Strategy generation method for deploying file honey points based on large language model

Abstract

The invention provides a strategy generation method for deploying file honey points based on a large language model, and relates to the technical field of network security. The strategy generation method comprises the following steps: devaluating a to-be-protected file system to obtain a forged file system, and capturing an initial attack log of an attacker in combination with a trapping tool; performing comprehensive scoring on each attack log session in the initial attack log based on a large language model, and performing cutting based on a comprehensive score to obtain a simplified attack log; the method comprises the following steps: designing a Prompt for guiding a model based on a simplified attack log, generating an attacker view and defender view file honey point deployment strategy based on the Prompt, deploying a file honey point based on the honey point deployment strategy, and periodically updating the file modification time of the file honey point based on the average modification time of normal files in a to-be-protected file system. According to the strategy generation method provided by the invention, the data analysis capability of the large language model is utilized, and the capture attack probability of the file honey point can be improved.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a strategy generation method for deploying file honey spots based on a large language model. Background Art

[0002] With the rapid development of the digital age, data is the most important wealth of individuals, enterprises and organizations. However, as the importance of data increases day by day, more and more attackers begin to carry out data theft attacks. Therefore, an efficient defense method is needed to protect important files. The file honey spot in the Shield Cube Four Honeys is born. The file honey spot is a safe and lightweight tool to lure hackers to attack. It simulates real files. When the attacker attempts to steal files and operates the file honey spot, such as opening, deleting, copying, etc., the file honey spot will sound an alarm, notify security personnel or automatically perform related processing such as disconnecting the computer link. Although the file honey spot has a high capture capability, it is an urgent problem to place the file honey spot in which file path, how to set file attributes such as file name, file size, file modification date and creation date, and how to fully realize the capture capability of the file honey spot under limited defense resources. Summary of the invention

[0003] The purpose of the present invention is to provide a strategy generation method for deploying file honey spots based on a large language model, which improves the problems of simple deployment paths of existing file honey spots and low probability of capturing attacks through the data analysis capabilities of the large language model.

[0004] The present invention provides a strategy generation method based on large language model deployment file honey points, which adopts the following technical solutions:

[0005] Devalue the file system to be protected to obtain a fake file system, and capture the attacker's initial attack log based on the fake file system and the trapping tool;

[0006] Performing a harmfulness score and a time score on each attack log session in the initial attack log based on the large language model, obtaining a comprehensive score based on the harmfulness score and the time score, and trimming the attack log session based on the comprehensive score to obtain a streamlined attack log when the attack log session exceeds the quantity limit;

[0007] A prompt for guiding the model is designed based on a streamlined attack log, and the prompt is input into a large language model to generate file honey spot deployment strategies from the attacker's perspective and the defender's perspective. File honey spots are deployed in the file system to be protected based on the honey spot deployment strategies, and the file modification time of the file honey spots is regularly updated based on the average modification time of normal files in the file system to be protected.

[0008] Optionally, in the process of devaluing the file system to be protected to obtain a forged file system, the file attributes of the forged file system are consistent with those of the file system to be protected, and the file content is falsified, and the file attributes include file path and file name.

[0009] Optionally, the process of capturing the attacker's initial attack log based on the forged file system in combination with the trapping tool includes: placing the forged file system and the honeypot in an isolation area, recording the attacker's behavior information based on the honeypot and forming an attack log session and saving it in the initial attack log.

[0010] Optionally, a harmfulness score and a time score are performed on each attack log session in the initial attack log based on a large language model, including:

[0011] A harmfulness score is performed on each attack log session in the initial attack log based on the large language model. When the attack log session contains data theft behavior, the harmfulness score is increased. The data theft behavior includes viewing and copying files. When a time score is performed on each attack log session in the initial attack log based on the large language model, the value of the attack log session time score depends on the time difference from the current time period.

[0012] Optionally, when obtaining a comprehensive score based on the hazard score and the time score, the comprehensive score is obtained by multiplying the hazard score and the time score.

[0013] Optionally, the process of obtaining a simplified attack log by trimming based on the comprehensive score includes: when the attack log sessions exceed the quantity limit, sorting the attack log sessions in the attack log based on the comprehensive score, and deleting the attack log sessions based on the sorting.

[0014] Optionally, the process of designing a prompt for guiding the model based on a streamlined attack log includes: traversing the file system to be protected to form a file system path tree, writing scenario tasks to be executed, setting the priority of files to be protected in the defense perspective, allowing the large language model to analyze the priority of attack commands in the attack perspective based on the streamlined attack log, and designing a formatted answer template output by the large language model; constructing a prompt from the attacker's perspective based on the streamlined attack log, scenario tasks, priority of files to be protected, priority of attack commands, and a formatted answer template; constructing a prompt from the defender's perspective based on the file system path tree, scenario tasks, priority of files to be protected, priority of attack commands, and a formatted answer template.

[0015] Optionally, the process of writing scenario tasks to be executed includes: requiring the file name generated by the large language model to be different from the file name in the file system to be protected, using the large knowledge base of the large language model to generate related file content based on the file name, requiring the large language model to analyze the path of the files that the attacker is interested in based on the streamlined log from the attacker's perspective, and generating the file path of the deployment file honeypot based on the number of times the attacker accesses or passes through the path, and analyzing the relative importance of the file path based on the file system path tree from the defender's perspective.

[0016] Optionally, when the Prompt is input into the large language model to generate the file honey spot deployment strategy for the attacker perspective and the defender perspective, a fixed number of generated file honey spots is given, and the number of generated honey spots is respectively allocated to the attacker perspective and the defender perspective based on the fixed number.

[0017] Optionally, the file modification time of the file honey spot is periodically updated based on the average modification time of normal files in the file system to be protected, including: setting a time interval, recording the file modification time of the file honey spot, when the file modification time of the file honey spot and the current time period reach the time interval, calculating the average modification time of normal files in the file system to be protected, and updating the file modification time of the file honey spot based on the average modification time.

[0018] The present invention provides a strategy generation method based on large language model deployment file honey spots, which has the following beneficial effects:

[0019] 1. The present invention analyzes the attack log through a large language model, generates the file honey spot deployment strategy from the attacker's perspective and the defender's perspective, makes the file honey spot deployment path, file name, and file content more reasonable, and effectively improves the probability of capturing attacks;

[0020] 2. The present invention periodically updates the file modification time of the file honey spot to prevent it from being identified due to differences with other normal files, thereby improving the confusingness and sweetness of the file honey spot. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] Figure 1 A schematic diagram of a strategy generation method for deploying file honey spots based on a large language model provided by the present invention.

[0022] Figure 2 A flow chart of a strategy generation method for deploying file honey spots based on a large language model provided by the present invention. DETAILED DESCRIPTION

[0023] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention. Unless otherwise defined, the technical terms or scientific terms used herein should be understood by people with general skills in the field to which the present invention belongs. "Including" and similar words used in this article mean that the elements or objects appearing before the word include the elements or objects listed after the word and their equivalents, without excluding other elements or objects.

[0024] The embodiment of the present invention provides a strategy generation method for deploying file honey spots based on a large language model, see Figure 1 ,include:

[0025] S1. De-value the file system to be protected to obtain a forged file system, and capture the attacker's initial attack log based on the forged file system and the trapping tool;

[0026] S2. Based on the large language model, each attack log session in the initial attack log is scored for harm and time, and a comprehensive score is obtained based on the harm and time scores. When the attack log session exceeds the quantity limit, the attack log session is trimmed based on the comprehensive score to obtain a streamlined attack log;

[0027] S3. Design a prompt for guiding the model based on the streamlined attack log, input the prompt into the large language model to generate file honey spot deployment strategies from the attacker's perspective and the defender's perspective, deploy file honey spots in the file system to be protected based on the honey spot deployment strategies, and regularly update the file modification time of the file honey spots based on the average modification time of normal files in the file system to be protected.

[0028] Specifically, the process of executing step S1 includes:

[0029] S1.1. De-value the file system to be protected to obtain a forged file system;

[0030] S1.2. Capture the attacker’s initial attack log based on a fake file system combined with a trapping tool.

[0031] Specifically, when executing step S1.1, de-valuing the file system to be protected to obtain a forged file system, the file attributes of the forged file system are consistent with the file system to be protected, and the file content is falsified, and the file attributes include file path and file name.

[0032] Specifically, when executing step S1.2, the forged file system and the honeypot are placed in an isolation area when capturing the attacker's initial attack log based on the forged file system combined with the trapping tool, and the attacker's behavior information is recorded based on the honeypot to form an attack log session and save it in the initial attack log.

[0033] Furthermore, the collected attack logs are transmitted to the security administrator device through encryption, and the attack logs are extracted based on the security administrator device.

[0034] Specifically, the process of executing step S2 includes:

[0035] S2.1. Performing a harmfulness score and a time score on each attack log session in the initial attack log based on a large language model;

[0036] S2.2, obtain a comprehensive score based on the hazard score and time score;

[0037] S2.3. Cut the attack log based on the comprehensive score to obtain a simplified attack log.

[0038] Specifically, when executing step S2.1, it includes:

[0039] S2.1.1. Score the harmfulness of the attack log session;

[0040] S2.1.2. Perform time scoring on attack logs.

[0041] Specifically, when executing step S2.1.1 and scoring the harmfulness of the attack log session, a harmfulness score is scored for each attack log session in the initial attack log based on the large language model. When the attack log session contains data theft behavior, the harmfulness score is increased. The data theft behavior includes viewing and copying files.

[0042] Specifically, when performing time scoring on the attack log in step S2.1.2, when performing time scoring on each attack log session in the initial attack log based on the large language model, the value of the attack log session time score depends on the time difference from the current time period.

[0043] Specifically, when executing step S2.2 and obtaining a comprehensive score based on the hazard score and the time score, the comprehensive score is obtained by multiplying the hazard score and the time score.

[0044] Furthermore, the formula for calculating the comprehensive score is as follows:

[0045] W i =D i ×H i ,i∈(1,2,…,n);

[0046] Among them, W i is the comprehensive score, D i Score D for the harmfulness of attack log session i i , H i is the time score of attack log session i, where i is the attack log session.

[0047] Specifically, when executing step S2.3 and cutting based on the comprehensive score to obtain a simplified attack log, when the attack log sessions exceed the quantity limit, the attack log sessions in the attack log are sorted based on the comprehensive score, and the attack log sessions are deleted based on the sorting.

[0048] In fact, if the number of attack logs obtained is too large, it will exceed the maximum token length that the large language model can accept. At this time, the attack logs need to be trimmed to reduce the generation of large model hallucinations and allow the large language model to focus on the attacker's attack behavior of stealing data.

[0049] Specifically, the process of executing step S3 includes:

[0050] S3.1, Prompt for guiding the model based on the simplified attack log;

[0051] S3.2, inputting the Prompt into the large language model to generate the attacker perspective and defender perspective file honey spot deployment strategy;

[0052] S3.3, deploying file honey spots in the file system to be protected based on the honey spot deployment strategy;

[0053] S3.4. Regularly update the file modification time of the file honeypot based on the average modification time of normal files in the file system to be protected.

[0054] Specifically, when executing step S3.1, designing a prompt for guiding the model based on the simplified attack log includes:

[0055] Traverse the file system to be protected to form a file system path tree, write the scenario tasks to be executed, set the priority of the files to be protected from the defense perspective, use the large language model to analyze the priority of attack commands from the attack perspective based on the streamlined attack log, and design a formatted answer template output by the large language model.

[0056] Furthermore, a prompt from the attacker's perspective is constructed based on the streamlined attack log, scenario tasks, priority of files to be protected, priority of attack commands, and formatted answer templates; a prompt from the defender's perspective is constructed based on the file system path tree, scenario tasks, priority of files to be protected, priority of attack commands, and formatted answer templates.

[0057] Furthermore, in the process of writing scenario tasks to be executed, it includes: requiring the file name generated by the large language model to not be the same as the file name in the file system to be protected, using the large knowledge base of the large language model to generate related file content based on the file name, requiring the large language model to analyze the path of the files that the attacker is interested in based on the streamlined log from the attacker's perspective, and generating the file path of the deployment file honeypot based on the number of times the attacker accesses or passes through the path, and analyzing the relative importance of the file path based on the file system path tree from the defender's perspective.

[0058] In fact, when writing scenario tasks to be performed, it is necessary to set a specific scenario for the large language model, such as being in an attack and defense network security drill. At the same time, it is also necessary to briefly introduce the tasks that the large model needs to complete, give task descriptions and requirements, and require the large language model to analyze the attacker's preferred files and habitual file paths in the attack behavior log from the attacker's perspective. From the defender's perspective, the large language model is required to analyze important files that should be protected in the file system. At the same time, both perspectives require the large language model to generate a limited number of attributes related to file honey spots.

[0059] Specifically, when executing step S3.2, the Prompt is input into the large language model to generate the file honey spot deployment strategy for the attacker perspective and the defender perspective, a fixed number of generated file honey spots is given, and the number of generated honey spots is respectively allocated to the attacker perspective and the defender perspective based on the fixed number.

[0060] Furthermore, step S3.3 is executed to deploy file honey spots in the file system to be protected based on the honey spot deployment strategy.

[0061] Specifically, when executing step S3.4, periodically updating the file modification time of the file honey spot based on the average modification time of the normal files in the file system to be protected, it includes:

[0062] Set a time interval and record the file modification time of the file honey point. When the file modification time of the file honey point and the current time period reach the time interval, calculate the average modification time of normal files in the file system to be protected, and update the file modification time of the file honey point based on the average modification time.

[0063] Furthermore, the formula for updating the file honeypoint is as follows:

[0064]

[0065] Among them, t start is the first deployment time of the file honeypot or the file modification time, t now is the current time period, T is the set time interval, The file modification time of other normal files j in the current path.

[0066] In fact, since file honey spots are avoided by normal users, the file modification time of file honey spots is significantly different from that of other normal files in the same path, which can be easily identified by experienced advanced attackers. Therefore, regularly updating the file modification time of file honey spots can increase the confusingness and sweetness of file honey spots.

[0067] In other embodiments, see Figure 2 , including: devaluing the file system to be protected to obtain a forged file system, capturing the attacker's initial attack log based on the forged file system in combination with a trapping tool, comprehensively scoring each attack log session in the initial attack log based on a large language model, trimming based on the comprehensive score to obtain a streamlined attack log, generating a strategy based on an attack and defense perspective, inputting a prompt from the attacker's perspective, allowing the large language model to generate a file honey spot strategy based on the streamlined attack log, inputting a prompt from the defender's perspective, allowing the large language model to generate a file honey spot strategy based on the file system to be protected, giving a fixed number of generated file honey spots, the sum of the numbers of honey spots generated by the attack and defense parties is the fixed number, deploying file honey spots in the system to be protected based on the file honey spot deployment strategy, and regularly updating the file modification time of the file honey spot based on the average modification time of normal files in the file system to be protected.

[0068] Although the embodiments of the present invention are described in detail above, it is obvious to those skilled in the art that various modifications and variations can be made to these embodiments. However, it should be understood that such modifications and variations are within the scope and spirit of the present invention as described in the claims. Moreover, the present invention described herein may have other embodiments and may be implemented or realized in a variety of ways.

Claims

1. A strategy generation method for deploying file honey spots based on a large language model, characterized in that: The following steps are involved: Devalue the file system to be protected to obtain a fake file system, and capture the attacker's initial attack log based on the fake file system and the trapping tool; Performing a harmfulness score and a time score on each attack log session in the initial attack log based on the large language model, obtaining a comprehensive score based on the harmfulness score and the time score, and trimming the attack log session based on the comprehensive score to obtain a streamlined attack log when the attack log session exceeds the quantity limit; A prompt for guiding the model is designed based on a streamlined attack log, and the prompt is input into a large language model to generate file honey spot deployment strategies from the attacker's perspective and the defender's perspective. File honey spots are deployed in the file system to be protected based on the honey spot deployment strategies, and the file modification time of the file honey spots is regularly updated based on the average modification time of normal files in the file system to be protected.

2. According to claim 1, a strategy generation method based on large language model deployment file honeypot, characterized in that: In the process of devaluing the file system to be protected to obtain a forged file system, the file attributes of the forged file system are consistent with the file system to be protected, and the file content is falsified. The file attributes include file path and file name.

3. The strategy generation method based on large language model deployment file honey spot according to claim 1 is characterized in that: The process of capturing the initial attack log of an attacker based on a forged file system combined with a trapping tool includes: placing the forged file system and a honeypot in an isolation area, recording the attacker's behavior information based on the honeypot and forming an attack log session and saving it in the initial attack log.

4. The strategy generation method based on large language model deployment file honeypot according to claim 1 is characterized in that: Based on the large language model, each attack log session in the initial attack log is scored for harmfulness and time, including: Scoring the harmfulness of each attack log session in the initial attack log based on the large language model, and increasing the harmfulness score when the attack log session contains data theft behavior, wherein the data theft behavior includes viewing and copying files; When performing time scoring on each attack log session in the initial attack log based on the large language model, the value of the attack log session time score depends on the time difference from the current time period.

5. The strategy generation method based on large language model deployment file honey spot according to claim 1 is characterized in that: When obtaining a comprehensive score based on the hazard score and the time score, the comprehensive score is obtained by multiplying the hazard score and the time score.

6. The strategy generation method based on large language model deployment file honeypot according to claim 1 is characterized in that: The process of obtaining a simplified attack log by trimming based on the comprehensive score includes: when the attack log sessions exceed the quantity limit, sorting the attack log sessions in the attack log based on the comprehensive score, and deleting the attack log sessions based on the sorting.

7. The strategy generation method based on large language model deployment file honey spot according to claim 1 is characterized in that: The process of designing a prompt for guiding the model based on a streamlined attack log includes: Traverse the file system to be protected to form a file system path tree, write the scenario tasks to be executed, set the priority of the files to be protected from the defense perspective, analyze the priority of attack commands from the attack perspective based on the simplified attack log, and design the formatted answer template output by the large language model; Prompt from the attacker's perspective is constructed based on streamlined attack logs, scenario tasks, priority of files to be protected, priority of attack commands, and formatted answer templates; Construct a prompt from the defender's perspective based on the file system path tree, scenario tasks, priority of files to be protected, priority of attack commands, and formatted answer templates.

8. The strategy generation method for deploying file honey spots based on a large language model according to claim 7, characterized in that: The process of writing the scenario tasks to be performed includes: The file name generated by the large language model must not be the same as the file name in the file system to be protected. The large knowledge base of the large language model is used to generate relevant file content based on the file name. From the attacker's perspective, the large language model is required to analyze the path of the files that the attacker is interested in based on the streamlined log, and to generate the file path of the deployment file honeypot based on the number of times the attacker accesses or passes through the path. From the defender's perspective, the relative importance of the file path is analyzed based on the file system path tree.

9. The strategy generation method based on large language model deployment file honeypot according to claim 1 is characterized in that: When the Prompt is input into the large language model to generate the file honey spot deployment strategy from the attacker's perspective and the defender's perspective, a fixed number of generated file honey spots is given, and the number of generated honey spots is respectively allocated to the attacker's perspective and the defender's perspective based on the fixed number.

10. The strategy generation method based on large language model deployment file honeypot according to claim 1, characterized in that: The file modification time of the file honey point is updated regularly based on the average modification time of normal files in the file system to be protected, including: Set a time interval and record the file modification time of the file honey point. When the file modification time of the file honey point and the current time period reach the time interval, calculate the average modification time of normal files in the file system to be protected, and update the file modification time of the file honey point based on the average modification time.

Images