A Method for Implementing a Trapping System Based on a Large Intelligent Model

Abstract

This invention relates to a method for implementing a decoy system based on an intelligent large-scale model, belonging to the field of network security technology. This invention intercepts attacker packets and simultaneously uses an intelligent large-scale model to generate a variety of fake packets that conform to the attacker's expectations, returning them to the attacker to lure them into further attacks. Finally, the attack traffic is redirected to a highly interactive and realistic honeypot simulation environment, thus achieving the decoy capture of the attacker. Using on-demand generated intelligent fake packets as bait can save significant costs associated with the actual construction of the honeypot, and can more intelligently and dynamically expand the diversity of existing honeypot functionality.

Description

Technical Field

[0001] This invention belongs to the field of network security technology, specifically relating to a method for implementing a trapping system based on an intelligent large model. Background Technology

[0002] With the escalating threat of cyberattacks worldwide, traditional passive security measures such as firewalls and cryptographic machines are no longer sufficient to fully address complex, dynamic, and covert new and unknown threats. Active security measures, such as decoy techniques, are urgently needed to lure and capture diverse cyber threats from powerful adversaries. Active decoy techniques use deception to trick attackers into launching attacks within specific environments. This reduces the threat to actual systems while simultaneously enabling attackers to understand attack methods, acquire attack tools, and support attack attribution. It represents a crucial direction in the field of network security defense. Currently, active decoy techniques typically achieve this by constructing honeypots. Low-interaction honeypots, high-interaction honeypots, and hybrid honeypots are the three most common honeypot forms.

[0003] (1) Low-interaction honeypot: It only simulates part of the system service response and does not execute the actual application code. It has low resource consumption, but may not be able to capture complex attack behaviors.

[0004] (2) High-interaction honeypot: simulates a complete system service and executes actual application code, which can capture more detailed attack behaviors, but consumes more resources and is at risk of being actually exploited.

[0005] (3) Hybrid honeypot: Combining the characteristics of low-interaction and high-interaction honeypots, it can be flexibly configured according to actual needs to achieve the best security performance.

[0006] However, regardless of the type of honeypot, it needs to be created based on a physical honeypot and cannot dynamically, intelligently, or proactively expand the functions beyond the honeypot itself. Therefore, the trapping efficiency is not high and it cannot achieve the goal of luring the enemy to launch more attacks. Summary of the Invention

[0007] (a) Technical problems to be solved

[0008] The technical problem to be solved by this invention is to improve the efficiency of trapping, expand the trapping range, save the huge cost of actually building honeypots, realize the diversity and dynamic expansion of trapping honeypots for complex networks, and to a certain extent solve the problems of static and single traditional honeypots and low hit rate, thereby improving the overall flexibility of honeynets.

[0009] (II) Technical Solution

[0010] To address the aforementioned technical problems, this invention provides a method for implementing a trapping system based on an intelligent large-scale model. This system is designed to include:

[0011] The dynamic camouflage module is used to intercept attack packets such as scanning and probing sent by the attacking host through the interception mechanism and send the packet information to the intelligent big model module; it is also used to send false packet information to the attacking host to induce it to launch further attack behavior; and it is used to guide the attack traffic to the honeypot trapping module, which can realize the trapping, evidence collection and source tracing analysis of network attack threats.

[0012] The intelligent large model module is used to receive message information and then dynamically generate diverse fake message information that meets the attacker's expectations through training and learning, and return the generated fake message information to the dynamic masquerading module.

[0013] The honeypot trapping module is used to construct various types of honeypot simulation environments, receive attack traffic redirected and pulled by the dynamic camouflage module, and combine it with a threat intelligence database to achieve the trapping, evidence collection, and source tracing analysis of network attack threats.

[0014] Preferably, the implementation method of the dynamic camouflage module is as follows:

[0015] (1) Design an interception mechanism to monitor and intercept the message information sent by the attacker to the virtual host in the dynamic masquerading module. The monitored data packets are parsed using deep packet inspection technology. Once the hidden malicious code, malicious probing or attack characteristics are found, the attack message is immediately intercepted by blocking the IP address or port of the attack source.

[0016] (2) Send the intercepted attack message information to the intelligent large model module;

[0017] (3) Receive intelligent fake message information generated by the intelligent large model module and return it to the attacking host;

[0018] (4) Repeat steps (1) to (3) above to continuously intercept the message information sent by the attacking host and return the false information message generated by its intelligent big model module to lure the attacker to further attack behavior.

[0019] (5) Drag the attack traffic to the honeypot trapping module.

[0020] Preferably, the implementation method of the intelligent large model module is as follows:

[0021] (1) Intelligent large-scale model construction and training:

[0022] Dataset collection: Collecting massive amounts of data from diverse data sources;

[0023] Model architecture selection: The model architecture is designed based on Transformer or Llama; a causal decoder architecture is adopted, and a unidirectional mask attention mechanism is used so that each input word only focuses on the word preceding it in the sequence and itself, thereby autoregressively predicting the output word;

[0024] Dataset processing and model training: Processing attack packets into a sequence data format that the model can understand, and selecting appropriate loss functions and optimization algorithms;

[0025] Model tuning phase: Fine-tune the model using labeled data for specific tasks; then, use the alignment technique of the self-game preference optimization method SPPO to optimize the model behavior through the self-game framework. In this process, the win rate of each output is estimated based on the labeling of the preference model, thereby further fine-tuning the model parameters so that the output with a win rate higher than the preset value has a higher probability of occurrence. The goal of the self-game is to fine-tune the model itself to outperform the previous model.

[0026] Model evaluation and validation phase: Periodically evaluate the model's performance on the test set, using a test set independent of the training process to assess the model's generalization ability and accuracy;

[0027] (2) Application of intelligent large-scale models:

[0028] Message Input: Input the attack message information intercepted by the dynamic masquerade module;

[0029] Message generation: Utilizes a trained model to generate fake message information that conforms to the attacker's expectations;

[0030] Message return: The generated false information message is returned to the dynamic masquerading module.

[0031] The present invention also provides a trapping system designed based on the method described above.

[0032] The present invention also provides an application of the method in network security.

[0033] (III) Beneficial Effects

[0034] (1) This invention protects the real system from the attacker's attack by intercepting the attacker's attack message, thus achieving the protection of the real system;

[0035] (2) This invention generates a variety of accurate fake messages through intelligent large model and returns them to the attacker, thus deceiving and enticing the attacker to launch further attacks. By generating intelligent fake messages on demand, it realizes the infinite intelligent expansion of existing honeypots, which is highly adaptable, flexible and convenient, and saves the huge cost of actually building a large number of honeypots. Attached Figure Description

[0036] Figure 1 This is a diagram showing the overall implementation architecture of the trapping system of the present invention;

[0037] Figure 2 The flowchart of the trapping system designed for this invention. Detailed Implementation

[0038] To make the objectives, contents, and advantages of the present invention clearer, the specific embodiments of the present invention will be described in further detail below with reference to the accompanying drawings and examples.

[0039] This invention provides a method for implementing a decoy system based on an intelligent large-scale model. This method first protects the real system from attacks by intercepting attack packets sent by attackers. Then, it generates fake packets using an intelligent large-scale model and returns them to the attacker. By using fake packets, it expands the functionality of existing honeypots, improving decoy efficiency, broadening the decoy range, and saving the significant overhead of building actual honeypots. This achieves diversity and dynamic expansion of decoy honeypots for complex networks, solving to some extent the problems of traditional honeypots being static, limited, and having low hit rates, thus improving the overall flexibility of the honeynet. This invention is a proactive defense measure against common complex network security threats, used to decoy known and unknown threats such as reconnaissance, access, deception, attack exploitation, payload delivery, information leakage, and information tampering.

[0040] The technical solution used by this invention to solve its technical problem is: a method for implementing a decoy system based on an intelligent large model. This method consists of three parts: a dynamic camouflage module, an intelligent large model module, and a honeypot decoy module. First, the dynamic camouflage module intercepts every scan, probe, and other attack behavior sent by the attacker through an interception mechanism, and sends the attack packets to the intelligent large model module. The intelligent large model module generates and returns a large amount of false packet information expected by the attacker through complex learning, thereby enticing the attacker to launch further attack behaviors. Finally, the dynamic camouflage module redirects the attack traffic to the honeypot decoy module, which uses a realistic high-interaction environment to perform source tracing analysis and decoy evidence collection of network attack threats.

[0041] Figure 1 This section describes the module design and overall architecture of a honeypot trapping method based on a large intelligent model. The specific process is as follows:

[0042] (1) The dynamic camouflage module intercepts the attack packets such as scanning and probing sent by the attacking host through the interception mechanism and sends the packet information to the intelligent big model module;

[0043] (2) After receiving the message information, the intelligent big model module dynamically generates diverse false message information that meets the attacker's expectations through training and learning, and returns the generated false message information to the dynamic masquerading module.

[0044] (3) The dynamic masquerading module sends false message information to the attacking host to induce it to launch further attack behavior;

[0045] (4) The dynamic camouflage module directs the attack traffic to the honeypot trapping module, which then performs the trapping, evidence collection, and source tracing analysis of network attack threats.

[0046] The method for implementing the trapping system based on a large intelligent model of the present invention includes the following three main modules:

[0047] (1) The dynamic masquerade module intercepts the message information sent by the attacking host through the interception mechanism and returns a large number of different false message information generated by the intelligent big model module to protect the real system from attack and lure the attacker to launch further attacks.

[0048] (2) Intelligent large model module: Input the attack message information such as scanning and probing sent by the attacker, and generate a large number of false message information expected by the attacker through complex training and learning.

[0049] (3) Honeypot trapping module: Constructs various types of highly interactive and realistic simulation environments, receives attack traffic redirected by the dynamic camouflage module, and combines it with threat intelligence database to achieve trapping, evidence collection and source tracing analysis of network attack threats.

[0050] Figure 2 This is the overall flowchart of the implementation method of the trapping system based on the intelligent large model, which mainly involves three core modules: dynamic camouflage module, intelligent large model module, and honeypot trapping module.

[0051] The specific method includes the following steps:

[0052] 1. The implementation methods of the dynamic camouflage module include:

[0053] (1) Design an interception mechanism to monitor and intercept the message information sent by the attacker to the virtual host in the dynamic masquerading module. Specifically, use deep packet inspection technology to parse the monitored data packets. Once it is found that the packet contains hidden malicious code, malicious probing or attack characteristics, the attack message is immediately intercepted by blocking the IP address or port of the attack source.

[0054] (2) Send the intercepted attack message information to the intelligent large model module;

[0055] (3) Receive intelligent fake message information generated by the intelligent large model module and return it to the attacking host;

[0056] (4) Repeat the above steps to continuously intercept the message information sent by the attacking host and return the false information message generated by its intelligent big model module to lure the attacker into further attack behavior.

[0057] (5) Drag the attack traffic to the honeypot trapping module.

[0058] 2. The implementation methods of the intelligent large model module include:

[0059] (1) Intelligent large-scale model construction and training:

[0060] Dataset collection: Collect massive amounts of data from diverse data sources, such as collecting large datasets of attack messages through web crawlers; and collecting relevant data information through books, code repositories, web pages, and dialogue data.

[0061] Model architecture selection: The model architecture is designed based on Transformer or Llama; a causal decoder architecture is adopted, and a unidirectional mask attention mechanism is used so that each input word only focuses on the word preceding it in the sequence and itself, thereby predicting the output word autoregressively.

[0062] Dataset processing and model training: Process the attack packets into a sequence data format that the model can understand, and select appropriate loss functions (such as cross-entropy loss, mean squared error loss, etc.) and optimization algorithms (such as Adam, SGD, particle swarm optimization, cuckoo algorithm, genetic algorithm, simulated annealing algorithm, etc.).

[0063] Model tuning phase: Large models are usually trained for general tasks and are not always suitable for specific tasks. Therefore, the model is fine-tuned using labeled data for specific tasks, such as classic hacker attack packets and related packets for specific attack tasks. The fine-tuned large model has higher accuracy and efficiency on specific tasks and can reduce the total amount of data required to train the large model. Then, the alignment technique of the Self-Playing Preference Optimization (SPPO) method is used to optimize the behavior of the large model through the self-playing framework. Specifically, based on the label of the preference model, the win rate of each output is estimated, thereby further fine-tuning the parameters of the large model so that the output with a high win rate has a higher probability of occurrence. The goal of the self-playing is to fine-tune the model itself to outperform the previous model.

[0064] Model evaluation and validation phase: Periodically evaluate the model's performance on the test set, using a test set independent of the training process to assess the model's generalization ability and accuracy.

[0065] (2) Application of intelligent large-scale models:

[0066] Message Input: Input the attack message information intercepted by the dynamic masquerade module;

[0067] Message generation: Utilize a pre-trained large model to generate fake message information that aligns with the attacker's expectations;

[0068] Message return: The generated false information message is returned to the dynamic masquerading module.

[0069] 3. The implementation methods of the honeypot trapping module include:

[0070] A highly interactive and realistic honeypot simulation environment is constructed to mimic an application environment with functions close to a real network. It receives attack traffic redirected and pulled by dynamic masquerading modules, and, combined with a threat intelligence database, enables the capture, evidence collection, and source tracing analysis of network attack threats. The honeypot simulation environment includes, but is not limited to:

[0071] (1) Common operating system emulation: Windows 7, Windows 8, Windows 10, Windows 11, Windows XP, Linux, NeoKylin, GalaxyKylin, etc.

[0072] (2) Common port simulation: FTP, SSH, HTTP, HTTPS, SMTP, TELNET, etc.;

[0073] (3) Common database simulations: MySQL, Oracle, SQL Server, PostgreSQL, MongoDB, Redis, etc.;

[0074] (4) Common application simulations: Tomcat, Nginx, Django, HADOOP, Apache Shiro, etc.;

[0075] (5) Common vulnerability simulation: SQL injection, cross-site scripting attack, cross-site request forgery, file inclusion vulnerability, file upload vulnerability, weak password vulnerability, etc.

[0076] As can be seen, this invention proposes a method for implementing a decoy system based on an intelligent large-scale model. The aim is to intercept attacker packets while simultaneously generating a variety of false packets that conform to the attacker's expectations using the intelligent large-scale model and returning them to the attacker, thereby luring the attacker to launch further attacks. Finally, the attack traffic is redirected to a highly interactive and realistic honeypot simulation environment, achieving the decoy capture of the attacker. Using on-demand generated intelligent false packets as bait can save significant costs associated with the actual construction of the honeypot and more intelligently and dynamically expand the diversity of existing honeypot functionalities.

[0077] The above description is only a preferred embodiment of the present invention. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the technical principles of the present invention, and these improvements and modifications should also be considered within the scope of protection of the present invention.

Claims

1. A method for implementing a trapping system based on an intelligent large-scale model, characterized in that, The system is designed to include: The dynamic camouflage module is used to intercept attack packets sent by the attacking host through the interception mechanism and send the packet information to the intelligent big model module; it is also used to send false packet information to the attacking host to induce it to launch further attack behavior; and it is used to guide the attack traffic to the honeypot trapping module, which can realize the trapping, evidence collection and source tracing analysis of network attack threats. The intelligent large model module is used to receive message information and then dynamically generate diverse fake message information that meets the attacker's expectations through training and learning, and return the generated fake message information to the dynamic masquerading module. The honeypot trapping module is used to construct various types of honeypot simulation environments, receive attack traffic redirected and pulled by the dynamic camouflage module, and combine it with the threat intelligence database to achieve the trapping, evidence collection, and source tracing analysis of network attack threats. The implementation method of the intelligent large model module is as follows: (1) Construction and training of large intelligent models: Dataset collection: Collecting massive amounts of data from diverse data sources; Model architecture selection: The model architecture is designed based on Transformer or Llama; a causal decoder architecture is adopted, and a unidirectional mask attention mechanism is used so that each input word only focuses on the word preceding it in the sequence and itself, thereby autoregressively predicting the output word; Dataset processing and model training: Processing attack packets into a sequence data format that the model can understand, and selecting appropriate loss functions and optimization algorithms; Model tuning phase: Fine-tune the model using labeled data for specific tasks; then, use the alignment technique of the self-game preference optimization method SPPO to optimize the model behavior through the self-game framework. In this process, the win rate of each output is estimated based on the labeling of the preference model, thereby further fine-tuning the model parameters so that the output with a win rate higher than the preset value has a higher probability of occurrence. The goal of the self-game is to fine-tune the model itself to outperform the previous model. Model evaluation and validation phase: Periodically evaluate the model's performance on the test set, using a test set independent of the training process to assess the model's generalization ability and accuracy; (2) Application of intelligent large-scale models: Message Input: Input the attack message information intercepted by the dynamic masquerade module; Message generation: Utilizes a trained model to generate fake message information that conforms to the attacker's expectations; Message return: The generated false information message is returned to the dynamic masquerading module.

2. The method as described in claim 1, characterized in that, The implementation method of the dynamic camouflage module is as follows: (1) Design an interception mechanism to monitor and intercept the message information sent by the attacker to the virtual host in the dynamic masquerading module. The monitored data packets are parsed using deep packet inspection technology. Once the hidden malicious code, malicious probing or attack characteristics are found, the attack message is immediately intercepted by blocking the IP address or port of the attack source. (2) Send the intercepted attack message information to the intelligent large model module; (3) Receive the intelligent fake message information generated by the intelligent large model module and return it to the attacking host; (4) Repeat steps (1) to (3) above to continuously intercept the message information sent by the attacking host and return the false information message generated by its intelligent big model module to lure the attacker to further attack behavior; (5) Drag the attack traffic to the honeypot trapping module.

3. The method as described in claim 1, characterized in that, When collecting datasets, the intelligent large model module collects attack message datasets through web crawlers and collects relevant data information through books, code libraries, web pages, and dialogue corpora.

4. The method as described in claim 1, characterized in that, The loss function includes cross-entropy loss and mean squared error loss.

5. The method as described in claim 1, characterized in that, Optimization algorithms include Adam, SGD, particle swarm optimization, cuckoo algorithm, genetic algorithm, and simulated annealing algorithm.

6. The method as described in claim 1, characterized in that, The honeypot simulation environment built by the honeypot trapping module includes: operating system simulation environment, port simulation environment, database simulation environment, application simulation environment, and vulnerability simulation environment.

7. The method as described in claim 1, characterized in that, This system is capable of luring and capturing known and unknown threats such as reconnaissance, access, deception, attack exploitation, payload delivery, information leakage, and information tampering.

Images