Honey spot anti-aging method and system based on digital twinning

Abstract

The invention provides a honey spot anti-aging method and system based on digital twinning. The method comprises the following steps: collecting historical original data of a target network and equipment; constructing an initial digital twinborn model, and training the initial twinborn model according to the historical original data to obtain a trained digital twinborn model; obtaining current original data of the target network and equipment, inputting the current original data into the current original data so as to output an event analysis result corresponding to the current original data, and generating and deploying a honey point according to the event analysis result corresponding to the current original data; judging whether the deployed honey points meet preset conditions of aging honey points or not; and if the preset condition of the aged honey point is met, performing anti-aging operation on the aged honey point. According to the invention, the flexibility, adaptability and resource utilization efficiency of a network security system can be obviously improved.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a honey spot anti-aging method and system based on digital twins. Background Art

[0002] As security threats continue to evolve and become more complex, security teams need to develop new defense systems and solutions to protect network assets. This requires security systems to be more intelligent and flexible to effectively identify and defend against new attacks. This need is particularly urgent in digital twin systems, because these systems rely on the continuous collection and analysis of large amounts of real-time data from their physical counterparts, including sensitive operational information and personal data. If this data is not properly encrypted and protected during transmission or storage, there is a risk of unauthorized access or leakage, which may lead to serious consequences. In addition, digital twin systems contain multiple interconnected components and services, and each expansion of the system may introduce new security vulnerabilities. For example, if there are defects in the design or configuration of interfaces or APIs, they may become potential attack channels. Therefore, ensuring the security of digital twin systems requires a series of maintenance measures, such as regular technology updates, system testing, and security audits. Although these measures are essential to maintaining system security, they may also introduce new vulnerabilities or expose existing risks during implementation. Technology updates may involve software patches, system upgrades, or hardware replacements to fix known vulnerabilities, improve system performance, or add new features.

[0003] However, existing network security measures mainly rely on static protection mechanisms and manual maintenance, which are difficult to adapt to the rapidly changing network environment and new and complex attack methods. At the same time, since manual intervention is required for system updates and configuration management, the process is cumbersome and prone to operational errors, resulting in low resource utilization and new security vulnerabilities, making it difficult to achieve continuous and efficient defense. Summary of the invention

[0004] The purpose of the present invention is to provide a honey spot anti-aging method and system based on digital twins, aiming to solve the problem that due to the static nature and lack of flexibility of traditional network security technology, it is difficult to adapt to the rapidly changing network environment and new and complex attack methods, and the maintenance and update process is cumbersome and easy to introduce new security vulnerabilities, resource utilization efficiency is low, and it is difficult to achieve continuous and efficient defense.

[0005] In a first aspect, the present invention provides a honey spot anti-aging method based on digital twins, the method comprising:

[0006] Collecting historical raw data of the target network and device, wherein the historical raw data includes at least one of network traffic data, system and application logs, device status information, and user behavior data;

[0007] Constructing an initial digital twin model, and training the initial virtual model according to the historical original data to obtain a trained digital twin model;

[0008] Acquire current raw data of the target network and device, and input the current raw data into the current raw data to output event analysis results corresponding to the current raw data, and generate and deploy honey spots according to the event analysis results corresponding to the current raw data;

[0009] Determine whether the deployed honey spots meet the preset conditions for aging honey spots;

[0010] If the preset conditions of the aging honey spot are met, an anti-aging operation is performed on the aging honey spot.

[0011] Furthermore, after the step of collecting the historical raw data of the target network and the device, the step further includes:

[0012] De-noising and formatting the historical original data in sequence to obtain formatted historical original data;

[0013] Extract key fields from the formatted historical raw data, where the key fields include timestamp, user name, IP address, and event description;

[0014] The historical original data is analyzed according to the key fields to obtain event analysis results.

[0015] Furthermore, the steps of constructing an initial digital twin model and training the initial virtual model according to the historical original data to obtain a trained digital twin model include:

[0016] The event description is annotated according to the event analysis result, and a data set is constructed according to the annotated result, and the initial digital twin model is trained according to the data set to obtain a trained digital twin model.

[0017] Furthermore, the steps of obtaining the current raw data of the target network and the device, inputting the current raw data into the current raw data to output the event analysis result corresponding to the current raw data, and generating and deploying the honey spot according to the event analysis result corresponding to the current raw data include:

[0018] Obtain network traffic patterns, user behavior patterns, and attack pattern characteristics based on the event analysis results;

[0019] Identify suspicious traffic according to the network traffic pattern, generate a honey spot corresponding to the suspicious traffic, and deploy the honey spot corresponding to the suspicious traffic at a location close to a target of the suspicious traffic;

[0020] Identify abnormal users with abnormal behaviors according to the user behavior pattern, and deploy honey spots near the systems or resources that the abnormal users attempt to access;

[0021] A corresponding honey spot is generated according to the attack pattern feature, and the honey spot corresponding to the attack pattern feature is deployed in an area that the attacker is concerned about.

[0022] Furthermore, the preset conditions include that the service corresponding to the original sweet spot is modified, or the difference in attack frequency of the sweet spot in adjacent monitoring cycles is less than a first preset threshold, or the difference in attack frequency of the sweet spot in adjacent monitoring cycles is greater than a second preset threshold.

[0023] Furthermore, if the preset condition of the aging sweet spot is met, the step of performing an anti-aging operation on the aging sweet spot includes:

[0024] If the honey point after deployment meets the service modification, the service image with the same version as the current digital twin model is searched and downloaded to the local server, the service image is modified using a script, a new honey point is generated using the bu ild instruction, and the new honey point is stored in the honey point warehouse, and the new honey point is called from the honey point warehouse for deployment.

[0025] Furthermore, if the preset condition of the aging sweet spot is met, the step of performing an anti-aging operation on the aging sweet spot includes:

[0026] If the deployed honey spot meets the requirement that the attack frequency is significantly reduced, the honey spot is deleted and the same service image is re-called from the honey spot warehouse as a new honey spot for replenishment;

[0027] If the frequency of attacking and being attacked of the deployed honey spot increases significantly, the service of the honey spot is modified at a first preset time interval.

[0028] In a second aspect, the present invention provides a honey spot anti-aging system based on digital twins, the system comprising:

[0029] A data collection module, used to collect historical raw data of target networks and devices, wherein the historical raw data includes at least one of network traffic data, system and application logs, device status information, and user behavior data;

[0030] A model building module, used to build an initial digital twin model, and train the initial virtual model according to the historical original data to obtain a trained digital twin model;

[0031] A honey spot deployment module, used to obtain current raw data of the target network and the device, and input the current raw data into the current raw data to output an event analysis result corresponding to the current raw data, and generate and deploy a honey spot according to the event analysis result corresponding to the current raw data;

[0032] An aging honey spot detection module is used to determine whether a deployed honey spot meets the preset conditions of an aging honey spot;

[0033] The anti-aging operation execution module is used to execute the anti-aging operation on the aging honey spot if the preset conditions of the aging honey spot are met.

[0034] In a third aspect, the present invention provides a readable storage medium, which stores one or more programs, which, when executed by a processor, implement the above-mentioned honey spot anti-aging method based on digital twins.

[0035] In a fourth aspect, the present invention provides a computer device, the computer device comprising a memory and a processor, wherein:

[0036] The memory is used to store computer programs;

[0037] When the processor is used to execute the computer program stored in the memory, the above-mentioned honey spot anti-aging method based on digital twin is implemented.

[0038] In summary, the embodiments of the present invention significantly improve the flexibility, adaptability and resource utilization efficiency of the network security system by combining deception defense theory, Docker technology, SDN and other technologies, while reducing the complexity of maintenance, and realizing intelligent defense against advanced persistent threats. It has high innovation and practical value. At the same time, the beneficial effects of the embodiments of the present invention specifically include:

[0039] 1. The embodiments of the present invention can automatically adjust and optimize defense strategies. This dynamic adaptive capability enables the system to not only respond to currently known threats, but also predict and prevent potential risks that are about to emerge. In addition, the honey spot anti-aging method in the embodiments of the present invention does not need to rely on frequent manual intervention, and can continuously learn and adapt to new attack patterns, thereby ensuring continuous and efficient protection in the face of unknown and ever-changing attacks. In addition, through this adaptive mechanism, the system can also better manage and allocate security resources to ensure rapid response when needed, thereby greatly improving the security and stability of the entire network.

[0040] 2. In the traditional network security framework, system maintenance usually involves complex manual processes such as regular software updates, patching and configuration management, which are not only time-consuming but also prone to introducing new security vulnerabilities due to human errors. The honey spot anti-aging method of the present invention adopts an automated update and configuration management mechanism, which enables the system to automatically detect new security vulnerabilities and necessary system upgrades, and automatically apply corresponding patches and updates without human intervention.

[0041] 3. The present invention adopts digital twin technology to create and maintain a dynamic virtual image (digital twin model), which can reflect the status of the physical network environment in real time. This makes the system more flexible than traditional static security measures and can better adapt to changes in the network environment and new attack methods, thereby improving overall defense capabilities.

[0042] 4. The present invention realizes centralized control and automated management of network resources by utilizing SDN technology, thereby reducing the need for manual intervention, reducing the complexity of system maintenance, and reducing the risk of manual operation errors. At the same time, the honey spot anti-aging method of the present invention generates and deploys honey spots based on real-time data, avoiding the waste of resources and identification risks caused by the long-term static existence of traditional honey spots. By dynamically generating and adjusting the configuration of honey spots, the system can more efficiently utilize network resources and ensure continuous and efficient security protection. In addition, by collecting and analyzing a variety of data in the network environment, accurate real-time intelligence is provided to the system. Combined with the anti-aging technology of honey spots, the system can quickly respond to potential threats, automatically generate and deploy honey spots, and achieve effective defense against unknown threats.

[0043] 5. The present invention can dynamically adjust the configuration and deployment strategy of the honey spots, maintain the effectiveness and freshness of the honey spots, and enable the system to intelligently respond to advanced persistent threats and other complex attacks, thereby improving the overall intelligence level of security protection. By adopting the honey spot warehouse and automated generation technology, the present invention can also create a complex trapping environment to attract and capture attacker behavior, reduce the risk exposure of real assets, and provide the security team with detailed attack behavior data, which helps to improve defense strategies and enhance threat detection capabilities. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] Figure 1 This is a flow chart of a honey spot anti-aging method based on digital twins proposed in one embodiment of the present invention;

[0045] Figure 2 It is a structural schematic diagram of a honey spot anti-aging system based on digital twin proposed in one embodiment of the present invention.

[0046] The following specific implementation manner will further illustrate the present invention in conjunction with the above-mentioned drawings. DETAILED DESCRIPTION

[0047] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention. Unless otherwise defined, the technical terms or scientific terms used herein should be understood by people with general skills in the field to which the present invention belongs. "Including" and similar words used in this article mean that the elements or objects appearing before the word include the elements or objects listed after the word and their equivalents, without excluding other elements or objects.

[0048] About the Technology The term "digital twin" refers to an advanced simulation technology that creates a virtual model of a physical object, process, or system to simulate its real-world counterpart. This virtual model integrates real-time and historical data from its physical twin, allowing users to test, analyze, and predict in a safe virtual environment to optimize operations, improve efficiency, predict maintenance needs, and enhance understanding of real-world systems. Digital twins are widely used in a variety of fields such as manufacturing, construction, healthcare, and urban planning, providing decision makers with a powerful tool to monitor, maintain, and improve the performance of systems or products in real time, efficiently, and accurately.

[0049] About the technical term "deception defense" refers to an advanced network security strategy that deceives and lures attackers into a controlled environment instead of real system resources by creating baits (such as honeypots, virtual services, fake files, etc.). This method actively induces attackers to expose their behavior patterns and attack techniques, allowing security teams to monitor, analyze and understand attackers' behavior and collect key security intelligence without endangering the main system. By establishing these seemingly vulnerable but closely monitored resources, deception defense can not only reduce the risk exposure of real assets, but also provide real-time data for counterattack strategies, and improve the intelligence and responsiveness of the overall security architecture. Through this strategy, organizations can more proactively defend against complex threats such as APTs and insider threats, and enhance the initiative and adaptability of the security posture.

[0050] About the technical term "SDN" refers to an innovative network architecture that separates the network control layer from traditional physical devices and centralizes the control functions to a central control point, namely the SDN controller. This design allows network administrators to dynamically configure, manage, and optimize network resources through software applications without directly intervening in hardware devices, thereby improving the flexibility and programmability of the network. SDN greatly simplifies network design and operation, supports more flexible traffic management and efficient data flow, and provides strong technical support for network virtualization and automation. Through centralized control and automated network management, SDN helps to better cope with rapidly changing network requirements and complex network security challenges.

[0051] About the technical term "honeypot" refers to a security mechanism used to set up seemingly attractive but actually controlled and monitored network or system resources, with the purpose of trapping and analyzing unauthorized or malicious network behavior. As an active defense tool, honeypots are designed in various forms, such as simulating operating systems, databases, websites or other network services with security vulnerabilities to attract hackers or automated malware. Honeypots appear to be a valuable target for attackers, but in fact they are isolated and do not contain any production data, thereby exposing attackers' attack techniques and strategies without knowing it. In this way, honeypots help security teams collect detailed information about the source, method and behavior of attacks, thereby improving security protection measures, enhancing threat detection capabilities and optimizing response strategies. Honeypots provide a risk-free environment to study new and unknown threats and are one of the indispensable tools in network security practice.

[0052] Honeypots can be divided into three types according to the degree of interaction with attackers: low interaction, medium interaction, and high interaction. Each type has its own unique characteristics and uses:

[0053] 1. Low-interaction honeypot

[0054] Low-interaction honeypots are simple in design and are mainly used to simulate network services or ports that are vulnerable to attacks, such as open FTP, Telnet, or Web services. This type of honeypot is designed to attract attackers and collect basic attack information, such as the type of attack, source, and tools used. Low-interaction honeypots usually do not run actual operating systems or applications, but track the behavior of attackers through network monitoring and logging functions. Doing so can effectively record attack activities while keeping the system low in complexity and high in efficiency.

[0055] 2. Medium Interaction Honeypot

[0056] Medium-interaction honeypots provide more complex interaction capabilities, usually with simulated complete operating systems and various application environments to attract attackers to conduct in-depth detection and attack activities. This type of honeypot is equipped with a variety of services and resources that attackers may seek, such as email servers, databases, or file sharing systems. Compared with low-interaction honeypots, medium-interaction honeypots can provide richer information and reveal the attacker's intentions and strategies in more detail, thereby effectively inducing and recording complex attack behaviors.

[0057] 3. High-interaction honeypot

[0058] High-interaction honeypots represent the most complex and realistic form of honeypot technology, completely recreating a real operating environment, including fully functional operating systems, applications, and data. These honeypots provide users with an experience that is extremely similar to the actual environment, making it difficult for attackers to distinguish between them and the real system. In such a honeypot, attackers may launch a complete attack campaign, including penetration testing, exploiting security vulnerabilities, and stealing data. Because high-interaction honeypots can provide extremely detailed attack data and behavioral analysis, they are considered to be extremely valuable network security tools.

[0059] See also Figure 1 , which is a flow chart of a honey spot anti-aging method based on digital twins provided by an embodiment of the present invention, the method comprises steps S101 to S105, wherein:

[0060] Step S101: Collecting historical raw data of the target network and device, wherein the historical raw data includes at least one of network traffic data, system and application logs, device status information, and user behavior data;

[0061] It should be noted that the historical raw data is key real-time data collected from various network environments and devices, including but not limited to network traffic data, system and application logs, device status information, and user behavior data. For example, for application logs, it can be the operating status and events of software such as operating systems and applications. For example, the system log of a Linux server records the user login situation, Aug 10 12:34:56myserver sshd

[12345] :Accepted password for user1 from 192.168.1.101port34567ssh2. This records that user user1 successfully logged into the server via SSH from IP address 192.168.1.101 at 12:34:56.

[0062] Specifically, data is collected by using advanced monitoring tools and sensor technology to ensure the comprehensiveness and accuracy of the data. The collected data is preprocessed, such as denoising and formatting, to obtain formatted historical raw data; key fields are extracted from the formatted historical raw data, and the key fields include timestamp, user name, IP address and event description; the historical raw data is analyzed according to the key fields to obtain event analysis results.

[0063] For example, the historical raw data collected is: Aug 10 12:34:56myserver sshd

[12345] :Accepted password for user1 from 192.168.1.101port 34567ssh2

[0064] Aug 10 12:34:57myserver kerne l:[123.456]Debug:System check comp lete

[0065] Aug 10 12:34:58myserver sshd

[12345] :Accepted password for user1from192.168.1.101port 34567ssh2

[0066] It can be seen that a debug information log is inserted in the two login events. During the denoising process, we can delete it and only keep the key login events.

[0067] The purpose of formatting is to standardize the log data and make it more consistent in structure for subsequent analysis. For example, key fields such as timestamp, user name, IP address, etc. can be extracted from the original data and replaced with structured data. For example:

[0068]

[0069] After formatting, log entries are parsed into structured JSON format, and all key information is extracted as separate fields for subsequent analysis and query.

[0070] The accurate collection and effective management of these data are the key to ensuring that the entire network security system can accurately reflect the network status and effectively respond to security threats.

[0071] Step S102: constructing an initial digital twin model, and training the initial virtual model according to the historical original data to obtain a trained digital twin model;

[0072] In this step, we first create a basic model corresponding to the physical entity in the virtual environment. This basic model is initially just a simple virtualized copy, similar to a static snapshot of the physical network, that is, the initial digital twin model is obtained, and the model is continuously updated using the collected data to ensure that it can accurately reflect the current state of the physical network environment. As time goes by, more historical raw data is continuously input into the digital twin model.

[0073] Specifically, the event description is annotated according to the event analysis result, and a data set is constructed according to the annotation result, and the initial digital twin model is trained according to the data set to obtain a trained digital twin model.

[0074] For example, a sensor's temperature reading continues to rise, indicating that the device may be overheating. This data is integrated into the virtual model (digital twin model) to update the status of the device. Through this highly synchronized data replication, the module can simulate and analyze potential security threats in a safe virtual environment, predict the possible impact of an attack, and test different defense strategies without risking the actual network.

[0075] In addition, digital twin models support complex data analysis and machine learning algorithms, which can provide an in-depth understanding of network behavior and anomalies, thereby identifying and responding to potential security incidents in advance, greatly enhancing the system's prevention and response capabilities.

[0076] For example, the event description is: the temperature of a controller A gradually rose from 70°C to 90°C in the past hour (the normal temperature should be below 60°C). The sensor data is transmitted to the digital twin module in real time, and the status of controller A in the virtual model is updated to "high temperature warning". A malicious traffic launched a large number of login attempts to controller B from IP address 192.168.1.50. This abnormal behavior was recorded and analyzed, and the event analysis result was "attacked". Therefore, the network status of controller B was marked as "attacked" in the virtual model.

[0077] In some embodiments, after obtaining the trained digital twin model, in order to continuously optimize the trained digital twin model, data generated in real time by the target network and device will be collected every second preset time. The data also includes but is not limited to network traffic data, system and application logs, device status information, and user behavior data. These data are then processed according to the preprocessing method of historical original data, and then input into the trained digital twin model for iterative update, thereby completing the fine-tuning optimization of the digital twin model. It should be noted that the purpose of setting the second preset time is to be able to continuously collect training data, and then continuously update the digital twin model over time, so as to further improve the model's ability to recognize abnormal behavior.

[0078] Step S103: obtaining current raw data of the target network and device, and inputting the current raw data into the current raw data to output an event analysis result corresponding to the current raw data, and generating and deploying a honey spot according to the event analysis result corresponding to the current raw data;

[0079] It should be noted that during the honey spot deployment process, the event analysis results also include the following three key features:

[0080] Network traffic patterns: Analysis includes information such as the source, target, protocol type, and traffic magnitude of the traffic. By observing normal traffic patterns in the network, identify which traffic sources may represent potential threats (such as a certain IP frequently accessing multiple different ports). At the same time, analyze whether there is abnormal traffic in the network, such as a surge in traffic in a short period of time or abnormal access frequency of certain IP addresses. Determine which traffic is suspicious or potentially malicious traffic and mark possible attack paths. For suspicious traffic, you can generate honey spots suitable for inducing the traffic (such as simulating vulnerable web servers). When deploying, you can place the honey spots in a location close to the target of the suspicious traffic to increase the attacker's chance of contacting the honey spots.

[0081] User behavior patterns: Analysis includes information such as user login behavior, access frequency, and operation type. The normal user's operating habits (such as usual login time, commonly used devices, etc.) are obtained, and operations that do not conform to normal behavior patterns are identified (such as logins at abnormal times, frequent failed login attempts, etc.). Finally, possible internal threats or signs of external attackers impersonating users are identified. For abnormal user behavior, honey spots can be deployed near systems or resources that these users may try to access, such as inducing attackers to enter a fake database or file system, and their operating behaviors are recorded.

[0082] Attack pattern features: Extract features including known attack behaviors (such as SQL injection, brute force cracking, etc.) and historical attack records to analyze attack behavior data in the digital twin model, and identify activities that match known attack features (such as frequent failed login attempts, abnormal access to specific ports, etc.). Based on the identified attack patterns, generate highly targeted honey spots (such as generating a false database honey spot for SQL injection attacks) and deploy them in areas that attackers may focus on.

[0083] Step S104: determining whether the deployed honey spot meets the preset conditions of the aging honey spot;

[0084] It should be pointed out that, in some embodiments, the preset conditions include that the service corresponding to the original sweet spot is modified (the service is modified), or the difference in attack frequency of the sweet spot in adjacent monitoring periods is less than a first preset threshold (the attack frequency is significantly reduced), or the difference in attack frequency of the sweet spot in adjacent monitoring periods is greater than a second preset threshold (the attack frequency is significantly increased). In other words, as long as the honey spot after deployment meets one of the preset conditions, the honey spot is considered to be an aging honey spot. Conversely, if the honey spot after deployment does not meet any of the three preset conditions, the honey spot is considered not to be an aging honey spot.

[0085] Step S105: If the preset conditions of the aging sweet spot are met, an anti-aging operation is performed on the aging sweet spot.

[0086] It should be pointed out that in the actual process of detecting honey spots, different anti-aging operations will be performed according to the preset conditions of different aging honey spots, as follows:

[0087] 1. For the honey points corresponding to the changes in the digital twin modules, if the old honey points are no longer applicable to the new services, the old honey points need to be deleted, and the python script is used to find the service image with the same version as the latest digital twin model from Dockerhub, and download it to the local server, and then use the script to modify the image to make it a honey point. Finally, use the build command to generate a new honey point and store it in the honey point warehouse, and then directly call the honey point from the warehouse for deployment. For example, in the digital twin model, a database honey point was originally deployed near a database. However, after the real system is modified, the virtual database in the digital twin also needs to be deleted. At this time, it will be judged that the original database honey point has lost its function, and the system will delete it and supplement the new honey point.

[0088] 2. For a honey spot whose attack frequency has significantly decreased recently, the system will determine that the honey spot has been discovered and has lost its reconnaissance significance. The system will delete the honey spot and call the same service image from the honey spot warehouse as a new honey spot to supplement it. For example, multiple honey spots are deployed in a corporate network to trap and analyze the behavior of attackers. The system continuously monitors the attack logs and activities of all honey spots and finds that the attack frequency of a honey spot has significantly decreased in the past few weeks. For example, there were dozens of attack attempts every day, but now there are only a few sporadic attempts. Analyze the attack log of the honey spot to confirm whether the decrease in attack frequency is a normal phenomenon (such as holidays, the activity cycle of the attacker, etc.) or an abnormal phenomenon (it may be that the honey spot has been discovered). If the frequency decrease is continuous and accompanied by signs that the attacker attempts to bypass the honey spot (such as trying to access a specific interface of the honey spot), it can be preliminarily determined that the honey spot may have been discovered. Then disconnect the honey spot from the network, stop its service, and clear the relevant configuration. For example, shut down a fake database service or a disguised server. Select an identical service image from the honey spot warehouse and configure a new honey spot as needed, such as setting a new fake database structure or updating the disguised server configuration.

[0089] 3. For honey spots whose attack frequency increases significantly, the system will regularly modify the services of the honey spots so that they provide different feedback to attackers in different time periods, delaying the time it takes for attackers to discover the honey spots. For example, multiple honey spots are deployed in a corporate network to trap and analyze attackers' behavior. Recently, some honey spots have been frequently attacked, so it is necessary to regularly modify the services of these honey spots to delay the time it takes for attackers to discover them. For example, regularly update the data content in the fake database. For example, change fake product information, prices, or user data every week or every day. Such changes can confuse attackers and make it difficult for them to determine whether the data is real. Or regularly modify the service configuration of the honey spot. For example, adjust the device status simulated by the honey spot to display different temperatures, vibrations, or operating parameters.

[0090] It should also be noted that in order to achieve automatic and sustainable aging detection of deployed honey spots, the honey spots must be deployed accordingly after they are generated. Generally, the aging honey spots are deleted and new honey spots are enabled to replace them. However, for networks that are frequently attacked, in order to prevent the aging of honey spots from being too fast, more honey spots will be automatically allocated to this network segment to slow down the aging of a single honey spot. After the deployment is completed, the system will continue to collect and analyze data on the honey spot logs, re-determine whether the honey spots are aged, and enter a cycle of creating non-aged honey spots.

[0091] In addition, in some optional embodiments, after the anti-aging operation is completed, the SDN controller will be initialized and the network management and control functions will be started. Subsequently, the data from the digital twin model and the honey spot anti-aging operation is received, including device status information, network traffic data, system logs, and honey spot information, which will be transmitted to the SDN controller for parsing. Then, the system will analyze the input traffic and use the parsed data to identify potential threats and traffic characteristics that need to be directed to the honey spot. According to the traffic analysis results, the SDN controller dynamically adjusts the network configuration, redirects potential attack traffic to the corresponding honey spot, and ensures effective capture of traffic by modifying traffic routing rules and adjusting access control policies.

[0092] For example, high-frequency requests, abnormal data packet content, etc. Potential attackers or malicious traffic are identified based on traffic characteristics. Normal request traffic does not need to be redirected to the honey spot, but the detected abnormal traffic will be redirected to the honey spot.

[0093] Regarding traffic routing rules, for example, redirecting traffic with source IP 192.168.1.10 to the honeypot 192.168.1.100 can be set using the flow table rules of the SDN controller. Update the flow table in the SDN controller to indicate that the traffic needs to be directed to the honeypot. The rules may include matching specific traffic features (such as IP address, port number) and forwarding them to the honeypot. For example: if (src_ip == 192.168.1.10 and dest_port == 80) then redi rect to 192.168.1.100;

[0094] Regarding access control policies, for example, you can set up whitelists to filter and redirect traffic. Regarding configuring firewall rules to allow traffic from specific IPs to enter the honeypot while blocking other traffic: Allow src_ip192.168.1.10,dest_ip 192.168.1.100,protocol TCP; Deny src_ip 10.0.0.0 / 8.

[0095] In addition, by re-instructing the deployment location and configuration of the honey spot based on the real-time analysis results, the honey spot is always in the best capture position to avoid being identified by attackers. Finally, the system continuously monitors the honey spot and network traffic, collects the attacker's behavior data and provides feedback to optimize the honey spot configuration and traffic control strategy, forming an adaptive and dynamic defense mechanism, thereby improving network security protection capabilities.

[0096] In summary, by analyzing network traffic in real time through SDN controllers and monitoring tools, we can learn about the attacker's activity range, attack mode, target, and the distribution of network traffic in various areas. Based on the real-time analysis results, we can identify traffic hotspots in the network, such as areas with large amounts of inbound traffic or frequent attack attempts. We can also determine the paths that attackers may try to attack, such as accessing sensitive services or bypassing defense areas.

[0097] Deploy honeypots to traffic hotspots or potential attack paths. For example, if analysis shows that attackers are concentrated in a certain subnet, you can deploy honeypots in that subnet.

[0098] In summary, the above-mentioned honey spot anti-aging method based on digital twins has the following advantages:

[0099] 1. The embodiments of the present invention can automatically adjust and optimize defense strategies. This dynamic adaptive capability enables the system to not only respond to currently known threats, but also predict and prevent potential risks that are about to emerge. In addition, the honey spot anti-aging method in the embodiments of the present invention does not need to rely on frequent manual intervention, and can continuously learn and adapt to new attack patterns, thereby ensuring continuous and efficient protection in the face of unknown and ever-changing attacks. In addition, through this adaptive mechanism, the system can also better manage and allocate security resources to ensure rapid response when needed, thereby greatly improving the security and stability of the entire network.

[0100] 2. In the traditional network security framework, system maintenance usually involves complex manual processes such as regular software updates, patching and configuration management, which are not only time-consuming but also prone to introducing new security vulnerabilities due to human errors. The honey spot anti-aging method of the present invention adopts an automated update and configuration management mechanism, which enables the system to automatically detect new security vulnerabilities and necessary system upgrades, and automatically apply corresponding patches and updates without human intervention.

[0101] 3. The present invention adopts digital twin technology to create and maintain a dynamic virtual image (digital twin model), which can reflect the status of the physical network environment in real time. This makes the system more flexible than traditional static security measures and can better adapt to changes in the network environment and new attack methods, thereby improving overall defense capabilities.

[0102] 4. The present invention realizes centralized control and automated management of network resources by utilizing SDN technology, thereby reducing the need for manual intervention, reducing the complexity of system maintenance, and reducing the risk of manual operation errors. At the same time, the honey spot anti-aging method of the present invention generates and deploys honey spots based on real-time data, avoiding the waste of resources and identification risks caused by the long-term static existence of traditional honey spots. By dynamically generating and adjusting the configuration of honey spots, the system can more efficiently utilize network resources and ensure continuous and efficient security protection. In addition, by collecting and analyzing a variety of data in the network environment, accurate real-time intelligence is provided to the system. Combined with the anti-aging technology of honey spots, the system can quickly respond to potential threats, automatically generate and deploy honey spots, and achieve effective defense against unknown threats.

[0103] 5. The present invention can dynamically adjust the configuration and deployment strategy of the honey spots, maintain the effectiveness and freshness of the honey spots, and enable the system to intelligently respond to advanced persistent threats and other complex attacks, thereby improving the overall intelligence level of security protection. By adopting the honey spot warehouse and automated generation technology, the present invention can also create a complex trapping environment to attract and capture attacker behavior, reduce the risk exposure of real assets, and provide the security team with detailed attack behavior data, which helps to improve defense strategies and enhance threat detection capabilities.

[0104] See also Figure 2 , which is a schematic diagram of the structure of a honey spot anti-aging system based on digital twins in one embodiment of the present invention, and the system includes:

[0105] A data collection module 10 is used to collect historical raw data of target networks and devices, wherein the historical raw data includes at least one of network traffic data, system and application logs, device status information, and user behavior data;

[0106] A model building module 20 is used to build an initial digital twin model and train the initial virtual model according to the historical original data to obtain a trained digital twin model;

[0107] A honey spot deployment module 30, for acquiring current raw data of a target network and a device, and inputting the current raw data into the current raw data to output an event analysis result corresponding to the current raw data, and generating and deploying a honey spot according to the event analysis result corresponding to the current raw data;

[0108] An aging honey spot detection module 40 is used to determine whether a deployed honey spot meets a preset condition of an aging honey spot;

[0109] The anti-aging operation execution module 50 is used to execute the anti-aging operation on the aging sweet spot if the preset condition of the aging sweet spot is met.

[0110] On the other hand, the present invention further proposes a readable storage medium having one or more programs stored thereon, which, when executed by a processor, implements the above-mentioned honey spot anti-aging method based on digital twins.

[0111] On the other hand, the present invention further proposes a computer device, including a memory and a processor, wherein the memory is used to store computer programs, and the processor is used to execute the computer programs stored in the memory to implement the above-mentioned honey spot anti-aging method based on digital twins.

[0112] Those skilled in the art will appreciate that the logic and / or steps represented in the flowchart or otherwise described herein, for example, may be considered as an ordered list of executable instructions for implementing logical functions, and may be embodied in any computer-readable medium for use by an instruction execution system, device or apparatus (such as a computer-based system, a system including a processor, or other system that can fetch instructions from an instruction execution system, device or apparatus and execute instructions), or in conjunction with such instruction execution systems, devices or apparatuses. For purposes of this specification, "computer-readable medium" may be any device that can contain, store, communicate, propagate or transmit a program for use by an instruction execution system, device or apparatus, or in conjunction with such instruction execution systems, devices or apparatuses.

[0113] More specific examples of computer-readable media (a non-exhaustive list) include the following: an electrical connection with one or more wires (electronic device), a portable computer disk case (magnetic device), a random access memory (RAM), a read-only memory (ROM), an erasable and programmable read-only memory (EPROM or flash memory), an optical fiber device, and a portable compact disk read-only memory (CDROM). In addition, the computer-readable medium may even be a paper or other suitable medium on which the program is printed, since the program may be obtained electronically, for example, by optically scanning the paper or other medium, followed by editing, deciphering or, if necessary, processing in another suitable manner, and then stored in a computer memory.

[0114] It should be understood that the various parts of the present invention can be implemented by hardware, software, firmware or a combination thereof. In the above-mentioned embodiments, a plurality of steps or methods can be implemented by software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented by hardware, as in another embodiment, it can be implemented by any one of the following technologies known in the art or a combination thereof: a discrete logic circuit having a logic gate circuit for implementing a logic function for a data signal, a dedicated integrated circuit having a suitable combination of logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc.

[0115] Although the embodiments of the present invention are described in detail above, it is obvious to those skilled in the art that various modifications and variations can be made to these embodiments. However, it should be understood that such modifications and variations are within the scope and spirit of the present invention as described in the claims. Moreover, the present invention described herein may have other embodiments and may be implemented or realized in a variety of ways.

Claims

1. A honey spot anti-aging method based on digital twins, characterized in that: The method comprises: Collecting historical raw data of the target network and device, wherein the historical raw data includes at least one of network traffic data, system and application logs, device status information, and user behavior data; Constructing an initial digital twin model, and training the initial virtual model according to the historical original data to obtain a trained digital twin model; Acquire current raw data of the target network and device, and input the current raw data into the current raw data to output event analysis results corresponding to the current raw data, and generate and deploy honey spots according to the event analysis results corresponding to the current raw data; Determine whether the deployed honey spots meet the preset conditions for aging honey spots; If the preset conditions of the aging honey spot are met, an anti-aging operation is performed on the aging honey spot.

2. The honey spot anti-aging method based on digital twin according to claim 1 is characterized in that: The step of collecting the historical raw data of the target network and the device further includes: De-noising and formatting the historical original data in sequence to obtain formatted historical original data; Extract key fields from the formatted historical raw data, where the key fields include timestamp, user name, IP address, and event description; The historical original data is analyzed according to the key fields to obtain event analysis results.

3. The honey spot anti-aging method based on digital twin according to claim 2 is characterized in that: The steps of constructing an initial digital twin model and training the initial virtual model according to the historical original data to obtain a trained digital twin model include: The event description is annotated according to the event analysis result, and a data set is constructed according to the annotated result, and the initial digital twin model is trained according to the data set to obtain a trained digital twin model.

4. The honey spot anti-aging method based on digital twin according to claim 3 is characterized in that: The steps of obtaining the current raw data of the target network and the device, inputting the current raw data into the current raw data to output the event analysis result corresponding to the current raw data, and generating and deploying the honey spot according to the event analysis result corresponding to the current raw data include: Obtain network traffic patterns, user behavior patterns, and attack pattern characteristics based on the event analysis results; Identify suspicious traffic according to the network traffic pattern, generate a honey spot corresponding to the suspicious traffic, and deploy the honey spot corresponding to the suspicious traffic at a location close to a target of the suspicious traffic; Identify abnormal users with abnormal behaviors according to the user behavior pattern, and deploy honey spots near the systems or resources that the abnormal users attempt to access; A corresponding honey spot is generated according to the attack pattern feature, and the honey spot corresponding to the attack pattern feature is deployed in an area that the attacker is concerned about.

5. The honey spot anti-aging method based on digital twin according to any one of claims 1 to 4, characterized in that: The preset conditions include that the service corresponding to the original sweet spot is modified, or the difference in attack frequency of the sweet spot in adjacent monitoring cycles is less than a first preset threshold, or the difference in attack frequency of the sweet spot in adjacent monitoring cycles is greater than a second preset threshold.

6. The honey spot anti-aging method based on digital twin according to claim 5 is characterized in that: If the preset conditions of the aging honey spot are met, the step of performing an anti-aging operation on the aging honey spot includes: If the honey point after deployment meets the service modification, search for the service image with the same version as the current digital twin model and download it to the local server, use the script to modify the service image, use the build instruction to generate a new honey point, and store the new honey point in the honey point warehouse, and call the new honey point from the honey point warehouse for deployment.

7. The honey spot anti-aging method based on digital twin according to claim 5 is characterized in that: If the preset conditions of the aging honey spot are met, the step of performing an anti-aging operation on the aging honey spot includes: If the frequency of attacks on the deployed honey spot is significantly reduced, the honey spot is deleted and the same service image is re-called from the honey spot warehouse as a new honey spot for replenishment; If the frequency of attacking and being attacked of the deployed honey spot increases significantly, the service of the honey spot is modified at a first preset time interval.

8. A honey spot anti-aging system based on digital twins, characterized in that: The system comprises: A data collection module, used to collect historical raw data of target networks and devices, wherein the historical raw data includes at least one of network traffic data, system and application logs, device status information, and user behavior data; A model building module, used to build an initial digital twin model, and train the initial virtual model according to the historical original data to obtain a trained digital twin model; A honey spot deployment module, used to obtain current raw data of the target network and the device, and input the current raw data into the current raw data to output an event analysis result corresponding to the current raw data, and generate and deploy a honey spot according to the event analysis result corresponding to the current raw data; An aging honey spot detection module is used to determine whether a deployed honey spot meets the preset conditions of an aging honey spot; The anti-aging operation execution module is used to execute the anti-aging operation on the aging honey spot if the preset conditions of the aging honey spot are met.

9. A readable storage medium, characterized in that: The readable storage medium stores one or more programs, which, when executed by a processor, implement the honey spot anti-aging method based on digital twins as described in any one of claims 1 to 7.

10. A computer device comprising a memory and a processor, wherein: The memory is used to store computer programs; When the processor is used to execute a computer program stored in the memory, it implements the honey spot anti-aging method based on digital twins as described in any one of claims 1 to 7.

Images