Construction method and system of dynamic threat capture system

Abstract

The invention provides a construction method and system for a dynamic threat capture system, and relates to the technical field of system construction, and the method comprises the steps: obtaining heterogeneous security data, extracting a three-domain behavior portrait, constructing a multi-dimensional feature vector, and recognizing attack features; dynamically constructing a virtual target environment to guide attacks, and obtaining threat data based on multi-modal perception; constructing a feature library for comparison, predicting an attack path, and generating a protection rule; and deploying protection measures to obtain confrontation data, and updating the feature library optimization rule. According to the invention, accurate identification, effective trapping and continuous confrontation of network threats can be realized, and the network security protection capability is improved.

Description

TECHNICAL FIELD

[0001] The present application relates to system construction technology, in particular to a method and system for constructing a dynamic threat capture system. BACKGROUND

[0002] With the rapid development of information technology, network security threats are increasingly complex and variable, and traditional static protection methods have been difficult to meet the security protection needs in today's network environment. At present, various network attack methods are constantly upgraded, and the techniques used by attackers are increasingly concealed, and the attack path is more complex, bringing great challenges to network security protection. Under this background, dynamic threat capture technology has gradually become a research hotspot in the field of network security, and its core idea is to attract and capture attackers by constructing a virtual environment, analyze attack behavior characteristics, and form an effective protection strategy.

[0003] Traditional threat capture systems mainly focus on single-dimensional security data analysis and lack comprehensive processing capabilities for heterogeneous security data. In actual application, the types of security data generated in the network environment are diverse, including network traffic, system logs, user behavior, etc. There are complex associations between these data, and single-dimensional data analysis cannot fully reflect the behavior characteristics of attackers, resulting in insufficient accuracy of threat identification.

[0004] Existing threat capture systems mostly adopt static protection architecture, which cannot dynamically adjust protection strategies according to attack characteristics. This fixed protection mode allows attackers to discover system protection weaknesses through long-term observation, thereby bypassing protection measures to implement attacks. At the same time, the static protection architecture is difficult to cope with the changing attack strategies of attackers, and cannot achieve continuous and effective threat protection.

[0005] In addition, the traditional threat capture system has limited capabilities in threat behavior analysis and prediction, and lacks accurate prediction of subsequent attacker behavior. Due to the lack of a perfect threat behavior feature library and behavior model, the system cannot infer the subsequent attack path that may be taken by the attacker based on the captured attack characteristics, which results in the lack of foresight in the deployment of protection measures, and only passive response to the attacks that have occurred, and cannot achieve active protection. SUMMARY

[0006] The embodiments of the present application provide a method and system for constructing a dynamic threat capture system, which can solve the problems in the prior art.

[0007] In a first aspect of the embodiments of the present application, a method for constructing a dynamic threat capture system is provided, comprising: acquiring heterogeneous security data in a target network environment, extracting a three-domain behavior portrait based on the heterogeneous security data, constructing a multi-dimensional feature vector, and identifying threat attack characteristics through feature matching of the three-domain behavior portrait; According to the attack characteristics, a virtual target environment with a layered protection architecture is dynamically constructed, the attack characteristics are guided into the virtual target environment, and multi-modal perception is performed based on the feature template of the three-domain behavior portrait to obtain threat behavior data; A threat behavior feature library is constructed, the threat behavior data is compared with the three-domain behavior portrait, a subsequent attack path is predicted, and a protection rule is generated; According to the protection rule, corresponding protection measures are deployed in the virtual target environment, and the attack characteristics are continuously obtained through multi-modal perception. Based on the countermeasure data of the attack characteristics, the threat behavior feature library is updated, and the protection rule is optimized to realize continuous confrontation of the attack characteristics.

[0008] Based on the heterogeneous security data, a three-domain behavior portrait is extracted, a multi-dimensional feature vector is constructed, and a threat attack characteristic is identified through feature matching of the three-domain behavior portrait, including: A three-dimensional feature vector is extracted from the heterogeneous security data, the three-dimensional feature vector is spliced to construct a behavior state node, the state transition probability between the behavior state nodes is calculated to construct a state transition edge, and the behavior evolution graph is constructed by the behavior state node and the state transition edge. Based on the behavior evolution graph, the behavior similarity deviation and state transition anomaly degree between adjacent behavior state nodes are calculated, and the behavior state node with the behavior similarity deviation greater than a preset similarity threshold and the state transition anomaly degree greater than a preset anomaly threshold is marked as a mutation node. According to the mutation node, the feature weight in the three-dimensional feature vector is adaptively adjusted to generate an adjusted feature weight; based on the adjusted feature weight, the three-dimensional feature vector is weighted and fused to construct a three-domain behavior portrait; The feature matching degree of the to-be-identified behavior portrait and the historical behavior portrait is calculated, the evolution prediction probability of the to-be-identified behavior portrait is calculated based on the behavior evolution graph, and the identification score is calculated according to the feature matching degree and the evolution prediction probability; based on the identification score, the attack characteristic of the to-be-identified behavior portrait is identified, and the identification result is fed back to the behavior evolution graph for updating, to realize dynamic identification of the attack characteristic.

[0009] The feature matching degree of the to-be-identified behavior portrait and the historical behavior portrait is calculated, the evolution prediction probability of the to-be-identified behavior portrait is calculated based on the behavior evolution graph, and the identification score is calculated according to the feature matching degree and the evolution prediction probability, including: The to-be-identified behavior portrait and the historical behavior portrait are input into the discriminator of the generative adversarial network, the matching degree of the to-be-identified behavior portrait and the historical behavior portrait is modeled through the discriminator, and the feature matching degree is output; extracting adjacent nodes of the node corresponding to the to-be-identified behavior portrait, generating a behavior evolution path based on the adjacent nodes by a generator of the generative adversarial network, and mapping the behavior evolution path to a behavior evolution graph; evaluating the authenticity of the behavior evolution path based on the behavior evolution graph by a discriminator of the generative adversarial network, outputting correlation features between nodes in the behavior evolution graph, and obtaining a fusion correlation score; exploring a candidate path set with the node corresponding to the to-be-identified behavior portrait as a starting point in the behavior evolution graph by a generator of the generative adversarial network, and evaluating the authenticity of each candidate path in the candidate path set based on the fusion correlation score by a discriminator to obtain a path probability; inputting the candidate path set into a decision tree ensemble model, performing evolution trend prediction on each candidate path based on the path probability by the decision tree ensemble model, and outputting an evolution prediction probability; inputting the feature matching degree and the evolution prediction probability into the decision tree ensemble model, and obtaining an identification score through multi-tree collaborative decision of the decision tree ensemble model.

[0010] dynamically constructing a virtual target environment with a layered protection architecture according to the attack features, guiding the attack features into the virtual target environment, and performing multi-modal perception based on the feature templates of the three-domain behavior portraits to obtain threat behavior data, including: dividing the virtual target environment into different unit sets, extracting environment feature vectors from the original target environment, constructing a digital twin model based on the environment feature vectors, generating an environment mapping through the digital twin model, inputting the attack features into the digital twin model to generate a mapping result; deploying the digital twin model in the different unit sets, and constructing a path evaluation based on the mapping result; evaluating each candidate guide path in a candidate guide path set based on the path evaluation, and selecting a candidate guide path with the highest evaluation score as an optimal guide path; guiding the attack features into the virtual target environment based on the optimal guide path, and constructing an analysis module; performing feature extraction on observation data in the virtual target environment by using the analysis module to obtain multi-dimensional features; inputting the multi-dimensional features into the digital twin model for fusion to obtain fusion features, performing threat labeling on the observation data based on the fusion features, and obtaining threat behavior data.

[0011] constructing a threat behavior feature library, comparing the threat behavior data with the three-domain behavior portraits in terms of features, predicting subsequent attack paths, and generating protection rules, including: Express the threat behavior feature as an n-dimensional feature vector, construct a feature evolution graph using the n-dimensional feature vector, map the n-dimensional feature vector to a three-domain behavior portrait, calculate the matching probability of the three-domain behavior portrait based on the feature state transition probability in the feature evolution graph, and calculate the feature matching degree according to the matching probability and a preset weight coefficient; According to the feature state transition probability, an attack evolution graph is constructed, the attack path probability is calculated using the attack evolution graph, the optimal attack path is predicted by combining the attack path probability and the feature matching degree, and a protection rule is generated based on the optimal attack path.

[0012] According to the feature state transition probability, an attack evolution graph is constructed, the attack path probability is calculated using the attack evolution graph, the optimal attack path is predicted by combining the attack path probability and the feature matching degree, and a protection rule is generated based on the optimal attack path. The attack evolution graph includes a set of attack state nodes and a set of state transition edges, and a new attack state node and a state transition edge are generated from the attack state node set using the attack evolution graph, and the structural similarity of the new attack state node and the state transition edge is evaluated. An evolution graph quality evaluation function is constructed based on the structural similarity and the evaluation score, and the attack evolution graph is iteratively optimized according to the evolution graph quality evaluation function to obtain an optimized attack evolution graph. The optimized attack evolution graph is input into the evolution graph quality evaluation function, a candidate attack path is generated based on the current attack state, the state transition probability between adjacent attack state nodes in the candidate attack path is calculated to obtain a path transition probability. The path feature vector of the candidate attack path is extracted, the feature matching degree between the path feature vector and a preset feature state vector is calculated, the path transition probability and the feature matching degree are combined to obtain a path feasibility evaluation value, and the optimal attack path is selected from the candidate attack path according to the path feasibility evaluation value.

[0013] According to the protection rule, corresponding protection measures are deployed in the virtual target environment, and the attack feature countermeasure data is continuously obtained through multi-modal perception, which includes: According to the protection rule, corresponding protection measures are deployed in the virtual target environment, and the attack feature countermeasure data is continuously obtained through multi-modal perception, which includes:

[0014] In a second aspect of the embodiments of the present application, a construction system of a dynamic threat capture system is provided, which includes: The first unit is configured to acquire heterogeneous security data in a target network environment, extract a three-domain behavior portrait based on the heterogeneous security data, construct a multi-dimensional feature vector, and identify attack features with threats through feature matching of the three-domain behavior portrait. The second unit is configured to dynamically construct a virtual target environment with a layered protection architecture according to the attack features, guide the attack features into the virtual target environment, and acquire threat behavior data based on multi-modal perception of a feature template of the three-domain behavior portrait. The third unit is configured to construct a threat behavior feature library, compare the threat behavior data with the three-domain behavior portrait, predict a subsequent attack path, and generate a protection rule. The fourth unit is configured to deploy a corresponding protection measure in the virtual target environment according to the protection rule, continuously acquire countermeasure behavior data of the attack features through multi-modal perception, update the threat behavior feature library based on the countermeasure behavior data, and optimize the protection rule to realize continuous countermeasures against the attack features.

[0015] In a third aspect, an electronic device is provided, including: a processor; a memory for storing processor-executable instructions; The processor is configured to invoke the instructions stored in the memory to execute the method described above.

[0016] In a fourth aspect, a computer-readable storage medium is provided, which stores computer program instructions, and the computer program instructions are executed by a processor to implement the method described above.

[0017] The present application has the following beneficial effects: The present application realizes deep analysis of multi-source heterogeneous security data by constructing a dynamic threat capture system, accurately identifies threat features by using a three-domain behavior portrait and feature matching technology, effectively improves the accuracy and real-time performance of threat discovery, and reduces the false positive rate.

[0018] Based on the layered protection architecture of the virtual target environment, the present application can guide attack behaviors to a safe isolation area for deep analysis, realizes continuous monitoring and data collection of attacker behaviors, ensures the safety of the production environment, and obtains comprehensive attack behavior features, thereby providing data support for protection strategy optimization.

[0019] The present application realizes adaptive adjustment of protection measures by constructing and continuously updating a threat behavior feature library, combining attack path prediction and dynamic protection rule generation, forms a closed-loop threat countermeasure mechanism, greatly improves the continuity and effectiveness of network security protection capability, and can cope with the evolving network attack threats. Attached Figure Description

[0020] Figure 1 This is a flowchart illustrating the construction method of the dynamic threat capture system according to an embodiment of the present invention; Figure 2 This is a flowchart of attack guidance and feature extraction based on digital twins in an embodiment of the present invention; Figure 3 This is a flowchart of the attack path optimization and evaluation process based on the evolution graph, according to an embodiment of the present invention. Detailed Implementation

[0021] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0022] The technical solution of the present invention will be described in detail below with reference to specific embodiments. These specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described again in some embodiments.

[0023] Figure 1 This is a flowchart illustrating the construction method of the dynamic threat capture system according to an embodiment of the present invention, as shown below. Figure 1 As shown, the method includes: Obtain heterogeneous security data in the target network environment, extract three-domain behavioral profiles based on the heterogeneous security data, construct multi-dimensional feature vectors, and identify threatening attack features through feature matching of the three-domain behavioral profiles; A virtual target environment with a layered protection architecture is dynamically constructed based on the attack characteristics. The attack characteristics are guided into the virtual target environment, and multimodal perception is performed based on the feature template of the three-domain behavior profile to obtain threat behavior data. Construct a threat behavior feature library, compare the threat behavior data with the three-domain behavior profiles, predict subsequent attack paths, and generate protection rules; According to the protection rules, corresponding protection measures are deployed in the virtual target environment. Multimodal perception is used to continuously acquire adversarial behavior data of the attack characteristics. The threat behavior feature library is updated based on the adversarial behavior data, and the protection rules are optimized to achieve continuous adversarial action against the attack characteristics.

[0024] In an optional embodiment, a three-domain behavior portrait is extracted based on the heterogeneous security data, a multi-dimensional feature vector is constructed, and a threat attack feature is identified through feature matching of the three-domain behavior portrait, including: A three-dimensional feature vector is extracted from the heterogeneous security data, the three-dimensional feature vector is spliced to construct a behavior state node, a state transition probability between the behavior state nodes is calculated to construct a state transition edge, and the behavior state node and the state transition edge are constructed into a behavior evolution graph; Based on the behavior evolution graph, a behavior similarity deviation and a state transition anomaly degree between adjacent behavior state nodes are calculated, and a behavior state node with a behavior similarity deviation greater than a preset similarity threshold and a state transition anomaly degree greater than a preset anomaly threshold is marked as a mutation node; According to the mutation node, the feature weight in the three-dimensional feature vector is adaptively adjusted to generate an adjusted feature weight; based on the adjusted feature weight, the three-dimensional feature vector is weighted and fused to construct a three-domain behavior portrait; The feature matching degree of the to-be-identified behavior portrait and the historical behavior portrait is calculated, the evolution prediction probability of the to-be-identified behavior portrait is calculated based on the behavior evolution graph, and the identification score is calculated according to the feature matching degree and the evolution prediction probability; based on the identification score, the attack feature of the to-be-identified behavior portrait is identified, and the identification result is fed back to the behavior evolution graph for updating, so as to realize dynamic identification of the attack feature.

[0025] Heterogeneous security data from different security devices is collected, including network flow data, system log data, and user behavior data. A three-dimensional feature vector is extracted from the collected heterogeneous security data, including a network domain feature vector, a host domain feature vector, and a user domain feature vector. The network domain feature vector includes source IP address, target IP address, source port, target port, protocol type, etc.; the host domain feature vector includes process ID, system call sequence, file access record, etc.; and the user domain feature vector includes login time, operation behavior sequence, access resource type, etc.

[0026] The three-dimensional feature vector is spliced to construct a behavior state node, for example, for a user A operation behavior, the extracted features are: network domain feature [192.168.1.100, 80, TCP], host domain feature [process 4721, read system file], and user domain feature [14:30:25, database query], which are spliced to form a behavior state node. The state transition probability between the behavior state nodes is calculated to construct a state transition edge, for example, the probability of user A's operation behavior changing from "database query" to "file download" is 0.03. The behavior state node and the state transition edge are constructed into a behavior evolution graph, which reflects the evolution process of user behavior over time.

[0027] The behavior similarity deviation between adjacent behavior state nodes is calculated based on the behavior evolution graph. The behavior similarity deviation is realized by calculating the cosine distance between the feature vectors of adjacent nodes. The greater the cosine distance, the lower the similarity and the greater the deviation. For two adjacent behavior state nodes of user B, the calculated behavior similarity deviation value is 0.82. At the same time, the state transition anomaly degree is calculated. The state transition anomaly degree is calculated by the difference between the current observed transition probability and the historical transition probability. For example, the anomaly degree of a certain behavior transition of user B is 0.75. The behavior state nodes with a behavior similarity deviation greater than a preset similarity threshold of 0.70 and a state transition anomaly degree greater than a preset anomaly threshold of 0.65 are marked as mutation nodes.

[0028] According to the identified mutation nodes, the feature weights in the three-dimensional feature vector are adaptively adjusted. The adjustment method is to increase the weight of the dimension corresponding to the abnormal feature in the mutation node and reduce the weight of the dimension corresponding to the normal feature. For example, it is detected that the behavior mutation of user C mainly reflects on the network domain feature, and the original weight is [0.3, 0.4, 0.3] (respectively corresponding to the network domain, the host domain, and the user domain). The adjusted weight is [0.5, 0.3, 0.2]. Based on the adjusted feature weight, the three-dimensional feature vector is weighted and fused to construct a three-domain behavior portrait.

[0029] For the behavior to be identified, the feature matching degree between the to-be-identified behavior portrait and the historical behavior portrait is calculated. The feature matching degree is realized by calculating the similarity between the feature vectors. For example, for a suspicious operation of user D, the feature matching degree with its historical behavior portrait is 0.35. The evolution prediction probability of the to-be-identified behavior portrait is calculated based on the behavior evolution graph. The evolution prediction probability represents the possibility that the current behavior state changes into a historical attack behavior state. For example, the prediction probability that the current behavior of user D changes into a known attack mode is 0.82. The identification score is calculated according to the feature matching degree and the evolution prediction probability. The identification score calculation formula is: identification score=(1-feature matching degree)×0.6+evolution prediction probability×0.4. The calculation result for user D is (1-0.35)×0.6+0.82×0.4=0.69. When the identification score is greater than a preset threshold of 0.60, it is determined that the behavior has attack characteristics.

[0030] The attack feature recognition is performed on the to-be-recognized behavior portrait based on the recognition score, and the recognition result is fed back to the behavior evolution graph for updating. For example, for a behavior of the user E, the recognition score is calculated as 0.75, which is greater than the preset threshold 0.60, and the behavior is determined as an attack behavior, and the behavior is added to the attack behavior node corresponding to the behavior evolution graph, and the related state transition probability is updated. The behavior evolution graph is updated by continuously accumulating the recognition result, the accuracy of subsequent attack feature recognition is improved, and dynamic recognition of the attack feature is realized.

[0031] In actual application, the security data of an intranet of an enterprise is analyzed, it is detected that the user F continuously attempts to access sensitive ports of multiple servers in a short time, the network domain feature shows obvious abnormality, the behavior similarity deviation is 0.88, and the state transition abnormality degree is 0.79, both of which exceed the preset threshold. The system adaptively adjusts the feature weight, and the network domain weight is increased from 0.33 to 0.60. The recognition score is calculated as 0.82, the port scanning attack behavior is successfully recognized, and the attack mode is updated to the behavior evolution graph for rapid recognition of subsequent similar attacks.

[0032] Through the above technical solutions, the embodiment can dynamically construct a three-domain behavior portrait based on heterogeneous security data, accurately recognize network attack behaviors, and improve network security protection capability.

[0033] In an optional embodiment, the feature matching degree of the to-be-recognized behavior portrait and the historical behavior portrait is calculated, the evolution prediction probability of the to-be-recognized behavior portrait is calculated based on the behavior evolution graph, and the recognition score is calculated according to the feature matching degree and the evolution prediction probability, including: The to-be-recognized behavior portrait and the historical behavior portrait are input into a discriminator of a generative adversarial network, the matching degree of the to-be-recognized behavior portrait and the historical behavior portrait is modeled by the discriminator, and the feature matching degree is output; The adjacent nodes of the node corresponding to the to-be-recognized behavior portrait are extracted, the behavior evolution path is generated based on the adjacent nodes by a generator of the generative adversarial network, and the behavior evolution path is mapped to the behavior evolution graph. The authenticity of the behavior evolution path is evaluated based on the behavior evolution graph by a discriminator of the generative adversarial network, the associated features between the nodes in the behavior evolution graph are output, and the fusion correlation score is obtained. The generator of the generative adversarial network is used to explore a candidate path set with the node corresponding to the to-be-recognized behavior portrait as a starting point in the behavior evolution graph, and the authenticity of each candidate path in the candidate path set is evaluated based on the fusion correlation score by the discriminator to obtain a path probability. The candidate path set is input into a decision tree ensemble model, an evolution trend prediction is made for each candidate path based on the path probability according to the decision tree ensemble model, and an evolution prediction probability is output; the feature matching degree and the evolution prediction probability are input into the decision tree ensemble model, and a recognition score is obtained through multi-tree collaborative decision of the decision tree ensemble model.

[0034] When calculating the feature matching degree of the to-be-identified behavior portrait and the historical behavior portrait, the behavior portrait needs to be preprocessed and standardized. The behavior portrait is a set of multi-dimensional feature vectors, including network domain, host domain and application domain behavior features. Network domain features include traffic features, protocol features and connection features; host domain features include process features, file features and registry features; application domain features include interface call features, data access features and user interaction features. To ensure the comparability of the features, the features in each dimension are normalized to make the feature values distributed between 0 and 1. For example, for network traffic features, the original traffic value is 1024 data packets per second, and the normalized feature value is 0.75; for process creation frequency features, the original frequency is 8 times per minute, and the normalized feature value is 0.62. The to-be-identified behavior portrait and the historical behavior portrait are both represented as 128-dimensional feature vectors, each dimension corresponding to a specific behavior feature.

[0035] When the to-be-identified behavior portrait and the historical behavior portrait are input into the discriminator of the generative adversarial network, a deep neural network architecture is used to implement the discriminator model, which consists of a feature extraction layer, a feature interaction layer and a discrimination output layer. The feature extraction layer uses a convolutional neural network to extract local and global features of the behavior portrait; the feature interaction layer calculates a similarity matrix between the to-be-identified behavior portrait and the historical behavior portrait through an attention mechanism; and the discrimination output layer outputs a matching probability through a fully connected network and a sigmoid activation function. The discriminator training uses a large number of labeled behavior portrait pairs, and uses a cross-entropy loss function to optimize the model parameters. The training data set contains 100,000 positive samples (pairs of behavior portraits of the same type) and 100,000 negative samples (pairs of behavior portraits of different types). For example, a pair of APT attack behavior portraits and historical APT attack behavior portraits constitutes a positive sample pair, and a pair of APT attack behavior portraits and DDoS attack behavior portraits constitutes a negative sample pair. The training process uses a mini-batch gradient descent method with a batch size of 64, an initial learning rate of 0.001, uses a learning rate decay strategy, and trains for 150 cycles.

[0036] When modeling the matching degree between the to-be-identified behavior portrait and the historical behavior portrait by the discriminator, the discriminator receives both behavior portraits as input. The discriminator first extracts deep feature representations of the two behavior portraits through the feature extraction layer, respectively, to obtain two feature vectors with a dimension of 512. Then, the feature interaction layer is used to calculate the similarity matrix of the two feature vectors to capture the key matching points and difference points of the two behavior portraits. Finally, the discriminant output layer generates a matching score ranging from 0 to 1, and the closer the score is to 1, the higher the matching degree. For example, for a malicious software behavior, the to-be-identified behavior portrait and the historical behavior portrait of the known malicious software family A are evaluated by the discriminator to obtain a matching score of 0.92, and the matching score with the historical behavior portrait of the malicious software family B is 0.45, and the matching score with the normal software behavior portrait is 0.08. This indicates that the to-be-identified behavior belongs to the malicious software family A.

[0037] When outputting the feature matching degree, the original output of the discriminator is post-processed and calibrated. The post-processing includes threshold screening and probability calibration. The threshold screening sets a minimum matching threshold, for example, 0.5, and the matching results below this threshold are filtered out. The probability calibration uses the temperature scaling method to adjust the original probability distribution to improve the accuracy of probability estimation. The calculation of the feature matching degree considers the matching results of multiple historical behavior portraits, and adopts a weighted average method, and the weight is determined by the confidence of the historical behavior portrait. For example, for a certain unknown network attack behavior, the matching degrees with three historical attack behavior portraits are 0.87 (weight 0.4), 0.76 (weight 0.35), and 0.65 (weight 0.25), respectively. The calculated comprehensive feature matching degree is 0.781. The feature matching degree is an important component of the recognition score, reflecting the static similarity between the to-be-identified behavior and the known behavior pattern.

[0038] When extracting the adjacent nodes of the to-be-identified behavior image corresponding node, operation is performed based on a behavior evolution graph, the behavior evolution graph is a directed weighted graph structure, a node represents a behavior state, an edge represents a state transition relationship, and a weight of the edge represents a transition probability. The to-be-identified behavior image is mapped to a certain node in the behavior evolution graph through feature matching, and then a forward adjacent node (a node pointing to the node) and a backward adjacent node (a node pointed to by the node) of the node are extracted. The extraction of the adjacent nodes adopts a graph traversal algorithm, and the number of hops is set to be limited to 2, that is, all nodes with a distance of not more than 2 hops from the target node are extracted. For the extracted adjacent nodes, an importance score is calculated according to the weight of the edge, and the top 10 nodes in the importance score are selected as key adjacent nodes. For example, for the to-be-identified behavior image mapped to the "data stealing" behavior node, the extracted key forward adjacent nodes include "lateral movement" (weight 0.85), "privilege escalation" (weight 0.72), and "information collection" (weight 0.63); and the key backward adjacent nodes include "data encryption" (weight 0.56) and "trace cleaning" (weight 0.78).

[0039] When the generator of the generative adversarial network generates a behavior evolution path based on the adjacent nodes, the generator adopts a sequence generation model structure, and the generator is composed of an encoder, an evolution prediction layer, and a decoder. The encoder encodes the feature vector of the adjacent node into a context vector; the evolution prediction layer predicts the behavior evolution trend based on the context vector; and the decoder generates a behavior sequence according to the evolution trend. The generation process adopts a self-recurrent manner, generates one behavior node at a time, and then adds the newly generated node to the sequence as a condition for the next generation. To enhance the diversity of the generation result, a beam search strategy is adopted, and the top 5 candidate sequences with the highest probability are retained. The training of the generator adopts a combination of adversarial training and supervised training, and uses historical attack chain data as real samples. For example, for the "network scanning" behavior node, the generator generates 5 evolution paths based on its adjacent nodes, such as "network scanning→vulnerability exploitation→privilege escalation→lateral movement→data stealing" and "network scanning→vulnerability exploitation→backdoor implantation→remote control→data stealing".

[0040] When mapping the behavior evolution path to the behavior evolution graph, the generated behavior sequence needs to be aligned and matched with the known paths in the behavior evolution graph. The alignment process considers the node semantic similarity and path structure similarity. The node semantic similarity is obtained by calculating the cosine similarity of the node feature vector; the path structure similarity is obtained by comparing the path length, node order and jump mode. For each node in the generated path, find the most similar node in the behavior evolution graph for mapping. If there is no exact match for a node in the graph, select the most similar node with a similarity exceeding the threshold value of 0.8. If the similarity is below the threshold value, consider the node as a newly discovered behavior pattern and add it to the behavior evolution graph. For example, the generated path "network scanning → exploit → backdoor implantation → remote control → data theft" is mapped to the behavior evolution graph, and the mapping similarity of each node is 1.0, 0.95, 0.88, 0.92 and 1.0 respectively, indicating that the path has a good matching degree in the graph.

[0041] When the discriminator based on the generative adversarial network evaluates the authenticity of the behavior evolution path according to the behavior evolution graph, the discriminator receives the mapped path as input and evaluates its similarity to the real attack chain. The evaluation process considers two aspects of path legality and path rationality. Path legality checks whether the path conforms to the basic law of behavior evolution, such as whether there is a logical conflict or an impossible jump; path rationality evaluates the possibility of the path occurring in a real scenario based on historical statistical data. The discriminator uses a graph convolution network to extract the structural features of the path, uses a recurrent neural network to extract the sequence features of the path, and then outputs a authenticity score through a multi-layer perceptron, ranging from 0 to 1. For example, for the mapped path "network scanning → exploit → backdoor implantation → remote control → data theft", the discriminator gives a legality score of 0.95, a rationality score of 0.88, and a comprehensive authenticity score of 0.92, indicating that the path is a real attack behavior sequence.

[0042] When outputting the association features between nodes in the behavior evolution graph, a variety of association features between nodes are extracted. The association features include direct connection strength, indirect connection strength, co-occurrence frequency and transfer time features. The direct connection strength represents the weight of the direct connection between two nodes; the indirect connection strength represents the comprehensive strength of the connection through intermediate nodes; the co-occurrence frequency represents the frequency of the two nodes appearing together in the same attack sequence; the transfer time feature represents the average time interval from one node to another node. The association features are integrated through a feature fusion network to output a fused association score ranging from 0 to 1. For example, for the two nodes "exploit" and "privilege escalation", the extracted association features include direct connection strength 0.82, indirect connection strength 0.25, co-occurrence frequency 0.75 and average transfer time interval 3 minutes, and the fused association score is 0.78, indicating that there is a strong association between the two behavior nodes.

[0043] When exploring the candidate path set starting from the node corresponding to the behavior portrait to be identified in the behavior evolution graph, the generator of the generative adversarial network is used to guide path generation using deep reinforcement learning techniques. The generator is considered as an agent, and the behavior evolution graph is considered as an environment. The goal of the agent is to find a high-probability attack path. The exploration process uses the Monte Carlo tree search algorithm, which selects the most potential node to expand each time, balancing exploration and utilization. The path generation process sets the maximum length to 10, the maximum exploration depth to 5, and the number of generated candidate paths to 20. For each generated path, the coverage rate and diversity score are calculated to ensure the representativeness and comprehensiveness of the candidate path set. For example, for the exploration starting from "network scanning", the generated candidate path set includes "network scanning → exploit → privilege escalation → lateral movement → data theft" (coverage rate 0.85), "network scanning → weak password cracking → credential theft → remote login → configuration modification" (coverage rate 0.72), and 20 different attack paths.

[0044] When the discriminator evaluates the authenticity of each candidate path in the candidate path set based on the fusion association score, the discriminator scores each candidate path. The scoring process considers the fusion association score of each pair of adjacent nodes in the path and the structural features of the path as a whole. The fusion association score of the adjacent node pair in the path calculates the local authenticity of the path through weighted averaging; the structural features of the path calculate the global authenticity of the path through similarity with historical attack paths. The local authenticity and global authenticity are combined to obtain the comprehensive authenticity score of the path, which is then converted to the path probability through the softmax function. For example, for the candidate path "network scanning → exploit → privilege escalation → lateral movement → data theft", its local authenticity score is 0.85, its global authenticity score is 0.92, its comprehensive authenticity score is 0.88, and its converted path probability is 0.15, indicating that among all candidate paths, this path has a 15% probability of being a real attack path.

[0045] When inputting the candidate path set into the decision tree ensemble model, a random forest or gradient boosting decision tree is used as the ensemble model. The decision tree ensemble model is composed of multiple decision trees, each of which is trained based on different feature subsets and sample subsets. The model input includes the path feature vector, which contains path length, node type distribution, transition pattern, time feature, and path probability, etc. The model training uses historical attack path data, with the label being the real evolution result of the path. The training process uses cross-validation method to ensure the generalization ability of the model. For example, the model contains 100 decision trees, each with a maximum depth of 10, a minimum leaf node sample size of 5, a feature randomness parameter of 0.7, and uses Gini impurity as the splitting criterion.

[0046] According to the evolutionary trend prediction of each candidate path based on the path probability of the decision tree ensemble model, the ensemble model outputs the prediction result of each candidate path. The prediction result includes path completion probability, key node achievement probability and target realization probability. The path completion probability represents the possibility of the path being executed completely in the expected order; the key node achievement probability represents the possibility of the key behavior node in the path being executed; and the target realization probability represents the possibility of the attack target being realized. The three probabilities are calculated by weighted average to obtain the comprehensive evolutionary prediction probability. For example, for the path "network scanning → exploit → privilege escalation → lateral movement → data theft", the path completion probability is 0.78, the key node (data theft) achievement probability is 0.85, the target realization (data leakage) probability is 0.82, and the calculated comprehensive evolutionary prediction probability is 0.81, indicating that the path has a high realization possibility.

[0047] When the feature matching degree and the evolutionary prediction probability are input into the decision tree ensemble model, a two-level decision model is constructed. The two-level model uses the same ensemble architecture as the previous level, but the input features only include the feature matching degree and the evolutionary prediction probability. The feature matching degree reflects the static similarity between the to-be-identified behavior and the known behavior pattern; and the evolutionary prediction probability reflects the dynamic trend of the future development of the to-be-identified behavior. The two-level model comprehensively evaluates the nature and risk of the to-be-identified behavior through the combination of the two indicators. The model training uses historical identification cases, and the labels are the real categories and risk levels of the behaviors. For example, for a potential APT attack behavior, the feature matching degree is 0.781 and the evolutionary prediction probability is 0.81, which are used as the input features of the two-level model.

[0048] When the recognition score is obtained through the multi-tree collaborative decision of the decision tree ensemble model, each decision tree in the ensemble model independently makes a prediction, and then the final result is obtained through voting or weighted average. For classification tasks, the majority voting method is used, and the class with the most votes is selected as the prediction result; for regression tasks, the weighted average method is used, and the average value of all tree prediction values is calculated as the final prediction value. The calculation of the recognition score comprehensively considers the confidence of the behavior category judgment and the accuracy of the risk level evaluation, and the score range is 0 to 100, the higher the score, the more reliable the recognition result and the higher the risk. For example, for the aforementioned potential APT attack behavior, 80% of the decision trees in the ensemble model judge it as an APT attack (category confidence 0.8), and the average risk score is 85 (standardized to 0.85), and the calculated recognition score is 85x0.8=68, indicating that the behavior is an APT attack and has a high security risk. The recognition score is an important basis for subsequent security decisions, and is used to trigger corresponding defense measures and response strategies.

[0049] In an optional implementation, the virtual target environment with a layered protection architecture is dynamically constructed according to the attack features, the attack features are guided into the virtual target environment, and multi-modal perception is performed based on a feature template of the three-domain behavior portrait to obtain threat behavior data, including: The virtual target environment is divided into different unit sets, an environment feature vector is extracted from an original target environment, a digital twin model is constructed based on the environment feature vector, an environment mapping is generated through the digital twin model, and an attack feature is input into the digital twin model to generate a mapping result; the digital twin model is deployed in the different unit sets, and a path evaluation is constructed based on the mapping result; Each candidate guiding path in a candidate guiding path set is evaluated based on the path evaluation, and a candidate guiding path with the highest evaluation score is selected as an optimal guiding path; the attack feature is guided into the virtual target environment based on the optimal guiding path, and an analysis module is constructed; The observation data in the virtual target environment are subjected to feature extraction by using the analysis module to obtain multi-dimensional features; the multi-dimensional features are input into the digital twin model for fusion to obtain fused features, the observation data are subjected to threat labeling based on the fused features, and threat behavior data are obtained.

[0050] As shown in Figure 2 the method includes: When the virtual target environment with a layered protection architecture is dynamically constructed according to attack features, the basic architecture of the virtual target environment needs to be determined. The virtual target environment is realized in a manner of combination of container technology and virtual machine technology, application layer components are realized by using lightweight containers, and core business systems are realized by using full virtualization technology. The basic architecture includes three levels of network layer, host layer and application layer, the network layer simulates enterprise network topology, including border routers, firewalls, switches and other devices; the host layer simulates various operating systems and servers, including file servers, database servers and web servers; and the application layer simulates various business applications, including mail systems, office systems and management platforms. Each level uses independent resource pool management, and through a resource scheduler, computing, storage and network resources are allocated on demand.

[0051] When dividing the virtual target environment into different cell sets, it is divided according to functions, security levels and business relevance. The cell set is mainly divided into boundary cells, business cells and data cells. The boundary cells include the external network access area, the DMZ area and the security protection area, which are responsible for external traffic access and primary filtering; the business cells include the web service area, the application service area and the management service area, which are responsible for business logic processing; the data cells include the data storage area, the data processing area and the data backup area, which are responsible for data management. Each cell is connected through a secure channel to realize business flow. For example, in the e-commerce scenario, the boundary cells deploy load balancers and WAFs, the business cells deploy order processing and payment services, and the data cells deploy user databases and transaction databases. The communication between cells strictly configures access control rules according to the principle of least privilege.

[0052] When extracting the environment feature vector from the original target environment, a combination of passive scanning and active probing is used. Passive scanning collects network communication data through traffic mirroring technology, and active probing obtains system configuration information through authentication and authorization. The extracted feature vector includes three types of network topology features, service component features and interaction behavior features. Network topology features describe network structure and communication mode, including IP address segment, subnet division, routing strategy and traffic distribution; service component features describe system and application configuration information, including operating system type, version number, open port, running service and patch status; interaction behavior features describe business process and data flow, including service invocation relationship, data access mode and user behavior mode. The feature vector is represented by 128 dimensions, of which network topology features account for 48 dimensions, service component features account for 42 dimensions, and interaction behavior features account for 38 dimensions.

[0053] When constructing a digital twin model based on the environment feature vector, a multi-layer graph structure is used to represent the model. The bottom layer is a physical resource graph that represents the distribution of computing, storage and network resources; the middle layer is a service component graph that represents the deployment of various services and applications; and the upper layer is a business process graph that represents business logic and data flow. Each layer of graph structure is associated through vertical mapping to form a complete twin model. The model construction process uses an incremental learning method. The initial model is constructed based on static configuration information, and then continuously optimized and adjusted through real-time monitoring data. For example, the initial model constructs a physical resource graph based on network topology scanning results, a service component graph based on service discovery results, and a business process graph based on traffic analysis results. Model parameters are obtained through historical data training, such as the association strength between nodes, service dependency probability and business call frequency.

[0054] When generating the environment mapping through the digital twin model, entities and relationships in the target environment are mapped into the virtual environment. The mapping process includes node mapping, edge mapping, and attribute mapping. Node mapping maps entity devices to virtual instances, such as mapping physical servers to virtual machines. Edge mapping maps network connections to virtual links, such as mapping local area network connections to virtual networks. Attribute mapping maps entity characteristics to configuration parameters, such as mapping service configurations to parameter settings of virtual instances. When mapping, resource limitations and performance requirements are considered, and non-critical components are appropriately simplified. For example, for an e-commerce platform, the mapping generates a virtual environment containing 3 boundary unit nodes, 5 business unit nodes, and 2 data unit nodes. Twelve virtual links are established between the nodes, 25 key service components are configured, and 103 configuration parameters are set.

[0055] When inputting attack features into the digital twin model to generate mapping results, attack features are represented as feature vectors, containing three parts of information: attack target, attack means, and attack path. Attack target describes the attacker's intention, such as data theft, service interruption, or privilege escalation. Attack means describes the techniques used by the attacker, such as SQL injection, buffer overflow, or social engineering. Attack path describes the attack sequence, such as reconnaissance-vulnerability exploitation-privilege escalation-lateral movement-data theft. The model simulates the propagation process of attack behavior in the target environment according to the input attack features, and generates attack impact range and affected asset list. For example, for the SQL injection attack feature, the mapping result generated by the model shows that the web server and database server are in high-risk state, the user data table and transaction record table are the main affected assets, and the attack impact range covers the business unit and data unit.

[0056] When deploying digital twin models in different unit sets, a distributed deployment architecture is adopted, with each unit set deploying a local model instance responsible for monitoring and analyzing behavior within the unit. Local models exchange information through secure channels to form a collaborative analysis network. The complexity of local models is adjusted according to the importance and resource situation of the unit. Key units deploy full-featured models, and non-critical units deploy lightweight models. Model deployment adopts an adaptive resource allocation strategy, dynamically adjusting computing resources according to business load and security posture. For example, when a high-intensity attack is detected, the computing resource allocation of the model is automatically increased to improve analysis and processing capabilities.

[0057] When constructing the path evaluation based on the mapping results, the connections between nodes in the virtual environment are regarded as the guide paths. The path evaluation considers three dimensions: guidance effect, resource consumption, and risk control. The guidance effect evaluates the attractiveness of the path to the attack behavior, including target value, environment fidelity, and response delay; the resource consumption evaluates the cost of path implementation, including computing resources, storage resources, and network resources; the risk control evaluates the risks introduced by the path, including information leakage risk, overflow infection risk, and misjudgment risk. The evaluation results are represented as a comprehensive score, with a score range of 0 to 100, and a higher score indicating a better path. For example, for a certain SQL injection attack feature, the guide path from the web server to the test database has an evaluation score of 85, and the guide path from the web server to the production database has an evaluation score of 45.

[0058] When evaluating each candidate guide path in the candidate guide path set based on the path evaluation, a multi-factor weighted scoring method is used, and the evaluation factors include path attractiveness, technical feasibility, resource efficiency, risk controllability, and defense value. The path attractiveness evaluates the induction effect of the path on the attacker, with a weight of 0.25; the technical feasibility evaluates the difficulty of path implementation, with a weight of 0.20; the resource efficiency evaluates the resource utilization rate of the path, with a weight of 0.15; the risk controllability evaluates the security boundary strength of the path, with a weight of 0.25; the defense value evaluates the intelligence collection value of the path, with a weight of 0.15. The score range of each factor is 0 to 10, and the comprehensive score is calculated by weighted average. For example, the scores of a certain candidate guide path are: path attractiveness 8 points, technical feasibility 7 points, resource efficiency 9 points, risk controllability 8 points, and defense value 9 points, and the calculated comprehensive score is 8.15 points.

[0059] When selecting the candidate guide path with the highest evaluation score as the optimal guide path, the top three paths with the highest scores are analyzed in detail, considering the current security situation and defense strategy. The detailed analysis includes path complexity analysis, emergency adaptability analysis, and long-term benefit analysis. The path complexity analysis evaluates the implementation difficulty and maintenance cost; the emergency adaptability analysis evaluates the ability to respond to attack changes; the long-term benefit analysis evaluates the continuous defense value. According to the detailed analysis results, the original scores are adjusted, and the path with the highest adjusted score is finally selected as the optimal guide path. For example, for a certain DDoS attack feature, the guide path with the highest initial score has a score decrease after detailed analysis, while the path ranked second initially becomes the final choice due to its good adaptability and high long-term benefit.

[0060] When guiding attack features into the virtual target environment based on the optimal guidance path, fine-grained traffic scheduling and session management are implemented. Traffic scheduling uses software-defined network technology to dynamically adjust traffic forwarding rules according to the matching degree of attack features. Session management ensures the continuity and authenticity of the guidance process through session replication and state synchronization technology. The guidance process is divided into three stages: identification, transfer, and maintenance. The identification stage uses deep packet inspection technology to identify traffic that meets attack features; the transfer stage redirects the identified traffic to the virtual environment through transparent proxy technology; and the maintenance stage ensures the continuity of interaction through session preservation technology. For example, for a certain network scanning attack, the identification stage detects a large number of port scanning requests, the transfer stage redirects these requests to the corresponding service port in the virtual environment, and the maintenance stage maintains the attacker's interest by simulating real service responses.

[0061] When constructing the analysis module, a hierarchical decoupling architecture design is adopted, and the analysis module includes a data collection layer, a feature extraction layer, a behavior analysis layer, and a decision output layer. The data collection layer is responsible for collecting raw data from the virtual environment, including network traffic, system logs, and application events; the feature extraction layer is responsible for extracting valuable features from raw data, including statistical features, sequence features, and semantic features; the behavior analysis layer is responsible for identifying behavior patterns based on features, including normal behavior patterns and abnormal behavior patterns; and the decision output layer is responsible for generating analysis results and defense recommendations, including threat levels, attack types, and coping strategies. Modules communicate through standard interfaces and support plug-in extensions. For example, for a certain network layer attack, the data collection layer collects network packets, the feature extraction layer extracts traffic features, the behavior analysis layer identifies a DDoS attack pattern, and the decision output layer generates a high-risk alarm and traffic cleaning recommendation.

[0062] When using the analysis module to extract features from observation data in the virtual target environment, a multi-level feature extraction strategy is adopted. Basic feature extraction extracts statistical quantities from raw data, such as traffic size, packet length distribution, and time interval; behavior feature extraction extracts patterns from interaction sequences, such as access order, operation frequency, and command type; and context feature extraction extracts semantic features in combination with environmental information, such as resource sensitivity, operation legality, and behavior abnormality. Feature extraction uses a combination of deep learning and expert rules to balance automation and accuracy. For example, for a certain application layer attack, the extracted multi-dimensional features include HTTP request frequency (75 times per second), abnormal parameter proportion (35%), sensitive operation proportion (60%), resource access dispersion (0.25), and authentication failure rate (80%).

[0063] When the multi-dimensional features are input into the digital twin model for fusion to obtain fused features, a multi-modal feature fusion technology is adopted, and the feature fusion is divided into three levels of early fusion, mid-fusion and late fusion. The early fusion is performed in the feature extraction stage, and the original data of different sources are jointly processed; the mid-fusion is performed in the feature representation stage, and the feature vectors of different types are combined; and the late fusion is performed in the decision stage, and different analysis results are integrated. The correlation and complementarity between the features are considered in the fusion process, and appropriate weights are given to different features. For example, for a certain mixed attack, the network feature weight is 0.4, the host feature weight is 0.35, and the application feature weight is 0.25. The fused features can comprehensively reflect each dimension of the attack behavior.

[0064] When the fused features are used to mark the observation data to obtain threat behavior data, a hierarchical marking strategy is adopted. The marking process includes behavior classification, threat assessment and marking generation. The behavior classification divides the observed behavior into three categories of normal, suspicious and malicious; the threat assessment calculates the harm degree of the behavior, which is divided into three levels of low, medium and high; and the marking generation generates a structured threat marking according to the classification and assessment results, which contains behavior type, threat level, impact range, confidence and recommended measures and the like. The marking data is stored in a standard format, which is convenient for subsequent analysis and sharing. For example, for a certain SQL injection attack behavior, the generated threat marking shows that the behavior type is "Web application attack-SQL injection", the threat level is "high", the impact range is "database server and user data table", the confidence is "95%", and the recommended measures are "update WAF rules and patch application vulnerabilities". Through the threat marking, the original observation data is converted into structured threat behavior data, which provides a basis for subsequent defense decisions.

[0065] In an optional implementation, a threat behavior feature library is constructed, the threat behavior data is compared with the three-domain behavior portrait in terms of features, a subsequent attack path is predicted, and a protection rule is generated, which includes: The threat behavior features are represented as n-dimensional feature vectors, the n-dimensional feature vectors are used to construct a feature evolution graph, the n-dimensional feature vectors are mapped to the three-domain behavior portrait, a matching probability of the three-domain behavior portrait is calculated based on a feature state transition probability in the feature evolution graph, and a feature matching degree is calculated according to the matching probability and a preset weight coefficient; An attack evolution graph is constructed according to the feature state transition probability, an attack path probability is calculated using the attack evolution graph, the optimal attack path is predicted by combining the attack path probability and the feature matching degree, and a protection rule is generated based on the optimal attack path.

[0066] Collect multi-source heterogeneous threat behavior data, including network traffic logs, system operation logs, and application access logs. Preprocess the collected data to remove noise and redundant information and extract key features. Feature extraction uses a deep learning model to convert raw data into a feature vector. For network traffic, for example, extract source IP, destination IP, port number, protocol type, packet size, transmission rate, etc.; for system operation, extract process creation time, file access path, registry modification, etc.; for application access, extract login frequency, access resource type, operation behavior sequence, etc.

[0067] When representing threat behavior features as n-dimensional feature vectors, set the feature dimension n to 128, with each dimension corresponding to a behavior feature. Each element in the feature vector has a value between 0 and 1, representing the weight of that feature. For example, for DDoS attack behavior, the dimension weight value in its feature vector representing high frequency and small packet size is 0.95, the dimension weight value representing same-source multi-target is 0.87, and the dimension weight value representing TCP SYN flag is 0.92. This representation method allows different threat behaviors to form clusters in vector space, facilitating subsequent matching and identification.

[0068] In the process of constructing the feature evolution graph using n-dimensional feature vectors, each feature vector is treated as a node in the graph, and the edges between nodes represent the transition relationship of behavior states. The weight of the edge is calculated from historical observation data, representing the probability of state transition. For example, the transition probability from the port scanning feature vector to the exploit feature vector is 0.75, indicating that there is a 75% chance of observing a vulnerability exploitation behavior after observing a port scanning behavior. The feature evolution graph uses a directed weighted graph structure for storage, with each node containing a feature vector and its corresponding threat type identifier.

[0069] When mapping n-dimensional feature vectors to three-domain behavior portraits, the three-domain behavior portraits include network domain, host domain, and application domain. The network domain portrait describes network communication behavior features such as traffic patterns, protocol preferences, and communication objects; the host domain portrait describes system operation behavior features such as process activity, file operation, and resource usage; and the application domain portrait describes application layer behavior features such as user interaction, function call, and data processing. The mapping process is achieved through feature decomposition and recombination, which decomposes the 128-dimensional feature vector into three sub-vectors corresponding to the behavior features of the three domains, with dimensions of 48, 42, and 38 respectively. The mapping algorithm uses a self-adaptive weighting method guided by domain knowledge to automatically adjust the mapping weights based on feature attributes.

[0070] When calculating the matching probability of the three-domain behavior portrait based on the feature state transition probability in the feature evolution graph, for the input unknown behavior, its feature vector is extracted and the similarity with the known threat behavior feature vector in the feature library is calculated. The similarity calculation uses the cosine similarity method, and the value closer to 1 indicates a higher matching degree. For vectors with a similarity exceeding the threshold value of 0.8, the state transition probability in the feature evolution graph is extracted. For example, the similarity between a certain unknown behavior and the command and control behavior in APT attack is 0.86, and the state transition probability matrix of the behavior vector obtained from the feature evolution graph is [0.12, 0.35, 0.45, 0.08], corresponding to the transition probabilities to the next state respectively.

[0071] When calculating the feature matching degree according to the matching probability and the preset weight coefficient, the domain weight coefficient is introduced, and the weight coefficients of the network domain, host domain and application domain are 0.35, 0.40 and 0.25 respectively, reflecting the importance of different domains in threat judgment. The matching degree calculation formula is the weighted sum of the matching probability of each domain and the corresponding weight. Taking a certain malware as an example, the network domain matching probability is 0.92, the host domain matching probability is 0.85, and the application domain matching probability is 0.78, and the calculated comprehensive matching degree is 0.92×0.35 + 0.85×0.40 + 0.78×0.25 = 0.855.

[0072] When constructing the attack evolution graph according to the feature state transition probability, the attack behavior sequence is modeled using Markov decision process. The attack evolution graph is a directed graph, where nodes represent attack states and edges represent attack behaviors, and the weight on the edge represents the state transition probability. When establishing the attack evolution graph, the initial state and the termination state are first determined, the initial state is reconnaissance behavior, and the termination state is data theft or system destruction. The intermediate states include attack stages such as vulnerability exploitation, privilege escalation, and lateral movement. The transition between states is obtained by statistical analysis of historical attack data, for example, the transition probability from the "privilege escalation" state to the "lateral movement" state is 0.68, indicating that the attacker has a 68% chance of attempting to move laterally within the network after obtaining higher privileges.

[0073] When calculating the attack path probability using the attack evolution graph, the forward algorithm is used to calculate all paths and their probabilities from the initial state to the termination state. The path probability is the product of all transition probabilities on the path. For example, the probability of the path "reconnaissance → vulnerability exploitation → privilege escalation → lateral movement → data theft" is 0.85×0.72×0.68×0.75=0.31, indicating that the attacker has a 31% chance of completing the attack along this path. The path probability calculation considers the continuity of multi-step attack chains and reflects the sequence characteristics of attack behaviors.

[0074] When predicting the optimal attack path by combining the attack path probability and the feature matching degree, the comprehensive risk score of each attack path is calculated. The risk score is the weighted combination of the path probability and the current state feature matching degree. The path weight is 0.6, and the matching degree weight is 0.4. Taking a detected suspicious behavior as an example, its feature matching degree is 0.855, and the attack path probability most related to it is 0.31. The calculated comprehensive risk score is 0.31x0.6+0.855x0.4=0.528. The risk score of all paths is calculated, and the path with the highest score is selected as the optimal attack path. This method considers both historical attack patterns and current observed features, improving prediction accuracy.

[0075] When generating protection rules based on the optimal attack path, for each attack state in the path, its feature vector is extracted and converted into specific protection strategies. Protection rules include network protection rules, host protection rules, and application protection rules. Network protection rules include access control lists, traffic filtering rules, and abnormal traffic blocking rules; host protection rules include process behavior restrictions, file access controls, and system configuration reinforcement; application protection rules include interface access restrictions, data processing verification, and user behavior auditing. Rule generation uses a template matching method, selects the corresponding protection template according to the attack features, and parameterizes according to the specific environment. For example, for the detected command and control behavior, the generated network protection rules include "block all TCP connections with IP address 10.20.30.40", the host protection rules include "restrict the network communication rights of process exploit.exe", and the application protection rules include "add secondary identity verification for database query operations".

[0076] The deployment strategy of protection rules considers the risk level and protection cost of each node in the attack path. The risk level is determined by the node's position in the attack path and the attack success probability. The protection cost includes resource consumption and impact on normal business. In the case of limited resources, protection rules for high-risk nodes are prioritized. Protection rules are stored in a rule library in a standard format, including rule ID, trigger condition, execution action, priority, and effective range fields. The rule evaluation mechanism regularly checks rule effectiveness and adjusts rule parameters or eliminates inefficient rules based on protection effectiveness and false positive rate.

[0077] In practical applications, after deploying the protection system on an e-commerce platform, a credential stuffing attack against user accounts was successfully detected and blocked. The system first identified abnormal login behavior with a feature matching degree of 0.89, predicted the probability of the attacker's next attempt to elevate privileges as 0.42, and calculated the comprehensive risk score as 0.612. The system automatically generated and deployed protection rules including IP flow control, account locking, and secondary verification, effectively blocking the attack and protecting user account security.

[0078] In an optional implementation, the method for predicting an optimal attack path based on the feature state transition probability comprises the following steps: The attack evolution graph comprises a set of attack state nodes and a set of state transition edges, and the attack evolution graph is used to generate new attack state nodes and state transition edges based on the set of attack state nodes, and the structural similarity of the new attack state nodes and the state transition edges is evaluated. An evolution graph quality evaluation function is constructed based on the structural similarity and the evaluation score, and the attack evolution graph is iteratively optimized according to the evolution graph quality evaluation function to obtain an optimized attack evolution graph. The optimized attack evolution graph is input into the evolution graph quality evaluation function, a candidate attack path is generated based on a current attack state, the state transition probability between adjacent attack state nodes in the candidate attack path is calculated to obtain a path transition probability. A path feature vector of the candidate attack path is extracted, the feature matching degree between the path feature vector and a preset feature state vector is calculated, the path transition probability and the feature matching degree are combined to obtain a path feasibility evaluation value, and an optimal attack path is selected from the candidate attack path according to the path feasibility evaluation value.

[0079] As shown in Figure 3 the method comprises: The attack evolution graph comprises a set of attack state nodes and a set of state transition edges, and the attack evolution graph is used to generate new attack state nodes and state transition edges based on the set of attack state nodes, and the structural similarity of the new attack state nodes and the state transition edges is evaluated.

[0080] The structural similarity of the newly generated attack state node and the state transition edge is evaluated, and the structural similarity calculation considers the topological relationship between nodes, node attribute similarity, and edge characteristics. In specific implementation, the system first constructs an adjacency matrix between nodes to record the connection relationship between nodes; for each pair of nodes, the similarity between their attribute vectors is calculated, including attack type, target resource, required permission, etc. dimensions; finally, the overall structural similarity between the node pair is obtained by integrating the topological position of the node and the attribute similarity. For example, two attack state nodes both represent "database server privilege escalation", and both are connected to the "get sensitive data" node, so their structural similarity is high.

[0081] An evolution graph quality evaluation function is constructed based on structural similarity and evaluation score, which comprehensively considers the integrity, consistency and practicability of the attack evolution graph. The input of the evaluation function includes the node set, edge set, structural similarity matrix between nodes of the attack evolution graph and the preset evaluation weight. The evaluation score calculation process includes: graph coverage score, which measures the coverage degree of the evolution graph to the attack path; structural redundancy score, which identifies and punishes redundant nodes and paths with similar structure; path rationality score, which evaluates whether the generated attack path conforms to the actual attack logic. For example, for an attack evolution graph containing 100 nodes, if it covers 95% of the known attack techniques, the structural redundancy is 15%, and the path rationality score is 0.85, then the comprehensive evaluation score is 0.78.

[0082] According to the evolution graph quality evaluation function, the attack evolution graph is iteratively optimized, redundant nodes with high structural similarity (such as 0.9) are identified and removed; functionally similar state transition edges are merged; state transition probabilities are adjusted to better reflect the actual attack situation; missing but reasonable attack state nodes and transition edges are added. Through multiple rounds of iterative optimization, the system continuously improves the quality of the attack evolution graph until the score of the evaluation function no longer significantly improves or reaches the preset number of iterations. In practical application, an initial attack evolution graph containing 80 nodes and 120 edges is optimized for 10 rounds, and is adjusted to 75 nodes and 115 edges, with the evaluation score improving from 0.65 to 0.88.

[0083] The optimized attack evolution graph is input into an evolution graph quality evaluation function, and a candidate attack path is generated based on the current attack state. The generation process uses a depth-first search algorithm to explore attack paths from the current attack state node. To avoid path explosion, the maximum search depth (e.g., 8) and the maximum number of candidate paths (e.g., 100) are set. For each generated candidate attack path, the state transition probabilities between adjacent attack state nodes in the path are calculated, and these probability values are multiplied to obtain the path transition probability. For example, the transition probabilities of each segment of the path "network scanning → vulnerability discovery → privilege acquisition → data theft" are 0.8, 0.6, and 0.7, respectively, and the overall path transition probability is 0.336.

[0084] The path feature vector of the candidate attack path is extracted, including path length, attack technology type, target resource value, and other dimensions. The feature matching degree of the path feature vector and the preset feature state vector is calculated using the cosine similarity method. The feature matching degree reflects the degree of conformity of the candidate path to the expected attack pattern. The path transition probability and the feature matching degree are combined with equal weights to obtain the path feasibility evaluation value. For example, for a candidate attack path, the path transition probability is 0.336, the feature matching degree is 0.75, and the equal weight combination method is used, then the path feasibility evaluation value is 0.543.

[0085] The candidate attack paths are sorted according to the path feasibility evaluation value, and the path with the highest evaluation value is selected as the optimal attack path. In actual application scenarios, such as network security protection systems, the system generates 50 candidate attack paths, calculates the feasibility evaluation value of each path, and finally identifies the path "external network scanning → exploiting Web application vulnerabilities → obtaining Web server privileges → lateral movement to database servers → escalating privileges → stealing core data" with an evaluation value of 0.82 as the optimal attack path, providing guidance for security protection strategy formulation.

[0086] Through the above method, the system can effectively construct and optimize the attack evolution graph, and comprehensively utilize path probability and feature matching degree to predict attack paths, providing decision support for network security protection.

[0087] In an optional implementation, according to the protection rule, a corresponding protection measure is deployed in the virtual target environment, and the attack feature countermeasure behavior data is continuously obtained through multi-modal perception, including: According to the protection rule, a protection measure is deployed in the virtual target environment, and a multi-agent collaborative perception mechanism is used to obtain attack feature countermeasure behavior data in the virtual target environment. Based on the countermeasure behavior data, the evolution direction of the attack feature countermeasure strategy is calculated, and the protection rule is updated according to the evolution direction of the countermeasure strategy. The updated protection rule is redeployed in the virtual target environment.

[0088] In the process of deploying protection measures in the virtual target environment according to the protection rules, the structure and content of the protection rules are parsed, and the protection rules usually contain attack feature identification conditions, response actions, priorities, and execution logic elements. For example, for a distributed denial of service (DDoS) attack protection rule, its identification conditions include "source IP address dispersion > 0.85", "request frequency per unit time > 500 times / sec", "TCP SYN packet ratio > 75%" and the like; the response actions include "discard related data packets", "limit source IP access frequency", or "start traffic cleaning" and the like. The system converts these rules into executable protection strategies and deploys corresponding protection components at key nodes of the virtual target environment, such as traffic filters at network boundaries, abnormal behavior detectors at application layers, and system resource monitors and the like.

[0089] The virtual target environment is a simulation environment of the real target system, including network topology, service components, data flow, and business logic. In the embodiment, the virtual environment is composed of multiple virtual machines and containers connected through software-defined networks. The environment simulates a typical three-layer architecture application system, including a load balancing layer, an application service layer, and a data storage layer, and is configured with a similar business traffic pattern as the production environment. The protection measures are deployed in the virtual firewall at the network entrance, the web application protection system in front of the application server, and the host protection agent of each node, forming a multi-level protection system.

[0090] In the implementation of obtaining attack feature countermeasure data in the virtual target environment using the multi-agent collaborative perception mechanism, the system deploys multiple types of intelligent perception agents, including network traffic analysis agents, system behavior monitoring agents, log analysis agents, and application state monitoring agents. These agents are distributed at different locations in the virtual environment and are responsible for data collection and preliminary analysis in specific domains. For example, network traffic analysis agents are located at key network nodes to capture data packets and extract traffic features; system behavior monitoring agents are deployed in host systems to record system calls and resource usage; log analysis agents collect and parse logs generated by various components; and application state monitoring agents track the running state and response time changes of application programs.

[0091] The core of multi-agent collaborative perception is information sharing and collaborative analysis between agents. The raw data collected by each agent is transmitted to the central coordinator through a secure communication channel. The coordinator realizes data fusion, establishes event correlation, and forms a global view. For example, when a suspicious web request pattern is detected, the network traffic analysis agent extracts the features and notifies the coordinator, which immediately requests the system behavior monitoring agent and the application state monitoring agent of the related server to provide supplementary information to determine whether there is an attack attempt and its actual impact on the system.

[0092] In practical applications, the multi-agent collaborative perception mechanism can capture the countermeasures taken by attackers against existing protection rules. For example, when the basic protection rules block requests containing keywords such as "SELECT" and "UNION", attackers use techniques such as character encoding transformation, comment insertion, or semantic equivalent replacement to bypass detection. The multi-agent system captures these transformed request contents through network traffic agents, while the application state monitoring agent observes that the database executes unexpected queries, and the system behavior monitoring agent records abnormal data access patterns. The coordinator integrates this information to identify the specific countermeasures used by the attacker, such as splitting "SELECT" into "SEL" + "ECT" or using hexadecimal encoding.

[0093] The collection of countermeasure data includes dimensions such as original request content, transformation technique features, bypass success rate, and target system response. In a test against a web application, the system collected 400 samples of attackers attempting to bypass XSS protection through HTTP parameter pollution, using different parameter encoding methods and injection positions. The system recorded the request details, bypass results, and server responses for each attempt, and found that 27% of the transformed attacks successfully bypassed existing rules. These successful samples mainly used techniques such as HTML entity encoding and event handler nesting.

[0094] Based on the countermeasure data, the system clusters and extracts features from the collected countermeasure samples to identify the main countermeasure types and techniques used by attackers. By comparing attack samples from different periods, the system can discover the evolution trend of attack features, such as the transition from simple character replacement to complex context-aware obfuscation.

[0095] In the analysis of the evolution direction of countermeasures, a vector representation of attack features is constructed, including dimensions such as syntax structure, semantic features, and execution effects. By comparing successful bypass samples and blocked samples, the system identifies effective countermeasures. In the aforementioned XSS attack case, the system analyzes and finds that attackers are transitioning from single encoding to multi-layer nested encoding, and are beginning to exploit parsing differences in specific browsers to bypass detection. In addition, attackers have increased indirect triggering methods based on DOM operations, which are difficult to detect through static rules.

[0096] During the process of updating the protection rules and redeploying according to the evolution direction of the countermeasures, the system automatically generates rule patches or completely new rule entries, including extending feature matching patterns, increasing detection depth, adjusting threshold parameters, and optimizing response strategies. For the multi-layer encoded XSS attacks discovered, the system adds recursive decoding processing and context-sensitive input validation rules. To deal with DOM operation type attacks, the system adds dynamic detection logic based on browser behavior simulation.

[0097] The updated rules are automatically verified to ensure that they can effectively protect known countermeasures while not significantly increasing false positive rates or affecting system performance. In the test environment, the updated XSS protection rules reduce the previous bypass rate of 27% to 3%, while the false positive rate is controlled within an acceptable range (less than 0.5%). After the rule verification passes, the system deploys the updated protection rules to the virtual target environment, replacing or supplementing the original rules, and continuously monitors their effectiveness.

[0098] Through this continuous "deployment-sensing-analysis-update" loop mechanism, the system can adapt to the changing attack countermeasures and maintain the effectiveness of the protection measures. This dynamic adaptive protection method significantly improves the system's ability to protect against unknown variant attacks.

[0099] The method further comprises: Creating a basic environment for the threat capture system, which simulates a real business server as a target with high simulation degree. In addition to installing necessary capture and analysis tools, the real server's operating system, application software, and system configuration must be completely copied. For example, for a web application server, the threat capture system not only needs to install the same version of the operating system and web service software, but also needs to configure the same website content, database structure, and access control policy. It is particularly important that the threat capture system must use the same IP address as the real server, so that the attacker cannot detect the change of the target environment after the attack traffic is redirected. The threat capture system is made using mirroring technology, which copies the entire real server, preserving all system files, configuration information, and application programs, and then adds traffic capture tools, behavior analysis components, and anti-escape mechanisms. The mirror file is stored in the mirror repository for on-demand deployment.

[0100] A network tunnel is established to implement traffic steering. The SDN controller establishes a dedicated tunnel between the enterprise Internet gateway and the network where the threat capture system is located, forming an independent traffic channel. Tunnel technology can use GRE, VXLAN, or IPsec protocols to ensure the security and reliability of data transmission. For example, when using a GRE tunnel, tunnel interfaces are created on the enterprise gateway and the router connected to the threat capture system, respectively, and source and destination addresses and key parameters are configured to establish a point-to-point connection. The two ends of the tunnel are identified as tunnel-1, which becomes the forwarding target for subsequent steering policies. The network tunnel not only provides a traffic transmission channel, but also ensures that malicious traffic does not pollute the enterprise network through isolation mechanisms. Even if the threat capture system is compromised, attackers cannot use it as a stepping stone to access other systems in the internal network.

[0101] Malicious traffic detection uses a multi-level defense mechanism. At the network layer, the firewall analyzes traffic characteristics through deep packet inspection technology to identify known attack characteristics. At the application layer, security defense software monitors service requests and responses to detect abnormal access patterns. At the system level, behavior monitoring components analyze process activity and file operations to detect suspicious behavior. When potential threats are detected, the intrusion detection module extracts key information such as source IP address, target IP address, protocol type, and application layer characteristics to construct threat feature descriptions. For example, for a web application attack, the detection module detected that the source IP address 1.2.1.5 initiated 500 login requests to the 10.1.1.1 server within 60 seconds, with a login failure rate of 95%, which matches the attack characteristics of password brute force cracking. The intrusion detection module marks this IP as a malicious source and triggers subsequent defense measures.

[0102] Threat intelligence analysis enhances detection capabilities, especially for unknown threats. The threat intelligence module receives data provided by the intrusion detection module, including IP addresses, domain names, URLs, file hashes, and behavior characteristics, and compares them with the threat intelligence library. The intelligence library contains descriptions of known indicators of compromise (IOCs) and attacker tactics, techniques, and procedures (TTPs). The comparison process uses a fuzzy matching algorithm that supports partial feature matching and behavior similarity calculation. For example, even if the attack IP is not included in the intelligence library, but its behavior pattern has a similarity of 85% to the attack methods of known APT organizations, it will be judged as a high-risk threat. The analysis results include threat type, credibility score, and attack phase judgment, which are fed back to the intrusion detection module to assist decision-making.

[0103] The deployment of the threat capture system adopts different strategies according to the enterprise resource conditions. For an enterprise with a large number of external servers but limited threat capture resources, an on-demand deployment mode is adopted. For an enterprise with fewer external servers and sufficient resources, a pre-deployment mode can be adopted. In the on-demand deployment mode, after the cloud computing management platform receives a deployment request containing a malicious IP address and a target IP address, a virtual machine is created on the threat capture server, and a corresponding threat capture system image is loaded according to the target IP address. For example, after detecting attacks on 10.1.1.1 and 10.1.1.2, the platform creates two virtual machines, loads the images corresponding to the two IP addresses respectively, and configures a virtual network environment with a gateway address of 10.1.1.255. After the virtual machine starts, the threat capture system immediately enters a running state and is ready to receive redirected attack traffic. Although the threat capture system uses the same IP address as the real server, it does not cause address conflicts or interfere with normal network operation because it does not publish routing information on the enterprise internal network.

[0104] The creation and issuance of the diversion strategy is the core mechanism of attack traffic redirection. After the SDN controller receives a strategy creation request containing a malicious source IP and a target IP, it generates and issues precise matching rules on the network device. On the enterprise Internet gateway, a diversion strategy matching the source IP of the malicious address is created to direct the hit traffic into the tunnel interface. On the router connected to the threat capture system, a diversion strategy matching the destination IP of the malicious source IP is created to direct the backhaul traffic back to the tunnel. For example, for attack traffic with source IP 1.2.1.1 to 1.2.1.10, a source address matching rule is created on the Internet gateway with a forwarding action to tunnel-1, and a destination address matching rule is created on router-2 with a forwarding action to tunnel-1. This strategy configuration ensures that only malicious traffic is redirected to the threat capture system, while normal user access is not affected, achieving precise protection.

[0105] The traffic forwarding and interactive response mechanism ensures that the attacker is unaware of the environment switching. When attack traffic reaches the enterprise gateway, it is identified by matching the diversion strategy and encapsulated into a tunnel message to be forwarded to the router where the threat capture system is located. The router sends the original message to the corresponding IP threat capture system after unencapsulating it. After receiving the attack message, the threat capture system can generate response messages that meet the protocol requirements due to the high consistency of the environment with the real server. These response messages are encapsulated into a tunnel by the router and returned to the enterprise gateway, and then forwarded to the attack source. The entire process is completely transparent to the attacker, from network connection, protocol interaction to application response, which is no different from directly attacking the real server, providing a highly realistic deception environment. For example, for an attacker's SQL injection attempt on a Web application, the threat capture system not only returns appropriate HTTP response codes and page content, but also simulates database query delays and error messages to enhance the realism of the interaction.

[0106] The resource recycling process after the attack ends ensures efficient operation of the system. The intrusion detection module monitors attack activities by setting a timeout timer. If no traffic from the malicious IP is detected within the preset time (e.g., 15 minutes), it is determined that the attack has ended. Before releasing the threat capture resources, the intrusion detection module first updates the firewall rules to add the confirmed malicious IP to the deny list, preventing the attack from returning. Then it notifies the cloud computing management platform to stop the corresponding threat capture system instance and notifies the SDN controller to delete the related diversion strategy. The cloud computing management platform exports the attack data and system logs recorded by the threat capture system before shutting down the virtual machine for subsequent research by security analysts. After exporting, the virtual machine state is suspended or saved, and the computing and storage resources are released. After receiving the notification, the SDN controller deletes the diversion strategy on the enterprise gateway and router, and restores the normal network routing.

[0107] The continuous updating mechanism of threat intelligence improves the defense effectiveness. Based on the attack data collected by the threat capture system, new threat features are extracted, including attack source information, attack method characteristics, and vulnerability exploitation patterns, which are updated to the threat intelligence library. This closed-loop mechanism enables the defense system to learn from each attack and continuously improve its ability to identify unknown threats. For example, a captured attack exploited an undisclosed zero-day vulnerability. By analyzing the attack traffic and system behavior logs, the feature pattern was extracted and added to the detection rule library, enabling early identification and interception of similar attacks the next time. This adaptive learning capability significantly improves the defense effect against advanced persistent threats (APTs).

[0108] In practical applications, a financial service provider deployed the dynamic threat capture system and successfully captured and analyzed a targeted attack on its online banking system. The attack first scanned the target system architecture and then attempted to exploit application layer vulnerabilities to gain access. After the intrusion detection module identified the abnormal scanning behavior, it marked the source IP as a malicious address and triggered the threat capture system deployment process. The attack traffic was seamlessly directed to the threat capture environment, and the attacker continued their penetration attempts, including vulnerability exploitation and privilege escalation. The entire attack process was recorded, and the security team analyzed and discovered unknown vulnerabilities in the application, which were promptly patched in the real system, preventing potential data leakage risks. The attacker was unaware of the environmental changes and eventually abandoned the attack after multiple attempts. This case demonstrates the dual value of the dynamic threat capture system in protecting critical business systems while collecting high-value threat intelligence.

[0109] In a second aspect of the embodiments of the present application, a construction system of a dynamic threat capture system is provided, comprising: The first unit is configured to acquire heterogeneous security data in a target network environment, extract a three-domain behavior portrait based on the heterogeneous security data, construct a multi-dimensional feature vector, and identify an attack feature with a threat through feature matching of the three-domain behavior portrait. The second unit is configured to dynamically construct a virtual target environment with a layered protection architecture according to the attack feature, guide the attack feature into the virtual target environment, and acquire threat behavior data through multi-modal perception based on a feature template of the three-domain behavior portrait. The third unit is configured to construct a threat behavior feature library, compare the threat behavior data with the three-domain behavior portrait, predict a subsequent attack path, and generate a protection rule. The fourth unit is configured to deploy a corresponding protection measure in the virtual target environment according to the protection rule, continuously acquire countermeasure behavior data of the attack feature through multi-modal perception, update the threat behavior feature library based on the countermeasure behavior data, and optimize the protection rule to realize continuous countermeasures against the attack feature.

[0110] In a third aspect, an electronic device is provided, including: a processor; a memory for storing processor-executable instructions; The processor is configured to invoke the instructions stored in the memory to execute the method described above.

[0111] In a fourth aspect, a computer-readable storage medium is provided, which stores computer program instructions, and the computer program instructions are executed by a processor to implement the method described above.

[0112] The present application can be a method, device, system and / or computer program product. The computer program product can include a computer readable storage medium having computer readable program instructions stored therein, which are used to perform various aspects of the present application.

[0113] Finally, it should be noted that: the above embodiments are only used to illustrate the technical solutions of the present application, and not to limit them; although the present application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that: it can still modify the technical solutions recorded in the foregoing embodiments, or make equivalent replacement for part or all of the technical features; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the scope of the technical solutions of the embodiments of the present application.

Claims

1. A method for constructing a dynamic threat capture system, characterized in that, include: Obtain heterogeneous security data in the target network environment, extract three-domain behavioral profiles based on the heterogeneous security data, construct multi-dimensional feature vectors, and identify threatening attack features through feature matching of the three-domain behavioral profiles; A virtual target environment with a layered protection architecture is dynamically constructed based on the attack characteristics. The attack characteristics are guided into the virtual target environment, and multimodal perception is performed based on the feature template of the three-domain behavior profile to obtain threat behavior data. Construct a threat behavior feature library, compare the threat behavior data with the three-domain behavior profiles, predict subsequent attack paths, and generate protection rules; According to the protection rules, corresponding protection measures are deployed in the virtual target environment. Multimodal perception is used to continuously acquire adversarial behavior data of the attack characteristics. The threat behavior feature library is updated based on the adversarial behavior data, and the protection rules are optimized to achieve continuous adversarial action against the attack characteristics.

2. The method according to claim 1, characterized in that, Based on the heterogeneous security data, a three-domain behavioral profile is extracted, and a multi-dimensional feature vector is constructed. Threatening attack features are identified through feature matching of the three-domain behavioral profiles, including: A three-dimensional feature vector is extracted from heterogeneous security data. The three-dimensional feature vector is then concatenated to construct behavioral state nodes. The state transition probabilities between the behavioral state nodes are calculated to construct state transition edges. The behavioral state nodes and the state transition edges are then used to construct a behavioral evolution graph. Based on the behavior evolution graph, calculate the behavior similarity deviation and state transition anomaly between adjacent behavior state nodes, and mark the behavior state nodes whose behavior similarity deviation is greater than a preset similarity threshold and whose state transition anomaly is greater than a preset anomaly threshold as mutation nodes. The feature weights in the three-dimensional feature vector are adaptively adjusted based on the mutation nodes to generate adjusted feature weights; the three-dimensional feature vector is then weighted and fused based on the adjusted feature weights to construct a three-domain behavioral profile. The feature matching degree between the behavior profile to be identified and the historical behavior profile is calculated. The evolution prediction probability of the behavior profile to be identified is calculated based on the behavior evolution graph. The identification score is calculated based on the feature matching degree and the evolution prediction probability. The attack feature is identified based on the identification score, and the identification result is fed back to the behavior evolution graph for updating, so as to realize the dynamic identification of attack features.

3. The method according to claim 2, characterized in that, Calculating the feature matching degree between the behavior profile to be identified and historical behavior profiles, calculating the evolution prediction probability of the behavior profile to be identified based on the behavior evolution graph, and calculating the identification score based on the feature matching degree and the evolution prediction probability include: The discriminator of the generative adversarial network inputs the behavioral profile to be identified and the historical behavioral profiles. The discriminator models the degree of matching between the behavioral profile to be identified and the historical behavioral profiles and outputs the feature matching degree. The neighboring nodes of the node corresponding to the behavior profile to be identified are extracted. Based on the neighboring nodes, the generator of the generative adversarial network generates a behavior evolution path and maps the behavior evolution path to a behavior evolution graph. Based on the discriminator of the generative adversarial network, the authenticity of the behavior evolution path is evaluated according to the behavior evolution graph, and the association features between nodes in the behavior evolution graph are output to obtain the fusion association score. In the behavior evolution graph, the generator of the generative adversarial network explores a set of candidate paths starting from the node corresponding to the behavior profile to be identified. Based on the discriminator, the authenticity of each candidate path in the set is evaluated according to the fusion association score to obtain the path probability. The candidate path set is input into the decision tree ensemble model. Based on the path probability, the decision tree ensemble model predicts the evolution trend of each candidate path and outputs the evolution prediction probability. The feature matching degree and the evolution prediction probability are input into the decision tree ensemble model, and the recognition score is obtained through multi-tree collaborative decision-making of the decision tree ensemble model.

4. The method according to claim 1, characterized in that, A virtual target environment with a layered protection architecture is dynamically constructed based on the attack characteristics. The attack characteristics are then guided into the virtual target environment. Multimodal perception is performed based on the feature templates of the three-domain behavioral profile to obtain threat behavior data, including: The virtual target environment is divided into different unit sets. Environmental feature vectors are extracted from the original target environment. A digital twin model is constructed based on the environmental feature vectors. An environment mapping is generated through the digital twin model. Attack features are input into the digital twin model to generate mapping results. The digital twin model is deployed in the different unit sets. A path evaluation is constructed based on the mapping results. Based on the path evaluation, each candidate guidance path in the candidate guidance path set is evaluated, and the candidate guidance path with the highest evaluation score is selected as the optimal guidance path; based on the optimal guidance path, the attack characteristics are guided to the virtual target environment to construct an analysis module; The analysis module is used to extract features from the observation data in the virtual target environment to obtain multi-dimensional features; the multi-dimensional features are input into the digital twin model for fusion to obtain fused features; and the observation data is marked with threats based on the fused features to obtain threat behavior data.

5. The method according to claim 1, characterized in that, A threat behavior feature database is constructed, and the threat behavior data is compared with the three-domain behavior profiles to predict subsequent attack paths and generate protection rules, including: Threat behavior features are represented as n-dimensional feature vectors. A feature evolution graph is constructed using the n-dimensional feature vectors. The n-dimensional feature vectors are mapped to a three-domain behavior profile. The matching probability of the three-domain behavior profile is calculated based on the feature state transition probability in the feature evolution graph. The feature matching degree is calculated based on the matching probability and a preset weight coefficient. An attack evolution graph is constructed based on the characteristic state transition probabilities. The attack path probabilities are calculated using the attack evolution graph. The attack path probabilities are combined with the feature matching degree to predict the optimal attack path. Protection rules are generated based on the optimal attack path.

6. The method according to claim 5, characterized in that, An attack evolution graph is constructed based on the characteristic state transition probabilities. The attack path probabilities are calculated using the attack evolution graph. The optimal attack path is predicted by combining the attack path probabilities with the feature matching degree. The attack evolution graph includes a set of attack state nodes and a set of state transition edges. New attack state nodes and state transition edges are generated based on the set of attack state nodes using the attack evolution graph. The structural similarity between the new attack state nodes and the state transition edges is evaluated. An evolution graph quality assessment function is constructed based on the structural similarity and evaluation score. The attack evolution graph is then iteratively optimized according to the evolution graph quality assessment function to obtain the optimized attack evolution graph. The optimized attack evolution graph is input into the evolution graph quality evaluation function to generate candidate attack paths based on the current attack state, and the path transition probability is obtained by calculating the state transition probability between adjacent attack state nodes in the candidate attack path. Extract the path feature vector of the candidate attack path, calculate the feature matching degree between the path feature vector and the preset feature state vector, combine the path transition probability with the feature matching degree to obtain the path feasibility evaluation value, and select the optimal attack path from the candidate attack paths based on the path feasibility evaluation value.

7. The method according to claim 1, characterized in that, According to the protection rules, corresponding protection measures are deployed in the virtual target environment, and adversarial behavior data of the attack characteristics are continuously acquired through multimodal perception, including: According to the protection rules, protective measures are deployed in the virtual target environment. Attack feature adversarial behavior data in the virtual target environment is obtained by using a multi-agent collaborative perception mechanism. The evolution direction of the adversarial strategy of the attack features is calculated based on the adversarial behavior data. The protection rules are updated according to the evolution direction of the adversarial strategy. The updated protection rules are redeployed in the virtual target environment.

8. A system for constructing a dynamic threat capture system, used to implement the method of any one of claims 1-7, characterized in that, include: The first unit is used to acquire heterogeneous security data in the target network environment, extract three-domain behavioral profiles based on the heterogeneous security data, construct multi-dimensional feature vectors, and identify threatening attack features through feature matching of the three-domain behavioral profiles. The second unit is used to dynamically construct a virtual target environment with a layered protection architecture based on the attack characteristics, guide the attack characteristics into the virtual target environment, and perform multimodal perception based on the feature template of the three-domain behavior profile to obtain threat behavior data. The third unit is used to build a threat behavior feature library, compare the threat behavior data with the three-domain behavior profile, predict subsequent attack paths, and generate protection rules. The fourth unit is used to deploy corresponding protection measures in the virtual target environment according to the protection rules, continuously acquire the adversarial behavior data of the attack characteristics through multimodal perception, update the threat behavior feature library based on the adversarial behavior data, and optimize the protection rules to achieve continuous adversarial action against the attack characteristics.

9. An electronic device, characterized in that, include: processor; Memory used to store processor-executable instructions; The processor is configured to invoke instructions stored in the memory to execute the method according to any one of claims 1 to 7.

10. A computer-readable storage medium having computer program instructions stored thereon, characterized in that, When the computer program instructions are executed by the processor, they implement the method described in any one of claims 1 to 7.

Images