Network threat comprehensive capturing system and method based on multi-dimensional quasi-state trapping

Abstract

The application provides a network threat comprehensive capture system and method based on multi-dimensional quasi-state trapping, relates to the technical field of network threat capture based on multi-dimensional quasi-state trapping, and performs multi-level feature type division on historical trapping file information, obtains a first overlapping type and a first non-overlapping type, and further obtains trapping party feature analysis information; performs multi-level feature type division on historical attack file information, obtains a second overlapping type and a second non-overlapping type, and further obtains attack party feature analysis information; obtains trapping attack similarity and weight data, further obtains a capture effect coefficient to perform threat capture state judgment, obtains threat capture state judgment information, and the application realizes deep joint analysis of capture and attack, and improves capture accuracy and pertinence.

Description

TECHNICAL FIELD

[0001] The application provides a network threat comprehensive capture system and method based on multi-dimensional quasi-state trapping, and relates to the threat capture technical field, in particular to the network threat capture technology field of multi-dimensional quasi-state trapping. BACKGROUND

[0002] The traditional threat capture method only relies on single-dimensional feature analysis trapping or attack files, and it is difficult to mine deep feature correlation, resulting in too shallow definition of successful or failed features. The evaluation method is mostly qualitative judgment, lacking quantitative indicators, and unable to accurately measure the capture effect; and no dynamic comparison mechanism of trapping and attack features is established, which is difficult to adapt to the rapid evolution of attack means. SUMMARY

[0003] The application provides a network threat comprehensive capture system and method based on multi-dimensional quasi-state trapping, which solves the above problems:

[0004] The network threat comprehensive capture system and method based on multi-dimensional quasi-state trapping provided by the application, the method comprises:

[0005] S1, multi-level feature type division is performed on historical trapping file information, first overlapping type and first non-overlapping type are obtained, and then historical trapping success feature information and historical trapping failure feature information of the feature analysis information of the trapping party are obtained;

[0006] S2, multi-level feature type division is performed on historical attack file information, second overlapping type and second non-overlapping type are obtained, and then historical attack success feature information and historical attack failure feature information of the feature analysis information of the attack party are obtained;

[0007] S3, the trapping attack similarity and weight data are obtained according to the first overlapping type, the first non-overlapping type, the second overlapping type and the second non-overlapping type, and then the capture effect coefficient is obtained to determine the threat capture state, and the threat capture state determination information is obtained.

[0008] Further, the system comprises:

[0009] The trapping analysis module is configured to perform multi-level feature type division on historical trapping file information, obtain first overlapping type and first non-overlapping type, and then obtain historical trapping success feature information and historical trapping failure feature information of the feature analysis information of the trapping party;

[0010] The attack analysis module is configured to perform multi-level feature type division on historical attack file information, obtain second overlapping type and second non-overlapping type, and then obtain historical attack success feature information and historical attack failure feature information of the feature analysis information of the attack party;

[0011] The capture analysis module is used for obtaining the trap attack similarity and weight data according to the first overlap type, the first non-overlap type, the second overlap type and the second non-overlap type, obtaining the capture effect coefficient for threat capture state judgment, and obtaining threat capture state judgment information.

[0012] The method solves the limitation of traditional single-dimensional analysis, realizes deep deconstruction of trap and attack characteristics through multi-level feature division, avoids surface information misjudgment, and accurately locates effective and ineffective characteristics; through overlap or non-overlap type comparison and similarity calculation, quantitative correlation between trap strategy and attack behavior is established, so that the capture effect evaluation changes from qualitative to quantitative; the dynamic judgment and update mechanism forms a closed loop optimization, ensures that the trap file continuously adapts to the change of attack characteristics, and improves the timeliness and accuracy of threat capture; the weight design strengthens the influence weight of key characteristics, reduces the interference of redundant information, and significantly reduces the misjudgment rate. BRIEF DESCRIPTION OF DRAWINGS

[0013] Figure 1 A schematic diagram of a network threat comprehensive capture method based on multi-dimensional quasi-state trapping. DETAILED DESCRIPTION

[0014] The preferred embodiments of the present application will be described below with reference to the accompanying drawings, and it should be understood that the preferred embodiments described herein are only used to illustrate and explain the present application, and are not used to limit the present application.

[0015] In an embodiment of the present application, the network threat comprehensive capture system and method based on multi-dimensional quasi-state trapping proposed by the present application, the method comprises:

[0016] S1, multi-level feature type division is performed on historical trap file information, first overlap type and first non-overlap type are obtained, and then historical trap success feature information and historical trap failure feature information of trap feature analysis information are obtained;

[0017] S2, multi-level feature type division is performed on historical attack file information, second overlap type and second non-overlap type are obtained, and then historical attack success feature information and historical attack failure feature information of attack feature analysis information are obtained;

[0018] S3, trap attack similarity and weight data are obtained according to the first overlap type, the first non-overlap type, the second overlap type and the second non-overlap type, and then capture effect coefficient is obtained for threat capture state judgment, and threat capture state judgment information is obtained.

[0019] The working principle and technical effects of the above technical solution are as follows: precise determination of the threat capture state is realized through three-layer progressive analysis. The historical bait file information is divided into multiple levels of features (including surface explicitness, middle functional, deep analysis, and bottom strategy information), which is compared with the multiple levels of features of the historical bait success information, and the overlapping part is extracted as the first overlapping type (historical bait success feature information), and the remaining part is extracted as the first non-overlapping type (historical bait failure feature information), and then bait feature analysis information is obtained. The same logic is used to process the historical attack file information, and the second overlapping type (historical attack success feature information) and the second non-overlapping type (historical attack failure feature information) are obtained through the comparison of the multiple levels of features and the historical attack success information, and attack feature analysis information is formed. Based on the results of the first two steps, the similarity (such as cosine similarity) of the first or second bait and attack features is calculated, and the ratio of the first or second overlapping type and non-overlapping type is used as the weight, and then the capture effect coefficient is obtained; the coefficient is compared with the preset threshold value, and the threat capture state is determined to be qualified or unqualified, and the historical bait file is updated when it is unqualified, until the state meets the standard.

[0020] The method solves the limitation of traditional single-dimensional analysis, and the multi-level feature division realizes the deep deconstruction of bait and attack features, avoids surface information misjudgment, and accurately locates effective and ineffective features; through the comparison of overlapping or non-overlapping types and the calculation of similarity, the quantitative correlation between bait strategies and attack behaviors is established, so that the capture effect evaluation changes from qualitative to quantitative; the dynamic determination and updating mechanism forms a closed loop optimization, ensures that the bait file continuously adapts to the change of attack features, and improves the timeliness and accuracy of threat capture; the weight design strengthens the influence weight of key features, reduces the interference of redundant information, and significantly reduces the misjudgment rate.

[0021] In an embodiment of the present application, the S1 comprises:

[0022] The historical bait file information is obtained, and the historical bait success information is obtained according to the historical bait file information;

[0023] The historical bait success feature information and the historical bait failure feature information are obtained according to the historical bait file information and the historical bait success information;

[0024] The bait feature analysis is performed according to the historical bait success feature information and the historical bait failure feature information, and bait feature analysis information is obtained.

[0025] The working principle and technical effects of the above technical solution are: based on historical data (the historical data of the application can be in the recent period), the information in multiple stages is extracted and analyzed. From the historical luring file information (such as file type, camouflage content, trigger mechanism, etc.), the records of successfully achieving the luring target are screened out to form historical luring success information, and the basis sample of "effective luring" is determined.

[0026] By comparing the historical luring file information with the success information, the intersection features (such as specific camouflage format, high trigger rate operation instruction) of the two are extracted to form historical luring success feature information; at the same time, the file information that does not achieve the luring target is compared with the success information, and the difference features (such as easily identified camouflage vulnerabilities, low-efficiency trigger logic) are located as historical luring failure feature information.

[0027] The success and failure features are cross-analyzed and patterned to extract the key dimensions affecting the luring effect, and finally the quantitative luring party feature analysis information is formed.

[0028] The method realizes "data-driven iteration" of the luring strategy, compares and analyzes the success and failure features, removes invalid information, focuses on key influencing factors, improves the recognition of luring features, and reduces redundant design;

[0029] Based on the historical feature analysis result, the design logic of the luring file can be dynamically adjusted to improve the success rate of the new luring scheme; by inducing the luring party features, a targeted defense model is constructed, so that the luring system can predict potential evasive means, form a closed loop of "historical experience, current strategy and future optimization", and enhance the initiative and effectiveness of network luring.

[0030] The method upgrades the experience-based luring to data-driven precision operation, which greatly reduces the consumption of invalid resources.

[0031] In an embodiment of the application, the historical luring success feature information and the historical luring failure feature information are obtained according to the historical luring file information combined with the historical luring success information, comprising:

[0032] The preset luring type is divided into multiple details to obtain multiple hierarchical feature types of the preset luring type; the multiple hierarchical feature types include a surface explicit information layer, a neutral functional information layer, a deep analysis information layer, and a bottom strategic information layer;

[0033] The historical luring file information is divided into multiple hierarchical feature types to obtain multiple hierarchical luring feature types;

[0034] The historical luring success information is divided into multiple hierarchical feature types to obtain multiple hierarchical luring feature types;

[0035] The first overlapping type of the multi-level trapping feature type of the historical trapping file information is obtained as historical trapping success feature information.

[0036] The first non-overlapping type of the historical trapping file information other than the historical trapping success feature information is obtained as historical trapping failure feature information.

[0037] The working principle and technical effects of the above technical solution are as follows: The trapping purpose of the traditional trapping method is usually to obtain the trapping target through the trapping file, and the focus is on obtaining the trapping feature information, which is shallow in analysis level and only obtains the features that realize the trapping purpose. However, these features are only what the trapping target wants to obtain, and it is difficult to analyze the deep attack purpose of the trapping target, and further understand which trapping deep information truly plays a core trapping role, rather than simply obtaining the features that realize the trapping. The above method realizes deep analysis and extraction of the features that play a trapping role, facilitates understanding of the core attack purpose of the trapping target, and simplifies the complexity of traditional trapping analysis. The traditional trapping method only obtains the surface trapping file, which is considered to contribute, but the attack essence logic purpose information or attack ability information cannot be understood.

[0038] The method realizes deep trapping feature analysis through multi-level feature disassembly and comparison. The preset trapping type is refined into four levels of feature types: surface explicit information, middle functional information, deep analysis information, and bottom strategic information. Then, the historical trapping file information and the historical trapping success information are respectively divided into multi-level features to obtain corresponding multi-level trapping feature types. The first overlapping type of the features of the two is extracted to determine the historical trapping success feature information. The first non-overlapping type of the historical trapping file information that is not overlapped is used as the historical trapping failure feature information. Finally, based on the comparison analysis of the success and failure features, the core logic of the trapping effect is excavated.

[0039] Compared with the traditional method of only obtaining surface trapping features, the method realizes deep analysis of trapping features: eliminates invalid feature interference, accurately locates key trapping elements, and improves the depth of attack ability cognition.

[0040] The surface explicit information layer is the most intuitive information of the trapping file and the content first contacted by the attacker. It includes file name, format (such as.doc,.exe), visible text (such as false account password list, seemingly important business data segment), icon, etc. Its core function is to complete preliminary camouflage through “explicit features” that meet the expectations of the attacker, and induce the attacker to have the desire to open or operate the file.

[0041] The middle layer functional information layer is hidden under the surface layer information, and is key information supporting the trapping function. The middle layer functional information layer includes preset trigger instructions (such as code activation signals corresponding to specific operations), basic monitoring identifiers (such as embedded invisible tracking codes of files and access log recording templates), and the like. These information is not directly exposed to attackers, and only plays a role in initiating preliminary capture of attack behavior when the file is operated, and is a bridge connecting the surface layer camouflage and the deep layer monitoring.

[0042] The deep layer analytical information layer is formed after the data captured by the middle layer functional information is processed. The deep layer analytical information layer includes basic characteristic analysis of attack sources (such as IP addresses, device operating system versions, and network protocol types), operation behavior sequences (such as opening time, modification position, and forwarding path), and the like. These information is structured and arranged, and is core information for converting from “capturing behavior” to “understanding attack”.

[0043] The bottom layer strategic information layer is the deepest layer of the trapping file information system, and includes strategic data supporting the entire trapping logic. For example, dynamic adjustment rules (such as algorithm parameters for automatically switching camouflage modes according to attack behavior types), threat intelligence correlation models (such as matching rules with known attack feature libraries), countermeasure response plans (such as defense instruction templates started after triggering specific attack behaviors), and the like. This type of information determines the intelligent degree and counteradaptability of the trapping file, and is the core support for realizing the “active trapping, deep analysis, and dynamic countermeasure” closed loop.

[0044] In an embodiment of the present application, the historical trapping success feature information is combined with historical trapping failure feature information to perform trapping feature analysis, and trapping party feature analysis information is obtained, including:

[0045] The first common feature information of the first overlapping type is obtained, which is different from the first non-overlapping type. The first common feature information is determined as the first trapping party feature information. The feature has a contribution to the trapping effect.

[0046] The first all feature information of the first non-overlapping type is obtained, which is different from the first overlapping type. The first all feature information is determined as the second trapping party feature information. The feature does not have a contribution to the trapping effect.

[0047] The working principle and technical effect of the above technical solution are: from the historical successful trapping feature information (first overlapping type), the common features that are different from the historical failed trapping feature information (first non-overlapping type) are extracted, and these features are determined as the first trapping party feature information, that is, the core features that really contribute to trapping. From the historical failed trapping feature information (first non-overlapping type), all features that are different from the historical successful trapping feature information (first overlapping type) are extracted, and these features are determined as the second trapping party feature information, that is, the features that do not produce trapping effect and have no contribution value. Through accurate division of the two types of features, a complete analysis of the trapping party features is formed.

[0048] The method breaks through the limitation of ambiguous feature value in traditional trapping analysis, accurately locates the effective features, and the first trapping party feature information clearly identifies the core elements that really play a role, avoiding waste of resources on ineffective features; the second trapping party feature information clearly identifies the ineffective features, reveals the types of features that do not work, and can eliminate or improve such features to reduce trapping redundancy design; deepens the understanding of attack logic, through the comparison of effective and ineffective features, the focus and avoidance habits of the trapping target can be deduced, a more targeted trapping system can be constructed, and the trapping efficiency and depth can be significantly improved.

[0049] In an embodiment of the present application, the S2 comprises:

[0050] Obtaining historical attack file information, and obtaining historical attack success information according to the historical attack file information;

[0051] Obtaining historical attack success feature information and historical attack failure feature information according to the historical attack file information and the historical attack success information;

[0052] Performing attack feature analysis according to the historical attack success feature information and the historical attack failure feature information to obtain attack party feature analysis information.

[0053] The working principle and technical effect of the above technical solution are: based on historical attack data, attack party feature depth analysis is realized through feature extraction and comparison. Historical attack file information is collected, and historical attack success information achieving attack purpose is screened out. The historical attack file information and the historical attack success information are associated and analyzed, the overlapping features of the two are extracted as historical attack success feature information, that is, the features that play a key role in the attack process; the remaining non-overlapping features are historical attack failure feature information, that is, the features that do not contribute to attack success. By comparing and analyzing the historical attack success and failure feature information, the commonalities and differences of the attack party in attack strategy, tool use, target selection, etc. are extracted, and attack party feature analysis information is formed.

[0054] Compared with the traditional method of only recording attack events, the method has significant improvement, accurately locks the effective attack features, and clearly identifies the core elements of successful attacks; through the failure feature identification of the attacker's weak point, a targeted interference strategy is developed to reduce the success rate of attacks; the behavior patterns and preferences of the attacker, such as common attack paths and preferred vulnerability types, are deeply mined, so that the defense is changed from passive response to active prediction, improving the forward-looking and effectiveness of the overall security protection, and reducing the loss caused by attacks.

[0055] In one embodiment of the present application, the historical attack success feature information and the historical attack failure feature information are obtained according to the historical attack file information combined with the historical attack success information, including:

[0056] The preset attack type is divided into multiple details to obtain a multi-level feature type of the preset attack type; the multi-level feature type includes a surface explicit information layer, a neutral functional information layer, a deep analysis information layer, and a bottom strategic information layer;

[0057] The historical attack information is divided into a multi-level attack type to obtain a multi-level attack feature type;

[0058] The historical attack success information is divided into a multi-level attack type to obtain a multi-level attack feature type;

[0059] The multi-level attack feature type of the historical attack success information is obtained in a second overlapping type of the multi-level attack feature type of the historical attack information, and the historical attack success feature information is obtained;

[0060] A second non-overlapping type of the historical attack information except the historical attack success information is obtained, and the historical attack failure feature information is obtained.

[0061] The working principle and technical effects of the above technical solution are as follows: through multi-level feature disassembly and comparison, the attack success and failure features are accurately extracted. The preset attack type is divided into four levels of feature types, including surface explicit information, middle functional information, deep analysis information, and bottom strategic information. The historical attack file information and the historical attack success information are respectively divided into multi-level features to obtain corresponding multi-level attack feature types. The multi-level features of the historical attack success information and the second overlapping type of the multi-level features of the historical attack file information are extracted as the historical attack success feature information, that is, the core features that truly promote the success of the attack; the second non-overlapping type of the historical attack file information except the success features is determined as the historical attack failure feature information, that is, the features that do not work. Through this multi-level comparison, the attack features are deeply disassembled.

[0062] Compared with the traditional method of extracting attack features based on only a single dimension, the method breaks through the limitation of surface information, deeply excavates the influence of each level on the success or failure of the attack, and clearly identifies the core feature and invalid feature by multi-level feature division.

[0063] In an embodiment of the present application, the attack feature analysis based on the historical attack success feature information and the historical attack failure feature information to obtain attack feature analysis information includes:

[0064] The second common feature information that is different from the second non-overlapping type is obtained, and the second common feature information is determined as the first attacker feature information.

[0065] The second all feature information that is different from the second overlapping type is obtained, and the second all feature information is determined as the second attacker feature information.

[0066] The working principle and technical effects of the above technical solution are as follows: the attack feature is accurately analyzed by feature difference extraction. On the basis of obtaining the historical attack success feature information (second overlapping type) and the historical attack failure feature information (second non-overlapping type), the features of the two are further compared: the common features that are different from the second non-overlapping type in the second overlapping type are extracted, and the common features are determined as the first attacker feature information, that is, the core features that truly contribute to the success of the attack; at the same time, all features that are different from the second overlapping type in the second non-overlapping type are extracted as the second attacker feature information, that is, the features that do not produce attack effect and do not have contribution value. Through the clear division of effective and invalid features, the system sorts out the key elements and weak points of the attacker in the attack process, and forms comprehensive attack feature analysis information.

[0067] The first attacker feature information accurately locks the effective attack feature, and clearly identifies the invalid attack feature. The second attacker feature information reveals the short board of the attacker, which can guide the design of targeted interference strategy and amplify the attack weakness. Through the comparison of the two types of features, the technical preference, behavior mode and ability boundary of the attacker are deeply restored, which helps to build a dynamic defense system, shifts from passive defense to active prediction, greatly improves the pertinence and effectiveness of defense, and significantly reduces the success probability of attack.

[0068] In an embodiment of the present application, the S3 includes:

[0069] Calculate the feature similarity of the first decoy feature information and the first attacker feature information to obtain the first decoy attack similarity; the feature similarity can be calculated by cosine similarity or other calculation methods;

[0070] Calculate the feature similarity of the second decoy feature information and the second attacker feature information to obtain the second decoy attack similarity;

[0071] Calculate the data ratio of the first overlap type and the first non-overlap type to obtain the first weight;

[0072] Calculate the data ratio of the second overlap type and the second non-overlap type to obtain the second weight;

[0073] Obtain the average of the product of the first decoy attack similarity and the first weight and the product of the second decoy attack similarity and the second weight to obtain the capture effect coefficient; when the denominator is 0, it is set to a minimum value.

[0074] Compare the capture effect coefficient with the preset effect threshold to obtain effect comparison information, and determine the threat capture state according to the effect comparison information to obtain threat capture state determination information;

[0075] Trigger the historical decoy file information update instruction according to the threat capture state determination information to update the historical decoy file information until the threat capture state is qualified.

[0076] Compare the capture effect coefficient with the preset effect threshold to obtain effect comparison information, and determine the threat capture state according to the effect comparison information to obtain threat capture state determination information, including:

[0077] When the capture effect coefficient is greater than the preset effect threshold, it is determined that the threat capture state is qualified;

[0078] When the capture effect coefficient is less than or equal to the preset effect threshold, it is determined that the threat capture state is unqualified.

[0079] The working principle and technical effects of the above technical solution are as follows: cosine similarity algorithm is used to calculate the similarity of the first trapping side feature information and the first attack side feature information (first trapping attack similarity) and the similarity of the second trapping side feature information and the second attack side feature information (second trapping attack similarity). The data ratio of the first overlap type and the first non-overlap type is calculated as the first weight, and the data ratio of the second overlap type and the second non-overlap type is calculated as the second weight (when the denominator is 0, it is set to a minimum value). The average value of the product of the first trapping attack similarity and the first weight and the product of the second trapping attack similarity and the second weight is obtained to obtain the capture effect coefficient. The coefficient is compared with a preset effect threshold value: if greater than the threshold value, the threat capture state is determined to be qualified; if less than or equal to the threshold value, it is determined to be unqualified. If it is in the unqualified state, a historical trapping file information update instruction is triggered to continuously optimize the trapping file until the state is qualified.

[0080] The method breaks through the single evaluation of traditional threat capture evaluation, and through the calculation mode of combining feature similarity and weight, the matching degree and data proportion of effective and ineffective features are comprehensively considered, so that the capture effect evaluation is more accurate, and the deviation of single dimension judgment is avoided; the dynamic determination mechanism realizes real-time monitoring of the threat capture state, and automatically triggers updating when it is unqualified, forming a closed loop of "evaluation, optimization, and re-evaluation", ensuring that the trapping strategy is always synchronized with the attack feature to adapt; through continuous optimization of the historical trapping file, the effective trapping features can be targetedly strengthened, the ineffective features can be weakened, the capture ability of the core intention of the attack side can be significantly improved, the passive response is changed to active optimization, the effectiveness and stability of the threat capture are greatly improved, and the security risk caused by insufficient capture is reduced.

[0081] One embodiment of the present application, the system comprises:

[0082] The trapping analysis module is used for multi-level feature type division of the historical trapping file information, obtaining the first overlap type and the first non-overlap type, and then obtaining the historical trapping successful feature information and the historical trapping failed feature information of the trapping side feature analysis information;

[0083] The attack analysis module is used for multi-level feature type division of the historical attack file information, obtaining the second overlap type and the second non-overlap type, and then obtaining the historical attack successful feature information and the historical attack failed feature information of the attack side feature analysis information;

[0084] The capture analysis module is used for obtaining the trapping attack similarity and the weight data according to the first overlap type, the first non-overlap type, the second overlap type and the second non-overlap type, and then obtaining the capture effect coefficient to determine the threat capture state and obtain the threat capture state determination information

[0085] The working principle and technical effects of the above technical solution are: precise determination of threat capture state is realized through three-layer progressive analysis. The historical bait file information is divided into multiple levels of features (including surface explicitness, middle functional, deep analysis, and bottom strategy information), which is compared with the multiple levels of features of historical bait success information, and the overlapping part is extracted as the first overlapping type (historical bait success feature information), and the remaining part is the first non-overlapping type (historical bait failure feature information), and then the bait feature analysis information is obtained. The historical attack file information is processed by the same logic, and the second overlapping type (historical attack success feature information) and the second non-overlapping type (historical attack failure feature information) are obtained by comparing the multiple levels of features with the historical attack success information, forming the attack feature analysis information. Based on the results of the first two steps, the similarity (such as cosine similarity) of the first or second bait and attack features is calculated, and the ratio of the first or second overlapping type and non-overlapping type is used as the weight, and then the capture effect coefficient is obtained; the coefficient is compared with the preset threshold value, and the threat capture state is determined to be qualified or unqualified, and the historical bait file is updated when unqualified, until the state meets the standard.

[0086] The method solves the limitation of traditional single-dimensional analysis, and the multi-level feature division realizes the deep deconstruction of bait and attack features, avoids surface information misjudgment, and accurately locates effective and ineffective features; through the comparison of overlapping or non-overlapping types and the calculation of similarity, the quantitative correlation between bait strategy and attack behavior is established, so that the capture effect evaluation goes from qualitative to quantitative; the dynamic determination and updating mechanism forms a closed loop optimization, ensures that the bait file continuously adapts to the change of attack features, and improves the timeliness and accuracy of threat capture; the weight design strengthens the influence weight of key features, reduces the interference of redundant information, and significantly reduces the misjudgment rate.

[0087] Obviously, those skilled in the art can make various modifications and changes to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and changes of the present application belong to the scope of the claims of the present application and their equivalent technologies, the present application also intends to include these modifications and changes.

Claims

1. A method for comprehensive capture of network threats based on multi-dimensional mimicry trapping, characterized in that, The method includes: S1. Obtain historical trapping file information, and obtain historical trapping success information based on the historical trapping file information; Based on the historical trapping file information and historical trapping success information, historical trapping success feature information and historical trapping failure feature information are obtained. Specifically, this includes: performing multiple detailed subdivisions on a preset trapping type to obtain multi-level feature types for the preset trapping type; performing multi-level feature type subdivisions on historical trapping file information to obtain multi-level trapping feature types; performing multi-level feature type subdivisions on historical trapping success information to obtain multi-level trapping feature types; obtaining the first overlapping type of the multi-level trapping feature types of historical trapping success information with the multi-level trapping feature types of historical trapping file information to obtain historical trapping success feature information; obtaining the first non-overlapping type in historical trapping file information other than historical trapping success feature information to obtain historical trapping failure feature information. Based on the historical successful trapping feature information and the historical failed trapping feature information, trapping feature analysis is performed to obtain trapping feature analysis information; S2. Obtain historical attack file information, and obtain historical attack success information based on the historical attack file information; Based on the historical attack file information and historical attack success information, historical attack success feature information and historical attack failure feature information are obtained. Specifically, this includes: performing multiple detailed divisions on a preset attack type to obtain multi-level feature types of the preset attack type; performing multi-level attack type divisions on historical attack information to obtain multi-level attack feature types; performing multi-level attack type divisions on historical attack success information to obtain multi-level attack feature types; obtaining the second overlapping type of the multi-level attack feature types of historical attack success information within the multi-level attack feature types of historical attack information to obtain historical attack success feature information; and obtaining the second non-overlapping type in historical attack information other than historical attack success information to obtain historical attack failure feature information. Attack feature analysis is performed based on the historical attack success feature information and the historical attack failure feature information to obtain attacker feature analysis information. S3. Obtain the similarity and weight data of the trapping attack based on the first overlapping type, the first non-overlapping type, the second overlapping type, and the second non-overlapping type, and then obtain the capture effect coefficient to determine the threat capture status and obtain the threat capture status determination information.

2. The method for comprehensive network threat capture based on multi-dimensional mimicry trapping according to claim 1, characterized in that, Based on the historical successful trapping feature information and the historical failed trapping feature information, trapping feature analysis is performed to obtain trapping feature analysis information, including: Obtain the first common feature information that distinguishes the first overlapping type from the first non-overlapping type, and determine the first common feature information as the first trapping feature information; Obtain all feature information of the first non-overlapping type region that is different from the first overlapping type, and determine the first all feature information as the second trapping feature information.

3. The method for comprehensive network threat capture based on multi-dimensional mimicry trapping according to claim 2, characterized in that, Attack feature analysis is performed based on the historical attack success feature information and historical attack failure feature information to obtain attacker feature analysis information, including: Obtain the second common feature information that distinguishes the second overlapping type from the second non-overlapping type, and determine the second common feature information as the first attacker's feature information; Obtain all second feature information of the second non-overlapping type region that is different from the second overlapping type, and determine the second all feature information as the second attacker feature information.

4. The method for comprehensive network threat capture based on multi-dimensional mimicry trapping according to claim 3, characterized in that, S3 includes: Calculate the feature similarity between the feature information of the first decoy and the feature information of the first attacker to obtain the first decoy-attack similarity. Calculate the feature similarity between the feature information of the second decoy and the feature information of the second attacker to obtain the second decoy-attack similarity. Calculate the ratio of the data of the first overlapping type to the data of the first non-overlapping type to obtain the first weight; Calculate the ratio of the second overlapping type to the second non-overlapping type of data to obtain the second weight; The capture effect coefficient is obtained by averaging the product of the first trap attack similarity and the first weight and the product of the second trap attack similarity and the second weight. The capture effect coefficient is compared with a preset effect threshold to obtain effect comparison information. Threat capture status is determined based on the effect comparison information to obtain threat capture status determination information. Based on the threat capture status determination information, a historical trapping file information update instruction is triggered to update the historical trapping file information until the threat capture status is qualified.

5. The method for comprehensive network threat capture based on multi-dimensional mimicry trapping according to claim 4, characterized in that, The capture effect coefficient is compared with a preset effect threshold to obtain effect comparison information. Threat capture status is determined based on the effect comparison information to obtain threat capture status determination information, including: When the capture effect coefficient is greater than the preset effect threshold, the threat capture status is determined to be qualified. When the capture effect coefficient is less than or equal to the preset effect threshold, the threat capture status is determined to be unqualified.

6. A system for implementing the method for comprehensive capture of network threats based on multi-dimensional mimicry trapping as described in claim 1, characterized in that, The system includes: The trapping analysis module is used to perform multi-level feature type classification on historical trapping file information, obtain the first overlapping type and the first non-overlapping type, and then obtain the historical successful trapping feature information and historical failed trapping feature information of the trapper feature analysis information. The attack analysis module is used to perform multi-level feature type division on historical attack file information, obtain the second overlapping type and the second non-overlapping type, and then obtain the historical attack success feature information and historical attack failure feature information of the attacker's feature analysis information. The capture analysis module is used to obtain the similarity and weight data of the trapping attack based on the first overlapping type, the first non-overlapping type, the second overlapping type, and the second non-overlapping type, and then obtain the capture effect coefficient to determine the threat capture status and obtain threat capture status determination information.

Images