Intelligent tracking and blocking method and system for network attack chain

Abstract

This invention provides an intelligent method and system for tracking and blocking network attack chains, relating to the field of network security technology. The method includes: establishing attack chain propagation paths by collecting network traffic data; setting detection breakpoints to obtain data samples for causal correlation analysis; extracting data transmission characteristics and converting them into behavioral sequence characteristics; predicting the attack chain evolution path using a bidirectional feature matching mechanism; deploying honeypot services and traffic probes to generate attacker profiles; and formulating defense strategies based on attack intent to block the attack chain. This invention enables accurate identification, effective tracking, and proactive defense against network attacks, improving network security protection capabilities.

Description

Technical Field

[0001] This invention relates to network security technology, and in particular to an intelligent method and system for tracking and blocking network attack chains. Background Technology

[0002] As cyberattacks become increasingly complex and sophisticated, traditional rule-based attack detection methods struggle to cope with the dynamic evolution of attack chains. Existing technologies primarily rely on fixed signature databases for attack identification, failing to effectively trace the propagation path of attack chains within the network, resulting in ineffective and inefficient defense deployments.

[0003] Current network protection systems lack the ability to deeply analyze attacker behavior, making it difficult to accurately characterize attackers' technical features and attack intentions. Furthermore, the lack of adaptive data collection mechanisms and intelligent feature extraction methods results in low-quality attack data, which cannot support precise tracking of attack chains.

[0004] Existing defense methods often employ static protection strategies, failing to dynamically adjust defenses based on the evolution of the attack chain, and lacking a closed-loop optimization mechanism for defense effectiveness. Therefore, there is an urgent need for a network attack protection method capable of intelligently tracing the attack chain propagation path, accurately analyzing attacker behavioral characteristics, and dynamically optimizing defense strategies. Summary of the Invention

[0005] This invention provides an intelligent method and system for tracking and blocking network attack chains, which can solve the problems in the prior art.

[0006] A first aspect of this invention provides an intelligent method for tracking and blocking network attack chains, comprising:

[0007] Collect network traffic data and establish an attack chain propagation path. Set detection breakpoints on the propagation path, automatically adjust the sampling time interval according to the network load, obtain data samples from each detection breakpoint, perform causal correlation analysis on the data samples, extract data transmission characteristics between each node in the attack chain propagation path based on the correlation analysis results, and transform the data transmission characteristics into behavioral sequence characteristics.

[0008] A two-way feature matching mechanism is used to match behavioral sequence features with preset attack patterns to obtain similarity. When the similarity exceeds a dynamic threshold, the attack chain evolution path is predicted based on the behavioral sequence features, and the location of defense deployment nodes is determined according to the attack chain evolution path.

[0009] Deploy honeypot services and traffic probes at the defense deployment node locations. Use honeypot services to obtain attacker behavior and traffic probes to obtain attack traffic characteristics. Generate attacker profiles based on behavior and traffic characteristics.

[0010] Attack intent is determined by analyzing attacker profiles, and defense strategies including access control and traffic redirection are developed to counter these intents. These strategies are then distributed to defense devices to block the attack chain. The blocking results are obtained, and the defense strategies are optimized based on these results.

[0011] In one alternative embodiment,

[0012] Collect network traffic data and establish an attack chain propagation path. Set detection breakpoints along the propagation path and automatically adjust the sampling time interval according to network load. Obtain data samples at each detection breakpoint, including:

[0013] The network load status is obtained by acquiring network traffic data, calculating the number of data packets, the number of bytes transmitted, and the link utilization of the network link, and dynamically adjusting the sampling time interval according to the network load status. When the network load status is higher than the preset load threshold, the sampling time interval is increased, and when the network load status is lower than the preset load threshold, the sampling time interval is decreased.

[0014] The collected network traffic data is reassembled into sessions, and the source and destination addresses, communication times and protocol types of the sessions are extracted. The source and destination addresses are used as communication nodes, the data transmission between nodes is sorted according to the communication time, and the association between nodes is marked based on the protocol type.

[0015] Analyze the transmission rate and interaction frequency between nodes, combine nodes that meet the preset transmission rules to construct an initial attack link, and verify the propagation path of the attack chain based on the protocol changes and data flow between nodes in the initial attack link.

[0016] The node monitoring priority is obtained by calculating the number of connections and data throughput of nodes in the attack chain propagation path. The monitoring location is determined according to the node monitoring priority. Detection points are set at the monitoring locations, application layer data is collected, load content and behavioral characteristics are extracted, and the data is grouped according to the sampling time interval and detection breakpoint identifier to obtain data samples of each detection point.

[0017] In one alternative embodiment,

[0018] Causal correlation analysis was performed on the data samples. Based on the correlation analysis results, data transmission characteristics between nodes in the attack chain propagation path were extracted, and the data transmission characteristics were transformed into behavioral sequence characteristics, including:

[0019] A time series is constructed based on the timestamps of the data samples. The conditional mutual information of adjacent data samples in the time series is calculated to obtain the sample influence value. The time window size is determined based on the sample influence value. The data samples are then time-series grouped to obtain grouped data.

[0020] Causal correlation calculation is performed on sample pairs in the grouped data to obtain correlation strength values. The grouped data is clustered according to the correlation strength values ​​to obtain data transmission patterns. Traffic change features, protocol conversion features, and latency distribution features are extracted from the data transmission patterns and combined to form a data transmission feature matrix. Based on the data transmission feature matrix, feature conversion probabilities are calculated to obtain a feature mapping matrix.

[0021] The feature mapping deviation value is calculated based on the historical defense results. The feature mapping matrix is ​​updated based on the feature mapping deviation value. The updated feature mapping matrix is ​​then used to transform the data transmission feature matrix into a behavioral feature sequence.

[0022] In one alternative embodiment,

[0023] A bidirectional feature matching mechanism is used to match behavioral sequence features with preset attack patterns to obtain similarity. When the similarity exceeds a dynamic threshold, the attack chain evolution path is predicted based on the behavioral sequence features, and the location of defense deployment nodes is determined according to the attack chain evolution path, including:

[0024] Extract instruction-level switching data, memory access data, and inter-process communication data from behavioral sequence features to generate a time-series feature sequence;

[0025] The temporal feature sequence is segmented to obtain a set of behavioral stages. The set of behavioral stages is divided into multiple overlapping subsequences. The length of the longest common subsequence between the overlapping subsequence and the preset attack mode is calculated to obtain the local matching degree. The global similarity is calculated based on the cumulative distribution of the local matching degree.

[0026] The compensation coefficient is calculated based on historical matching samples. The compensation coefficient is multiplied by the benchmark threshold to obtain the dynamic threshold. The global similarity is compared with the dynamic threshold. When the global similarity exceeds the dynamic threshold, a state transition matrix is ​​constructed based on the behavioral stage set.

[0027] A Markov gain matrix is ​​constructed based on the state transition matrix. The eigenvectors of the Markov gain matrix are calculated to obtain the node importance. The path with the highest node importance is selected as the attack chain evolution path.

[0028] The node influence coefficient is obtained by calculating the ratio of in-degree centrality to out-degree centrality of each node in the attack chain evolution path. The defensive deployment node positions are determined by sorting the nodes from largest to smallest according to the node influence coefficient.

[0029] In one alternative embodiment,

[0030] Deploy honeypot services and traffic probes at defense deployment nodes. Use the honeypot service to acquire attacker behavior and the traffic probes to obtain attack traffic characteristics. Generate attacker profiles based on these behavior and traffic characteristics, including:

[0031] Deploy honeypot services and traffic probes at the defense deployment node locations;

[0032] In the honeypot service, an instruction execution environment including a real instruction pipeline and a virtual instruction pipeline is constructed. The attacker's operation behavior is simultaneously sent to the real instruction pipeline and the virtual instruction pipeline for execution. The execution difference between the two pipelines is extracted to obtain the operation disturbance characteristics.

[0033] The attacker's hidden operational behavior is identified based on the operational perturbation characteristics. A deception response environment is constructed based on the hidden operational behavior. The deception response environment returns a response result that meets the attacker's expectations and records the attacker's subsequent operational behavior.

[0034] The attack traffic is obtained through the traffic probe, and the payload data of the attack traffic is extracted.

[0035] The payload data is subjected to deep packet inspection to obtain the protocol field structure. The information entropy of the protocol field structure is calculated to obtain traffic characteristics. Based on the traffic characteristics, the attacker's traffic spoofing method is identified.

[0036] The operational behaviors and traffic characteristics are mapped on a time dimension, and the associated parts of the mapping results are extracted to obtain attack characteristics. The attack process is divided into multiple stages based on the attack characteristics, and an attacker profile is generated based on the hidden operational behaviors and traffic characteristics of each stage.

[0037] In one alternative embodiment,

[0038] Deep packet inspection of the payload data yields the protocol field structure. The information entropy of the protocol field structure is calculated to obtain traffic characteristics. Based on these traffic characteristics, the attacker's traffic spoofing methods are identified, including:

[0039] The payload data is parsed in layers, and the conditional probability distribution of the byte sequence is calculated using a sliding window. Based on the conditional probability distribution, the associated byte sequence is divided into field units, and the field units are constructed into a protocol field tree.

[0040] In each layer of the protocol field tree, the field type distribution is calculated to obtain the type entropy value, and the field length distribution is calculated to obtain the length entropy value. Based on the type entropy value and the length entropy value, the structural features of the current layer are constructed. The structural feature differences between adjacent layers in the protocol field tree are extracted to obtain the inter-layer difference sequence. The structural mutation layer is identified from the inter-layer difference sequence. The structural mutation layer corresponds to the attacker's protocol rewriting position.

[0041] The structural features of the structural mutation layer are analyzed over time to obtain the change period. Based on the change period, the structural features are grouped, and the fluctuation pattern of each group of features is calculated to obtain the obfuscation pattern. The protocol rewrite location and the obfuscation pattern are combined to form the protocol deformation feature. The traffic spoofing method used by the attacker is identified based on the protocol deformation feature.

[0042] In one alternative embodiment,

[0043] Attacker profiling analysis determines attack intent; defense strategies, including access control and traffic redirection, are developed to counter these intents; these strategies are then deployed to defense devices to block the attack chain; and the blocking results are obtained and the defense strategies are optimized based on these results.

[0044] The attacker profile is used to extract attack path features, the node state distribution in the attack path features is calculated to obtain the state transition probability, the current attack state is correlated with the state transition probability to obtain the target node prediction probability, and the attack intent is determined based on the target node prediction probability.

[0045] Analyze the affected nodes in response to the attack intent, and generate access control policies based on the distribution of the affected nodes and the severity of the attack intent. The access control policies include node access permissions and operation restrictions.

[0046] A decoy environment is constructed on the affected node, and the response characteristics of the decoy environment are set based on the attack intent to generate a redirection strategy for directing attack traffic to the decoy environment.

[0047] The access control and redirection policies are classified according to the processing performance of the defense devices to generate basic defense policies and enhanced defense policies;

[0048] Basic and enhanced defense policies are issued to the defense devices. At the same time, blocking and performance data are collected during the execution of the defense policies by the defense devices. The defense effect is calculated based on the blocking data. Based on the defense effect and performance data, the access permission granularity in the access control policy and the traffic redirection ratio in the redirection policy are adjusted, and the basic and enhanced defense policies are updated.

[0049] A second aspect of this invention provides an intelligent tracking and blocking system for network attack chains, comprising:

[0050] The first unit is used to collect network traffic data and establish an attack chain propagation path. Detection breakpoints are set on the propagation path, the sampling time interval is automatically adjusted according to the network load, data samples are obtained from each detection breakpoint, causal correlation analysis is performed on the data samples, and data transmission characteristics between each node in the attack chain propagation path are extracted based on the correlation analysis results, and the data transmission characteristics are transformed into behavioral sequence characteristics.

[0051] The second unit is used to match behavioral sequence features with preset attack patterns using a two-way feature matching mechanism to obtain similarity. When the similarity exceeds a dynamic threshold, the attack chain evolution path is predicted based on the behavioral sequence features, and the location of the defense deployment node is determined according to the attack chain evolution path.

[0052] The third unit is used to deploy honeypot services and traffic probes at the defense deployment node locations. The honeypot service is used to obtain attacker operation behavior, and the traffic probe is used to obtain attack traffic characteristics. Based on the operation behavior and traffic characteristics, an attacker profile is generated.

[0053] The fourth unit analyzes the attacker's profile to determine the attack intent, formulates defense strategies including access control and traffic redirection to address the attack intent, distributes the defense strategies to the defense devices to block the attack chain, obtains the blocking results, and optimizes the defense strategies based on the blocking results.

[0054] A third aspect of the present invention provides an electronic device, comprising:

[0055] processor;

[0056] a memory for storing processor-executable instructions;

[0057] The processor is configured to invoke instructions stored in the memory to execute the aforementioned method.

[0058] A fourth aspect of the present invention provides a computer-readable storage medium having stored thereon computer program instructions that, when executed by a processor, implement the aforementioned method.

[0059] In this embodiment, by collecting network traffic data and establishing attack chain propagation paths, setting detection breakpoints for causal correlation analysis, extracting data transmission characteristics, and converting them into behavioral sequence characteristics, accurate identification and tracking of attack chains are achieved, improving the accuracy of network security defense. A bidirectional feature matching mechanism is employed to match behavioral sequence characteristics with preset attack patterns, and based on this, the attack chain evolution path is predicted. Honeypot services and traffic probes are deployed at key nodes to proactively acquire attacker operational behaviors and traffic characteristics, forming a comprehensive attacker profile and enhancing the foresight and targeting of network defense. Attack intent is determined based on attacker profile analysis, and defense strategies including access control and traffic redirection are formulated. These strategies are continuously optimized based on blocking results, achieving intelligent blocking of network attacks, improving the adaptability and effectiveness of network security defense, and reducing network security risks. Attached Figure Description

[0060] Figure 1 This is a flowchart illustrating the intelligent tracking and blocking method for network attack chains according to an embodiment of the present invention.

[0061] Figure 2 This diagram illustrates the performance comparison between bidirectional feature matching and other detection methods.

[0062] Figure 3 Generate a sequence diagram for attacker profiling based on honeypot services and traffic probes;

[0063] Figure 4 Simulation diagram of attack intent prediction and defense strategy optimization. Detailed Implementation

[0064] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0065] The technical solution of the present invention will be described in detail below with reference to specific embodiments. These specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described again in some embodiments.

[0066] Figure 1 This is a flowchart illustrating the intelligent tracking and blocking method for network attack chains according to an embodiment of the present invention, as shown below. Figure 1 As shown, the method includes:

[0067] Collect network traffic data and establish an attack chain propagation path. Set detection breakpoints on the propagation path, automatically adjust the sampling time interval according to the network load, obtain data samples from each detection breakpoint, perform causal correlation analysis on the data samples, extract data transmission characteristics between each node in the attack chain propagation path based on the correlation analysis results, and transform the data transmission characteristics into behavioral sequence characteristics.

[0068] A two-way feature matching mechanism is used to match behavioral sequence features with preset attack patterns to obtain similarity. When the similarity exceeds a dynamic threshold, the attack chain evolution path is predicted based on the behavioral sequence features, and the location of defense deployment nodes is determined according to the attack chain evolution path.

[0069] Deploy honeypot services and traffic probes at the defense deployment node locations. Use honeypot services to obtain attacker behavior and traffic probes to obtain attack traffic characteristics. Generate attacker profiles based on behavior and traffic characteristics.

[0070] Attack intent is determined by analyzing attacker profiles, and defense strategies including access control and traffic redirection are developed to counter these intents. These strategies are then distributed to defense devices to block the attack chain. The blocking results are obtained, and the defense strategies are optimized based on these results.

[0071] In one optional implementation, network traffic data is collected and an attack chain propagation path is established. Detection breakpoints are set along the propagation path, and the sampling time interval is automatically adjusted according to network load. Data samples obtained at each detection breakpoint include:

[0072] The network load status is obtained by acquiring network traffic data, calculating the number of data packets, the number of bytes transmitted, and the link utilization of the network link, and dynamically adjusting the sampling time interval according to the network load status. When the network load status is higher than the preset load threshold, the sampling time interval is increased, and when the network load status is lower than the preset load threshold, the sampling time interval is decreased.

[0073] The collected network traffic data is reassembled into sessions, and the source and destination addresses, communication times and protocol types of the sessions are extracted. The source and destination addresses are used as communication nodes, the data transmission between nodes is sorted according to the communication time, and the association between nodes is marked based on the protocol type.

[0074] Analyze the transmission rate and interaction frequency between nodes, combine nodes that meet the preset transmission rules to construct an initial attack link, and verify the propagation path of the attack chain based on the protocol changes and data flow between nodes in the initial attack link.

[0075] The node monitoring priority is obtained by calculating the number of connections and data throughput of nodes in the attack chain propagation path. The monitoring location is determined according to the node monitoring priority. Detection points are set at the monitoring locations, application layer data is collected, load content and behavioral characteristics are extracted, and the data is grouped according to the sampling time interval and detection breakpoint identifier to obtain data samples of each detection point.

[0076] This invention provides a method for detecting network attack chain propagation paths. By collecting network traffic data and establishing attack chain propagation paths, detection breakpoints are set on the propagation paths, and the sampling time interval is automatically adjusted according to network load to obtain data samples at each detection breakpoint.

[0077] For example, the first step is to deploy network traffic acquisition devices, which can be deployed in front of core switches, border routers, or critical servers in the network. The acquisition devices capture passing data packets through network interfaces, recording the packet header information and payload content. The collected network traffic data includes information such as source IP address, destination IP address, source port, destination port, protocol type, timestamp, and data payload.

[0078] Network load status is calculated by statistically analyzing the number of data packets, the number of bytes transmitted, and the link utilization per unit time. Specifically, within each sampling period, the total number of data packets passing through the monitoring point is counted, the total number of bytes in these data packets is calculated, and the link utilization is calculated based on the link's maximum bandwidth. For example, if a link is detected to have transmitted 50,000 data packets in 10 seconds, with a total size of 75MB and a link bandwidth of 1Gbps, the link utilization is:

[0079] (75×8×1000000) / (10×1000000000)×100%=6%.

[0080] The sampling interval is dynamically adjusted based on the calculated network load status. When the network load is higher than a preset load threshold, the sampling interval is increased to reduce system load. When the network load is lower than the preset load threshold, the sampling interval is decreased to obtain more refined data. For example, if the preset load threshold is set to 50%, when the link utilization exceeds 50%, the sampling interval is increased from 30 seconds to 60 seconds; when the link utilization is lower than 50%, the sampling interval is decreased from 60 seconds to 30 seconds. In practical applications, multiple threshold levels can be set, such as 30%, 50%, 70%, and 90%, corresponding to sampling intervals of 15 seconds, 30 seconds, 60 seconds, and 120 seconds, respectively.

[0081] Session reassembly of collected network traffic data is achieved through the session tracking mechanism of the TCP / IP protocol stack. The system combines data packets with the same five-tuple (source IP, source port, destination IP, destination port, protocol type) into a single session. The source and destination addresses are extracted from the reassembled session as communication nodes. Data transmission between nodes is sorted according to communication time, and the association between nodes is marked based on protocol type. For example, if a client with IP address 192.168.1.100 establishes an HTTP session with a server with IP address 10.0.0.50, with a communication time of 2023-06-15 14:30:25 and a protocol type of HTTP, then 192.168.1.100 and 10.0.0.50 are designated as communication nodes, and their communication time and protocol type are recorded.

[0082] Analyzing the transmission rate and interaction frequency between nodes is achieved by calculating the amount of data transmitted and the number of interactions between nodes per unit time. Transmission rate refers to the number of bytes transmitted from the source node to the target node per unit time, and interaction frequency refers to the number of communications between the source and target nodes per unit time. Preset transmission rules include: abnormal transmission rate (e.g., sudden increase), abnormal interaction frequency (e.g., frequent short connections), communication on unconventional ports, and use of sensitive protocols. Node combinations that meet these preset transmission rules are constructed as the initial attack link.

[0083] Verifying the initial attack chain to determine the attack propagation path is based on protocol changes and data flow between nodes. Protocol changes refer to the attacker's potential use of different protocols for communication during the attack, such as switching from HTTP to SSH. Data flow refers to the direction in which data is transmitted from one node to another. By analyzing these characteristics, it can be verified whether the initial attack chain conforms to typical attack patterns. For example, if an HTTP request is observed from an external IP address to an internal web server, followed by an unusual SQL query from that web server to an internal database server, and then a large amount of data is transmitted from the database server to the external IP address, this conforms to a typical data breach attack pattern and can be confirmed as a valid attack chain propagation path.

[0084] The node monitoring priority is determined by calculating the number of connections and data throughput of nodes along the attack chain propagation path. The number of connections refers to the total number of connections a node establishes with other nodes, and the data throughput refers to the total amount of data processed by the node. The calculation of node monitoring priority considers the number of connections, data throughput, the node's position in the attack chain, and the node's importance. For example, a node with 50 connections, a data throughput of 500 MB / s, located in the middle of the attack chain, and being a critical business server, would have a higher monitoring priority.

[0085] The monitoring locations are determined based on node monitoring priorities, and monitoring points are set up at these locations. Monitoring points can be port mirroring on network devices (such as switches and routers) or network monitoring agents on hosts. Application layer data is collected at the monitoring points to extract load content and behavioral characteristics. Load content includes HTTP request headers, SQL statements, command-line instructions, etc., while behavioral characteristics include access patterns, authentication attempts, and resource usage.

[0086] Data was grouped according to sampling time intervals and detection breakpoint identifiers to obtain data samples for each detection point. Each data sample included information such as detection point identifier, sampling time, traffic characteristics, protocol distribution, and abnormal events. For example, data samples collected by detection point A at 15:00:00 on June 15, 2023 showed that HTTP traffic accounted for 70% during this period, with 10 SQL injection attempts and 3 brute-force authentication attempts detected, representing a 30% increase in traffic compared to the normal baseline.

[0087] In this embodiment, the sampling time interval is dynamically adjusted based on network load status to avoid oversampling and resource waste under high load, while increasing the sampling frequency under low load to enhance detection accuracy. Through session reassembly and communication feature extraction, communication links can be accurately reconstructed and potential attack paths can be identified. Combining protocol changes and data flow direction further verifies the attack chain to ensure the accuracy of propagation path identification. Prioritization based on the number of node connections and throughput allows for focused deployment of detection breakpoints at key nodes, improving resource utilization efficiency. Ultimately, targeted collection and behavioral feature analysis of application layer data at key locations are achieved, thereby enhancing the ability to visualize, track, and accurately intercept complex attack behaviors.

[0088] In one optional implementation, causal correlation analysis is performed on the data samples. Based on the correlation analysis results, data transmission characteristics between nodes in the attack chain propagation path are extracted, and the data transmission characteristics are transformed into behavioral sequence characteristics, including:

[0089] A time series is constructed based on the timestamps of the data samples. The conditional mutual information of adjacent data samples in the time series is calculated to obtain the sample influence value. The time window size is determined based on the sample influence value. The data samples are then time-series grouped to obtain grouped data.

[0090] Causal correlation calculation is performed on sample pairs in the grouped data to obtain correlation strength values. The grouped data is clustered according to the correlation strength values ​​to obtain data transmission patterns. Traffic change features, protocol conversion features, and latency distribution features are extracted from the data transmission patterns and combined to form a data transmission feature matrix. Based on the data transmission feature matrix, feature conversion probabilities are calculated to obtain a feature mapping matrix.

[0091] The feature mapping deviation value is calculated based on the historical defense results. The feature mapping matrix is ​​updated based on the feature mapping deviation value. The updated feature mapping matrix is ​​then used to transform the data transmission feature matrix into a behavioral feature sequence.

[0092] This invention provides a causal correlation analysis method based on data samples to extract data transmission characteristics between nodes in an attack chain propagation path and transform them into behavioral sequence characteristics. First, network traffic data samples are collected, each containing information such as timestamp, source IP address, destination IP address, protocol type, and packet size. For the collected data samples, a time-series sequence is constructed based on their timestamps. For example, for n data samples within a time period, they are arranged in chronological order to form the sequence {S1, S2, ..., S...}. n}

[0093] To calculate the conditional mutual information of adjacent data samples in a time series, the system performs conditional mutual information calculations on each pair of adjacent samples S. i and S i+1 The analysis proceeds. Specifically, feature vectors are extracted from the two samples, including attributes such as IP address similarity, protocol type, port number, and packet size. These features are then used to calculate the similarity of the features in sample S. i Condition S i+1 The probability distribution of occurrence and S i+1 The conditional mutual information value is obtained by considering the differences in their own probability distributions. For example, when analyzing two adjacent data packets, if a data packet with a source IP of 192.168.1.100 is immediately followed by a data packet with a destination IP of 10.0.0.5, and this pattern repeats at multiple time points, then the conditional mutual information value between these two samples is high, possibly reaching 0.85.

[0094] Based on the calculated conditional mutual information value, the system determines an appropriate time window size. When the average conditional mutual information value of adjacent samples is higher than a preset threshold (e.g., 0.7), a smaller time window (e.g., 5 seconds) is selected; when the conditional mutual information value is low, a larger time window (e.g., 30 seconds) is selected. Using the determined time window size, the original data samples are divided into multiple time groups, where samples within each group are temporally close and may have a causal relationship.

[0095] Causal association calculations are performed on sample pairs within each time group. The system constructs feature vectors, including IP address translation patterns, protocol changes, port changes, and packet size change rates. The Granger causality test is used to analyze the causal relationships between sample pairs and calculate the association strength value. For example, if after detecting an HTTP request from host A to host B, host B immediately sends a large number of UDP packets to host C, and this pattern repeats across multiple time windows, the association strength values ​​between A to B and B to C might be 0.92 and 0.88, respectively.

[0096] Based on the calculated association strength values, the system uses a hierarchical clustering algorithm to cluster the grouped data. Sample pairs with association strength values ​​higher than 0.8 are grouped into the same class, forming a data transmission pattern. For example, in an attack, a transmission pattern chain such as "scanning-vulnerability exploitation-privilege escalation-data theft" may be identified.

[0097] From the identified data transmission patterns, the system extracts three key features: traffic variation features, protocol conversion features, and latency distribution features. Traffic variation features describe the pattern of traffic volume changes during data transmission, such as the rate of increase in burst traffic and its duration. For example, in a certain attack, from the initial scan to the vulnerability exploitation phase, the traffic growth rate is 250%, and the duration is 45 seconds. Protocol conversion features describe the pattern of communication protocol changes, such as switching from HTTP to SSH or from DNS to ICMP. Latency distribution features describe the distribution of time intervals during data transmission, such as average latency and latency variance. In real-world cases, the average latency during the command and control phase might be 1.2 seconds, while the average latency during the data theft phase could increase to 3.5 seconds.

[0098] The extracted three types of features are combined to form a data transmission feature matrix M. Each row of the matrix represents a data transmission mode, and each column represents a feature. For example, a row of matrix M might be [250%, HTTP->SSH, 1.2s], indicating that the traffic growth rate of this transmission mode is 250%, the protocol is changed from HTTP to SSH, and the average latency is 1.2 seconds.

[0099] Based on the data transmission feature matrix, the system calculates the feature transformation probability and constructs a feature mapping matrix T. The feature mapping matrix describes the transformation relationship between different features, such as the correlation probability between a specific traffic change pattern and a protocol conversion pattern. In practical applications, if a traffic growth rate of 250% is observed, there is a 0.85 probability that it will be accompanied by a protocol conversion from HTTP to SSH.

[0100] The system calculates feature mapping bias values ​​based on historical defense results. The mapping bias is obtained by comparing the predicted attack behavior with the actual observed attack behavior. For example, if the system predicts that a certain traffic pattern will lead to data theft, but it actually leads to system disruption, this bias is recorded. Based on the calculated mapping bias values, the system updates the feature mapping matrix T, adjusting the transformation probabilities between features.

[0101] Using the updated feature mapping matrix, the system transforms the data transmission feature matrix into a behavioral feature sequence. This sequence describes the behavioral characteristics of each stage in the attack chain, such as "network scanning - vulnerability exploitation - privilege escalation - lateral movement - data theft". Each behavioral feature includes detailed attribute descriptions, such as scan rate, type of vulnerability exploited, and privilege level escalated. These behavioral sequence features can be used for attack detection, early warning, and defense strategy development.

[0102] In this embodiment, by introducing causal association analysis, the inherent causal relationships between samples can be identified, thereby accurately dividing the temporal structure of data and improving the contextual completeness of feature extraction. Based on features such as traffic changes, protocol conversions, and latency distribution extracted by cluster analysis, the transmission patterns between nodes can be comprehensively characterized, enhancing the ability to identify complex attack behaviors. By constructing a feature mapping matrix and combining it with historical defense results for dynamic correction, the adaptive transformation and continuous optimization of behavioral sequences can be achieved, giving the system strong generalization ability and adaptability. Finally, a stable and evolvable behavioral feature sequence can be generated, providing a highly reliable behavioral semantic foundation for subsequent anomaly detection, attack prediction, and response decisions.

[0103] In one optional implementation, a bidirectional feature matching mechanism is used to match behavioral sequence features with preset attack patterns to obtain similarity. When the similarity exceeds a dynamic threshold, the attack chain evolution path is predicted based on the behavioral sequence features, and the location of the defense deployment node is determined according to the attack chain evolution path, including:

[0104] Extract instruction-level switching data, memory access data, and inter-process communication data from behavioral sequence features to generate a time-series feature sequence;

[0105] The temporal feature sequence is segmented to obtain a set of behavioral stages. The set of behavioral stages is divided into multiple overlapping subsequences. The length of the longest common subsequence between the overlapping subsequence and the preset attack mode is calculated to obtain the local matching degree. The global similarity is calculated based on the cumulative distribution of the local matching degree.

[0106] The compensation coefficient is calculated based on historical matching samples. The compensation coefficient is multiplied by the benchmark threshold to obtain the dynamic threshold. The global similarity is compared with the dynamic threshold. When the global similarity exceeds the dynamic threshold, a state transition matrix is ​​constructed based on the behavioral stage set.

[0107] A Markov gain matrix is ​​constructed based on the state transition matrix. The eigenvectors of the Markov gain matrix are calculated to obtain the node importance. The path with the highest node importance is selected as the attack chain evolution path.

[0108] The node influence coefficient is obtained by calculating the ratio of in-degree centrality to out-degree centrality of each node in the attack chain evolution path. The defensive deployment node positions are determined by sorting the nodes from largest to smallest according to the node influence coefficient.

[0109] For example, firstly, based on the collected data transmission characteristic sequence, the behavior sequence feature extraction module extracts core indicators related to the attack, mainly including instruction-level switching data, memory access behavior data, and process communication behavior data. Instruction-level switching data reflects the switching between user mode and kernel mode in the system, which can reveal whether a process has abnormal call behavior; memory access data reflects the frequency and range of process access to heap, stack, shared memory, etc., which can reflect potential buffer overflow or data injection behavior; process communication data describes the communication activities between various processes, including the communication protocol used, communication frequency, and type of transmitted content, which can help identify whether there is illegal interaction behavior between processes. Through continuous sampling and merging of the above data, a complete behavior sequence is constructed.

[0110] The aforementioned behavioral sequence is temporally segmented into several consecutive sets of behavioral stages. Each behavioral stage represents a data segment with relatively consistent behavior. Furthermore, to improve the sensitivity and robustness of matching, each behavioral stage is divided into multiple overlapping subsequences. These overlapping subsequences are obtained using a sliding window mechanism, where the window slides one step at a time, truncating the original behavioral stage to form overlapping subsequence fragments. The local matching degree is obtained by calculating the longest common subsequence length between these subsequences and the corresponding stages in a preset attack pattern. The longest common subsequence length reflects the similarity between the current behavioral stage and the attack pattern stage in terms of behavioral execution order; a higher matching degree indicates that the current system may be reenacting a behavioral stage in the attack chain.

[0111] By combining the local matching information of all sub-sequences and their cumulative distribution, a comprehensive evaluation of the global similarity between the entire behavioral sequence and the preset attack pattern is performed. To overcome matching offsets caused by differences in attack payload, system environment, or user behavior between behavioral sequences, a dynamic threshold mechanism is introduced when calculating similarity. This dynamic threshold is obtained by multiplying a baseline threshold by a compensation coefficient obtained from historical matching samples. The compensation coefficient is used to correct for possible biases in the current detection task, making the similarity evaluation results more adaptive and fault-tolerant.

[0112] When the global similarity exceeds a dynamic threshold, the current system behavior sequence is considered highly similar to the attack pattern. In this case, a state transition matrix is ​​constructed to describe the transition relationships between behavior stages. This state transition matrix is ​​based on a set of behavior stages, recording the transition probability from each stage to the next, and marking its order of occurrence and direction of transition. The transition probability can be obtained by statistically analyzing the frequency of similar transition paths in a large number of historical behavior sequences.

[0113] Based on the state transition matrix, a Markov gain matrix is ​​further constructed. This matrix measures the gain of each node in the attack chain path, i.e., the facilitating effect of a node's presence on subsequent actions. The Markov gain matrix considers the cumulative dependencies and evolutionary trends between states, and calculates the matrix's eigenvectors to measure the relative importance of each node in the entire path. The higher the importance of a node, the more central its position in the attack chain, and the greater its behavioral changes influence the evolution of the attack chain.

[0114] The path with the largest value in the eigenvector is used as the evolution path of the attack chain, and the deployment value of each node on this path is then evaluated. To do this, the in-degree centrality and out-degree centrality of each node are calculated, and the ratio of these two values ​​yields the node's influence coefficient. In-degree centrality represents the degree to which a node is depended upon by multiple predecessor nodes, while out-degree centrality represents a node's control over multiple subsequent nodes. A larger influence coefficient indicates that the node possesses both guiding and transmitting capabilities in the propagation and control path, making it suitable as a defensive deployment location.

[0115] For example, in an enterprise-level server scenario, a monitoring system detects abnormal access behavior on a service port. The process involved frequently switches instructions, accesses shared memory, and initiates connection requests to multiple external hosts within a short period. After dividing this behavior into multiple stages, the behavior sequence extraction module finds that two stages highly match the behavioral characteristics of a known remote control Trojan attack pattern, with their longest common subsequence length significantly exceeding that of the normal behavior pattern. By cumulatively analyzing the matching degree of each stage, the system determines that the overall similarity of the current behavior sequence exceeds a dynamic threshold, and subsequently constructs the state transition relationship of the attack chain.

[0116] Statistical analysis shows that this attack chain typically evolves from port scanning to command execution, and then into data penetration. State transition matrix calculations revealed that the node with the sudden increase in memory read frequency has the highest Markov gain value in this chain. Further analysis, combined with the node's high in-degree centrality and low out-degree centrality, indicates that this node has the greatest impact coefficient. Therefore, it is recommended to deploy a network-layer and application-layer coordinated defense mechanism at this node, and simultaneously implement isolation policies to restrict its upstream connections. This strategy significantly improves the defense system's ability to identify and block attacks in their early stages.

[0117] In this embodiment, a bidirectional feature matching mechanism is introduced to conduct in-depth comparisons between behavioral sequence features and preset attack patterns, effectively improving the accuracy of attack chain identification. Existing technologies often rely on static feature or rule matching, which struggles to cope with the evolution of complex behavioral stages and dynamic changes in attack paths. Furthermore, they often lack a global perspective and quantitative basis for node deployment, leading to unreasonable allocation of defense resources. This application refines the behavioral stage division by extracting multi-dimensional temporal features such as instruction switching, memory access, and process communication, and achieves more flexible global matching by combining local matching degree and cumulative similarity. Simultaneously, a dynamic threshold mechanism based on historical sample adjustments is introduced to enhance the model's adaptability to abnormal behavior. Regarding attack chain evolution prediction, a state transition matrix is ​​constructed and a Markov gain matrix is ​​derived to quantify the evolution weight of nodes in the attack chain. Further, the centrality ratio of nodes is combined to scientifically evaluate their defensive deployment value. This improvement, starting from enhancing the accuracy of attack path prediction and the rationality of defense decisions, realizes a strategic shift from "whether to defend" to "where to prioritize defense," enhancing the system's real-time perception and response capabilities when facing complex attack chains.

[0118] Figure 2 This is a diagram illustrating the performance comparison between bidirectional feature matching and other detection methods, such as... Figure 2 As shown, the bidirectional feature matching technique (mesh-filled pillars) of this invention significantly outperforms traditional feature matching (white pillars) and unidirectional sequence matching (diagonal pillars) methods in all performance metrics. Specifically:

[0119] In terms of detection accuracy: bidirectional feature matching reached 93.5%, an improvement of 30.3 percentage points compared to traditional feature matching (63.2%), and an improvement of 15.5 percentage points compared to one-way sequence matching (78.0%). Regarding attack prediction accuracy: bidirectional feature matching reached 90.0%, significantly higher than traditional feature matching's 50.0% and one-way sequence matching's 70.0%. In terms of defense success rate: bidirectional feature matching reached 95.5%, significantly higher than traditional feature matching's 70.0% and one-way sequence matching's 83.0%.

[0120] Experimental results show that the bidirectional feature matching technology of this invention effectively improves the prediction accuracy of attack chains and the efficiency of defense deployment through dynamic threshold mechanism and Markov gain matrix.

[0121] In one optional implementation, a honeypot service and a traffic probe are deployed at the defense deployment node. The honeypot service is used to obtain attacker behavior, and the traffic probe is used to obtain attack traffic characteristics. Based on the behavior and traffic characteristics, an attacker profile is generated, including:

[0122] Deploy honeypot services and traffic probes at the defense deployment node locations;

[0123] In the honeypot service, an instruction execution environment including a real instruction pipeline and a virtual instruction pipeline is constructed. The attacker's operation behavior is simultaneously sent to the real instruction pipeline and the virtual instruction pipeline for execution. The execution difference between the two pipelines is extracted to obtain the operation disturbance characteristics.

[0124] The attacker's hidden operational behavior is identified based on the operational perturbation characteristics. A deception response environment is constructed based on the hidden operational behavior. The deception response environment returns a response result that meets the attacker's expectations and records the attacker's subsequent operational behavior.

[0125] The attack traffic is obtained through the traffic probe, and the payload data of the attack traffic is extracted.

[0126] The payload data is subjected to deep packet inspection to obtain the protocol field structure. The information entropy of the protocol field structure is calculated to obtain traffic characteristics. Based on the traffic characteristics, the attacker's traffic spoofing method is identified.

[0127] The operational behaviors and traffic characteristics are mapped on a time dimension, and the associated parts of the mapping results are extracted to obtain attack characteristics. The attack process is divided into multiple stages based on the attack characteristics, and an attacker profile is generated based on the hidden operational behaviors and traffic characteristics of each stage.

[0128] This invention provides an attacker profiling method based on honeypot services and traffic probes. By deploying honeypot services and traffic probes at defense deployment nodes, a comprehensive analysis and profiling of attacker behavior can be achieved.

[0129] Figure 3 Generate timing diagrams for attacker profiling based on honeypot services and traffic probes, such as Figure 3 As shown, when deploying honeypot services and traffic probes at defense deployment nodes, locations such as network boundaries, the front end of important servers, or key nodes within the internal network can be selected. The honeypot service employs highly interactive honeypot technology to simulate a real system environment, including components such as the operating system, application services, and databases. The traffic probe uses a bypass deployment method, acquiring the full network traffic passing through the nodes through network mirroring or traffic splitting technology.

[0130] The command execution environment built within the honeypot service includes a real command pipeline and a virtual command pipeline. The real command pipeline executes attacker commands in a real system environment, recording system state changes, file operations, network connections, and other behaviors. The virtual command pipeline executes the same commands in a sandbox environment, simulating the execution process but not actually changing the system state. The two pipelines run in parallel, and the system compares the execution results in real time. For example, when an attacker executes the command "ls -la", the real pipeline displays all files in the current directory (including hidden files), while the virtual pipeline may display filtered results; by comparing the output differences, the system detects that the attacker may be searching for hidden files.

[0131] Operational perturbation feature extraction employs behavioral difference analysis technology, primarily encompassing four dimensions: instruction execution path differences, system call sequence differences, resource access pattern differences, and execution result differences. The system vectorizes these differential features to construct an operational perturbation feature set. For example, when an attacker executes the command "cat / etc / shadow", the real pipeline will actually access the password file, while the virtual pipeline will return simulated data; by comparing the differences between the access path and the returned results, the system identifies that the attacker is attempting to obtain system password information.

[0132] Based on the identified hidden operational behaviors, the system constructs a deceptive response environment. This environment dynamically generates response content according to the attacker's intent, simulating real system behavior. For example, when it detects that the attacker is searching for a database configuration file, the deceptive response environment generates a configuration file containing fake but plausible database connection information, guiding the attacker to continue. The system also records all subsequent actions of the attacker, including command execution, file access, and network connections, forming a complete attack chain.

[0133] Attack traffic acquired by the traffic probe is stored in a multi-level buffer to ensure no packet loss in high-speed network environments. The system extracts payload data from the traffic, stripping transport and network layer header information while retaining application layer data. For encrypted traffic, the system deploys an SSL / TLS decryption module to perform decryption analysis under legitimate authorization.

[0134] During deep packet inspection, the system first identifies the protocol type used by the traffic, including standard protocols (such as HTTP, DNS, SSH, etc.) and non-standard protocols. For standard protocols, the system uses a predefined protocol parser to extract fields; for non-standard protocols, the system uses heuristic analysis methods to identify the protocol structure. For example, for HTTP traffic, the system extracts the request method, URL, header fields, and body content; for DNS traffic, it extracts information such as the query domain name and record type.

[0135] The entropy calculation for the protocol field structure employs a sliding window technique, calculating the entropy value byte-by-byte for the payload data. The system sets an entropy threshold of 4.5; when the entropy value of a data segment exceeds this threshold, it is marked as potentially encrypted or obfuscated data. By analyzing the entropy distribution characteristics of different protocol fields, the system can identify the traffic masquerading methods used by attackers, such as DNS tunneling, hiding data in HTTP headers, and embedding encrypted commands within normal traffic. For example, when an abnormally high entropy value (exceeding 4.5) is detected in the subdomain portion of a DNS query, the system determines that a DNS tunnel may exist; when the entropy value of the User-Agent field in an HTTP request is abnormal and its length exceeds the standard value, it is determined to be a possible command hiding channel.

[0136] The time-dimensional mapping between operational behaviors and traffic characteristics employs time window correlation analysis technology, associating operational behaviors and traffic characteristics that are close in time (interval less than 500 milliseconds). The system extracts these correlated parts to form an attack feature set. For example, when an attacker executes a file download command, an HTTP GET request traffic immediately appears. The system correlates these two events to identify that the attacker is downloading malicious tools via the HTTP protocol.

[0137] Based on the extracted attack characteristics, the system divides the attack process into stages such as reconnaissance, intrusion, privilege escalation, lateral movement, data theft, and trace erasure. Each stage is characterized by operational behavior patterns, traffic patterns, duration, and transition conditions. Based on the hidden operational behaviors and traffic characteristics of each stage, the system generates an attacker profile, including dimensions such as technical skill level, attack objectives, tools used, behavioral patterns, and possible attribution. For example, when the system detects that an attacker uses advanced covert tunneling techniques, is proficient in Linux command operations, and engages in targeted theft of specific business data, it can determine that the attacker is a high-level threat actor with a clear objective.

[0138] In existing technologies, most network defense systems rely solely on static rules or known signature databases to identify attack behaviors, making it difficult to effectively counter highly concealed manipulation behaviors and encrypted, obfuscated traffic. Furthermore, they lack in-depth guidance on attack intent and continuous behavioral tracking at the interaction response level, resulting in insufficient accuracy and completeness in attacker profiling. This application constructs a highly realistic interactive environment capable of executing both real and virtual command pipelines by deploying honeypot services and traffic probes at defense deployment nodes. This environment not only processes attacker input commands through dual channels but also extracts operational disturbance features by analyzing the differences in the execution of the two command pipelines, thereby identifying commands with hidden intentions and improving the detection capability of concealed manipulation behaviors in complex attack paths. Based on this, combined with a deceptive response environment, dynamically generated disguised response results guide attackers to continue operations, effectively extending their dwell time and exposing more behavioral intentions. The traffic probe can capture attack traffic in real time at the deployment node, analyze its payload content, and construct protocol field structures. By calculating the distribution characteristics of protocol fields and obtaining information entropy changes, it identifies obfuscation and masking behaviors in the traffic, overcoming the low recognition rate of novel traffic disguises in traditional deep packet inspection. Furthermore, the technical solution maps and analyzes operational behaviors and traffic characteristics over time, extracts the correspondence between behaviors and traffic, effectively reconstructs the evolution path of attack behaviors, and achieves phased division.

[0139] Compared to existing technologies, this application is attacker behavior-oriented and interaction response-centered. Through the synergistic integration of instruction difference analysis and traffic feature parsing, it not only enhances the system's ability to identify covert attack features, but also achieves a detailed characterization of attacker behavior and intent, improving the accuracy and real-time performance of the profile, and providing more precise support for subsequent attack chain tracing and defense strategy optimization.

[0140] In one optional implementation, deep packet inspection is performed on the payload data to obtain the protocol field structure, the information entropy of the protocol field structure is calculated to obtain traffic characteristics, and the attacker's traffic spoofing methods are identified based on the traffic characteristics, including:

[0141] The payload data is parsed in layers, and the conditional probability distribution of the byte sequence is calculated using a sliding window. Based on the conditional probability distribution, the associated byte sequence is divided into field units, and the field units are constructed into a protocol field tree.

[0142] In each layer of the protocol field tree, the field type distribution is calculated to obtain the type entropy value, and the field length distribution is calculated to obtain the length entropy value. Based on the type entropy value and the length entropy value, the structural features of the current layer are constructed. The structural feature differences between adjacent layers in the protocol field tree are extracted to obtain the inter-layer difference sequence. The structural mutation layer is identified from the inter-layer difference sequence. The structural mutation layer corresponds to the attacker's protocol rewriting position.

[0143] The structural features of the structural mutation layer are analyzed over time to obtain the change period. Based on the change period, the structural features are grouped, and the fluctuation pattern of each group of features is calculated to obtain the obfuscation pattern. The protocol rewrite location and the obfuscation pattern are combined to form the protocol deformation feature. The traffic spoofing method used by the attacker is identified based on the protocol deformation feature.

[0144] This invention proposes a method for identifying attacker traffic spoofing techniques. By performing deep packet inspection and information entropy calculation on payload data, the characteristics of attack traffic can be accurately identified.

[0145] In this implementation, the payload is first extracted from the captured data packets on the network. Payload data refers to the actual content of the data packet after removing the header information. The system uses a network packet capture tool to obtain the data stream and separates the payload portion of the TCP or UDP protocol from it. For example, for an HTTP request packet, the system extracts the HTTP header and subsequent content data as the payload.

[0146] The extracted payload data is parsed hierarchically to establish a protocol field structure. The system uses a 64-byte sliding window, sliding across the payload data in 8-byte increments. For each byte sequence within the window, the system calculates the conditional probability distribution of each byte. Specifically, the system statistically analyzes the byte value distribution at each position in the byte sequence. When the byte value at a certain position changes little or shows a regular pattern, that position is considered a fixed identifier or length field; when the byte value changes significantly and without a clear pattern, that position is considered a data content field.

[0147] In conditional probability calculation, the system analyzes 1000 collected data packet samples and counts the frequency of occurrence of each byte value. For example, for the four bytes with position offsets of 12-15, if they maintain a specific value sequence in 95% of the samples, they are marked as a protocol fixed identifier field; if the bytes with position offsets of 16-19 vary significantly and irregularly among the samples, they are marked as a data content field.

[0148] Based on the above calculations, the system divides related byte sequences into field units. A field unit refers to a consecutive sequence of bytes that has the same functional meaning. For example, if four consecutive bytes all exhibit the characteristics of a length indicator, then these four bytes are divided into a "length field" unit. The field types identified by the system include: fixed identifier fields, length fields, checksum fields, and data content fields.

[0149] After the field units are divided, the system constructs a protocol field tree. A protocol field tree is a hierarchical tree data structure representing the protocol structure, where the root node represents the entire protocol, and each level represents the nesting level of the protocol. During construction, the system first identifies the outermost protocol structure as the first level, and then recursively analyzes the internally nested sub-protocol structures. For attackers' disguised traffic, they typically add forged protocol headers or modify the protocol structure at a certain level.

[0150] For a pre-constructed protocol field tree, the system calculates structural features at each layer. These structural features include the type entropy value of the field type distribution and the length entropy value of the field length distribution. The type entropy value is calculated by statistically analyzing the distribution of all field types at that layer, counting the frequency of different field types, and calculating the information entropy of this distribution. Similarly, the length entropy value is calculated by statistically analyzing the distribution of all field lengths at that layer and calculating the information entropy of the length distribution.

[0151] For example, when analyzing the first layer of normal HTTP traffic, it may contain three main field types: request line, multiple header fields, and message body. The type distribution is relatively even, and the calculated type entropy value is 2.46. However, when analyzing traffic disguised by an attacker, a large number of repeated fixed identifier fields may appear in a certain layer, resulting in an unbalanced type distribution. The calculated type entropy value drops significantly to 0.87.

[0152] The system extracts the structural feature differences between adjacent layers to obtain an inter-layer difference sequence. Specifically, it calculates the difference between the type entropy and length entropy values ​​of the i-th and (i+1)-th layers, forming difference value pairs. The nested structure of a normal protocol typically exhibits a smooth change in inter-layer differences, while pseudo-protocols injected by attackers can cause abrupt changes in the difference values. The system identifies layers with structural abrupt changes by setting thresholds (e.g., a type entropy difference greater than 1.5 or a length entropy difference greater than 1.2).

[0153] For identified structural mutation layers, the system performs time-series analysis to determine their change cycle. The system continuously monitors the characteristic changes of structural mutation layers in traffic from the same source and records the time intervals of these characteristic changes. For example, if the characteristics of a certain attack traffic at the structural mutation layer change significantly every 30 seconds, it indicates that the attacker has adopted a periodic protocol variation strategy.

[0154] Based on the determined change cycle, the system groups structural features and calculates the fluctuation pattern of each group to obtain obfuscation patterns. Obfuscation patterns include: periodic replacement of fixed identifiers, randomization of length fields, and changes in protocol nesting depth. For example, the system may find that in each cycle of a certain attack traffic, the value of the fixed identifier field changes cyclically according to a specific sequence, while the length field exhibits randomized characteristics.

[0155] Ultimately, the system combines the protocol rewriting location (structural mutation layer) and obfuscation pattern to form a protocol deformation feature, which is then matched against a known database of attack traffic masquerading methods. Based on the matching results, the system can identify the traffic masquerading methods used by the attacker, such as protocol masquerading, protocol obfuscation, and deep encapsulation. For example, when the system detects that the attack traffic inserts fake HTTP headers into the application layer protocol structure, and these header fields change according to a specific period, it can determine that the attacker has used an HTTP protocol masquerading method.

[0156] In this embodiment, by performing hierarchical parsing of payload data and constructing a protocol field tree, the protocol structure hierarchy can be accurately reconstructed. Within each layer, structural entropy features are extracted by calculating the distribution characteristics of field types and lengths. Then, based on inter-layer structural differences, mutation layers with abnormal variations are identified, precisely locating the attacker's protocol rewriting behavior. Furthermore, time-series analysis is performed on the mutation layer features to identify the periodic patterns of field changes, thereby constructing obfuscation patterns and combining them with the rewriting location to form protocol deformation features, achieving accurate identification of complex traffic masquerading methods. Compared to traditional methods, this scheme does not rely on prior knowledge of protocol types and has the ability to dynamically adapt to protocol layer rewriting and obfuscation patterns, significantly improving the depth and breadth of masquerading traffic identification and enhancing the system's ability to detect unknown or variant attack traffic.

[0157] In one optional implementation, the attack intent is determined based on attacker profiling analysis; a defense strategy, including access control and traffic redirection, is formulated to address the attack intent; the defense strategy is then distributed to the defense device to block the attack chain; and the blocking results are obtained and the defense strategy is optimized based on the blocking results.

[0158] The attacker profile is used to extract attack path features, the node state distribution in the attack path features is calculated to obtain the state transition probability, the current attack state is correlated with the state transition probability to obtain the target node prediction probability, and the attack intent is determined based on the target node prediction probability.

[0159] Analyze the affected nodes in response to the attack intent, and generate access control policies based on the distribution of the affected nodes and the severity of the attack intent. The access control policies include node access permissions and operation restrictions.

[0160] A decoy environment is constructed on the affected node, and the response characteristics of the decoy environment are set based on the attack intent to generate a redirection strategy for directing attack traffic to the decoy environment.

[0161] The access control and redirection policies are classified according to the processing performance of the defense devices to generate basic defense policies and enhanced defense policies;

[0162] Basic and enhanced defense policies are issued to the defense devices. At the same time, blocking and performance data are collected during the execution of the defense policies by the defense devices. The defense effect is calculated based on the blocking data. Based on the defense effect and performance data, the access permission granularity in the access control policy and the traffic redirection ratio in the redirection policy are adjusted, and the basic and enhanced defense policies are updated.

[0163] For example, the first step is to extract attack path features from the attacker's profile. Attack path features include information such as the attacker's activity trajectory within the network, the characteristics of the attack tools used, and target asset preferences. By analyzing the node access sequences within these features, the distribution of node states is calculated, yielding state transition probabilities that reflect the attacker's behavioral patterns. For instance, an attacker might first compromise an edge server, then laterally move to a database server, and finally steal sensitive data; this behavioral pattern would form a stable distribution characteristic in the state transition probabilities.

[0164] The algorithm correlates the currently detected attack state with the state transition probability to calculate the probability of a potential target node. Specifically, a sliding time window method is used to match the state transition features in historical attack paths with the current attack state, obtaining a predicted probability for each potential target node. A higher predicted probability indicates that the node is more likely to become the attacker's next target. Based on the predicted probability distribution of target nodes, combined with the node's business attributes and asset importance, the attacker's intent can be determined.

[0165] To address identified attack intents, it's necessary to analyze potentially affected network nodes. Affected nodes include the attacker's target node and related nodes that interact with or depend on the target node for data exchange. For example, when an attacker's intent to compromise a business system is detected, it's necessary to simultaneously protect related nodes such as the system's database server and log server. Based on the distribution of affected nodes within the network and the severity of the attack intent, corresponding access control policies are generated. Access control policies primarily consist of two aspects: node access permissions and operational restrictions. Node access permissions define the rules for accessing affected nodes from different source IPs, while operational restrictions specify the types and frequency limits of allowed operations.

[0166] To induce and observe attacker behavior, a decoy environment is constructed around the affected nodes. This decoy environment is an independent sandbox system that simulates the characteristics of a real business environment. The response characteristics of the decoy environment are set according to the attack intent, including system version information, open ports, and service responses. These characteristics must be consistent with the real environment to ensure authenticity. Simultaneously, traffic redirection policies are generated to direct attack traffic matching specific characteristics into the decoy environment. For example, when a malicious database access request is detected, it is redirected to a pre-deployed database honeypot.

[0167] Considering the varying processing capabilities of different defense devices, access control and redirection policies need to be tiered. First, the processing performance of each defense device is evaluated, including metrics such as throughput and concurrent connections. Based on the performance evaluation results, defense policies are divided into basic defense policies and enhanced defense policies. Basic defense policies contain necessary access control rules and are executed by all defense devices. Enhanced defense policies contain finer-grained control rules and complex traffic analysis rules, and are executed only by devices with higher performance.

[0168] After the strategy is generated, basic and enhanced defense strategies are distributed to various defense devices through a centralized management platform. During strategy execution, operational data from the defense devices is collected in real time, mainly including two types: blocking data and performance data. Blocking data records information such as the number of strategy match hits and the blocking success rate, while performance data includes the resource consumption during strategy execution. Based on the collected blocking data, defense effectiveness metrics are calculated. These metrics primarily consider two dimensions: blocking accuracy and false negative rate.

[0169] Based on defense effectiveness metrics and performance data, defense strategies are dynamically optimized. When a high false positive rate is detected in certain access control rules, their control granularity is appropriately reduced; when certain redirection rules cause excessive device load, the traffic redirection ratio is adjusted. For example, if access control rules for a certain IP segment cause significant disruption to normal services, the control granularity can be adjusted from the IP segment level to the specific IP level. If a redirection rule causes the device's CPU utilization to consistently exceed a threshold, the proportion of redirected traffic is reduced.

[0170] The optimized defense strategy is updated into both the basic and enhanced defense strategies and then redistributed to the defense devices. This feedback-based optimization mechanism enables the defense strategy to continuously adapt to changes in the network environment and the evolution of attack characteristics. The entire process forms a closed loop, achieving precise protection against the attack chain through continuous monitoring, analysis, and optimization. In practical applications, this method can adaptively adjust the defense strategy based on the attacker's behavioral characteristics, significantly improving the effectiveness of network protection.

[0171] This embodiment enables intelligent tracking and blocking of the entire attack chain. Based on attacker profiling and behavioral characteristic analysis, it accurately predicts attack intent and attack paths, improving the accuracy and foresight of attack detection. Dynamic thresholding and bidirectional feature matching reduce false positive rates and improve detection efficiency. A layered defense strategy and adaptive optimization mechanism are adopted, deploying strategies hierarchically according to the performance characteristics of defense devices, avoiding device overload and ensuring the stable operation of defense measures. Simultaneously, closed-loop optimization based on defense effectiveness allows the defense strategy to dynamically adapt to changes in the network environment and the evolution of attack characteristics. The inducement environment built at affected nodes effectively guides and captures attack traffic, providing detailed data for attack analysis. Precise access control and traffic redirection effectively block the attack chain while minimizing the impact on normal business operations. The overall solution enhances the intelligence level and defense effectiveness of network security protection.

[0172] Figure 4 The simulation diagram illustrates the attack intent prediction and defense strategy optimization. As the number of iterations increases, the accuracy of attack intent prediction gradually improves from the initial 62.4% to 90.5%, while the blocking rate of the defense strategy correspondingly increases from 60.3% to 89.6%, and the false alarm rate decreases from 20.1% to 2.3%. The diagram marks the significant improvement in prediction accuracy (to 75.6%) in the third iteration and the key nodes where the strategy basically converges in the sixth iteration.

[0173] By extracting attack path features to construct a state transition probability matrix, and combining this with dynamic optimization of access control and traffic redirection strategies, it is possible to accurately predict and efficiently block attack intent, while effectively reducing the false positive rate.

[0174] A second aspect of the present invention provides an intelligent tracking and blocking system, the system comprising:

[0175] The first unit is used to collect network traffic data and establish an attack chain propagation path. Detection breakpoints are set on the propagation path, the sampling time interval is automatically adjusted according to the network load, data samples are obtained from each detection breakpoint, causal correlation analysis is performed on the data samples, and data transmission characteristics between each node in the attack chain propagation path are extracted based on the correlation analysis results, and the data transmission characteristics are transformed into behavioral sequence characteristics.

[0176] The second unit is used to match behavioral sequence features with preset attack patterns using a two-way feature matching mechanism to obtain similarity. When the similarity exceeds a dynamic threshold, the attack chain evolution path is predicted based on the behavioral sequence features, and the location of the defense deployment node is determined according to the attack chain evolution path.

[0177] The third unit is used to deploy honeypot services and traffic probes at the defense deployment node locations. The honeypot service is used to obtain attacker operation behavior, and the traffic probe is used to obtain attack traffic characteristics. Based on the operation behavior and traffic characteristics, an attacker profile is generated.

[0178] The fourth unit is used to determine the attack intent based on the attacker profile analysis, formulate defense strategies including access control and traffic redirection against the attack intent, issue defense strategies to the defense devices to block the attack chain, obtain the blocking results, and optimize the defense strategies based on the blocking results.

[0179] A third aspect of the present invention provides an electronic device, comprising:

[0180] processor;

[0181] a memory for storing processor-executable instructions;

[0182] The processor is configured to invoke instructions stored in the memory to execute the aforementioned method.

[0183] A fourth aspect of the present invention provides a computer-readable storage medium having stored thereon computer program instructions that, when executed by a processor, implement the aforementioned method.

[0184] This invention can be a method, apparatus, system, and / or computer program product. The computer program product may include a computer-readable storage medium having computer-readable program instructions loaded thereon for performing various aspects of the invention.

[0185] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention.

Claims

1. An intelligent method for tracing and blocking network attack chains, characterized in that, include: Collect network traffic data and establish an attack chain propagation path. Set detection breakpoints on the propagation path, automatically adjust the sampling time interval according to the network load, obtain data samples from each detection breakpoint, construct a time series based on the timestamps of the data samples, calculate the conditional mutual information of adjacent data samples in the time series to obtain the sample influence value, determine the time window size based on the sample influence value, and perform time-series grouping of the data samples to obtain grouped data. Causal correlation calculation is performed on sample pairs in the grouped data to obtain correlation strength values. The grouped data is clustered according to the correlation strength values ​​to obtain data transmission patterns. Traffic change features, protocol conversion features, and latency distribution features are extracted from the data transmission patterns and combined to form a data transmission feature matrix. Based on the data transmission feature matrix, feature conversion probabilities are calculated to obtain a feature mapping matrix. The feature mapping deviation value is calculated based on the historical defense results. The feature mapping matrix is ​​updated based on the feature mapping deviation value. The updated feature mapping matrix is ​​then used to transform the data transmission feature matrix into a behavioral feature sequence. Extract instruction-level switching data, memory access data, and inter-process communication data from behavioral sequence features to generate a time-series feature sequence; The temporal feature sequence is segmented to obtain a set of behavioral stages. The set of behavioral stages is divided into multiple overlapping subsequences. The length of the longest common subsequence between the overlapping subsequence and the preset attack mode is calculated to obtain the local matching degree. The global similarity is calculated based on the cumulative distribution of the local matching degree. The compensation coefficient is calculated based on historical matching samples. The compensation coefficient is multiplied by the benchmark threshold to obtain the dynamic threshold. The global similarity is compared with the dynamic threshold. When the global similarity exceeds the dynamic threshold, a state transition matrix is ​​constructed based on the behavioral stage set. A Markov gain matrix is ​​constructed based on the state transition matrix. The eigenvectors of the Markov gain matrix are calculated to obtain the node importance. The path with the highest node importance is selected as the attack chain evolution path. The node influence coefficient is obtained by calculating the ratio of the in-degree centrality to the out-degree centrality of each node in the attack chain evolution path. The defensive deployment node positions are determined by sorting the nodes from largest to smallest according to the node influence coefficient. Deploy honeypot services and traffic probes at the defense deployment node locations. Use honeypot services to obtain attacker behavior and traffic probes to obtain attack traffic characteristics. Generate attacker profiles based on behavior and traffic characteristics. The attacker profile is used to extract attack path features, the node state distribution in the attack path features is calculated to obtain the state transition probability, the current attack state is correlated with the state transition probability to obtain the target node prediction probability, and the attack intent is determined based on the target node prediction probability. Analyze the affected nodes in response to the attack intent, and generate access control policies based on the distribution of the affected nodes and the severity of the attack intent. The access control policies include node access permissions and operation restrictions. A decoy environment is constructed on the affected node, and the response characteristics of the decoy environment are set based on the attack intent to generate a redirection strategy for directing attack traffic to the decoy environment. The access control and redirection policies are classified according to the processing performance of the defense devices to generate basic defense policies and enhanced defense policies; Basic and enhanced defense policies are issued to the defense devices. At the same time, blocking and performance data are collected during the execution of the defense policies by the defense devices. The defense effect is calculated based on the blocking data. Based on the defense effect and performance data, the access permission granularity in the access control policy and the traffic redirection ratio in the redirection policy are adjusted, and the basic and enhanced defense policies are updated.

2. The method according to claim 1, characterized in that, Collect network traffic data and establish an attack chain propagation path. Set detection breakpoints along the propagation path and automatically adjust the sampling time interval according to network load. Obtain data samples at each detection breakpoint, including: The network load status is obtained by acquiring network traffic data, calculating the number of data packets, the number of bytes transmitted, and the link utilization of the network link, and dynamically adjusting the sampling time interval according to the network load status. When the network load status is higher than the preset load threshold, the sampling time interval is increased, and when the network load status is lower than the preset load threshold, the sampling time interval is decreased. The collected network traffic data is reassembled into sessions, and the source and destination addresses, communication times and protocol types of the sessions are extracted. The source and destination addresses are used as communication nodes, the data transmission between nodes is sorted according to the communication time, and the association between nodes is marked based on the protocol type. Analyze the transmission rate and interaction frequency between nodes, combine nodes that meet the preset transmission rules to construct an initial attack link, and verify the propagation path of the attack chain based on the protocol changes and data flow between nodes in the initial attack link. The node monitoring priority is obtained by calculating the number of connections and data throughput of nodes in the attack chain propagation path. The monitoring location is determined according to the node monitoring priority. Detection points are set at the monitoring locations, application layer data is collected, load content and behavioral characteristics are extracted, and the data is grouped according to the sampling time interval and detection breakpoint identifier to obtain data samples of each detection point.

3. The method according to claim 1, characterized in that, Deploy honeypot services and traffic probes at defense deployment nodes. Use the honeypot service to acquire attacker behavior and the traffic probes to obtain attack traffic characteristics. Generate attacker profiles based on these behavior and traffic characteristics, including: Deploy honeypot services and traffic probes at the defense deployment node locations; In the honeypot service, an instruction execution environment including a real instruction pipeline and a virtual instruction pipeline is constructed. The attacker's operation behavior is simultaneously sent to the real instruction pipeline and the virtual instruction pipeline for execution. The execution difference between the two pipelines is extracted to obtain the operation disturbance characteristics. The attacker's hidden operational behavior is identified based on the operational perturbation characteristics. A deception response environment is constructed based on the hidden operational behavior. The deception response environment returns a response result that meets the attacker's expectations and records the attacker's subsequent operational behavior. The attack traffic is obtained through the traffic probe, and the payload data of the attack traffic is extracted. The payload data is subjected to deep packet inspection to obtain the protocol field structure. The information entropy of the protocol field structure is calculated to obtain traffic characteristics. Based on the traffic characteristics, the attacker's traffic spoofing method is identified. The operational behaviors and traffic characteristics are mapped on a time dimension, and the associated parts of the mapping results are extracted to obtain attack characteristics. The attack process is divided into multiple stages based on the attack characteristics, and an attacker profile is generated based on the hidden operational behaviors and traffic characteristics of each stage.

4. The method according to claim 3, characterized in that Deep packet inspection of the payload data yields the protocol field structure. The information entropy of the protocol field structure is calculated to obtain traffic characteristics. Based on these traffic characteristics, the attacker's traffic spoofing methods are identified, including: The payload data is parsed in layers, and the conditional probability distribution of the byte sequence is calculated using a sliding window. Based on the conditional probability distribution, the associated byte sequence is divided into field units, and the field units are constructed into a protocol field tree. In each layer of the protocol field tree, the field type distribution is calculated to obtain the type entropy value, and the field length distribution is calculated to obtain the length entropy value. Based on the type entropy value and the length entropy value, the structural features of the current layer are constructed. The structural feature differences between adjacent layers in the protocol field tree are extracted to obtain the inter-layer difference sequence. The structural mutation layer is identified from the inter-layer difference sequence. The structural mutation layer corresponds to the attacker's protocol rewriting position. The structural features of the structural mutation layer are analyzed over time to obtain the change period. Based on the change period, the structural features are grouped, and the fluctuation pattern of each group of features is calculated to obtain the obfuscation pattern. The protocol rewrite location and the obfuscation pattern are combined to form the protocol deformation feature. The traffic spoofing method used by the attacker is identified based on the protocol deformation feature.

5. An intelligent tracking and blocking system for network attack chains, used to implement the method described in any one of claims 1-4, characterized in that, include: The first unit is used to collect network traffic data and establish an attack chain propagation path. Detection breakpoints are set on the propagation path, the sampling time interval is automatically adjusted according to the network load, data samples are obtained from each detection breakpoint, causal correlation analysis is performed on the data samples, and data transmission characteristics between each node in the attack chain propagation path are extracted based on the correlation analysis results, and the data transmission characteristics are transformed into behavioral sequence characteristics. The second unit is used to match behavioral sequence features with preset attack patterns using a two-way feature matching mechanism to obtain similarity. When the similarity exceeds a dynamic threshold, the attack chain evolution path is predicted based on the behavioral sequence features, and the location of the defense deployment node is determined according to the attack chain evolution path. The third unit is used to deploy honeypot services and traffic probes at the defense deployment node locations. The honeypot service is used to obtain attacker operation behavior, and the traffic probe is used to obtain attack traffic characteristics. Based on the operation behavior and traffic characteristics, an attacker profile is generated. The fourth unit analyzes the attacker's profile to determine the attack intent, formulates defense strategies including access control and traffic redirection to address the attack intent, distributes the defense strategies to the defense devices to block the attack chain, obtains the blocking results, and optimizes the defense strategies based on the blocking results.

6. An electronic device, characterized in that, include: processor; a memory for storing processor-executable instructions; The processor is configured to invoke instructions stored in the memory to execute the method according to any one of claims 1 to 4.

7. A computer-readable storage medium having computer program instructions stored thereon, characterized in that, When the computer program instructions are executed by the processor, they implement the method described in any one of claims 1 to 4.

Images