Intelligent tracking and blocking method and system for network attack chain

Abstract

The invention provides an intelligent tracking and blocking method and system for a network attack chain, and relates to the technical field of network security, and the method comprises the steps: collecting network flow data, building an attack chain propagation path, setting a detection breakpoint, obtaining a data sample, carrying out the causal correlation analysis, extracting a data transmission feature, and converting the data transmission feature into a behavior sequence feature; predicting an attack chain evolution path by adopting a bidirectional feature matching mechanism; a honeypot service and a flow probe are deployed to generate an attacker portrait; and formulating a defense strategy according to the attack intention to realize attack chain blocking. According to the invention, accurate identification, effective tracking and active defense of network attacks can be realized, and the network security protection capability is improved.

Description

Technical Field

[0001] The present invention relates to network security technology, and in particular to an intelligent tracking and blocking method and system for a network attack chain. Background Art

[0002] As network attacks become more complex and intelligent, traditional rule-based attack detection methods struggle to cope with the dynamic evolution of attack chains. Existing technologies primarily rely on fixed signature libraries for attack identification, failing to effectively track the propagation paths of attack chains within the network. This leads to blind and ineffective defense deployment.

[0003] Current network protection systems lack the ability to deeply analyze attacker behavior, making it difficult to accurately characterize an attacker's technical characteristics and attack intent. Furthermore, due to the lack of adaptive data collection mechanisms and intelligent feature extraction methods, the quality of collected attack data is low, making it impossible to accurately track the attack chain.

[0004] Existing defense methods often employ static strategies that fail to dynamically adjust defense measures based on the evolution of the attack chain and lack a closed-loop optimization mechanism for defense effectiveness. Therefore, a network attack defense method is urgently needed that can intelligently track the propagation path of the attack chain, accurately analyze attacker behavioral characteristics, and dynamically optimize defense strategies. Summary of the Invention

[0005] The embodiments of the present invention provide a method and system for intelligently tracking and blocking a network attack chain, which can solve the problems in the prior art.

[0006] A first aspect of an embodiment of the present invention provides an intelligent tracking and blocking method for a network attack chain, comprising: Collect network traffic data and establish an attack chain propagation path. Set detection breakpoints along the propagation path, automatically adjust the sampling interval based on network load, obtain data samples at each detection breakpoint, perform causal correlation analysis on the data samples, and extract data transmission characteristics between each node in the attack chain propagation path based on the correlation analysis results. Convert the data transmission characteristics into behavioral sequence characteristics. A two-way feature matching mechanism is used to match behavior sequence features with preset attack patterns to obtain similarity. When the similarity exceeds a dynamic threshold, the attack chain evolution path is predicted based on the behavior sequence features, and the defense deployment node location is determined based on the attack chain evolution path. Deploy honeypot services and traffic probes at defense deployment nodes. Use the honeypot services to capture attacker behavior, and use the traffic probes to capture attack traffic characteristics. Generate an attacker profile based on these behaviors and traffic characteristics. Determine the attack intent based on the attacker's profile analysis, formulate a defense strategy including access control and traffic redirection based on the attack intent, send the defense strategy to the defense device to block the attack chain, obtain the blocking results and optimize the defense strategy based on the blocking results.

[0007] In an optional embodiment, Collect network traffic data and establish the attack chain propagation path. Set detection breakpoints along the propagation path and automatically adjust the sampling interval based on the network load. The data samples obtained at each detection breakpoint include: Acquire network traffic data, calculate the number of data packets, the amount of transmitted bytes, and the link utilization of the network link to obtain a network load status, and dynamically adjust a sampling time interval according to the network load status, increasing the sampling time interval when the network load status is higher than a preset load threshold, and decreasing the sampling time interval when the network load status is lower than the preset load threshold; Performing session reorganization on the collected network traffic data, extracting the source and destination addresses, communication time, and protocol type of the session, using the source and destination addresses as communication nodes, sorting the data transmission between nodes based on the communication time, and marking the association between nodes based on the protocol type; Analyze the transmission rate and interaction frequency between nodes, construct the node combination that meets the preset transmission rules into the initial attack chain, and verify the attack chain propagation path based on the protocol changes and data flow between nodes in the initial attack chain; Calculate the number of connections and data throughput of nodes in the attack chain propagation path to obtain the node monitoring priority, determine the monitoring location based on the node monitoring priority, set a detection point at the monitoring location, collect application layer data, extract the load content and behavior characteristics, group the data according to the sampling time interval and detection breakpoint identifier, and obtain data samples at each detection point.

[0008] In an optional embodiment, Perform causal correlation analysis on data samples, extract data transmission features between nodes in the attack chain propagation path based on the correlation analysis results, and convert data transmission features into behavioral sequence features, including: Construct a time series sequence according to the timestamps of the data samples, calculate the conditional mutual information of adjacent data samples in the time series sequence to obtain a sample influence value, determine the time window size based on the sample influence value, and perform time series grouping on the data samples to obtain grouped data; Performing causal association calculations on sample pairs in the packet data to obtain association strength values, clustering the packet data based on the association strength values to obtain data transmission patterns, extracting flow change features, protocol conversion features, and delay distribution features from the data transmission patterns, and combining them to form a data transmission feature matrix, and calculating feature conversion probabilities based on the data transmission feature matrix to obtain a feature mapping matrix; A feature mapping deviation value is calculated according to historical defense results, a feature mapping matrix is updated based on the feature mapping deviation value, and the data transmission feature matrix is converted into a behavior feature sequence using the updated feature mapping matrix.

[0009] In an optional embodiment, A two-way feature matching mechanism is used to match the behavior sequence features with the preset attack pattern to obtain similarity. When the similarity exceeds the dynamic threshold, the attack chain evolution path is predicted based on the behavior sequence features. The defense deployment node location is determined based on the attack chain evolution path, including: Extract instruction-level switching data, memory access data, and process communication data from behavioral sequence features to generate a timing feature sequence; Segmenting the temporal feature sequence to obtain a behavior phase set, dividing the behavior phase set into multiple overlapping subsequences, calculating the longest common subsequence length between the overlapping subsequences and a preset attack pattern to obtain a local matching degree, and calculating the global similarity based on the cumulative distribution of the local matching degrees; Calculating a compensation coefficient based on historical matching samples, multiplying the compensation coefficient by a reference threshold to obtain a dynamic threshold, comparing the global similarity with the dynamic threshold, and constructing a state transition matrix according to a set of behavior stages when the global similarity exceeds the dynamic threshold; Constructing a Markov gain matrix based on the state transition matrix, calculating the eigenvector of the Markov gain matrix to obtain node importance, and selecting the path with the largest node importance as the attack chain evolution path; The ratio of the in-degree centrality to the out-degree centrality of each node in the attack chain evolution path is calculated to obtain the node influence coefficient, and the defense deployment node position is determined according to the node influence coefficient sorted from large to small.

[0010] In an optional embodiment, Deploy honeypot services and traffic probes at defense deployment nodes. Use the honeypot service to obtain attacker operation behavior, and use the traffic probe to obtain attack traffic characteristics. Generate an attacker profile based on the operation behavior and traffic characteristics, including: Deploy honeypot services and traffic probes at defense deployment nodes; An instruction execution environment including a real instruction pipeline and a virtual instruction pipeline is constructed in the honeypot service, the attacker's operation behavior is sent to the real instruction pipeline and the virtual instruction pipeline for execution at the same time, and the execution difference between the two pipelines is extracted to obtain the operation disturbance feature; Identifying the attacker's hidden operation behavior according to the operation disturbance characteristics, building a deception response environment based on the hidden operation behavior, returning a response result that meets the attacker's expectations in the deception response environment, and recording the attacker's subsequent operation behavior; Acquire attack traffic through the traffic probe and extract payload data of the attack traffic; Performing deep packet parsing on the payload data to obtain a protocol field structure, calculating information entropy of the protocol field structure to obtain a traffic feature, and identifying an attacker's traffic disguise method based on the traffic feature; The operation behavior and traffic characteristics are mapped in the time dimension, and the associated part of the mapping result is extracted to obtain the attack characteristics. The attack process is divided into multiple stages according to the attack characteristics, and an attacker portrait is generated based on the hidden operation behavior and traffic characteristics of each stage.

[0011] In an optional embodiment, Performing deep packet parsing on the payload data to obtain a protocol field structure, calculating information entropy of the protocol field structure to obtain traffic characteristics, and identifying the attacker's traffic disguise method based on the traffic characteristics includes: Performing hierarchical parsing on the payload data, calculating the conditional probability distribution of the byte sequence using a sliding window, dividing the associated byte sequence into field units based on the conditional probability distribution, and constructing the field units into a protocol field tree; At each layer of the protocol field tree, the field type distribution is calculated to obtain a type entropy value, and the field length distribution is calculated to obtain a length entropy value. Based on the type entropy value and the length entropy value, the structural features of the current layer are constructed. The differences in the structural features between adjacent layers in the protocol field tree are extracted to obtain an inter-layer difference sequence. A structural mutation layer is identified from the inter-layer difference sequence. The structural mutation layer corresponds to the attacker's protocol rewrite location. A time series analysis is performed on the structural features of the structural mutation layer to obtain a change cycle. The structural features are grouped based on the change cycle, and the fluctuation law of each group of features is calculated to obtain an obfuscation pattern. The protocol rewrite position and the obfuscation pattern are combined to form a protocol deformation feature. The traffic camouflage method used by the attacker is identified based on the protocol deformation feature.

[0012] In an optional embodiment, Determine attack intent based on attacker profiling, formulate defense strategies based on attack intent, including access control and traffic redirection, distribute these strategies to defense devices to block the attack chain, obtain blocking results, and optimize defense strategies based on these results. This includes: Extract attack path features from the attacker portrait, calculate the node state distribution in the attack path features to obtain a state transition probability, perform an association operation on the current attack state and the state transition probability to obtain a target node prediction probability, and determine the attack intention based on the target node prediction probability; Analyze the affected nodes according to the attack intention, and generate an access control policy based on the distribution location of the affected nodes and the degree of damage of the attack intention, wherein the access control policy includes node access rights and operation restriction conditions; Constructing an induction environment at the affected node, setting response characteristics of the induction environment based on the attack intent, and generating a redirection strategy for directing attack traffic to the induction environment; Classifying the access control policy and redirection policy according to the processing performance of the defense device to generate a basic defense policy and an enhanced defense policy; Issue basic defense strategies and enhanced defense strategies to defense devices, collect blocking data and performance data during the defense strategy execution process, calculate defense effects based on the blocking data, adjust the access permission granularity in the access control strategy and the traffic guidance ratio in the redirection strategy based on the defense effects and performance data, and update basic defense strategies and enhanced defense strategies.

[0013] A second aspect of an embodiment of the present invention provides an intelligent network attack chain tracking and blocking system, comprising: The first unit is used to collect network traffic data and establish the attack chain propagation path. It sets detection breakpoints on the propagation path, automatically adjusts the sampling interval according to the network load, obtains data samples at each detection breakpoint, performs causal correlation analysis on the data samples, extracts the data transmission characteristics between each node in the attack chain propagation path based on the correlation analysis results, and converts the data transmission characteristics into behavioral sequence characteristics. The second unit is used to match the behavior sequence features with the preset attack pattern using a bidirectional feature matching mechanism to obtain similarity. When the similarity exceeds a dynamic threshold, the attack chain evolution path is predicted based on the behavior sequence features and the defense deployment node location is determined based on the attack chain evolution path. The third unit is used to deploy honeypot services and traffic probes at defense deployment nodes. The honeypot service is used to obtain attacker operation behavior, and the traffic probe is used to obtain attack traffic characteristics. The attacker profile is generated based on the operation behavior and traffic characteristics. Unit 4: Determine attack intent based on attacker profile analysis, formulate defense strategies including access control and traffic redirection based on attack intent, send defense strategies to defense devices to block attack chains, obtain blocking results, and optimize defense strategies based on blocking results.

[0014] According to a third aspect of an embodiment of the present invention, an electronic device is provided, including: processor; a memory for storing processor-executable instructions; The processor is configured to call the instructions stored in the memory to execute the aforementioned method.

[0015] According to a fourth aspect of an embodiment of the present invention, a computer-readable storage medium is provided, on which computer program instructions are stored. When the computer program instructions are executed by a processor, the method described above is implemented.

[0016] In this embodiment, by collecting network traffic data and establishing the attack chain propagation path, setting detection breakpoints for causal analysis, extracting data transmission features and converting them into behavioral sequence features, the attack chain is accurately identified and tracked, improving the accuracy of network security defense. A two-way feature matching mechanism is used to match behavioral sequence features with preset attack patterns, and based on this, the attack chain evolution path is predicted. Honeypot services and traffic probes are deployed at key nodes, which can actively obtain the attacker's operating behavior and traffic characteristics, form a comprehensive attacker portrait, and enhance the foresight and pertinence of network defense. Based on the attacker portrait analysis, the attack intent is determined, and a defense strategy including access control and traffic redirection is formulated. The defense strategy is continuously optimized based on the blocking results, realizing intelligent blocking of network attacks, improving the adaptive capability and defense effect of network security defense, and reducing network security risks. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] Figure 1 Schematic diagram of the flow of the intelligent tracking and blocking method of the network attack chain according to an embodiment of the present invention; Figure 2 Schematic diagram showing the performance comparison between bidirectional feature matching and other detection methods; Figure 3 Generate time sequence diagrams for attacker profiling based on honeypot services and traffic probes; Figure 4 Schematic diagram of attack intention prediction and defense strategy optimization simulation. DETAILED DESCRIPTION

[0018] To make the objectives, technical solutions, and advantages of the embodiments of the present invention more clear, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts shall fall within the scope of protection of the present invention.

[0019] The following specific embodiments are used to describe the technical solution of the present invention in detail. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described in detail in some embodiments.

[0020] Figure 1 FIG. 1 is a flow chart of an intelligent tracking and blocking method for a network attack chain according to an embodiment of the present invention. Figure 1As shown, the method includes: Collect network traffic data and establish an attack chain propagation path. Set detection breakpoints along the propagation path, automatically adjust the sampling interval based on network load, obtain data samples at each detection breakpoint, perform causal correlation analysis on the data samples, and extract data transmission characteristics between each node in the attack chain propagation path based on the correlation analysis results. Convert the data transmission characteristics into behavioral sequence characteristics. A two-way feature matching mechanism is used to match behavior sequence features with preset attack patterns to obtain similarity. When the similarity exceeds a dynamic threshold, the attack chain evolution path is predicted based on the behavior sequence features, and the defense deployment node location is determined based on the attack chain evolution path. Deploy honeypot services and traffic probes at defense deployment nodes. Use the honeypot services to capture attacker behavior, and use the traffic probes to capture attack traffic characteristics. Generate an attacker profile based on these behaviors and traffic characteristics. Determine the attack intent based on the attacker's profile analysis, formulate a defense strategy including access control and traffic redirection based on the attack intent, send the defense strategy to the defense device to block the attack chain, obtain the blocking results and optimize the defense strategy based on the blocking results.

[0021] In an optional embodiment, collecting network traffic data and establishing an attack chain propagation path, setting detection breakpoints on the propagation path, automatically adjusting the sampling time interval according to the network load, and obtaining data samples at each detection breakpoint include: Acquire network traffic data, calculate the number of data packets, the amount of transmitted bytes, and the link utilization of the network link to obtain a network load status, and dynamically adjust a sampling time interval according to the network load status, increasing the sampling time interval when the network load status is higher than a preset load threshold, and decreasing the sampling time interval when the network load status is lower than the preset load threshold; Performing session reorganization on the collected network traffic data, extracting the source and destination addresses, communication time, and protocol type of the session, using the source and destination addresses as communication nodes, sorting the data transmission between nodes based on the communication time, and marking the association between nodes based on the protocol type; Analyze the transmission rate and interaction frequency between nodes, construct the node combination that meets the preset transmission rules into the initial attack chain, and verify the attack chain propagation path based on the protocol changes and data flow between nodes in the initial attack chain; Calculate the number of connections and data throughput of nodes in the attack chain propagation path to obtain the node monitoring priority, determine the monitoring location based on the node monitoring priority, set a detection point at the monitoring location, collect application layer data, extract the load content and behavior characteristics, group the data according to the sampling time interval and detection breakpoint identifier, and obtain data samples at each detection point.

[0022] The present invention provides a network attack chain propagation path detection method, which collects network traffic data and establishes the attack chain propagation path, sets detection breakpoints on the propagation path, automatically adjusts the sampling time interval according to the network load, and obtains data samples at each detection breakpoint.

[0023] For example, network traffic collection equipment must first be deployed. Traffic mirroring devices can be deployed on core switches, edge routers, or in front of key servers. The collection equipment captures passing data packets through network interfaces, recording the packet headers and payload content. The collected network traffic data includes information such as source IP address, destination IP address, source port, destination port, protocol type, timestamp, and data payload.

[0024] The network load status is calculated by counting the number of packets, bytes transmitted, and link utilization per unit time. Specifically, during each sampling period, the total number of packets passing through the monitoring point is counted, the total byte size of these packets is calculated, and the link utilization is calculated based on the maximum bandwidth of the link. For example, if a link is monitored to transmit 50,000 packets in 10 seconds, with a total byte size of 75MB, and the link bandwidth is 1Gbps, the link utilization is: (75×8×1000000) / (10×1000000000)×100%=6%.

[0025] The sampling interval is dynamically adjusted based on the calculated network load status. When the network load status is higher than the preset load threshold, the sampling interval is increased to reduce the system burden. When the network load status is lower than the preset load threshold, the sampling interval is reduced to obtain more detailed data. For example, if the preset load threshold is set to 50%, when the link utilization exceeds 50%, the sampling interval is increased from 30 seconds to 60 seconds; when the link utilization is lower than 50%, the sampling interval is reduced from 60 seconds to 30 seconds. In actual applications, multiple thresholds can be set, such as 30%, 50%, 70%, and 90%, with corresponding sampling intervals of 15 seconds, 30 seconds, 60 seconds, and 120 seconds, respectively.

[0026] Session reassembly of collected network traffic data is achieved through the session tracking mechanism of the TCP / IP protocol stack. The system groups packets with the same five-tuple (source IP, source port, destination IP, destination port, and protocol type) into a session. The source and destination addresses are extracted from the reassembled sessions as communication nodes. Data transmission between nodes is sorted according to communication time, and node associations are marked based on protocol type. For example, if an HTTP session is established between a client with IP address 192.168.1.100 and a server with IP address 10.0.0.50 at 2023-06-15 14:30:25, and the protocol type is HTTP, 192.168.1.100 and 10.0.0.50 are considered communication nodes, and the communication time and protocol type between them are recorded.

[0027] Analyzing the transmission rate and interaction frequency between nodes is accomplished by calculating the amount of data transferred and the number of interactions per unit time. The transmission rate refers to the number of bytes transmitted from the source node to the destination node per unit time, while the interaction frequency refers to the number of communications between the source and destination nodes per unit time. Pre-set transmission rules include abnormal transmission rates (such as sudden increases), abnormal interaction frequencies (such as frequent short connections), communication on unconventional ports, and the use of sensitive protocols. Node combinations that meet these pre-set transmission rules are constructed as the initial attack chain.

[0028] The method for verifying the initial attack chain to determine the attack chain propagation path is based on protocol changes and data flow between nodes. Protocol changes refer to the fact that during an attack, the attacker may use different protocols for communication, such as switching from HTTP to SSH. Data flow refers to the direction in which data is transmitted from one node to another. By analyzing these characteristics, it is possible to verify whether the initial attack chain conforms to a typical attack pattern. For example, if an HTTP request is observed from an external IP address to an internal web server, followed by an abnormal SQL query from that web server to an internal database server, and then a large amount of data is transmitted from the database server to an external IP address, this conforms to a typical data leakage attack pattern and can be confirmed as a valid attack chain propagation path.

[0029] The number of connections and data throughput of nodes in the attack chain propagation path are calculated to determine the node monitoring priority. The number of connections refers to the total number of connections a node has with other nodes, and data throughput refers to the total amount of data processed by the node. The calculation of node monitoring priority takes into account the number of connections, data throughput, the node's position in the attack chain, and its importance. For example, a node with 50 connections, a data throughput of 500MB / s, located in the middle of the attack chain, and a critical business server will receive a higher monitoring priority.

[0030] Determine monitoring locations based on node monitoring priorities and set up detection points at these locations. These detection points can be port mirrors on network devices (such as switches and routers) or network monitoring agents on hosts. Application layer data is collected at these detection points to extract payload content and behavioral characteristics. Payload content includes HTTP request headers, SQL statements, and command line instructions. Behavioral characteristics include access patterns, authentication attempts, and resource usage.

[0031] Data is grouped by sampling interval and detection breakpoint identifier to obtain data samples for each detection point. Each data sample includes information such as the detection point identifier, sampling time, traffic characteristics, protocol distribution, and abnormal events. For example, the data sample collected at detection point A at 15:00:00 on June 15, 2023, shows that HTTP traffic accounted for 70% during this period, 10 SQL injection attempts, and 3 brute force authentication attempts were detected, representing a 30% increase in traffic compared to the normal baseline.

[0032] In this embodiment, the sampling time interval is dynamically adjusted based on the network load status to avoid excessive sampling and resource waste under high load, while the sampling frequency is increased under low load to enhance detection accuracy; through session reorganization and communication feature extraction, the communication link can be accurately restored and potential attack paths can be identified; the attack chain is further verified by combining protocol changes and data flow to ensure the accuracy of propagation path identification; priority assessment is performed based on the number of node connections and throughput, and detection breakpoints can be deployed on key nodes to improve resource utilization efficiency; ultimately, targeted collection of application layer data at key locations and behavioral feature analysis are achieved, thereby enhancing the visual tracking and precise interception capabilities of complex attack behaviors.

[0033] In an optional embodiment, causal correlation analysis is performed on the data sample, and based on the correlation analysis results, data transmission features between nodes in the attack chain propagation path are extracted. The data transmission features are converted into behavioral sequence features, including: Construct a time series sequence according to the timestamps of the data samples, calculate the conditional mutual information of adjacent data samples in the time series sequence to obtain a sample influence value, determine the time window size based on the sample influence value, and perform time series grouping on the data samples to obtain grouped data; Performing causal association calculations on sample pairs in the packet data to obtain association strength values, clustering the packet data based on the association strength values to obtain data transmission patterns, extracting flow change features, protocol conversion features, and delay distribution features from the data transmission patterns, and combining them to form a data transmission feature matrix, and calculating feature conversion probabilities based on the data transmission feature matrix to obtain a feature mapping matrix; A feature mapping deviation value is calculated according to historical defense results, a feature mapping matrix is updated based on the feature mapping deviation value, and the data transmission feature matrix is converted into a behavior feature sequence using the updated feature mapping matrix.

[0034] The present invention provides a causal correlation analysis method based on data samples, which is used to extract the data transmission characteristics between each node in the attack chain propagation path and convert it into behavioral sequence characteristics. First, network traffic data samples are collected. Each sample contains information such as timestamp, source IP address, destination IP address, protocol type, packet size, etc. For the collected data samples, a time series sequence is constructed based on its timestamp. For example, for n data samples within a time period, a sequence {S1, S2, ..., S n}.

[0035] In order to calculate the conditional mutual information of adjacent data samples in the time series, the system calculates the conditional mutual information of each pair of adjacent samples S i and S i+1 Specifically, the feature vectors of the two samples are extracted, including attributes such as IP address similarity, protocol type, port number, and packet size. By calculating these features in sample S i Condition S i+1 The probability distribution of occurrence is related to S i+1 The difference in their own probability distributions is used to obtain the conditional mutual information value. For example, when analyzing two adjacent packets, if a packet with source IP address 192.168.1.100 is immediately followed by a packet with destination IP address 10.0.0.5, and this pattern repeats at multiple time points, the conditional mutual information value between the two samples is high, perhaps reaching 0.85.

[0036] Based on the calculated conditional mutual information (CMI), the system determines an appropriate time window size. When the average CMI value of adjacent samples is above a preset threshold (e.g., 0.7), a smaller time window (e.g., 5 seconds) is selected; when the CMI value is lower, a larger time window (e.g., 30 seconds) is selected. Using the determined time window size, the raw data samples are divided into multiple time groups, with samples within each group being close in time and potentially causally related.

[0037] Causal associations are calculated for sample pairs within each time group. The system constructs feature vectors, including IP address translation patterns, protocol changes, port changes, and packet size change rates. Granger causality tests are used to analyze causal relationships between sample pairs and calculate association strength values. For example, if an HTTP request from host A to host B is detected, followed by a large number of UDP packets sent by host B to host C. If this pattern recurs across multiple time windows, the association strengths between A and B and between B and C might be 0.92 and 0.88, respectively.

[0038] Based on the calculated correlation strength, the system uses a hierarchical clustering algorithm to cluster the grouped data. Sample pairs with correlation strengths above 0.8 are grouped together, forming a data transmission pattern. For example, in an attack, a transmission pattern chain might be identified: "scanning - vulnerability exploitation - privilege escalation - data theft."

[0039] From the identified data transmission patterns, the system extracts three types of key features: traffic change features, protocol conversion features, and delay distribution features. Traffic change features describe the change pattern of traffic size during data transmission, such as burst traffic growth rate, duration, etc. For example, in a certain attack, from the initial scan to the vulnerability exploitation stage, the traffic growth rate was 250%, and the duration was 45 seconds. Protocol conversion features describe the change pattern of communication protocols, such as from HTTP to SSH, from DNS to ICMP, etc. Delay distribution features describe the distribution of time intervals during data transmission, such as average delay, delay variance, etc. In actual cases, the average delay in the command and control stage may be 1.2 seconds, while the average delay in the data theft stage may increase to 3.5 seconds.

[0040] The three extracted features are combined to form a data transmission feature matrix M. Each row of the matrix represents a data transmission mode, and each column represents a feature. For example, a row of matrix M might be [250%, HTTP->SSH, 1.2s], indicating that the traffic growth rate for this transmission mode is 250%, and the average latency is 1.2 seconds when the protocol switches from HTTP to SSH.

[0041] Based on the data transmission feature matrix, the system calculates feature conversion probabilities and constructs a feature mapping matrix T. The feature mapping matrix describes the conversion relationships between different features, such as the probability of associating a specific traffic change pattern with a protocol conversion pattern. In practice, if a traffic growth rate of 250% is observed, there is a 0.85 probability of an HTTP to SSH protocol conversion.

[0042] The system calculates feature mapping deviations based on historical defense results. This deviation is determined by comparing the predicted attack behavior with the observed attack behavior. For example, if the system predicts a traffic pattern will result in data theft but it actually results in system sabotage, this deviation is recorded. Based on this calculated deviation, the system updates the feature mapping matrix T, adjusting the conversion probabilities between features.

[0043] Using the updated feature mapping matrix, the system converts the data transmission feature matrix into a behavioral feature sequence. This behavioral feature sequence describes the behavioral characteristics of each stage in the attack chain, such as "network scanning - vulnerability exploitation - privilege escalation - lateral movement - data theft." Each behavioral feature includes detailed attributes such as scanning rate, exploited vulnerability type, and escalated privilege level. These behavioral sequence features can be used for attack detection, early warning, and defense strategy development.

[0044] In this embodiment, by introducing causal correlation analysis, the intrinsic causal relationship between samples can be identified, thereby accurately dividing the data time series structure and improving the contextual integrity of feature extraction; based on the traffic changes, protocol conversion and delay distribution features extracted by cluster analysis, the transmission mode between nodes can be comprehensively characterized, and the ability to identify complex attack behaviors can be enhanced; by constructing a feature mapping matrix and combining historical defense results for dynamic correction, the adaptive transformation and continuous optimization of the behavior sequence can be achieved, so that the system has strong generalization ability and adaptability; finally, a stable and evolvable behavior feature sequence can be generated, providing a highly reliable behavior semantic basis for subsequent anomaly detection, attack prediction and response decision-making.

[0045] In an optional embodiment, a bidirectional feature matching mechanism is used to match the behavior sequence features with the preset attack pattern to obtain similarity. When the similarity exceeds a dynamic threshold, the attack chain evolution path is predicted based on the behavior sequence features, and the defense deployment node location is determined based on the attack chain evolution path. The method includes: Extract instruction-level switching data, memory access data, and process communication data from behavioral sequence features to generate a timing feature sequence; Segmenting the temporal feature sequence to obtain a behavior phase set, dividing the behavior phase set into multiple overlapping subsequences, calculating the longest common subsequence length between the overlapping subsequences and a preset attack pattern to obtain a local matching degree, and calculating the global similarity based on the cumulative distribution of the local matching degrees; Calculating a compensation coefficient based on historical matching samples, multiplying the compensation coefficient by a reference threshold to obtain a dynamic threshold, comparing the global similarity with the dynamic threshold, and constructing a state transition matrix according to a set of behavior stages when the global similarity exceeds the dynamic threshold; Constructing a Markov gain matrix based on the state transition matrix, calculating the eigenvector of the Markov gain matrix to obtain node importance, and selecting the path with the largest node importance as the attack chain evolution path; The ratio of the in-degree centrality to the out-degree centrality of each node in the attack chain evolution path is calculated to obtain the node influence coefficient, and the defense deployment node position is determined according to the node influence coefficient sorted from large to small.

[0046] For example, the behavioral sequence feature extraction module first extracts core attack-related indicators from the collected data transmission feature sequence, primarily including instruction-level switching data, memory access behavior data, and process communication behavior data. Instruction-level switching data reflects the switching between user mode and kernel mode in the system, revealing whether a process has abnormal call behavior. Memory access data reflects the frequency and scope of a process's access to the heap, stack, and shared memory, reflecting potential buffer overflows or data injections. Process communication data describes the communication activities between processes, including the communication protocol used, communication frequency, and the type of transmission content. This data can assist in identifying illegal interactions between processes. By continuously sampling and merging the aforementioned data, a complete behavioral sequence is constructed.

[0047] The above-mentioned behavior sequence is segmented in time sequence and divided into a set of several continuous behavior stages. Each behavior stage represents a data segment with relative behavioral consistency. Furthermore, in order to improve the sensitivity and robustness of the matching, each behavior stage is divided into multiple overlapping subsequences. Overlapping subsequences are obtained by setting a certain sliding window mechanism. Each time the window slides a step size, the original behavior stage is intercepted to form overlapping subsequence fragments. The local matching degree is obtained by calculating the longest common subsequence length between these subsequences and the corresponding stage in the preset attack pattern. The longest common subsequence length reflects the degree of similarity between the current behavior stage and the attack pattern stage in the behavior execution order. The higher the matching degree, the more likely the current system is repeating a behavior stage in the attack chain.

[0048] Combining the local matching information of all subsequences and their cumulative distribution, a comprehensive global similarity assessment is performed between the entire behavioral sequence and the pre-set attack pattern. To overcome mismatches between behavioral sequences due to differences in attack payload, system environment, or user behavior, a dynamic threshold mechanism is introduced into the similarity calculation. This dynamic threshold is calculated by multiplying a baseline threshold with a compensation coefficient derived from historical matching samples. The compensation coefficient is used to correct for potential deviations in the current detection task, making the similarity assessment more adaptable and fault-tolerant.

[0049] When the global similarity exceeds a dynamic threshold, the current system behavior sequence is considered highly similar to the attack pattern. A state transition matrix is then constructed to describe the transition relationships between behavioral phases. This state transition matrix, based on a set of behavioral phases, records the probability of transitions from each phase to the next, annotating their order of occurrence and direction. Transition probabilities can be derived by counting the frequency of similar transition paths across a large number of historical behavior sequences.

[0050] Based on the state transition matrix, a Markov gain matrix is further constructed. This matrix measures the gain of each node in the attack chain path, that is, the facilitation effect of a node's presence on subsequent behavior. The Markov gain matrix takes into account the cumulative dependencies and evolutionary trends between states. Based on this, the matrix's eigenvectors are calculated to measure the relative importance of each node in the entire path. The higher the importance of a node, the more central it is in the attack chain, and its behavioral changes have a greater impact on the evolution of the attack chain.

[0051] The path with the largest value in the eigenvector is used as the evolution path of the attack chain, and the deployment value of each node along this path is then evaluated. To this end, the in-degree centrality and out-degree centrality of each node are calculated separately, and the node influence coefficient is calculated as the ratio of the two. In-degree centrality indicates the degree to which a node is dependent on multiple predecessor nodes, while out-degree centrality indicates the control a node has over multiple subsequent nodes. A larger influence coefficient indicates that the node has both guiding and conductive properties in the propagation and control paths, making it suitable as a defensive deployment location.

[0052] For example, in an enterprise server scenario, the monitoring system detected abnormal access behavior on a service port. The process involved in this behavior frequently switched instructions within a short period of time, accessed shared memory areas, and initiated connection requests to multiple external hosts. The behavior sequence extraction module divided this behavior into multiple stages and found that two of these stages closely matched the behavioral characteristics of a known remote control Trojan attack pattern, with the longest common subsequence length significantly longer than that of normal behavior patterns. By cumulatively analyzing the matching degree of each stage, the system determined that the overall similarity of the current behavior sequence exceeded the dynamic threshold and subsequently constructed the state transition relationship of the attack chain.

[0053] According to statistics, this attack chain typically evolves from port scanning to command execution, and then into the data exfiltration phase. State transition matrix calculations revealed that the node with a sudden increase in memory read frequency has the highest Markov gain in this chain. Furthermore, considering this node's high in-degree centrality and low out-degree centrality, the system assesses this node as having the greatest impact. Therefore, it is recommended to deploy a coordinated network-layer and application-layer defense mechanism at this node, and simultaneously initiate an isolation strategy to restrict its upstream connections. This strategy significantly improves the defense system's ability to identify and block attacks early.

[0054] In this embodiment, a bidirectional feature matching mechanism is introduced to perform an in-depth comparison of behavioral sequence features against pre-set attack patterns, effectively improving the accuracy of attack chain identification. Existing technologies often rely on static features or rule matching, making it difficult to cope with the evolution of complex behavioral stages and the dynamic changes in attack paths. They also often lack a global perspective and quantitative basis for node deployment, leading to irrational allocation of defense resources. This application extracts multi-dimensional temporal features such as instruction switching, memory access, and process communication to refine the behavioral stage divisions. This approach combines local matching with cumulative similarity to achieve more flexible global matching. Furthermore, a dynamic threshold mechanism adjusted based on historical samples is introduced to enhance the model's adaptability to abnormal behavior. Regarding attack chain evolution prediction, a state transition matrix is constructed and a Markov gain matrix is derived to quantify the evolutionary weight of nodes in the attack chain. Furthermore, the node centrality ratio is combined to scientifically assess the value of their defense deployment. This improvement, aimed at improving the accuracy of attack path prediction and the rationality of defense decisions, shifts the strategic focus from "whether to defend" to "where to prioritize defense," enhancing the system's real-time perception and response capabilities in the face of complex attack chains.

[0055] Figure 2 This is a schematic diagram showing the performance comparison between bidirectional feature matching and other detection methods. Figure 2 As shown in the figure, the bidirectional feature matching technology of the present invention (grid-filled columns) significantly outperforms the traditional feature matching (white columns) and unidirectional sequence matching (slashed columns) methods in all performance indicators. Specifically: In terms of detection accuracy, two-way feature matching reached 93.5%, a 30.3 percentage point increase over traditional feature matching (63.2%) and a 15.5 percentage point increase over one-way sequence matching (78.0%). In terms of attack prediction rate, two-way feature matching reached 90.0%, significantly higher than the 50.0% for traditional feature matching and the 70.0% for one-way sequence matching. In terms of defense success rate, two-way feature matching reached 95.5%, significantly higher than the 70.0% for traditional feature matching and the 83.0% for one-way sequence matching.

[0056] Experimental results show that the bidirectional feature matching technology of the present invention effectively improves the prediction accuracy of the attack chain and the defense deployment efficiency through the dynamic threshold mechanism and Markov gain matrix.

[0057] In an optional embodiment, a honeypot service and a traffic probe are deployed at the defense deployment node location. The attacker's operation behavior is obtained through the honeypot service, and the attack traffic characteristics are obtained through the traffic probe. Generating an attacker profile based on the operation behavior and traffic characteristics includes: Deploy honeypot services and traffic probes at defense deployment nodes; An instruction execution environment including a real instruction pipeline and a virtual instruction pipeline is constructed in the honeypot service, the attacker's operation behavior is sent to the real instruction pipeline and the virtual instruction pipeline for execution at the same time, and the execution difference between the two pipelines is extracted to obtain the operation disturbance feature; Identifying the attacker's hidden operation behavior according to the operation disturbance characteristics, building a deception response environment based on the hidden operation behavior, returning a response result that meets the attacker's expectations in the deception response environment, and recording the attacker's subsequent operation behavior; Acquire attack traffic through the traffic probe and extract payload data of the attack traffic; Performing deep packet parsing on the payload data to obtain a protocol field structure, calculating information entropy of the protocol field structure to obtain a traffic feature, and identifying an attacker's traffic disguise method based on the traffic feature; The operation behavior and traffic characteristics are mapped in the time dimension, and the associated part of the mapping result is extracted to obtain the attack characteristics. The attack process is divided into multiple stages according to the attack characteristics, and an attacker portrait is generated based on the hidden operation behavior and traffic characteristics of each stage.

[0058] The present invention provides an attacker portrait generation method based on honeypot services and flow probes, which realizes comprehensive analysis and portrait generation of attacker behavior by deploying honeypot services and flow probes at defense deployment node locations.

[0059] Figure 3 Generate a time sequence diagram for attacker portrait based on honeypot services and traffic probes, such as Figure 3 As shown, when deploying honeypot services and traffic probes at defense deployment nodes, you can choose locations such as network boundaries, key server front-ends, or key intranet nodes. The honeypot service uses highly interactive honeypot technology to simulate a real-world system environment, including components such as the operating system, application services, and databases. Traffic probes are deployed in a bypass mode, capturing the full network traffic passing through the node through network mirroring or traffic splitting.

[0060] The command execution environment constructed within the honeypot service consists of a real command pipeline and a virtual command pipeline. The real command pipeline executes the attacker's commands in the actual system environment, recording system state changes, file operations, network connections, and other behaviors. The virtual command pipeline executes the same commands in a sandbox environment, simulating the execution process without actually changing the system state. The two pipelines run in parallel, and the system compares the execution results in real time. For example, when an attacker executes the command "ls -la," the real pipeline displays all files in the current directory (including hidden files), while the virtual pipeline may display a filtered result. By comparing the output differences, the system can detect that the attacker may be searching for hidden files.

[0061] Operational perturbation feature extraction utilizes behavioral difference analysis technology, focusing on four key dimensions: instruction execution path differences, system call sequence differences, resource access pattern differences, and execution result differences. The system vectorizes these difference features to construct an operational perturbation feature set. For example, when an attacker executes the "cat / etc / shadow" command, the real pipeline will actually access the password file, while the virtual pipeline will return simulated data. By comparing the differences in the access path and the returned results, the system identifies that the attacker is attempting to obtain system password information.

[0062] Based on the identified hidden operational behaviors, the system constructs a deception response environment. This environment dynamically generates responses tailored to the attacker's intent, simulating real system behavior. For example, if it identifies an attacker seeking a database configuration file, the deception response environment generates a configuration file containing false but plausible database connection information, guiding the attacker to proceed. The system also records all subsequent attacker actions, including command execution, file access, and network connections, forming a complete chain of attack behavior.

[0063] Attack traffic captured by traffic probes is stored in multi-level buffers to ensure packet loss in high-speed network environments. The system extracts payload data from traffic, stripping off transport and network layer header information while retaining application layer data. For encrypted traffic, the system deploys an SSL / TLS decryption module, enabling decryption analysis with legal authorization.

[0064] During deep packet parsing, the system first identifies the protocol type used in the traffic, including standard protocols (such as HTTP, DNS, and SSH) and non-standard protocols. For standard protocols, the system uses predefined protocol parsers to extract fields. For non-standard protocols, the system employs heuristic analysis methods to identify protocol structure. For example, for HTTP traffic, the system extracts the request method, URL, header fields, and body content. For DNS traffic, it extracts information such as the query domain name and record type.

[0065] The information entropy calculation of the protocol field structure uses a sliding window technique to calculate the entropy value of the payload data on a byte-by-byte basis. The system sets the entropy threshold to 4.5. When the entropy value of a certain data segment exceeds the threshold, it is marked as possible encrypted or obfuscated data. By analyzing the entropy distribution characteristics of different protocol fields, the system can identify traffic disguise methods used by attackers, such as DNS tunneling, hiding data in HTTP headers, and inserting encrypted commands into normal traffic. For example, when the entropy value of the subdomain part in the DNS query is detected to be abnormally high (exceeding 4.5), the system determines that a DNS tunnel may exist; when the entropy value of the User-Agent field in the HTTP request is abnormal and the length exceeds the standard value, it is determined to be a possible command hiding channel.

[0066] The time-dimensional mapping of operational behaviors and traffic characteristics uses time window correlation analysis technology to correlate operational behaviors and traffic characteristics that are close in time (less than 500 milliseconds apart). The system extracts these correlations to form an attack signature set. For example, when an attacker executes a file download command and HTTP GET request traffic follows, the system correlates these two events and identifies the attacker as downloading malicious tools via HTTP.

[0067] Based on the extracted attack signatures, the system divides the attack process into phases: reconnaissance, intrusion, privilege escalation, lateral movement, data theft, and trace removal. The characteristics of each phase include operational behavior patterns, traffic feature patterns, duration, and transition conditions. Based on the hidden operational behaviors and traffic characteristics of each phase, the system generates an attacker profile, encompassing dimensions such as technical proficiency, attack objectives, tools used, behavioral patterns, and possible attribution. For example, if the system detects an attacker using advanced covert channel techniques, skilled Linux command operations, or targeted theft of specific business data, the attacker may be identified as a high-level threat actor with a clear goal.

[0068] In the existing technology, most network defense systems rely only on static rules or known feature libraries to identify attack behaviors, making it difficult to effectively deal with highly concealed manipulation behaviors and encrypted and obfuscated disguised traffic. At the same time, there is a lack of in-depth guidance of attack intentions and continuous tracking of behaviors at the interactive response level, resulting in insufficient accuracy and completeness of attacker portraits. This application deploys honeypot services and traffic probes at the defense deployment node location to build a highly simulated interactive environment that can execute real and virtual instruction pipelines. It can not only perform dual-channel processing on the operation instructions input by the attacker, but also extract operation disturbance features by analyzing the differences in the execution process of the two instruction pipelines, thereby identifying instruction behaviors with hidden intentions, and improving the detection capability of covert manipulation behaviors in complex attack paths. On this basis, combined with the deception response environment, disguised response results are dynamically generated to guide the attacker to continue operating, effectively prolonging their stay time and exposing more behavioral intentions. The traffic probe can capture attack traffic in real time at the deployment node, parse its payload content and construct the protocol field structure. By calculating the distribution feature information of the protocol field, the information entropy change is obtained, thereby identifying obfuscated and concealed behaviors in the traffic, overcoming the problem of low recognition rate of new traffic disguises in traditional deep packet inspection. Furthermore, the technical solution maps and analyzes operational behaviors and traffic characteristics in the time dimension, extracts the correspondence between behaviors and traffic, effectively restores the evolution path of attack behaviors and realizes phased division.

[0069] Compared with the existing technology, this application is guided by attacker behavior and focuses on interactive response. Through the coordinated integration of instruction difference analysis and traffic feature analysis, it not only enhances the system's ability to identify hidden attack features, but also achieves a detailed portrayal of the attacker's behavioral intentions, improves the accuracy and real-time nature of the portrait, and provides more precise support for subsequent tracing of the attack chain and optimization of defense strategies.

[0070] In an optional embodiment, performing deep packet parsing on the payload data to obtain a protocol field structure, calculating information entropy of the protocol field structure to obtain traffic characteristics, and identifying the attacker's traffic disguise method based on the traffic characteristics includes: Performing hierarchical parsing on the payload data, calculating the conditional probability distribution of the byte sequence using a sliding window, dividing the associated byte sequence into field units based on the conditional probability distribution, and constructing the field units into a protocol field tree; At each layer of the protocol field tree, the field type distribution is calculated to obtain a type entropy value, and the field length distribution is calculated to obtain a length entropy value. Based on the type entropy value and the length entropy value, the structural features of the current layer are constructed. The differences in the structural features between adjacent layers in the protocol field tree are extracted to obtain an inter-layer difference sequence. A structural mutation layer is identified from the inter-layer difference sequence. The structural mutation layer corresponds to the attacker's protocol rewrite location. A time series analysis is performed on the structural features of the structural mutation layer to obtain a change cycle. The structural features are grouped based on the change cycle, and the fluctuation law of each group of features is calculated to obtain an obfuscation pattern. The protocol rewrite position and the obfuscation pattern are combined to form a protocol deformation feature. The traffic camouflage method used by the attacker is identified based on the protocol deformation feature.

[0071] The present invention proposes a method for identifying the attacker's traffic disguise mode, which realizes accurate identification of attack traffic characteristics through deep packet analysis and information entropy calculation of payload data.

[0072] In this implementation, the payload of captured data packets is first extracted. Payload data refers to the actual content of a data packet after removing the header information. The system uses a network packet capture tool to capture the data stream and separate the TCP or UDP protocol payload from it. For example, for an HTTP request packet, the system extracts the HTTP header and the subsequent content data as the payload.

[0073] The extracted payload data is hierarchically parsed to establish the protocol field structure. The system uses a 64-byte sliding window, sliding across the payload data in steps of 8 bytes. For the byte sequence within the window, the system calculates the conditional probability distribution of each byte. Specifically, the system calculates the distribution of byte values at each position in the byte sequence. When the byte value at a certain position varies slightly or shows regular changes, that position is considered a fixed identifier or length field. When the byte value varies significantly and shows no obvious pattern, that position is considered a data content field.

[0074] To calculate conditional probability, the system analyzes 1,000 collected data packet samples and counts the frequency of occurrence of byte values at each position. For example, if the four bytes at offsets 12-15 maintain a specific value sequence in 95% of the samples, they are marked as protocol-fixed identification fields. If the bytes at offsets 16-19 vary significantly and irregularly between samples, they are marked as data content fields.

[0075] Based on the above calculations, the system divides the associated byte sequence into field units. A field unit is a continuous sequence of bytes that has the same functional meaning. For example, if four consecutive bytes all exhibit the characteristics of a length indicator, these four bytes are classified as a "length field" unit. The field types recognized by the system include: fixed identification field, length field, checksum field, data content field, etc.

[0076] After the field units are divided, the system constructs a protocol field tree. This is a hierarchical tree data structure that represents the protocol structure. The root node represents the entire protocol, and each layer represents the nested level of the protocol. During the construction process, the system first identifies the outermost protocol structure as the first layer, then recursively analyzes the nested sub-protocol structures within it. Attackers often spoof traffic by adding forged protocol headers or modifying the protocol structure at a certain level.

[0077] For the constructed protocol field tree, the system calculates structural features at each layer. These features include type entropy for field type distribution and length entropy for field length distribution. Type entropy is calculated by statistically analyzing the distribution of all field types at that layer, counting the frequency of fields of different types, and calculating the information entropy of this distribution. Similarly, length entropy is calculated by statistically analyzing the distribution of all field lengths at that layer and calculating the information entropy of the length distribution.

[0078] For example, when analyzing the first layer of normal HTTP traffic, it may contain three main field types: request line, multiple header fields, and message body. The type distribution is relatively even, and the calculated type entropy value is 2.46. However, when analyzing the attacker's disguised traffic, a large number of repeated fixed identification fields may appear in a certain layer, resulting in an uneven type distribution. The calculated type entropy value drops significantly to 0.87.

[0079] The system extracts the differences in structural features between adjacent layers to obtain a sequence of inter-layer differences. Specifically, the differences in type entropy and length entropy are calculated for layer i and layer i+1, forming pairs of difference values. The nested structure of a normal protocol usually exhibits a smooth change in inter-layer differences, while pseudo-protocols injected by attackers can cause sudden changes in the difference values. The system identifies structural mutation layers by setting thresholds (for example, a difference in type entropy greater than 1.5 or a difference in length entropy greater than 1.2).

[0080] For each identified structural mutation layer, the system performs time series analysis to determine its periodicity. The system continuously monitors changes in the structural mutation layer's characteristics within traffic from the same source, recording the intervals between these changes. For example, if the structural mutation layer characteristics of a particular attack traffic change significantly every 30 seconds, this indicates that the attacker is employing a periodic protocol modification strategy.

[0081] Based on the defined change cycle, the system groups structural features and calculates the fluctuation pattern of each group of features to generate obfuscation patterns. Obfuscation patterns include periodic replacement of fixed identifiers, randomization of length fields, and variations in protocol nesting depth. For example, the system may discover that within each cycle of attack traffic, the value of the fixed identifier field changes in a specific sequence, while the length field exhibits randomization.

[0082] Ultimately, the system combines the protocol rewrite location (structural mutation layer) and obfuscation pattern to form a protocol deformation signature, which is then matched against a library of known attack traffic camouflage signatures. Based on the matching results, the system can identify the traffic camouflage method used by the attacker, such as protocol camouflage, protocol obfuscation, and deep encapsulation. For example, if the system identifies that the attack traffic inserts pseudo-HTTP headers into the application layer protocol structure, and these header fields change according to a specific period, it can be determined that the attacker is using HTTP protocol camouflage.

[0083] In this embodiment, by performing hierarchical analysis on the payload data and constructing a protocol field tree, the protocol structure hierarchy can be accurately restored. In each layer, the distribution characteristics of the field type and length are calculated to extract the structural entropy characteristics. Then, based on the structural differences between the layers, the mutation layer with abnormal mutations is identified, and the attacker's protocol rewriting behavior is accurately located. Furthermore, a time series analysis is performed on the mutation layer characteristics to identify the periodic regularity of field changes, thereby constructing an obfuscation pattern and combining it with the rewriting position to form a protocol deformation feature, thereby achieving accurate identification of complex traffic disguise methods. Compared with traditional methods, this solution does not rely on prior knowledge of protocol types, and has the ability to dynamically adapt to protocol layer rewriting and obfuscation patterns, significantly improving the depth and breadth of identification of disguised traffic and enhancing the system's ability to detect unknown or variant attack traffic.

[0084] In an optional implementation, attack intent is determined based on attacker profile analysis, a defense strategy including access control and traffic redirection is formulated based on the attack intent, the defense strategy is issued to the defense device to block the attack chain, and the blocking results are obtained and the defense strategy is optimized based on the blocking results. Extract attack path features from the attacker portrait, calculate the node state distribution in the attack path features to obtain a state transition probability, perform an association operation on the current attack state and the state transition probability to obtain a target node prediction probability, and determine the attack intention based on the target node prediction probability; Analyze the affected nodes according to the attack intention, and generate an access control policy based on the distribution location of the affected nodes and the degree of damage of the attack intention, wherein the access control policy includes node access rights and operation restriction conditions; Constructing an induction environment at the affected node, setting response characteristics of the induction environment based on the attack intent, and generating a redirection strategy for directing attack traffic to the induction environment; Classifying the access control policy and redirection policy according to the processing performance of the defense device to generate a basic defense policy and an enhanced defense policy; Issue basic defense strategies and enhanced defense strategies to defense devices, collect blocking data and performance data during the defense strategy execution process, calculate defense effects based on the blocking data, adjust the access permission granularity in the access control strategy and the traffic guidance ratio in the redirection strategy based on the defense effects and performance data, and update basic defense strategies and enhanced defense strategies.

[0085] For example, we first need to extract attack path features from the attacker profile. These features include the attacker's activity trajectory within the network, the characteristics of the attack tools used, and target asset preferences. By analyzing the node access sequences within these features and calculating the distribution of node states, we can derive state transition probabilities that reflect the attacker's behavioral patterns. For example, an attacker may first compromise an edge server, then move laterally to a database server, and finally steal sensitive data. This behavior pattern will form a stable distribution in the state transition probabilities.

[0086] The currently detected attack state is correlated with the state transition probability to calculate the probability of the attacker targeting a target node. Specifically, a sliding time window approach is used to match the state transition characteristics of historical attack paths with the current attack state to obtain a predicted probability for each potential target node. A higher predicted probability indicates a more likely target node to become the attacker's next target. Based on the predicted probability distribution of target nodes, combined with the node's business attributes and asset importance, the attacker's attack intent can be determined.

[0087] For identified attack intent, it is necessary to analyze potentially affected network nodes. Affected nodes include the attacker's target node and related nodes that have data interaction or business dependencies with the target node. For example, when an attacker is detected intending to invade a business system, it is necessary to simultaneously protect the system's database server, log server, and other related nodes. Based on the distribution of the affected nodes in the network and the degree of damage caused by the attack intent, a corresponding access control policy is generated. The access control policy mainly consists of two aspects: node access rights and operation restrictions. Node access rights define the access rules for different source IP addresses to the affected nodes, while operation restrictions specify the types of operations allowed and the frequency limits.

[0088] To induce and observe attacker behavior, a decoy environment is constructed near the affected node. This decoy environment is an independent sandbox system that simulates the characteristics of a real-world business environment. Response characteristics of the decoy environment are set based on the attack intent, including system version information, open ports, and service responses. These characteristics must be consistent with the real-world environment to ensure authenticity. Traffic redirection policies are also generated to direct attack traffic matching specific characteristics into the decoy environment. For example, when a database access request with malicious characteristics is detected, it is redirected to a pre-deployed database honeypot.

[0089] Considering the differences in processing capabilities among defense devices, access control and redirection policies need to be tiered. First, evaluate the processing performance of each defense device, including metrics such as throughput and concurrent connections. Based on the performance evaluation results, defense policies are categorized into basic and enhanced defense policies. The basic defense policy contains essential access control rules and is executed by all defense devices. The enhanced defense policy, which includes more granular control rules and complex traffic analysis, is executed only by devices with higher performance.

[0090] After a policy is generated, basic and enhanced defense policies are distributed to each defense device through the centralized management platform. During policy execution, operational data from the defense devices is collected in real time. This data primarily consists of two types: blocking data and performance data. Blocking data records information such as the number of policy matches and the blocking success rate, while performance data includes resource usage during policy execution. Defense effectiveness metrics are calculated based on this collected blocking data. These metrics primarily consider blocking accuracy and false negative rates.

[0091] Dynamically optimize defense strategies based on defense effectiveness indicators and performance data. When it is found that certain access control rules have a high false alarm rate, appropriately reduce their control granularity; when certain redirection rules cause excessive device load, adjust the traffic diversion ratio. For example, if it is found that the access control rules of a certain IP segment cause a large number of normal business interruptions, the control granularity can be adjusted from the IP segment level to the specific IP level. If a certain redirection rule causes the device CPU usage to continuously exceed the threshold, reduce the proportion of redirected traffic.

[0092] The optimized defense strategy is updated to the basic and enhanced defense strategies and redistributed to the defense devices. This feedback-based optimization mechanism enables the defense strategy to continuously adapt to changes in the network environment and evolving attack characteristics. This entire process forms a closed loop, achieving precise protection against the attack chain through continuous monitoring, analysis, and optimization. In practical applications, this method can adaptively adjust the defense strategy based on the attacker's behavioral characteristics, significantly improving network protection effectiveness.

[0093] In this embodiment, it is possible to achieve full intelligent tracking and blocking of the attack chain. Based on the attacker's portrait and behavioral feature analysis, the attack intention and attack path are accurately predicted, which improves the accuracy and foresight of attack detection. Through the dynamic threshold mechanism and two-way feature matching, the false alarm rate is reduced and the detection efficiency is improved. A layered defense strategy and an adaptive optimization mechanism are adopted to deploy strategies in a hierarchical manner according to the performance characteristics of the defense equipment, thus avoiding equipment overload and ensuring the stable operation of defense measures. At the same time, closed-loop optimization based on the defense effect enables the defense strategy to dynamically adapt to changes in the network environment and the evolution of attack features. The induced environment constructed at the affected node can effectively guide and capture attack traffic, providing detailed data for attack analysis. Through precise access control and traffic redirection, the attack chain is effectively blocked while reducing the impact on normal business. The overall solution improves the intelligence level and defense effect of network security protection.

[0094] Figure 4 A schematic diagram of the attack intent prediction and defense strategy optimization simulation. As the number of iterations increases, the attack intent prediction accuracy gradually increases from an initial 62.4% to 90.5%. The defense strategy's blocking rate correspondingly increases from 60.3% to 89.6%, while the false alarm rate decreases from 20.1% to 2.3%. The diagram highlights the significant improvement in prediction accuracy (to 75.6%) during the third iteration and the critical point at which the strategy converges at the sixth iteration.

[0095] By extracting attack path features to construct a state transition probability matrix and combining it with dynamic optimization of access control and traffic redirection strategies, we can accurately predict and efficiently block attack intentions while effectively reducing the false alarm rate.

[0096] A second aspect of the present invention provides an intelligent tracking and blocking system, comprising: The first unit is used to collect network traffic data and establish the attack chain propagation path. It sets detection breakpoints on the propagation path, automatically adjusts the sampling interval according to the network load, obtains data samples at each detection breakpoint, performs causal correlation analysis on the data samples, extracts the data transmission characteristics between each node in the attack chain propagation path based on the correlation analysis results, and converts the data transmission characteristics into behavioral sequence characteristics. The second unit is used to match the behavior sequence features with the preset attack pattern using a bidirectional feature matching mechanism to obtain similarity. When the similarity exceeds a dynamic threshold, the attack chain evolution path is predicted based on the behavior sequence features and the defense deployment node location is determined based on the attack chain evolution path. The third unit is used to deploy honeypot services and traffic probes at defense deployment nodes. The honeypot service is used to obtain attacker operation behavior, and the traffic probe is used to obtain attack traffic characteristics. The attacker profile is generated based on the operation behavior and traffic characteristics. The fourth unit is used to determine the attack intention based on the attacker's profile analysis, formulate defense strategies including access control and traffic redirection based on the attack intention, send defense strategies to defense devices to block the attack chain, obtain blocking results and optimize the defense strategies based on the blocking results.

[0097] According to a third aspect of an embodiment of the present invention, an electronic device is provided, including: processor; a memory for storing processor-executable instructions; The processor is configured to call the instructions stored in the memory to execute the aforementioned method.

[0098] According to a fourth aspect of an embodiment of the present invention, a computer-readable storage medium is provided, on which computer program instructions are stored. When the computer program instructions are executed by a processor, the method described above is implemented.

[0099] The present invention may be a method, an apparatus, a system and / or a computer program product. The computer program product may include a computer-readable storage medium carrying computer-readable program instructions for executing various aspects of the present invention.

[0100] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the above embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the above embodiments, or replace some or all of the technical features therein with equivalents. However, these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention.

Claims

1. An intelligent tracking and blocking method for network attack chains, characterized by: include: Collect network traffic data and establish an attack chain propagation path. Set detection breakpoints along the propagation path, automatically adjust the sampling interval based on network load, obtain data samples at each detection breakpoint, perform causal correlation analysis on the data samples, and extract data transmission characteristics between each node in the attack chain propagation path based on the correlation analysis results. Convert the data transmission characteristics into behavioral sequence characteristics. A two-way feature matching mechanism is used to match behavior sequence features with preset attack patterns to obtain similarity. When the similarity exceeds a dynamic threshold, the attack chain evolution path is predicted based on the behavior sequence features, and the defense deployment node location is determined based on the attack chain evolution path. Deploy honeypot services and traffic probes at defense deployment nodes. Use the honeypot services to capture attacker behavior, and use the traffic probes to capture attack traffic characteristics. Generate an attacker profile based on these behaviors and traffic characteristics. Determine the attack intent based on the attacker's profile analysis, formulate a defense strategy including access control and traffic redirection based on the attack intent, send the defense strategy to the defense device to block the attack chain, obtain the blocking results and optimize the defense strategy based on the blocking results.

2. The method according to claim 1, characterized in that Collect network traffic data and establish the attack chain propagation path. Set detection breakpoints along the propagation path and automatically adjust the sampling interval based on the network load. The data samples obtained at each detection breakpoint include: Acquire network traffic data, calculate the number of data packets, the amount of transmitted bytes, and the link utilization of the network link to obtain a network load status, and dynamically adjust a sampling time interval according to the network load status, increasing the sampling time interval when the network load status is higher than a preset load threshold, and decreasing the sampling time interval when the network load status is lower than the preset load threshold; Performing session reorganization on the collected network traffic data, extracting the source and destination addresses, communication time, and protocol type of the session, using the source and destination addresses as communication nodes, sorting the data transmission between nodes based on the communication time, and marking the association between nodes based on the protocol type; Analyze the transmission rate and interaction frequency between nodes, construct the node combination that meets the preset transmission rules into the initial attack chain, and verify the attack chain propagation path based on the protocol changes and data flow between nodes in the initial attack chain; Calculate the number of connections and data throughput of nodes in the attack chain propagation path to obtain the node monitoring priority, determine the monitoring location based on the node monitoring priority, set a detection point at the monitoring location, collect application layer data, extract the load content and behavior characteristics, group the data according to the sampling time interval and detection breakpoint identifier, and obtain data samples at each detection point.

3. The method according to claim 1, characterized in that Perform causal correlation analysis on data samples, extract data transmission features between nodes in the attack chain propagation path based on the correlation analysis results, and convert data transmission features into behavioral sequence features, including: Construct a time series sequence according to the timestamps of the data samples, calculate the conditional mutual information of adjacent data samples in the time series sequence to obtain a sample influence value, determine the time window size based on the sample influence value, and perform time series grouping on the data samples to obtain grouped data; Performing causal association calculations on sample pairs in the packet data to obtain association strength values, clustering the packet data based on the association strength values to obtain data transmission patterns, extracting flow change features, protocol conversion features, and delay distribution features from the data transmission patterns, and combining them to form a data transmission feature matrix, and calculating feature conversion probabilities based on the data transmission feature matrix to obtain a feature mapping matrix; A feature mapping deviation value is calculated according to historical defense results, a feature mapping matrix is updated based on the feature mapping deviation value, and the data transmission feature matrix is converted into a behavior feature sequence using the updated feature mapping matrix.

4. The method according to claim 1, wherein A two-way feature matching mechanism is used to match the behavior sequence features with the preset attack pattern to obtain similarity. When the similarity exceeds the dynamic threshold, the attack chain evolution path is predicted based on the behavior sequence features. The defense deployment node location is determined based on the attack chain evolution path, including: Extract instruction-level switching data, memory access data, and process communication data from behavioral sequence features to generate a timing feature sequence; Segmenting the temporal feature sequence to obtain a behavior phase set, dividing the behavior phase set into multiple overlapping subsequences, calculating the longest common subsequence length between the overlapping subsequences and a preset attack pattern to obtain a local matching degree, and calculating the global similarity based on the cumulative distribution of the local matching degrees; Calculating a compensation coefficient based on historical matching samples, multiplying the compensation coefficient by a reference threshold to obtain a dynamic threshold, comparing the global similarity with the dynamic threshold, and constructing a state transition matrix according to a set of behavior stages when the global similarity exceeds the dynamic threshold; Constructing a Markov gain matrix based on the state transition matrix, calculating the eigenvector of the Markov gain matrix to obtain node importance, and selecting the path with the largest node importance as the attack chain evolution path; The ratio of the in-degree centrality to the out-degree centrality of each node in the attack chain evolution path is calculated to obtain the node influence coefficient, and the defense deployment node position is determined according to the node influence coefficient sorted from large to small.

5. The method according to claim 1, wherein Deploy honeypot services and traffic probes at defense deployment nodes. Use the honeypot service to obtain attacker operation behavior, and use the traffic probe to obtain attack traffic characteristics. Generate an attacker profile based on the operation behavior and traffic characteristics, including: Deploy honeypot services and traffic probes at defense deployment nodes; An instruction execution environment including a real instruction pipeline and a virtual instruction pipeline is constructed in the honeypot service, the attacker's operation behavior is sent to the real instruction pipeline and the virtual instruction pipeline for execution at the same time, and the execution difference between the two pipelines is extracted to obtain the operation disturbance feature; Identifying the attacker's hidden operation behavior according to the operation disturbance characteristics, building a deception response environment based on the hidden operation behavior, returning a response result that meets the attacker's expectations in the deception response environment, and recording the attacker's subsequent operation behavior; Acquire attack traffic through the traffic probe and extract payload data of the attack traffic; Performing deep packet parsing on the payload data to obtain a protocol field structure, calculating information entropy of the protocol field structure to obtain a traffic feature, and identifying an attacker's traffic disguise method based on the traffic feature; The operation behavior and traffic characteristics are mapped in the time dimension, and the associated part of the mapping result is extracted to obtain the attack characteristics. The attack process is divided into multiple stages according to the attack characteristics, and an attacker portrait is generated based on the hidden operation behavior and traffic characteristics of each stage.

6. The method according to claim 5, characterized in that Performing deep packet parsing on the payload data to obtain a protocol field structure, calculating information entropy of the protocol field structure to obtain traffic characteristics, and identifying the attacker's traffic disguise method based on the traffic characteristics includes: Performing hierarchical parsing on the payload data, calculating the conditional probability distribution of the byte sequence using a sliding window, dividing the associated byte sequence into field units based on the conditional probability distribution, and constructing the field units into a protocol field tree; At each layer of the protocol field tree, the field type distribution is calculated to obtain a type entropy value, and the field length distribution is calculated to obtain a length entropy value. Based on the type entropy value and the length entropy value, the structural features of the current layer are constructed. The differences in the structural features between adjacent layers in the protocol field tree are extracted to obtain an inter-layer difference sequence. A structural mutation layer is identified from the inter-layer difference sequence. The structural mutation layer corresponds to the attacker's protocol rewrite location. A time series analysis is performed on the structural features of the structural mutation layer to obtain a change cycle. The structural features are grouped based on the change cycle, and the fluctuation law of each group of features is calculated to obtain an obfuscation pattern. The protocol rewrite position and the obfuscation pattern are combined to form a protocol deformation feature. The traffic camouflage method used by the attacker is identified based on the protocol deformation feature.

7. The method according to claim 1, characterized in that Determine attack intent based on attacker profiling, formulate defense strategies based on attack intent, including access control and traffic redirection, distribute these strategies to defense devices to block the attack chain, obtain blocking results, and optimize defense strategies based on these results. This includes: Extract attack path features from the attacker portrait, calculate the node state distribution in the attack path features to obtain a state transition probability, perform an association operation on the current attack state and the state transition probability to obtain a target node prediction probability, and determine the attack intention based on the target node prediction probability; Analyze the affected nodes according to the attack intention, and generate an access control policy based on the distribution location of the affected nodes and the degree of damage of the attack intention, wherein the access control policy includes node access rights and operation restriction conditions; Constructing an induction environment at the affected node, setting response characteristics of the induction environment based on the attack intent, and generating a redirection strategy for directing attack traffic to the induction environment; Classifying the access control policy and redirection policy according to the processing performance of the defense device to generate a basic defense policy and an enhanced defense policy; Issue basic defense strategies and enhanced defense strategies to defense devices, collect blocking data and performance data during the defense strategy execution process, calculate defense effects based on the blocking data, adjust the access permission granularity in the access control strategy and the traffic guidance ratio in the redirection strategy based on the defense effects and performance data, and update basic defense strategies and enhanced defense strategies.

8. An intelligent network attack chain tracking and blocking system, used to implement the method according to any one of claims 1 to 7, characterized in that: include: The first unit is used to collect network traffic data and establish the attack chain propagation path. It sets detection breakpoints on the propagation path, automatically adjusts the sampling interval according to the network load, obtains data samples at each detection breakpoint, performs causal correlation analysis on the data samples, extracts the data transmission characteristics between each node in the attack chain propagation path based on the correlation analysis results, and converts the data transmission characteristics into behavioral sequence characteristics. The second unit is used to match the behavior sequence features with the preset attack pattern using a bidirectional feature matching mechanism to obtain similarity. When the similarity exceeds a dynamic threshold, the attack chain evolution path is predicted based on the behavior sequence features and the defense deployment node location is determined based on the attack chain evolution path. The third unit is used to deploy honeypot services and traffic probes at defense deployment nodes. The honeypot service is used to obtain attacker operation behavior, and the traffic probe is used to obtain attack traffic characteristics. The attacker profile is generated based on the operation behavior and traffic characteristics. Unit 4: Determine attack intent based on attacker profile analysis, formulate defense strategies including access control and traffic redirection based on attack intent, send defense strategies to defense devices to block attack chains, obtain blocking results, and optimize defense strategies based on blocking results.

9. An electronic device, characterized in that: include: processor; a memory for storing processor-executable instructions; The processor is configured to call the instructions stored in the memory to execute the method according to any one of claims 1 to 7.

10. A computer-readable storage medium having computer program instructions stored thereon, characterized in that: When the computer program instructions are executed by a processor, the method according to any one of claims 1 to 7 is implemented.

Images