Attack trapping method and system based on network attack surface adaptive conversion

Abstract

The invention discloses an attack trapping method and system based on network attack surface adaptive conversion, and the method comprises the steps: dynamically converting vulnerabilities and weaknesses in a system, so that an attacker is difficult to determine an entrance of a real system; threat intelligence and a network environment are monitored and analyzed in real time, and abnormal traffic and potential attack behaviors are identified; constructing a false target and monitoring attack behaviors, and obtaining behavior characteristics and attack means of an attacker; attack behavior data are analyzed by using artificial intelligence and a machine learning algorithm, potential threats are quickly identified and responded, a threat intelligence library and a defense strategy are updated, and the method better adapts to constantly changing attack means and threat forms. The method not only can trap attack behaviors, but also can collect and analyze behavior characteristics of attackers, and provides more accurate data support for network security decision and threat prediction.

Description

Technical Field

[0001] The invention belongs to the technical field of network information security, and relates to an attack trapping method and system based on adaptive conversion of network attack surfaces. Background Art

[0002] In the current network environment, network attacks are increasing and evolving, and traditional defense methods are no longer sufficient. Common network security protection measures mainly include firewalls, intrusion detection systems (IDS), intrusion prevention systems (IPS), etc.

[0003] However, these traditional defense methods have the following problems. First, static defense capabilities are very limited. Traditional defense methods are mainly based on known attack features and vulnerabilities, and are difficult to deal with new unknown attacks and variant attacks. Second, there is a clear asymmetry between defense and attack. Attackers can bypass the rules and strategies of defense methods, greatly reducing the effectiveness of defense. Finally, there is a problem of difficulty in accurately identifying attack behaviors. Traditional defense methods can often only identify known attack features and cannot identify and prevent unknown attack behaviors in a timely manner. Summary of the invention

[0004] To solve the above technical problems, the present invention provides an attack trapping method and system based on adaptive conversion of network attack surface, which improves the capability and effect of network security by implementing steps such as dynamic vulnerability conversion, abnormal traffic monitoring, false target trapping and response analysis.

[0005] To achieve the above purpose, the technical solution adopted by the present invention is as follows: On the one hand, an attack trapping method based on adaptive conversion of network attack surface is implemented in the following steps: Step 1: Abnormal traffic monitoring and dynamic vulnerability conversion: Real-time monitoring and analysis of network traffic, identification of abnormal traffic and potential attack behaviors, dynamic perception of the network environment, simulation of vulnerabilities and weaknesses in the real system and continuous updating of vulnerabilities and weaknesses in the system; Step 2: False target trapping: Construct an attractive false target, and obtain the attacker's behavioral characteristics by monitoring and recording the attacker's behavior of entering the false target; Step 3: Response analysis: Analyze the monitored attack behavior feature data to quickly identify and respond to potential attack behaviors.

[0006] Furthermore, the abnormal flow monitoring in step 1 includes: Use traffic monitoring tools or devices to monitor and capture network traffic in real time; Compare the real-time monitored traffic data with the normal traffic behavior model to identify abnormal traffic that is inconsistent with the normal traffic pattern, indicating potential attack behavior; Extract the characteristics of potential attack behaviors from abnormal traffic.

[0007] Furthermore, the traffic monitoring tool or device includes an intrusion detection system IDS and a network traffic analysis tool. The detection of abnormal traffic is identified through machine learning or statistical analysis algorithms. The characteristics of the attack behavior include network protocol anomalies, request frequency anomalies, and data packet size anomalies.

[0008] Furthermore, the dynamic vulnerability conversion in step 1 includes: Real-time monitoring and analysis of threat intelligence: Collect the latest threat intelligence information through information collection tools and analyze it; Dynamically perceive the network environment: Use network monitoring tools and sensors to obtain real-time environmental data in the network, and combine the analysis results of threat intelligence information to identify possible vulnerabilities and weaknesses in the network; Convert vulnerabilities and weaknesses: Create multiple virtual machines or containers and deploy different operating systems, network configurations, and application versions in them to simulate vulnerabilities and weaknesses in real systems. Update and convert the multiple virtual machines or containers to keep the vulnerabilities and weaknesses changing.

[0009] Furthermore, the information collection tools include web crawlers and threat intelligence sharing platforms, the real-time environment data include traffic and device information, and the creation of the multiple virtual machines or containers is achieved through virtualization technology or containerization technology.

[0010] Furthermore, the false target trapping in step 2 includes: Constructing fake targets: Creating attractive fake targets based on threat intelligence information and the characteristics of the real system, and constructing corresponding fake target environments for different attack types and attacker targets; Monitor and record attack behavior: Set up a monitoring and recording mechanism in the fake target environment to monitor and record the attacker's behavior of entering the fake target in real time; Attack behavior analysis: Analyze the monitored attack behavior data, extract the attacker's behavior information, and obtain the attack behavior characteristics.

[0011] Furthermore, the false targets include virtual machines and network services, the recording mechanisms include network logs, system logs, and operation logs, and the attacker's behavior information includes behavior characteristics, attack methods, and tools used.

[0012] Furthermore, the response analysis in step 3 includes: Data analysis: Use machine learning and data analysis algorithms to process and analyze the monitored attack behavior data and establish attack behavior models and rules; Attack identification and prevention: Apply established attack behavior models and rules to real-time attack traffic and match them with known attack features to identify and prevent attack behaviors; Threat intelligence update: Use the results of response analysis to update the threat intelligence library and defense strategies to improve the accuracy and efficiency of network security defense.

[0013] On the other hand, the present invention also provides an attack trapping system based on adaptive conversion of network attack surface, comprising the following units: Abnormal traffic monitoring and dynamic vulnerability conversion unit: used to monitor and analyze network traffic in real time, identify abnormal traffic and potential attack behaviors, and dynamically perceive the network environment, simulate the vulnerabilities and weaknesses in the real system and continuously update the vulnerabilities and weaknesses in the system; False target trapping unit: used to build an attractive false target, and obtain the attacker's behavioral characteristics by monitoring and recording the attacker's behavior of entering the false target; Response Analysis Unit: used to analyze the monitored attack behavior data, quickly identify and respond to potential threats. By establishing attack behavior models and rules, it can accurately identify and block unknown attack behaviors and improve the effectiveness of network security defense.

[0014] The beneficial effects of the present invention are: It can dynamically transform the vulnerabilities and weaknesses in the system, making it difficult for attackers to determine the entrance to the real system. By continuously transforming vulnerabilities and weaknesses, the difficulty and complexity of attacks are increased, and the protection capabilities of network security are increased. Secondly, it can monitor and analyze threat intelligence and network environment in real time, identify abnormal traffic and potential attack behaviors. By learning and modeling attack behaviors, unknown attack behaviors can be discovered and blocked in a timely manner, and the detection and defense capabilities of network security can be improved. In addition, by building false targets and monitoring attack behaviors, the behavioral characteristics and attack methods of attackers can be obtained, and the attackers' strategies and techniques can be further understood. This helps to optimize network security defense strategies and improve the ability to respond to unknown attacks. Finally, using artificial intelligence and machine learning algorithms to analyze attack behavior data can quickly identify and respond to potential threats and improve the effectiveness of network security defense. At the same time, timely updating of threat intelligence libraries and defense strategies can better adapt to changing attack methods and threat forms.

[0015] Through the above implementation steps, attackers can be effectively guided into false targets, and through methods such as dynamic vulnerability conversion, abnormal traffic monitoring and response analysis, network security defense capabilities can be improved to overcome the limitations of traditional defense methods. Effectively improve network security protection capabilities and increase the ability to track and identify attackers. This method can not only trap attack behaviors, but also collect and analyze the behavioral characteristics of attackers, providing more accurate data support for network security decision-making and threat prediction. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] Figure 1 It is a flow chart of the attack trapping method based on network attack surface adaptive conversion of the present invention; Figure 2 It is a schematic diagram of the attack trapping system based on adaptive conversion of network attack surface of the present invention. DETAILED DESCRIPTION

[0017] The present invention is described in detail below with reference to the accompanying drawings and specific embodiments.

[0018] like Figure 1 As shown, the attack trapping method based on adaptive conversion of network attack surface of the present invention is a technical solution for network security defense. It improves the ability and effect of network security by implementing steps such as dynamic vulnerability conversion, abnormal traffic monitoring, false target trapping and response analysis. It is implemented in the following steps: Step 1: Abnormal traffic monitoring: Monitor and analyze network traffic in real time to identify abnormal traffic and potential attack behaviors; Dynamic vulnerability conversion: Real-time monitoring and analysis of threat intelligence, as well as dynamic perception of the network environment, continuously transforming the vulnerabilities and weaknesses in the system; making it difficult for attackers to determine the entrance to the real system, increasing the difficulty and complexity of the attack; Step 2: False target trapping: Build attractive false targets to simulate the vulnerabilities and weaknesses of the real system; obtain the attacker's behavioral characteristics and attack methods by monitoring and recording the attacker's behavior of entering the false target; this can further understand the attacker's strategies and techniques and optimize the network security defense strategy; Step 3: Response analysis: Use artificial intelligence and machine learning algorithms to analyze the monitored attack behavior data to quickly identify and respond to potential threats; by establishing attack behavior models and rules, accurately identify and block unknown attack behaviors, and improve the effectiveness of network security defense.

[0019] Dynamic vulnerability conversion in step 1 refers to the continuous conversion of vulnerabilities and weaknesses in the system through real-time monitoring and analysis of threat intelligence and dynamic perception of the network environment. The specific implementation process includes three steps: The first step is to monitor and analyze threat intelligence in real time. Use information collection tools, such as web crawlers and threat intelligence sharing platforms, to collect the latest threat intelligence information. Then analyze this intelligence to identify potential threats and attack methods.

[0020] The second step is to dynamically perceive the network environment. Use network monitoring tools and sensors to obtain real-time environmental data in the network, such as traffic and device information. Combine this environmental data with threat intelligence analysis results to identify possible vulnerabilities and weaknesses in the network.

[0021] The third step is to transform vulnerabilities and weaknesses. Based on the identified vulnerabilities and weaknesses, multiple virtual machines or containers are created and different operating systems, network configurations, and application versions are deployed in them to simulate the vulnerabilities and weaknesses in the real system. By updating and transforming these virtual machines or containers, the vulnerabilities and weaknesses are constantly changing, making it more difficult for attackers to determine the entrance to the real system.

[0022] Abnormal traffic monitoring in step 1 refers to real-time monitoring and analysis of network traffic to identify abnormal traffic and potential attack behaviors. The specific implementation process includes three steps: The first step is to monitor network traffic. Use traffic monitoring tools or equipment to monitor and capture network traffic in real time to obtain traffic data.

[0023] The second step is abnormal traffic detection. The monitored traffic data is compared with the normal traffic behavior model to identify abnormal traffic that is inconsistent with the normal traffic pattern. Abnormal traffic indicates possible attack behavior.

[0024] The third step is to extract attack behavior features. Extract attack behavior features from abnormal traffic, such as abnormal network protocols, abnormal request frequencies, abnormal data packet sizes, etc. By learning and modeling the patterns and features of attack behaviors, unknown attack behaviors can be discovered and prevented in a timely manner.

[0025] The false target trapping in step 3 refers to building attractive false targets and simulating the vulnerabilities and weaknesses of the real system. The specific implementation process includes three steps: The first step is to build a fake target. According to the threat intelligence and the characteristics of the real system, create an attractive fake target, and build a corresponding fake target environment for different attack types and attacker goals.

[0026] The second step is to monitor and record the attack behavior. Set up a monitoring and recording mechanism in the fake target to monitor and record the attacker's behavior of entering the fake target in real time. These monitoring and recording mechanisms can include network logs, system logs, operation logs, etc., to obtain the attacker's behavioral characteristics and attack methods.

[0027] The third step is attack behavior analysis. Analyze the monitored attack behavior data and extract the attacker's behavior information, such as behavior characteristics, attack methods, and tools used. By analyzing this data, we can further understand the attacker's strategies and techniques, thereby optimizing network security defense strategies.

[0028] The response analysis in step 4 uses artificial intelligence and machine learning algorithms to analyze the monitored attack behavior data to quickly identify and respond to potential threats. The specific implementation process includes three steps: The first step is data analysis. Using machine learning and data analysis algorithms, the monitored attack behavior data is processed and analyzed to extract key information.

[0029] The second step is attack identification and prevention. The established attack behavior models and rules are applied to real-time attack traffic and matched with known attack features to identify and prevent attack behaviors. This can improve the effectiveness of network security defense and prevent the intrusion of unknown attack behaviors.

[0030] The third step is threat intelligence update. Based on the results of response analysis, the threat intelligence library and defense strategy are updated to improve the accuracy and efficiency of network security defense. Timely updating of threat intelligence can help the network defense system better respond to new attacks and threats.

[0031] Traditional defense methods often have limited static defense capabilities when facing new unknown attacks and variant attacks. In contrast, the attack trapping method based on adaptive conversion of network attack surface can effectively solve this problem. The following is a detailed analysis from a technical perspective: First, dynamic vulnerability conversion can improve the flexibility and adaptability of defense. Traditional defense methods mainly rely on known attack features and vulnerability information, which limits the ability of the defense system to known threat forms. Dynamic vulnerability conversion continuously transforms the vulnerabilities and weaknesses in the system through real-time monitoring and analysis of threat intelligence and network environment, making it difficult for attackers to determine the real system entrance. This defense strategy based on dynamic conversion can increase the difficulty and complexity of attacks and enhance the defense system's ability to adapt to unknown attacks.

[0032] Secondly, false target trapping can make up for the asymmetry between defense and attack. Traditional defense means often detect and block based on known attack behaviors, and attackers can bypass them according to defense strategy rules. False target trapping builds attractive false targets to simulate the vulnerabilities and weaknesses of real systems and attract attackers into false targets. By monitoring and recording attack behaviors, obtaining the attacker's behavioral characteristics and attack methods, we can further understand the attacker's strategies and techniques. This active trapping strategy for attackers can reduce the threat of attackers and provide an important reference for defense system optimization strategies.

[0033] Finally, response analysis uses artificial intelligence and machine learning algorithms to analyze and identify the monitored attack behavior data, which can solve the problem of difficulty in accurately identifying attack behaviors. Traditional defense methods can often only identify known attack features and cannot timely identify and prevent unknown attack behaviors. Response analysis can accurately identify and prevent attack behaviors by establishing attack behavior models and rules and applying them to real-time attack traffic and matching them with known attack features. This method based on machine learning and data analysis can quickly identify potential threats, update threat intelligence libraries and defense strategies, and improve the accuracy and efficiency of network security defense.

[0034] To further illustrate the technical solution of the present invention, the following three specific embodiments under different application environments are provided: Example 1: Network security protection system The attack trapping method based on adaptive conversion of network attack surface can be applied to network security protection system to improve the security and defense capability of the network through steps such as dynamic vulnerability conversion, abnormal traffic monitoring, false target trapping and response analysis.

[0035] Step 1: Abnormal traffic monitoring: Monitor and analyze network traffic in real time to identify abnormal traffic and potential attack behaviors; In step 1, the system will monitor abnormal traffic and identify abnormal traffic and potential attack behaviors. The system will monitor and capture network traffic in real time through traffic monitoring tools or devices, and compare the monitored traffic data with the normal traffic behavior model to identify abnormal traffic that is inconsistent with the normal traffic pattern. The system will also use machine learning or statistical analysis algorithms to extract the characteristics of attack behaviors from abnormal traffic, such as abnormal network protocols, abnormal request frequencies, abnormal data packet sizes, etc.

[0036] Dynamic vulnerability conversion: Real-time monitoring and analysis of threat intelligence, as well as dynamic perception of the network environment, convert vulnerabilities and weaknesses in the system.

[0037] In step 1, the system monitors and analyzes threat intelligence in real time and dynamically perceives the network environment. It can obtain the latest threat intelligence information through information collection tools such as web crawlers and threat intelligence sharing platforms, and obtain real-time environmental data in the network in combination with network monitoring tools and sensors. Then, the system transforms the vulnerabilities and weaknesses in the system and simulates the vulnerabilities and weaknesses in the real system by creating and updating multiple virtual machines or containers, so that the vulnerabilities and weaknesses in the system are constantly changing.

[0038] Step 2: False target trapping: Build an attractive false target to simulate the vulnerabilities and weaknesses of the real system; obtain the attacker's behavioral characteristics by monitoring and recording the attacker's behavior entering the false target.

[0039] In step 2, the system will build a fake target to trap the attacker. Based on the threat intelligence and the characteristics of the real system, the system will create an attractive fake target and set up a monitoring and recording mechanism in it. Once the attacker enters the fake target, the system will monitor and record the attacker's behavior in real time, analyze the monitored attack behavior data, extract the attacker's behavior information, and understand the attacker's strategy and technology.

[0040] Step 3: Response analysis: Use artificial intelligence and machine learning algorithms to analyze the monitored attack behavior data to quickly identify and respond to potential attack behaviors.

[0041] In step 3, the system will use artificial intelligence and machine learning algorithms to analyze and respond to the monitored attack behavior data. The system will process and analyze this data to establish attack behavior models and rules. Then, the system will apply these models and rules to real-time attack traffic and match them with known attack features to identify and block attack behaviors. At the same time, the system will also update the threat intelligence library and defense strategies based on the results of the response analysis to improve the accuracy and efficiency of network security defense.

[0042] Through the above-mentioned technical solutions, the network security protection system can be more intelligent and adaptive. It can actively transform loopholes and weaknesses while monitoring and analyzing attack behaviors in real time, trap attackers and respond in time, thereby improving the security and defense capabilities of the network.

[0043] Example 2: Network Intrusion Detection System This technical solution can be applied to network intrusion detection systems to improve the system's detection and defense capabilities against network intrusions through steps such as dynamic vulnerability conversion, abnormal traffic monitoring, false target trapping and response analysis.

[0044] Step 1: Abnormal traffic monitoring: Monitor and analyze network traffic in real time to identify abnormal traffic and potential attack behaviors; In step 1, the system monitors abnormal traffic and identifies abnormal traffic and potential attack behaviors. Through traffic monitoring tools or devices, network traffic is monitored and analyzed in real time, and the monitored traffic data is compared to identify abnormal traffic behaviors and behaviors that do not match known attack patterns. The system uses machine learning and statistical analysis algorithms to analyze and model abnormal traffic.

[0045] Dynamic vulnerability conversion: Real-time monitoring and analysis of threat intelligence, as well as dynamic perception of the network environment, convert vulnerabilities and weaknesses in the system.

[0046] In step 1, the system monitors and analyzes threat intelligence in real time and dynamically perceives the network environment. The latest threat intelligence information is obtained through information collection tools, and real-time environmental data in the network is obtained in combination with network monitoring tools and sensors. Then, the system transforms the vulnerabilities and weaknesses in the system, creates multiple virtual machines or containers to simulate the vulnerabilities and weaknesses in the real system, and updates and transforms these virtual machines or containers to keep the vulnerabilities and weaknesses changing.

[0047] Step 2: False target trapping: Build an attractive false target to simulate the vulnerabilities and weaknesses of the real system; obtain the attacker's behavioral characteristics and attack methods by monitoring and recording the attacker's behavior entering the false target.

[0048] In step 2, the system builds a fake target to trap the attacker. Based on the threat intelligence and the characteristics of the real system, the system creates an attractive fake target and sets up a monitoring and recording mechanism in it. When the attacker enters the fake target, the system monitors and records the attacker's behavior in real time and obtains the attacker's behavioral characteristics and attack methods. These behavioral characteristics and attack methods can be used to better identify and analyze network intrusion behaviors.

[0049] Step 3: Response analysis: Use artificial intelligence and machine learning algorithms to analyze monitored attack behavior data to quickly identify and respond to potential threats.

[0050] In step 3, the system uses artificial intelligence and machine learning algorithms to analyze and respond to the monitored attack behavior data. The system quickly identifies and responds to potential threats by processing and analyzing the monitored attack behavior data. By establishing attack behavior models and rules and applying them to real-time attack traffic, the system can accurately identify and block network intrusions. At the same time, the system uses the results of the response analysis to update the threat intelligence library and defense strategies to improve the system's detection and defense capabilities against network intrusions.

[0051] Through the above technical solutions, the network intrusion detection system can realize intelligent monitoring and defense of network intrusion behavior, improve the security and stability of the system, and protect the enterprise network from the threat of attack and intrusion.

[0052] Example 3: Security incident response system This technical solution can also be applied to security incident response systems to help enterprises promptly discover, identify and respond to security incidents, and take appropriate measures to protect the security of systems and data.

[0053] Step 1: Abnormal traffic monitoring: Monitor and analyze network traffic in real time to identify abnormal traffic and potential attack behaviors; In step 1, the system monitors abnormal traffic and identifies abnormal traffic and potential attack behaviors. Through traffic monitoring tools or devices, network traffic is monitored and analyzed in real time, and the monitored traffic data is compared to identify abnormal traffic behaviors and unknown attack behaviors. Through machine learning and statistical analysis algorithms, the system can learn and model the patterns and characteristics of attack behaviors.

[0054] Dynamic vulnerability conversion: Real-time monitoring and analysis of threat intelligence, as well as dynamic perception of the network environment, convert vulnerabilities and weaknesses in the system.

[0055] In step 1, the system monitors and analyzes threat intelligence in real time and dynamically perceives the network environment. The latest threat intelligence information is obtained through information collection tools, and real-time environmental data in the network is obtained in combination with network monitoring tools and sensors. Then, the system transforms the vulnerabilities and weaknesses in the system, creates virtual machines or containers to simulate the vulnerabilities and weaknesses in the real system, and updates and converts the virtual machines or containers to maintain the security of the system.

[0056] Step 2: False target trapping: Build an attractive false target to simulate the vulnerabilities and weaknesses of the real system; obtain the attacker's behavioral characteristics and attack methods by monitoring and recording the attacker's behavior entering the false target.

[0057] In step 2, the system builds a fake target to trap the attacker. Based on the threat intelligence and the characteristics of the real system, the system creates an attractive fake target and sets up a monitoring and recording mechanism. Once the attacker enters the fake target, the system can monitor and record the attacker's behavior in real time and obtain the attacker's behavioral characteristics and attack methods.

[0058] Step 3: Response analysis: Use artificial intelligence and machine learning algorithms to analyze monitored attack behavior data to quickly identify and respond to potential threats.

[0059] In step 3, the system uses artificial intelligence and machine learning algorithms to analyze and respond to the monitored attack behavior data. The system uses this data for analysis to quickly identify and respond to potential threats. By establishing attack behavior models and rules and applying them to real-time attack traffic, the system can identify and prevent security incidents in a timely manner. At the same time, the system also updates the threat intelligence library and defense strategies based on the results of the response analysis to improve the security and response capabilities of the system.

[0060] Through the technical solution of the present invention, the security incident response system can timely discover and respond to various security incidents and protect the system and data security of the enterprise. The system can quickly identify and respond to attack behaviors, improve the efficiency and accuracy of security incident response, and help enterprises cope with ever-changing threats.

[0061] In addition, the present invention also provides a network trap based on attack trapping and trapping defense system, such as Figure 2 As shown, it includes a vulnerability conversion unit, a traffic monitoring unit, a target trapping unit, and a response analysis unit; Vulnerability conversion unit: This unit is responsible for real-time monitoring and analysis of threat intelligence and dynamic perception of the network environment. Its main function is to continuously transform vulnerabilities and weaknesses in the system, making it difficult for attackers to determine the entrance to the real system, thereby increasing the difficulty and complexity of the attack. By obtaining the latest threat intelligence information and combining it with real-time network environment data, the unit can quickly identify and analyze vulnerabilities and weaknesses in the system, and simulate these vulnerabilities and weaknesses by creating virtual machines or containers to keep them changing.

[0062] Traffic monitoring unit: This unit is used to monitor and analyze network traffic in real time to identify abnormal traffic and potential attack behaviors. Through traffic monitoring tools or devices, this unit can monitor and capture network traffic and compare and analyze traffic data. Using machine learning and statistical analysis algorithms, this unit can learn and model the patterns and characteristics of attack behaviors. By monitoring and analyzing network traffic in real time, this unit can improve the accuracy and efficiency of network security defense.

[0063] Target trapping unit: This unit is used to build attractive fake targets and simulate vulnerabilities and weaknesses in real systems. By setting up monitoring and recording mechanisms, the unit can monitor and record the attacker's behavior of entering the fake target and obtain the attacker's behavioral characteristics and attack methods. This can further understand the attacker's strategies and techniques and optimize network security defense strategies. By trapping attackers and obtaining their behavior information, the unit can improve the system's perception and response capabilities to attack behaviors.

[0064] Response Analysis Unit: This unit is used to analyze the monitored attack behavior data, quickly identify and respond to potential threats. By establishing attack behavior models and rules, this unit can accurately identify and block unknown attack behaviors. Based on real-time monitoring of attack behaviors, this unit uses artificial intelligence and machine learning algorithms to process and analyze attack behavior data to quickly identify potential threats. At the same time, by updating the threat intelligence library and defense strategies, this unit can further improve the effectiveness of network security defense.

[0065] Through the integration of vulnerability conversion units, traffic monitoring units, target trapping units and response analysis units, the system can improve the security and defense capabilities of the network, realize intelligent perception, identification and blocking of various attack behaviors, thereby protecting the enterprise's system and data security.

[0066] The specific implementation of the above-mentioned units can be found in the method embodiment described above, which will not be repeated here.

[0067] The attack trapping method based on adaptive conversion of network attack surface of the present invention effectively copes with the problems existing in traditional defense. Through technical means such as dynamic vulnerability conversion, false target trapping and response analysis, it makes up for the problems of insufficient static defense capability, asymmetry between defense and attack, and difficulty in accurately identifying attack behaviors, and improves the capability and effect of network security. Through this comprehensive defense strategy, the capability and effect of network security can be improved, and new unknown attacks and variant attacks can be effectively dealt with. Not only can the difficulty and complexity of attacks be increased, but also unknown attack behaviors can be timely identified and prevented, network security defense strategies can be optimized, and the ability to cope with new attacks and threats can be improved.

[0068] The specific embodiments described above further illustrate the objectives, technical solutions and beneficial effects of the present invention in detail. It should be understood that the above description is only a specific embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the protection scope of the present invention.

Claims

1. An attack trapping method based on adaptive conversion of network attack surface, characterized in that: The method comprises the following steps: Step 1: Abnormal traffic monitoring and dynamic vulnerability conversion: Real-time monitoring and analysis of network traffic, identification of abnormal traffic and potential attack behaviors, dynamic perception of the network environment, simulation of vulnerabilities and weaknesses in the real system and continuous updating of vulnerabilities and weaknesses in the system; Step 2: False target trapping: Construct an attractive false target, and obtain the attacker's behavioral characteristics by monitoring and recording the attacker's behavior of entering the false target; Step 3: Response analysis: Analyze the monitored attack behavior feature data to quickly identify and respond to potential attack behaviors.

2. The attack trapping method based on network attack surface adaptive conversion according to claim 1 is characterized in that: The abnormal flow monitoring in step 1 includes: Use traffic monitoring tools or devices to monitor and capture network traffic in real time; Compare the real-time monitored traffic data with the normal traffic behavior model to identify abnormal traffic that is inconsistent with the normal traffic pattern, indicating potential attack behavior; Extract the characteristics of potential attack behaviors from abnormal traffic.

3. The attack trapping method based on network attack surface adaptive conversion according to claim 2 is characterized in that: The traffic monitoring tool or device includes an intrusion detection system IDS and a network traffic analysis tool. The detection of abnormal traffic is identified through machine learning or statistical analysis algorithms. The characteristics of the attack behavior include network protocol anomalies, request frequency anomalies, and data packet size anomalies.

4. The attack trapping method based on network attack surface adaptive conversion according to claim 1 is characterized in that: The dynamic vulnerability conversion in step 1 includes: Real-time monitoring and analysis of threat intelligence: Collect the latest threat intelligence information through information collection tools and analyze it; Dynamically perceive the network environment: Use network monitoring tools and sensors to obtain real-time environmental data in the network, and combine the analysis results of threat intelligence information to identify possible vulnerabilities and weaknesses in the network; Convert vulnerabilities and weaknesses: Create multiple virtual machines or containers and deploy different operating systems, network configurations, and application versions in them to simulate vulnerabilities and weaknesses in real systems. Update and convert the multiple virtual machines or containers to keep the vulnerabilities and weaknesses changing.

5. The attack trapping method based on network attack surface adaptive conversion according to claim 4 is characterized in that: The information collection tools include web crawlers and threat intelligence sharing platforms. The real-time environment data include traffic and device information. The creation of the multiple virtual machines or containers is achieved through virtualization technology or containerization technology.

6. The attack trapping method based on network attack surface adaptive conversion according to claim 1 is characterized in that: The false target trapping in step 2 includes: Constructing fake targets: Creating attractive fake targets based on threat intelligence information and the characteristics of the real system, and constructing corresponding fake target environments for different attack types and attacker targets; Monitor and record attack behavior: Set up a monitoring and recording mechanism in the fake target environment to monitor and record the attacker's behavior of entering the fake target in real time; Attack behavior analysis: Analyze the monitored attack behavior data, extract the attacker's behavior information, and obtain the attack behavior characteristics.

7. The attack trapping method based on network attack surface adaptive conversion according to claim 6 is characterized in that: The false targets include virtual machines and network services, the recording mechanisms include network logs, system logs, and operation logs, and the attacker's behavior information includes behavior characteristics, attack methods, and tools used.

8. The attack trapping method based on network attack surface adaptive conversion according to claim 1 is characterized in that: The response analysis in step 3 includes: Data analysis: Use machine learning and data analysis algorithms to process and analyze the monitored attack behavior data and establish attack behavior models and rules; Attack identification and prevention: Apply established attack behavior models and rules to real-time attack traffic and match them with known attack features to identify and prevent attack behaviors; Threat intelligence update: Use the results of response analysis to update the threat intelligence library and defense strategy.

9. Attack trapping system based on adaptive conversion of network attack surface, characterized in that: The following units are included: Traffic monitoring unit: used to monitor and analyze network traffic in real time and identify abnormal traffic and potential attack behaviors; Dynamic vulnerability conversion unit: used for real-time monitoring and dynamic perception of the network environment, simulating vulnerabilities and weaknesses in the real system and continuously updating the vulnerabilities and weaknesses in the system; False target trapping unit: used to build an attractive false target, and obtain the attacker's behavioral characteristics by monitoring and recording the attacker's behavior of entering the false target; Response Analysis Unit: used to analyze the monitored attack behavior data and quickly identify and respond to potential threats.

Images