A honey spot deployment method based on improved multi-objective firefly algorithm

Abstract

The present invention provides a honey spot deployment method based on an improved multi-target firefly algorithm, which relates to the technical field of network security, including: generating a two-dimensional grid map after mapping and encoding power system network nodes and honey spot locations; obtaining exploration information and attack action information of network nodes to generate an attack graph; combining exploration information and attack action information, decomposing into multiple target modal components, and obtaining an initial prediction model; establishing a training set based on exploration information, attack action information, and real honey spot location information; obtaining an improved multi-target firefly algorithm based on a nonlinear adjustment factor and an adaptive neighborhood, training the initial prediction model using the training set and the improved multi-target firefly algorithm, obtaining multiple trained prediction models, and outputting predicted honey spot location information based on the trained prediction models. The present invention considers decomposing the attack action information, and using multiple trained prediction models to capture attack action features, thereby improving network defense efficiency.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a honey spot deployment method based on an improved multi-objective firefly algorithm. Background Art

[0002] With the development of information technology, the security of network power systems has become increasingly important. Cyber ​​attacks can cause system power outages, economic losses, and even leaks of sensitive information. Therefore, studying defense methods against cyber attacks is of great significance to protecting network security.

[0003] In the existing technology, honeypot technology, as an active defense technology, can lure attackers to attack the honeypot and protect other network devices from damage. However, with the development of network security defense technology, attackers' attack methods are also constantly evolving and improving, making it difficult for honeypot technology to effectively capture new attacks such as zero-day vulnerability attacks and advanced persistent attacks. Faced with the huge business scale and diverse environments in the power system, it is extremely difficult to disguise all businesses in a completely authentic manner with limited resources. Attackers can easily analyze the subtle differences between the honeypot system and the real business, increasing the possibility of the honeypot being bypassed, reducing the defense performance of the honeypot, and thus increasing the threat level of network attacks to the power system. Therefore, it is urgent to provide a solution to improve the above problems. Summary of the invention

[0004] The purpose of the present invention is to provide a honeypot deployment method based on an improved multi-target firefly algorithm to improve the problem that the existing honeypot technology is difficult to effectively capture zero-day vulnerability attacks and advanced persistent attacks, resulting in low network defense efficiency.

[0005] The present invention provides a honey spot deployment method based on an improved multi-objective firefly algorithm, which adopts the following technical solutions:

[0006] Map and encode the locations of network nodes and honey spots in the power system to generate a two-dimensional grid map;

[0007] After acquiring the detection information and attack action information of each network node in the two-dimensional grid map, an attack graph is generated, and the real honey spot location information is acquired based on the attack graph, wherein the attack graph is composed of multiple attack edges and multiple network nodes;

[0008] Combining the detection information and the attack action information to obtain combined information, decomposing the combined information into a plurality of target modal components, and establishing a corresponding initial prediction model for each target modal component;

[0009] Establishing a training set based on the detection information, the attack action information and the real sweet spot location information;

[0010] An improved multi-objective firefly algorithm is obtained based on a nonlinear adjustment factor and an adaptive neighborhood, and multiple initial prediction models are trained based on the training set and the improved multi-objective firefly algorithm to obtain multiple trained prediction models, and the predicted honey spot location information is output based on the trained prediction models.

[0011] The beneficial effects of a honey spot deployment method based on an improved multi-objective firefly algorithm provided by the present invention are as follows: first, the present invention decomposes the input signal into multiple modal components by using a variational mode decomposition technique, which can effectively extract frequency features and reduce noise interference, thereby better understanding and analyzing signal features; second, a corresponding initial prediction model is established for each modal component, which can better understand the features of each modality, and a 1-tanh function and a peephole are added to the forget gate in the initial prediction model, which can capture more attack signal features from the attack action information and improve the accuracy of model prediction; third, the traditional firefly algorithm is improved by using a nonlinear adjustment factor and an adaptive neighborhood to obtain an improved firefly algorithm, which improves the convergence speed of the algorithm and the search ability of the firefly population; fourth, the initial prediction model is trained by using a training set and the improved firefly algorithm to obtain a trained honey spot deployment prediction model, thereby improving the prediction accuracy of the honey spot deployment prediction model; fifth, the trained honey spot deployment prediction model can be used to predict the attacker's attack path and determine the optimal honey spot deployment position, continuously track the attacker, and provide protection for the safety of the power system.

[0012] Optionally, the mathematical expression for encoding the position information in the two-dimensional grid map is:

[0013] ;

[0014] in, Indicates The grid is Encoded information of direction; Indicates The grid is Encoded information of direction; Indicates the total number of grids in each row; Represents modulo operation; Indicates rounding up.

[0015] Optionally, the process of decomposing the combined information into a plurality of target modal components includes:

[0016] Constructing a constrained variational problem based on the combined information, and converting the constrained variational problem into an augmented Lagrangian function by performing unconstrained variation;

[0017] After alternately optimizing the target point of the augmented Lagrangian function, multiple target modal components are obtained.

[0018] Optionally, the improved multi-objective firefly algorithm includes:

[0019] Establishing a fitness function based on the real sweet spot location information and the predicted sweet spot location information;

[0020] Initialize the parameters of the improved firefly algorithm and the position of the firefly population, and set the current number of iterations and the maximum number of iterations. The parameters are composed of the number of targets, the dimension of the decision variable, the population size, the maximum number of iterations, the light absorption coefficient, the maximum attraction between fireflies, and the step factor.

[0021] Based on the fitness function, the fitness function value of each firefly in the firefly population is calculated, and the firefly and fireflies Manhattan distance of ;

[0022] When the current number of iterations is less than the maximum number of iterations, the neighborhood range is obtained based on the Manhattan distance, and the positions of the fireflies in the neighborhood range are iteratively updated based on the fitness function value of the individual fireflies and the nonlinear adjustment factor until the current number of iterations is greater than or equal to the maximum number of iterations and the updating is stopped.

[0023] Optionally, the mathematical expression of the neighborhood range is:

[0024] ;

[0025] in, Firefly Neighborhood range; Firefly and fireflies Manhattan distance of ; represents the size of the firefly population; A dimension representing the size of the firefly population.

[0026] Optionally, the mathematical expression for iteratively updating the positions of fireflies within the neighborhood is:

[0027] ;

[0028] in, represents the firefly population, Firefly Firefly dominate, Firefly and fireflies The fitness function value of represents the nonlinear adjustment factor, Indicates Iteration Firefly The spatial location, and Firefly and In the The spatial position to which the iteration belongs, Indicates the greatest attraction between fireflies, Firefly and The Manhattan distance between represents the light absorption coefficient, represents the step size factor, represents a random number vector that obeys Gaussian distribution and uniform distribution, The optimal individual in the population is obtained by randomly weighting all objectives.

[0029] Optionally, the nonlinear adjustment factor The mathematical expression is:

[0030] ;

[0031] in, is the current iteration number, Indicates the maximum number of iterations.

[0032] Optionally, the fitness function is a three-objective optimization function, and its mathematical expression is:

[0033] { F RM = 1 N ∑ i = 1 N S ( y i − y ̃ i ) 2 F MA = 1 N ∑ i = 1 N S | y i − y ̃ i | | y i | × 100 % F R 2 = ∑ i = 1 N s ( y i − y ¯ i ) / [ ∑ i = 1 N s ( y i − y ¯ i ) − ∑ i = 1 N s ( y i − y ̃ i )] ;

[0034] in, Represents the number of training samples in the training set; Indicates the real honey spot location information; Indicates the predicted honey spot location information; represents the average status of honey spot deployment, represents the first fitness function constructed by the root mean square error, represents the second fitness function constructed by the mean absolute percentage error, Represents the third fitness function constructed by the coefficient of determination.

[0035] Optionally, the initial prediction model is composed of a forget gate with a peephole, a feature extraction unit, an input gate and an output gate, wherein the feature extraction unit is used to The function extracts features from the output value of the forget gate with a peephole to obtain attack feature information; the peephole is used to establish the type of attack action and the location of the honey spot, and then establish a long-term dependency relationship between the attack action and the location of the honey spot.

[0036] Optionally, the mathematical expression of the attack feature information is:

[0037] ;

[0038] in, Indicates attack feature information. Indicates combination information. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] Figure 1 It is a flow chart of a honey spot deployment method based on an improved multi-objective firefly algorithm provided by the present invention;

[0040] Figure 2 It is a structural diagram of the initial prediction model provided by the present invention;

[0041] Figure 3 It is a honey spot deployment prediction flow chart based on the initial prediction model provided by the present invention. DETAILED DESCRIPTION

[0042] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention. Unless otherwise defined, the technical terms or scientific terms used herein should be understood by people with general skills in the field to which the present invention belongs. "Including" and similar words used in this article mean that the elements or objects appearing before the word include the elements or objects listed after the word and their equivalents, without excluding other elements or objects.

[0043] In some embodiments, see Figure 1 , which is a flow chart of a honey spot deployment method based on an improved multi-objective firefly algorithm provided by the present invention, comprising the following steps:

[0044] S1, mapping and encoding the locations of network nodes and honey spots in the power system to generate a two-dimensional grid map;

[0045] S2, generating an attack graph after acquiring the detection information and attack action information of each network node in the two-dimensional grid map, and acquiring the real honey spot location information based on the attack graph, wherein the attack graph is composed of multiple attack edges and multiple network nodes;

[0046] S3, combining the detection information and the attack action information to obtain combined information, decomposing the combined information into multiple target modal components, and establishing a corresponding initial prediction model for each target modal component;

[0047] S4, establishing a training set based on the detection information, attack action information and real honey spot location information;

[0048] S5. Obtain an improved multi-objective firefly algorithm based on a nonlinear adjustment factor and an adaptive neighborhood, and train a plurality of the initial prediction models based on the training set and the improved multi-objective firefly algorithm, respectively, to obtain a plurality of trained prediction models, and output predicted honey spot location information based on the trained prediction models.

[0049] In some embodiments, the process of executing step S2 to generate an attack graph includes: converting the detection information into format information based on the MulVAL format conversion tool, inputting the format information into the MulVAL attack graph generation tool, and generating an attack graph in combination with the vulnerability information library.

[0050] In some embodiments, the process of obtaining the real honey spot location information based on the attack graph in step S2 includes:

[0051] S2-1. Collect vulnerability information in the power system network, and obtain the atomic attack difficulty score corresponding to each attack edge based on the Common Vulnerability Scoring System (CVSS), where the number of attack edges is M;

[0052] S2-2. Sort the atomic attack difficulty scores of the attack edges from high to low to obtain a sorting sequence, select the first N attack edges as target attack edges based on the sorting sequence, and deploy real honey spot location information based on the target attack edges, where N<M.

[0053] Specifically, when executing step S2-1, the mathematical expression of the atomic attack difficulty score is:

[0054] ;

[0055] in, Indicates the difficulty of atomic attack, represents the attack vector, Indicates the complexity of the attack, Indicates authentication requirements.

[0056] In some embodiments, when executing step S1 to generate a two-dimensional grid map, the mathematical expression for encoding the position information in the two-dimensional grid map is:

[0057] ;

[0058] in, Indicates The grid is Encoded information of direction; Indicates The grid is Encoded information of direction; Indicates the total number of grids in each row; Represents modulo operation; Indicates rounding up.

[0059] In some embodiments, the process of performing step S3 to decompose the combined information into a plurality of target modal components includes:

[0060] S3-1, constructing a constrained variational problem based on the combined information, and converting the constrained variational problem into an augmented Lagrangian function by performing unconstrained variation;

[0061] S3-2, obtaining multiple target modal components by alternately optimizing the target point of the augmented Lagrangian function.

[0062] Specifically, when executing step S3-1, the mathematical expression of the constrained variation problem is:

[0063] { min { u l },{ ω l } { ∑ l || ∂ ∂ t [ δ ( t ) + j π t ∗ u l ( t )] e − j ω l t || 2 2 } s . t . ∑ l u l ( t ) = f ( t ) ;

[0064] In the formula, Indicates the number of decomposed modes; represents the Dirac function; represents the set of modal components; represents the set of modal center frequencies; Represents the convolution operator.

[0065] Furthermore, the mathematical expression of the augmented Lagrangian function is:

[0066] ;

[0067] in, represents the quadratic penalty factor, which is used to reduce Gaussian noise interference; represents the Lagrange multiplier, Indicates the combination of detection information and attack action information.

[0068] Specifically, when executing step S3-2 to obtain multiple target modal components, the mathematical expression of the target modal components is:

[0069] ;

[0070] in, represents noise tolerance; , , and Respectively , , and The Fourier transform of .

[0071] In some embodiments, when executing step S4, the training set consists of the exploration information, the attack action information and the real honey spot location information.

[0072] In some embodiments, the process of obtaining an improved multi-objective firefly algorithm based on the nonlinear adjustment factor and the adaptive neighborhood in step S5 includes:

[0073] S5-1, establishing a fitness function based on the real sweet spot location information and the predicted sweet spot location information;

[0074] S5-2, initialize the parameters of the improved firefly algorithm and the population position of fireflies, and set the current number of iterations and the maximum number of iterations, wherein the parameters are composed of the number of targets, the dimension of the decision variable, the population size, the maximum number of iterations, the light absorption coefficient, the maximum attraction between fireflies, and the step factor;

[0075] S5-3, based on the fitness function, calculate the fitness function value of each firefly individual in the firefly population, and calculate the firefly and fireflies Manhattan distance of ;

[0076] S5-4. When the current number of iterations is less than the maximum number of iterations, the neighborhood range is obtained based on the Manhattan distance, and the position of the fireflies in the neighborhood range is iteratively updated based on the fitness function value of the individual fireflies and the nonlinear adjustment factor, until the current number of iterations is greater than or equal to the maximum number of iterations and the updating is stopped.

[0077] Specifically, when executing step S5-1 to establish the fitness function, the fitness function is a three-objective optimization function, and its mathematical expression is:

[0078] { F RM = 1 N ∑ i = 1 N S ( y i − y ̃ i ) 2 F MA = 1 N ∑ i = 1 N S | y i − y ̃ i | | y i | × 100 % F R 2 = ∑ i = 1 N s ( y i − y ¯ i ) / [ ∑ i = 1 N s ( y i − y ¯ i ) − ∑ i = 1 N s ( y i − y ̃ i )] ;

[0079] in, Represents the number of training samples in the training set; Indicates the real honey spot location information; Indicates the predicted honey spot location information; represents the average status of honey spot deployment, represents the first fitness function constructed by the root mean square error, represents the second fitness function constructed by the mean absolute percentage error, Represents the third fitness function constructed by the coefficient of determination.

[0080] In fact, the three fitness functions are constructed by using mean square error, mean absolute percentage error and determination coefficient, and these three fitness functions are optimized at the same time. At this time, the optimization problem is transformed into a three-objective optimization problem, that is, , compared with optimizing only one fitness function, it can help the model achieve better optimization results.

[0081] Specifically, when executing step S5-4 to obtain the neighborhood range based on the Manhattan distance, the mathematical expression of the neighborhood range is:

[0082] ;

[0083] in, Firefly Neighborhood range; Firefly and fireflies Manhattan distance of ; represents the size of the firefly population; A dimension representing the size of the firefly population.

[0084] In fact, after each round of iteration of the algorithm, each individual firefly will automatically obtain a neighborhood, and can adaptively adjust the neighborhood range according to the current population crowding level. This strategy only compares the dominance relationship with the fireflies in the neighborhood, which can effectively reduce the overhead of comparing dominance relationships between fireflies; fuzzy dominance is used to determine the dominance relationship between fireflies to avoid the failure of the dominance relationship and cause errors in the evolutionary direction of individual fireflies.

[0085] Specifically, in step S5-4, the mathematical expression for iteratively updating the position of the fireflies in the neighborhood based on the fitness function value of the individual fireflies and the nonlinear adjustment factor is:

[0086] ;

[0087] in, represents the firefly population, Firefly Firefly dominate, Firefly and fireflies The fitness function value of represents the nonlinear adjustment factor, Indicates Iteration Firefly The spatial location, and Firefly and In the The spatial position to which the iteration belongs, Indicates the greatest attraction between fireflies, Firefly and The Manhattan distance between represents the light absorption coefficient, represents the step size factor, represents a random number vector that obeys Gaussian distribution and uniform distribution, The optimal individual in the population is obtained by randomly weighting all objectives.

[0088] Furthermore, the nonlinear adjustment factor The mathematical expression is:

[0089] ;

[0090] in, is the current iteration number, Indicates the maximum number of iterations.

[0091] In fact, the nonlinear adjustment factor It can ensure that the improved firefly algorithm has good exploration ability in the early stage of iteration, and ensure that the improved firefly algorithm has a faster convergence speed in the later stage.

[0092] In some embodiments, when executing step S3, the initial prediction model is composed of a forget gate with a peephole, a feature extraction unit, an input gate, and an output gate, wherein the feature extraction unit is used to The function extracts features from the output value of the forget gate with a peephole to obtain attack feature information; the peephole is used to establish the type of attack action and the location of the honey spot, and then establish a long-term dependency relationship between the attack action and the location of the honey spot.

[0093] In fact, the value of attack signature information is [ 0 . 23 , 1 ] The closer the value is to 0, the more attack feature information is forgotten, and the closer the value is to 1, the more attack feature information is retained. [ 0 . 23 , 1 ] The purpose is to retain as many attack features as possible in the attack action information, thereby improving the learning ability of the initial prediction model during the training process.

[0094] Among them, the mathematical expression of the forget gate with a peephole is:

[0095] ;

[0096] ;

[0097] ;

[0098] ;

[0099] in, Indicates attack feature information; It represents the combined information, which is composed of the detection information and the attack action information; Represents the weight matrix of the forget gate; express The training set at the moment; express Hidden information at all times, Represents the bias value of the forget gate; express Activation function; represents the hyperbolic tangent function.

[0100] Input gate decision and What information is memorized and updated, the mathematical expressions of the input gate and candidate memory cells are:

[0101] i t = σ [ W i ( x t , h t − 1 ) + b i ] ;

[0102] C ̃ t = tanh [ W c ( x t , h t − 1 ) + b c ] ;

[0103] in, Represents the value of the input gate; represents the weight matrix of the input gate; represents the bias term of the input gate; The weight matrix representing the candidate memory unit; Represents the bias term of the candidate unit.

[0104] Furthermore, the attack feature information and The cell state Perform convolution operation to forget some attack actions and retain some attack action information, and add the attack action information of the input gate and the forget gate to get the new cell state , its mathematical expression is:

[0105] ;

[0106] In the formula, Represents a convolution operation.

[0107] Furthermore, after the forget gate and input gate update the cell state, Attack action information output at all times and The training set at the moment Combine and obtain Attack action information output at the moment , its mathematical expression is:

[0108] h t = σ ( W o [ x t , h t − 1 ] + b o ) ∗ tanh ( C t ) ;

[0109] In the formula, Represents the weight matrix of the output gate; Represents the bias term of the output gate.

[0110] In some embodiments, when executing step S5 to train multiple initial prediction models and obtain multiple trained prediction models, it is essentially a process of optimizing the hyperparameters in the initial prediction model. The specific steps are: converting the hyperparameters of the initial prediction model into position coordinates, and using the improved firefly algorithm to iteratively train the position coordinates. If the current number of iterations reaches the maximum number of iterations, multiple groups of Pareto optimal solutions are output. The optimal solution is the parameter information of the prediction model. If there are multiple groups of Pareto optimal solutions, arbitrarily select one group of Pareto optimal solutions as the parameters of the trained prediction model.

[0111] In fact, when executing step S5 to obtain multiple trained prediction models and outputting predicted honey spot location information based on the trained prediction models, it is necessary to save the predicted honey spot locations and the detection information of all network nodes output by the multiple trained prediction models to obtain the saved information. The administrator will regularly calibrate the parameters of the trained prediction model based on the saved information to ensure the robustness of the trained prediction model.

[0112] In some embodiments, see Figure 2 , which represents the structure diagram of the initial prediction model provided by the present invention. Compared with the long short-term memory network model, the improvement is that the present invention adds a Feature extraction unit with a peephole added to the forget gate.

[0113] In some embodiments, see Figure 3, represents the honey spot deployment prediction flow chart based on the initial prediction model provided by the present invention. First, the raw data of the power system is collected, and the raw data represents the detection information and attack action information of each network node. Secondly, the variational mode decomposition technology (VMD) is used to decompose the collected raw data into multiple target mode components IMF0, IMF1, IMF2, IMFn, finally, a corresponding identical initial prediction model (ILSTM) is constructed for each target modal component. Each initial prediction model will output a corresponding subset of honey point positions. After data integration of all honey point subset positions, the predicted honey point position is obtained. The predicted honey point position is composed of multiple honey point subset positions. The number of trained prediction models is equal to the number of target modal components.

[0114] Although the embodiments of the present invention are described in detail above, it is obvious to those skilled in the art that various modifications and variations can be made to these embodiments. However, it should be understood that such modifications and variations are within the scope and spirit of the present invention as described in the claims. Moreover, the present invention described herein may have other embodiments and may be implemented or realized in a variety of ways.

Claims

1. A honey spot deployment method based on an improved multi-objective firefly algorithm, characterized in that: include: Map and encode the locations of network nodes and honey spots in the power system to generate a two-dimensional grid map; After acquiring the detection information and attack action information of each network node in the two-dimensional grid map, an attack graph is generated, and the real honey spot location information is acquired based on the attack graph, wherein the attack graph is composed of multiple attack edges and multiple network nodes; Combining the detection information and the attack action information to obtain combined information, decomposing the combined information into a plurality of target modal components, and establishing a corresponding initial prediction model for each target modal component; Establishing a training set based on the detection information, the attack action information and the real sweet spot location information; Establishing a fitness function based on the real sweet spot location information and the predicted sweet spot location information; Initialize the parameters of the improved firefly algorithm and the position of the firefly population, and set the current number of iterations and the maximum number of iterations. The parameters are composed of the number of targets, the dimension of the decision variable, the population size, the maximum number of iterations, the light absorption coefficient, the maximum attraction between fireflies, and the step factor; Based on the fitness function, the fitness function value of each firefly in the firefly population is calculated, and the firefly and fireflies Manhattan distance of ; When the current number of iterations is less than the maximum number of iterations, the neighborhood range is obtained based on the Manhattan distance, and the position of the fireflies in the neighborhood range is iteratively updated based on the fitness function value of the firefly individual and the nonlinear adjustment factor, until the current number of iterations is greater than or equal to the maximum number of iterations, the update is stopped, and an improved multi-objective firefly algorithm is obtained; Based on the training set and the improved multi-objective firefly algorithm, the multiple initial prediction models are trained respectively to obtain multiple trained prediction models, and the predicted honey spot location information is output based on the trained prediction models.

2. According to claim 1, a honey spot deployment method based on an improved multi-objective firefly algorithm is characterized in that: The mathematical expression for encoding the position information in the two-dimensional grid map is: in, Indicates The grid is Encoded information of direction; Indicates The grid is Encoded information of direction; Indicates the total number of grids in each row; Represents modulo operation; Indicates rounding up.

3. The honey spot deployment method based on the improved multi-objective firefly algorithm according to claim 1 is characterized in that: The process of decomposing the combined information into a plurality of target modal components comprises: Constructing a constrained variational problem based on the combined information, and converting the constrained variational problem into an augmented Lagrangian function by performing unconstrained variation; After alternately optimizing the target point of the augmented Lagrangian function, multiple target modal components are obtained.

4. The honey spot deployment method based on the improved multi-objective firefly algorithm according to claim 1 is characterized in that: The mathematical expression of the neighborhood range is: in, Firefly Neighborhood range; Firefly and fireflies Manhattan distance of ; represents the size of the firefly population; A dimension representing the size of the firefly population.

5. The honey spot deployment method based on the improved multi-objective firefly algorithm according to claim 1 is characterized in that: The mathematical expression for iteratively updating the position of fireflies within the neighborhood is: in, represents the firefly population, Firefly Firefly dominate, Firefly and fireflies The fitness function value of represents the nonlinear adjustment factor, Indicates Iteration Firefly The spatial location, and Firefly and In the The spatial position to which the iteration belongs, Indicates the greatest attraction between fireflies, Firefly and The Manhattan distance between represents the light absorption coefficient, represents a random number vector that obeys a Gaussian distribution and uniform distribution, The optimal individual in the population is obtained by randomly weighting all objectives.

6. The honey spot deployment method based on the improved multi-objective firefly algorithm according to claim 1 is characterized in that: The nonlinear adjustment factor The mathematical expression is: in, is the current iteration number, Indicates the maximum number of iterations.

7. The honey spot deployment method based on the improved multi-objective firefly algorithm according to claim 1 is characterized in that: The fitness function is a three-objective optimization function, and its mathematical expression is: in, Represents the number of training samples in the training set; Indicates the real honey spot location information; Indicates the predicted honey spot location information; represents the average status of honey spot deployment, represents the first fitness function constructed by the root mean square error, represents the second fitness function constructed by the mean absolute percentage error, Represents the third fitness function constructed by the coefficient of determination.

8. The honey spot deployment method based on the improved multi-objective firefly algorithm according to claim 1 is characterized in that: The initial prediction model is composed of a forget gate with a peephole, a feature extraction unit, an input gate and an output gate, wherein the feature extraction unit is used to The function extracts features from the output value of the forget gate with a peephole to obtain attack feature information; the peephole is used to establish the type of attack action and the location of the honey spot, and then establish a long-term dependency relationship between the attack action and the location of the honey spot.

9. The honey spot deployment method based on the improved multi-objective firefly algorithm according to claim 8, characterized in that: The mathematical expression of the attack feature information is: in, Indicates attack feature information. Indicates combination information.

Images