A tracing deterrence method and system based on floating code honeyhole

Abstract

The present invention provides a source tracing deterrence method based on a floating code honeyhole, which relates to the technical field of network security attack source tracing. The method comprises: capturing and processing network traffic to obtain multidimensional information; constructing an initial model, extracting multidimensional information features, and training the initial model to obtain a profile model; inputting a validation set into the profile model to generate an attacker profile; generating a honeyhole program based on the attacker profile and forcing the attacker to install it; simulating a real identity authentication scenario based on the honeyhole program to deter the attacker from accessing the attack; if the attacker continues to access the attack, the honeyhole program generates floating code based on the attacker's different attack stages and different attack methods, and updates the honeyhole program in the form of a hot patch for real-time monitoring and source tracing; collecting real-time information, performing source tracing analysis based on the deterrent events and real-time information, and generating a source tracing deterrence report. The present invention aims to improve the problems of existing technologies in terms of targeting, flexibility, real-timeness, and deterrence, thereby more effectively defending against and countering network attacks.

Description

Technical Field

[0001] The present invention relates to the technical field of network security attack tracing technology, and in particular to a tracing deterrence method and system based on a floating code honey hole. Background Art

[0002] As cyberattacks continue to evolve, particularly advanced persistent threats (APTs) and complex multi-stage attacks, which have become common security challenges, traditional network defense technologies are increasingly exposed to shortcomings. Attackers are often able to bypass traditional security measures such as firewalls and intrusion detection systems, infiltrating target networks and seeking opportunities to steal sensitive data or damage critical infrastructure.

[0003] To address this challenge, the concept of active defense emerged. Its core principle is to proactively interact with attackers, collect information about them, trace the source of the attack, and ultimately achieve effective countermeasures. Honeypot technology, as a proactive deception defense method, has been widely used and developed under the guidance of this active defense concept. By deploying decoy systems or services, honeypot technology can attract attackers to interact with them, thereby collecting information about the attacker, analyzing attack behavior, and tracing the source of the attack.

[0004] However, traditional honeypot tracing technology has obvious limitations: lack of targeting and flexibility, resulting in poor tracing efficiency and deterrence effect when facing complex and changing network attacks. Specifically:

[0005] (1) Existing technologies lack specificity, resulting in low traceability efficiency: Traditional traceability technologies usually rely on general rules and feature matching, which makes it difficult to conduct targeted analysis of the characteristics and attack stages of different attackers. This leads to the generalization of collected information, making it difficult to effectively identify the attacker's identity and attack intentions, thereby reducing traceability efficiency.

[0006] (2) Existing technologies lack flexibility and are difficult to adapt to complex attack scenarios: Traditional tracing technologies are difficult to dynamically adjust tracing strategies based on attacker behavior and attack stages. Faced with complex and changing attack scenarios, it is difficult to effectively collect and correlate attacker behavior information, which reduces the success rate of tracing.

[0007] (3) Existing tracing technology lacks real-time performance and is difficult to capture the attacker's real-time behavior: Traditional tracing technology often relies on post-analysis of logs and traffic data and cannot track the attacker's behavior in real time, which easily leads to missing the best tracing opportunity.

[0008] (4) Existing traceability technologies generally lack deterrent capabilities and are unable to effectively prevent attacks: Traditional traceability technologies are mainly aimed at post-event accountability and lack the ability to effectively intervene in and prevent ongoing attacks.

[0009] Therefore, it is urgent to develop a solution to improve the above problems. Summary of the Invention

[0010] The purpose of the present invention is to provide a traceability deterrence method and system based on floating code honeyholes, aiming to improve the problems of existing traceability technologies in terms of targeting, flexibility, real-timeness and deterrence capabilities, so as to more effectively defend and counter network attacks.

[0011] The present invention provides a source tracing deterrence method and system based on floating code honeyholes, which adopts the following technical solutions:

[0012] First, a source tracing deterrence method based on floating code honeyholes, specifically including:

[0013] Capture network traffic, extract information, and then preprocess to obtain multi-dimensional information;

[0014] Build an initial model, extract multi-dimensional information features and divide them into training set, test set and validation set. Train and test the initial model based on the training set and test set to obtain a profile model. Input the validation set into the profile model to generate an attacker profile.

[0015] Generate a honeyhole program based on the attacker's profile and force the attacker to install it. Use the honeyhole program to simulate real authentication scenarios to deter attackers from accessing the program. If the attacker continues to access the program, generate floating code based on the attacker's profile and package it into a hot patch. Use the hot patch to update the honeyhole program.

[0016] Based on the updated honeyhole program, attackers are monitored in real time and real-time information is collected. Based on deterrence events and real-time information, source tracing analysis is performed to generate a source tracing deterrence report.

[0017] The beneficial effects of the source tracing deterrence method based on floating code honeyhole provided by the present invention are:

[0018] (1) Dynamically generate and deliver targeted floating codes based on the attacker's characteristics and attack phase, thus achieving a floating code traceability mechanism that is tailored to each individual, thereby improving traceability efficiency and targeting.

[0019] (2) By forcibly installing the honeyhole program and dynamically updating the floating code using hot patch technology in the later stage, the flexibility and real-time performance of traceability are enhanced.

[0020] (3) Simulate real identity authentication scenarios, forcing attackers to provide identity credentials or install honeyhole programs, thereby increasing the cost of attack and the risk of tracing the source, effectively deterring attackers and causing them to voluntarily stop the attack.

[0021] (4) Achieve pre-emptive deterrence and post-incident tracing, thereby more effectively defending against and countering cyber attacks.

[0022] Optionally, network traffic is captured and pre-processed to extract information and obtain multi-dimensional information, including:

[0023] Capturing network traffic based on data acquisition devices deployed at the network edge, extracting information, cleaning the data, and formatting it to obtain multi-dimensional information, which is then stored in a database or other storage medium.

[0024] The multi-dimensional information includes: network environment information, system information, hardware fingerprint information and attack behavior information.

[0025] Optionally, the initial model is trained and tested based on the training set and the test set to obtain a portrait model, including:

[0026] Initialize the initial model parameters, input the training set into the initial model for forward propagation to obtain the predicted value, calculate the error between the predicted value and the true value and construct the cross-entropy loss function, minimize the loss function based on the gradient descent method, iteratively update the model parameters until the loss function tends to a stable value or the maximum number of iterations is reached to end the training, and evaluate and fine-tune the trained initial model based on the test set to obtain the portrait model.

[0027] Optionally, the validation set is fed into the profiling model to generate an attacker profile, including:

[0028] Based on the portrait model, the verification set is clustered and grouped and risk levels are divided, the correlation between different dimensions is mined, and the relationships are converted into quantifiable indicators to construct an attacker portrait.

[0029] Optionally, the portrait model includes a clustering module, a classification module and an association mining module; the clustering module is used to cluster and group the multidimensional information data, the classification module is used to divide the grouped data into risk levels, and the association mining module is used to mine the association relationship between different dimensions of the graded data and construct an attacker portrait.

[0030] Optionally, when a honeyhole program is generated based on an attacker's profile and the attacker is required to forcibly install it, in order to force the attacker to install the honeyhole program, the system will intercept suspicious access requests and require the user to install the honeyhole program in various ways before continuing to access.

[0031] Optionally, when the attacker continues to access, a floating code is generated based on the attacker's profile and packaged into a hot patch. The honeyhole program is updated based on the hot patch, including:

[0032] Different tracing functions are encapsulated into independent code modules including information collection module, keyboard recording module, and screenshot module. Different independent code modules are selected and combined according to the attacker profile and attack stage, and the code is obfuscated to generate the final floating code. The floating code is packaged into a hot patch file, and the honeyhole program is updated based on the hot patch technology.

[0033] Optionally, when the honeyhole program is updated based on hot patch technology, the honeyhole program utilizes hot patch technology to dynamically load the floating code into the program and execute it without the user restarting the program. The updated honeyhole program records user information in real time and uploads the recorded user data to the server.

[0034] Optionally, conduct source tracing analysis based on deterrence events and real-time information to generate a source tracing deterrence report, including:

[0035] Based on deterrence events and real-time information, the attacker's behavior trajectory is restored to identify the attacker's identity, motives, and attack methods. A traceability report is generated by combining data from an open source threat intelligence platform. Ultimately, a traceability deterrence report is generated that includes both the deterrence events and the traceability report.

[0036] The deterrent event includes refusing to provide identity credentials or refusing to install a honeyhole program, and the real-time information includes visited web pages, executed commands, and keyboard records.

[0037] The second aspect is a traceability deterrence system based on floating code honeyholes, which specifically includes:

[0038] The data processing module is used to capture network traffic, extract information, and then pre-process it to obtain multi-dimensional information;

[0039] The portrait generation module is used to build an initial model, extract multi-dimensional information features and divide them into training, test and validation sets. The initial model is trained and tested based on the training and test sets to obtain a portrait model. The validation set is input into the portrait model to generate an attacker portrait.

[0040] The honeyhole program tracing module generates a honeyhole program based on the attacker's profile and forces the attacker to install it. The honeyhole program simulates real authentication scenarios to deter attackers from accessing the program. If the attacker continues to access the program, floating code is generated based on the attacker's profile and packaged into a hot patch. The hot patch is then used to update the honeyhole program.

[0041] The data analysis module monitors attackers in real time and collects real-time information based on the updated honeyhole program, performs source tracing analysis based on deterrence events and real-time information, and generates a source tracing deterrence report.

[0042] The beneficial effects of the second aspect can refer to the description of the first aspect. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] Figure 1 A flowchart of the overall steps of a source tracing deterrence method based on a floating code honeyhole provided by the present invention;

[0044] Figure 2 A schematic diagram of the data processing module flow of a traceability deterrence system based on a floating code honeyhole provided by the present invention;

[0045] Figure 3 A schematic flow chart of the honeyhole program tracing module of a tracing deterrence system based on a floating code honeyhole provided by the present invention. DETAILED DESCRIPTION

[0046] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention. Unless otherwise defined, the technical terms or scientific terms used herein should be the common meanings understood by people with ordinary skills in the field to which the invention belongs. The words "including" and similar words used in this article mean that the elements or objects appearing before the word cover the elements or objects listed after the word and their equivalents, without excluding other elements or objects.

[0047] Definition of noun:

[0048] 1) A honeyhole is an attack deterrence and tracing system deployed in a real network close to the attacker. When it detects abnormal user access, it uses edge multi-level identity authentication or tracing to authenticate the user, such as requesting identity credentials or requiring them to download and execute specific executable code. The honeyhole's purpose is to deter attackers by increasing the cost of attacks and the risk of tracing their source, forcing them to cease their attacks.

[0049] 2) Hot patching is a technology that dynamically repairs or updates programs without restarting the application or system. It achieves dynamic updates by loading modified code snippets into the runtime environment and injecting them into the target program's memory, replacing or modifying the original code. Hot patching offers advantages such as no restart required, fast response, and flexible scalability.

[0050] The embodiment of the present invention provides a source tracing deterrence method based on floating code honeyhole, see Figure 1 , including the following steps:

[0051] S1, capture network traffic, extract information, and then preprocess to obtain multi-dimensional information;

[0052] S2. Build an initial model, extract multidimensional information features and divide them into training, test, and validation sets. Train and test the initial model based on the training and test sets to obtain a profile model. Input the validation set into the profile model to generate an attacker profile.

[0053] S3: Generate a honeyhole program based on the attacker's profile and force the attacker to install it. Use the honeyhole program to simulate a real authentication scenario to deter the attacker from accessing the program. If the attacker continues to access the program, generate floating code based on the attacker's profile and package it into a hot patch. Use the hot patch to update the honeyhole program.

[0054] S4. Based on the updated honeyhole program, the attacker is traced and monitored in real time to collect real-time information. Based on the deterrence events and real-time information, the attacker is traced and analyzed to generate a traceability deterrence report.

[0055] In some embodiments, see Figure 2 When executing step S1, network traffic is captured, information is extracted, and then preprocessed to obtain multi-dimensional information, including:

[0056] S1-1, capturing network traffic based on data collection devices deployed at the network edge;

[0057] S1-2, after information extraction, data cleaning and formatting are performed to obtain multidimensional information;

[0058] S1-3, storing the multidimensional information in a database or other storage medium;

[0059] Specifically, when executing step S1-1, a honeypot is deployed at a network boundary or in an internal network to capture network traffic.

[0060] Specifically, when executing step S1-2, the multi-dimensional information includes: network environment information, system information, hardware fingerprint information and attack behavior information.

[0061] Furthermore, network environment information, including the attacker's IP address, geographic location, network operator, DNS server, etc., is used to identify the attacker's source and network environment characteristics; system information, including the operating system type, version, patch level, browser type and version, installed software list, etc. used by the attacker, is used to identify the vulnerabilities and configuration information of the attacker's system; hardware fingerprint information, including the CPU model, memory size, hard disk serial number, graphics card model, etc. used by the attacker, is used to identify the unique identifier of the attacker's device; attack behavior information, including the attacker's access frequency, access path, attack tools used, target system attacked, etc., is used to identify the attacker's attack intentions and attack methods.

[0062] Specifically, when executing step S1-3, the database includes: a relational database, a NoSQL database, an in-memory database, and a distributed database.

[0063] In some embodiments, executing step S2 includes:

[0064] S2-1. Build an initial model, extract multidimensional information features and divide them into training set, test set and validation set. Train and test the initial model based on the training set and test set to obtain a portrait model.

[0065] S2-2. Input the verification set into the portrait model to generate the attacker portrait.

[0066] Specifically, when executing step S2-1, the initial model is trained and tested based on the training set and the test set to obtain the portrait model, including:

[0067] Initialize the initial model parameters, input the training set into the initial model for forward propagation to obtain the predicted value, calculate the error between the predicted value and the true value and construct the cross-entropy loss function, minimize the loss function based on the gradient descent method, iteratively update the model parameters until the loss function tends to a stable value or the maximum number of iterations is reached to end the training, and evaluate and fine-tune the trained initial model based on the test set to obtain the portrait model.

[0068] Specifically, when executing step S2-2, the verification set is input into the portrait model to generate the attacker portrait, including:

[0069] Based on the portrait model, the verification set is clustered and grouped and risk levels are divided, the correlation between different dimensions is mined, and the relationships are converted into quantifiable indicators to construct an attacker portrait.

[0070] In fact, the portrait model includes a clustering module, a classification module and an association mining module; the clustering module is used to cluster and group the multidimensional information data, the classification module is used to divide the grouped data into risk levels, and the association mining module is used to mine the association relationship between different dimensions of the graded data and construct an attacker portrait.

[0071] Furthermore, the clustering module uses the K-means clustering algorithm to group attackers with similar characteristics to form different attacker groups; the classification module uses the decision tree classification algorithm to divide attackers into different risk levels based on the degree of harm caused by the attack behavior and the attacker's technical level; the association mining module uses the Apriori association rule mining algorithm to mine the association relationship between information of different dimensions, such as the association relationship between attack tools and attack targets, so as to more comprehensively characterize the attacker's characteristics.

[0072] In some embodiments, when executing step S3, it specifically includes:

[0073] S3-1. Generate a honeyhole program based on the attacker's profile and force the attacker to install it.

[0074] S3-2, using the honeyhole program to simulate real authentication scenarios to deter attackers from accessing;

[0075] S3-3. When the attacker continues to access, a floating code is generated based on the attacker's profile and packaged into a hot patch, and the honeyhole program is updated based on the hot patch.

[0076] Specifically, when executing step S3-1, a honeyhole program is generated based on the attacker's portrait and the attacker is required to forcibly install it. In order to force the attacker to install the honeyhole program, the system will intercept suspicious access requests and require the user to install the honeyhole program in various ways before continuing to access.

[0077] Furthermore, the honeyhole program includes basic information collection functions and is small in size, aiming to reduce the vigilance of attackers and increase the possibility of their installation; at the same time, this honeyhole program also serves as the basic framework for subsequent hot patch updates.

[0078] Furthermore, the system interception method includes: popping up a prompt box, redirecting a web page, or disguising the honeyhole program as a necessary software component.

[0079] Specifically, when executing step S3-2, the honeyhole program will simulate a real identity authentication scenario, including requiring the user to provide an ID card, real-name mobile phone number, and mobile phone verification code. This can not only collect the attacker's identity information and behavior data, but also increase the attacker's attack cost and the risk of being traced, effectively deterring the attacker.

[0080] Specifically, when executing step S3-3, see Figure 3 When the attacker continues to access, a floating code is generated based on the attacker's profile and packaged into a hot patch. The honeyhole program is updated based on the hot patch, including:

[0081] Different tracing functions are encapsulated into independent code modules including information collection module, keyboard recording module, and screenshot module. Different independent code modules are selected and combined according to the attacker profile and attack stage, and the code is obfuscated to generate the final floating code. The floating code is packaged into a hot patch file, and the honeyhole program is updated based on the hot patch technology.

[0082] Furthermore, new floating code snippets are dynamically generated based on the attacker's attack behavior and attack stage. For example, in the early stage of the attack, the floating code may only collect some basic information, while in the in-depth stage of the attack, it can collect more sensitive information such as keyboard logging, screenshots, etc.

[0083] Furthermore, to enhance the concealment of the floating code, the floating code generation module can also employ code obfuscation technology to obfuscate the generated code, making it more difficult for attackers to analyze the code. To accommodate diverse application scenarios, the floating code generation module supports multiple operating systems and platforms, such as Windows and Linux.

[0084] In fact, when the honeyhole program is updated based on hot patch technology, the honeyhole program uses hot patch technology to dynamically load the floating code into the program and execute it without the user restarting the program. The updated honeyhole program records user information in real time and uploads the recorded user data to the server.

[0085] Furthermore, by utilizing hot patching technology, the floating code can be dynamically updated without restarting the honeyhole program, enabling real-time tracing and continuous monitoring of attackers. This ensures real-time tracing and improves the concealment of the honeyhole program, preventing the attacker from being alerted by the program's excessive size.

[0086] In other embodiments, a user visits a website where the device of the present invention is deployed and downloads and installs an initial honeyhole program. This program includes basic system information collection and simulates identity verification. At this point, the program is small and simple in function, making it unlikely to arouse user suspicion. Suppose the user passes identity verification and begins further malicious operations, such as attempting to access sensitive directories on the server. The honeyhole program uploads this behavioral information to the server. Based on the user's behavioral information, the server-side floating code generation module determines that the user may be in the intrusion phase of an attack. It then generates a floating code for recording the user's keyboard input and packages it into a patch file. The hot patch update module distributes the patch file to the user's honeyhole program. Using hot patching technology, the honeyhole program dynamically loads and executes the keyboard recording code without the user having to restart the program. The updated honeyhole program begins recording the user's keyboard input and uploads the recorded data to the server, providing key evidence for subsequent attribution tracing, without the user being aware of the change in the honeyhole program's functionality. This demonstrates the real-time, stealthy, and flexible nature of hot patching technology, enabling the honeyhole program to dynamically adjust its attribution strategy based on the attacker's actions. If the attacker's behavior changes again, such as attempting to perform privilege escalation operations, the floating code generation module can generate new floating code (such as process monitoring code) again and update it to the honeyhole program through a hot patch, thereby continuously monitoring the attacker's behavior.

[0087] In some embodiments, executing step S4 specifically includes:

[0088] S4-1, based on the updated honeyhole program, monitor the attacker in real time and collect real-time information;

[0089] S4-2. Conduct source tracing analysis based on deterrence events and real-time information, and generate a source tracing deterrence report.

[0090] Specifically, when executing step S4-1, the attacker is monitored in real time based on the updated honeyhole program and real-time information is collected. The real-time information includes web pages visited by the attacker, commands executed, and keyboard records.

[0091] Furthermore, the updated honeyhole program begins to record the web pages visited, commands executed, and keystrokes taken by the attacker, and uploads the recorded real-time data to the server, providing key evidence for subsequent tracing. The attacker will find it difficult to detect that the function of the honeyhole program has changed.

[0092] Specifically, when executing step S4-2, a source tracing analysis is performed based on the deterrence event and real-time information to generate a source tracing deterrence report, including:

[0093] Based on deterrence events and real-time information, the attacker's behavior trajectory is restored to identify the attacker's identity, motives, and attack methods. A traceability report is generated by combining data from an open source threat intelligence platform. Ultimately, a traceability deterrence report is generated that includes both the deterrence events and the traceability report.

[0094] Furthermore, the deterrent event includes refusing to provide identity credentials or refusing to install the honeyhole program.

[0095] The embodiment of the present invention further provides a source tracing deterrence system based on a floating code honeyhole, specifically comprising:

[0096] The data processing module is used to capture network traffic, extract information, and then pre-process it to obtain multi-dimensional information;

[0097] The portrait generation module is used to build an initial model, extract multi-dimensional information features and divide them into training, test and validation sets. The initial model is trained and tested based on the training and test sets to obtain a portrait model. The validation set is input into the portrait model to generate an attacker portrait.

[0098] The honeyhole program tracing module generates a honeyhole program based on the attacker's profile and forces the attacker to install it. The honeyhole program simulates real authentication scenarios to deter attackers from accessing the program. If the attacker continues to access the program, floating code is generated based on the attacker's profile and packaged into a hot patch. The hot patch is then used to update the honeyhole program.

[0099] The data analysis module monitors attackers in real time and collects real-time information based on the updated honeyhole program, performs source tracing analysis based on deterrence events and real-time information, and generates a source tracing deterrence report.

[0100] While the embodiments of the present invention have been described in detail above, it will be apparent to those skilled in the art that various modifications and variations of these embodiments are possible. However, it should be understood that such modifications and variations are within the scope and spirit of the present invention as set forth in the claims. Furthermore, the invention described herein is susceptible to other embodiments and may be practiced or implemented in a variety of ways.

Claims

1. A tracing deterrence method based on floating code honeyhole, characterized in that: include: Capture network traffic, extract information, and then preprocess to obtain multi-dimensional information; Construct an initial model, extract multi-dimensional information features and divide them into training set, test set and validation set, train and test the initial model based on the training set and test set to obtain a portrait model, and input the validation set into the portrait model to generate an attacker portrait; wherein, when the initial model is trained and tested based on the training set and test set to obtain the portrait model, it includes: initializing the initial model parameters, inputting the training set into the initial model for forward propagation to obtain the predicted value, calculating the error between the predicted value and the true value and constructing the cross-entropy loss function, minimizing the loss function based on the gradient descent method, iteratively updating the model parameters until the loss function tends to a stable value or the maximum number of iterations is reached to terminate the training, and evaluating and fine-tuning the trained initial model based on the test set to obtain the portrait model; Generate a honeyhole program based on the attacker's profile and force the attacker to install it. Use the honeyhole program to simulate real authentication scenarios to deter attackers from accessing the program. If the attacker continues to access the program, generate floating code based on the attacker's profile and package it into a hot patch. Use the hot patch to update the honeyhole program. Based on the updated honeyhole program, attackers are monitored in real time and real-time information is collected. Based on deterrence events and real-time information, source tracing analysis is performed to generate a source tracing deterrence report.

2. A source tracing deterrence method based on floating code honeyhole according to claim 1, characterized in that: Capture network traffic, extract information, and then preprocess to obtain multi-dimensional information, including: Capturing network traffic based on data acquisition devices deployed at the network edge, extracting information, cleaning the data, and formatting it to obtain multi-dimensional information, which is then stored in a database or other storage medium. The multi-dimensional information includes: network environment information, system information, hardware fingerprint information and attack behavior information.

3. The method of tracing and deterring based on floating code honeyhole according to claim 1 is characterized in that: The validation set is input into the portrait model to generate an attacker portrait, including: Based on the portrait model, the verification set is clustered and grouped and risk levels are divided, the correlation between different dimensions is mined, and the relationships are converted into quantifiable indicators to construct an attacker portrait.

4. The method of tracing and deterring based on floating code honeyhole according to claim 3 is characterized in that: The portrait model includes a clustering module, a classification module and an association mining module; the clustering module is used to cluster and group the multidimensional information data, the classification module is used to classify the grouped data into risk levels, and the association mining module is used to mine the association relationship between different dimensions of the classified data and construct an attacker portrait.

5. The method of tracing source deterrence based on floating code honeyhole according to claim 1, characterized in that: When a honeyhole program is generated based on the attacker's profile and the attacker is forced to install it, in order to force the attacker to install the honeyhole program, the system will intercept suspicious access requests and require the user to install the honeyhole program in various ways before continuing to access.

6. The method for tracing the source and deterring based on a floating code honey hole according to claim 1, characterized in that: When the attacker continues to access, floating code is generated based on the attacker's profile and packaged into a hot patch. The honeyhole program is updated based on the hot patch, including: Different tracing functions are encapsulated into independent code modules including information collection module, keyboard recording module, and screenshot module. Different independent code modules are selected and combined according to the attacker profile and attack stage, and the code is obfuscated to generate the final floating code. The floating code is packaged into a hot patch file, and the honeyhole program is updated based on the hot patch technology.

7. The method of tracing source deterrence based on floating code honeyhole according to claim 6 is characterized in that: When the honey hole program is updated based on the hot patch technology, the honey hole program utilizes the hot patch technology to dynamically load the floating code into the program and execute it without the user restarting the program. The updated honey hole program records the user's information in real time and uploads the recorded user data to the server.

8. The method of tracing source deterrence based on floating code honeyhole according to claim 1, characterized in that: Conduct source tracing analysis based on deterrence events and real-time information to generate a source tracing deterrence report, including: Based on deterrence events and real-time information, the attacker's behavior trajectory is restored to identify the attacker's identity, motives, and attack methods. A traceability report is generated by combining data from an open source threat intelligence platform. Ultimately, a traceability deterrence report is generated that includes both the deterrence events and the traceability report. The deterrent event includes refusing to provide identity credentials or refusing to install a honeyhole program, and the real-time information includes visited web pages, executed commands, and keyboard records.

9. A traceability deterrence system based on floating code honeyhole, characterized by: include: The data processing module is used to capture network traffic, extract information, and then pre-process it to obtain multi-dimensional information; A portrait generation module is used to build an initial model, extract multi-dimensional information features and divide them into a training set, a test set, and a validation set. The initial model is trained and tested based on the training set and the test set to obtain a portrait model, and the validation set is input into the portrait model to generate an attacker portrait. The process of training and testing the initial model based on the training set and the test set to obtain the portrait model includes: initializing the initial model parameters, inputting the training set into the initial model for forward propagation to obtain a predicted value, calculating the error between the predicted value and the true value and constructing a cross-entropy loss function, minimizing the loss function based on the gradient descent method, iteratively updating the model parameters until the loss function approaches a stable value or the maximum number of iterations is reached to terminate the training, and evaluating and fine-tuning the trained initial model based on the test set to obtain the portrait model. The honeyhole program tracing module generates a honeyhole program based on the attacker's profile and forces the attacker to install it. The honeyhole program simulates real authentication scenarios to deter attackers from accessing the program. If the attacker continues to access the program, floating code is generated based on the attacker's profile and packaged into a hot patch. The hot patch is then used to update the honeyhole program. The data analysis module monitors attackers in real time and collects real-time information based on the updated honeyhole program, performs source tracing analysis based on deterrence events and real-time information, and generates a source tracing deterrence report.

Images