Simulation network asset surveying and mapping poisoning defense system and method

Abstract

The invention discloses a simulation network asset surveying and mapping poisoning defense system and a simulation network asset surveying and mapping poisoning defense method. The system comprises a data acquisition module, a network request life cycle management module, an asset identification and intelligent forwarding module, a dynamic response generation module, a log module and a data display module. According to the method, high-simulation virtual assets are deployed and passively exposed to the Internet, so that asset surveying and mapping and illegal data collection behaviors of attackers are interfered. When an attacker carries out information collection, a large amount of invalid simulation asset data with various asset fingerprints is obtained, and the identification and analysis cost of the attacking early stage is obviously increased, so that real asset information is effectively confused, and the security of enterprise core assets is improved. By constructing a dynamic simulation asset system, active interference and misleading to attackers are realized, and a more efficient preposed defense barrier is established for enterprises.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a simulated network asset mapping and poisoning defense system and method. Background Art

[0002] The exposure of corporate internet assets is expanding exponentially, encompassing a wide range of forms, including web applications, APIs, cloud services, IoT devices, and third-party open source components. However, with the widespread adoption of cybersecurity asset discovery technology and the abuse of automated tools, attackers can quickly locate target corporate asset fingerprints using platforms like Shodan and Censys. They can also obtain relevant corporate data through dark web data transactions and sensitive information leaks on GitHub, building high-value attack chains.

[0003] Currently, cyber threat actors have developed a targeted attack model of "asset mapping, vulnerability mining, and data exploitation." On the one hand, they rapidly identify unpatched zero-day vulnerabilities and known vulnerable components in target assets by comparing CVE / NVD vulnerability libraries and Exploit-DB exploit code. On the other hand, they leverage data such as leaked account credentials and business logic flaws to launch targeted social engineering attacks and penetrate the supply chain. These attacks expose enterprises to multiple risks, including but not limited to the compromise of core business systems, the leakage of sensitive data assets, and damage to brand reputation.

[0004] It's worth noting that the traditional perimeter-based security model is showing signs of fatigue. The dynamic expansion of the attack surface, the increasing automation of vulnerability exploitation, and the decreasing cost of sniffing public network assets have made it difficult for enterprises to effectively respond solely through traditional honeypot defense mechanisms. Therefore, the industry urgently needs a poisoning technology that obfuscates virtual assets, hides real network assets, and makes it more difficult for attackers to detect and map them. Summary of the Invention

[0005] In order to solve the above problems, the present invention provides a simulated network asset mapping and poisoning defense system, which includes a data acquisition module, a network request lifecycle management module, an asset identification and intelligent forwarding module, a dynamic response generation module, a log module, and a data display module; The data acquisition module is used to collect relevant data information; the network request lifecycle management module is used to preprocess the network request information in the collected data and disguise it; the asset identification and intelligent forwarding module is used to identify and read the collected data, and input it into the routing queue after classification; the dynamic response generation module is used to obtain the data in the routing queue and the disguised network request information, perform real-time threat dynamic scoring, and generate corresponding dynamic pseudo-response data; the log module is used to record the full-link information and operation data in real time; the data display module is used to display the real-time threat score of the network request information, and draw a real-time information monitoring map based on the classified data in the routing queue and then display it in real time; it also includes a data storage module for storing collected data, processed data, generated pseudo-response data, threat intelligence, IP whitelist information and historical data information.

[0006] Furthermore, the relevant data information collected by the data collection module specifically includes: network simulation data, network request data, user fingerprint information, and image data; The network simulation data specifically includes: randomly generated messy data, Internet asset fingerprint feature data, and asset data, wherein the asset data includes: website title, website ICO, and Web API; The network request data includes: unique request identifier, network protocol and target domain name / port, request URL path, client User-Agent header, proxy link IP sequence, and request website JS file; The user fingerprint information includes: user agent IP, hardware configuration, and browser characteristics.

[0007] Furthermore, the log module specifically includes security logs, defense-in-depth logs, and threat intelligence logs; wherein the security log specifically includes: event codes, threat classifications, and attack characteristics.

[0008] Furthermore, the network request lifecycle management module pre-processes the network request information specifically by: utilizing traffic characteristics for modular processing, and disguising abnormal requests and normal business requests in the network requests in a consistent manner; wherein, the abnormal requests specifically include: scanning detection requests and brute force cracking requests.

[0009] Furthermore, the asset identification and intelligent forwarding module specifically identifies and classifies the collected data by building a multi-dimensional asset identification engine; Among them, the data classification categories specifically include: favicon, random_media_resource, random_js_resource, random_style_sheet_resource, collection$is_args$args, and random_error_page.

[0010] A simulated network asset mapping and poisoning defense method includes the following steps: S1. Obtain relevant data information and pre-process the obtained relevant data information before disguising it; S2. Classify and rewrite the disguised data information and input it into the corresponding routing queue for IP whitelist verification: When the IP whitelist verification passes, step S3 is executed; when the IP whitelist fails, an alarm interface is generated and returned to the client; S3. Generate random data for each routing queue and calculate threat scores for network requests. S4. Generate corresponding pseudo-response data based on the pre-processed disguised data and the threat score of the network request and output it.

[0011] Furthermore, the relevant data information in step S1 specifically includes: network simulation data, network request data, user fingerprint information, and image data; The network simulation data specifically includes: randomly generated messy data, Internet asset fingerprint feature data, and asset data, wherein the asset data includes: website title, website ICO, and Web API; The network request data includes: unique request identifier, network protocol and target domain name / port, request URL path, client User-Agent header, proxy link IP sequence, and requested website JS file; when an illegal request is detected, HttpServletResponse immediately sets a 500 status code, triggering the error handling chain: Construct a structured log object and execute step S3 in the log to load the simulation data. Use ObjectMapper for deep semantic obfuscation. JSON serialize the simulation data and dynamically generated obfuscated parameters, then inject tracking markers. This ultimately generates a pseudo-response output that is syntactically valid but semantically obfuscated. The structured log object includes secure random numbers, parameter fingerprint information, and a sensitive field filtering mechanism.

[0012] The user fingerprint information includes: user agent IP, hardware configuration, and browser characteristics; the user fingerprint information collection step is specifically: extracting the client browser fingerprint information based on the Web API, and asynchronously inputting it through the info parameter after Base64 encoding.

[0013] Furthermore, the random data generation in step S3 specifically includes: random icon generation, random simulation data generation; The random icon generation specifically includes the following steps: S3I-1. Initialize the configuration file: load the icon JSON configuration file; parse and store simulation data into the list payload; create a resource loading instance and encrypt the secure random number generator object; S3I-2. Generate a secure random index based on the favicon payload size; S3I-3 obtains the corresponding simulation icon path from the list payload based on the generated secure random index value and loads the icon; S3I-4. Encapsulate the generated icon and output it.

[0014] Furthermore, the random simulation data generation specifically includes the following steps: S3II-1. Set simulation goals and data requirements, and load historical samples; wherein the simulation goals and data requirements specifically include: attack surface coverage, event types, time span; S3II-2. Define system simulation parameters and generate corresponding entity information: The system simulation parameters include: number of simulation hosts, system roles, network topology, IP, MAC, system type, and port open status; the corresponding entity information includes: host, user, account, service, and file; S3II-3. Build event-driven and attack chain simulation: Generate behavioral events containing timestamps, execution subjects, and execution actions, and correlate the generated events. The generated behavioral events specifically include login events, process startups, file reads and writes, network connections, permission modifications, and vulnerability exploits. Perform multi-stage attacks on generated events based on a preset attack path, where each stage of events is dynamically generated based on the previous output results; S3II-4. Performing disturbance processing on the generated behavioral events and introducing behavioral randomness and abnormality; wherein the disturbance processing includes: time jitter, content replacement, and behavior insertion; S3II-5. Normalize the format of various behavioral events and output them after verification.

[0015] Furthermore, a display interface generation step is included: S5. A visualization chart is generated according to the generated pseudo-response data and the threat score, and is dynamically adjusted in real time according to the attack situation.

[0016] The present invention provides a simulated network asset mapping and poisoning defense system and method, which has the following beneficial effects: This invention disrupts attackers' asset mapping and illegal data collection efforts by deploying highly realistic virtual assets and passively exposing them to the internet. When attackers gather information, they acquire a large amount of invalid simulated asset data containing various asset fingerprints, significantly increasing the identification and analysis costs in the early stages of an attack. This effectively obfuscates real asset information and enhances the security of a company's core assets. By building a dynamic simulated asset system, attackers can be proactively disrupted and misled, establishing a more efficient, proactive defense barrier for enterprises. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the structures shown in these drawings without paying any creative work.

[0018] Figure 1 A flow chart of the method provided by the present invention; Figure 2 This is a schematic diagram of the alarm interface provided by the present invention. DETAILED DESCRIPTION

[0019] It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention.

[0020] The following describes the implementation method of the present invention in detail with reference to the accompanying drawings. The description only includes some embodiments, not all embodiments. For the purpose of clarity, representations and descriptions that are not related to the present invention are omitted in the drawings and descriptions.

[0021] In order to have a clearer understanding of the technical features, purposes and beneficial effects of the present invention, the technical solutions of the present invention are now described in detail below. Obviously, the implementation cases described are part of the embodiments of the present invention, not all of them, and should not be understood as limiting the scope of the implementation of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

[0022] This invention disrupts attackers' asset mapping and illegal data collection efforts by deploying highly realistic virtual assets and passively exposing them to the internet. When attackers gather information, they acquire a large amount of invalid simulated asset data containing various asset fingerprints, significantly increasing the identification and analysis costs in the early stages of an attack. This effectively obfuscates real asset information and enhances the security of a company's core assets. By building a dynamic simulated asset system, attackers can be proactively disrupted and misled, establishing a more efficient, proactive defense barrier for enterprises.

[0023] This invention provides a simulated network asset mapping and poisoning defense system, comprising a data acquisition module, a network request lifecycle management module, an asset identification and intelligent forwarding module, a dynamic response generation module, a logging module, and a data display module. This system utilizes a layered collaborative design concept, with high concealment, low resource consumption, and dynamic response as its core goals, and adopts a three-layer modular architecture. Each module is decoupled through lightweight middleware, significantly reducing backend service load while maintaining security protection capabilities, ensuring the system can maintain stable service capabilities even under large-scale attacks.

[0024] The data collection module is used to collect relevant data information. The relevant data information specifically includes: network simulation data, network request data, user fingerprint information, and image data. The network simulation data specifically includes: randomly generated random data, Internet asset fingerprint feature data, and asset data. The asset data includes: website title, website ICO, and WebAPI; the network request data includes: unique request identifier, network protocol and target domain name / port, request URL path, client User-Agent header, proxy link IP sequence, and requested website JS file; the user fingerprint information includes: user agent IP, hardware configuration, and browser characteristics.

[0025] The network request lifecycle management module preprocesses and disguises network request information within collected data. Based on a reverse proxy mechanism, all inbound requests to poisoned assets are uniformly preprocessed. Traffic feature fuzzing technology is used to achieve behavioral consistency between abnormal requests (such as scanning and brute force attacks) and normal business requests at the protocol layer, eliminating any discrepancies in their characteristics.

[0026] The asset identification and intelligent forwarding module identifies and reads collected data, classifies it, and then enters it into the routing queue. Customized based on NGINX, it utilizes a multi-dimensional asset fingerprinting engine (including HTTP header features, URI patterns, and certificate fingerprints) to achieve refined request classification and routing decisions. It employs a hybrid LRU+TTL caching algorithm, with hot asset rules resident in memory to reduce disk I / O consumption. The number of worker processes is dynamically adjusted based on the query per second (QPS), maintaining a CPU utilization threshold below 70%. Unix Domain Sockets enable seamless configuration updates to ensure service continuity.

[0027] The dynamic response generation module is used to retrieve data from the routing queue and disguised network request information, perform real-time threat dynamic scoring, and generate corresponding dynamic pseudo-response data. The response generation engine is built on a microservices architecture, combining a threat intelligence library with behavioral analysis models to dynamically generate pseudo-response data that conforms to business logic. It supports nested variables in multiple formats such as JSON / XML / HTML, injects decoy data such as fake database fields and false API endpoints, and automatically adjusts the randomness of response data based on the attack intensity to increase the cost of the attack.

[0028] The log module records all information and operational data in real time. It aggregates multi-source security data to the asset platform's public network defense interface in real time, building a comprehensive security analysis system encompassing real-time defense status monitoring, multi-dimensional attack traffic distribution maps, abnormal access source IP tracing analysis, and time-series attack situation prediction models.

[0029] Construct a RequestJsonNode request parsing unit through CollectionController and instantiate an ObjectNode object as a data container. Call the RequestJsonNode(request) method to deeply parse the HttpServletRequest and extract all network elements such as the request header, parameters, and cookies. Implement an abnormal attribute detection mechanism to automatically trigger the Base64 decoding verification module for requests containing sensitive fields such as "navigator".

[0030] The log module specifically includes: security log, using object mapper to implement multi-level data conversion: serializing the original request object into a JSON tree structure (logConfNode), extracting key attack features (crucialEntity) and performing XSS / injection attack feature filtering, and linking to the CVE vulnerability database for threat intelligence matching; specifically including: event coding, threat classification, and attack features.

[0031] Deep defense logs and building a full-link log tracking system: The original request data is converted to an intermediate log (asLog) through A.convertToJson(B), and the security event log is written to the encrypted log queue through log.debug(). A sensitive data erasure mechanism is implemented, and temporary log data in the memory is forcibly cleared in the finally code block.

[0032] Threat intelligence logs use a standardized threat coding system: E60-0002 corresponds to the "asset mapping attack" classification, dynamically generates attack path maps (eventRelatedAPIs), associates with the CVE vulnerability library to achieve attack scenario tracing, and finally generates a threat event log that complies with the ISO / IEC 27035 standard through writeValueAsString().

[0033] The data display module is used to display the real-time threat score of network request information, and draw a real-time information monitoring map based on the data in the classified routing queue and then display the output in real time.

[0034] It also includes a data storage module for storing collected data, processed data, generated pseudo-response data, threat intelligence, IP whitelist information, and historical data information.

[0035] The network request lifecycle management module pre-processes the network request information by using traffic characteristics for modular processing and disguising abnormal requests and normal business requests in the network requests in a consistent manner; wherein the abnormal requests specifically include scanning detection requests and brute force cracking requests.

[0036] The asset identification and intelligent forwarding module specifically identifies and classifies the collected data by building a multi-dimensional asset identification engine; among them, the data classification categories specifically include: favicon, random_media_resource, random_js_resource, random_style_sheet_resource, collection$is_args$args, and random_error_page.

[0037] like Figure 1 As shown, a simulated network asset mapping and poisoning defense method includes the following steps: S1 obtains relevant data information, and pre-processes the obtained relevant data information to disguise: wherein the relevant data information specifically includes: network simulation data, network request data, user fingerprint information, image data; The network simulation data specifically includes: randomly generated messy data, Internet asset fingerprint feature data, and asset data, wherein the asset data includes: website title, website ICO, and Web API; the network request data includes: unique request identifier, network protocol and target domain name / port, request URL path, client User-Agent header, proxy link IP sequence, and requested website JS file; user fingerprint information includes: user proxy IP, hardware configuration, and browser characteristics; the user fingerprint information collection steps are specifically as follows: extracting client browser fingerprint information based on the Web API, and asynchronously inputting it through the info parameter after Base64 encoding.

[0038] The specific steps for collecting proxy link IP sequences are as follows: the backend service associates and stores the above metadata with service logs and implements a dynamic parameter validation strategy: length threshold checks are performed on the User-Agent, X-Forwarded-For, and info parameters. If an abnormal parameter length is detected (possibly caused by client-side forgery or injection attacks), the parameter value is forcibly replaced with a fixed identifier string "parameter_length_exception".

[0039] S2. Classify and rewrite the disguised data information and input it into the corresponding routing queue for IP whitelist verification: when the IP whitelist verification passes, execute step S3; when the IP whitelist fails, generate an alarm interface and return it to the client. When it is detected that the source network environment of the user's access request is an unauthorized intranet address and the target domain name is not registered in the preset DNS whitelist, the system will automatically trigger the poisoning response strategy. If the MIME type of the request is a web resource (such as text / html), an alarm interface is generated in real time through the preset template engine and returned to the client. The alarm interface achieves accurate tracing of attack behavior and compliance warnings by dynamically injecting metadata information requested by the user.

[0040] The alarm interface contains elements such as Figure 2As shown: multi-language warnings (including bilingual interception statements in Chinese and English, clearly indicating the unauthorized nature and potential threats of access behavior; adapting to international access scenarios, strengthening the legal deterrent effect, and meeting the compliance notification needs of users in different regions), unique request identifiers (globally unique request tracking codes (such as 2d8b3a6245fee089f690699e4692cd7c8), associated with the back-end log system, supporting security teams to quickly locate attack contexts, assisting with forensics and behavioral analysis), intercepted domain names and URLs (clearly marking blocked domain names (such as sadaeing.faw .com.cn) and the complete request path to help users confirm the legitimacy of intercepted resources, while exposing abnormal subdomains or unauthorized interfaces that attackers attempt to access), user agent and timestamp (recording client browser fingerprints and interception time accurate to the second level, building attacker portraits, identifying automated tool features (such as crawler frameworks), and providing key data for time series analysis), legal statement terms (listing prohibited behavior types such as penetration testing and vulnerability scanning to meet compliance requirements, clarify legal boundaries, reduce the risk of misoperation, and form a psychological deterrent to curb further attack attempts).

[0041] S3. Generate random data for the data in each routing queue and calculate the threat score for the network request: generate random icons and generate random simulation data.

[0042] The random icon generation specifically includes the following steps: S3I-1. Initialize the configuration file: load the icon's json configuration file through the PayloadFaviconDataLoader class; call the loadFromJsonFile() method to parse and store the simulation data into the list payload; create a resource loading instance and encrypt the secure random number generation object; S3I-2. Generate a secure random index based on the favicon payload size; S3I-3. Based on the generated secure random index value, obtain the corresponding simulation icon path from the list payload and load the icon; S3I-4. Encapsulate the generated icon and output it.

[0043] Random simulation data generation, combined with request metadata, behavior templates, and attack chain logic, achieves blocking from high-level semantics to low-level attack behaviors and ensures contextual continuity and logical consistency of simulation data. Specifically, the following steps are included: S3II-1. Set simulation goals and data requirements, and load historical samples; wherein the simulation goals and data requirements specifically include: attack surface coverage, event types, time span; S3II-2 define system simulation parameters and generate corresponding entity information: the system simulation parameters include: the number of simulation hosts, system roles, network topology, IP, MAC, system type, port open status; the corresponding entity information includes: host, user, account, service, file; S3II-3. Build event-driven and attack chain simulation: Generate behavioral events containing timestamps, execution subjects, and execution actions, and correlate them. Specifically, generated behavioral events include login events, process launches, file reads and writes, network connections, permission modifications, and vulnerability exploits. Perform multi-stage attacks on generated events based on a preset attack path, where each stage of events is dynamically generated based on the previous output results; S3II-4. Performing disturbance processing on the generated behavioral events and introducing behavioral randomness and abnormality; wherein the disturbance processing includes: time jitter, content replacement, and behavior insertion; S3II-5. Normalize the format of various behavioral events and output them after verification.

[0044] When generating simulation data in step S3, a multi-source simulation data dynamic loading mechanism is adopted, and a three-layer data loading architecture of ResourceLoader is designed: static configuration files preset basic response templates; obfuscation parameters are dynamically generated at runtime; and external data sources are used to inject real-time threat intelligence.

[0045] S4. Generate the corresponding protection strategy based on the pre-processed disguised data and the threat score of the network request and output it.

[0046] For the client's JS link request processing steps: the client HTTP request enters the RandomJavaScriptResourceController controller, and the randomJavaScriptResource method processing entry is triggered through the preset routing rules; the MIME type is set: response.setContentType("application / javascript;charset=UTF-8") to strictly limit the response body to the UTF-8 encoded JavaScript format to prevent content sniffing attacks; establish a cache suppression strategy; generate a comment identifier that complies with the ECMAScript specification: / * random_js_resource * / ; adopt a minimized content output strategy to avoid exposing business logic fingerprints while maintaining grammatical validity; inject the generated content into the HTTP response body through a controlled output stream to complete the request-response life cycle.

[0047] The cache suppression strategies include: Pragma: no-cache is backward compatible with HTTP / 1.0 cache control; Cache-Control: no-cache forces each request to be verified with the origin server; Expires: 0 sets an absolute expiration timestamp to ensure that the client's cache is immediately invalidated.

[0048] When an error is detected in a client request: When an illegal request is detected, HttpServletResponse immediately sets the 500 status code (SC_INTERNAL_SERVER_ERROR). This status code was chosen based on threat modeling analysis to effectively prevent attackers from using HTTP status codes to fingerprint the system and trigger the error handling chain: Construct a structured log object and execute step S3 in the log to load the simulation data. Use ObjectMapper for deep semantic obfuscation. JSON serialize the simulation data and dynamically generated obfuscated parameters, then inject tracking markers. This ultimately generates a pseudo-response output that is syntactically valid but semantically obfuscated. The structured log object includes secure random numbers, parameter fingerprint information, and a sensitive field filtering mechanism.

[0049] ObjectNode is used to construct structured log objects, integrating the following security elements: dynamic injection of secure random numbers (generated using SecureRandom instances); request parameter fingerprint extraction (reverse cleaning via request.getParameter()); and a sensitive field filtering mechanism (sensitive information is desensitized via finalC.remove("asLog")). Multi-dimensional data simulation is implemented through the ResourceLoader class: the errorPlainPayload dataset is dynamically loaded from a JSON configuration file; a weighted random algorithm is applied to generate an unpredictable response content index within the payload.size range; and a cryptographically secure random number generator (CSPRNG) is used to ensure the unpredictability of index values.

[0050] Use ObjectMapper for deep semantic obfuscation: Serialize the simulated data and dynamically generated obfuscated parameters into JSON, inject behavior tracking markers through customJsonLog.setEvent(), and finally generate syntactically valid but semantically obfuscated response content.

[0051] The method also includes a display interface generation step: S5. Generate a visualization chart based on the generated pseudo-response data and the threat score, and make real-time dynamic adjustments based on the attack situation.

[0052] The page language is dynamically set through the $pageHtmlLang random language variable to support multi-language environment adaptation. Meta tags (such as character encoding, viewport, browser compatibility, SEO description, keywords, etc.) are all injected through variables (such as ${pageHtmlHeadMetaCharset}) to achieve dynamic generation and flexible configuration of meta information.

[0053] External CSS files are loaded cyclically through the pageHtmlHeadLinks variable (th:each instruction), supporting the introduction of multiple style sheets on demand; inline CSS styles are dynamically inserted through the pageHtmlHeadStyles variable, allowing flexible injection of key style code snippets.

[0054] External scripts are dynamically loaded through the pageHtmlBodyScriptLinks variable, decoupling the script path from the template logic; inline scripts are injected through the pageHtmlBodyScripts variable, supporting dynamic adjustment of script logic at runtime.

[0055] The th:utext directive is used to render the randomHtmlContent and pageHtmlBodyContent variables, allowing for direct insertion of raw HTML content (such as alerts and dynamic components). The independent module pageHtmlICPNumberContent displays ICP filing information, ensuring compliance with regulatory requirements. Thymeleaf's th:block tag organizes logical blocks, maintaining a clear HTML structure while enabling looping and conditional rendering.

[0056] The foregoing description is merely a preferred embodiment of the present invention. It should be understood that the present invention is not limited to the form disclosed herein and should not be construed as excluding other embodiments. Rather, the present invention can be used in various other combinations, modifications, and environments and can be modified within the scope of the concept described herein through the above teachings or techniques or knowledge in the relevant field. Modifications and variations made by those skilled in the art that do not depart from the spirit and scope of the present invention are intended to be protected by the appended claims.

Claims

1. A simulated network asset mapping and poisoning defense system, characterized in that: It includes data collection module, network request lifecycle management module, asset identification and intelligent forwarding module, dynamic response generation module, log module, and data display module; The data acquisition module is used to collect relevant data information; The network request lifecycle management module is used to pre-process the network request information in the collected data and disguise it; The asset identification and intelligent forwarding module is used to identify and read the collected data, and input it into the routing queue after classification; The dynamic response generation module is used to obtain the data in the routing queue and the disguised network request information, perform real-time threat dynamic scoring, and generate corresponding dynamic pseudo-response data; The log module is used to record the entire link information and operation data in real time; The data display module is used to display the real-time threat score of network request information, and draw a real-time information monitoring map based on the data in the classified routing queue and then display the output in real time; It also includes a data storage module for storing collected data, processed data, generated pseudo-response data, threat intelligence, IP whitelist information, and historical data information.

2. The simulated network asset mapping and poisoning defense system according to claim 1 is characterized in that: The relevant data information collected by the data collection module specifically includes: network simulation data, network request data, user fingerprint information, and image data; The network simulation data specifically includes: randomly generated messy data, Internet asset fingerprint feature data, and asset data, wherein the asset data includes: website title, website ICO, and Web API; The network request data includes: unique request identifier, network protocol and target domain name / port, request URL path, client User-Agent header, proxy link IP sequence, and request website JS file; The user fingerprint information includes: user agent IP, hardware configuration, and browser characteristics.

3. The simulated network asset mapping and poisoning defense system according to claim 1 is characterized in that: The log module specifically includes security logs, in-depth defense logs, and threat intelligence logs; wherein, the security log specifically includes: event codes, threat classifications, and attack characteristics.

4. The simulated network asset mapping and poisoning defense system according to claim 1 is characterized in that: The network request lifecycle management module pre-processes the network request information by using traffic characteristics for modular processing and disguising abnormal requests and normal business requests in the network requests in a consistent manner; wherein the abnormal requests specifically include scanning and detection requests and brute force cracking requests.

5. The simulated network asset mapping and poisoning defense system according to claim 1 is characterized in that: The asset identification and intelligent forwarding module specifically identifies and classifies the collected data by building a multi-dimensional asset identification engine; Among them, the data classification categories specifically include: favicon, random_media_resource, random_js_resource, random_style_sheet_resource, collection$is_args$args, and random_error_page.

6. A simulated network asset mapping and poisoning defense method, based on the simulated network asset mapping and poisoning defense system according to any one of claims 1 to 5, characterized in that: The following steps are involved: S1. Obtain relevant data information and pre-process the obtained relevant data information before disguising it; S2. Classify and rewrite the disguised data information and input it into the corresponding routing queue for IP whitelist verification: When the IP whitelist verification passes, step S3 is executed; when the IP whitelist fails, an alarm interface is generated and returned to the client; S3. Generate random data for each routing queue and calculate threat scores for network requests. S4. Generate corresponding pseudo-response data based on the pre-processed disguised data and the threat score of the network request and output it.

7. The method for defending against poisoning of simulated network assets according to claim 6, characterized in that: The relevant data information in step S1 specifically includes: network simulation data, network request data, user fingerprint information, and image data; The network simulation data specifically includes: randomly generated messy data, Internet asset fingerprint feature data, and asset data, wherein the asset data includes: website title, website ICO, and Web API; The network request data includes: unique request identifier, network protocol and target domain name / port, request URL path, client User-Agent header, proxy link IP sequence, and request website JS file; The user fingerprint information includes: user agent IP, hardware configuration, and browser characteristics; the user fingerprint information collection step is specifically: extracting the client browser fingerprint information based on the Web API, and asynchronously inputting it through the info parameter after Base64 encoding.

8. The method for defending against poisoning of simulated network assets according to claim 6, characterized in that: The random data generation in step S3 specifically includes: random icon generation and random simulation data generation; The random icon generation specifically includes the following steps: S3I-1. Initialize the configuration file: load the icon JSON configuration file; parse and store simulation data into the list payload; create a resource loading instance and encrypt the secure random number generator object; S3I-2. Generate a secure random index based on the favicon payload size; S3I-3 obtains the corresponding simulation icon path from the list payload based on the generated secure random index value and loads the icon; S3I-4. Encapsulate the generated icon and output it.

9. The simulated network asset mapping poisoning defense method according to claim 8, characterized in that: The random simulation data generation specifically includes the following steps: S3II-1. Set simulation goals and data requirements, and load historical samples; wherein the simulation goals and data requirements specifically include: attack surface coverage, event types, time span; S3II-2. Define system simulation parameters and generate corresponding entity information: The system simulation parameters include: number of simulation hosts, system roles, network topology, IP, MAC, system type, and port open status; the corresponding entity information includes: host, user, account, service, and file; S3II-3. Build event-driven and attack chain simulation: Generate behavioral events containing timestamps, execution subjects, and execution actions, and correlate the generated events. The generated behavioral events specifically include login events, process startups, file reads and writes, network connections, permission modifications, and vulnerability exploits. Perform multi-stage attacks on generated events based on a preset attack path, where each stage of events is dynamically generated based on the previous output results; S3II-4. Performing disturbance processing on the generated behavioral events and introducing behavioral randomness and abnormality; wherein the disturbance processing includes: time jitter, content replacement, and behavior insertion; S3II-5. Normalize the format of various behavioral events and output them after verification.

10. The simulated network asset mapping poisoning defense method according to claim 6, characterized in that: The method also includes a display interface generation step: S5. Generate a visualization chart based on the generated pseudo-response data and the threat score, and make real-time dynamic adjustments based on the attack situation.

Images