A configuration file protection method based on dynamic redirection

Abstract

The present invention provides a configuration file protection method based on dynamic redirection, which relates to the field of information security technology. The configuration file protection method includes the following steps: based on the system identifying the configuration file to be protected and transferring it to a safe storage location, based on the software and hardware characteristics of the user terminal device, a highly simulated bait configuration file is generated in the original path of the configuration file to be protected; based on the file system filter driver, the process requesting access to the configuration file to be protected is automatically captured and passed to the redirection decision engine, and the redirection decision engine is used to determine the process requesting access; when the request process is determined to be a legal behavior, the system redirects the access path to the real configuration file; when it is determined to be an abnormal or suspicious request, the request process path will be redirected to the bait configuration file, inducing the process to access forged data. The configuration file protection method provided by the present invention realizes transparent protection of the client configuration file, improving security and obfuscation.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to a configuration file protection method based on dynamic redirection. Background Art

[0002] With the rapid development of information technology and the internet, personal devices have become essential tools for users to access networks and manage data. Modern client applications and maintenance tools often store numerous configuration files on user devices. These files contain sensitive information such as user accounts, keys, and network configuration information, enabling users to quickly access personalized services. However, if client configuration files are stolen by malicious attackers, they can lead to user account theft, system intrusion, and even serious information leakage and financial loss. With the increasing number of attacks targeting configuration files, it is imperative to improve the security protection of client configuration files.

[0003] In the field of network security, honeypot and honeytoken technologies are becoming increasingly popular as active defense measures. Honeypot technology creates fake systems or network nodes to entrap attackers and record their attack behavior. Honeytokens are fake digital resources with a tag, such as fake accounts, files, or database records, deployed in critical system locations to trick attackers into attempting to exploit these resources. However, honeypot and honeytoken technologies are primarily used on servers and in centrally managed systems. Existing honeytoken deployment and decoy mechanisms primarily protect databases and key nodes, but lack effective protection for terminal client configuration files.

[0004] Therefore, it is urgent to provide a solution to solve the above problems. Summary of the Invention

[0005] The purpose of the present invention is to provide a configuration file protection method based on dynamic redirection, which improves the problem of insufficient security of configuration file protection in the prior art.

[0006] The present invention provides a configuration file protection method based on dynamic redirection, which adopts the following technical solutions:

[0007] The system identifies the configuration file to be protected and transfers it to a secure storage location. Based on the software and hardware characteristics of the user's terminal device, a highly simulated decoy configuration file is generated in the original path of the configuration file to be protected.

[0008] Automatically capture processes requesting access to protected configuration files based on the file system filter driver, extract key attributes of the processes, and pass them to the redirection decision engine. The redirection decision engine then determines the access request based on blacklist and whitelist filtering rules, context detection, and behavior pattern analysis.

[0009] When a request process is judged to be a legitimate behavior, the system will redirect the access path to the real configuration file. When it is judged to be an abnormal or suspicious request, the request process path will be redirected to the bait configuration file, inducing the process to access forged data.

[0010] Optionally, the system identifies the configuration files to be protected and transfers them to a secure storage location, including:

[0011] When the system is first run, it will automatically scan, identify and record a list of all installed applications and software that support configuration file redirection. The scan results include software names, version information and default paths of configuration files, and the results are stored in an encrypted database file.

[0012] The system displays the scanning results to the user in the form of a list, outputs a prompt for the user to select the configuration file of the application to be protected, and transfers the extracted configuration file information to be protected to a secure storage area based on the user's selection.

[0013] Optionally, the process of generating a highly simulated decoy configuration file in the original path of the configuration file to be protected based on the software and hardware characteristics of the user terminal device includes:

[0014] Based on the software and hardware characteristics of the user's terminal device, the usage pattern and access characteristics of the configuration file are analyzed, and the structural template of the real configuration file is used in combination with random parameters to generate a highly simulated bait file in the original path of the configuration file to be protected, and the bait account and password information are set for the account and password fields of the configuration file.

[0015] Optionally, after the user selects the configuration file of the application to be protected, the server-side collaborative module will filter the honeypot that matches the selected program from the honeypot library based on the selected program and deploy it to the isolated server environment. The honeypot will focus on monitoring the set bait account and capture any attack activities that attempt to use the bait account for illegal access.

[0016] Optionally, the process of automatically capturing the process requesting to access the configuration file to be protected based on the file system filter driver and extracting key attributes of the process and passing them to the redirection decision engine includes:

[0017] When a process initiates an access request and attempts to access the protected configuration file, the file system filter driver automatically captures the request and interrupts the process to directly enter the file system;

[0018] After capturing the access request, the filter driver extracts the key attributes of the request and passes them to the redirection decision engine. The key attributes include the target file path, the process ID that initiated the request, and the access mode.

[0019] Optionally, the redirection decision engine determines the process requesting access based on blacklist and whitelist filtering rules, context detection, and behavior pattern analysis, including:

[0020] Obtaining a system whitelist and blacklist, wherein the whitelist contains authorized processes and the blacklist includes known malicious processes or software explicitly marked as a threat;

[0021] The process requesting access is judged based on the blacklist and whitelist. When the process requesting access matches the whitelist rules, it is directly judged as trusted access and the path is redirected to the real configuration file path. When the process requesting access matches the blacklist rules, it is directly judged as untrusted access and the path is redirected to the bait file path. When the process requesting access matches neither the whitelist nor the blacklist, the process requesting access is judged based on context environment detection and behavior pattern analysis.

[0022] Optionally, the process of determining the access requesting process based on context detection and behavior pattern analysis includes:

[0023] Analyze the system context and process context, and map their characteristics to a scoring function for comprehensive evaluation. This generates a score for the abnormality of the current system state and access behavior. When the score exceeds a threshold, the system determines that the current environment is abnormal and marks the process requesting access as a potential threat. The path is redirected to a decoy file path. Otherwise, the process requesting access is judged based on behavioral pattern analysis.

[0024] The system context includes CPU occupancy, number of network connections, system running time, and user authority level; the process context environment includes the parent process chain that initiated the process, memory occupancy, number of threads and their behavior patterns.

[0025] Optionally, the process of determining the process requesting access based on behavior pattern analysis includes:

[0026] Based on a fixed time window defined by the system, historical behavior data of the process is extracted and sorted based on time to form a time behavior sequence;

[0027] Calculate the downsampling factor based on the activity of the time behavior series, and perform sparse processing on the behavior data of the time behavior series based on the dynamic downsampling mechanism;

[0028] The downsampled time behavior sequence is input into the fast dynamic time warping algorithm and matched with the templates in the malicious behavior template library to obtain the matching distance;

[0029] When the matching distance exceeds a preset abnormal threshold, the current behavior sequence is determined to be abnormal, and the process path is redirected to the bait file, otherwise the path is redirected to the real configuration file path.

[0030] Optionally, the process of extracting the historical behavior data of the process and sorting the data based on time to form a time behavior sequence includes:

[0031] When the process is run for the first time or the historical behavior data is insufficient, the system will first refer to the behavior characteristics of the parent process to fill in the actual part; when the behavior data of the parent process is unavailable, the missing data will be inferred based on the known behavior characteristics through zero filling or neighboring interpolation, thereby ensuring the integrity of the time series and the accuracy of the analysis.

[0032] Optionally, the client is responsible for monitoring all access behaviors to the bait configuration files and reporting the access logs to the server. The server will also record and issue an alarm. The honeypot of the server-side collaborative module is responsible for capturing logins or other illegal access behaviors to the bait account, and generates a complete attack path analysis report based on the access logs, sending detailed alarm information to the user and informing him that the device may have been hacked.

[0033] The present invention provides a configuration file protection method based on dynamic redirection, which has the following beneficial effects:

[0034] 1. The present invention achieves transparent protection of client configuration files through dynamic redirection technology, can intelligently identify access behavior and guide abnormal requests to bait files without requiring user program changes, thereby improving security and obfuscation;

[0035] 2. The redirection decision engine combines blacklists and whitelists, context analysis, and behavioral pattern analysis, balancing real-time performance with accuracy to build a hierarchical comprehensive judgment system, significantly improving the accuracy of detecting malicious access behavior.

[0036] 3. Generate highly simulated bait files through the client and deploy them in the real configuration file path. Combined with the server-side honeypot system to guide abnormal access behavior, it has high scalability and practicality, and can effectively defend against various attack threats against configuration files. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] Figure 1 This is a flow chart of a configuration file protection method based on dynamic redirection provided by the present invention. DETAILED DESCRIPTION

[0038] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention. Unless otherwise defined, the technical terms or scientific terms used herein should be the common meanings understood by people with ordinary skills in the field to which the invention belongs. The words "including" and similar words used in this article mean that the elements or objects appearing before the word cover the elements or objects listed after the word and their equivalents, without excluding other elements or objects.

[0039] The embodiment of the present invention provides a configuration file protection method based on dynamic redirection, see Figure 1 ,include:

[0040] S1. The system identifies the configuration file to be protected and transfers it to a secure storage location. Based on the software and hardware characteristics of the user terminal device, a highly simulated decoy configuration file is generated in the original path of the configuration file to be protected;

[0041] S2. Automatically capture the process requesting access to the protected configuration file based on the file system filter driver, extract key attributes of the process, and pass them to the redirection decision engine. The redirection decision engine determines the process requesting access based on blacklist and whitelist filtering rules, context detection, and behavior pattern analysis;

[0042] S3. When the request process is judged to be a legitimate behavior, the system will redirect the access path to the real configuration file. When it is judged to be an abnormal or suspicious request, the request process path will be redirected to the bait configuration file to induce the process to access forged data.

[0043] In some embodiments, the process of executing step S1 includes:

[0044] S1.1. Identify the configuration files to be protected based on the system and transfer them to a secure storage location;

[0045] S1.2. Generate a highly simulated decoy configuration file in the original path of the configuration file to be protected based on the software and hardware characteristics of the user terminal device;

[0046] S1.3. Deploy honeypot based on the server-side collaborative module.

[0047] Specifically, when executing step S1.1, it includes: when the system is run for the first time, it will automatically scan, identify and record a list of all installed applications and software that support configuration file redirection. The scanning results include the software name, version information and the default path of the configuration file, and the results are stored in an encrypted database file.

[0048] Furthermore, the system displays the scanning results to the user in a list, outputs a prompt for the user to select a configuration file of the application to be protected, and transfers the extracted configuration file information to be protected to a secure storage area based on the user's selection.

[0049] Specifically, when executing step S1.2, it includes: analyzing the usage pattern and access characteristics of the configuration file based on the software and hardware characteristics of the user terminal device, using the structural template of the real configuration file, combining random parameters to generate a highly simulated bait file in the original path of the configuration file to be protected, and setting the bait account and password information for the account and password fields of the configuration file.

[0050] Specifically, when executing step S1.3, it includes: after the user selects the configuration file of the application to be protected, the server-side collaborative module will filter the honeypot that matches the selected program from the honeypot library based on the selected program, and deploy it to the isolated server environment. The honeypot will focus on monitoring the set bait account and capture any attack activities that attempt to use the bait account for illegal access.

[0051] In practice, on the client side, the system first automatically identifies the program requiring protection and its configuration file path, transfers the actual configuration file from the original path to the new path, and generates a decoy file highly similar to the actual configuration file and deploys it in the original path of the actual configuration file to induce and confuse potential attacks. At the same time, the client is responsible for monitoring all access to the decoy configuration file and using a decision engine to determine the legitimacy of process access. Once abnormal access behavior is detected, the system records it and synchronizes it to the server in real time, facilitating centralized analysis and rapid response by the server. This client-side deployment and monitoring process ensures the local protection effectiveness of the decoy configuration file, enabling applications to transparently protect the configuration file without changing their usage.

[0052] Furthermore, on the server side, the system uses a collaborative module to centrally analyze abnormal behavior data transmitted by the client. The server aggregates and analyzes the access records and abnormal behavior characteristics reported by the client, and dynamically adjusts the deployment content and protection strategies of the bait files by combining threat intelligence and historical attack data. At the same time, the server supports centralized management and rapid distribution of policies, and can synchronize updated bait file configurations and access rules to multiple clients to respond to new threats or changing attack patterns. In addition, the server cooperates with the honeypot system to guide abnormal access behaviors into a virtual honeypot environment, recording the attacker's behavioral trajectory, attack methods, and utilization paths. This method can not only further confuse attackers, but also provide rich data support for subsequent traceability analysis and behavior pattern research.

[0053] In some embodiments, the process of executing step S2 includes:

[0054] S2.1. Automatically capture processes that request access to protected configuration files based on the file system filter driver.

[0055] S2.2. Extract key attributes of the process and pass them to the redirection decision engine;

[0056] S2.3. Determine the process requesting access based on blacklist and whitelist filtering rules, context detection, and behavior pattern analysis.

[0057] Specifically, when executing step S2.1, it includes: when a process initiates an access request and attempts to access the configuration file to be protected, the file system filter driver automatically captures the request and interrupts the process to directly enter the file system.

[0058] The File System Filter Driver (FSFD) is a kernel-level technology that implements real-time interception and processing of file operation requests by loading the driver module into the operating system's file system driver stack. It intercepts file operation requests before they reach the file system, providing the technical foundation for dynamic redirection.

[0059] Further, step S2.2 is executed. After capturing the access request, the filter driver extracts the key attributes of the request and passes these key attributes to the redirection decision engine. The key attributes include the target file path, the process ID that initiates the request, and the access mode.

[0060] Specifically, the process of executing step S2.3 includes:

[0061] S2.3.1. Determine the process requesting access based on blacklist and whitelist filtering rules;

[0062] S2.3.2. Determine the process requesting access based on context detection;

[0063] S2.3.3. Determine the process requesting access based on behavioral pattern analysis.

[0064] Specifically, when executing step S2.3.1, it includes:

[0065] Obtaining a system whitelist and blacklist, wherein the whitelist contains authorized processes and the blacklist includes known malicious processes or software explicitly marked as a threat;

[0066] The process requesting access is judged based on the blacklist and whitelist. When the process requesting access matches the whitelist rules, it is directly judged as trusted access and the path is redirected to the real configuration file path. When the process requesting access matches the blacklist rules, it is directly judged as untrusted access and the path is redirected to the bait file path. When the process requesting access matches neither the whitelist nor the blacklist, the process requesting access is judged based on context environment detection and behavior pattern analysis.

[0067] In fact, the blacklist and whitelist filtering rules are the first-level filtering mechanism of the redirection decision engine. Their purpose is to quickly screen out completely trusted and completely untrusted access behaviors. The whitelist contains authorized processes, such as system core processes and known trusted applications; the blacklist includes known malicious processes or software clearly marked as threats.

[0068] Specifically, when executing step S2.3.2, it includes:

[0069] The system context environment and process context environment are analyzed, and the system context environment and process context environment characteristics are mapped to the scoring function for comprehensive evaluation to obtain the abnormality degree score of the current system status and access behavior. When the score exceeds the threshold, the system determines that the current environment is abnormal, and marks the process requesting access as a potential threat, and redirects the path to the bait file path. Otherwise, the process requesting access is judged based on behavioral pattern analysis; the system context includes CPU occupancy, number of network connections, system running time, and user permission level; the process context environment includes the parent process chain of the initiating process, memory occupancy, number of threads and its behavioral pattern.

[0070] Furthermore, the mathematical expression of the scoring function is as follows:

[0071]

[0072] Among them, Score context is the abnormality score, f i (x) represents the score function of the i-th context feature, w iis the feature weight, and n is the total number of features.

[0073] Furthermore, the feature weights are initialized using the frequency weight method, with the weight w i The allocation is based on the frequency of the feature's association with abnormal behavior in historical logs, calculated as follows:

[0074]

[0075] Among them, Fq(f i ) represents the feature f i Frequency of occurrence in abnormal behavior records, It is the sum of all feature frequencies. Through normalization, the sum of the weights of all features is ensured to be 1. The initialization data of the weights comes from historical system logs and abnormal behavior case libraries, and is statistically analyzed in combination with the long-term operating environment.

[0076] Specifically, when executing step S2.3.3, it includes:

[0077] S2.3.3.1. Define a time window to extract time behavior sequences;

[0078] S2.3.3.2. Sparse processing of time behavior series based on dynamic downsampling mechanism;

[0079] S2.3.3.3. Calculate the matching distance between the temporal behavior sequence and the malicious behavior template library;

[0080] S2.3.3.4. Make an abnormality determination.

[0081] Specifically, when executing step S2.3.3.1, it includes: defining a fixed time window based on the system, extracting the historical behavior data of the process and forming a time behavior sequence based on time sorting; the time behavior sequence includes system call sequence, file operation frequency, network connection activity, memory usage, etc.

[0082] In fact, the time window can be defined as 5 minutes and updated in real time in a sliding manner to ensure the capture of the latest behavior data while maintaining the continuity and real-time performance of the calculation; the extracted behavior data are then sorted by time to form a time behavior sequence sequence S T ={s t-T ,s t-T+1 ,…,s t}, where element s t Represents the process behavior at time point t.

[0083] Furthermore, when the process is run for the first time or the historical behavior data is insufficient, the system will first refer to the behavior characteristics of the parent process to fill in the actual part; when the behavior data of the parent process is unavailable, the missing data will be inferred based on the known behavior characteristics through zero filling or neighboring interpolation, thereby ensuring the integrity of the time series and the accuracy of the analysis.

[0084] Specifically, when executing step S2.3.3.2, it includes: calculating the downsampling factor based on the activity of the time behavior sequence, and performing sparse processing on the behavior data of the time behavior sequence based on the dynamic downsampling mechanism.

[0085] Furthermore, the calculation formula of the downsampling factor is:

[0086]

[0087] Among them active(S T ) represents the time behavior sequence S in the time window T activity (such as call frequency), and c represents the adjustment parameter.

[0088] In fact, the time behavior sequence after downsampling is S′ T ={s t-T ,s t-T+k ,s t-T+2k ,…}, which retains the core features of behavioral data while significantly reducing the computational complexity.

[0089] Specifically, when executing step S2.3.3.3, it includes: inputting the downsampled time behavior sequence into the fast dynamic time warping algorithm, and performing similarity matching with the templates in the malicious behavior template library to obtain the matching distance.

[0090] Furthermore, the fast dynamic time warping algorithm uses a hierarchical path optimization process to first calculate the global path at a coarse-grained level and then make local adjustments at a fine-grained level to quickly calculate the matching distance. The matching distance is calculated as follows:

[0091] D(S′ T ,M n ) = FDWT(S′ T ,M n );

[0092] Among them, M n Denotes the nth malicious behavior template, D(S′ T ,M n ) is the time behavior sequence S′ T With template M n The matching distance.

[0093] In fact, multiple matching distances are calculated based on the malicious behavior template library, and the minimum matching distance is used to compare the abnormality threshold.

[0094] Specifically, when executing step S2.3.3.4, it includes: when the matching distance exceeds the preset abnormal threshold, determining that the current behavior sequence is abnormal, redirecting the process path to the bait file, otherwise redirecting the path to the real configuration file path.

[0095] In fact, the client is responsible for monitoring all access behaviors to the bait configuration files and reporting the access logs to the server. At the same time, the server will record and issue an alarm; the honeypot of the server-side collaborative module is responsible for capturing logins or other illegal access behaviors to the bait account, and generates a complete attack path analysis report based on the access logs, sending detailed alarm information to the user and informing him that the device may have been hacked.

[0096] While the embodiments of the present invention have been described in detail above, it will be apparent to those skilled in the art that various modifications and variations of these embodiments are possible. However, it should be understood that such modifications and variations are within the scope and spirit of the present invention as set forth in the claims. Furthermore, the invention described herein is susceptible to other embodiments and may be practiced or implemented in a variety of ways.

Claims

1. A configuration file protection method based on dynamic redirection, characterized in that: The following steps are involved: The system identifies the configuration file to be protected and transfers it to a secure storage location. Based on the software and hardware characteristics of the user's terminal device, a highly simulated decoy configuration file is generated in the original path of the configuration file to be protected. Automatically capture processes requesting access to protected configuration files based on the file system filter driver, extract key attributes of the processes, and pass them to the redirection decision engine. The redirection decision engine then determines the access request based on blacklist and whitelist filtering rules, context detection, and behavior pattern analysis. When a request process is judged to be legitimate, the system redirects the access path to the real configuration file. When a request is judged to be abnormal or suspicious, the request process path will be redirected to the decoy configuration file, inducing the process to access forged data. The process of judging the process requesting access based on behavioral pattern analysis includes: Based on a fixed time window defined by the system, historical behavior data of the process is extracted and sorted based on time to form a time behavior sequence; Calculate the downsampling factor based on the activity of the time behavior series, and perform sparse processing on the behavior data of the time behavior series based on the dynamic downsampling mechanism; The downsampled time behavior sequence is input into the fast dynamic time warping algorithm and matched with the templates in the malicious behavior template library to obtain the matching distance; When the matching distance exceeds a preset abnormal threshold, the current behavior sequence is determined to be abnormal, and the process path is redirected to the bait file, otherwise the path is redirected to the real configuration file path.

2. The configuration file protection method based on dynamic redirection according to claim 1, characterized in that: The process of identifying configuration files to be protected and transferring them to a secure storage location based on the system includes: When the system is first run, it will automatically scan, identify and record a list of all installed applications and software that support configuration file redirection. The scan results include software names, version information and default paths of configuration files, and the results are stored in an encrypted database file. The system displays the scanning results to the user in the form of a list, outputs a prompt for the user to select the configuration file of the application to be protected, and transfers the extracted configuration file information to be protected to a secure storage area based on the user's selection.

3. A configuration file protection method based on dynamic redirection according to claim 2, characterized in that: The process of generating a highly simulated decoy configuration file in the original path of the configuration file to be protected based on the software and hardware characteristics of the user terminal device includes: Based on the software and hardware characteristics of the user's terminal device, the usage pattern and access characteristics of the configuration file are analyzed, and the structural template of the real configuration file is used in combination with random parameters to generate a highly simulated bait file in the original path of the configuration file to be protected, and the bait account and password information are set for the account and password fields of the configuration file.

4. A configuration file protection method based on dynamic redirection according to claim 3, characterized in that: After the user selects the configuration file of the application to be protected, the server-side collaborative module will filter the honeypot that matches the selected program from the honeypot library based on the selected program and deploy it to the isolated server environment. The honeypot will focus on monitoring the set bait account and capture any attack activities that attempt to use the bait account for illegal access.

5. The configuration file protection method based on dynamic redirection according to claim 1, characterized in that: The process of automatically capturing processes requesting access to protected configuration files based on the file system filter driver and extracting key attributes of the processes and passing them to the redirection decision engine includes: When a process initiates an access request and attempts to access the protected configuration file, the file system filter driver automatically captures the request and interrupts the process to directly enter the file system; After capturing the access request, the filter driver extracts the key attributes of the request and passes them to the redirection decision engine. The key attributes include the target file path, the process ID that initiated the request, and the access mode.

6. The configuration file protection method based on dynamic redirection according to claim 1, characterized in that: The redirection decision engine determines the process of requesting access based on blacklist and whitelist filtering rules, context detection, and behavior pattern analysis, including: Obtaining a system whitelist and blacklist, wherein the whitelist contains authorized processes and the blacklist includes known malicious processes or software explicitly marked as a threat; The process requesting access is judged based on the blacklist and whitelist. When the process requesting access matches the whitelist rules, it is directly judged as trusted access and the path is redirected to the real configuration file path. When the process requesting access matches the blacklist rules, it is directly judged as untrusted access and the path is redirected to the bait file path. When the process requesting access matches neither the whitelist nor the blacklist, the process requesting access is judged based on context environment detection and behavior pattern analysis.

7. The configuration file protection method based on dynamic redirection according to claim 6, characterized in that: The process of judging the process requesting access based on context detection and behavior pattern analysis includes: Analyze the system context and process context, and map their characteristics to a scoring function for comprehensive evaluation. This generates a score for the abnormality of the current system state and access behavior. When the score exceeds a threshold, the system determines that the current environment is abnormal and marks the process requesting access as a potential threat. The path is redirected to a decoy file path. Otherwise, the process requesting access is judged based on behavioral pattern analysis. The system context includes CPU occupancy, number of network connections, system running time, and user authority level; the process context environment includes the parent process chain that initiated the process, memory occupancy, number of threads and their behavior patterns.

8. The configuration file protection method based on dynamic redirection according to claim 1, characterized in that: The process of extracting the historical behavior data of the process and forming a time behavior sequence based on time order includes: When the process is run for the first time or there is insufficient historical behavior data, the system will first refer to the behavioral characteristics of the parent process to fill in the missing parts; when the behavioral data of the parent process is unavailable, the missing data will be inferred based on the known behavioral characteristics through zero filling or neighboring interpolation, thereby ensuring the integrity of the time series and the accuracy of the analysis.

9. The configuration file protection method based on dynamic redirection according to claim 4, characterized in that: The client is responsible for monitoring all access behaviors to the bait configuration files and reporting the access logs to the server. The server will also record and issue an alarm. The honeypot of the server-side collaborative module is responsible for capturing logins or other illegal access behaviors to the bait account, and generates a complete attack path analysis report based on the access logs, sending detailed alarm information to the user and informing him that the device may have been hacked.

Images