Active defense strategy generation method, device, electronic device and storage medium

Abstract

The present invention provides an active defense strategy generation method, device, electronic device and storage medium, the method comprising: obtaining network device parameter information of a honeypot strategy network to be deployed, wherein the honeypot strategy network to be deployed is a distributed network; inputting the network device parameter information into a pre-trained local honeypot deployment strategy generation model, obtaining target strategy parameters of a target honeypot defense strategy that matches the honeypot strategy network to be deployed and output by the local honeypot deployment strategy generation model, wherein the local honeypot deployment strategy generation model is dynamically updated based on the network device parameter information and the target strategy parameters; generating a target honeypot defense strategy based on the target strategy parameters, and performing active defense strategy deployment for the honeypot strategy network to be deployed based on the target honeypot defense strategy. The method realizes the ability to improve the security defense capability of the honeypot strategy network to be deployed, and provides a more effective solution for network security.

Description

Technical Field

[0001] The present invention relates to the field of computer network security technology, and in particular to an active defense strategy generation method, device, electronic equipment and storage medium. Background Art

[0002] It is known from relevant technologies that in a distributed network scenario, the network threats faced by each network are complex, different and dynamic. Currently, passive defense measures such as firewalls are often used for network security protection, which results in the distributed network being unable to cope well with complex attack threats in the real network environment.

[0003] Therefore, finding a defense strategy generation method that can improve the network's security defense capabilities has become a current research hotspot. Summary of the invention

[0004] The present invention provides a method, device, electronic device and storage medium for generating an active defense strategy, which can improve the security defense capability of a network and provide a more effective solution for network security.

[0005] The present invention provides an active defense strategy generation method, the method comprising: obtaining network device parameter information of a honeypot strategy network to be deployed, wherein the honeypot strategy network to be deployed is a distributed network; inputting the network device parameter information into a pre-trained local honeypot deployment strategy generation model to obtain target strategy parameters of a target honeypot defense strategy that matches the honeypot strategy network to be deployed and output by the local honeypot deployment strategy generation model, wherein the local honeypot deployment strategy generation model is dynamically updated based on the network device parameter information and the target strategy parameters; generating the target honeypot defense strategy based on the target strategy parameters, and performing active defense strategy deployment for the honeypot strategy network to be deployed based on the target honeypot defense strategy.

[0006] According to an active defense strategy generation method provided by the present invention, after the active defense strategy is deployed for the honeypot strategy network to be deployed based on the target honeypot defense strategy, the method further includes: when the target honeypot defense strategy is deployed in the honeypot strategy network to be deployed, obtaining the asset equipment, honeypot log, and security threat alarm information of the honeypot strategy network to be deployed; based on the asset equipment, the honeypot log, and the security threat alarm information, restoring the security threat attack path, and based on the security threat attack path, obtaining attack intelligence; based on the attack intelligence, generating an attack intelligence map corresponding to the attack intelligence, wherein the attack intelligence map is used to display the security threat attack situation of the honeypot strategy network to be deployed.

[0007] According to an active defense strategy generation method provided by the present invention, after generating an attack intelligence map corresponding to the attack intelligence, the method further includes: regularly obtaining each of the attack intelligence maps corresponding to each of the honeypot strategy networks to be deployed; aggregating each of the attack intelligence maps to obtain a global attack intelligence map; and updating each of the attack intelligence maps based on the global attack intelligence map.

[0008] According to an active defense strategy generation method provided by the present invention, after generating the target honeypot defense strategy based on the target strategy parameters, the method further includes: obtaining device change information of the honeypot strategy network to be deployed, and security threat alarm information; inputting the device change information, the security threat alarm information, and the target honeypot defense strategy into a pre-trained local honeypot deployment strategy dynamic transformation model to obtain target change strategy parameters of the changed target honeypot defense strategy output by the local honeypot deployment strategy dynamic transformation model, wherein the changed target honeypot defense strategy matches the honeypot strategy network to be deployed in which the device change occurs; and using the target change strategy parameters as the target strategy parameters.

[0009] According to an active defense strategy generation method provided by the present invention, the local honeypot deployment strategy generation model is updated in the following manner: based on federated learning, first model parameters of each local honeypot deployment strategy generation model corresponding to each honeypot strategy network to be deployed are regularly obtained; each first model parameter is aggregated to obtain a first aggregated model parameter; based on the first aggregated model parameter, the local honeypot deployment strategy generation model is updated to obtain a global honeypot deployment strategy generation model, and the global honeypot deployment strategy generation model is used as the final local honeypot deployment strategy generation model.

[0010] According to an active defense strategy generation method provided by the present invention, the local honeypot deployment strategy dynamic transformation model is updated in the following manner: based on federated learning, the second model parameters of each local honeypot deployment strategy dynamic transformation model corresponding to each honeypot strategy network to be deployed are regularly obtained; each second model parameter is aggregated to obtain a second aggregated model parameter; based on the second aggregated model parameter, the local honeypot deployment strategy dynamic transformation model is updated to obtain a global honeypot deployment strategy dynamic transformation model, and the global honeypot deployment strategy dynamic transformation model is used as the final local honeypot deployment strategy dynamic transformation model.

[0011] The present invention also provides an active defense strategy generation device, which includes: an acquisition module, used to obtain network device parameter information of a honeypot strategy network to be deployed, wherein the honeypot strategy network to be deployed is a distributed network; a processing module, used to input the network device parameter information into a pre-trained local honeypot deployment strategy generation model, and obtain the target strategy parameters of the target honeypot defense strategy that matches the honeypot strategy network to be deployed and output by the local honeypot deployment strategy generation model, wherein the local honeypot deployment strategy generation model is dynamically updated based on the network device parameter information and the target strategy parameters; a deployment module, used to generate the target honeypot defense strategy based on the target strategy parameters, and perform active defense strategy deployment for the honeypot strategy network to be deployed based on the target honeypot defense strategy.

[0012] The present invention also provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the active defense strategy generation method described in any one of the above methods is implemented.

[0013] The present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, and when the computer program is executed by a processor, the active defense strategy generation method as described in any one of the above is implemented.

[0014] The present invention also provides a computer program product, comprising a computer program, wherein when the computer program is executed by a processor, the active defense strategy generation method as described above is implemented.

[0015] The present invention provides an active defense strategy generation method, device, electronic device and storage medium, which obtain network device parameter information of a honeypot strategy network to be deployed; input the network device parameter information into a pre-trained local honeypot deployment strategy generation model, obtain the target strategy parameters of a target honeypot defense strategy that matches the honeypot strategy network to be deployed output by the local honeypot deployment strategy generation model; generate a target honeypot defense strategy based on the target strategy parameters, and perform active defense strategy deployment for the honeypot strategy network to be deployed based on the target honeypot defense strategy. The method can improve the security defense capability of the honeypot strategy network to be deployed, and provide a more effective solution for network security. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] In order to more clearly illustrate the technical solutions in the present invention or the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0017] Figure 1 This is one of the flow charts of the active defense strategy generation method provided by the present invention.

[0018] Figure 2 This is the second flow chart of the active defense strategy generation method provided by the present invention.

[0019] Figure 3 This is the third flow chart of the active defense strategy generation method provided by the present invention.

[0020] Figure 4 This is the fourth flow chart of the active defense strategy generation method provided by the present invention.

[0021] Figure 5 It is a flow chart of updating the local honeypot deployment strategy generation model provided by the present invention.

[0022] Figure 6 It is a flow chart of the dynamic transformation model for updating the local honeypot deployment strategy provided by the present invention.

[0023] Figure 7 It is a model schematic diagram of an active defense enhancement system based on federated learning in a distributed network scenario provided by the present invention.

[0024] Figure 8 It is a structural schematic diagram of the active defense strategy generation device provided by the present invention.

[0025] Fig. 9 It is a structural schematic diagram of the electronic device provided by the present invention. DETAILED DESCRIPTION

[0026] In order to make the purpose, technical solution and advantages of the present invention clearer, the technical solution of the present invention will be clearly and completely described below in conjunction with the drawings of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0027] The active defense strategy generation method provided by the present invention and the active defense enhancement method based on federated learning in a distributed scenario greatly improve the defense capability of honeypot technology by sharing honeypot deployment strategy and dynamic transformation strategy, and provide a more effective solution for network security.

[0028] Figure 1 This is one of the flow charts of the active defense strategy generation method provided by the present invention.

[0029] The following will be combined Figure 1The process of the active defense strategy generation method provided by the present invention is described.

[0030] In an exemplary embodiment of the present invention, Figure 1 It can be seen that the active defense strategy generation method may include steps 110 to 130, and each step will be introduced below.

[0031] In step 110, network device parameter information of the honeypot policy network to be deployed is obtained.

[0032] In one embodiment, the honeypot policy network to be deployed may be a distributed network. During the application process, network device parameter information of the honeypot policy network to be deployed may be obtained, wherein the network device parameter information may include quantity information, service configuration information, operating system information, etc. of the honeypot policy network to be deployed.

[0033] In step 120, the network device parameter information is input into the pre-trained local honeypot deployment strategy generation model to obtain the target strategy parameters of the target honeypot defense strategy output by the local honeypot deployment strategy generation model and matching the honeypot strategy network to be deployed.

[0034] In step 130, a target honeypot defense strategy is generated based on the target strategy parameters, and active defense strategy deployment is performed for the honeypot strategy network to be deployed based on the target honeypot defense strategy.

[0035] In one embodiment, the network device parameter information can be input into the pre-trained local honeypot deployment strategy generation model, so as to obtain the target strategy parameters of the target honeypot defense strategy that matches the honeypot strategy network to be deployed and output by the local honeypot deployment strategy generation model. The local honeypot deployment strategy generation model can be obtained based on deep reinforcement learning training, and the local honeypot deployment strategy generation model can be dynamically updated based on the network device parameter information and the target strategy parameters.

[0036] In another embodiment, a target honeypot defense strategy can be generated according to the target strategy parameters, and active defense strategy deployment can be performed for the honeypot strategy network to be deployed based on the target honeypot defense strategy. This embodiment realizes active defense deployment for the honeypot strategy network to be deployed, improves the security defense capability of the honeypot strategy network to be deployed, and provides a more effective solution for network security.

[0037] Figure 2 This is the second flow chart of the active defense strategy generation method provided by the present invention.

[0038] The following will be combined Figure 2 The process of another active defense strategy generation method provided by the present invention is described.

[0039] In an exemplary embodiment of the present invention, Figure 2 It can be seen that after the active defense strategy is deployed for the honeypot strategy network to be deployed based on the target honeypot defense strategy, the active defense strategy generation method can also include the following steps 210 to 230, each of which will be introduced below.

[0040] In step 210, when the target honeypot defense strategy is deployed in the honeypot strategy network to be deployed, the asset equipment, honeypot logs, and security threat alarm information of the honeypot strategy network to be deployed are obtained.

[0041] In step 220, based on the asset equipment, honeypot logs, and security threat alarm information, the security threat attack path is restored, and based on the security threat attack path, attack intelligence is obtained.

[0042] In step 230, based on the attack intelligence, an attack intelligence graph corresponding to the attack intelligence is generated.

[0043] In one embodiment, threat intelligence extraction and analysis can be performed when the honeypot strategy network to be deployed has a target honeypot defense strategy deployed, that is, the asset equipment, honeypot logs, and security threat alarm information of the honeypot strategy network to be deployed are obtained. Further, based on the asset equipment, honeypot logs, and security threat alarm information, combined with open source threat intelligence, expert experience, and ATT&CK model, the log and alarm information are sorted and analyzed to obtain analysis results, and based on the analysis results, the security threat attack path is restored.

[0044] Furthermore, based on the security threat attack path, through expert experience, automated feature recognition models and other methods, intelligence information such as attack methods and tools is extracted from the logs and other data of the corresponding equipment to obtain attack intelligence.

[0045] In another embodiment, an attack intelligence map corresponding to the attack intelligence may be generated based on the attack intelligence, wherein the attack intelligence map is used to display the security threat attack situation of the honeypot strategy network to be deployed, so that the user can easily obtain the security threat attack situation of the honeypot strategy network to be deployed.

[0046] Figure 3 This is the third flow chart of the active defense strategy generation method provided by the present invention.

[0047] The following will be combined Figure 3 The process of another active defense strategy generation method of the present invention is described.

[0048] In an exemplary embodiment of the present invention, Figure 3It can be seen that after generating the attack intelligence graph corresponding to the attack intelligence, the active defense strategy generation method can also include step 310 to step 330, and each step will be introduced below.

[0049] In step 310, each attack intelligence map corresponding to each honeypot policy network to be deployed is obtained regularly.

[0050] In step 320, the attack intelligence graphs are aggregated to obtain a global attack intelligence graph.

[0051] In step 330, each attack intelligence map is updated based on the global attack intelligence map.

[0052] In one embodiment, since the honeypot policy network to be deployed is a distributed network, each attack intelligence map corresponding to each honeypot policy network to be deployed can also be obtained regularly. Then, each attack intelligence map is aggregated to obtain a global attack intelligence map, wherein the global attack intelligence map is formed by comprehensively considering the attack intelligence maps of each distributed network (honeypot policy network to be deployed), and can achieve a global view of the attack situation of the entire distributed network. Furthermore, each attack intelligence map can be updated based on the global attack intelligence map, so as to ensure that in the process of safely protecting each honeypot policy network to be deployed, the attack intelligence map can be obtained from a global perspective.

[0053] Figure 4 This is the fourth flow chart of the active defense strategy generation method provided by the present invention.

[0054] The following will be combined Figure 4 The process of another active defense strategy generation method is described.

[0055] In an exemplary embodiment of the present invention, Figure 4 It can be seen that after the target honeypot defense strategy is generated based on the target strategy parameters, the active defense strategy generation method further includes steps 410 to 430, and each step will be introduced below.

[0056] In step 410, device change information of the honeypot policy network to be deployed and security threat alarm information are obtained.

[0057] In step 420, the device change information, security threat alarm information, and target honeypot defense strategy are input into the pre-trained local honeypot deployment strategy dynamic transformation model to obtain the target change strategy parameters of the changed target honeypot defense strategy output by the local honeypot deployment strategy dynamic transformation model.

[0058] In step 430, the target change policy parameter is used as the target policy parameter.

[0059] In one embodiment, the device change information and security threat alarm information of the honeypot policy network to be deployed can also be obtained. The device change information, security threat alarm information, and target honeypot defense strategy are then input into the pre-trained local honeypot deployment strategy dynamic transformation model, so that the target change strategy parameters of the changed target honeypot defense strategy output by the local honeypot deployment strategy dynamic transformation model can be obtained. Among them, the changed target honeypot defense strategy matches the honeypot policy network to be deployed where the device change occurs.

[0060] Furthermore, the target change strategy parameters are used as target strategy parameters, so that the target honeypot defense strategy can be generated based on the target strategy parameters, and the active defense strategy deployment can be performed for the honeypot strategy network to be deployed based on the target honeypot defense strategy. Through this embodiment, the honeypot system can flexibly respond to changing attack methods in a distributed environment. Federated learning allows each node to share the transformation strategy, and through real-time updating and optimization, ensures that the honeypot system is always in the best defense state. It not only improves the deception effect of the honeypot, but also effectively prevents attackers from evading by identifying honeypot features.

[0061] Figure 5 It is a flow chart of updating the local honeypot deployment strategy generation model provided by the present invention.

[0062] The following will be combined Figure 5 The process of updating the local honeypot deployment strategy generation model is described.

[0063] In an exemplary embodiment of the present invention, Figure 5 It can be seen that updating the local honeypot deployment strategy generation model may include steps 510 to 530, and each step will be introduced below.

[0064] In step 510, first model parameters of local honeypot deployment strategy generation models corresponding to honeypot strategy networks to be deployed are periodically obtained based on federated learning.

[0065] In step 520, the first model parameters are aggregated to obtain first aggregated model parameters.

[0066] In step 530, based on the first aggregated model parameters, the local honeypot deployment strategy generation model is updated to obtain a global honeypot deployment strategy generation model, and the global honeypot deployment strategy generation model is used as the final local honeypot deployment strategy generation model.

[0067] In one embodiment, in a distributed network center, a federated learning framework is used to obtain the honeypot deployment strategy generation model parameters (corresponding to the first model parameters of each local honeypot deployment strategy generation model) of each distributed network (corresponding to the honeypot strategy network to be deployed) at fixed time intervals. After the model parameters are aggregated by classic parameter aggregation algorithms such as FedAVG, the first aggregated model parameters are obtained. Furthermore, based on the first aggregated model parameters, the local honeypot deployment strategy generation model is updated to obtain a global honeypot deployment strategy generation model, and the global honeypot deployment strategy generation model is used as the final local honeypot deployment strategy generation model. Through this embodiment, the rationality of the final local honeypot deployment strategy generation model can be ensured globally.

[0068] Figure 6 It is a flow chart of the dynamic transformation model for updating the local honeypot deployment strategy provided by the present invention.

[0069] The following will be combined Figure 6 The process of updating the dynamic transformation model of the local honeypot deployment strategy is explained.

[0070] In an exemplary embodiment of the present invention, Figure 6 It can be seen that updating the local honeypot deployment strategy dynamic transformation model may include steps 610 to 630, and each step will be introduced below.

[0071] In step 610, based on federated learning, second model parameters of each local honeypot deployment strategy dynamic transformation model corresponding to each honeypot strategy network to be deployed are periodically obtained.

[0072] In step 620, the second model parameters are aggregated to obtain second aggregated model parameters.

[0073] In step 630, based on the second aggregated model parameters, the local honeypot deployment strategy dynamic transformation model is updated to obtain a global honeypot deployment strategy dynamic transformation model, and the global honeypot deployment strategy dynamic transformation model is used as the final local honeypot deployment strategy dynamic transformation model.

[0074] In one embodiment, in a distributed network center, a federated learning framework is used to obtain the honeypot deployment strategy dynamic transformation model parameters (corresponding to each second model parameter of the local honeypot deployment strategy dynamic transformation model) of each distributed network (corresponding to the honeypot strategy network to be deployed) at fixed time intervals. After the model parameters are aggregated by a classic parameter aggregation algorithm such as FedAVG, the second aggregated model parameters are obtained. Furthermore, based on the second aggregated model parameters, the local honeypot deployment strategy dynamic transformation model is updated to obtain a global honeypot deployment strategy dynamic transformation model, and the global honeypot deployment strategy dynamic transformation model is used as the final local honeypot deployment strategy dynamic transformation model. Through this embodiment, the rationality of the final local honeypot deployment strategy dynamic transformation model can be ensured globally.

[0075] Through the above-mentioned embodiments, multiple distributed networks are allowed to jointly train models (including local honeypot deployment strategy dynamic transformation models and local honeypot deployment strategy generation models) without sharing original data, thereby improving the overall defense effect while protecting privacy. This method provides a new idea and solution for network security by sharing honeypot deployment strategies and dynamic transformation strategies in distributed scenarios, and combining the construction and global aggregation of attack intelligence maps.

[0076] Figure 7 It is a model schematic diagram of an active defense enhancement system based on federated learning in a distributed network scenario provided by the present invention.

[0077] In order to further introduce the active defense strategy generation method provided by the present invention, Figure 7 Provide explanation.

[0078] In an exemplary embodiment of the present invention, Figure 7 It can be seen that in the distributed network scenario, each target network (corresponding to Figure 7 Network 1, Network 2, and Network N in the figure can achieve more effective defense strategy generation and a wider range of attack intelligence acquisition through model parameter and attack intelligence graph aggregation.

[0079] During the application process, for each honeypot policy network to be deployed, network 1 is taken as an example. Inside the distributed network (network 1), the deception defense module in network 1 adopts a deep reinforcement learning method, with the number of key devices, service configuration, operating system and other information in the target network as input, and the number, type, configuration and other information of the honeypots to be deployed as output, and the target policy parameters of the target honeypot defense policy that matches the honeypot policy network to be deployed (corresponding to network 1), and then generates the target honeypot defense policy based on the target policy parameters, and sends the target honeypot defense policy to the dynamic transformation module in network 1.

[0080] In another embodiment, the intelligence collection and analysis module in network 1 collects log files and alarm information from the assets and honeypot devices of the target network (corresponding to network 1) and analyzes them. The specific steps are as follows:

[0081] The intelligence collection and analysis module collects logs and alarm information from asset devices and honeypots in the target network;

[0082] Combining open source threat intelligence, expert experience and the ATT&CK model, the log and alarm information is sorted and analyzed to obtain analysis results.

[0083] Furthermore, the intelligence collection and analysis module can restore the attack path based on the analysis results and extract attack intelligence. The intelligence collection and analysis module can restore the attack path based on the analysis results and information such as the location of the alarm device. Combined with the attack path, through expert experience, automated feature recognition models and other methods, intelligence information such as attack methods and tools can be extracted from the logs and other data of the corresponding device.

[0084] In another embodiment, the intelligence collection and analysis module can integrate and sort out the attack path and attack intelligence, extract key attack fields such as attack IP, attacker location, attack frequency, attack time, attack duration, request content, attack target, attack method, etc., and combine the attack fields in the form of triples, and import them into graph construction tools such as Neo4j to form an attack intelligence graph.

[0085] In another embodiment, the dynamic transformation module in network 1 adopts a deep reinforcement learning method, with the honeypot deployment strategy from the deception defense module, the change of key equipment in the target network and the alarm status as input, and the number, type, configuration and other information of the changed honeypots as output, to form the deployment strategy of the transformed honeypot (corresponding to the changed target honeypot defense strategy mentioned above), and send it to the deception defense module for honeypot deployment.

[0086] In another embodiment, a strategy sharing module is established in the distributed network center (including network 1 to network N), and a federated learning framework is used to obtain the honeypot deployment strategy generation model parameters of each distributed network at fixed time intervals. After the model parameters are aggregated by using classic parameter aggregation algorithms such as FedAVG, the global honeypot deployment strategy generation model parameters (corresponding to the first aggregated model parameters) are obtained, and the global honeypot deployment strategy generation model parameters are sent again to the deception defense modules of each distributed network to update the parameters of the local honeypot deployment strategy generation model of each distributed network.

[0087] In another embodiment, in the distributed network center (including network 1 to network N), the strategy sharing module adopts a federated learning framework to obtain the dynamic transformation model parameters of the honeypot deployment strategy of each distributed network at fixed time intervals, and obtains the global honeypot deployment strategy dynamic transformation model parameters (corresponding to the second aggregated model parameters) after aggregating the model parameters using classic parameter aggregation algorithms such as FedAVG. The global honeypot deployment strategy dynamic transformation model parameters are then sent down again to the deception defense modules of each distributed network to update the parameters of the local honeypot deployment strategy dynamic transformation model of each distributed network.

[0088] In another embodiment, an intelligence collection module is set up in the distributed network center to obtain the attack intelligence map of each distributed network at fixed time intervals. After the map is aggregated, the global attack intelligence map is sent to each distributed network again to update the local attack intelligence map.

[0089] The active defense strategy generation method provided by the present invention takes the honeypot as the core and shares and optimizes the honeypot deployment strategy in a distributed environment through federated learning. This strategy generation process combines the attack data and defense experience of different nodes, thereby generating a more reasonable and effective honeypot deployment plan on a global scale, effectively improving the honeypot's trapping ability and defense effect. The present invention also introduces a dynamic transformation strategy, so that the honeypot system can flexibly respond to changing attack methods. Under the framework of federated learning, each node can share and update the transformation strategy in real time to ensure that the honeypot system is always in the best defense state. This not only improves the deception effect of the honeypot, but also effectively prevents attackers from evading by identifying honeypot features.

[0090] According to the foregoing description, the present invention provides an active defense strategy generation method, which obtains network device parameter information of a honeypot strategy network to be deployed; inputs the network device parameter information into a pre-trained local honeypot deployment strategy generation model, obtains target strategy parameters of a target honeypot defense strategy output by the local honeypot deployment strategy generation model that matches the honeypot strategy network to be deployed; generates a target honeypot defense strategy based on the target strategy parameters, and performs active defense strategy deployment for the honeypot strategy network to be deployed based on the target honeypot defense strategy. This method can improve the security defense capability of the honeypot strategy network to be deployed, and provides a more effective solution for network security.

[0091] The active defense strategy generation device provided by the present invention is described below. The active defense strategy generation device described below and the active defense strategy generation method described above can be referenced to each other.

[0092] Figure 8 It is a structural schematic diagram of the active defense strategy generation device provided by the present invention.

[0093] The following will be combined Figure 8 The active defense strategy generating device provided by the present invention is described.

[0094] In an exemplary embodiment of the present invention, Figure 8 It can be seen that the active defense strategy generation device may include an acquisition module 810, a processing module 820, and a deployment module 830, and each module will be introduced below.

[0095] The acquisition module 810 may be configured to acquire network device parameter information of a honeypot policy network to be deployed, wherein the honeypot policy network to be deployed is a distributed network;

[0096] The processing module 820 may be configured to input the network device parameter information into a pre-trained local honeypot deployment strategy generation model, and obtain the target strategy parameters of the target honeypot defense strategy that matches the honeypot strategy network to be deployed and output by the local honeypot deployment strategy generation model, wherein the local honeypot deployment strategy generation model is dynamically updated based on the network device parameter information and the target strategy parameters;

[0097] The deployment module 830 may be configured to generate the target honeypot defense strategy based on the target strategy parameters, and perform active defense strategy deployment for the honeypot strategy network to be deployed based on the target honeypot defense strategy.

[0098] In an exemplary embodiment of the present invention, the deployment module 830 may also be configured to:

[0099] When the target honeypot defense strategy is deployed in the honeypot strategy network to be deployed, obtaining asset equipment, honeypot logs, and security threat alarm information of the honeypot strategy network to be deployed;

[0100] Based on the asset device, the honeypot log, and the security threat warning information, restore the security threat attack path, and obtain attack intelligence based on the security threat attack path;

[0101] Based on the attack intelligence, an attack intelligence map corresponding to the attack intelligence is generated, wherein the attack intelligence map is used to display the security threat attack situation of the honeypot strategy network to be deployed.

[0102] In an exemplary embodiment of the present invention, the deployment module 830 may also be configured to:

[0103] Regularly obtain the attack intelligence maps corresponding to the honeypot strategy networks to be deployed;

[0104] Aggregating the attack intelligence graphs to obtain a global attack intelligence graph;

[0105] Based on the global attack intelligence map, each of the attack intelligence maps is updated.

[0106] In an exemplary embodiment of the present invention, the deployment module 830 may also be configured to:

[0107] Obtaining device change information of the honeypot strategy network to be deployed, as well as security threat warning information;

[0108] Input the device change information, the security threat alarm information, and the target honeypot defense strategy into a pre-trained local honeypot deployment strategy dynamic transformation model to obtain a target change strategy parameter of the changed target honeypot defense strategy output by the local honeypot deployment strategy dynamic transformation model, wherein the changed target honeypot defense strategy matches the honeypot strategy network to be deployed where the device change occurs;

[0109] The target change strategy parameter is used as the target strategy parameter.

[0110] In an exemplary embodiment of the present invention, the deployment module 830 implements updating the local honeypot deployment strategy generation model in the following manner:

[0111] Based on federated learning, regularly obtain first model parameters of each local honeypot deployment strategy generation model corresponding to each of the honeypot strategy networks to be deployed;

[0112] Aggregate the first model parameters to obtain first aggregated model parameters;

[0113] Based on the first aggregated model parameters, the local honeypot deployment strategy generation model is updated to obtain a global honeypot deployment strategy generation model, and the global honeypot deployment strategy generation model is used as the final local honeypot deployment strategy generation model.

[0114] In an exemplary embodiment of the present invention, the deployment module 830 implements the dynamic transformation model of updating the local honeypot deployment strategy in the following manner:

[0115] Based on federated learning, regularly obtain each second model parameter of each local honeypot deployment strategy dynamic transformation model corresponding to each honeypot strategy network to be deployed;

[0116] Aggregate each of the second model parameters to obtain second aggregated model parameters;

[0117] Based on the second aggregated model parameters, the local honeypot deployment strategy dynamic transformation model is updated to obtain a global honeypot deployment strategy dynamic transformation model, and the global honeypot deployment strategy dynamic transformation model is used as the final local honeypot deployment strategy dynamic transformation model.

[0118] Fig. 9 An example of a physical structure diagram of an electronic device is shown in FIG. Fig. 9 As shown, the electronic device may include: a processor 910, a communication interface 920, a memory 930 and a communication bus 940, wherein the processor 910, the communication interface 920 and the memory 930 complete mutual communication through the communication bus 940. The processor 910 may call the logic instructions in the memory 930 to execute the active defense strategy generation method, which includes: obtaining network device parameter information of the honeypot strategy network to be deployed, wherein the honeypot strategy network to be deployed is a distributed network; inputting the network device parameter information into the pre-trained local honeypot deployment strategy generation model, obtaining the target strategy parameters of the target honeypot defense strategy that matches the honeypot strategy network to be deployed and output by the local honeypot deployment strategy generation model, wherein the local honeypot deployment strategy generation model is dynamically updated based on the network device parameter information and the target strategy parameters; generating the target honeypot defense strategy based on the target strategy parameters, and performing active defense strategy deployment for the honeypot strategy network to be deployed based on the target honeypot defense strategy.

[0119] In addition, the logic instructions in the above-mentioned memory 930 can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when it is sold or used as an independent product. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk and other media that can store program codes.

[0120] On the other hand, the present invention also provides a computer program product, which includes a computer program, and the computer program can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer can execute the active defense strategy generation method provided by the above-mentioned methods, and the method includes: obtaining network device parameter information of a honeypot strategy network to be deployed, wherein the honeypot strategy network to be deployed is a distributed network; inputting the network device parameter information into a pre-trained local honeypot deployment strategy generation model to obtain target policy parameters of a target honeypot defense strategy that matches the honeypot strategy network to be deployed, output by the local honeypot deployment strategy generation model, wherein the local honeypot deployment strategy generation model is dynamically updated based on the network device parameter information and the target policy parameters; generating the target honeypot defense strategy based on the target policy parameters, and performing active defense strategy deployment for the honeypot strategy network to be deployed based on the target honeypot defense strategy.

[0121] On the other hand, the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, is implemented to execute the active defense strategy generation method provided by the above-mentioned methods, the method comprising: obtaining network device parameter information of a honeypot strategy network to be deployed, wherein the honeypot strategy network to be deployed is a distributed network; inputting the network device parameter information into a pre-trained local honeypot deployment strategy generation model to obtain target policy parameters of a target honeypot defense strategy that matches the honeypot strategy network to be deployed and output by the local honeypot deployment strategy generation model, wherein the local honeypot deployment strategy generation model is dynamically updated based on the network device parameter information and the target policy parameters; generating the target honeypot defense strategy based on the target policy parameters, and performing active defense strategy deployment for the honeypot strategy network to be deployed based on the target honeypot defense strategy.

[0122] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without paying creative labor.

[0123] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0124] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for generating an active defense strategy, characterized in that: The method comprises: Acquire network device parameter information of a honeypot strategy network to be deployed, wherein the honeypot strategy network to be deployed is a distributed network; Input the network device parameter information into a pre-trained local honeypot deployment strategy generation model to obtain target strategy parameters of a target honeypot defense strategy that matches the honeypot strategy network to be deployed and is output by the local honeypot deployment strategy generation model, wherein the local honeypot deployment strategy generation model is dynamically updated based on the network device parameter information and the target strategy parameters; The target honeypot defense strategy is generated based on the target strategy parameters, and active defense strategy deployment is performed for the honeypot strategy network to be deployed based on the target honeypot defense strategy, wherein after the target honeypot defense strategy is generated based on the target strategy parameters, the method further includes: Obtaining device change information of the honeypot strategy network to be deployed, as well as security threat warning information; Input the device change information, the security threat alarm information, and the target honeypot defense strategy into a pre-trained local honeypot deployment strategy dynamic transformation model to obtain a target change strategy parameter of the changed target honeypot defense strategy output by the local honeypot deployment strategy dynamic transformation model, wherein the changed target honeypot defense strategy matches the honeypot strategy network to be deployed where the device change occurs; The target change strategy parameter is used as the target strategy parameter, wherein, A global honeypot deployment strategy generation model is obtained based on a federated learning algorithm, and the global honeypot deployment strategy generation model is used as a final local honeypot deployment strategy generation model; A global honeypot deployment strategy dynamic transformation model is obtained based on a federated learning algorithm, and the global honeypot deployment strategy dynamic transformation model is used as a final local honeypot deployment strategy dynamic transformation model.

2. The active defense strategy generation method according to claim 1, characterized in that: After the active defense strategy is deployed for the honeypot strategy network to be deployed based on the target honeypot defense strategy, the method further includes: When the target honeypot defense strategy is deployed in the honeypot strategy network to be deployed, obtaining asset equipment, honeypot logs, and security threat alarm information of the honeypot strategy network to be deployed; Based on the asset device, the honeypot log, and the security threat warning information, restore the security threat attack path, and obtain attack intelligence based on the security threat attack path; Based on the attack intelligence, an attack intelligence map corresponding to the attack intelligence is generated, wherein the attack intelligence map is used to display the security threat attack situation of the honeypot strategy network to be deployed.

3. The active defense strategy generation method according to claim 2, characterized in that: After generating the attack intelligence graph corresponding to the attack intelligence, the method further includes: Regularly obtain the attack intelligence maps corresponding to the honeypot strategy networks to be deployed; Aggregating the attack intelligence graphs to obtain a global attack intelligence graph; Based on the global attack intelligence map, each of the attack intelligence maps is updated.

4. The method for generating an active defense strategy according to claim 1, characterized in that: The local honeypot deployment strategy generation model is updated in the following way: Based on federated learning, regularly obtain first model parameters of each local honeypot deployment strategy generation model corresponding to each of the honeypot strategy networks to be deployed; Aggregate the first model parameters to obtain first aggregated model parameters; Based on the first aggregated model parameters, the local honeypot deployment strategy generation model is updated to obtain a global honeypot deployment strategy generation model, and the global honeypot deployment strategy generation model is used as the final local honeypot deployment strategy generation model.

5. The method for generating an active defense strategy according to claim 1, characterized in that: The local honeypot deployment strategy dynamic transformation model is updated in the following way: Based on federated learning, regularly obtain each second model parameter of each local honeypot deployment strategy dynamic transformation model corresponding to each honeypot strategy network to be deployed; Aggregate each of the second model parameters to obtain second aggregated model parameters; Based on the second aggregated model parameters, the local honeypot deployment strategy dynamic transformation model is updated to obtain a global honeypot deployment strategy dynamic transformation model, and the global honeypot deployment strategy dynamic transformation model is used as the final local honeypot deployment strategy dynamic transformation model.

6. An active defense strategy generation device, characterized in that: The device is used to implement the active defense strategy generation method according to any one of claims 1 to 5, and the device includes: An acquisition module, used to acquire network device parameter information of a honeypot strategy network to be deployed, wherein the honeypot strategy network to be deployed is a distributed network; A processing module, used for inputting the network device parameter information into a pre-trained local honeypot deployment strategy generation model, and obtaining the target strategy parameters of the target honeypot defense strategy that matches the honeypot strategy network to be deployed and output by the local honeypot deployment strategy generation model, wherein the local honeypot deployment strategy generation model is dynamically updated based on the network device parameter information and the target strategy parameters; A deployment module is used to generate the target honeypot defense strategy based on the target strategy parameters, and to perform active defense strategy deployment for the honeypot strategy network to be deployed based on the target honeypot defense strategy.

7. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the program, the active defense strategy generation method according to any one of claims 1 to 5 is implemented.

8. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the active defense strategy generation method according to any one of claims 1 to 5 is implemented.

9. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the active defense strategy generation method according to any one of claims 1 to 5 is implemented.

Images