Command honey point construction and deployment method based on large model

Abstract

The invention provides a command honey point construction and deployment method based on a large model, and relates to the technical field of network space security. The command honey point construction and deployment method comprises the following steps: constructing a user behavior model based on a user terminal command historical record, and constructing an attack behavior model based on an attack log; generating a command honey point template based on the user behavior model and the attack behavior model, analyzing the current operation environment of the user based on the large model, and matching the command honey point template to dynamically generate a plurality of command honey points; selecting a deployment position of a command honey point based on the user behavior model, the attack behavior model and the current operation environment of the user; and when the command honey point is triggered, giving an alarm and recording a trigger event of the command honey point, generating structured feedback data based on the trigger event, and optimizing the command honey point based on the structured feedback data. According to the command honey point construction and deployment method provided by the invention, the problems of low defense effect and insufficient security of command historical records in a traditional method are improved.

Description

Technical Field

[0001] The present invention relates to the field of cyberspace security technology, and in particular to a command honeypot construction and deployment method based on a large model. Background Art

[0002] In the modern network security environment, attack methods such as advanced persistent threats (APT) are becoming increasingly complex. Attackers not only have a deep technical background, but also often use legitimate interfaces or normal operation paths in the system to collect information and cover up their own behavior. After infiltrating the system, attackers usually collect key information by viewing the system's command history, determine whether there are sensitive resources in the target system, understand the system's usage habits, and even further discover traces of high-privilege operations.

[0003] The command history is a log file that records user command operations, usually used to help users trace back previous operations. However, in the eyes of attackers, the command history becomes a tool for indirectly obtaining system information. For example, attackers can quickly understand the system status and potential sensitive resource locations by looking for common commands such as file access and network status check. This passive information collection method provides attackers with a low-risk exploration method that often does not trigger alarms in traditional detection systems.

[0004] However, current defense methods are mostly focused on system logs, network traffic monitoring, and behavioral anomaly detection. These traditional methods are difficult to effectively prevent attackers from collecting information through command history records, and lack corresponding trapping mechanisms to induce attackers to reveal their true intentions. Therefore, it is urgent to provide a solution to improve the above problems. Summary of the invention

[0005] The purpose of the present invention is to provide a command honey spot construction and deployment method based on a large model, which improves the problems of low defense effect and insufficient security of command history records in traditional methods.

[0006] The present invention provides a method for constructing and deploying command honey spots based on a large model, which adopts the following technical solutions:

[0007] Build a user operation chain directed graph based on the user terminal command history, build a user behavior model based on the large model analysis of the user operation chain directed graph, build an attack path directed graph based on the attack log, and build an attack behavior model based on the large model analysis of the attack path directed graph;

[0008] Generate command honey spot templates based on user behavior models and attack behavior models, and dynamically generate multiple command honey spots by matching the command honey spot templates with the user's current operating environment based on the large model;

[0009] Selecting a deployment location of a command honey spot based on a user behavior model, an attack behavior model, and a user's current operating environment, constructing a trigger path between the plurality of command honey spots, and dynamically adjusting the deployment location and the trigger path based on real-time trigger data of the command honey spots;

[0010] When a command sweet spot is triggered, an alarm is issued and the triggering event of the command sweet spot is recorded, structured feedback data is generated based on the triggering event, and the command sweet spot is optimized based on the structured feedback data.

[0011] Optionally, the process of constructing a user behavior model by analyzing the user operation chain directed graph based on the big model includes: generating command context embedding for the user operation chain directed graph based on the big model; constructing a user operation chain model based on the Markov chain and the user operation chain directed graph; calculating the command frequency distribution based on the user operation chain directed graph; composing a user behavior model based on command context embedding, the user operation chain model and the command frequency distribution; and updating the user behavior model in real time using incremental learning technology based on dynamic changes in user behavior.

[0012] Optionally, the process of constructing an attack behavior model by analyzing the attack path directed graph based on the large model includes: generating an attack context embedding for the attack path directed graph based on the large model; constructing an attack path probability model based on the attack behavior data in the attack path directed graph; generating an attack preference description based on analyzing the attack path directed graph based on the large model; and composing an attack behavior model based on the attack context embedding, the attack path probability model and the attack preference description.

[0013] Optionally, the process of generating a command honeyspot template based on a user behavior model and an attack behavior model includes: obtaining a command template that imitates common user operations based on the user behavior model, obtaining a target path of interest to the attacker based on the attack preference description of the attack behavior model, and generating a command honeyspot template for forged commands based on the command template and the target path of interest to the attacker.

[0014] Optionally, the process of dynamically generating multiple command honey spots by analyzing the current operating environment of the user based on the large model and matching the command honey spot template includes:

[0015] Based on the big model, a semantic analysis is performed on the context of the user's current operating environment, and a plurality of command honey spots are dynamically generated by matching the command honey spot template; based on the big model, a first semantic vector of the command honey spot and a second semantic vector of the context of the user's current operating environment are generated, and the semantic correlation between the first semantic vector and the second semantic vector is calculated; based on the big model, a first matching probability between the command honey spot and the user's current operating environment is obtained; based on the big model, a second matching probability between the command honey spot and the target path of interest to the attacker is obtained; and the plurality of command honey spots are optimized based on the semantic correlation, the first matching probability and the second matching probability.

[0016] Optionally, the parameters of the command honey spot include a path and a file name, the path is generated based on a user access history, and the file name is generated based on an attacker's goal.

[0017] Optionally, the process of selecting a deployment location of a command honey spot based on the user behavior model, the attack behavior model, and the user's current operating environment includes:

[0018] The command high-frequency nodes are obtained based on the user behavior model, the attack preference nodes are obtained based on the attack behavior model, a time window is created based on the user's current operating environment, the time distribution of the user's operation is obtained, and the time period when the user's operation frequency is lower than the threshold is obtained based on the time distribution. When in the said time period, the command honey spot is deployed at the logical breakpoint based on the command high-frequency nodes and the attack preference nodes.

[0019] Optionally, the process of constructing the trigger path between the multiple command sweet spots includes: calculating the transition probability between the multiple sweet spots, and constructing the logical association between the multiple command sweet spots based on the transition probability to obtain the trigger path between the sweet spots.

[0020] Optionally, the process of dynamically adjusting the deployment position and the trigger path based on the command honey spot real-time trigger data includes:

[0021] Design forged results based on command sweet spots, guide the attacker to execute subsequent commands based on the output of the forged results, record the real-time trigger data of the command sweet spots, increase the density of command sweet spots at high trigger rate positions based on the real-time trigger data, and redesign the trigger paths between the sweet spots, giving priority to enhancing high-probability paths. The real-time trigger data includes the triggered command sweet spots, whether the sweet spots are triggered, the trigger time, and the attacker's subsequent commands.

[0022] Optionally, the process of generating structured feedback data based on the trigger event and optimizing command honey spots based on the structured feedback data includes:

[0023] Based on the triggering event, the triggered command sweet spot, the triggering frequency of the command sweet spot and the attacker's operation path map are obtained; based on the triggered command sweet spot, the triggering frequency of the command sweet spot and the attacker's operation path map, structured feedback data is generated; based on the triggering frequency of the structured feedback data, the command sweet spot generation content is optimized; based on the attacker's operation path map of the structured feedback data, the deployment position and triggering path of the command sweet spot are adjusted.

[0024] The invention provides a method for constructing and deploying command honey spots based on a large model, which has the following beneficial effects:

[0025] 1. The command honey spot of the present invention is generated by forging historical commands and the target path that the attacker is concerned about. The honey spot is sweeter, which improves the confusing and trapping effect on the attacker;

[0026] 2. The present invention guides the attacker's behavior path by designing the trigger path between the honey spots;

[0027] 3. When a command honeypot is triggered, the system can immediately record the triggering behavior and generate real-time alarms, providing technical support for attack tracing and security response;

[0028] 4. The present invention can update the generation content of command sweet spots and the deployment location and trigger path of command sweet spots in real time by generating structured feedback data. BRIEF DESCRIPTION OF THE DRAWINGS

[0029] Figure 1 A flow chart of a command honey spot construction and deployment method based on a large model provided by the present invention. DETAILED DESCRIPTION

[0030] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention. Unless otherwise defined, the technical terms or scientific terms used herein should be understood by people with general skills in the field to which the present invention belongs. "Including" and similar words used in this article mean that the elements or objects appearing before the word include the elements or objects listed after the word and their equivalents, without excluding other elements or objects.

[0031] The embodiment of the present invention provides a command honeypot construction and deployment method based on a large model, see Figure 1 ,include:

[0032] S1. Build a user operation chain directed graph based on the user terminal command history record, build a user behavior model based on the large model analysis of the user operation chain directed graph, build an attack path directed graph based on the attack log, and build an attack behavior model based on the large model analysis of the attack path directed graph;

[0033] S2, generate a command honey spot template based on the user behavior model and the attack behavior model, and dynamically generate multiple command honey spots by matching the command honey spot template with the user's current operating environment based on the large model;

[0034] S3, selecting a deployment location of a command honey spot based on a user behavior model, an attack behavior model, and a user's current operating environment, constructing a trigger path between the plurality of command honey spots, and dynamically adjusting the deployment location and the trigger path based on real-time trigger data of the command honey spots;

[0035] S4. When a command sweet spot is triggered, an alarm is issued and the triggering event of the command sweet spot is recorded, structured feedback data is generated based on the triggering event, and the command sweet spot is optimized based on the structured feedback data.

[0036] In some embodiments, the process of executing step S1 includes:

[0037] S1.1. Construct a user operation chain directed graph based on the user terminal command history record;

[0038] S1.2. Construct a directed graph of attack paths based on attack logs;

[0039] S1.3, build user behavior model based on large model analysis of user operation chain directed graph;

[0040] S1.4. Analyze the attack path directed graph based on the large model to build an attack behavior model.

[0041] Specifically, when executing step S1.1, constructing a user operation chain directed graph based on the user terminal command history record includes:

[0042] Get the user terminal command history:

[0043] U={(c1,t1),(c2,t2),…,(c n ,t n )};

[0044] Among them, U is the user terminal command history, c n The nth command executed by the user, t n The timestamp of executing the nth command.

[0045] Furthermore, a user operation chain directed graph G is constructed based on the user terminal command history. u =(V u ,E u ), V u is a command set, E u Dependencies between commands.

[0046] Specifically, when executing step S1.2, constructing the attack path directed graph based on the attack log includes:

[0047] Collect attack logs or simulate attack data:

[0048] A={(a1,t1),(a2,t2),…,(a m ,t m )};

[0049] Among them, A is the attack behavior data, a mis the mth command operated by the attacker, t m The operation time for executing the mth command.

[0050] Furthermore, based on the attack behavior data, an attack path directed graph G is constructed a =(V a ,E a ), V a is the set of command nodes executed by the attacker, E a The logical or causal relationship between commands.

[0051] In fact, after obtaining the directed graph of the user operation chain and the directed graph of the attack path, the directed graph is firstly filtered to remove invalid commands, and then the commands in the directed graph are segmented and parsed to extract the command name, parameters and target path, and finally a contextual semantic representation is generated for each command.

[0052] Specifically, when executing step S1.3, building a user behavior model based on the large model analysis of the user operation chain directed graph includes:

[0053] Generate command context embedding for the user operation chain directed graph based on the big model:

[0054] v(c i )=Enc(c i |c i-1 ,c i-2 ,…,c1);

[0055] Where v(c i ) is the command context embedding, Enc is the large model encoder, c i-1 ,c i-2 ,…,c1 is the context of the current command;

[0056] Construct a user operation chain model based on Markov chain and user operation chain directed graph:

[0057]

[0058] Among them, P(c i+1 |c i ) is the user operation chain model, Count(c i →c i+1 ) is the command c i Jump to command c i+1 The number of times, ∑ j Count(c i →c j ) is from command c i Jump to all commands c j The sum of the number of times, j is to traverse all possible commands;

[0059] Calculate the command frequency distribution based on the user operation chain directed graph:

[0060]

[0061] Among them, F(c i ) is the command frequency, Count(c i ) is the command c i The number of occurrences of , N is the total number of commands;

[0062] The user behavior model is constructed based on command context embedding, user operation chain model and command frequency distribution;

[0063] M u ={v(c i ),P(c i+1 |c i ),F(c i )};

[0064] Among them, M u is the user behavior model, v(c i ) is the command context embedding, P(c i+1 |c i ) is the user operation chain model, F(c i ) is the command frequency;

[0065] Furthermore, the user behavior model is updated in real time using incremental learning technology based on the dynamic changes in user behavior.

[0066] Specifically, when executing step S1.4, building an attack behavior model based on the large model analysis attack path directed graph includes:

[0067] Generate attack context embedding for the directed graph of attack paths based on the large model:

[0068] v(a i )=Enc(a i |a i-1 ,a i-2 ,…,a1);

[0069] Where v(a i ) is the attack context embedding, Enc is the large model encoder, and a i-1 ,a i-2 ,…,a1 is the context of the current attack behavior;

[0070] Based on the attack behavior data in the attack path directed graph, an attack path probability model is constructed:

[0071]

[0072] Among them, P(ai+1 |a i ) is the attack path probability model, Count(a i →a i+1 ) is an attack behavior a i Jump to attack behaviora i+1 The number of times, ∑ k Count(a i →a k ) is an attack behavior a i Jump to all attacksa k The sum of the number of times, k is to traverse all possible attack behaviors;

[0073] Analyze the attack path directed graph based on the large model to generate attack preference description;

[0074] The attack behavior model is composed of attack context embedding, attack path probability model and attack preference description:

[0075] M a ={v(a i ),P(a i+1 |a i ),F(A)};

[0076] Among them, M a is the attack behavior model, v(a i ) is the attack context embedding, P(a i+1 |a i ) is the attack path probability model, and F(A) is the attack preference description.

[0077] In some embodiments, the process of executing step S2 includes:

[0078] S2.1, Generate command honeypot template based on user behavior model and attack behavior model;

[0079] S2.2. Analyze the user's current operating environment based on the large model and match the command honey spot template to dynamically generate multiple command honey spots.

[0080] Specifically, when executing step S2.1, generating a command honey spot template based on the user behavior model and the attack behavior model, it includes: obtaining a command template that imitates the user's common operations based on the user behavior model, obtaining a target path that the attacker is concerned about based on the attack preference description of the attack behavior model, and generating a command honey spot template for forged commands based on the command template and the target path that the attacker is concerned about.

[0081] Specifically, the process of executing step S2.2 includes:

[0082] S2.2.1, generate command honey points;

[0083] S2.2.2. Optimize command honey spots.

[0084] Specifically, when executing step S2.2.1 and generating command honey spots, a semantic analysis is performed on the context of the user's current operating environment based on the large model, and a plurality of command honey spots are dynamically generated by matching the command honey spot template.

[0085] In fact, by performing semantic analysis on the context of the user's current operating environment through a large model, it is possible to dynamically generate a fake path based on the user's access history, and generate a fake file name based on the attacker's goals, thereby improving the authenticity of the command honey spot.

[0086] Furthermore, when executing step S2.2.2, optimizing the command honey point, it includes:

[0087] Based on the big model, a first semantic vector of the command honey spot and a second semantic vector of the context of the user's current operating environment are generated, and the semantic correlation between the first semantic vector and the second semantic vector is calculated; based on the big model, a first matching probability between the command honey spot and the user's current operating environment is obtained; based on the big model, a second matching probability between the command honey spot and the target path of interest to the attacker is obtained; and the multiple command honey spots are optimized based on the semantic correlation, the first matching probability and the second matching probability.

[0088] Furthermore, when optimizing the plurality of command honey spots based on the semantic relevance, the first matching probability and the second matching probability, the following formula is used:

[0089] P(H|M u ,M a )=w1·Rel(H,Context)+w2·P u (H)+w3·P a (H);

[0090] Among them, P(H|M u ,M a ) is the optimized command honey point, Rel(H,Context) is the semantic relevance, P u (H) is the first matching probability, P a (H) is the second matching probability, w1, w2, w3 are weight factors.

[0091] In some embodiments, the process of executing step S3 includes:

[0092] S3.1. Select the deployment location of the command honeypot based on the user behavior model, the attack behavior model and the user's current operating environment;

[0093] S3.2, constructing trigger paths between multiple command honey spots;

[0094] S3.3. Dynamically adjust the deployment position and trigger path based on the command honey spot real-time trigger data.

[0095] Specifically, when executing step S3.1, the command high-frequency node is obtained based on the user behavior model, the attack preference node is obtained based on the attack behavior model, a time window is created based on the user's current operating environment, the time distribution of the user's operation is obtained, and the time period in which the user's operation frequency is lower than the threshold is obtained based on the time distribution. When in the said time period, the command honey spot is deployed at the logical breakpoint based on the command high-frequency node and the attack preference node.

[0096] Specifically, when executing step S3.2 and constructing the trigger path between multiple command sweet spots, the transition probabilities between the multiple sweet spots are calculated, and logical associations between the multiple command sweet spots are constructed based on the transition probabilities to obtain the trigger path between the sweet spots.

[0097] Furthermore, the calculation formula for the transition probability between honey spots is:

[0098]

[0099] Among them, P(H i+1 |H i ) is the honey point H i Transfer to Honey Spot H i+1 The probability of Count(H i →H i+1 ) is the honey point H i Jump to Honey Spot H i+1 The number of times, ∑ j Count(H i →H l ) is the honey point H i Jump to all honey spots H l The sum of the times, l is the traversal of all possible commands.

[0100] Furthermore, the trigger path L between the honey points is constructed based on the transition probability between the honey points:

[0101] L={H1→H2→…→H z};

[0102] Where L is the trigger path between the honey spots, H z is the honey point z, → is the logical association between command honey points.

[0103] Specifically, when executing step S3.3, dynamically adjusting the deployment position and trigger path based on the command honey spot real-time trigger data includes:

[0104] Design forged results based on command sweet spots, guide the attacker to execute subsequent commands based on the output of the forged results, record the real-time trigger data of the command sweet spots, increase the density of command sweet spots at high trigger rate positions based on the real-time trigger data, and redesign the trigger paths between the sweet spots, giving priority to enhancing high-probability paths. The real-time trigger data includes the triggered command sweet spots, whether the sweet spots are triggered, the trigger time, and the attacker's subsequent commands.

[0105] In fact, when an attacker triggers a command honey spot, the command honey spot will design a forged result based on the content of the honey spot, and guide the attacker to execute subsequent commands based on the output of the forged result.

[0106] Furthermore, the honey spot trigger data is captured in real time, and the trigger data is:

[0107] T H ={(H,Triggered_Flag,Time,Action)};

[0108] Among them, T H is the trigger data, Triggered_Flag is whether the honey spot is triggered, Time is the trigger time, and Action is the subsequent operation of the attacker.

[0109] In some embodiments, the process of executing step S4 includes:

[0110] S4.1. When a command sweet spot is triggered, an alarm is issued and the triggering event of the command sweet spot is recorded;

[0111] S4.2, generating structured feedback data based on the triggering event;

[0112] S4.3. Optimize command honey spots based on structured feedback data.

[0113] In fact, when executing step S4.1, after the attacker triggers the command honey spot, it will detect whether the command honey spot is called, record the parameters and results when the command is triggered, collect the environmental information and targets when the command honey spot trigger event occurs, generate the trigger frequency distribution, and issue an alarm to notify the administrator and generate the corresponding alarm log.

[0114] Furthermore, the command honey spot trigger event record format is:

[0115] E H ={ID H ,T H ,A H ,P H ,C H};

[0116] E H Honey spot trigger event, ID His the unique identifier of the triggering honeypoint, T H is the honey point trigger time, A H is the attacker's identity feature (such as IP address, device fingerprint, etc.), P H is the parameter value when the honey point is triggered, C H To trigger context information.

[0117] Furthermore, when generating the trigger frequency distribution:

[0118]

[0119] F(H) is the trigger frequency, Count(H) is the number of times the command sweet spot H is triggered, and Δt is the time interval.

[0120] Specifically, when executing step S4.2 and generating structured feedback data based on the trigger event, the triggered command sweet spot, the triggering frequency of the command sweet spot and the attacker's operation path map are obtained based on the triggering event, and the structured feedback data is generated based on the triggered command sweet spot, the triggering frequency of the command sweet spot and the attacker's operation path map.

[0121] In fact, by analyzing the attacker's operation path graph, we can extract the attacker's behavior characteristics, record the parameters used by the attacker, such as the target path or file name, count the time intervals between operations, and determine the attacker's degree of automation; identify high-frequency nodes in the path graph, and prioritize generating feedback related to these nodes.

[0122] Further, execute S4.3, optimize the command honey spot based on the structured feedback data, optimize the command honey spot generation content based on the trigger frequency of the structured feedback data, and adjust the deployment location and trigger path of the command honey spot based on the attacker operation path map of the structured feedback data.

[0123] Although the embodiments of the present invention are described in detail above, it is obvious to those skilled in the art that various modifications and variations can be made to these embodiments. However, it should be understood that such modifications and variations are within the scope and spirit of the present invention as described in the claims. Moreover, the present invention described herein may have other embodiments and may be implemented or realized in a variety of ways.

Claims

1. A method for constructing and deploying command honey spots based on a large model, characterized in that: The following steps are involved: Build a user operation chain directed graph based on the user terminal command history, build a user behavior model based on the large model analysis of the user operation chain directed graph, build an attack path directed graph based on the attack log, and build an attack behavior model based on the large model analysis of the attack path directed graph; Generate command honey spot templates based on user behavior models and attack behavior models, and dynamically generate multiple command honey spots by matching the command honey spot templates with the user's current operating environment based on the large model; Selecting a deployment location of a command honey spot based on a user behavior model, an attack behavior model, and a user's current operating environment, constructing a trigger path between the plurality of command honey spots, and dynamically adjusting the deployment location and the trigger path based on real-time trigger data of the command honey spots; When a command sweet spot is triggered, an alarm is issued and the triggering event of the command sweet spot is recorded, structured feedback data is generated based on the triggering event, and the command sweet spot is optimized based on the structured feedback data.

2. According to the large model-based command honeypot construction and deployment method of claim 1, it is characterized in that: The process of building a user behavior model based on a large model analysis of the user operation chain directed graph includes: Generate command context embedding for the user operation chain directed graph based on the big model; Construct a user operation chain model based on Markov chain and user operation chain directed graph; Calculate command frequency distribution based on the user operation chain directed graph; The user behavior model is constructed based on command context embedding, user operation chain model and command frequency distribution; The user behavior model is updated in real time using incremental learning technology based on the dynamic changes in user behavior.

3. According to the large model-based command honeypot construction and deployment method of claim 1, it is characterized in that: The process of building an attack behavior model based on a large model-based attack path directed graph analysis includes: Generate attack context embedding for the directed graph of attack paths based on the large model; Based on the attack behavior data in the attack path directed graph, an attack path probability model is constructed; Analyze the attack path directed graph based on the large model to generate attack preference description; The attack behavior model is composed of attack context embedding, attack path probability model and attack preference description.

4. A method for constructing and deploying command honey spots based on a large model according to claim 3, characterized in that: The process of generating command honey spot templates based on user behavior models and attack behavior models includes: Based on the user behavior model, a command template that imitates the user's common operations is obtained. Based on the attack preference description of the attack behavior model, the target path that the attacker is concerned about is obtained. Based on the command template and the target path that the attacker is concerned about, a command honeyspot template for forged commands is generated.

5. A method for constructing and deploying command honey spots based on a large model according to claim 4, characterized in that: The process of dynamically generating multiple command honey spots by analyzing the user's current operating environment based on the large model and matching the command honey spot template includes: Based on the big model, the context of the user's current operating environment is semantically analyzed, and multiple command honey spots are dynamically generated by matching the command honey spot template; Generate a first semantic vector of a command honey point and a second semantic vector of a context of a current operating environment of a user based on the large model, and calculate a semantic correlation between the first semantic vector and the second semantic vector; Obtaining a first matching probability between a command honey spot and a current operating environment of the user based on the large model; Obtaining a second matching probability between the command honey spot and the target path of interest to the attacker based on the large model; The plurality of command honeyspots are optimized based on the semantic relevance, the first matching probability, and the second matching probability.

6. A method for constructing and deploying command honey spots based on a large model according to claim 5, characterized in that: The parameters of the command honey spot include a path and a file name, wherein the path is generated based on the user's access history, and the file name is generated based on the attacker's goal.

7. A method for constructing and deploying command honey spots based on a large model according to claim 1, characterized in that: The process of selecting the deployment location of the command honeypot based on the user behavior model, the attack behavior model and the user's current operating environment includes: The command high-frequency nodes are obtained based on the user behavior model, the attack preference nodes are obtained based on the attack behavior model, a time window is created based on the user's current operating environment, the time distribution of the user's operation is obtained, and the time period when the user's operation frequency is lower than the threshold is obtained based on the time distribution. When in the said time period, the command honey spot is deployed at the logical breakpoint based on the command high-frequency nodes and the attack preference nodes.

8. The method for constructing and deploying command honey spots based on a large model according to claim 1, characterized in that: The process of executing and constructing the trigger path between the plurality of command honey points includes: The transition probabilities between the multiple sweet spots are calculated, and logical associations between the multiple command sweet spots are constructed based on the transition probabilities to obtain trigger paths between the sweet spots.

9. A method for constructing and deploying command honey spots based on a large model according to claim 1, characterized in that: The process of dynamically adjusting the deployment position and the trigger path based on the command honey point real-time trigger data includes: Design forged results based on command sweet spots, guide the attacker to execute subsequent commands based on the output of the forged results, record the real-time trigger data of the command sweet spots, increase the density of command sweet spots at high trigger rate positions based on the real-time trigger data, and redesign the trigger paths between the sweet spots, giving priority to enhancing high-probability paths. The real-time trigger data includes the triggered command sweet spots, whether the sweet spots are triggered, the trigger time, and the attacker's subsequent commands.

10. A method for constructing and deploying command honey spots based on a large model according to claim 1, characterized in that: The process of generating structured feedback data based on the trigger event and optimizing command honey spots based on the structured feedback data includes: Based on the triggering event, the triggered command sweet spot, the triggering frequency of the command sweet spot and the attacker's operation path map are obtained; based on the triggered command sweet spot, the triggering frequency of the command sweet spot and the attacker's operation path map, structured feedback data is generated; based on the triggering frequency of the structured feedback data, the command sweet spot generation content is optimized; based on the attacker's operation path map of the structured feedback data, the deployment position and triggering path of the command sweet spot are adjusted.

Images