cluster C i The set of noise points containing attack traffic with similar density is N. The complete dataset is represented as

[0168]

[0169] The DBSCAN clustering algorithm can classify attack traffic and filter out isolated noise traffic.

[0170] The present invention uses the DBSCAN clustering algorithm to accurately classify attack traffic based on the attack type identified by network traffic data and models, and obtains multiple similar attack traffic classification clusters. This provides high-quality classified attack traffic data for subsequent determination of honeypot deployment locations based on cluster priorities, and for introducing specific classification clusters into honeypots for deep learning to optimize and adjust the internal configuration of honeypots. At the same time, for new attack traffic, it can quickly determine the cluster to which it belongs and then accurately guide it to the corresponding honeypot.

[0171] Example 5

[0172] Combine Figures 1-6 As shown, the difference between this embodiment and embodiment 1 is that, in step S5, the honeypots are deployed in descending order of the classification cluster priority, and the deployment location of the honeypot is selected and deployed based on the network traffic characteristics within the cluster and the matching rules between the cluster and the deployment location. The process includes the following steps:

[0173] Step S51: Define the type of honeypot deployment location based on the network structure and network security requirements. The types of honeypot deployment locations are mainly divided into the following types:

[0174]

[0175]

[0176] Step S52: Based on the type of honeypot deployment location, traffic characteristics are analyzed for each cluster, and matching rules are formulated for clusters to deployment locations. In practice, cluster traffic characteristics analysis primarily analyzes traffic characteristics such as IP addresses, ports, and protocol types to determine the scope of attack traffic and the primary target of the attack, including external networks, internal networks, and specific protocol assets.

[0177] In the specific implementation, the traffic feature distribution of each cluster is analyzed, and the deployment location of the honeypot is determined according to the matching rules, and the corresponding type of honeypot is deployed at the corresponding location. Among them, the matching rules of the traffic features of different dimensions of the cluster to the honeypot deployment location are shown in the traffic feature matching rule table below:

[0178]

[0179]

[0180] In the matching rules, the classification rules are defined for the feature whose dimension is traffic packet size. The specific rules are shown in the traffic packet size classification table below:

[0181]

[0182] Among them, in the matching rules, for the feature definition of the number of requests per second dimension, the specific rules are shown in the following table of the number of requests per second classification:

[0183]

[0184] Finally, according to the deployment location area, configure the corresponding type of honeypot at the corresponding location. The specific deployment location area and honeypot type comparison table is as follows:

[0185]

[0186]

[0187] Note: Popular ports refer to ports that are widely used on the Internet or frequently scanned and exploited by attackers, including HTTP (80) / HTTPS (443), FTP (20), 21, SSH (22), SMTP (25), DNS (53), MySQL (3306), PostgreSQL (5432), RDP (3389), and Telnet (23).

[0188] Step S53: A comprehensive score is assigned to each cluster obtained through clustering, and the clusters are prioritized based on the score. Each cluster is scored and prioritized based on the score, with higher-priority clusters corresponding to locations with more deployed resources. In practice, each cluster is scored based on two factors: the severity of the attack traffic within the cluster, which determines the level of danger of the attack type; and the scale of the attack traffic within the cluster, which determines the proportion of the attack traffic within the cluster to the total attack traffic.

[0189] In a specific implementation, the method for calculating the comprehensive score of each cluster includes the following steps:

[0190] Step S531: Set the priority score P of the cluster cluster As a comprehensive score, the calculation formula is:

[0191] P cluster =ω1·S severity +ω2·S scale

[0192] Among them, P cluster S is the priority score of the cluster, severity Score the severity of attack traffic within the cluster, S scale Score the traffic scale within the cluster, with ω1 and ω2 as weights;

[0193] Step S532: Assign points according to the severity of the attack type of the attack traffic, and then calculate the severity score S of the attack traffic in the cluster. severity , and its calculation formula is:

[0194]

[0195] Among them, G i is the severity score of the i-th attack, W i is the proportion of the attack in the cluster, and N is the total number of attack types in the cluster.

[0196] When calculating the score, you can formulate scoring rules and assign scores based on the severity of the attack type of the attack traffic. The scores can be divided into: high-risk attacks (such as DDoS and SQL injection) with a score of 10, medium-risk attacks (such as scanning) with a score of 6, and low-risk attacks (such as information detection) with a score of 3.

[0197] Step S533: Assign points based on the proportion of the number of data points in the cluster to the total traffic, and calculate the traffic scale score S scale , and its calculation formula is:

[0198]

[0199] Among them, N cluster is the number of traffic points of the current cluster, N total is the number of points for all traffic, is the cluster with the largest total traffic among all clusters. In this way, the cluster size score is automatically normalized, S scale The value range is (0,10], the largest cluster gets a full score of 10, and the scores of small clusters are also reflected.

[0200] Step S534: Balance the importance of the two indicators by adjusting the weights ω1 and ω2, and combine them to obtain a comprehensive score P cluster When calculating the score, if the attack is more serious, ω1 is increased. If the network load is heavy and the traffic scale is given priority, ω2 is increased. The default weight ω1 = ω2 = 0.5.

[0201] Step S54: Deploy honeypots in descending order of cluster priority. Select the honeypot deployment location and complete the deployment based on the network traffic characteristics within the cluster and the matching rules between cluster and deployment location. cluster Arrange in descending order, and deploy high-priority ones first. During deployment, determine whether there are surplus honeypot resources. If there are surplus honeypot resources, deploy real honeypots, otherwise deploy virtual honeypots. This deployment maximizes resource utilization.

[0202] The selection of honeypot deployment location adopts a multi-location combination strategy, specifically: according to the traffic characteristics within the cluster, the correlation of different locations in the matching rule table of the cluster deployment location is matched item by item. Each matching location will have a score. If the characteristics are completely matched, the weight score will be increased (such as 5 points). If the characteristics are partially matched, the weight score will be reduced (such as 2 points). The scores of all characteristics of each location are added up, and the location with the highest score is selected for deployment. If the traffic matching scores of multiple locations are the same, they are deployed according to the following priority: near the core node > near the intranet assets > DMZ area > VPN, remote access exit > hot spot location > boundary network segment.

[0203] Step S55: Repeat step S54, traverse all classification clusters in turn, and complete the honeypot deployment at the corresponding location.

[0204] Because cluster generation requires sufficient data points, if data points are insufficient in the early stages, they are first stored in a buffer and attack traffic is isolated to prevent impact on normal business operations. Once sufficient data points are generated and clusters are formed, subsequent attack traffic is redirected to the honeypot in the corresponding area.

[0205] The present invention implements a multi-location deployment strategy based on cluster analysis results, matching the characteristic distribution of each cluster in the clustering results with the capture targets at different locations. Clusters are deployed in descending order of cluster priority to achieve efficient resource utilization and maximize capture effectiveness. Simultaneously, a dynamic adjustment strategy is adopted for the clustering results, regularly re-analyzing clusters, monitoring cluster changes, and dynamically adjusting honeypot deployment based on new characteristics, releasing unnecessary honeypot nodes to maximize resource utilization. This dynamic honeypot deployment method based on a clustering algorithm can adjust the number, type, and location of honeypot nodes based on real-time traffic and attack trends, achieving optimal resource allocation.

[0206] Example 6

[0207] Combine Figures 1-6 As shown, the difference between this embodiment and embodiment 1 is that, for step S6, the attack traffic inside each honeypot is targeted, and the attack pattern is learned using a deep Q network, optimizing the configuration of the honeypot node to obtain the optimal capture rate. The key part is that the model trained using the deep Q network can select the optimal honeypot configuration strategy based on the traffic characteristics, and the core of the training process is to achieve automatic configuration strategy selection by learning the Q value function Q(S, A) of each state-action pair and selecting the action with the largest Q value. The process includes the following steps:

[0208] Step S61: Define the state space, action space, and reward function of the deep Q network. The specific definitions are as follows:

[0209] 1) State space S: The state space is defined as consisting of the collected network traffic feature information. The state space S is represented as follows:

[0210] S=[f1,f2,…,f n ]

[0211] Among them, f1,f2,…,f n is the network traffic statistics data, namely, the first network traffic feature and the second network traffic feature output by the attack identification module, and n is the number of network traffic data.

[0212] 2) Action space A: The action space is defined as the set of all configuration strategies that the system can execute. There are five configuration strategies in total. The action space A is represented as follows:

[0213] A={E,I,R,D,L}

[0214] Here, "E" represents a service adjustment action, which is achieved by adding or removing services or changing service port numbers or port ranges. Different services attract different types of attackers. For example, adding HTTP services is more likely to attract web application attacks, while opening SSH ports increases the likelihood of brute force attacks. Changing port numbers can induce attackers to launch scanning attacks against the honeypot. Adding more services attracts more attack traffic, but this also increases system resource consumption, so a trade-off must be made between these two.

[0215] I represents the interaction depth adjustment action, which adjusts the service's response complexity (from simple to complex) to simulate more vulnerabilities or real system behavior. Increasing the interaction depth increases the likelihood of attackers interacting with the honeypot, forcing them to spend more time attempting attacks (e.g., executing commands, probing for vulnerabilities, etc.). High-interaction honeypots can record a more complete attack process, increasing the collection of valuable data. The deeper the interaction depth, the closer the honeypot is to the real system, making it more attractive to experienced attackers. However, high-interaction honeypots can be used as springboard attacks, requiring more system resources to maintain isolation.

[0216] R represents resource allocation adjustments, dynamically adjusting the system's CPU and memory allocation, and limiting or increasing storage capacity. Increasing resources can mitigate frequent or large-scale attacks (such as DDoS) and prevent system downtime; reducing resources may result in some attack traffic not being captured. Dynamic resource allocation can reduce operating costs while improving system stability.

[0217] D represents data decoy adjustments, increasing the amount of decoy data (e.g., forging a database) and modifying the decoy content (e.g., forging sensitive information). Data decoys can attract more targeted attacks; different types of decoys trigger different attack behaviors, expanding the types of data captured and confusing attackers, making the honeypot difficult to identify.

[0218] L represents actions to adjust the scope of log capture, including adjusting the granularity of packet capture (full packet or metadata) and increasing or decreasing the types of log records (such as commands and attack tool signatures). More detailed logs can capture the entire attack process, but increase storage and analysis costs. Wider log coverage helps extract attack behavior characteristics and improve subsequent analysis. Reducing log granularity can improve the system's real-time processing capabilities.

[0219] These actions have varying effects on the effectiveness of capturing attack traffic. Adding service types and adjusting data decoys can increase the diversity of captured traffic; adjusting interaction depth can attract more advanced attackers and obtain more attack data; and adjusting resource allocation and logging granularity can optimize costs. Through a deep Q-network, the honeypot can balance these actions and gradually learn the optimal configuration strategy to achieve the best balance between resource consumption and capture efficiency.

[0220] 3) Reward function R(S,A): This function evaluates the strategy action based on the honeypot configuration’s attack capture effect. The reward factors in this system are:

[0221] a) Attack capture: The capture efficiency is directly measured by the size of the attack traffic per unit time and the number of attack types captured by the honeypot. The larger the attack traffic captured and the more types of attacks captured, the greater the reward. When there is no attack traffic for a period of time, no reward or penalty is given. When attack traffic is identified but capture fails due to system resource overload and no attack information is recorded, a penalty is given.

[0222] b) Attack interaction depth: The deeper the attacker's interaction depth in the honeypot, the higher the reward and no penalty.

[0223] c) Resource usage: The resource consumption of the honeypot when capturing attacks. If the system resources consumed by a unit of attack traffic are too large, a penalty will be given, and rewards will be given for each hour of consumption.

[0224] To sum up, the reward function is defined as:

[0225] R(S,A)=ω1R capture +ω2R depth +ω3R resource

[0226] Among them, R captureR is the capture of the attack by the honeypot after taking action A in the current state S. capture =size flow +counts type , size flow is the size of the captured attack traffic, counts type The number of attack types captured.

[0227] R depth is the attacker’s interaction depth in the honeypot after taking action A in the current state S, R depth =duration+complex, where duration represents the time the same attack stays in the honeypot, and complexity represents the complexity of the attack, which is reflected in the number of attack sessions and the number and types of commands used in the attack.

[0228] R resource It is the system resources consumed by capturing unit traffic after taking action A in the current state S; is the size of the captured attack traffic, R cpu is the CPU usage, R disk The size of the logs recorded to capture attack traffic, R mem is the memory usage, in Mb; ω cpu 、ω disk 、ω mem The default value is 1. If a resource is in short supply, you can increase the weight of that resource appropriately.

[0229] ω i The weight of the corresponding reward function part. The default value is 1. If you pay more attention to the impact of a certain part on the system, increase the corresponding weight.

[0230] Step S62: Set the Q-value update function Q(S,A) of the deep Q network, the formula is:

[0231] Q(S t ,A t )←Q(S t ,A t )+α[R(S t ,A t )+γmaxQ(S t+1 ,A t )-Q(S t ,A t )]

[0232] Among them, S t is the current state; A t is the currently selected action; R(S t ,A t) is the reward obtained after executing the current action; S t+1 is the state after executing the current action; γ is the discount factor, which controls the influence of future rewards (usually chosen to be 0.99); α is the learning rate, which controls the step size of each update.

[0233] Step S63: Introduce the attack traffic belonging to a certain cluster into the corresponding honeypot, and use the deep Q network to learn in each honeypot to obtain a trained deep Q network model;

[0234] Step S64: The Deep Q Network model selects the optimal honeypot configuration strategy by maximizing the Q value based on the traffic characteristics entering the honeypot. After training, the Deep Q Network will use the previously learned strategy to perform the action that maximizes the Q value for the current state (i.e., network traffic characteristics). This action is the optimal configuration strategy, which can effectively capture attacks while achieving efficient allocation and rational utilization of network resources.

[0235] In step S63, the training process of the deep Q network model includes the following steps:

[0236] Step S631: Initialize the Q network Q(S,A), the target Q network Q target (S, A) and experience recycling pool. Among them, initialize the Q network Q (S, A), use the neural network to approximate the Q value; initialize the target Q network Q target (S,A), same as Q network, but with slower update speed.

[0237] Step S632: In each training step, based on the ε-greedy strategy, according to the current state S t Select an action A t .

[0238] In the specific implementation process, at each training step, according to the current state S t Select an action A t The ε-greedy strategy balances exploration and exploitation. Specifically, an action is randomly selected with probability ε (exploration) and the action with the highest Q value is selected with probability 1-ε (exploitation). During the initialization phase, a large ε value (exploration probability) is set. For example, an initial ε value of 0.9 means there is a 90% probability of randomly selecting an action and a 10% probability of selecting the action with the highest Q value. Exponential decay is used to gradually reduce the ε value until it approaches or equals zero. Exponential decay keeps the ε value large in the early stages of training, allowing for more exploration, and gradually decreases it in the later stages, allowing the algorithm to exploit more of what it has learned.

[0239] ε(t)=ε end +(ε start -εend )·e -λt

[0240] Where ε(t) is the value of ε at time t; ε start is the initial ε value; ε end is the final ε value (i.e., the lower limit of ε after decay); λ is the decay rate, which controls the speed at which the ε value decreases. A larger λ value will cause the ε value to decrease faster; t is the current time step or the number of training steps; e is the base of the natural logarithm.

[0241] Under the ε-greedy strategy, the action selection expression action A t for:

[0242]

[0243] Among them, A t is the currently selected action, with probability ε, choose A random , that is, randomly selecting an action from the action space, which is the exploration part, used to discover new actions that may have higher rewards. With probability 1-ε, select argmax A Q(S t ,A), that is, according to the current state S t , select the action that maximizes the Q value from the Q-function. This is the utilization part, which uses existing experience to select the action that is currently considered optimal.

[0244] Step S633: Execute current action A t , observe the reward R(S t ,A t ) and the next state S t+1

[0245] Step S634: The current state, action, reward and next state are taken as a tuple (S t , A t , R(S t , A t ), S t+1 ) is stored in the experience replay pool, and then sampled from the experience replay pool and updated the Q value.

[0246] In the specific implementation process, a small batch of sample sets B are randomly selected from the experience replay pool, and the Q value y is calculated for each sample (S, A, R, S′) in the sample set:

[0247] y=R+γmax a Q target (S′,A)

[0248] Among them, R is the immediate reward in the sample; rmax a Q target(S′, S) is the discounted future reward, which represents the maximum Q value that can be obtained starting from the next state S′, and multiplied by a discount factor γ (between 0 and 1), Q ttrget It is the target Q network, which is used to improve the stability of the deep Q network.

[0249] Finally, the mean square error loss function is used to update the weights of the Q network. The loss function is defined as:

[0250]

[0251] Use the gradient descent method to minimize the loss function to determine the Q network parameters θ. The steps are as follows.

[0252] ①Calculate the gradient: The error term of each sample in the loss function is (yS(S,A)) 2 , for this error term with respect to the Q network parameter θ, we get the gradient:

[0253]

[0254] Among them, yQ(S,A) is the prediction error, that is, the difference between the current Q value and the target Q value; It is the partial derivative of the Q network with respect to the parameter θ, which indicates the sensitivity of the Q value to its weight parameter.

[0255] ② Update parameters using gradient descent: According to the gradient, the weight θ of the Q network is updated using the gradient descent method:

[0256]

[0257] Among them, α is the learning rate, which controls the step size of each weight update. Initially, 0.001 is selected as the starting point. If the model becomes unstable during training, it is lowered. If the training converges very slowly or even stagnates, it is increased.

[0258] Step S635: If the soft update frequency is reached, the Q network parameters are synchronized with the target network. This ensures a more stable target value for the target Q network, which impacts model stability and convergence speed. The initial value is set to 2000. If the Q value fluctuates significantly during training, increase this value appropriately, in increments of 1000.

[0259] Step S636: Repeat the above steps until the Q network converges, that is, the actions selected under the same state tend to be stable, and output the trained deep Q network.

[0260] The present invention customizes the state space, action space, and reward function of the deep Q network, and uses the deep Q network algorithm to intelligently learn the internal configuration of the honeypot node. The deep Q network learns how to select the optimal honeypot configuration strategy based on the traffic characteristics entering the honeypot. By maximizing the Q value, the model will give priority to strategies that can effectively capture attacks and minimize resource consumption, allowing the honeypot to dynamically adjust the actions mentioned in the present invention, improving the capture rate of attack traffic while minimizing resource utilization. Combined with the DQN experience replay and target network update strategy, the response to different types of attacks is optimized, enabling the honeypot to cope with changing attack patterns and continuously optimize the capture strategy, making the honeypot more flexible and intelligent when capturing attack traffic.

[0261] Example 7

[0262] In this embodiment, common DDoS attack types are mainly used as specific examples to explain in detail the process of obtaining the optimal configuration strategy and dynamically adjusting the honeypot related configuration through deep Q network learning in the present invention.

[0263] Consider a honeypot system designed to defend against potential DDoS attacks. Honeypots receive and analyze network traffic to identify and block malicious traffic. However, traditional honeypot configurations can suffer from resource inefficiencies, such as frequent adjustments to service port numbers or excessive logging, which can consume significant system resources.

[0264] Specific steps:

[0265] 1) Initialize the honeypot configuration, including: setting the initial service port number range and open service list; initializing the interactive depth to limit the attacker's operation rights on the honeypot; adjusting available system resources (CPU load, memory usage); and determining the log capture granularity and type.

[0266] 2) Conducting Deep Q-Network model training. The training process includes: the Deep Q-Network evaluates all possible actions A based on the current state S and selects the optimal action to maximize the total future reward; after each attack, the Deep Q-Network receives new state information and adjusts its strategy; the Deep Q-Network is trained on batch datasets to learn the optimal configuration adjustment strategy under different attack scenarios.

[0267] 3) The Deep Q Network learns to select the optimal honeypot configuration strategy based on the traffic characteristics entering the honeypot, thereby dynamically adjusting the honeypot configuration. The specific adjustment strategy can be divided into several aspects:

[0268] Adjusting open services: During implementation, select an appropriate port range and open list based on the characteristics of attack traffic. For example, when facing a DDoS attack, add specific ports to attract more attack traffic. For TFA attacks, keep multiple ports open to allow normal communication and abnormal traffic to coexist.

[0269] Interactive deep control: During the specific implementation process, the attacker's access rights to the honeypot can be restricted to prevent them from performing deep operations or stealing data; by setting access control rules (such as allowing only read operations and prohibiting write operations), the attacker's action space can be reduced.

[0270] Resource allocation optimization: When high-frequency attacks occur, dynamically increase system resources (such as CPU load) to meet attack demands; monitor system resource usage and trigger resource limitation mechanisms in a timely manner to avoid honeypot downtime due to insufficient resources.

[0271] Adjusting the scope of log capture: During implementation, the capture granularity of detailed log information can be increased (e.g., refining event time resolution) to better analyze attack signatures; while also reducing unnecessary log types and controlling the system's overall resource consumption.

[0272] 4) Conduct evaluation and continuous iteration: During each attack, evaluate the capture rate and system resource usage under the current configuration; adjust the Deep Q Network strategy based on the results to optimize future configuration choices; iterate the training process to continuously improve the decision-making ability of the DQN.

[0273] When facing network attacks such as DDoS, the present invention trains a deep Q-network model to derive an optimal configuration strategy. Based on the dynamic adjustment of the strategy to optimize the honeypot configuration, the honeypot system can maximize the capture of attack traffic, identify and intercept DDoS attack traffic to the greatest extent possible, and improve honeypot capture. Simultaneously, it effectively optimizes resource allocation, minimizes system resource consumption, reduces system resource utilization, reduces the demand for system processing power, and avoids honeypot downtime due to insufficient resources. The present invention maximizes attack and defense effectiveness. This adaptive configuration optimization method can cope with various attack scenarios and make the best decision based on actual conditions, thereby improving the security and efficiency of the honeypot.

[0274] Example 8

[0275] The embodiment of the present invention further provides a dynamic honeypot deployment and optimization system based on intelligent traffic analysis, using any of the dynamic honeypot deployment and optimization methods based on intelligent traffic analysis as described above, the system includes a data acquisition module, an attack behavior identification module, a honeypot intelligent deployment module, and a dynamic configuration module;

[0276] The data acquisition module is used to collect network traffic and perform preprocessing to obtain preset network traffic characteristics;

[0277] The attack behavior identification module uses the network traffic characteristics output by the data acquisition module to train a random forest model. It then uses the trained random forest model to identify the attack type based on the input network traffic data, providing data support for decision-making.

[0278] The honeypot intelligent deployment module includes a cluster generation module and a dynamic deployment module. The cluster generation module constructs a cluster data set based on the network traffic characteristics output by the data acquisition module and the attack types identified by the random forest model, and classifies the data set using the DBSCAN algorithm to obtain multiple classification clusters. The dynamic deployment module then selects the deployment location of the honeypot and completes the deployment based on the network traffic characteristics within the classification cluster and the matching rules between the classification cluster and the honeypot deployment location.

[0279] The dynamic configuration module uses a deep Q network to learn the attack patterns of attack traffic entering each honeypot and optimizes the configuration of honeypot nodes to obtain the best capture rate.

[0280] The first three modules implement the intelligent deployment of honeypots, and the fourth module implements the dynamic configuration within the honeypot.

[0281] This invention utilizes a dynamic honeypot deployment and optimization system comprised of three components: attack traffic identification, on-demand honeypot deployment, and honeypot configuration strategy optimization. This system automates and intelligentizes the entire process, from traffic identification to honeypot capture. This system, which spans network attack identification and adaptive defense strategy adjustment, is capable of handling a variety of attack scenarios and possesses independent dynamic defense capabilities.

[0282] The above description is only an embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent replacements, and improvements made within the scope of the present invention shall be included in the scope of protection of the present invention.

Claims

1. A dynamic honeypot deployment and optimization method based on intelligent traffic analysis, characterized in that: The following steps are involved: Step S1: Collect network traffic and perform preprocessing to obtain preset network traffic characteristics; Step S2: Based on the network traffic characteristics, a data set for random forest model training is constructed, multiple decision trees are trained, and a trained random forest model is obtained; Step S3: Use the random forest model to identify the attack type of the input network traffic data and output the corresponding attack type; Step S4: Based on the network traffic characteristics and the attack types identified by the random forest model, a data set for clustering is constructed, and the data set for clustering is classified using the DBSCAN clustering algorithm to obtain multiple classification clusters; Step S5: Deploy honeypots in descending order of priority of the classification clusters. Select the deployment location of the honeypots and complete the deployment based on the network traffic characteristics within the classification clusters and the matching rules from the classification clusters to the honeypot deployment locations. Step S6: For the attack traffic entering each honeypot, use the deep Q network to learn the attack pattern and optimize the configuration of the honeypot node to obtain the optimal capture rate.

2. A dynamic honeypot deployment and optimization method based on intelligent traffic analysis according to claim 1, characterized in that: In step S1, the network traffic is collected and pre-processed to obtain a preset feature vector, which specifically includes the following steps: Step S11: collecting network traffic data and extracting first network traffic features; Step S12: performing traffic classification and calculation on the non-numerical features in the first network traffic features to extract the second network traffic features; Step S13: Perform feature engineering processing on the obtained first network traffic feature and the second network traffic feature to obtain a preset network traffic feature.

3. A dynamic honeypot deployment and optimization method based on intelligent traffic analysis according to claim 1, characterized in that: In step S2, based on the network traffic characteristics, a data set for random forest model training is constructed, multiple decision trees are trained, and a trained random forest model is obtained, which specifically includes the following steps: Step S21: adding attack type labels to the feature vectors to construct a random forest model training dataset; Step S22: randomly extract a subset from the training data set, and then randomly select some features as the training subset for each decision tree; Step S23: construct each decision tree, use Gini impurity as the splitting criterion of the decision tree, select the feature and split point with the smallest Gini impurity to split the decision tree, until the preset stopping condition is met, and generate a complete decision tree; Step S24: Repeat steps S22 to S23 to construct multiple decision trees. When the number of decision trees reaches the preset requirement, a trained random forest model is obtained.

4. A dynamic honeypot deployment and optimization method based on intelligent traffic analysis according to claim 3, characterized in that: In step S23, the process of constructing each decision tree using the Gini impurity splitting criterion includes the following steps: Step S231: For the decision tree, select a split point at each layer and divide the training subset into left child nodes D according to the split point. L and right child node D R Two subsets; Step S232: Calculate the Gini impurities of the left and right child nodes respectively: Among them, Gini (D L ) is the Gini impurity of the left child node, Gini(D R ) is the Gini impurity of the right child node, D L and D R Respectively represent the proportion of samples of category i in the left child node and the right child node, and C is the number of sample categories; Step S233: Calculate the Gini impurity after splitting: Among them, Gini split is the Gini impurity after splitting, |D| is the total number of samples in the current node, |D L | and |D R | are the number of samples in the left and right child nodes after splitting; Step S234: Select the optimal split. For the current node, traverse all possible split combinations and find the one that minimizes Gini split The way of splitting; Step S235: recursively execute the above steps S231 to S234 until the stopping condition is met, that is, the maximum tree depth is reached or the number of data set samples is insufficient to split, and a complete decision tree is generated.

5. The method for dynamic honeypot deployment and optimization based on intelligent traffic analysis according to claim 1 is characterized in that: In step S4, based on the network traffic characteristics and the attack types identified by the model, a data set for clustering is constructed, and the data set for clustering is classified using the DBSCAN clustering algorithm, which specifically includes the following steps: Step S41: constructing a data set for clustering based on the network traffic data and the attack types identified by the model; Step S42: defining the neighborhood radius and minimum number of samples for the DBSCAN clustering algorithm; Step S43: For each data point in the data set, calculate the number of data points within the neighborhood radius of the data point. If the number of data points is greater than or equal to the minimum number of samples, then the data point is included in the core point set. Otherwise, proceed to step S44. Step S44: Determine whether the data point is within the neighborhood radius of a core point. If so, the data point is classified into the boundary point set; otherwise, the data point is classified into the noise point set. Step S45: repeat steps S43 to S45 until all data points in the data set have been traversed and grouped; Step S46: Visit any unvisited core point in the core point set, recursively visit all boundary points and core points within the neighborhood radius of the core point, and group these points into a cluster; Step S47: Repeat step S46 until all data points in the core point set are visited and classified as points of a certain cluster or noise points, thereby obtaining multiple classification clusters.

6. A dynamic honeypot deployment and optimization method based on intelligent traffic analysis according to claim 1, characterized in that: In step S5, the honeypots are deployed in descending order of the classification cluster priority. The deployment location of the honeypot is selected and the deployment is completed according to the network traffic characteristics within the classification cluster and the matching rules from the classification cluster to the deployment location. Specifically, the following steps are included: Step S51: defining the type of honeypot deployment location according to the network structure and network security requirements; Step S52: Analyze the traffic characteristics of each classification cluster according to the type of honeypot deployment location, and formulate matching rules between the classification cluster and the deployment location; Step S53: comprehensively scoring each classification cluster obtained by clustering, and prioritizing the classification clusters according to the scoring results; Step S54: Deploy honeypots in descending order of priority of the classification clusters. Select the deployment location of the honeypots and complete the deployment based on the network traffic characteristics within the classification clusters and the matching rules between the classification clusters and the deployment locations. Step S55: Repeat step S54, traverse all classification clusters in turn, and complete the honeypot deployment at the corresponding location.

7. A dynamic honeypot deployment and optimization method based on intelligent traffic analysis according to claim 6, characterized in that: In step S53, the method for calculating the comprehensive score of each classification cluster includes the following steps: Step S531: Set the priority score P of the classification cluster cluster As a comprehensive score, the calculation formula is: P cluster =ω1·S severity +ω2·S scale Among them, P cluster S is the priority score of the cluster, severity Score the severity of attack traffic within the cluster, S scale Score the traffic scale within the cluster, with ω1 and ω2 as weights; Step S532: Calculate the severity score S of the attack traffic within the classification cluster severity , and its calculation formula is: Among them, G i is the severity score of the i-th attack, W i is the proportion of the attack in the cluster, and N is the total number of attack types in the cluster; Step S533: Calculate the traffic scale score S scale , and its calculation formula is: Among them, N cluster is the number of traffic points in the current cluster, N total is the number of points for all traffic, It is the cluster with the largest total traffic among all clusters; Step S544: Balance the importance of the two indicators by adjusting the weights ω1 and ω2, and combine them to obtain a comprehensive score P cluster .

8. The method for dynamic honeypot deployment and optimization based on intelligent traffic analysis according to claim 1, characterized in that: In step S6, the attack pattern is learned using a deep Q network for entering each honeypot, and the configuration of the honeypot node is optimized to obtain the best capture rate, which specifically includes the following steps: Step S61: define the state space, action space and reward function of the deep Q network; Step S62: Setting the Q-value update function Q(S,A) of the deep Q network; Step S63: Introduce the attack traffic belonging to a certain classification cluster into the corresponding honeypot, and use the deep Q network to learn in each honeypot to obtain a trained deep Q network model; Step S64: The deep Q network model selects the optimal honeypot configuration strategy by maximizing the Q value according to the traffic characteristics entering the honeypot.

9. A dynamic honeypot deployment and optimization method based on intelligent traffic analysis according to claim 8, characterized in that: In step S61, the state space, action space and reward function of the deep Q network are defined as follows: 1) State space S: The state space is defined as consisting of the collected network traffic feature information. The state space S is represented as follows: S=[f1,f2,…,f n ] Among them, f1,f2,…,f n is the network traffic statistics data, namely, the first network traffic feature and the second network traffic feature output by the attack identification module, and n is the number of network traffic data; 2) Action space A: The action space is defined as the set of all configuration strategies that the system can execute. There are five configuration strategies in total. The action space A is represented as follows: A={E,I,R,D,L} Among them, E represents service adjustment action, I represents interaction depth adjustment action, R represents resource allocation adjustment action, D represents data bait adjustment action, and L represents log capture range adjustment action; 3) Reward function R(S,A), specifically defined as: R(S,A)=ω1R capture +ω2R depth +ω3R resource Among them, R(S,A) represents the immediate reward obtained after taking action A in state S, R capture R is the capture of the attack by the honeypot after taking action A in the current state S. depth is the attacker’s interaction depth in the honeypot after taking action A in the current state S, R resource The system resources consumed by capturing unit traffic after taking action A in the current S state. w1, w2, and w3 are weights, all 1 by default. If you pay more attention to the impact of a certain part on the system, increase the corresponding weight.

10. A dynamic honeypot deployment and optimization system based on intelligent traffic analysis, characterized in that: A dynamic honeypot deployment and optimization method based on intelligent traffic analysis according to any one of claims 1 to 9 is used, wherein the system includes a data acquisition module, an attack behavior identification module, a honeypot intelligent deployment module, and a dynamic configuration module; The data acquisition module is used to collect network traffic and perform preprocessing to obtain preset network traffic characteristics; The attack behavior identification module uses the network traffic characteristics output by the data acquisition module to train a random forest model, and then uses the trained random forest model to identify the attack type of the input network traffic data; Honeypot intelligent deployment module, including cluster generation module and dynamic deployment module. The cluster generation module builds a cluster data set based on the network traffic characteristics output by the data acquisition module and the attack types identified by the random forest model, and classifies the data set using the DBSCAN algorithm to obtain multiple classification clusters. Then the dynamic deployment module selects the honeypot deployment location and completes the deployment based on the network traffic characteristics within the classification cluster and the matching rules between the classification cluster and the honeypot deployment location; The dynamic configuration module uses a deep Q network to learn the attack patterns of attack traffic entering each honeypot and optimizes the configuration of honeypot nodes to obtain the best capture rate.

Images