Automatic attack traceability countering process method

Through unsupervised learning models and dynamic honeypot technology, the weaknesses of the traditional network security defense system in advanced threat tracing are resolved, accurate identification and in-depth analysis of unknown attacks are achieved, and the automated response capabilities of network security are improved.

CN120639494APending Publication Date: 2025-09-12STATE GRID HENAN INFORMATION & TELECOMM CO
0 Cites 1 Cited by

Patent Information

Application Number
CN202511041016.1
Authority / Receiving Office
CN · China
Patent Type
Applications(China)
Current Assignee / Owner
Filing Date
2025-07-28
Publication Date
2025-09-12

AI Technical Summary

Technical Problem

Traditional network security defense systems are unable to cope with advanced persistent threats, zero-day vulnerability exploits and new attacks. They have weak threat perception and tracing capabilities, single countermeasures that easily interfere with legitimate business, lack flexibility and deceptiveness, and are unable to achieve self-awareness and enemy awareness in offensive and defensive confrontations.

Method used

Through unsupervised learning models, real-time traffic on the edge side is self-learned and modeled to identify unknown suspicious traffic. A dynamic honeypot environment is deployed for deep interaction and behavior capture to extract attack indicators and form a highly credible attack evidence chain.

Benefits of technology

It achieves accurate identification, in-depth analysis and effective tracing of edge-side attacks, and improves the automated analysis and response capabilities for advanced and unknown attacks.

✦ Generated by Eureka AI based on patent content.
Patent Text Reader

Abstract

The invention relates to the technical field of network security, and particularly discloses an automatic attack traceability countering process method, which comprises the following steps of: firstly, dynamically associating an isolated early warning event into a global attack context by fusing and analyzing multi-source heterogeneous data such as network traffic, equipment logs and external intelligence and then utilizing a threat knowledge graph technology; and performing intelligent prediction on the next intention of the attacker based on the topological relation of the atlas. Based on this, an instant spoofing environment that is highly matched with the predicted target is dynamically arranged and generated, and attack traffic is non-inductively redirected into the controlled environment. And finally, through transparent takeover and deep interaction of the redirection traffic, comprehensive capture and structural analysis of real behaviors, used tools and techniques and tactics of the attacker are realized. Therefore, while the attack traceability accuracy is improved, the initiative and flexibility of the countering means are enhanced, and an active defense system is constructed for network security defense.
Need to check novelty before this filing date? Find Prior Art