Honeypot automatic coping strategy generation method based on large model

Abstract

The invention discloses a honeypot automatic coping strategy generation method based on a large model. The method comprises the steps of S1, performing semantic analysis on dynamic attack behaviors; s2, performing context-aware threat reasoning; s3, adaptive strategy generation and semantic verification are carried out; s4, strategy executable compiling is carried out; s5, enhancing the efficiency of the closed-loop strategy; according to the method, the authority / service logic contradiction is thoroughly eliminated through a semantic consistency verification mechanism, so that the false alarm rate of the honeypot in the APT attack is reduced; an anti-recognition perturbation code injected by the low-entropy strategy compiling technology breaks through a traditional honeypot periodic response mode, and the fingerprint recognition success rate of an attacker is reduced; a resource penalty function of the Pareto optimal strategy sequence enables a trapping intensity mean value under limited resources to be improved; a double-channel updating mechanism promotes coevolution of a knowledge base and a constraint set, and the response generation speed for an unknown attack mode is shortened.

Description

TECHNICAL FIELD

[0001] The application belongs to the field of honeypot coping strategies, and more particularly to a large model-based honeypot automatic coping strategy generation method. BACKGROUND

[0002] As an active defense technology, network honeypot traps attackers by simulating real system vulnerabilities. The current mainstream solutions mainly include: static rule matching type honeypot: generate response scripts based on a pre-defined attack feature library, and use a finite state machine to realize the interaction logic; machine learning enhanced honeypot: identify attack patterns through behavior clustering algorithms to drive pre-set strategy modules to generate responses; game theory strategy optimization honeypot: uses reinforcement learning to optimize defense action sequences, but the action space is limited to the pre-defined rule library; the above technologies significantly rely on artificial experience to construct rule libraries or training data, and have inherent limitations; In dynamic attack scenarios, due to the lack of deep understanding of attack semantics, the technology often generates responses that violate system behavior logic, such as: unopened services returning access logs, low-privilege accounts performing privileged operations; such contradictory behaviors are easily identified by advanced attackers through context association analysis, leading to honeypot failure; the root cause is that the rule library cannot cover the semantic association of multi-stage combined attacks, and the machine learning model cannot capture the temporal consistency constraints of disguised identities; Based on the above, we propose a large model-based honeypot automatic coping strategy generation method to address the existing problems in the prior art. SUMMARY

[0003] The purpose of the present application is to solve the problems existing in the prior art, and to propose a large model-based honeypot automatic coping strategy generation method, which eliminates the risk of behavior logic exposure based on semantic paradox verification; adopts entropy reinforcement compilation technology to make the response mechanization feature zero; 3. Construct a dynamic attack chain reasoning-strategy evolution closed loop to improve the advanced attack trapping rate.

[0004] To achieve the above purpose, the present application provides the following technical scheme: A large model-based honeypot automatic coping strategy generation method, comprising the following steps: S1, real-time capture of original attack traffic against the honeypot, extraction of multi-dimensional attack features through a protocol analysis engine; convert the attack feature sequence into a natural language description of a dynamic attack scenario text, including attack source identity, attack tool fingerprint, operation instruction semantics and attack stage marker; S2, splice the dynamic attack scenario text with the honeypot environment knowledge base as context input; perform multi-round threat reasoning through a pre-trained large language model, output adversarial intent analysis and attacker portrait structured data; S3, based on the threat reasoning result and the preset defense target constraint set, a large language model generates a multi-step virtual confrontation operation sequence; a model feedback loop mechanism is used for semantic consistency verification of the operation sequence, to ensure that the policy logic meets the behavior consistency principle of the honeypot camouflage identity; S4, mapping the virtual confrontation operation sequence that passes the verification to a honeypot atomic operation instruction set; automatically combining to generate a low-entropy defense strategy script that can be deployed immediately, to avoid producing a mechanically identifiable feature response mode; S5, executing the defense strategy script and collecting attacker interaction feedback data; based on the interaction data and the confrontation effect evaluation of the large language model, dynamically updating the honeypot environment knowledge base and the defense target constraint set, to realize a strategy evolution closed loop.

[0005] Preferably, the protocol analysis engine in step S1 uses a multi-level attack feature aggregation mechanism, including: network layer features, application layer features, and behavior layer features; the dynamic attack scene text is generated through feature time sequence association, and an attack stage risk weight label is embedded.

[0006] Preferably, the attack instruction semantic conversion method used in step S1 includes: restoring binary shell instruction streams to natural language operation command descriptions; performing anti-decompression and pseudo-instruction stripping on obfuscated attack payloads; based on the attack tool fingerprint library, adding tool chain threat level labels.

[0007] Preferably, the honeypot environment knowledge base in step S2 is a dynamic graph data structure, including: virtual service vulnerability nodes, including CVE number simulation and patch state labels; historical attack path relationship edges, including successful / failed attack behavior records; associating attacker intentions in threat reasoning through real-time knowledge graph embedding technology; The multi-round threat reasoning method of step S2 is specifically: the first reasoning generates attack target hypotheses, including data theft, privilege escalation, and persistent residence; the second reasoning analyzes attack means synergy, including horizontal movement and defense evasion combination techniques; the final output includes structured portrait data containing attack chain stage confidence scores.

[0008] Preferably, the defense target constraint set in step S3 implements a dynamic priority scheduling mechanism: when resource consumption approaches the upper limit, automatically reduce the vulnerability trigger complexity weight; When a high-risk APT attack is detected, prioritize increasing the trapping strength threshold. A Pareto optimal policy sequence is generated using a constraint conflict resolution algorithm; The semantic consistency verification in step S3 specifically involves: Identity and behavioral conflict detection; Validation of the time logic paradox; The validation failure strategy triggers a context-aware regeneration mechanism for the large language model.

[0009] Preferably, the honeypot atomic operation instruction set in step S4 employs response pattern obfuscation technology: Generates a nondeterministic, delayed response to the same attack command; Injecting device fingerprint noise factors into fake service responses; Dynamically adjust the timestamp dispersion in the log forgery template.

[0010] Preferably, the low-entropy defense strategy script in step S4 is generated through a triple compilation layer: Semantic layer: Translates natural language operation sequences into intermediate instruction trees; Logic layer: Inject anti-feature recognition perturbation code; Execution layer: Adapts to the kernel-level API call interface of the target honeypot system.

[0011] Preferably, the attacker interaction feedback data analysis in step S5 includes: Indicators of strategy-induced effectiveness include attack persistence duration and number of lateral movement attempts; Honeypot exposure risk indicators include sudden decreases in attack traffic and scanner signature detection; The quantitative metrics are mapped to reinforcement learning reward signals for knowledge base updates; The strategy evolution closed loop in step S5 adopts a dual-channel update mechanism: Short-term update: Real-time injection of the interaction characteristics of this attack session into the honeypot environment knowledge base; Long-term updates: Optimize the threshold parameters of the defense target constraint set based on historical attack patterns clustering.

[0012] Preferably, the dynamic graph data structure employs adversarial knowledge distillation technique: Extract implicit threat association rules from large language model inference; The rules are compressed into lightweight graph submodules; Replace the original model for threat inference in resource-constrained scenarios; The device fingerprint noise factor is generated based on a heterogeneous honeypot environment parameter library: A virtual device model library, including routers, industrial control equipment, and IoT terminals; Operating system version fragmentation feature library; Non-repeatable hardware fingerprint combinations are constructed through weighted random sampling.

[0013] The technical effects and advantages of this invention are as follows: This invention provides an automatic response strategy generation method for honeypots based on a large model. Compared with the prior art, this invention completely eliminates the contradiction between permission / service logic through a semantic consistency verification mechanism, thereby reducing the false alarm rate of honeypots in APT attacks. The anti-identification perturbation code injected by the low-entropy strategy compilation technology breaks through the traditional honeypot periodic response mode, reducing the success rate of attacker fingerprint recognition. The resource penalty function of the Pareto optimal strategy sequence improves the average trapping intensity under limited resources; the dual-channel update mechanism promotes the co-evolution of the knowledge base and constraint set, shortening the response generation speed to deal with unknown attack patterns; the confidence score of the dynamic threat propagation model integrates multi-source data, improving the accuracy of advanced attack chain identification; the device fingerprint generated by the time-varying hardware noise algorithm has session-level uniqueness, improving the success rate of defense device clustering analysis. Attached Figure Description

[0014] Figure 1 This is a flowchart of the honeypot automatic response strategy generation method based on a large model according to the present invention. Detailed Implementation

[0015] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to specific embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the invention. All other embodiments obtained by those skilled in the art based on the embodiments of this invention without inventive effort are within the scope of protection of this invention.

[0016] This invention provides, for example Figure 1 The method for automatically generating honeypot response strategies based on a large model, as shown, includes the following steps: Step S1: Semantic Analysis of Dynamic Attack Behaviors Real-time capture of raw attack traffic targeting honeypots, and extraction of multi-dimensional attack characteristics through a protocol parsing engine; The attack feature sequence is transformed into dynamic attack scenario text described in natural language, including attack source identity, attack tool fingerprint, operation command semantics, and attack stage markers; The attack command semantic transformation method used in step S1 includes: Convert the binary shell command stream back into a natural language operation command description; Perform depacketization and pseudo-instruction stripping on obfuscated attack payloads; Threat level labeling based on attack tool fingerprint database and additional toolchain.

[0017] In step S1, the protocol parsing engine employs a multi-level attack signature aggregation mechanism, including: Network layer characteristics (source IP geographic location, TOR node marker), application layer characteristics (unconventional API call sequence, encrypted payload identifier), and behavioral layer characteristics (high-frequency probe interval, brute-force attack mode). Dynamic attack scenario text is generated by feature temporal correlation, and risk weight labels for attack stages are embedded.

[0018] Step S2: Context-Aware Threat Reasoning The dynamic attack scenario text is concatenated with the honeypot environment knowledge base (including system configuration, service vulnerability simulation data, and historical attack records) to form the context input; Multi-round threat reasoning is performed using a pre-trained large language model, outputting structured data for adversarial intent analysis and attacker profiling; The honeypot environment knowledge base in step S2 is a dynamic graph data structure, including: Virtual service vulnerability nodes (including CVE number simulation and patch status marking); Historical attack path relationships (including records of successful / failed attack behaviors); Attacker intent in threat reasoning is correlated using real-time knowledge graph embedding technology. The multi-round threat reasoning method in step S2 is as follows: The initial inference generates hypotheses about the attack targets (data theft, privilege escalation, persistent persistence). Secondary reasoning analysis of the synergy of attack methods (lateral movement and defensive evasion combination techniques); The final output is structured profile data containing confidence scores for each stage of the attack chain.

[0019] Applying adversarial knowledge distillation techniques to dynamic graph data structures: Extract implicit threat association rules from large language model inference; The rules are compressed into lightweight graph submodules; Replace the original model for threat inference in resource-constrained scenarios.

[0020] The confidence score for each stage of the attack chain is calculated using a dynamic threat propagation model: ,in, This represents the confidence score (0-1) for the current attack phase; a higher value indicates a stronger threat. The preset threat weights are the fingerprints of the i-th type of attack tools. The attack method coordination index (0-1) is generated by secondary inference from a large language model. The matching degree (0-1) for historical similar attack paths is derived from the honeypot environment knowledge base. As a normalized factor for attack duration, Let α and λ be the attenuation coefficients of the defense and evasion combination techniques, respectively, and let α and λ be the knowledge base contribution rate and the temporal attenuation coefficient. The above formula solves the problem of traditional scoring models ignoring the correlation of attack stages by parameterizing and integrating tool threats, historical data and temporal features. It introduces a defense and evasion attenuation term to reduce the false judgment rate of disguised attacks and realize the adaptive weighted fusion of knowledge base data and real-time attack flow.

[0021] Step S3: Adaptive policy generation and semantic verification Based on the threat inference results and the preset set of defense target constraints (including the trapping intensity threshold, resource consumption limit, and compliance rules), a multi-step virtual adversarial operation sequence is generated by the large language model; A model feedback loop mechanism is used to perform semantic consistency verification on the operation sequence to ensure that the strategy logic conforms to the behavioral consistency principle of honeypot disguised identity; Step S3 implements a dynamic priority scheduling mechanism for the defense target constraint set: When resource consumption approaches its limit, the vulnerability triggering complexity weight is automatically reduced. When a high-risk APT attack is detected, prioritize increasing the trapping strength threshold. A Pareto optimal policy sequence is generated using a constraint conflict resolution algorithm; Step S3, semantic consistency verification, includes: Identity and behavior conflict detection (e.g., network scan response generated by a database honeypot). Validation of time logic paradoxes (such as returning access logs when the service is not initialized); The validation failure strategy triggers a context-aware regeneration mechanism for the large language model.

[0022] The utility function of a Pareto optimal policy sequence is defined as: ,in, The overall utility value of the strategy. The vulnerability simulation was scored to assess its realism. This represents the ratio of current resource consumption to the upper limit. To meet the compliance rules and requirements, , This is a balance coefficient between trapping intensity and resource consumption, and + =1, γ is the nonlinear increase factor of resource penalty, and δ is the compliance reward weight; the above formula uses a logarithmic-exponential combination function to accurately characterize the marginal diminishing characteristics of the trapping reward. The non-powerful design of the resource penalty ensures that the strategy automatically degrades when resources reach the threshold. The compliance constraint avoids legal risks through the threshold cutoff mechanism.

[0023] Step S4: Executable compilation of the strategy Map the verified virtual adversarial operation sequence to the honeypot atomic operation instruction set (including fake service response, vulnerability trigger delay, and log forgery template). Automatically combine and generate low-entropy defense strategy scripts that can be deployed immediately, avoiding the generation of mechanical response patterns with recognizable characteristics; Step S4 uses response-mode obfuscation technology for the honeypot atomic operation instruction set. Generates a nondeterministic, delayed response to the same attack command; Inject device fingerprint noise factors (such as random memory address offsets) into fake service responses. Dynamically adjust the timestamp dispersion in the log forgery template; The low-entropy defense strategy script in step S4 is generated through a triple compilation layer: Semantic layer: Translates natural language operation sequences into intermediate instruction trees; Logic layer: Inject anti-feature identification perturbation codes (such as invalid system call instrumentation); Execution layer: Adapts to the kernel-level API call interface of the target honeypot system; Device fingerprint noise factor is generated based on a heterogeneous honeypot environment parameter library: Virtual device model library (including routers, industrial control equipment, and IoT terminals); Operating system version fragmentation feature library; Non-repeatable hardware fingerprint combinations are constructed through weighted random sampling.

[0024] Step S5: Enhancing the performance of closed-loop strategies Execute defense strategy scripts and collect attacker interaction feedback data; Based on the evaluation of adversarial effectiveness using interactive data and large language models, the honeypot environment knowledge base and defense target constraint set are dynamically updated to achieve a closed loop of strategy evolution. The policy evolution closed loop in step S5 adopts a dual-channel update mechanism: Short-term update: Real-time injection of the interaction characteristics of this attack session into the honeypot environment knowledge base; Long-term updates: Optimize the threshold parameters of the defense target constraint set based on historical attack patterns clustering; Step S5, attacker interaction feedback data analysis, includes: Indicators of strategy-induced effectiveness include attack persistence duration and number of lateral movement attempts; Honeypot exposure risk indicators include sudden decreases in attack traffic and scanner signature detection; The quantitative metrics are mapped to reinforcement learning reward signals for knowledge base updates; The quantitative model for honeypot exposure risk indicators is as follows: ,in, The honeypot exposure risk index, The ratio of the magnitude of the attack traffic mutation to the mean. Match confidence scores to scanner features. Let be the value of the policy-induced index for the k-th type at time t. Let η be the historical standard deviation of indicator k, and η be the sensitivity coefficient for behavioral mutations. The above formula shows that the dual-channel monitoring mode simultaneously captures traffic anomalies and behavioral anomalies. The problem of inconsistent dimensions of multiple indicators is solved by normalizing the historical standard deviation. When an attacker identifies a honeypot, the policy reset mechanism is automatically triggered.

[0025] In summary, compared with existing technologies, this invention completely eliminates the contradiction in permission / service logic through a semantic consistency verification mechanism, thereby reducing the false alarm rate of honeypots in APT attacks; the anti-identification perturbation code injected by the low-entropy strategy compilation technology breaks through the traditional honeypot periodic response mode, reducing the success rate of attacker fingerprint recognition. The resource penalty function of the Pareto optimal strategy sequence improves the average trapping intensity under limited resources; the dual-channel update mechanism promotes the co-evolution of the knowledge base and constraint set, shortening the response generation speed to deal with unknown attack patterns; the confidence score of the dynamic threat propagation model integrates multi-source data, improving the accuracy of advanced attack chain identification; the device fingerprint generated by the time-varying hardware noise algorithm has session-level uniqueness, improving the success rate of defense device clustering analysis.

[0026] Finally, it should be noted that the above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art can still modify the technical solutions described in the foregoing embodiments or make equivalent substitutions for some of the technical features. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A method for automatically generating honeypot response strategies based on a large model, characterized in that, Includes the following steps: S1. Real-time capture of raw attack traffic targeting honeypots, extraction of multi-dimensional attack features through protocol parsing engine; conversion of attack feature sequences into dynamic attack scenario text describing natural language, including attack source identity, attack tool fingerprint, operation command semantics, and attack stage markers. S2. The dynamic attack scenario text is concatenated with the honeypot environment knowledge base as context input; multiple rounds of threat reasoning are performed through a pre-trained large language model to output structured data of adversarial intent analysis and attacker profile; S3. Based on the threat inference results and the preset defense target constraint set, a multi-step virtual adversarial operation sequence is generated by a large language model; A model feedback loop mechanism is used to perform semantic consistency verification on the operation sequence to ensure that the strategy logic conforms to the behavioral consistency principle of honeypot disguised identity; S4. Map the verified virtual adversarial operation sequence to the honeypot atomic operation instruction set; automatically combine and generate low-entropy defense strategy scripts that can be deployed in real time, avoiding the generation of mechanical response patterns with identifiable features; S5. Execute the defense strategy script and collect attacker interaction feedback data; based on the interaction data and the adversarial effect evaluation of the large language model, dynamically update the honeypot environment knowledge base and defense target constraint set to achieve a closed loop of strategy evolution.

2. The method for generating automatic honeypot response strategies based on a large model according to claim 1, characterized in that, In step S1, the protocol parsing engine employs a multi-level attack signature aggregation mechanism, including: Network layer features, application layer features, and behavioral layer features; the dynamic attack scenario text is generated through temporal correlation of features, and risk weight labels for the attack stage are embedded.

3. The method for generating automatic honeypot response strategies based on a large model according to claim 1, characterized in that, The attack command semantic transformation method used in step S1 includes: Convert the binary shell command stream back into a natural language operation command description; Perform depacketization and pseudo-instruction stripping on obfuscated attack payloads; Threat level labeling based on attack tool fingerprint database and additional toolchain.

4. The method for generating automatic honeypot response strategies based on a large model according to claim 1, characterized in that, The honeypot environment knowledge base in step S2 is a dynamic graph data structure, including: Virtual service vulnerability nodes, including simulated CVE numbers and patch status markers; Historical attack path relationships, including records of successful / failed attack behaviors; By linking attacker intent in threat reasoning through real-time knowledge graph embedding technology; The multi-round threat reasoning method in step S2 is as follows: The initial inference generates hypotheses about attack targets, including data theft, privilege escalation, and persistent persistence. Secondary reasoning analyzes the synergy of attack methods, including lateral movement and defensive evasion combinations; The final output is structured profile data containing confidence scores for each stage of the attack chain.

5. The method for generating automatic honeypot response strategies based on a large model according to claim 1, characterized in that, The defense target constraint set in step S3 implements a dynamic priority scheduling mechanism: When resource consumption approaches its limit, the vulnerability triggering complexity weight is automatically reduced. When a high-risk APT attack is detected, prioritize increasing the trapping strength threshold. A Pareto optimal policy sequence is generated using a constraint conflict resolution algorithm; The semantic consistency verification in step S3 specifically involves: Identity and behavioral conflict detection; Validation of the time logic paradox; The validation failure strategy triggers a context-aware regeneration mechanism for the large language model.

6. The method for generating automatic honeypot response strategies based on a large model according to claim 1, characterized in that, The honeypot atomic operation instruction set in step S4 employs response-mode obfuscation technology: Generates a nondeterministic, delayed response to the same attack command; Injecting device fingerprint noise factors into fake service responses; Dynamically adjust the timestamp dispersion in the log forgery template.

7. The method for generating automatic honeypot response strategies based on a large model according to claim 6, characterized in that, The low-entropy defense strategy script in step S4 is generated through a triple compilation layer: Semantic layer: Translates natural language operation sequences into intermediate instruction trees; Logic layer: Inject anti-feature recognition perturbation code; Execution layer: Adapts to the kernel-level API call interface of the target honeypot system.

8. The method for generating automatic honeypot response strategies based on a large model according to claim 1, characterized in that, The attacker interaction feedback data analysis in step S5 includes: Indicators of strategy-induced effectiveness include attack persistence duration and number of lateral movement attempts; Honeypot exposure risk indicators include sudden decreases in attack traffic and scanner signature detection; The quantitative metrics are mapped to reinforcement learning reward signals for knowledge base updates; The strategy evolution closed loop in step S5 adopts a dual-channel update mechanism: Short-term update: Real-time injection of the interaction characteristics of this attack session into the honeypot environment knowledge base; Long-term updates: Optimize the threshold parameters of the defense target constraint set based on historical attack patterns clustering.

9. The method for generating automatic honeypot response strategies based on a large model according to claim 7, characterized in that, The dynamic graph data structure employs adversarial knowledge distillation techniques. Extract implicit threat association rules from large language model inference; The rules are compressed into lightweight graph submodules; Replace the original model for threat inference in resource-constrained scenarios; The device fingerprint noise factor is generated based on a heterogeneous honeypot environment parameter library: A virtual device model library, including routers, industrial control equipment, and IoT terminals; Operating system version fragmentation feature library; Non-repeatable hardware fingerprint combinations are constructed through weighted random sampling.

Images