Network space endogenous security protection system, method and equipment based on mimicry defense and medium

Abstract

The invention discloses a network space endogenous security protection system, method and device based on mimicry defense and a medium, and belongs to the technical field of network space security protection, and the method comprises the steps: carrying out attack perception and application layer dynamic cheating through a network layer intelligent threat hunting module; deep threat analysis and network layer intelligent hunting are carried out through the network layer intelligent threat hunting module; host layer anomaly detection and endogenous immune treatment are carried out through a host layer endogenous safe immune module; and unified scheduling and cross-layer collaborative response as well as quantitative evaluation and active closed-loop optimization are carried out through the unified scheduling and quantitative evaluation center. According to the invention, through dynamic traffic scheduling and behavior simulation trapping of the application layer mimicry camouflage module, attacker detection is effectively confused and interfered, and the active defense capability is improved; by means of a multi-engine fusion analysis and predictive AI model of a network layer intelligent threat hunting module, high-precision detection and attack chain reconstruction of known and unknown threats are realized.

Description

Technical Field

[0001] This invention relates to the field of cyberspace security protection technology, specifically to a cyberspace intrinsic security protection system, method, device, and medium based on mimicry defense. Background Technology

[0002] Against the backdrop of an increasingly severe cybersecurity situation, the power system, as a crucial component of critical information infrastructure, faces complex security challenges such as Advanced Persistent Threats (APTs), ransomware, and exploitation of unknown vulnerabilities. Traditional cybersecurity protection systems primarily rely on prior knowledge-based defense mechanisms such as signature matching and rule base updates, which have significant limitations: on the one hand, they struggle to address emerging threats like zero-day vulnerabilities and unknown attack methods; on the other hand, they lack cross-layer collaboration capabilities, resulting in blind spots and delays in the defense system.

[0003] In recent years, mimicry defense theory has, to some extent, changed the passive situation of network defense through dynamic, random, and diverse means. However, existing mimicry defense-based technical solutions mostly focus on dynamic scheduling at the network layer and have not yet formed a comprehensive intrinsic security system covering the application layer, network layer, and host layer. Especially in specific scenarios in the power industry, existing solutions still have shortcomings in the following aspects: First, they lack mimicry simulation and decoy capabilities at the business logic level; second, the detection accuracy of advanced threats such as encrypted traffic and covert channels is limited; third, it is difficult to achieve full-stack trusted verification from hardware root of trust to application runtime; and fourth, there is a lack of a unified quantitative evaluation and closed-loop optimization mechanism, resulting in the inability to continuously improve the protection effect. Summary of the Invention

[0004] In view of the above-mentioned problems, the present invention provides a cyberspace intrinsic security protection system, method, device and medium based on mimicry defense.

[0005] Therefore, the technical problems solved by this invention are: first, the lack of mimicry and trapping capabilities at the business logic level; second, the limited detection accuracy of advanced threats such as encrypted traffic and covert channels; third, the difficulty in achieving full-stack trusted verification from hardware root of trust to application runtime; and fourth, the lack of a unified quantitative evaluation and closed-loop optimization mechanism.

[0006] To address the aforementioned technical problems, this invention provides the following technical solution: a cyberspace intrinsic security protection system based on mimicry defense, comprising, The module includes an application-layer mimicry module, a network-layer intelligent threat hunting module, a host-layer intrinsic security immunity module, and an advanced persistent threat simulation and defense exercise module.

[0007] The application-layer mimicry module is deployed at the front end of the business system.

[0008] The network layer intelligent threat hunting module integrates a deep packet inspection engine, a natural language processing semantic analysis engine, and a predictive AI model based on the high-wattage model system.

[0009] The predictive AI model in the network layer intelligent threat hunting module adopts a training mechanism based on adversarial generative networks, which is trained by mixing simulated advanced attack traffic with real network traffic.

[0010] The network layer intelligent threat hunting module also includes an attack chain reconstruction unit, which can automatically associate discrete security events based on the output of the fused deep packet inspection engine and natural language processing semantic analysis engine, and use graph computing technology to construct and visualize the complete attack kill chain.

[0011] The host-layer intrinsic security immune module is embedded in the operating system kernel layer or tightly coupled to critical business processes.

[0012] The advanced persistent threat simulation and defense exercise module is connected to the unified scheduling and quantitative evaluation center in the host layer intrinsic security immunity module.

[0013] As a preferred embodiment of the network space intrinsic security protection system based on mimicry defense described in this invention, the application-layer mimicry camouflage module includes: The dynamic traffic scheduling engine is used to dynamically mix and randomly route real business traffic with highly realistic decoy traffic, forming a black hole targeting attackers' behavior and traffic.

[0014] The behavior simulation trapping unit has built-in a variety of adaptive mimicry simulation scenarios that are highly realistic in simulating real business logic. It is used to deeply trap attackers across the entire chain and record their attack behavior.

[0015] The real-time task compiler, based on instructions from the unified scheduling and quantitative evaluation center, compiles and loads tiny defense code snippets into the application runtime environment in real time.

[0016] As a preferred embodiment of the network space intrinsic security protection system based on mimicry defense described in this invention, the host-layer intrinsic security immunity module includes: The Trusted Security Kernel ensures the integrity of the core components of the protection system by building a minimal trusted computing base.

[0017] The behavior analyzer, based on statistical methods and machine learning algorithms, monitors process behavior, system calls, and resource access sequences in real time, dynamically learns, and establishes a baseline of normal application behavior.

[0018] The adaptive closed-loop processing unit can respond instantly according to a preset strategy when it detects abnormal behavior that deviates from the baseline.

[0019] The unified scheduling and quantitative evaluation center uses a high-speed data bus for real-time data interaction and strategy linkage.

[0020] The Advanced Persistent Threat (APPT) simulation and defense exercise module simulates the behavior of each stage of an APPT attack chain in an isolated test environment according to a preset attack script. This is used to continuously verify and train the collaborative defense and unknown threat immunity effectiveness of the application layer, network layer, and host layer modules, and to feed the exercise results back to the VPT technology system for optimizing the quantitative evaluation model.

[0021] As a preferred embodiment of the network space intrinsic security protection system based on mimicry defense described in this invention, the dynamic traffic scheduling engine in the application layer mimicry camouflage module has a scheduling strategy based on a spatiotemporal randomness algorithm.

[0022] The behavior simulation trapping unit also includes a dynamic environment generator, which can generate and deploy targeted mimicry scenarios in real time based on the attacker's IP reputation and behavior pattern profile output by the network layer intelligent threat hunting module.

[0023] The defense code snippet compiled by the real-time task compiler is a RASP self-protection script, which is used to implement real-time interception and behavior obfuscation of specific attack sequences in the application runtime environment.

[0024] As a preferred embodiment of the network space intrinsic security protection system based on mimicry defense described in this invention, the behavior analyzer in the host layer intrinsic security immunity module adopts the isolated forest model in the unsupervised learning algorithm to detect abnormal processes that deviate from the baseline of normal application behavior.

[0025] The preset strategies of the adaptive closed-loop handling unit constitute a dynamic strategy matrix. The strategy items and the degree of handling actions in the dynamic strategy matrix are dynamically learned and adjusted by the unified scheduling and quantitative assessment center based on the global threat situation.

[0026] As a preferred embodiment of the network space intrinsic security protection system based on mimicry defense described in this invention, the trusted security kernel in the host-layer intrinsic security immune module performs step-by-step measurement and verification based on cryptographic algorithms and the TCM / TPM hardware trusted root at startup.

[0027] As a preferred embodiment of the cyberspace intrinsic security protection system based on mimicry defense described in this invention, the VPT technology system integrated by the unified scheduling and quantitative evaluation center is implemented through a quantitative evaluation model. The input of the quantitative evaluation model is a set of key performance indicators, asset information, vulnerability data and real-time threat intelligence, and the output is a dynamic risk value and risk priority ranking for different security zones or business systems.

[0028] The unified scheduling and quantitative assessment center automatically generates and distributes optimized protection strategies to the application layer, network layer, and host layer modules based on the risk priority.

[0029] This invention provides a method for intrinsic cybersecurity protection based on mimicry defense.

[0030] To address the aforementioned technical problems, this invention provides the following technical solution: a cyberspace intrinsic security protection method based on mimicry defense, comprising: a network layer intelligent threat hunting module that perceives and extracts attack characteristics of initial attack behavior in real time and reports them to a unified scheduling and quantitative evaluation center; the unified scheduling and quantitative evaluation center generates instructions and issues them to an application layer mimicry camouflage module; the application layer mimicry camouflage module activates a dynamic environment generator to generate a mimicry simulation scenario for the attack source, and increases the decoy traffic delivery ratio through a dynamic traffic scheduling engine to route the attack source access to the decoy scenario to confuse, delay, and record the attack behavior.

[0031] The network layer intelligent threat hunting module uses a natural language processing semantic analysis engine to extract and understand the features of unstructured information, employs a predictive AI model to deeply detect attack patterns to identify potential advanced persistent threats, and initiates an attack chain reconstruction unit when a suspicious sequence is detected. Based on the output of the deep packet inspection engine and the natural language processing semantic analysis engine, it uses graph computing technology to associate discrete events, construct and visualize the complete attack kill chain.

[0032] The behavior analyzer of the host-layer intrinsic security immune module continuously monitors and maintains the normal behavior baseline using an unsupervised learning algorithm.

[0033] The unified scheduling and quantitative assessment center aggregates data from all layers, analyzes and outputs dynamic risk values ​​and priority rankings through quantitative assessment models, and automatically generates and distributes optimized collaborative protection strategies to modules at each layer.

[0034] The unified scheduling and quantitative assessment center continuously calculates the security performance score. When the score falls below the threshold, it automatically triggers the advanced persistent threat simulation and defense exercise module to conduct stress tests, and the exercise results are fed back to the VPT technology system.

[0035] The present invention provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps of the described cyberspace intrinsic security protection system based on mimicry defense.

[0036] The present invention provides a computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the steps of the described cyberspace intrinsic security protection system based on mimicry defense.

[0037] The beneficial effects of this invention are as follows: This invention effectively confuses and interferes with attacker detection and enhances proactive defense capabilities through dynamic traffic scheduling and behavior simulation trapping using the application-layer mimicry module; it achieves high-precision detection and attack chain reconstruction of known and unknown threats by leveraging the multi-engine fusion analysis and predictive AI model of the network-layer intelligent threat hunting module; it constructs a dynamic trust chain and abnormal behavior baseline using the host-layer intrinsic security immunity module, enabling real-time detection and autonomous handling of malicious behavior; and finally, through cross-layer collaboration and quantitative evaluation by a unified scheduling and quantitative evaluation center, it forms an intrinsic security closed loop of measurement-evaluation-testing-optimization. Attached Figure Description

[0038] To more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0039] Figure 1 This is a flowchart of the application layer mimicry camouflage module in a cyberspace intrinsic security protection system based on mimicry defense, provided as an embodiment of the present invention.

[0040] Figure 2 This is a structural diagram of a network layer intelligent threat hunting module in a cyberspace intrinsic security protection system based on mimicry defense, provided as an embodiment of the present invention.

[0041] Figure 3 This is a diagram illustrating the operation mechanism of the host-layer intrinsic security immune module in a network space intrinsic security protection system based on mimicry defense, provided as an embodiment of the present invention.

[0042] Figure 4 This is a logical block diagram of a unified scheduling and quantitative evaluation center in a cyberspace intrinsic security protection system based on mimicry defense, provided as an embodiment of the present invention.

[0043] Figure 5The flowchart of an advanced persistent threat simulation and defense exercise subsystem in a cyberspace intrinsic security protection system based on mimicry defense, provided as an embodiment of the present invention, is shown below.

[0044] Figure 6 This is a schematic diagram of cross-layer collaborative response and closed-loop optimization in a cyberspace intrinsic security protection system based on mimicry defense, provided as an embodiment of the present invention.

[0045] Figure 7 This is a flowchart of a cyberspace intrinsic security protection method based on mimicry defense, provided as an embodiment of the present invention. Detailed Implementation

[0046] To make the present invention more apparent and understandable, the specific embodiments of the present invention will be described in detail below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of the present invention, not all of them. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the protection scope of the present invention.

[0047] Example 1, referring to Figures 1-6 This is one embodiment of the present invention, which provides a cyberspace intrinsic security protection system based on mimicry defense, comprising: The module includes an application-layer mimicry module, a network-layer intelligent threat hunting module, a host-layer intrinsic security immunity module, and an advanced persistent threat simulation and defense exercise module.

[0048] The application-layer mimicry module is deployed at the front end of the business system.

[0049] In this application embodiment, the application layer mimicry module can also be deployed as a Sidecar component. Its core function is to build a dynamic and uncertain defense interface, making it difficult for attackers to detect the real system structure and business logic.

[0050] Reference Figure 2 The network layer intelligent threat hunting module integrates a deep packet inspection (DPI) engine, a natural language processing (NLP) semantic analysis engine, and a predictive AI model based on a high-wattage model system.

[0051] The host-layer intrinsic security immunity module is embedded in the operating system kernel layer or tightly coupled to critical business processes.

[0052] The Advanced Persistent Threat Simulation and Defense Exercise Module is connected to the Unified Scheduling and Quantitative Assessment Center in the Host Layer Intrinsic Security Immunity Module.

[0053] Reference Figure 1 The application-layer mimicry and camouflage module includes: The dynamic traffic scheduling engine is used to dynamically mix and randomly route real business traffic with highly realistic decoy traffic, creating a black hole targeting attacker behavior and traffic flow. Specifically, it includes: The hardware foundation specifically involves the dynamic traffic scheduling engine, which can be deployed on a server with a high-performance network interface card (NIC) equipped with multiple network queues (such as SmartNIC), or implemented as a software plugin on a load balancer to support high-speed packet processing and forwarding.

[0054] The data flow specifically refers to the dynamic traffic scheduling engine receiving policy instructions from the unified scheduling and quantitative evaluation center in real time (such as "increase the decoy route weight to 90% for traffic in IP segment ABC0 / 24"), and updating its routing table and scheduling algorithm accordingly.

[0055] The behavior simulation trapping unit has built-in a variety of adaptive mimicry simulation scenarios that are highly realistic in simulating real business logic. It is used to deeply trap attackers across the entire chain and record their attack behavior.

[0056] Specifically, the behavior simulation trapping unit consists of a dynamic environment generator and a highly interactive honeypot cluster: The workflow of the dynamic environment generator is as follows: Input: Receive attacker profiles from the network layer intelligent threat hunting module, including IP reputation, attack tool fingerprints, types of vulnerabilities attempted to be exploited, and behavioral sequence patterns.

[0057] Generation and Deployment: The generator comes pre-loaded with various basic business scenario templates (such as OA systems, database management interfaces, API gateways, etc.). Based on the attacker profile, it uses containerization technology (such as Docker) or lightweight virtual machines to quickly instantiate a highly customized simulation scenario within seconds. For example, if it detects that an attacker is scanning for web logic vulnerabilities, it dynamically generates a simulated web application containing common e-commerce business logic (such as user login, product browsing, and order placement), and deliberately presets some "vulnerability" traps that are similar to those in the real system.

[0058] Full-link trapping: Attacker sessions scheduled to this location will engage in "full-link" interactions within the simulation environment. Every step of their operation, including clicking links, submitting forms, and attempting SQL injection, will be recorded and monitored in a fine-grained manner.

[0059] Recording and Feedback: The monitoring agent embedded in the unit records all attack behaviors of the attacker (such as attack payload, exploited vulnerability paths, lateral movement attempts) and forms a detailed attack chain log, which is reported in real time to the unified scheduling and quantitative assessment center to provide data support for the global threat intelligence database.

[0060] The real-time task compiler, based on instructions from the unified scheduling and quantitative evaluation center, compiles and loads tiny defense code snippets into the application runtime environment in real time.

[0061] Specifically, the real-time task compiler listens for instructions issued by the unified scheduling and quantization evaluation center through a secure internal communication channel. These instructions are tiny defensive logic fragments (code snippets) described in a high-level language.

[0062] Upon receiving the instruction, the compiler will just-in-time (JIT) compile or interpret it into bytecode or machine code that can be executed directly in the current application runtime environment (such as JVM, .NET CLR, Node.js environment).

[0063] The compiled defensive code snippets are typically hook functions, which are injected into critical function call points of the target application (such as entry functions for handling HTTP requests, functions for executing database queries, and file operation functions). When a specific attack sequence is triggered (such as detecting a specific malicious parameter), these hook functions immediately execute predefined defensive actions.

[0064] Example of a specific defensive action: Immediate interception terminates the processing of the current request immediately and returns a fake error page.

[0065] Behavioral obfuscation involves harmlessly obfuscating the attacker's input before processing it. For example, escaping single quotes in an SQL injection statement can disable the attack without the attacker immediately realizing that it has been blocked, thus delaying the attack's pace.

[0066] Dynamic taint tracking marks data submitted by attackers and tracks its propagation within the application. If the data is found to be used for dangerous operations (such as system command execution), it is immediately blocked.

[0067] Reference Figure 3 The host-level intrinsic security immunity module includes: The Trusted Security Kernel ensures the integrity of the system's core components by building a minimal trusted computing base.

[0068] The behavior analyzer, based on statistical methods and machine learning algorithms, monitors process behavior, system calls, and resource access sequences in real time, dynamically learns, and establishes a baseline of normal application behavior.

[0069] The adaptive closed-loop processing unit can respond instantly according to a preset strategy when it detects abnormal behavior that deviates from the baseline.

[0070] Reference Figure 4 The unified scheduling and quantitative evaluation center uses a high-speed data bus for real-time data interaction and strategy linkage.

[0071] Specifically, it involves real-time data interaction with the aforementioned trusted security kernel, behavior analyzer, and adaptive closed-loop processing unit.

[0072] The Advanced Persistent Threat (APPT) simulation and defense exercise module simulates the behavior of each stage of an APPT attack chain in an isolated test environment based on a preset attack script. This is used to continuously verify and train the collaborative defense and unknown threat immunity effectiveness of the application layer, network layer, and host layer modules, and feeds the exercise results back to the VPT technology system for optimizing the quantitative evaluation model.

[0073] The dynamic traffic scheduling engine in the application layer mimicry module uses a scheduling strategy based on a spatiotemporal randomness algorithm.

[0074] The spatiotemporal randomness algorithm can be implemented using a weighted random scheduler. This scheduler maintains a dynamic routing table, where each route entry contains a destination address, weight value, and timestamp, including steps S1-S2: S1. Spatial randomness, specifically including dynamically allocating different routing paths for different source IPs or sessions based on real-time calculated risk scores, which are derived from the network layer.

[0075] In this invention, the network layer is an intelligent threat hunting module, which assigns different routing paths to the real business cluster and to decoy servers in different regions.

[0076] For dynamic routing path allocation in spatial random scheduling strategies, differentiated routing decisions are calculated for different network sessions based on real-time threat intelligence, specifically expressed as follows: in, The final scheduling score for session i, which will be used for subsequent routing decisions; The normalized real-time risk score originates from the network layer intelligent threat hunting module. This score is calculated based on attacker profiles, behavioral sequence threat levels, IP reputation, etc., and its value ranges from [0, 1]. The higher the value, the greater the likelihood of the session being malicious.

[0077] This represents the randomization hash factor. It is determined by the source IP address of the session (…). ), target port ( ) and a random salt value that is updated periodically by the system ( The hash function (such as SHA-256) is performed and normalized to obtain the hash value. The purpose of this factor is to introduce spatial randomness to ensure that even two sessions with similar risk scores will produce different hash values ​​due to differences in their IP, port, or salt value, and thus may be routed to different paths.

[0078] This represents a time perturbation function, a chaotic sequence or pseudo-random function (such as using a sine function with chaotic parameters) based on system time t, whose output value varies at low frequency and non-periodically within the range [0, 1]. This function introduces temporal randomness, causing the overall scheduling strategy baseline to drift over time, preventing attackers from summarizing fixed patterns through long-term probing.

[0079] α, β, γ represent weighting coefficients, and α + β + γ = 1.

[0080] S2, randomized time, specifically including: The weight value of each routing entry is periodically perturbed based on a pseudo-random number generator (PRNG) and a system timestamp, causing the routing policy to change dynamically over time without any fixed pattern.

[0081] When a user request is received, the scheduler randomly distributes the request according to the current routing table weights. For IPs identified as malicious, their traffic will be scheduled to the trapping environment with a very high probability, thus forming a "traffic black hole". This means that the attacker's probe requests will never return and will not be able to obtain real system feedback.

[0082] In this embodiment, the spatiotemporal randomness algorithm is executed by an intelligent scheduling model. This model maintains a dynamic list containing target nodes (real business servers and decoy servers of different types).

[0083] Specifically, the intelligent scheduling model has the following characteristics: Spatial randomness is achieved by assigning a randomized scheduling factor to each incoming request session. This factor is generated through a hash operation using the source IP address, the target port, and a real-time updated salt value, ensuring that different requests from the same session may be scheduled to different nodes, thus breaking attackers' probing patterns based on fixed IP addresses or ports.

[0084] The temporal dimension introduces a periodically changing weight matrix into the intelligent scheduling model. This matrix assigns a weight value to each target node, which is dynamically adjusted based on the system clock (such as a Unix timestamp) and a pre-defined chaotic sequence (such as one generated based on a Logistic Map). For example, every 5 seconds, the weights of all nodes are recalculated based on the output of the chaotic sequence, resulting in a non-periodic and unpredictable change in traffic distribution over time.

[0085] For each request, the dynamic traffic scheduling engine combines its randomized scheduling factor and the current dynamic weight matrix, using a weighted random selection algorithm to ultimately decide whether to route the request to a real business node or a specific decoy node. This mechanism creates an elusive "behavioral and traffic black hole," making it impossible for attackers to draw accurate network topology and service maps through repeated probing.

[0086] The behavior simulation trapping unit also includes a dynamic environment generator, which can generate and deploy targeted mimicry scenarios in real time based on the attacker's IP reputation and behavior pattern profile output by the network layer intelligent threat hunting module.

[0087] Specifically, the dynamic environment generator is an automated system based on container orchestration technologies (such as Kubernetes) and Infrastructure as Code (IaC).

[0088] The generator receives threat intelligence in real time from the network layer intelligent threat hunting module via an API interface, and formats it into a structured attacker profile, including: threat level, suspected attack type (such as SQL injection, file inclusion), fingerprint of the attack tools used, and target detection path.

[0089] The generator comes pre-loaded with an extensible library of simulated scenario templates. Each template is a configuration list describing a specific business system (such as a content management system, financial software backend, or API interface service). Upon receiving an attacker profile, the generator uses a rule engine to match and select the most suitable scenario template. For example, for attacks focused on API vulnerability exploits, a template containing a simulated RESTful API and its backend logic is selected.

[0090] Once a template is selected, the generator instantiates a completely new, highly realistic simulated environment within seconds in a dedicated, isolated decoy cluster by calling Kubernetes' CRD (Custom Resource Definition) or using Terraform scripts. This environment is dynamically injected with decoy data related to attacker behavior; for example, for SQL injection attacks, a table structure containing sensitive field names is pre-installed in the simulated database.

[0091] Once the environment is ready, the dynamic traffic scheduling engine receives instructions to redirect subsequent traffic from the attacker to this newly generated simulated scenario. When the attack session ends or a preset timeout period is reached, the environment is automatically destroyed to release resources, achieving on-demand and elastic utilization of defense resources.

[0092] The defensive code snippets compiled by the Real-Time Task Compiler are RASP self-protection scripts, which are used to implement real-time interception and behavior obfuscation of specific attack sequences in the application runtime environment.

[0093] Specifically, the Real-Time Task Compiler is a microkernel-based RASP runtime that is embedded into the protected business application process through mechanisms such as Java Agent, .NET Profiling API, or operating system-level ptrace.

[0094] The compiler receives defense scripts written in a domain-specific language (DSL) from the unified scheduling and quantification evaluation center. This DSL predefines security-related operational primitives. Upon receiving the scripts, the compiler performs syntax and security checks to ensure they are error-free and harmless.

[0095] Validated DSL scripts are compiled on-the-fly into JVM bytecode, .NET intermediate language (IL), or native machine code. The compiler then uses bytecode enhancement techniques or function hooks to weave the compiled code snippets into the target application's critical execution paths, as shown in examples B1-B4 below: B1, the entry point for HTTP request parsing, specifically uses the Servlet's service method.

[0096] B2. The database query execution point, specifically using JDBC Statement.execute.

[0097] B3. The operating system command execution point, specifically Runtime.exec.

[0098] B4. File system operation point, specifically using the FileOutputStream constructor.

[0099] In the above content, in this invention, just-in-time compilation is used, bytecode enhancement technology uses ASM and Javassist, and function hooks use Hook technology.

[0100] Runtime execution and effects: When the attack sequence triggers the woven detection logic (for example, detecting a malicious OGNL expression in the request parameters), the RASP script immediately throws a security exception, terminates the processing of the current request, and returns a customized error message to the upper layer, thus achieving real-time blocking of the attack.

[0101] For attacks that require long-term investigation, the script's executable behavior is obfuscated. For example, when an SQL injection attempt is detected, the script will not directly intercept it, but will rewrite the injected payload in a harmless way (such as escaping single quotes) and then let the query continue to execute. The attacker will get a seemingly "successful" but actually fake query result, which will greatly interfere with the attacker's judgment, delay the attack process, and buy time for the backend to trace the source.

[0102] The predictive AI model in the network layer intelligent threat hunting module adopts a training mechanism based on adversarial generative networks. It improves the robustness of detecting unknown threats and mutated attacks by training by mixing simulated advanced attack traffic with real network traffic.

[0103] The network layer intelligent threat hunting module also includes an attack chain reconstruction unit, which can automatically associate discrete security events based on the output of the fused deep packet inspection engine and natural language processing semantic analysis engine, and use graph computing technology to construct and visualize the complete attack kill chain.

[0104] In this embodiment, the network layer intelligent threat hunting module is deployed as a distributed probe and analysis center cluster at key network nodes. Its core task is to analyze network traffic, accurately identify high-level and highly stealthy threats, and reconstruct their complete attack process. (1) The foundation of deep detection through multi-engine fusion: Deep Packet Inspection (DPI) Engine: The engine can be deployed on hardware devices equipped with FPGAs or dedicated network processors, or it can be used to achieve line-rate traffic processing on general-purpose servers using DPDK technology.

[0105] Beyond traditional firewall port / IP inspection, it delves into application layer protocols for parsing. It can accurately identify and parse fields and payloads of various protocols such as HTTP / HTTPS (with SSL / TLS decryption required), DNS, FTP, and SMB.

[0106] It extracts key elements from communications, such as HTTP request URIs, User-Agents, and Cookies; DNS query domains and record types; and email attachment filenames and types. This provides structured and unstructured raw data for subsequent NLP and AI analysis.

[0107] Natural Language Processing (NLP) Semantic Analysis Engine: Specifically designed for analyzing unstructured text data in network traffic, this is key to discovering advanced threats; The DPI engine extracts text (such as HTTP request parameters, email body, subdomains in DNS tunnels, and FTP commands) and performs word segmentation, part-of-speech tagging, and named entity recognition.

[0108] It can use pre-trained models such as BERT or ERNIE to understand the semantics of text. For example, it can identify parameters in a seemingly normal HTTP POST request that actually contain hidden system commands or data disclosure intentions.

[0109] By calculating semantic similarity, malicious commands disguised by attackers using synonym substitution, encoding obfuscation, and other methods can be discovered. For example, replacing cat / etc / passwd with more / etc / passwd or performing Base64 encoding can be used to identify the true intent of the attackers through semantic analysis.

[0110] (2) Predictive AI models based on generative adversarial networks: Model architecture and training: It is responsible for learning the data distribution of real network traffic (especially normal business traffic) and generating traffic data that is highly similar to it but contains simulated attack characteristics. These attack characteristics are based on variations and combinations of known attack methods, simulating the probing behavior of unknown threats and APT attacks.

[0111] A predictive AI model is a threat detection model whose task is to determine whether the input traffic is "real normal traffic", "real malicious traffic" or "simulated attack traffic generated by a generator".

[0112] Predictive AI model generators consist of a generator and a discriminator.

[0113] The generator continuously produces simulated attacks that are harder to detect, forcing the discriminator to improve its detection capabilities; The generator's input is random noise z, with dimension 1. .

[0114] Optionally, the generator may also include a condition vector c, which may include a type label, strength parameter, or key feature fragment of a known attack.

[0115] The internal structure of the generator is as follows: The input layer is used to receive .

[0116] The fully connected layer contains an activation function, LeakyReLU.

[0117] The reshaping layer is used to transform vectors into a sequence shape suitable for convolution; A one-dimensional upsampling convolutional layer, Conv1DTranspose (filters=128, kernel_size=5, strides=2), with LeakyReLU activation function.

[0118] A one-dimensional convolutional layer (Conv1D, filters=64, kernel_size=5, padding='same') with the LeakyReLU activation function.

[0119] The output layer is a one-dimensional convolutional layer (Conv1D, filters=n_features, kernel_size=5, padding='same', activation='tanh' or 'sigmoid'), where n_features corresponds to the feature dimensions of the traffic data (such as packet length sequence, protocol type encoding, time interval, etc.).

[0120] The output is the generated simulated flow data. .

[0121] The discriminator, acting as a multi-classifier, determines which of the following three categories an input sample belongs to: (a) genuine normal traffic, (b) genuine malicious traffic (known attacks), and (c) simulated attack traffic generated by the generator. Through adversarial training, its ultimate goal is to accurately distinguish between normal and malicious (including known and unknown simulated) traffic.

[0122] The input to the discriminator is a sample of network traffic data, which can be real (normal or malicious) or generated.

[0123] The internal structure is as follows: The input layer is used to receive traffic data samples.

[0124] A one-dimensional convolutional layer (Conv1D, filters=64, kernel_size=5, strides=2) with the activation function LeakyReLU.

[0125] Batch Normalization layer.

[0126] A one-dimensional convolutional layer (Conv1D, filters=128, kernel_size=5, strides=2) with the activation function LeakyReLU.

[0127] Global Average Pooling (GlobalAveragePooling1D) or Flatten layer.

[0128] The fully connected layer (Dense, units=128) uses LeakyReLU as the activation function and a dropout rate of 0.3 to prevent overfitting.

[0129] Output layer: Outputs the probability distributions of the three categories. .

[0130] Advances in the discriminator require the generator to produce more realistic attacks. Through the above steps, the discriminator (i.e., the final predictive AI model) becomes more robust to detecting unknown threats and mutated attacks.

[0131] The well-trained discriminator model is deployed online to score real-time network traffic. It can not only match based on known features, but also identify previously unseen attack patterns based on the "essential attack features" learned in adversarial training, thus enabling threat prediction.

[0132] (3) Attack chain reconstruction unit: Data association: At the core of this unit is a graph computing engine whose data source is standardized security events output by the DPI and NLP engines.

[0133] Discrete security events are constructed as a heterogeneous information network. Nodes can represent IP addresses, hosts, users, processes, files, URLs, etc. Edges represent the relationships between them, such as "accessed," "logged in," "created," and "downloaded."

[0134] Engine-based graph algorithms (such as community detection, shortest path, and centrality analysis) automatically discover inherent connections between seemingly unrelated events. For example, it can automatically link a scan event from an external IP, a successful brute-force login, an abnormal external connection to an internal host, and the creation of a suspicious file into a complete attack path.

[0135] Kill chain construction and visualization: Based on the correlation results, the unit divides the attack activity into stages such as reconnaissance, weaponization, delivery, exploitation, installation, command and control, and target action, according to the Cyber ​​Kill Chain model.

[0136] Finally, by integrating front-end visualization libraries such as D3.js or ECharts, the complete attack and kill chain is presented to security analysts in the form of an interactive topology diagram. The diagram clearly shows the starting point of the attack, each step of the transition, the exploited vulnerabilities, and the compromised hosts, making the entire attack process clear at a glance and greatly improving the efficiency and accuracy of threat response.

[0137] The behavior analyzer in the host-layer intrinsic security immunity module uses the isolated forest model from unsupervised learning algorithms to detect abnormal processes that deviate from the normal application behavior baseline, specifically including steps B11-B17: B11. Data Preparation and Feature Engineering: Data collection: The behavior analyzer continuously collects multi-dimensional time-series data during host layer runtime, including but not limited to steps B111-B114: B111, Process Behavior Sequence: Process Startup Parameters, Child Process Generation Relationships, Process Lifecycle.

[0138] B112, System call sequence: call type, frequency, parameter structure, and call context.

[0139] B113, Resource Access Modes: File Read / Write, Network Connection, Memory Allocation, CPU Utilization Timing.

[0140] B114, Permissions and Identity Information: Process UID / GID, SELinux / AppArmor Context.

[0141] B12. Feature extraction and vectorization: Transform the raw behavioral data into structured feature vectors, for example: Statistical characteristics: number of system calls per minute, file operation entropy, and network port access dispersion.

[0142] Sequence features: Extracting n-gram system call patterns using a sliding window.

[0143] Contextual features: process tree depth, session relevance, and resource access time distribution.

[0144] B13. Data normalization: Use Z-score standardization or Min-Max scaling to ensure that each feature dimension participates in model calculation under the same scale.

[0145] B14. Algorithm for constructing the isolation tree: Each isolation tree is constructed using a completely random method: a feature dimension is randomly selected. q Randomly select a split point between the maximum and minimum values ​​of this feature. p ; Calculate the dataset according to Divide the tree into left and right child nodes; recursively execute the above steps until either of the following conditions is met: the node contains only one sample; or the tree reaches the preset maximum depth. All samples in a node have identical feature values.

[0146] B15. Tree Structure: Each node records: Split Feature Index q Split threshold p The number of samples contained in the left and right child pointer nodes (used for path length calculation).

[0147] B16. Constructing an Isolated Forest: Setting the Number of Trees in the Forest t (Typically 100-200 trees), each tree is constructed using a randomly sampled subset, the subset size is... Typically, the number is 256 or 512 to control the diversity of each tree and reduce overfitting; multiple isolated trees are built in parallel using multi-core CPUs or distributed computing frameworks (such as Spark MLlib) to improve modeling efficiency.

[0148] B17. Model Training Process: Training is performed using only normal behavior samples, without labeling abnormal data. The training data comes from behavior logs collected by the system during the security baseline period (such as the initialization phase or a known attack-free period). Specific training steps are B171-B173: B17.1 Input: Normal Behavior Feature Matrix , where n is the number of samples and m is the number of features.

[0149] B17.2, for each isolated tree Random selection A sample is used as the training set for the tree; the above isolated tree construction algorithm is recursively executed to generate the tree structure.

[0150] B17.3 Output: The trained Isolation Forest model .

[0151] The preset strategies of the adaptive closed-loop response unit constitute a dynamic strategy matrix. The strategy items and the degree of response actions in the dynamic strategy matrix are dynamically learned and adjusted by the unified scheduling and quantitative assessment center based on the global threat situation.

[0152] The trusted security kernel in the host-layer intrinsic security immune module performs step-by-step measurement and verification based on cryptographic algorithms and the TCM / TPM hardware root of trust during startup.

[0153] The cryptographic algorithms are specifically domestically developed algorithms (e.g., elliptic curve public key cryptography, cryptographic hash algorithms, block cipher algorithms, or identifier cryptography algorithms).

[0154] The VPT technology system integrated by the unified scheduling and quantitative assessment center is implemented through a quantitative assessment model. The input of the quantitative assessment model is a set of key performance indicators, asset information, vulnerability data and real-time threat intelligence, and the output is dynamic risk values ​​and risk priority ranking for different security zones or business systems.

[0155] The unified scheduling and quantitative assessment center prioritizes risks and automatically generates and distributes optimized protection strategies to application layer, network layer, and host layer modules.

[0156] Example 2, refer to Figure 7 As an embodiment of the present invention, based on the previous embodiment, a cyberspace intrinsic security protection method based on mimicry defense is provided, comprising: S1. Attack detection and application-layer dynamic deception are achieved through the network layer intelligent threat hunting module.

[0157] S2. Perform in-depth threat analysis and network layer intelligent threat hunting through the network layer intelligent threat hunting module.

[0158] S3. Anomaly detection and endogenous immune treatment at the host layer are performed through the host layer endogenous security immune module.

[0159] S4. Through a unified scheduling and quantitative evaluation center, unified scheduling and cross-layer collaborative response, as well as quantitative evaluation and proactive closed-loop optimization are carried out.

[0160] Furthermore, the attack detection and application-layer dynamic deception in S1 includes steps A11-A15: The A11 network layer intelligent threat hunting module uses its integrated deep packet inspection (DPI) engine and predictive AI model based on the high-wattage model system to perceive and identify initial attack behaviors such as scanning and brute-force attacks in the network in real time, and extract attack characteristics such as attack source IP and behavior sequence.

[0161] A12. The network layer intelligent threat hunting module reports the above attack characteristics to the unified scheduling and quantitative evaluation center.

[0162] A13. The unified scheduling and quantitative assessment center generates policy instructions based on the received threat intelligence and sends them to the application layer mimicry module.

[0163] A14. The application layer mimicry module, based on the instruction, activates its dynamic environment generator to generate a highly realistic mimicry simulation scene in real time for the attack source.

[0164] A15. Through a dynamic traffic scheduling engine, based on a spatiotemporal randomness algorithm, the proportion of highly realistic decoy traffic delivered to the attack source is dynamically increased, and its access requests are routed to the trapping scenario, forming a behavioral and traffic black hole to confuse, delay, and record attack behavior.

[0165] Furthermore, the deep threat analysis and network-layer intelligent hunting in S2 includes steps A21-A23: A21, the network layer intelligent threat hunting module utilizes its NLP semantic analysis engine to extract features and understand the semantics of unstructured information in network traffic and log data.

[0166] A22. By leveraging predictive AI models enhanced with adversarial generative network training mechanisms, deep detection of known and unknown attack patterns is performed to identify potential advanced persistent threats (APTs).

[0167] A23. When a suspicious attack sequence or abnormal behavior is detected, the attack chain reconstruction unit is activated. Based on the output of DPI and NLP, it uses graph computing technology to automatically associate discrete attack events, construct and visualize the complete attack kill chain from the initial intrusion and lateral movement to the target achievement.

[0168] Furthermore, the host layer anomaly detection and endogenous immune response in S3 include steps A31-A33: A31, the behavior analyzer of the host-layer intrinsic security immunity module, uses unsupervised learning algorithms to continuously monitor process behavior and system call sequences, dynamically learn and maintain the baseline of normal application behavior.

[0169] A32. When abnormal behavior deviating from the baseline is detected, the adaptive closed-loop handling unit immediately initiates preset response measures according to the dynamic strategy matrix, including but not limited to process termination, file isolation, and network connection disconnection.

[0170] A33. The trusted and secure kernel ensures that during system startup and operation, it performs step-by-step measurements based on domestic cryptographic algorithms and TCM / TPM hardware root of trust, builds and maintains a dynamic trust chain from hardware to operating system kernel, and guarantees the integrity of core components.

[0171] like Figure 6 As shown, further, the unified scheduling and cross-layer collaborative response in S4 specifically includes steps A41-A43: A41. The unified scheduling and quantitative evaluation center aggregates security events, behavior logs, and performance indicators from the application layer, network layer, and host layer in real time through a high-speed data bus.

[0172] A42. The VPT quantitative assessment model within the center performs integrated analysis on the aggregated data. The model inputs include key performance indicators such as attack detection rate, response time, and false alarm rate, as well as asset information, vulnerability data, and real-time threat intelligence. The output is the dynamic risk value and risk priority ranking for different security zones or business systems.

[0173] A43. Based on risk priority, the center automatically generates and distributes optimized collaborative protection strategies to each layer module: for example, instructing the application layer to adjust the decoy strategy, guiding the network layer to update the detection model parameters, and commanding the host layer to adjust the severity of the handling actions.

[0174] Furthermore, the quantitative evaluation and active closed-loop optimization in S4 specifically include A44-A47: A44. The unified scheduling and quantitative evaluation center continuously calculates the overall dynamic security performance score of the system and compares it with the preset security performance threshold.

[0175] A45. When the security performance score remains below the threshold, the center automatically triggers the advanced persistent threat simulation and defense exercise subsystem.

[0176] Reference Figure 5 Flowchart for the Advanced Persistent Threat Simulation and Defense Exercise Subsystem.

[0177] A46. This subsystem simulates a complete APT attack chain in an isolated environment based on a pre-set advanced attack script that includes unknown threat methods, and performs stress tests on the existing protection system.

[0178] A47. The results of the exercise are fed back to the VPT technology system to optimize the quantitative evaluation model and drive the application layer, network layer, and host layer modules to dynamically adjust their protection strategies, detection thresholds, and response mechanisms, forming a complete "measurement-evaluation-testing-optimization" endogenous security closed loop, and realizing continuous adaptive enhancement of the system's protection capabilities.

[0179] This embodiment also provides an electronic device applicable to a cyberspace intrinsic security protection system based on mimicry defense, comprising: a memory and a processor; the memory is used to store computer-executable instructions, and the processor is used to execute the computer-executable instructions to realize a cyberspace intrinsic security protection system based on mimicry defense as proposed in the above embodiment.

[0180] This embodiment also provides a storage medium on which a computer program is stored. When the program is executed by a processor, it implements a cyberspace intrinsic security protection system based on mimicry defense as proposed in the above embodiments.

[0181] The storage medium proposed in this embodiment belongs to the same inventive concept as the network space intrinsic security protection system based on mimicry defense proposed in the above embodiments. Technical details not described in detail in this embodiment can be found in the above embodiments, and this embodiment has the same beneficial effects as the above embodiments.

[0182] Based on the above description of the implementation methods, those skilled in the art can clearly understand that the present invention can be implemented using software and necessary general-purpose hardware, and of course, it can also be implemented using hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as a computer floppy disk, read-only memory (ROM), random access memory (RAM), flash memory, hard disk, or optical disk, etc., including several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods of the various embodiments of the present invention.

[0183] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and not to limit it. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical solutions of the present invention without departing from the spirit and scope of the technical solutions of the present invention, and all such modifications or substitutions should be covered within the scope of the claims of the present invention.

Claims

1. A cyberspace intrinsic security protection system based on mimicry defense, characterized in that: include, Application layer mimicry and camouflage module, network layer intelligent threat hunting module, host layer intrinsic security immunity module, and advanced persistent threat simulation and defense exercise module; The application-layer mimicry module is deployed at the front end of the business system; The network layer intelligent threat hunting module integrates a deep packet inspection engine, a natural language processing semantic analysis engine, and a predictive AI model based on the high-wattage model system. The predictive AI model in the network layer intelligent threat hunting module adopts a training mechanism based on adversarial generative networks, which is trained by mixing simulated advanced attack traffic with real network traffic. The network layer intelligent threat hunting module also includes an attack chain reconstruction unit, which can automatically associate discrete security events based on the output of the fused deep packet inspection engine and natural language processing semantic analysis engine, and use graph computing technology to construct and visualize the complete attack kill chain. The host-layer intrinsic security immunity module is embedded in the operating system kernel layer or tightly coupled to critical business processes. The advanced persistent threat simulation and defense exercise module is connected to the unified scheduling and quantitative evaluation center in the host layer intrinsic security immunity module.

2. The cyberspace intrinsic security protection system based on mimicry defense as described in claim 1, characterized in that: The application-layer mimicry module includes, The dynamic traffic scheduling engine is used to dynamically mix and randomly route real business traffic with highly realistic decoy traffic, forming a black hole targeting the attacker's behavior and traffic. The behavior simulation trapping unit has built-in a variety of adaptive mimicry simulation scenarios that are highly realistic in simulating real business logic. It is used to deeply trap attackers throughout the entire chain and record their attack behavior. The real-time task compiler, based on instructions from the unified scheduling and quantitative evaluation center, compiles and loads tiny defense code snippets into the application runtime environment in real time.

3. The cyberspace intrinsic security protection system based on mimicry defense as described in claim 2, characterized in that: The host-layer intrinsic security immunity module includes, A trusted security kernel ensures the integrity of the core components of the protection system by constructing a minimized trusted computing base. The behavior analyzer, based on statistical methods and machine learning algorithms, monitors process behavior, system calls, and resource access sequences in real time, dynamically learns and establishes a baseline of normal application behavior; An adaptive closed-loop processing unit can respond instantly according to a preset strategy when it detects abnormal behavior that deviates from the baseline. The unified scheduling and quantitative evaluation center enables real-time data interaction and strategy linkage through a high-speed data bus. The Advanced Persistent Threat (APPT) simulation and defense exercise module simulates the behavior of each stage of an APPT attack chain in an isolated test environment according to a preset attack script. This is used to continuously verify and train the collaborative defense and unknown threat immunity effectiveness of the application layer, network layer, and host layer modules, and to feed the exercise results back to the VPT technology system for optimizing the quantitative evaluation model.

4. The cyberspace intrinsic security protection system based on mimicry defense as described in claim 3, characterized in that: The dynamic traffic scheduling engine in the application layer mimicry module has a scheduling strategy based on a spatiotemporal randomness algorithm. The behavior simulation trapping unit also includes a dynamic environment generator, which can generate and deploy targeted mimicry simulation scenarios in real time based on the attacker's IP reputation and behavior pattern profile output by the network layer intelligent threat hunting module. The defense code snippet compiled by the real-time task compiler is a RASP self-protection script, which is used to implement real-time interception and behavior obfuscation of specific attack sequences in the application runtime environment.

5. A cyberspace intrinsic security protection system based on mimicry defense as described in claim 4, characterized in that: The behavior analyzer in the host layer intrinsic security immune module uses the isolated forest model in the unsupervised learning algorithm to detect abnormal processes that deviate from the normal application behavior baseline. The preset strategies of the adaptive closed-loop handling unit constitute a dynamic strategy matrix. The strategy items and the degree of handling actions in the dynamic strategy matrix are dynamically learned and adjusted by the unified scheduling and quantitative assessment center based on the global threat situation.

6. The cyberspace intrinsic security protection system based on mimicry defense as described in claim 4, characterized in that: The trusted security kernel in the host layer intrinsic security immune module performs step-by-step measurement and verification based on cryptographic algorithms and the TCM / TPM hardware root of trust during startup.

7. The cyberspace intrinsic security protection system based on mimicry defense as described in claim 4, characterized in that: The VPT technology system integrated by the unified scheduling and quantitative assessment center is implemented through a quantitative assessment model. The input of the quantitative assessment model is a set of key performance indicators, asset information, vulnerability data and real-time threat intelligence, and the output is a dynamic risk value and risk priority ranking for different security zones or business systems. The unified scheduling and quantitative assessment center automatically generates and distributes optimized protection strategies to the application layer, network layer, and host layer modules based on the risk priority.

8. A method for intrinsic cybersecurity protection based on mimicry defense, employing an intrinsic cybersecurity protection system based on mimicry defense as described in any one of claims 1 to 7, characterized in that, include: The network layer intelligent threat hunting module senses and extracts the attack characteristics of the initial attack behavior in real time and reports them to the unified scheduling and quantitative evaluation center. The unified scheduling and quantitative evaluation center generates instructions and sends them to the application layer mimicry and camouflage module. The application layer mimicry and camouflage module starts the dynamic environment generator to generate a mimicry simulation scenario for the attack source, and increases the decoy traffic delivery ratio through the dynamic traffic scheduling engine to route the attack source access to the trap scenario to confuse, delay and record the attack behavior. The network layer intelligent threat hunting module uses a natural language processing semantic analysis engine to extract and understand the features of unstructured information, employs a predictive AI model to deeply detect attack patterns to identify potential advanced persistent threats, and initiates an attack chain reconstruction unit when a suspicious sequence is detected. Based on the output of the deep packet inspection engine and the natural language processing semantic analysis engine, it uses graph computing technology to associate discrete events, construct and visualize the complete attack kill chain. The behavior analyzer of the host-layer intrinsic security immune module continuously monitors and maintains the normal behavior baseline using an unsupervised learning algorithm. The unified scheduling and quantitative assessment center aggregates data from all layers, analyzes and outputs dynamic risk values ​​and priority rankings through quantitative assessment models, and automatically generates and distributes optimized collaborative protection strategies to modules at all layers. The unified scheduling and quantitative assessment center continuously calculates the security performance score. When the score falls below the threshold, it automatically triggers the advanced persistent threat simulation and defense exercise module to conduct stress tests, and the exercise results are fed back to the VPT technology system.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the cyberspace intrinsic security protection system based on mimicry defense as described in any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the steps of the cyberspace intrinsic security protection system based on mimicry defense as described in any one of claims 1 to 7.

Images