Defense strategy recommendation system and method

Abstract

The invention discloses a defense strategy recommendation system and method, relates to the technical field of network security, and aims to solve the problem that an oil and gas pipe network is attacked and invaded, so that the security of the oil and gas pipe network is relatively low. Comprising a trapping module which is used for creating a virtual environment by adopting a Docker virtual technology, setting trapping nodes and obtaining a running log according to the trapping nodes; the machine learning module is used for establishing a defense strategy for a real attack sent by an attacker according to the running log; the machine learning module comprises an intelligent analysis unit and a game unit; the intelligent analysis unit is used for adopting a random forest model of machine learning according to the running log to distinguish real attacks and system misinformation of attackers; the game unit is used for extracting features in real attacks, calculating attack indexes based on the features and establishing defense strategies according to the attack indexes; and the defense module is used for adjusting the defense strategy and sending out a corresponding alarm according to the adjusted defense strategy.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a defense strategy recommendation system and method. Background Art

[0002] With the rapid development of information technology, the threats to oil and gas pipeline network security are becoming increasingly complex. Attacks targeting oil and gas pipeline networks encompass not only traditional malware, viruses, and phishing attacks, but also more subtle and complex methods. These attacks are often highly concealed and persistent, making existing security measures difficult to effectively identify and prevent. Therefore, intelligent, automated, and real-time network security defense systems are crucial for ensuring network security. However, in actual application, network security defense systems suffer from false alarms and incomplete defense strategies. These issues lead to attacks and intrusions into oil and gas pipeline networks, compromising network security. Summary of the Invention

[0003] The purpose of this application is to provide a defense strategy recommendation system and method, which aims to solve the problem of low security of oil and gas pipeline networks caused by attacks and invasions.

[0004] To achieve the above objectives, this application adopts the following technical solutions:

[0005] In a first aspect, the present application provides a defense strategy recommendation system, comprising: a trapping module, a machine learning module, and a defense module, wherein the machine learning module comprises: an intelligent analysis unit and a game unit;

[0006] The trapping module is used to create a virtual environment using Docker virtual technology, set up trapping nodes, and obtain operation logs based on the trapping nodes;

[0007] A machine learning module is used to establish defense strategies for real attacks launched by attackers based on operation logs;

[0008] An intelligent analysis unit, which uses a machine learning random forest model based on operation logs to distinguish between real attacks and false alarms.

[0009] The game unit is used to extract features from real attacks, calculate the attack index based on the features, and establish a defense strategy based on the attack index;

[0010] The defense module is used to adjust the defense strategy and issue corresponding alarms based on the adjusted defense strategy.

[0011] In some embodiments, the trapping module includes: a simulation unit, a monitoring unit, and a storage unit;

[0012] A simulation unit, used to create a virtual environment, configure network services and industrial control protocols, and deploy decoy nodes based on the virtual environment;

[0013] The simulation unit is further used to set a honeypot on the trapping node. The honeypot includes: an environment file tank, an environment directory tank and a network service tank. The environment file tank and the environment directory tank are established based on the network service tank. The environment directory tank is used to expand the environment file tank.

[0014] Monitoring unit, used to monitor the status and performance of the honeypot and record operating data;

[0015] The storage unit is used to store the operation data of the honeypot and obtain the operation log.

[0016] In some embodiments, a machine learning random forest model is used based on the operation log to distinguish between real attacks by attackers and false alarms by the system, including:

[0017] Based on the following formula, a machine learning random forest model is used based on the operation logs to distinguish between real attacks and false alarms.

[0018]

[0019] Among them, x represents the leaf node sample, P t (y=+1|x) represents the probability of a true attack on the leaf node sample x of each decision tree, P t (y=-1|x) represents the probability of each decision tree misreporting the sample x at the leaf node, N t Represented as the total number of samples of the decision tree, Indicates the number of samples of leaf nodes that belong to real attacks, represents the number of samples of leaf nodes that are false positives of the system, λ1 represents the smoothing parameter of real attacks, λ2 represents the smoothing parameter of false positives of the system, and λ1+λ2=1.5, P(y|x) represents the probability of the decision tree, T represents the number of decision trees in the random forest, t represents any decision tree, and θ represents the set probability threshold. Represents the classification label, A represents a real attack, and B represents a false alarm of the system.

[0020] In some embodiments, extracting features from real attacks, calculating an attack index based on the features, and establishing a defense strategy based on the attack index include:

[0021] Extract the attack rate, attack time, attack frequency, attack consumption resources and damage degree in real attacks to calculate the attack index;

[0022] Expand the data capacity of honeypots that have been subjected to real attacks and isolate honeypots that have not been subjected to real attacks;

[0023] Establish a defense strategy based on the attack index.

[0024] In some embodiments, the attack rate, attack time, attack frequency, attack resource consumption, and damage level of a real attack are extracted to calculate an attack index, including:

[0025] Based on the following formula, the attack index is calculated;

[0026]

[0027] Among them, I represents the attack index, R represents the attack rate, T represents the attack time, S represents the attack intensity, F represents the attack frequency, G represents the attack consumption resources, and D represents the damage degree.

[0028] In some embodiments, establishing a defense strategy based on the attack index includes:

[0029] Set an attack index greater than or equal to 30 as a first-level defense strategy factor;

[0030] Set the attack index greater than or equal to 20 and less than 30 as the secondary defense strategy factor;

[0031] An attack index greater than or equal to 0 and less than 20 is set as a third-level defense strategy factor.

[0032] In some embodiments, the defense module includes: a policy adjustment unit;

[0033] Adjust your defense strategy, including:

[0034] A strategy adjustment unit is used to establish a historical defense strategy set based on the historical defense strategy, and pre-process the historical defense strategy set to obtain a target set;

[0035] The strategy adjustment unit is also used to extract the defense strategy factor based on the target set, and multiply the defense strategy factor with the first-level defense strategy factor, the second-level defense strategy factor, and the third-level defense strategy factor respectively to obtain the first-level defense strategy feature corresponding to the first-level defense strategy factor, the second-level defense strategy feature corresponding to the second-level defense strategy factor, and the third-level defense strategy feature corresponding to the third-level defense strategy factor.

[0036] In some embodiments, extracting a defense strategy factor based on a target set includes:

[0037] Based on the following formula, the defense strategy factor is extracted according to the target set;

[0038]

[0039] Where Q represents the defense strategy factor, M represents the success rate of the defense strategy in the historical defense strategy set, N represents the number of successful implementations of the defense strategy in the historical defense strategy set, and K represents the number of failed implementations of the defense strategy in the historical defense strategy set.

[0040] In some embodiments, the defense module further comprises: an alarm unit;

[0041] Issue corresponding alerts based on the adjusted defense strategy, including:

[0042] An alarm unit, used to issue a first-level alarm based on the first-level defense strategy characteristics;

[0043] The alarm unit is also used to issue a secondary alarm based on the secondary defense strategy characteristics;

[0044] The alarm unit is also used to issue a three-level alarm according to the three-level defense strategy characteristics;

[0045] Among them, the urgency of level one alert, level two alert and level three alert decreases in sequence.

[0046] The defense strategy recommendation system provided by the embodiments of the present application uses a trapping module that creates a virtual environment and deploys honeypots to simulate real-world network scenarios, capturing attackers' attack behaviors and gaining a comprehensive understanding of their techniques and paths, thus forming the first line of defense. The machine learning module establishes defense strategies and alerts, providing progressive protection measures to effectively block attacks of varying severity. Through machine learning algorithms, it can accurately distinguish between real attacks and system false alarms, reducing the false alarm rate and effectively minimizing the waste of network security resources. Furthermore, the machine learning module develops targeted defense strategies based on real attacks, improving adaptability and flexibility in responding to different attacks. The defense module can adjust defense strategies to reduce latency and respond to new threats, reducing manual intervention and reliance on human involvement, saving costs, and improving response efficiency. The alignment of alerts and defense strategies allows for prioritizing high-urgency alerts, thereby reducing response time to high-powered incidents and focusing limited resources on high-priority attacks. This prevents users from treating all alerts the same way, leading to wasted resources and overlooking high-powered incidents.

[0047] In a second aspect, the present application provides a defense strategy recommendation method, which is applied to a defense strategy recommendation system. The defense strategy recommendation method includes:

[0048] Use Docker virtual technology to create a virtual environment, set up decoy nodes, and obtain operation logs based on the decoy nodes;

[0049] Establish defense strategies for real attacks launched by attackers based on operation logs;

[0050] Use a machine learning random forest model based on operation logs to distinguish between real attacks and false alarms.

[0051] Extract features from real attacks, calculate attack indexes based on the features, and establish defense strategies based on the attack indexes;

[0052] Adjust the defense strategy and issue corresponding alerts based on the adjusted defense strategy.

[0053] In a third aspect, the present application provides a defense strategy recommendation device, comprising: a processor and a memory; wherein the memory is used to store one or more programs, and the one or more programs include computer execution instructions. When the defense strategy recommendation device is running, the processor executes the computer execution instructions stored in the memory to enable the defense strategy recommendation device to perform the defense strategy recommendation method of the second aspect.

[0054] The defense strategy recommendation device can be a network device (electronic device) or a component within a network device, such as a system-on-chip (SoC) within the network device. The SoC is used to support the network device in implementing the functions described in any of the above-mentioned possible implementations, such as data collection, processing, correction, prediction, or early warning. The SoC includes a chip, but may also include other discrete components or circuit structures.

[0055] In a fourth aspect, the present application provides a computer-readable storage medium. When the computer-executable instructions stored in the computer-readable storage medium are executed by a processor of a defense strategy recommendation device, the defense strategy recommendation device can execute the defense strategy recommendation method of the second aspect.

[0056] In a fifth aspect, the present application provides a computer program product, which includes: a computer program or instructions, which, when the computer program or instructions are run on a computer, enables the computer to execute the defense strategy recommendation method of the second aspect.

[0057] It should be noted that the aforementioned computer program or instructions may be stored in whole or in part on a computer-readable storage medium. The computer-readable storage medium may be packaged together with the processor of the defense strategy recommendation device, or may be packaged separately from the processor of the defense strategy recommendation device, and this is not limited in this embodiment of the present application.

[0058] The description of the second, third, fourth and fifth aspects of this application can refer to the detailed description of the first aspect. BRIEF DESCRIPTION OF THE DRAWINGS

[0059] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0060] Figure 1 A schematic diagram of the structure of a defense strategy recommendation system provided in an embodiment of the present application;

[0061] Figure 2 A flowchart of a defense strategy recommendation method provided in an embodiment of the present application;

[0062] Figure 3 A schematic diagram of the structure of a defense strategy recommendation device provided in an embodiment of the present application;

[0063] Figure 4 A schematic diagram of the structure of a defense strategy recommendation device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0064] The following will be combined with the drawings in the embodiments of this application to clearly and completely describe the technical solutions in the embodiments of this application. Obviously, the embodiments described are only part of the embodiments of this application, not all of the embodiments. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of this application.

[0065] In the description of this application, it should be understood that the terms "first" and "second" are used for descriptive purposes only and should not be understood to indicate or imply relative importance or implicitly specify the number of the technical features indicated. Therefore, a feature specified as "first" or "second" may explicitly or implicitly include one or more of the features. In the description of this application, unless otherwise specified, "plurality" means two or more.

[0066] In the embodiments of the present application, the terms "comprises," "comprising," or any other variations thereof are intended to encompass non-exclusive inclusion, such that a process, article, or device comprising a series of elements includes not only those elements but also other elements not explicitly listed, or elements inherent to such process, article, or device. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not preclude the presence of other identical elements in the process, article, or device comprising the element.

[0067] In the embodiments of this application, words such as "exemplary" or "for example" are used to indicate examples, illustrations, or descriptions. Any embodiment or design described as "exemplary" or "for example" in the embodiments of this application should not be interpreted as being preferred or advantageous over other embodiments or designs. Rather, the use of words such as "exemplary" or "for example" is intended to present the relevant concepts in a concrete manner.

[0068] Exemplary embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although exemplary embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be limited by the embodiments set forth herein. On the contrary, these embodiments are provided to enable a more thorough understanding of the present disclosure and to fully convey the scope of the present disclosure to those skilled in the art. It should be noted that, unless there is a conflict, the embodiments in this application and the features described in the embodiments may be combined with each other. The present application will be described in detail below with reference to the accompanying drawings and in conjunction with the embodiments.

[0069] In actual application development, network security defense systems for oil and gas pipeline networks suffer from false alarms and imperfect defense strategies. A false alarm occurs when the defense system mistakenly identifies a normal operation or event as an attack. This not only impacts the efficiency of operations and maintenance users but also wastes resources. For example, excessive false alarms force administrators to conduct frequent checks and analyses, increasing management costs and potentially missing real attacks amidst a flood of irrelevant alarms, thereby reducing the overall effectiveness of the system. Another issue is the imperfect nature of defense strategies. Cyberattacks are constantly evolving, while existing defense strategies often rely on fixed rules, making them slow to respond to rapidly changing attacks and leading to defense failures. Furthermore, the alarm mechanisms of traditional systems are overly simplistic and lack granularity. Users blindly invest resources in response to varying levels of alarms, resulting in wasted network resources, increased chances of successful attacks, and compromised security protection effectiveness.

[0070] To address this issue, the present application provides a defense strategy recommendation system. The trapping module simulates real-world network scenarios by creating a virtual environment and deploying honeypots to capture attackers' attack behaviors, providing a comprehensive understanding of their techniques and paths, and forming the first line of defense. The machine learning module establishes defense strategies and alerts, providing progressive protection measures to effectively block attacks of varying severity. Through machine learning algorithms, it can accurately distinguish between real attacks and system false alarms, reducing false alarm rates and effectively minimizing the waste of network security resources. Furthermore, the machine learning module develops targeted defense strategies based on real attacks, improving adaptability and flexibility in responding to different attacks. The defense module can adjust defense strategies to reduce latency and respond to new threats, reducing manual intervention and reliance on human involvement, saving costs, and improving response efficiency. The alignment of alerts and defense strategies prioritizes alerts with high urgency, thereby reducing response time to high-powered incidents and focusing limited resources on high-priority attacks. This prevents users from treating all alerts the same way, resulting in wasted resources and overlooking high-powered incidents.

[0071] The defense strategy recommendation system provided in the embodiment of the present application is described in detail below in conjunction with the accompanying drawings. The defense strategy recommendation system provided in the embodiment of the present application can be applied to oil and gas pipeline systems, and of course can also be applied to other equipment or systems, and this application does not impose any restrictions on this.

[0072] This application embodiment provides a defense strategy recommendation system, such as Figure 1 As shown, the defense strategy recommendation system includes: a trapping module 101, a machine learning module 102 and a defense module 103, and the machine learning module 102 includes: an intelligent analysis unit 1021 and a game unit 1022.

[0073] The trapping module 101 is used to create a virtual environment using Docker virtual technology, set up a trapping node, and obtain an operation log based on the trapping node;

[0074] The machine learning module 102 is used to establish a defense strategy for real attacks launched by attackers based on the operation logs;

[0075] Intelligent analysis unit 1021, used to use a machine learning random forest model based on the operation log to distinguish between real attacks and system false alarms;

[0076] The game unit 1022 is used to extract features from real attacks, calculate attack indexes based on the features, and establish defense strategies based on the attack indexes;

[0077] The defense module 103 is used to adjust the defense strategy and issue corresponding alarms according to the adjusted defense strategy.

[0078] Specifically, the entrapment module 101, machine learning module 102, and defense module 103 collaborate to achieve a closed-loop process from threat perception to policy implementation. Entrapping module 101 uses Docker virtualization technology to create a virtual environment and set up entrapment nodes to lure attackers into attacking, convincing them they are in a real environment. It also monitors the attacker's behavior and generates logs, providing basic data for subsequent analysis. Machine learning module 102 utilizes machine learning algorithms to learn the characteristics of attack behavior from the entrapment module 101's logs and generate effective defense strategies.

[0079] The machine learning module 102 consists of two subunits: an intelligent analysis unit 1021 and a game unit 1022. The intelligent analysis unit 1021 uses machine learning algorithms to intelligently analyze the operation logs, identifying real attacks from attackers and false alarms. The game unit 1022 constructs effective defense strategies based on real attacks. The defense module 103 converts the defense strategies output by the machine learning module 102 into executable defense measures, adjusts the defense strategies in real time, and issues alerts to users. The top-down data flow between these three modules enhances the system's intelligence. By using machine learning to identify real attacks from attackers and adjust defense strategies in a timely manner, the system strengthens network security and reduces the cost of defending against network attacks.

[0080] It is understandable that by analyzing the operation logs through machine learning technology, the system can quickly identify the attacker's real attack, reducing the workload and subjective errors of human intervention analysis. By utilizing the adaptive characteristics of machine learning, the system can extract features from attack behaviors and establish defense strategies, enhancing the defense capabilities against unknown attacks. The game unit establishes defense strategies to respond to complex and constantly changing attack environments in real time and maintain the system's good defense. The intelligent analysis unit reduces the false alarm rate, effectively avoids the waste of network resources caused by false alarms, and improves the system's recognition accuracy.

[0081] In some embodiments, the trapping module 101 includes: a simulation unit 1011, a monitoring unit 1012, and a storage unit 1013;

[0082] The simulation unit 1011 is used to create a virtual environment, configure network services and industrial control protocols, and deploy decoy nodes according to the virtual environment;

[0083] The simulation unit 1011 is further configured to set a honeypot on the trapping node. The honeypot includes an environment file jar, an environment directory jar, and a network service jar. The environment file jar and the environment directory jar are established based on the network service jar. The environment directory jar is used to expand the environment file jar.

[0084] Monitoring unit 1012, for monitoring the status and performance of the honeypot and recording operating data;

[0085] The storage unit 1013 is used to store the operation data of the honeypot and obtain the operation log.

[0086] Specifically, the simulation unit 1011 uses Docker virtual technology to share the host machine's kernel and build a virtual mirror operating environment to simulate the real system environment. The simulation unit 1011 establishes a complete network topology structure, communication protocol and application services for the virtual environment, which enhances the authenticity of the virtual environment and induces attackers to launch attack operations.

[0087] The network protocols supported by the simulation unit 1011 are: Hypertext Transfer Protocol (HTTP), File Transfer Protocol (FTP) and Simple Mail Transfer Protocol (SMTP). HTTP is a stateless, application-layer network communication protocol used to transmit hypertext data between Web browsers and Web servers, supports communication between clients and servers, and transfers data through standard request and response methods.

[0088] FTP is a standard network protocol for transferring files between clients and servers, and is used to transfer files between different computers. SMT is a network protocol for email transmission, used to send and receive emails between mail server clients and define the rules for sending and forwarding emails.

[0089] The Simulation Unit 1011 supports not only civilian network protocols but also industrial control network protocols Modbus and DNP3. Modbus supports serial and Ethernet-based communication, allowing a single master to control one or more slaves. DNP3 is a communication protocol used in power systems and industrial control systems, supporting multi-point communication and time synchronization.

[0090] Simulation unit 1011 encompasses multiple communication protocols and establishes a robust network architecture, thereby enhancing the realism of the virtual environment. Simulation unit 1011 deploys decoy nodes based on the structure and scale of the virtual environment. These decoy nodes serve as entry points to attract attackers for attack. Decoy nodes are equipped with honeypots, which simulate real target assets. These honeypots also include an environment file jar, an environment directory jar, and a network service jar. The network service jar simulates specific network services within the real target asset, providing an interactive interface to attract attackers to attempt attacks. The environment file jar, built upon the network service jar, stores forged target asset files and data. File types and content are customized based on the simulated target asset. The environment directory jar organizes and manages the hierarchical structure of the environment file jar, simulating the actual directory structure to display the environment file jar or information and guide attackers deeper into the environment. The organic integration of the environment file jar, environment directory jar, and network service jar enables the simulation unit to accurately simulate and enhance the effectiveness of decoys.

[0091] It is understood that monitoring unit 1012 is responsible for real-time monitoring of the honeypot's operation and checking its operational status, including its service response speed and resource utilization. Another important task of monitoring unit 1012 is to record the honeypot's operational data, including the specific paths and steps an attacker accesses within the honeypot, as well as the commands and malicious code the attacker enters within the honeypot. Storage unit 1013 writes the operational data collected by monitoring unit 1012 to a storage device in real time to prevent data loss due to system failures. Storage unit 1013 compresses the operational data to generate a structured operational log for subsequent data analysis.

[0092] The simulation unit 1011 of the trapping module 101 establishes a virtual environment and supports multiple protocols, enabling it to attract different types of attacks and adapt to various attack scenarios. The real-time monitoring and data recording of the monitoring unit 1012 ensures a complete record of attack behavior, providing excellent input data for subsequent analysis. The storage unit 1013 ensures the security and integrity of the data. The three units work together to enhance the trapping effectiveness of the trapping module.

[0093] In some embodiments, a machine learning random forest model is used based on the operation log to distinguish between real attacks by attackers and false alarms by the system, including:

[0094] Based on the following formulas (Formula 1, Formula 2, Formula 3, and Formula 4), a machine learning random forest model is used based on the operation logs to distinguish between real attacks and false alarms.

[0095]

[0096] Among them, x represents the leaf node sample, P t(y=+1|x) represents the probability of a true attack on the leaf node sample x of each decision tree, P t (y=-1|x) represents the probability of each decision tree misreporting the sample x at the leaf node, N t Represented as the total number of samples of the decision tree, Indicates the number of samples of leaf nodes that belong to real attacks, represents the number of samples of leaf nodes that are false positives of the system, λ1 represents the smoothing parameter of real attacks, λ2 represents the smoothing parameter of false positives of the system, and λ1+λ2=1.5, P(y|x) represents the probability of the decision tree, T represents the number of decision trees in the random forest, t represents any decision tree, and θ represents the set probability threshold. Represents the classification label, A represents a real attack, and B represents a false alarm of the system.

[0097] It is understandable that the random forest model of machine learning is adopted. The random forest model is a model based on the comprehensive judgment of multiple decision trees. The classification label is calculated by the random forest model, and the system accurately distinguishes between real attacks and system false alarms, thereby improving the recognition accuracy of the system. The probability set for θ can be 0.7 (or 0.8, 0.6, etc.). If the probability of the decision tree is greater than the set probability, it is determined to be a real attack. The setting of the smoothing parameter avoids the number of category samples being too small, making the data rigorous and accurate. The intelligent analysis unit 1021 uses the operation log for real-time calculation to reduce the false alarm rate. When an attack occurs, the low false alarm rate enables the system to quickly identify and handle real attacks, shortening the response time from discovery to resolution, and does not require too many resources to be spent on processing false alarm verification.

[0098] In some embodiments, extracting features from real attacks, calculating an attack index based on the features, and establishing a defense strategy based on the attack index include:

[0099] Extract the attack rate, attack time, attack frequency, attack consumption resources and damage degree in real attacks to calculate the attack index;

[0100] Expand the data capacity of honeypots that have been subjected to real attacks and isolate honeypots that have not been subjected to real attacks;

[0101] Establish a defense strategy based on the attack index.

[0102] Specifically, the game unit 1022 extracts the characteristics of real attacks from the operation log: attack rate, attack time, attack frequency, attack resource consumption, and damage degree. Attack rate refers to the speed at which the attacker sends attack packets within an hour; attack time is the duration of the attack, providing a basis for defense tracing; attack frequency is the interval between attack behaviors, which can determine whether the attacker is using periodic methods; attack resource consumption is the bandwidth consumed by the attacker when launching the attack, which can reveal the attacker's technical level; and damage degree is the extent of the attack's impact on the honeypot.

[0103] By extracting these core elements, the game unit 1022 can paint a comprehensive picture of real attacks, improving the system's awareness of potential threats and enabling effective network security management. After extracting these core elements, the game unit 1022 comprehensively calculates an attack index, a metric that measures the threat level and guides the development of subsequent defense strategies. The game unit 1022 dynamically adjusts the data capacity of honeypots that have been attacked. Upon identifying a specific honeypot as being under real attack, the game unit 1022 dynamically expands the data capacity of that honeypot. For example, if an environment file jar is attacked due to frequent access, its storage capacity will increase to accommodate more real attacks, inducing the attacker to increase their intensity and engage in prolonged attacks, consuming their resources and time. Simultaneously, honeypots that have not been attacked are isolated and suspended to improve resource utilization efficiency. The game unit establishes a defense strategy based on the attack index.

[0104] In some embodiments, the attack rate, attack time, attack frequency, attack resource consumption, and damage level of a real attack are extracted to calculate an attack index, including:

[0105] Based on the following formulas (Formula 5 and Formula 6), the attack index is calculated;

[0106]

[0107] Among them, I represents the attack index, R represents the attack rate, T represents the attack time, S represents the attack intensity, F represents the attack frequency, G represents the attack consumption resources, and D represents the damage degree.

[0108] It is understandable that the attack index formula (i.e., Formula 5) integrates multi-dimensional data of real attacks into a single indicator, quantitatively describing the severity of the attack, making it easier for the system to quickly judge the extent of the attack threat, and formulate targeted defense strategies based on the attack index, rationally allocating network security resources and enhancing the adaptability of the system.

[0109] In some embodiments, establishing a defense strategy based on the attack index includes:

[0110] Set an attack index greater than or equal to 30 as a first-level defense strategy factor;

[0111] Set the attack index greater than or equal to 20 and less than 30 as the secondary defense strategy factor;

[0112] An attack index greater than or equal to 0 and less than 20 is set as a third-level defense strategy factor.

[0113] It should be noted that the above parameters such as 0, 20, and 30 can be determined according to specific scenarios, and the embodiments of this application are only described as exemplary parameters.

[0114] Specifically, the first-level defense strategy factor represents an attack with high intensity, high rate and long duration, which poses a serious threat to the honeypot; the second-level defense strategy factor represents a medium-threat attack with moderate attack power, which causes a certain degree of damage to the honeypot; the third-level defense strategy factor represents a low-threat attack, in which the attacker adopts a low-level scanning or probing threat, which causes less damage to the honeypot.

[0115] The first-level, second-level, and third-level defense strategy factors are used to deploy defenses accordingly. The first-level defense strategy factors block the attack source, protect the honeypot's core resources, and conduct in-depth analysis and tracing of attack activities. A blacklist mechanism is implemented for the attacker's IP address, domain name, and related resources to immediately block attack traffic from entering the honeypot, filter out abnormal traffic, and ensure the normal operation of the honeypot. At the same time, access control of the honeypot database and interfaces is strengthened, with verification and dynamic permission adjustment implemented. IDPS defense is deployed to comprehensively track the behavioral path of attack traffic and extract attack tools, commands, and communication characteristics.

[0116] The second-level defense strategy factor adopts a flow limiting strategy based on the attack type, limits the number of requests to the honeypot, changes the firewall rules, and takes access restrictions on network ports. The third-level defense strategy factor implements lightweight restrictions on suspicious access behaviors, increases request delays and dynamically adjusts the response content, adjusts resource allocation within a reasonable range, and avoids low-threat attacks that lead to degradation of honeypot performance.

[0117] It's understandable that setting multiple levels of defense strategy factors based on the attack index and implementing corresponding defenses ensures the rational allocation of network security resources. Differentiated response measures reduce overreactions to low-threat behaviors, lowering system resource investment and saving network resource security defense costs. Furthermore, the accumulation of data on low-threat behaviors provides a foundation for defense optimization, enhancing the system's intelligence and automation. The execution of defenses at each level of defense strategy factors is fed back to the system, forming an effective closed-loop security loop.

[0118] In some embodiments, the defense module 103 includes: a policy adjustment unit 1031;

[0119] Adjust your defense strategy, including:

[0120] The strategy adjustment unit 1031 is used to establish a historical defense strategy set based on the historical defense strategy, and pre-process the historical defense strategy set to obtain a target set;

[0121] The strategy adjustment unit 1031 is further configured to extract a defense strategy factor based on the target set, and multiply the defense strategy factor by the first-level defense strategy factor, the second-level defense strategy factor, and the third-level defense strategy factor, respectively, to obtain a first-level defense strategy feature corresponding to the first-level defense strategy factor, a second-level defense strategy feature corresponding to the second-level defense strategy factor, and a third-level defense strategy feature corresponding to the third-level defense strategy factor.

[0122] Specifically, the strategy adjustment unit 1031 is used to dynamically adjust the defense strategy factor based on historical defense strategies and the current threat landscape. Each historical defense strategy record in the historical defense strategy set contains the execution conditions and actual performance of the defense strategy. Because historical defense strategies contain irrelevant data, the strategy adjustment unit 1031 needs to preprocess the historical defense strategy set. This preprocessing includes removing irrelevant, erroneous, or invalid records.

[0123] The strategy adjustment unit 1031 establishes a complete target set through preprocessing, focusing on refining and analyzing historical defense strategies. The target set contains factors that affect the defense strategy factors, called defense strategy factors. The defense strategy factors are extracted based on the target set and cover comprehensive data of the target set. Comprehensive data support can reasonably adjust the defense strategy factors and ensure that each level of defense strategy factors can be dynamically adjusted according to the actual threat situation.

[0124] It can be understood that by extracting defense strategy factors and calculating defense strategy characteristics, defense module 103 can dynamically adjust defenses based on the current threat situation, enhancing the system's defense capabilities. Allocation based on defense strategy factors can effectively avoid resource waste. For example, in low-threat scenarios, defense module 103 will tend to adopt defenses with lower resource consumption. The historical defense strategy collection established by defense module 103 provides a solid data foundation for subsequent optimization, enabling continuous system improvement and enhancing long-term defense capabilities.

[0125] In some embodiments, extracting a defense strategy factor based on a target set includes:

[0126] Based on the following formulas (Formula 7 and Formula 8), the defense strategy factor is extracted according to the target set;

[0127]

[0128] Where Q represents the defense strategy factor, M represents the success rate of the defense strategy in the historical defense strategy set, N represents the number of successful implementations of the defense strategy in the historical defense strategy set, and K represents the number of failed implementations of the defense strategy in the historical defense strategy set.

[0129] The Defense Strategy Factor quantifies the effectiveness of the Defense Strategy Factor into a measurable and optimizable value, helping the system accurately assess the performance of the defenses implemented by the Defense Strategy Factor in the face of attacks. This allows for reasonable adjustments to the Defense Strategy Factor, ensuring that each defense decision is highly targeted and effective, thereby enhancing the system's defense capabilities.

[0130] In some embodiments, the defense module 103 further includes: an alarm unit 1032;

[0131] Issue corresponding alerts based on the adjusted defense strategy, including:

[0132] Alarm unit 1032, configured to issue a first-level alarm based on the first-level defense strategy characteristics;

[0133] The alarm unit 1032 is further configured to issue a second-level alarm based on the second-level defense strategy characteristics;

[0134] The alarm unit 1032 is further configured to issue a third-level alarm based on the characteristics of the third-level defense strategy;

[0135] Among them, the urgency of level one alert, level two alert and level three alert decreases in sequence.

[0136] Specifically, the alarm unit 1032 of the defense module 103 issues corresponding alarms based on the different levels of defense strategy characteristics, ensuring that the system can promptly and accurately notify users to prepare effective defenses. The defense strategy characteristics are graded based on the calculated attack index and the defense strategy factor. The corresponding alarm urgency varies based on the graded defense strategy characteristics, helping users take appropriate countermeasures based on their actual situation.

[0137] A Level 1 alert is triggered when an attack is at its most severe. Under this level of defense strategy, the defense module prioritizes the most effective defensive measures and immediately issues a Level 1 alert, prompting users to take urgent action to address the threat. A Level 2 alert, while less urgent than a Level 1 alert, indicates that the honeypot is facing a significant threat. The attack has already caused some damage or exposed a potential security vulnerability, requiring protective measures to prevent further spread. A Level 3 alert generally indicates a lesser threat, with minimal impact on the honeypot. In this case, the defense module, based on the Level 3 defense strategy, will implement relatively mild defensive measures and issue a Level 3 alert, alerting users to the attack.

[0138] As you can understand, the urgency of level 1, level 2, and level 3 alerts decreases in order. Level 1 is the most urgent, level 2 is the second most urgent, and level 3 is the least urgent. By grading alerts, users can prioritize high-urgency alerts, reducing response time for high-powered incidents and focusing limited resources on high-priority attacks. This prevents users from treating all alerts the same way, leading to wasted resources and overlooking high-powered incidents.

[0139] In summary, in the embodiments of the present application, the trapping module simulates real network scenarios by creating a virtual environment and deploying honeypots to capture the attacker's attack behavior, fully understand the attacker's technology and path, and form the first line of defense. The machine learning module establishes defense strategies and alarms, provides progressive protection measures, and effectively prevents attacks of different degrees. Through machine learning algorithms, it can accurately distinguish between real attacks and system false alarms, reduce the false alarm rate, and effectively reduce the waste of network security resources. The machine learning module formulates targeted defense strategies based on real attacks, improves the adaptability and flexibility of responding to different attacks, and the defense module can adjust the defense strategy to reduce delays and respond to new threats, reduce manual intervention, reduce dependence on human participation, save costs, and improve response efficiency. The correspondence between alarms and defense strategies can give priority to alarms with high urgency, thereby reducing the response time to events with strong attack power, focusing limited resources on high-priority attacks, and avoiding users taking the same approach to all alarms, resulting in waste of resources and high-attack events being ignored.

[0140] In some embodiments, the present application provides a defense strategy recommendation method, which is applied to a defense strategy recommendation system, such as Figure 2 As shown, the recommended defense strategy includes:

[0141] S201. Create a virtual environment using Docker virtual technology, set up a trapping node, and obtain a running log based on the trapping node.

[0142] In some embodiments, the above S201 may specifically include:

[0143] Create a virtual environment, configure network services and industrial control protocols, and deploy decoy nodes based on the virtual environment.

[0144] A honeypot is set up at the trapping node. The honeypot includes: an environment file jar, an environment directory jar and a network service jar. The environment file jar and the environment directory jar are established based on the network service jar, and the environment directory jar is used to expand the environment file jar.

[0145] Monitor the status and performance of the honeypot and record operational data.

[0146] Store the honeypot's operating data and generate operating logs.

[0147] S202: Establish a defense strategy for the real attack launched by the attacker based on the operation log.

[0148] S203. Use a machine learning random forest model based on the operation log to distinguish between real attacks by attackers and false alarms by the system.

[0149] In some embodiments, the above S203 may specifically include: based on the above formulas (Formula 1, Formula 2, Formula 3 and Formula 4), using a machine learning random forest model according to the operation log to distinguish between the attacker's real attack and the system false alarm.

[0150] S204: Extract features from real attacks, calculate attack indexes based on the features, and establish defense strategies based on the attack indexes.

[0151] In some embodiments, the above S204 may specifically include:

[0152] The attack rate, attack time, attack frequency, attack consumption resources and damage degree in real attacks are extracted to calculate the attack index.

[0153] Specifically, the attack index can be calculated based on the above formula 5 and formula 6.

[0154] Expand the data capacity of honeypots that have been subjected to real attacks and isolate honeypots that have not been subjected to real attacks.

[0155] Establish a defense strategy based on the attack index.

[0156] Specifically, a defense strategy is established based on the attack index, including:

[0157] An attack index greater than or equal to 30 is set as the first-level defense strategy factor.

[0158] An attack index greater than or equal to 20 and less than 30 is set as the secondary defense strategy factor.

[0159] An attack index greater than or equal to 0 and less than 20 is set as a third-level defense strategy factor.

[0160] S205: Adjust the defense strategy and issue a corresponding alarm based on the adjusted defense strategy.

[0161] Specifically, adjust the defense strategy, including:

[0162] A historical defense strategy set is established according to the historical defense strategy, and the historical defense strategy set is preprocessed to obtain a target set.

[0163] The defense strategy factor is extracted according to the target set, and the defense strategy factor is multiplied with the first-level defense strategy factor, the second-level defense strategy factor and the third-level defense strategy factor respectively to obtain the first-level defense strategy characteristics corresponding to the first-level defense strategy factor, the second-level defense strategy characteristics corresponding to the second-level defense strategy factor and the third-level defense strategy characteristics corresponding to the third-level defense strategy factor.

[0164] Specifically, extracting the defense strategy factor according to the target set includes: extracting the defense strategy factor according to the target set based on the above formula 7 and formula 8.

[0165] Specifically, corresponding alerts are issued based on the adjusted defense strategy, including:

[0166] A level one alarm is issued based on the level one defense strategy characteristics.

[0167] A second-level alarm is issued based on the characteristics of the second-level defense strategy.

[0168] A third-level alarm is issued based on the characteristics of the third-level defense strategy.

[0169] Among them, the urgency of level one alert, level two alert and level three alert decreases in sequence.

[0170] It's clear that establishing a virtual environment and capturing its operational logs effectively captured the attacker's attack behavior. Using machine learning algorithms based on these logs, a specific model distinguished between real attacks and false alarms, improving identification accuracy. Targeted defense strategies were then developed for confirmed attacks, enabling rapid response to these threats. Defense strategies were adjusted and, combined with alert mechanisms, alerts were issued to indicate the need for action, achieving efficient and precise network security defense.

[0171] The above mainly introduces the solution provided by the embodiment of the present application from the perspective of method. In order to realize the above functions, it includes hardware structures and / or software modules corresponding to the execution of each function. Those skilled in the art should easily appreciate that, in combination with the units and algorithm steps of each example described in the embodiments disclosed herein, the present application can be implemented in the form of hardware or a combination of hardware and computer software. Whether a function is executed in a hardware or computer software driven hardware manner depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0172] In the embodiments of the present application, the defense strategy recommendation device can be divided into functional modules according to the above-mentioned method examples. For example, each functional module can be divided according to each function, or two or more functions can be integrated into a single processing module. The above-mentioned integrated modules can be implemented in the form of hardware or software functional modules. Optionally, the module division in the embodiments of the present application is illustrative and is only a logical functional division. In actual implementation, other division methods may be used.

[0173] like Figure 3 , which is a structural diagram of a defense strategy recommendation device provided in an embodiment of the present application. Figure 3 The defense strategy recommendation device shown includes: a processing module 301 and an early warning module 302 .

[0174] The processing module 301 is configured to create a virtual environment using Docker virtual technology, set a decoy node, and obtain a running log according to the decoy node.

[0175] The processing module 301 is further configured to establish a defense strategy for the real attack launched by the attacker according to the operation log.

[0176] The processing module 301 is further configured to adopt a random forest model of machine learning based on the operation log to distinguish between real attacks by attackers and false alarms of the system.

[0177] The processing module 301 is further configured to extract features from real attacks, calculate attack indexes based on the features, and establish defense strategies according to the attack indexes.

[0178] The early warning module 302 is configured to adjust the defense strategy and issue a corresponding alarm according to the adjusted defense strategy.

[0179] Optionally, the processing module 301 is specifically configured to create a virtual environment, configure network services and industrial control protocols, and deploy decoy nodes according to the virtual environment.

[0180] The processing module 301 is specifically configured to set up a honeypot at the trapping node. The honeypot includes: an environment file jar, an environment directory jar and a network service jar. The environment file jar and the environment directory jar are established based on the network service jar, and the environment directory jar is used to expand the environment file jar.

[0181] The processing module 301 is specifically configured to monitor the status and performance of the honeypot and record operation data.

[0182] The processing module 301 is specifically configured to store the operation data of the honeypot and obtain the operation log.

[0183] Optionally, the processing module 301 is specifically configured to use a machine learning random forest model based on the above formulas (Formula 1, Formula 2, Formula 3 and Formula 4) according to the operation log to distinguish between the attacker's real attack and the system false alarm.

[0184] Optionally, the processing module 301 is specifically configured to extract the attack rate, attack time, attack frequency, attack consumption resources and damage degree in a real attack, and calculate an attack index.

[0185] The processing module 301 is specifically configured to expand the data capacity of the honeypots that have suffered real attacks and isolate the honeypots that have not suffered real attacks.

[0186] The processing module 301 is specifically configured to establish a defense strategy according to the attack index.

[0187] Optionally, the processing module 301 is specifically configured to calculate the attack index based on the above formula 5 and formula 6.

[0188] Optionally, the processing module 301 is specifically configured to set an attack index greater than or equal to 30 as a first-level defense strategy factor.

[0189] The processing module 301 is specifically configured to set an attack index greater than or equal to 20 and less than 30 as a secondary defense strategy factor.

[0190] The processing module 301 is specifically configured to set an attack index greater than or equal to 0 and less than 20 as a third-level defense strategy factor.

[0191] Optionally, the processing module 301 is specifically configured to establish a historical defense strategy set according to historical defense strategies, and pre-process the historical defense strategy set to obtain a target set.

[0192] The processing module 301 is specifically configured to extract a defense strategy factor based on the target set, and multiply the defense strategy factor with the first-level defense strategy factor, the second-level defense strategy factor, and the third-level defense strategy factor, respectively, to obtain the first-level defense strategy feature corresponding to the first-level defense strategy factor, the second-level defense strategy feature corresponding to the second-level defense strategy factor, and the third-level defense strategy feature corresponding to the third-level defense strategy factor.

[0193] Optionally, the processing module 301 is specifically configured to extract the defense strategy factor according to the target set based on the above formula 7 and formula 8.

[0194] Optionally, the processing module 301 is specifically configured to issue a first-level alarm according to the first-level defense strategy characteristics.

[0195] The processing module 301 is specifically configured to issue a level 2 alarm according to the level 2 defense strategy characteristics.

[0196] The processing module 301 is specifically configured to issue three-level alarms according to the three-level defense strategy characteristics; wherein the urgency of the first-level alarm, the second-level alarm and the third-level alarm decreases in sequence.

[0197] like Figure 4 FIG. 4 is a schematic diagram of a defense strategy recommendation device according to an embodiment of the present invention. The defense strategy recommendation device includes a processor 401, a memory 402, a communication interface 403, and a bus 404. The processor 401, the memory 402, and the communication interface 403 can be connected via a bus 404.

[0198] Processor 401 is the control center of the defense strategy recommendation device and can be a single processor or a collection of multiple processing elements. For example, processor 401 can be a general-purpose central processing unit (CPU) or other general-purpose processor. A general-purpose processor can be a microprocessor or any conventional processor.

[0199] As an embodiment, the processor 401 may include one or more CPUs, such as Figure 4 CPU 0 and CPU 1 are shown in Figure 1.

[0200] The memory 402 may be a read-only memory (ROM) or other type of static storage device that can store static information and instructions, a random access memory (RAM) or other type of dynamic storage device that can store information and instructions, an electrically erasable programmable read-only memory (EEPROM), a magnetic disk storage medium or other magnetic storage device, or any other medium that can be used to carry or store desired program code in the form of instructions or data structures and can be accessed by a computer, but is not limited thereto.

[0201] In one possible implementation, memory 402 may exist independently of processor 401 and may be connected to processor 401 via bus 404 to store instructions or program code. When processor 401 calls and executes the instructions or program code stored in memory 402, the defense strategy recommendation method provided in the following embodiments of this application can be implemented.

[0202] In another possible implementation, the memory 402 may also be integrated with the processor 401 .

[0203] The communication interface 403 is used to connect the defense strategy recommendation device to other devices via a communication network, which may be Ethernet, wireless access network, wireless local area network (WLAN), etc. The communication interface 403 may include a receiving unit for receiving data and a sending unit for sending data.

[0204] Bus 404 can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus. This bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 4 Only one thick line is used in the diagram, but this does not mean that there is only one bus or one type of bus.

[0205] It should be pointed out that Figure 4 The structure shown in the figure does not constitute a limitation on the recommended equipment for defense strategy, except Figure 4In addition to the components shown, the defense strategy recommendation device may include more or fewer components than shown, or combine certain components, or arrange the components differently.

[0206] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may take the form of a complete hardware embodiment, a complete software embodiment, or a combination of software and hardware embodiments. Furthermore, the present application may take the form of a computer program commodity implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0207] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems) and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 a process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0208] These computer program instructions may also be stored in a computer readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 a process or multiple processes and / or boxes Figure 1 The function specified in one or more boxes.

[0209] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing the instructions executed on the computer or other programmable device for implementing the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0210] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application and not to limit them. Although the present application has been described in detail with reference to the above embodiments, ordinary technicians in the relevant field should understand that the specific implementation methods of the present application can still be modified or replaced by equivalents. Any modification or equivalent replacement that does not depart from the spirit and scope of the present application should be included in the scope of protection of the claims of the present application.

[0211] The above are only specific embodiments of the present application, but the scope of protection of this application is not limited thereto. Any changes or substitutions that can be easily conceived by a person skilled in the art within the technical scope disclosed in this application should be included in the scope of protection of this application. Therefore, the scope of protection of this application should be based on the scope of protection of the claims.

Claims

1. A defense strategy recommendation system, characterized in that: include: A trapping module, a machine learning module, and a defense module, wherein the machine learning module includes an intelligent analysis unit and a game unit; The trapping module is used to create a virtual environment using Docker virtual technology, set a trapping node, and obtain an operation log based on the trapping node; The machine learning module is used to establish a defense strategy for real attacks launched by attackers based on the operation log; The intelligent analysis unit is configured to adopt a random forest model of machine learning based on the operation log to distinguish between the real attack of the attacker and a system false alarm; The game unit is configured to extract features from the real attack, calculate an attack index based on the features, and establish a defense strategy based on the attack index; The defense module is used to adjust the defense strategy and issue corresponding alarms according to the adjusted defense strategy.

2. The defense strategy recommendation system according to claim 1, characterized in that: The trapping module includes: a simulation unit, a monitoring unit and a storage unit; The simulation unit is used to create a virtual environment, configure network services and industrial control protocols, and deploy the decoy node according to the virtual environment; The simulation unit is further configured to set a honeypot on the trapping node, wherein the honeypot includes an environment file jar, an environment directory jar, and a network service jar, wherein the environment file jar and the environment directory jar are established based on the network service jar, and the environment directory jar is used to expand the environment file jar; The monitoring unit is used to monitor the status and performance of the honeypot and record operating data; The storage unit is used to store the operation data of the honeypot and obtain an operation log.

3. The defense strategy recommendation system according to claim 1, characterized in that: The adopting of a random forest model of machine learning based on the operation log to distinguish between the real attack of the attacker and the system false alarm includes: Based on the following formula, the random forest model of machine learning is adopted according to the operation log to distinguish the real attack of the attacker from the system false alarm; Among them, x represents the leaf node sample, P t (y=+1|x) represents the probability of a true attack on the leaf node sample x of each decision tree, P t (y=-1|x) represents the probability of each decision tree misreporting the sample x at the leaf node, N t Represented as the total number of samples of the decision tree, Indicates the number of samples of leaf nodes that belong to real attacks, represents the number of samples of leaf nodes that are false positives of the system, λ1 represents the smoothing parameter of real attacks, λ2 represents the smoothing parameter of false positives of the system, and λ1+λ2=1.5, P(y|x) represents the probability of the decision tree, T represents the number of decision trees in the random forest, t represents any decision tree, and θ represents the set probability threshold. Represents the classification label, A represents a real attack, and B represents a false alarm of the system.

4. The defense strategy recommendation system according to claim 2, characterized in that: The extracting features from the real attack, calculating an attack index based on the features, and establishing a defense strategy based on the attack index include: Extracting the attack rate, attack time, attack frequency, attack consumption resources and damage degree from the real attack, and calculating the attack index; Expanding the data capacity of the honeypots that have suffered the real attack, and isolating the honeypots that have not suffered the real attack; The defense strategy is established according to the attack index.

5. The defense strategy recommendation system according to claim 4, characterized in that: The extraction of the attack rate, attack time, attack frequency, attack consumption resources and damage degree in the real attack and calculation of the attack index include: The attack index is calculated based on the following formula: Among them, I represents the attack index, R represents the attack rate, T represents the attack time, S represents the attack intensity, F represents the attack frequency, G represents the attack consumption resources, and D represents the damage degree.

6. The defense strategy recommendation system according to claim 1, characterized in that: The establishing of the defense strategy according to the attack index includes: Setting the attack index greater than or equal to 30 as a first-level defense strategy factor; Setting the attack index greater than or equal to 20 and less than 30 as a secondary defense strategy factor; The attack index greater than or equal to 0 and less than 20 is set as the third-level defense strategy factor.

7. The defense strategy recommendation system according to claim 6, characterized in that: The defense module includes: a strategy adjustment unit; The adjusting the defense strategy includes: The strategy adjustment unit is used to establish a historical defense strategy set based on the historical defense strategy, and pre-process the historical defense strategy set to obtain a target set; The strategy adjustment unit is further used to extract a defense strategy factor based on the target set, and multiply the defense strategy factor with the first-level defense strategy factor, the second-level defense strategy factor, and the third-level defense strategy factor respectively to obtain the first-level defense strategy feature corresponding to the first-level defense strategy factor, the second-level defense strategy feature corresponding to the second-level defense strategy factor, and the third-level defense strategy feature corresponding to the third-level defense strategy factor.

8. The defense strategy recommendation system according to claim 7, characterized in that: Extracting the defense strategy factor according to the target set includes: Extracting a defense strategy factor based on the target set based on the following formula: Where Q represents the defense strategy factor, M represents the success rate of the defense strategy in the historical defense strategy set, N represents the number of successful implementations of the defense strategy in the historical defense strategy set, and K represents the number of failed implementations of the defense strategy in the historical defense strategy set.

9. The defense strategy recommendation system according to claim 7, characterized in that: The defense module further includes: an alarm unit; The issuing of corresponding alerts according to the adjusted defense strategy includes: The alarm unit is used to issue a first-level alarm according to the first-level defense strategy characteristics; The alarm unit is further configured to issue a secondary alarm based on the secondary defense strategy characteristics; The alarm unit is further configured to issue a third-level alarm based on the characteristics of the third-level defense strategy; Among them, the urgency of the first level alarm, the second level alarm and the third level alarm decreases in sequence.

10. A defense strategy recommendation method, characterized in that: Applied to a defense strategy recommendation system, the defense strategy recommendation method includes: Using Docker virtual technology to create a virtual environment, setting up a trap node, and obtaining a running log based on the trap node; Establishing a defense strategy against real attacks launched by attackers based on the operation log; A random forest model of machine learning is used according to the operation log to distinguish between the real attack of the attacker and the system false alarm; Extracting features from the real attack, calculating an attack index based on the features, and establishing a defense strategy based on the attack index; The defense strategy is adjusted, and corresponding alarms are issued according to the adjusted defense strategy.

Images