An automated honeyhole scene construction system based on large models

Abstract

The present invention provides a large-model-based automatic construction method for a honeyhole scene, which relates to the field of network security technology and includes: a web page data acquisition module, which is used to collect web page data of a target website according to a network security space mapping engine and based on preset rules, and the web page data includes: web page structure, content and plug-ins; a vulnerability fingerprint information acquisition module, which is used to collect vulnerability information of vulnerability fingerprint POC, and the vulnerability information includes: vulnerability type, vulnerability exploitation code, and vulnerability feature string; a multi-agent analysis module, which is used to generate multiple agents according to pre-designed prompts and rules, and use the agents to extract and store feature information of web page data and vulnerability information, and the feature information includes: vulnerability points, user interaction hotspots, and sensitive information; a scene synthesis module, which is used to fuse scenes in a scene library with the feature information according to the needs of the system to construct a honeyhole scene, and generate a final web page source code.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a large-model-based honeyhole scenario automatic construction system. Background Art

[0002] With the development of active deception defense technology, security personnel are no longer simply waiting for attackers to invade. Instead, they are proactively deploying decoys within the network environment to defend against attackers. Honeyholes have emerged to address this need. Honeyholes aim to deter attackers by increasing the cost of attacks and the risk of tracing their source. During deployment, decoys are disguised as legitimate network plug-ins or files. For example, executable files can be disguised as seemingly harmless software updates or documents and embedded in web pages. When attackers access or download these decoys, security personnel can gather information about the attackers, such as their attack methods, targets, and IP addresses, enabling them to counterattack and trace their source.

[0003] Active deception defense products on the market, including honeyholes, honey tags, and honey baits, deploy decoys and other forms of deception. Most of these products are implemented by pre-building scenarios for various service types. These scenarios attempt to disguise themselves as legitimate web pages, servers, or applications to lure attackers into downloading the embedded decoys. While these have some defensive effectiveness, they still face challenges such as a lack of automation and flexibility in scenario construction, complexity in production, and a lack of intelligent decoy embedding strategies.

[0004] Therefore, it is urgent to provide a solution to improve the above problems. Summary of the Invention

[0005] The purpose of the present invention is to provide a large-model-based honeyhole scene automatic construction system to improve the problems in the prior art of scene construction lacking automation and flexibility, complex production, and lack of intelligence in bait embedding strategies.

[0006] The present invention provides a large-model-based honeyhole scene automatic construction system, comprising:

[0007] A web page data collection module is used to collect web page data of a target website based on a network security space mapping engine and preset rules. The web page data includes: web page structure, content, and plug-ins;

[0008] The vulnerability fingerprint information collection module is used to collect vulnerability information of the vulnerability fingerprint POC, and the vulnerability information includes: vulnerability type, vulnerability exploit code, and vulnerability feature string;

[0009] A multi-agent analysis module is used to generate multiple agents based on pre-designed prompts and rules, and use these agents to extract and store feature information of web page data and vulnerability information, including vulnerability points, user interaction hotspots, and sensitive information;

[0010] The scene synthesis module is used to fuse the scenes in the scene library with the feature information according to the needs of the system to build a honeyhole scene, and generate the final web page source code.

[0011] The beneficial effect of the large-scale model-based honeyhole scene automatic construction system provided by the present invention is that the present invention realizes the automatic construction of the honeyhole scene library and the intelligent embedding of the honeyhole by integrating the network security space mapping engine, the vulnerability scanner POC fingerprint features and the large-scale language model multi-source information, and adopts multi-agent analysis and intelligent scene synthesis technical means. Therefore, the present invention can effectively solve the problems of high cost, limited trapping effect and high maintenance difficulty of traditional scene construction, improve the trapping effect and countermeasure capability of the honeyhole, and reduce the deployment cost and maintenance difficulty of the honeyhole. Specifically, the present invention can automatically construct diverse and highly authentic scenes to attract more attackers; it can generate smarter and more targeted honeyhole embedding strategies based on web page scenes to improve the honeyhole trapping success rate; it can automatically verify the honeyhole scene to ensure its effectiveness and security, and reduce the security risks of the honeyhole system itself.

[0012] Optionally, the intelligent agent includes: a scene summarizing intelligent agent, a web page structure analyzing intelligent agent, a user behavior analyzing intelligent agent, a feature analyzing intelligent agent and a web page screening intelligent agent.

[0013] Optionally, multiple agents are connected via LangGraph as an information transmission platform to achieve information collaboration between them, specifically including:

[0014] Each agent is regarded as a node, and the agents are connected through directed edges, which represent the direction of information flow;

[0015] Compile LangGraph to generate multiple executable workflows, and transfer information between multiple agents according to a predefined order to achieve information collaboration.

[0016] Optionally, the vulnerability fingerprint information collection module specifically includes:

[0017] The fingerprint information extraction module is used to select vulnerability scanning POCs from mainstream attacker vulnerability scanners, analyze the request methods for web page URLs, parameters, and directory key parameters in the POCs, reversely construct deceptive vulnerability fingerprint features, and construct similar URLs, parameters, or directory structures so that they can be identified as potential vulnerabilities by the attacker's vulnerability scanner;

[0018] The fingerprint information screening module is used to screen the web page structure, content and plug-ins, obtain sensitive information and user interaction hotspots in the web page, generate screening data, and generate a high-risk vulnerability fingerprint library.

[0019] Optionally, the multi-agent analysis module specifically includes:

[0020] A scenario summarizing module, configured to reduce and summarize the web page data according to the scenario summarizing agent to obtain simplified web page data;

[0021] A result analysis module is used to identify the structure of a web page based on the web page structure analysis agent and obtain user interaction elements, wherein the interaction elements include forms and buttons;

[0022] The user behavior analysis module is used to infer the possible web page behaviors of the user in the current web page structure based on the user behavior analysis agent, and store the filtered data in the module library for storage based on the web page behaviors, wherein the web page behaviors include: logging in and uploading;

[0023] The vulnerability POC analysis module is used to analyze the information in the POC according to the feature analysis agent, extract the vulnerability type, attack code and feature string, and then perform CVSS scoring to obtain the scoring results. It is also used to classify and filter according to the scoring results, generate corresponding fingerprint features and store them in the fingerprint library for storage.

[0024] Optionally, the process of classifying and screening based on the scoring results includes:

[0025] The extracted information is used to filter out severe vulnerabilities with a score greater than 9.5 based on the CVSS score of the vulnerability. Then, based on the vulnerability type, vulnerabilities that may lead to remote command execution are filtered out. The PATH and BODY response rules in the POC are extracted and stored as fingerprint features in the fingerprint library.

[0026] Optionally, the scene synthesis module specifically includes:

[0027] A built-in large model module is used to understand and analyze the user's scenario description, select appropriate templates and vulnerability fingerprints, and then select the appropriate functional honeyhole from the functional honeyhole library based on the needs of building a complete honeyhole scenario;

[0028] A honeyhole embedding module is used to analyze the web page structure, user interaction elements and potential vulnerabilities, embed the honeyhole, generate the initial web page source code, and generate the initial web page based on the initial web page source code, wherein the initial web page source code is HTML, JavaScript and CSS code, which contains simulated vulnerabilities and bait elements for attracting attackers and collecting attack behavior information;

[0029] The verification module is used to verify the initial web page and scan the honey hole scene using a vulnerability scanner to verify the authenticity of the vulnerability simulation and whether there are other security risks. If the verification passes, the final web page source code is output. If the verification fails, the initial web page is regenerated based on the scene synthesis intelligent agent for re-verification. If the number of verifications reaches the preset maximum number of verifications, the honey hole scene is randomly replaced. BRIEF DESCRIPTION OF THE DRAWINGS

[0030] Figure 1 This is a structural diagram of a honey hole scene automatic construction system based on a large model provided by the present invention;

[0031] Figure 2 This is a flow chart of web page and vulnerability fingerprint information collection provided by the present invention;

[0032] Figure 3 This is a flow chart of the multi-agent analysis module provided by the present invention;

[0033] Figure 4 This is a scene synthesis flow chart provided by the present invention. DETAILED DESCRIPTION

[0034] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention. Unless otherwise defined, the technical terms or scientific terms used herein should be the common meanings understood by people with ordinary skills in the field to which the invention belongs. The words "including" and similar words used in this article mean that the elements or objects appearing before the word cover the elements or objects listed after the word and their equivalents, without excluding other elements or objects.

[0035] In order to more clearly illustrate the technical solution of the present invention, some glossaries of the present invention are first provided, as follows;

[0036] Large Language Model (LLM): A large language model is a natural language processing model based on deep learning. It can learn and understand large amounts of text data and has powerful capabilities such as semantic understanding, text generation, and code generation. For example, BERT and GPT-4 are typical large language models. LLMs can be used for tasks such as analyzing web page content, understanding user behavior, and generating code. In this paper, they are mainly used for web page scenario analysis and honeyhole embedding strategy generation.

[0037] Cyberspace Mapping Engine: A cyberspace mapping engine is a tool used to collect, analyze, and visualize internet asset information, helping security personnel understand cyberspace topology, asset distribution, and vulnerability status. Examples of common cyberspace mapping engines include ZoomEye, Shodan, and Fofa. In this invention, a cyberspace mapping engine is used to collect webpage information, such as page structure, content, and plugins, providing the foundational data for honeyhole scenario construction.

[0038] Vulnerability Scanner POC Fingerprint: A vulnerability scanner POC fingerprint is a code snippet or characteristic string that uniquely identifies a specific vulnerability and can be used to detect and verify the existence of a vulnerability. For example, vulnerability scanners such as FSCAN, NUCLEI, and GOGO all include extensive POC fingerprint libraries. In this invention, the vulnerability scanner POC fingerprint is used to construct webpage scenarios that simulate real vulnerabilities, enhancing the honeyhole's trapping capabilities.

[0039] Intelligent Agent: An intelligent agent is a computer program based on a large language model, capable of planning, thinking, memory, and using utility functions, allowing it to autonomously complete tasks. In this invention, it can autonomously perform tasks such as web page structure analysis, vulnerability identification, and user behavior prediction based on pre-designed prompts and rules, and provide the analysis results to other modules. Using a large language model to build an intelligent agent can enhance its semantic understanding and reasoning capabilities, enabling more efficient analysis and processing of complex information.

[0040] The embodiment of the present invention provides a large model-based honeyhole scene automatic construction system, including:

[0041] A web page data collection module is used to collect web page data of a target website based on a network security space mapping engine and preset rules. The web page data includes: web page structure, content, and plug-ins;

[0042] The vulnerability fingerprint information collection module is used to collect vulnerability information of the vulnerability fingerprint POC, and the vulnerability information includes: vulnerability type, vulnerability exploit code, and vulnerability feature string;

[0043] A multi-agent analysis module is used to generate multiple agents based on pre-designed prompts and rules, and use these agents to extract and store feature information of web page data and vulnerability information, including vulnerability points, user interaction hotspots, and sensitive information;

[0044] The scene synthesis module is used to fuse the scenes in the scene library with the feature information according to the needs of the system to build a honeyhole scene, and generate the final web page source code.

[0045] Specifically, the intelligent agents include: scene summarization intelligent agent, web page structure analysis intelligent agent, user behavior analysis intelligent agent, feature analysis intelligent agent and web page screening intelligent agent.

[0046] Furthermore, the scene summarization agent, webpage structure analysis agent, user behavior analysis agent, feature analysis agent, and webpage screening agent are connected via LangGraph as an information transmission platform to achieve information collaboration. The process of connecting multiple agents via LangGraph as an information transmission platform to achieve information collaboration includes:

[0047] Each agent is regarded as a node, and the agents are connected through directed edges, which represent the direction of information flow;

[0048] Compile LangGraph to generate multiple executable workflows, and transfer information between multiple agents according to a predefined order to achieve information collaboration.

[0049] In some embodiments, the vulnerability fingerprint information collection module specifically includes:

[0050] The fingerprint information extraction module is used to select vulnerability scanning POCs from mainstream attacker vulnerability scanners, analyze the request methods for key parameters such as web page URLs, parameters, directories, etc. in the POCs, reversely construct deceptive vulnerability fingerprint features, and construct similar URLs, parameters, or directory structures so that they can be identified as potential vulnerabilities by the attacker's vulnerability scanner;

[0051] The fingerprint information screening module is used to screen the web page structure, content and plug-ins, obtain sensitive information and user interaction hotspots in the web page, generate screening data, and generate a high-risk vulnerability fingerprint library.

[0052] In some embodiments, the multi-agent analysis module specifically includes:

[0053] A scenario summarizing module, configured to reduce and summarize the web page data according to the scenario summarizing agent to obtain simplified web page data;

[0054] A result analysis module is used to identify the structure of a web page based on the web page structure analysis agent and obtain user interaction elements, wherein the interaction elements include forms and buttons;

[0055] The user behavior analysis module is used to infer the possible web page behaviors of the user in the current web page structure based on the user behavior analysis agent, and store the filtered data in the module library for storage based on the web page behaviors, wherein the web page behaviors include: logging in and uploading;

[0056] The vulnerability POC analysis module is used to analyze the information in the POC according to the feature analysis agent, extract the vulnerability type, attack code and feature string, and then perform CVSS scoring to obtain the scoring results. It is also used to classify and filter according to the scoring results, generate corresponding fingerprint features and store them in the fingerprint library for storage.

[0057] In some embodiments, the process of classifying and screening according to the scoring results includes:

[0058] The extracted information is used to filter out severe vulnerabilities with a score greater than 9.5 based on the CVSS score of the vulnerability. Then, based on the vulnerability type, vulnerabilities that may lead to remote command execution are filtered out. The PATH and BODY response rules in the POC are extracted and stored as fingerprint features in the fingerprint library.

[0059] In some embodiments, the scene synthesis module specifically includes:

[0060] A built-in large model module is used to understand and analyze the user's scenario description, select appropriate templates and vulnerability fingerprints, and then select the appropriate functional honeyhole from the functional honeyhole library based on the needs of building a complete honeyhole scenario;

[0061] A honeyhole embedding module is used to analyze the web page structure, user interaction elements and potential vulnerabilities, embed the honeyhole, generate the initial web page source code, and generate the initial web page based on the initial web page source code, wherein the initial web page source code is HTML, JavaScript and CSS code, which contains simulated vulnerabilities and bait elements for attracting attackers and collecting attack behavior information;

[0062] The verification module is used to verify the initial web page and scan the honey hole scene using a vulnerability scanner to verify the authenticity of the vulnerability simulation and whether there are other security risks. If the verification passes, the final web page source code is output. If the verification fails, the initial web page is regenerated based on the scene synthesis intelligent agent for re-verification. If the number of verifications reaches the preset maximum number of verifications, the honey hole scene is randomly replaced.

[0063] See Figure 1 The invention designs an automatic construction method of honeyhole scenes based on a large model, which is mainly divided into four modules: web page information and vulnerability fingerprint collection module, multi-agent analysis module, honeyhole scene library, and scene synthesis module.

[0064] The webpage information collection module mainly uses the network security space mapping engine to collect webpage information of the target website according to preset rules, including webpage structure, content, plug-ins, etc. The vulnerability fingerprint collection module collects information from the vulnerability fingerprint POC, such as vulnerability type, vulnerability exploit code, vulnerability feature string, etc.

[0065] The multi-agent analysis module is responsible for analyzing the information collected in the web page information collection module and the vulnerability fingerprint collection module, extracting key information required by the system, such as potential vulnerability points, user interaction hotspots, sensitive information, etc., and storing the extracted information.

[0066] The honeyhole scene library stores a variety of common honeyhole scene templates, such as login page, file upload page, search page, etc., and reserves honeyhole embedding points.

[0067] When the system needs to construct a honeyhole scenario, the scenario synthesis module fuses the scenarios in the honeyhole scenario library with the information extracted by the multi-agent analysis module to generate the final webpage scenario. Simultaneously, the module utilizes a built-in large-scale language model to select appropriate locations to insert vulnerability information or decoy elements into the webpage scenario.

[0068] See Figure 2 Using the cybersecurity space mapping engine and pre-set rules, the crawler module crawls the target website's webpage information through the API interface, obtains the webpage source code, sends it to the scenario analysis agent for analysis, and sends the analysis results to the module library. At the same time, mainstream vulnerability scanning tools are used to extract PoCs and send them to the feature analysis agent. The feature analysis agent screens the data to identify sensitive information and user interaction hotspots on the webpage, and sends them to the high-risk vulnerability fingerprint library.

[0069] See Figure 3 The crawler data is input into the scenario summary module, which outputs a webpage structure summary and sends it to the structure analysis module. The user behavior analysis module is used to filter out the appropriate source code and embed the webpage source code into the template library based on the embedding type. The POC is input into the feature analysis module for analysis, and the POC summary is output and sent to the key fingerprint extraction module. The CVSS score is generated based on the vulnerability type and fingerprint features and saved in the fingerprint library.

[0070] In practice, the webpage filtering agent passes the filtering results to the structural analysis module. Ultimately, the extracted key information, such as potential vulnerability embedding points, user interaction hotspots, and sensitive information, is stored in the honeyhole scenario library. This provides a more accurate basis for subsequent honeyhole scenario construction and strategy generation. For example, honeyhole traps can be set based on user interaction hotspots, and highly realistic honeyhole scenarios can be constructed based on high-risk vulnerability fingerprints.

[0071] See Figure 4, input the scene description into the scene synthesis intelligent agent, use the built-in large model to perform scene analysis on the user's scene description, select appropriate templates and vulnerability fingerprints from the vulnerability fingerprint library and template library respectively, and then select appropriate function honeyholes from the function honeyhole library for honeyhole embedding, output the web page source code, and then use the verification module to scan the source code for verification. If the verification passes, output the final web page source code.

[0072] While the embodiments of the present invention have been described in detail above, it will be apparent to those skilled in the art that various modifications and variations of these embodiments are possible. However, it should be understood that such modifications and variations are within the scope and spirit of the present invention as set forth in the claims. Furthermore, the invention described herein is susceptible to other embodiments and may be practiced or implemented in a variety of ways.

Claims

1. A large-scale model-based honey hole scene automatic construction system, characterized by: include: A web page data collection module is used to collect web page data of a target website based on a network security space mapping engine and preset rules. The web page data includes: web page structure, content, and plug-ins; The vulnerability fingerprint information collection module is used to collect vulnerability information of the vulnerability fingerprint POC, and the vulnerability information includes: vulnerability type, vulnerability exploit code, and vulnerability feature string; A multi-agent analysis module is used to generate multiple agents based on pre-designed prompts and rules, and use these agents to extract and store feature information of web page data and vulnerability information, including vulnerability points, user interaction hotspots, and sensitive information; The scene synthesis module is used to fuse the scenes in the scene library with the feature information according to the needs of the system to build a honeyhole scene, and generate the final web page source code. It includes: a built-in large model module, which is used to understand and analyze the user's scene description according to the needs of building a complete honeyhole scene, select appropriate templates and vulnerability fingerprints, and then select appropriate functional honeyholes from the functional honeyhole library.

2. A large model-based honey hole scene automatic construction system according to claim 1, characterized in that: The intelligent agents include: scene summarization intelligent agent, web page structure analysis intelligent agent, user behavior analysis intelligent agent, feature analysis intelligent agent and web page screening intelligent agent.

3. The large-scale model-based honey hole scene automatic construction system according to claim 1 is characterized in that: Multiple agents are connected via LangGraph as an information transmission platform to achieve information collaboration between them, specifically including: Each agent is regarded as a node, and the agents are connected through directed edges, which represent the direction of information flow; Compile LangGraph to generate multiple executable workflows, and transfer information between multiple agents according to a predefined order to achieve information collaboration.

4. The large model-based honey hole scene automatic construction system according to claim 1 is characterized in that: The vulnerability fingerprint information collection module specifically includes: The fingerprint information extraction module is used to select vulnerability scanning POCs from mainstream attacker vulnerability scanners, analyze the request methods for web page URLs, parameters, and directory key parameters in the POCs, reversely construct deceptive vulnerability fingerprint features, and construct similar URLs, parameters, or directory structures so that they can be identified as potential vulnerabilities by the attacker's vulnerability scanner; The fingerprint information screening module is used to screen the web page structure, content and plug-ins, obtain sensitive information and user interaction hotspots in the web page, generate screening data, and generate a high-risk vulnerability fingerprint library.

5. The large model-based honey hole scene automatic construction system according to claim 1 is characterized in that: The multi-agent analysis module specifically includes: A scenario summarizing module, configured to reduce and summarize the web page data according to the scenario summarizing agent to obtain simplified web page data; A result analysis module is used to identify the structure of a web page based on the web page structure analysis agent and obtain user interaction elements, wherein the interaction elements include forms and buttons; The user behavior analysis module is used to infer the possible web page behaviors of the user in the current web page structure based on the user behavior analysis agent, and store the filtered data in the module library for storage based on the web page behaviors, wherein the web page behaviors include: logging in and uploading; The vulnerability POC analysis module is used to analyze the information in the POC according to the feature analysis agent, extract the vulnerability type, attack code and feature string, and then perform CVSS scoring to obtain the scoring results. It is also used to classify and filter according to the scoring results, generate corresponding fingerprint features and store them in the fingerprint library for storage.

6. The large-model-based honey hole scene automatic construction system according to claim 5 is characterized in that: The process of classifying and screening according to the scoring results includes: The extracted information is used to filter out severe vulnerabilities with a score greater than 9.5 based on the CVSS score of the vulnerability. Then, based on the vulnerability type, vulnerabilities that may lead to remote command execution are filtered out. The PATH and BODY response rules in the POC are extracted and stored as fingerprint features in the fingerprint library.

7. The large model-based honey hole scene automatic construction system according to claim 1 is characterized in that: The scene synthesis module also includes: A honeyhole embedding module is used to analyze the web page structure, user interaction elements and potential vulnerabilities, embed the honeyhole, generate the initial web page source code, and generate the initial web page based on the initial web page source code, wherein the initial web page source code is HTML, JavaScript and CSS code, which contains simulated vulnerabilities and bait elements for attracting attackers and collecting attack behavior information; The verification module is used to verify the initial web page and scan the honey hole scene using a vulnerability scanner to verify the authenticity of the vulnerability simulation and whether there are other security risks. If the verification passes, the final web page source code is output. If the verification fails, the initial web page is regenerated based on the scene synthesis intelligent agent for re-verification. If the number of verifications reaches the preset maximum number of verifications, the honey hole scene is randomly replaced.

Images