Network defense system vulnerability simulation method based on generative adversarial network

Abstract

The invention discloses a network defense system vulnerability simulation method based on a generative adversarial network. The method comprises the following steps: S1, generating a network security situation awareness data set; s2, obtaining a weighted attack path graph; s3, performing graph semantic coding on the weighted attack path graph, and mapping a condition vector set; s4, obtaining a converged candidate weak point configuration set; s5, generating a target weak point configuration list; s6, forming a weak bait cluster; and S7, collecting a detection behavior log aiming at the weak bait cluster in real time, generating an attacker interaction behavior data set by utilizing the behavior log and the transverse movement behavior log, updating a weighted attack path graph and a condition vector set based on the attacker interaction behavior data set, and performing online fine adjustment on the condition generative adversarial network to obtain a weighted attack path graph. And the step S5 and the step S6 are executed again. According to the invention, through comprehensive discrimination and constraint optimization, unification of high trapping value and low business risk is realized.

Description

Technical Field

[0001] The present invention relates to the field of network defense technology, and in particular to a network defense system vulnerability simulation method based on a generative adversarial network. Background Art

[0002] With the rapid growth of network scale and business complexity, security operations centers (SOCs) are increasingly using asset inventory management, vulnerability scanning, traffic auditing, and attack path analysis to support defense strategy development. However, in actual attack and defense scenarios, traditional approaches often statically deploy decoy nodes based on experience or fixed templates, or simply select a few "high-risk" nodes in the attack path based on a single vulnerability score and permission boundaries. This approach lacks comprehensive consideration of business importance, attacker preferences, and multi-source security data, resulting in a disconnect between vulnerability settings and real-world business scenarios and limited decoy effectiveness. While some vendors have begun experimenting with machine learning to predict attack trajectories, these approaches often rely solely on offline clustering or regression evaluation based on historical logs, making it difficult to dynamically adjust decoy strategies as the network environment changes. Existing vulnerability assessment mechanisms often employ scoring methods based on static weights or simple centrality metrics, lacking a comprehensive understanding of the semantic associations within multi-attribute attack paths. This results in significant deviations between assessment results and actual attack chains, often leading to poor decoy returns for high-scoring nodes and frequent exploitation of low-scoring nodes.

[0003] On the other hand, generative adversarial networks have been introduced into the security field in recent years to generate traffic samples or complete vulnerability data. However, mainstream solutions often use noise-driven generation directly, lacking deep integration with attack path structure and business context. The generated results have significant deficiencies in interpretability, controllability, and security tolerance. At the same time, the vulnerability configurations output by the generative model usually require security experts to manually screen and map them to specific assets. The overall process is fragmented and the workload is huge. In addition, most automated orchestration platforms only focus on resource utilization or operation and maintenance windows during the deployment phase, and lack quantitative indicators for the balance between the value of vulnerability trapping and business risks. As a result, after the trapping nodes are deployed, they are either not attractive enough to attackers or cause excessive disturbances to key businesses. Summary of the Invention

[0004] One purpose of the present invention is to propose a network defense system vulnerability simulation method based on a generative adversarial network. The present invention achieves the unity of high trapping value and low business risk through comprehensive judgment and constraint optimization.

[0005] A network defense system vulnerability simulation method based on a generative adversarial network according to an embodiment of the present invention includes:

[0006] S1. Generate cybersecurity situational awareness dataset;

[0007] S2. Construct a directed multi-attribute attack path graph based on the cybersecurity situational awareness dataset and assign weights based on asset nodes, vulnerability edges, and permission relationships to obtain a weighted attack path graph.

[0008] S3. Perform graph semantic encoding on the weighted attack path graph and map the condition vector set;

[0009] S4. Initialize the conditional generative adversarial network, use the random noise vector and the condition vector set as input, train the generator to output the candidate vulnerability configuration set, and obtain the converged candidate vulnerability configuration set;

[0010] S5. Map the converged candidate vulnerability configuration set to a weighted attack path graph. Invoke the vulnerability assessment model to comprehensively score the asset nodes to which the candidate vulnerability configuration set belongs in the weighted attack path graph. Filter out target vulnerability configurations based on the comprehensive score, business impact threshold, and security baseline constraints, and generate a target vulnerability configuration list.

[0011] S6. Input the target vulnerability configuration list into the security orchestration automation module to generate a vulnerability deployment plan. According to the vulnerability deployment plan, vulnerability decoy nodes are deployed at predetermined network locations. The target vulnerability configuration is injected into the corresponding asset nodes, along with traceable audit hooks, to form a vulnerability decoy cluster.

[0012] S7. Collect detection behavior logs, exploitation behavior logs, and lateral movement behavior logs for the vulnerability bait cluster in real time to generate an attacker interaction behavior dataset. Update the weighted attack path graph and conditional vector set based on the attacker interaction behavior dataset, and perform online fine-tuning on the conditional generative adversarial network to re-execute steps S5 and S6.

[0013] In this embodiment, the generation of the network security situation awareness data set includes collecting asset inventory information, vulnerability scan results, traffic log data and security alert data, and performing format unification, field regularization and time alignment processing.

[0014] In this embodiment, S2 includes the following steps:

[0015] S21. Define each asset in the cybersecurity situation awareness dataset as an asset node;

[0016] Each asset node includes a device type, IP address, operating system type, and an open service combination, which are used to describe the basic network attributes of the asset node.

[0017] S22. For each asset node with a known vulnerability, extract the vulnerability identifier based on the vulnerability scan results and create a directed edge for the vulnerability in the attack path graph;

[0018] The directed edges are accompanied by vulnerability attribute labels, which include vulnerability numbers and vulnerability score values. The vulnerability numbers and vulnerability score values ​​are used to identify the uniqueness of the vulnerability and quantify the severity of the vulnerability.

[0019] S23. Analyze the connection relationship between asset nodes based on traffic log data, extract the permission call relationship, and establish permission edges in the attack path graph for asset nodes with access rights;

[0020] The permission level label is attached to the permission side. The permission level label includes read permission, write permission, execute permission and administrator permission. Different permission types correspond to different risk levels.

[0021] S24. Construct an attack path graph. The attack path graph consists of a set of asset nodes and a set of directed edges. The directed edge set includes all directed edges formed by vulnerability relationships and permission relationships. The attack path graph is used to describe the dependencies and propagation relationships between assets, vulnerabilities, and permissions in the network.

[0022] S25. Assign a risk weight value to each directed edge in the attack path graph;

[0023] The risk weight value is obtained by weighted calculation of the vulnerability scoring factor, permission risk factor and business importance weight. The vulnerability scoring factor is taken as the vulnerability score value, the permission risk factor is mapped to a risk value based on the permission level label, and the business importance weight is derived from the business system label in the security situation awareness dataset. The risk weight value is used to comprehensively measure the vulnerability risk, permission risk and business impact of the connection between asset nodes.

[0024] S26. Calculate the cumulative risk value of the outbound edge set of each asset node in the attack path graph. The cumulative risk value is the sum of the risk weight values ​​of all outbound edges of the asset node. The cumulative risk value is used to measure the attack propagation tendency of the asset node in the attack path graph.

[0025] In this embodiment, S3 includes the following steps:

[0026] S31. Extract the basic attributes of each asset node in the weighted attack path graph, and encode the device type, operating system type, IP address, and open service combination of the asset node through the asset node attribute embedding encoding function to obtain the asset node attribute vector. The asset node attribute vector is used to represent the basic network semantic characteristics of the asset node;

[0027] S32. Extract the risk weight value of each directed edge in the weighted attack path graph, combine each risk weight value with its edge type, and obtain a risk edge vector;

[0028] The risk edge vector includes the risk weight value, the vulnerability edge flag and the permission edge flag. The risk edge vector is used to characterize the risk channel structure in the asset connection.

[0029] S33. Calculate the path probability value for each attack path from a potential attack source node to a target key node in the weighted attack path graph;

[0030] The path probability value is the product of the risk weight values ​​of all edges on the path. The path probability value is used to quantify the possibility of an attacker choosing the path. All path probability values ​​constitute the path probability distribution set.

[0031] S34. Extract the business importance weight of each asset node in the weighted attack path graph. The business importance weight is derived from the business system label. The business importance weight is normalized to obtain the normalized business importance weight.

[0032] S35. Generate an attacker preference feature vector based on attack history data and behavior profiles;

[0033] The attacker preference feature vector includes the vulnerability type, access path tendency and target asset attributes that the attacker prefers to attack. The attacker preference feature vector is combined with the asset node attribute vector, risk edge vector, path probability value and normalized business importance weight to form a complete contextual semantics.

[0034] S36. Concatenate the asset node attribute vector, risk edge vector, path probability distribution set, normalized business importance weight, and attacker preference feature vector to jointly construct a conditional vector set.

[0035] In this embodiment, S4 includes the following steps:

[0036] S41. Initialize the conditional generative adversarial network model, which includes a generator, a first discriminator, a second discriminator, and a vulnerability security constraint module;

[0037] S42. Generate a random noise vector;

[0038] Random noise vectors are used to ensure the diversity and randomness of the vulnerability configuration generation process, preventing the generated vulnerability configuration from being easily identified as a fixed pattern by attackers;

[0039] S43. The random noise vector is concatenated with the conditional vector set and then fed into the generator. The generator then adaptively weights the concatenated input features using a hierarchical attention mechanism based on the goal of inducing network defense system weaknesses. This mechanism dynamically captures the importance differences of attack path nodes and edges in the conditional vector set in the network attack and defense context, and outputs a set of candidate vulnerability configurations.

[0040] S44. The candidate vulnerability configuration set and the true vulnerability configuration sample are input into the first discriminator. The first discriminator adopts a hierarchical difference determination strategy for fine-grained differences in vulnerability configuration features and outputs a fine-grained difference determination result of the consistency between the candidate vulnerability configuration set and the true vulnerability configuration sample.

[0041] Used to accurately measure the degree of detail difference between candidate vulnerability configurations and actual network defense system vulnerability characteristics in network attack and defense scenarios;

[0042] S45. The candidate vulnerability configuration set and the corresponding condition vector set are input into the second discriminator. The second discriminator performs a comprehensive attention matching calculation based on the network attack and defense semantic consistency of the vulnerability configuration in the attack path diagram, and outputs the semantic consistency attention matching result between the candidate vulnerability configuration set and the corresponding condition vector set;

[0043] Used to measure whether the candidate vulnerability configuration maintains a high degree of consistency under the attack path topology structure and asset relationship semantics induced by the network defense system vulnerability;

[0044] S46. Construct a vulnerability security constraint module. The vulnerability security constraint module generates a security assessment factor for the vulnerability configuration based on the security baseline constraints. The security assessment factor quantifies the network attack and defense security risk of each candidate vulnerability configuration. A higher security assessment factor value for a candidate vulnerability configuration indicates a greater potential impact on the service security baseline of the real network environment.

[0045] S47. Define a loss function for the generator, where the loss function of the generator includes a comprehensive penalty of the fine-grained difference determination result of the consistency of the first discriminator, the semantic consistency attention matching result of the second discriminator, and the security assessment factor;

[0046] The loss function of the generator is used to guide the generator to generate candidate vulnerability configurations that are both highly realistic under the network defense system weakness induction semantics and do not exceed the security baseline constraint;

[0047] S48. Define loss functions for the first discriminator and the second discriminator. The loss function of the first discriminator is used to constrain its accuracy in determining the fine-grained difference between the candidate vulnerability configuration and the true vulnerability configuration sample. The loss function of the second discriminator is used to constrain its accuracy in determining the semantic consistency attention matching result between the candidate vulnerability configuration and the corresponding condition vector set.

[0048] S49. The loss functions of the generator, the first discriminator, and the second discriminator are alternately optimized through the adversarial learning method, and the network parameters of the generator, the first discriminator, and the second discriminator are iteratively updated until the candidate vulnerability configuration set output by the generator satisfies both the fine-grained difference in consistency with the true vulnerability configuration sample and the semantic consistency attention matching with the corresponding conditional vector set, and both meet the convergence conditions, and the security assessment factor is lower than the set security baseline threshold, thereby obtaining the final converged candidate vulnerability configuration set.

[0049] In this embodiment, S5 includes the following steps:

[0050] S51. Map the converged candidate vulnerability configuration set output by the generator to the weighted attack path graph, and determine the target asset node associated with each vulnerability configuration in the candidate vulnerability configuration set;

[0051] S52. Calculate the betweenness centrality of each candidate evaluation node in the weighted attack path graph;

[0052] Betweenness centrality is used to measure the proportion of times a candidate evaluation node is passed through in all shortest paths in the attack path graph. The higher the betweenness centrality, the stronger the control power of the node in the potential attack path.

[0053] S53. Calculate the path probability weight for each candidate evaluation node;

[0054] The path probability weight is the sum of the joint propagation probabilities of all attack paths with the candidate evaluation node as the relay node. The propagation probability of a single path is the product of the risk weight values ​​of all edges in the path. The larger the path probability weight, the higher the node's guiding ability in the attack path propagation.

[0055] S54. Extract the normalized business importance weight of each candidate evaluation node;

[0056] The normalized business importance weight is derived from the result of normalization of business system labels and is used to reflect the importance of the business system associated with the candidate evaluation node. The higher the normalized business importance weight, the greater the impact of the node on key businesses.

[0057] S55. For each candidate evaluation node, based on betweenness centrality, path probability weight, and normalized business importance weight, combined with trapping strategy adjustment parameters, a weighted sum and difference is performed to obtain a trapping value score;

[0058] The trapping value score is used to comprehensively measure the balance between the trapping benefits and business risks of the candidate evaluation node. A higher trapping value score indicates that the node is suitable for target vulnerability configuration.

[0059] S56. Sort all candidate evaluation nodes according to the trapping value score, and filter them in combination with the business impact threshold and the network security baseline risk threshold to screen out the target vulnerability configurations and generate a target vulnerability configuration list.

[0060] In this embodiment, S6 includes the following steps:

[0061] S61. Input the target vulnerability configuration list into the security orchestration automation module. The security orchestration automation module parses the asset nodes, trapping objectives, and resource requirements corresponding to each target vulnerability configuration in the target vulnerability configuration list. The asset nodes, trapping objectives, and resource requirements are used to subsequently generate a deployment plan.

[0062] S62. Collect the operating status information in the current network environment. The operating status information includes network resource occupancy, system load status and business operation window information. The network resource occupancy indicates the remaining amount of computing resources of each physical node or virtual node. The system load status indicates the average CPU and memory usage per unit time. The business operation window information indicates the scheduling authority range for business critical periods and non-critical periods.

[0063] S63. Construct a weakness deployment constraint scheduling model. The weakness deployment constraint scheduling model comprehensively considers the trapping value score of the asset node corresponding to each target weakness configuration, the resource idleness and business interference tolerance of the target node location. The trapping value score represents the trapping profit capability of the target weakness configuration, the resource idleness represents the current resource surplus status of the deployment target location, and the business interference tolerance is used to quantify the acceptable impact range of the deployment on the business system. The three are weighted by the policy adjustment parameters to form a deployment priority function. The deployment priority function is used to measure the deployment priority of the target weakness configuration. The larger the value of the deployment priority function, the more suitable the target weakness configuration is for priority deployment.

[0064] S64. Sort all target vulnerability configurations according to the deployment priority function, and generate a vulnerability deployment plan based on the resource distribution map and the business operation window schedulable strategy. The vulnerability deployment plan is used to determine the deployment location, deployment time, and deployment method of each target vulnerability configuration in the actual network environment.

[0065] S65. Inject the target vulnerability configuration into a predetermined network location according to the vulnerability deployment plan. The predetermined network location includes a physical node, a virtual node, a container environment, or an isolated partition. Activate the vulnerability configuration on the corresponding asset node, and form a vulnerability bait node after activation.

[0066] S66. A traceable audit hook is implanted in each vulnerability decoy node. The traceable audit hook is used to record the behavior trajectory of external visitors to the vulnerability decoy node. The behavior trajectory includes port detection, service interaction, vulnerability exploitation and lateral movement attempts. The behavior trajectory will be used for subsequent attack path map updates and generative adversarial network retraining.

[0067] S67. Logically group all successfully deployed weakness decoy nodes to form a weakness decoy cluster. The weakness decoy cluster serves as the core decoy area of ​​the network decoy system and participates in subsequent decoy interaction analysis and dynamic optimization.

[0068] The beneficial effects of the present invention are:

[0069] The closed-loop learning mechanism of the present invention collects attack behavior logs in real time through traceable audit hooks on bait nodes, feeds interaction data into the attack path diagram and generation network, continuously iterates and optimizes the trapping strategy, and realizes adaptive threat guidance and trapping system evolution.

[0070] The present invention designs a dual discriminator + weakness security constraint structure. The first discriminator uses fine-grained hierarchical feature comparison to effectively constrain the local consistency between generated samples and real weaknesses. The second discriminator determines the consistency between candidate weaknesses and attack path graph conditions based on the semantic attention mechanism. The weakness security constraint module quantifies the business risk of the generated configuration to ensure that the output samples never break the security baseline. Through comprehensive discrimination and constraint optimization, the unity of high capture value and low business risk is achieved. BRIEF DESCRIPTION OF THE DRAWINGS

[0071] The accompanying drawings are used to provide a further understanding of the present invention and constitute a part of the specification. Together with the embodiments of the present invention, they are used to explain the present invention and do not constitute a limitation of the present invention. In the accompanying drawings:

[0072] Figure 1 This is a flowchart of a network defense system vulnerability simulation method based on a generative adversarial network proposed by the present invention. DETAILED DESCRIPTION

[0073] The present invention will now be described in further detail with reference to the accompanying drawings, which are simplified schematic diagrams that illustrate the basic structure of the present invention in a schematic manner.

[0074] refer to Figure 1 , a network defense system vulnerability simulation method based on generative adversarial network, including:

[0075] S1. Generate cybersecurity situational awareness dataset;

[0076] S2. Construct a directed multi-attribute attack path graph based on the cybersecurity situational awareness dataset and assign weights based on asset nodes, vulnerability edges, and permission relationships to obtain a weighted attack path graph.

[0077] S3. Perform graph semantic encoding on the weighted attack path graph and map the condition vector set;

[0078] S4. Initialize the conditional generative adversarial network, use the random noise vector and the condition vector set as input, train the generator to output the candidate vulnerability configuration set, and obtain the converged candidate vulnerability configuration set;

[0079] S5. Map the converged candidate vulnerability configuration set to a weighted attack path graph. Invoke the vulnerability assessment model to comprehensively score the asset nodes to which the candidate vulnerability configuration set belongs in the weighted attack path graph. Filter out target vulnerability configurations based on the comprehensive score, business impact threshold, and security baseline constraints, and generate a target vulnerability configuration list.

[0080] S6. Input the target vulnerability configuration list into the security orchestration automation module to generate a vulnerability deployment plan. According to the vulnerability deployment plan, vulnerability decoy nodes are deployed at predetermined network locations. The target vulnerability configuration is injected into the corresponding asset nodes, along with traceable audit hooks, to form a vulnerability decoy cluster.

[0081] S7. Collect detection behavior logs, exploitation behavior logs, and lateral movement behavior logs for the vulnerability bait cluster in real time to generate an attacker interaction behavior dataset. Update the weighted attack path graph and conditional vector set based on the attacker interaction behavior dataset, and perform online fine-tuning on the conditional generative adversarial network to re-execute steps S5 and S6.

[0082] Optionally, the generation of the network security situation awareness data set includes collecting asset inventory information, vulnerability scanning results, traffic log data and security alert data, and performing format unification, field regularization and time alignment processing.

[0083] Optionally, S2 includes the following steps:

[0084] S21. Define each asset in the cybersecurity situation awareness dataset as an asset node;

[0085] Each asset node includes a device type, IP address, operating system type, and an open service combination, which are used to describe the basic network attributes of the asset node.

[0086] S22. For each asset node with a known vulnerability, extract the vulnerability identifier based on the vulnerability scan results and create a directed edge for the vulnerability in the attack path graph;

[0087] The directed edges are accompanied by vulnerability attribute labels, which include vulnerability numbers and vulnerability score values. The vulnerability numbers and vulnerability score values ​​are used to identify the uniqueness of the vulnerability and quantify the severity of the vulnerability.

[0088] S23. Analyze the connection relationship between asset nodes based on traffic log data, extract the permission call relationship, and establish permission edges in the attack path graph for asset nodes with access rights;

[0089] The permission level label is attached to the permission side. The permission level label includes read permission, write permission, execute permission and administrator permission. Different permission types correspond to different risk levels.

[0090] S24. Construct an attack path graph. The attack path graph consists of a set of asset nodes and a set of directed edges. The directed edge set includes all directed edges formed by vulnerability relationships and permission relationships. The attack path graph is used to describe the dependencies and propagation relationships between assets, vulnerabilities, and permissions in the network.

[0091] S25. Assign a risk weight value to each directed edge in the attack path graph;

[0092] The risk weight value is obtained by weighted calculation of the vulnerability scoring factor, permission risk factor and business importance weight. The vulnerability scoring factor is taken as the vulnerability score value, the permission risk factor is mapped to a risk value based on the permission level label, and the business importance weight is derived from the business system label in the security situation awareness dataset. The risk weight value is used to comprehensively measure the vulnerability risk, permission risk and business impact of the connection between asset nodes.

[0093] S26. Calculate the cumulative risk value of the outbound edge set of each asset node in the attack path graph. The cumulative risk value is the sum of the risk weight values ​​of all outbound edges of the asset node. The cumulative risk value is used to measure the attack propagation tendency of the asset node in the attack path graph.

[0094] Optionally, S3 includes the following steps:

[0095] S31. Extract the basic attributes of each asset node in the weighted attack path graph, and encode the device type, operating system type, IP address, and open service combination of the asset node through the asset node attribute embedding encoding function to obtain the asset node attribute vector. The asset node attribute vector is used to represent the basic network semantic characteristics of the asset node;

[0096] S32. Extract the risk weight value of each directed edge in the weighted attack path graph, combine each risk weight value with its edge type, and obtain a risk edge vector;

[0097] The risk edge vector includes the risk weight value, the vulnerability edge flag and the permission edge flag. The risk edge vector is used to characterize the risk channel structure in the asset connection.

[0098] S33. Calculate the path probability value for each attack path from a potential attack source node to a target key node in the weighted attack path graph;

[0099] The path probability value is the product of the risk weight values ​​of all edges on the path. The path probability value is used to quantify the possibility of an attacker choosing the path. All path probability values ​​constitute the path probability distribution set.

[0100] S34. Extract the business importance weight of each asset node in the weighted attack path graph. The business importance weight is derived from the business system label. The business importance weight is normalized to obtain the normalized business importance weight.

[0101] S35. Generate an attacker preference feature vector based on attack history data and behavior profiles;

[0102] The attacker preference feature vector includes the vulnerability type, access path tendency and target asset attributes that the attacker prefers to attack. The attacker preference feature vector is combined with the asset node attribute vector, risk edge vector, path probability value and normalized business importance weight to form a complete contextual semantics.

[0103] S36. Concatenate the asset node attribute vector, risk edge vector, path probability distribution set, normalized business importance weight, and attacker preference feature vector to jointly construct a conditional vector set.

[0104] Optionally, the S4 includes the following steps:

[0105] S41. Initialize a conditional generative adversarial network model, wherein the conditional generative adversarial network model includes a generator, a first discriminator, a second discriminator, and a vulnerability security constraint module;

[0106] S42. Generate a random noise vector;

[0107] Random noise vectors are used to ensure the diversity and randomness of the vulnerability configuration generation process, preventing the generated vulnerability configuration from being easily identified as a fixed pattern by attackers;

[0108] S43. The random noise vector is concatenated with the conditional vector set and then fed into the generator. The generator then adaptively weights the concatenated input features using a hierarchical attention mechanism based on the goal of inducing network defense system weaknesses. This mechanism dynamically captures the importance differences of attack path nodes and edges in the conditional vector set in the network attack and defense context, and outputs a set of candidate vulnerability configurations.

[0109] S44. The candidate vulnerability configuration set and the true vulnerability configuration sample are input into the first discriminator. The first discriminator adopts a hierarchical difference determination strategy for fine-grained differences in vulnerability configuration features and outputs a fine-grained difference determination result of the consistency between the candidate vulnerability configuration set and the true vulnerability configuration sample.

[0110] Used to accurately measure the degree of detail difference between candidate vulnerability configurations and actual network defense system vulnerability characteristics in network attack and defense scenarios;

[0111] S45. The candidate vulnerability configuration set and the corresponding condition vector set are input into the second discriminator. The second discriminator performs a comprehensive attention matching calculation based on the network attack and defense semantic consistency of the vulnerability configuration in the attack path diagram, and outputs the semantic consistency attention matching result between the candidate vulnerability configuration set and the corresponding condition vector set;

[0112] Used to measure whether the candidate vulnerability configuration maintains a high degree of consistency under the attack path topology structure and asset relationship semantics induced by the network defense system vulnerability;

[0113] S46. Construct a vulnerability security constraint module. The vulnerability security constraint module generates a security assessment factor for the vulnerability configuration based on the security baseline constraints. The security assessment factor quantifies the network attack and defense security risk of each candidate vulnerability configuration. A higher security assessment factor value for a candidate vulnerability configuration indicates a greater potential impact on the service security baseline of the real network environment.

[0114] S47. Define a loss function for the generator, where the loss function of the generator includes a comprehensive penalty of the fine-grained difference determination result of the consistency of the first discriminator, the semantic consistency attention matching result of the second discriminator, and the security assessment factor;

[0115] The loss function of the generator is used to guide the generator to generate candidate vulnerability configurations that are both highly realistic under the network defense system weakness induction semantics and do not exceed the security baseline constraint;

[0116] S48. Define loss functions for the first discriminator and the second discriminator. The loss function of the first discriminator is used to constrain its accuracy in determining the fine-grained difference between the candidate vulnerability configuration and the true vulnerability configuration sample. The loss function of the second discriminator is used to constrain its accuracy in determining the semantic consistency attention matching result between the candidate vulnerability configuration and the corresponding condition vector set.

[0117] S49. The loss functions of the generator, the first discriminator, and the second discriminator are alternately optimized through the adversarial learning method, and the network parameters of the generator, the first discriminator, and the second discriminator are iteratively updated until the candidate vulnerability configuration set output by the generator satisfies both the fine-grained difference in consistency with the true vulnerability configuration sample and the semantic consistency attention matching with the corresponding conditional vector set, and both meet the convergence conditions, and the security assessment factor is lower than the set security baseline threshold, thereby obtaining the final converged candidate vulnerability configuration set.

[0118] Optionally, S5 includes the following steps:

[0119] S51. Map the converged candidate vulnerability configuration set output by the generator to the weighted attack path graph, and determine the target asset node associated with each vulnerability configuration in the candidate vulnerability configuration set;

[0120] S52. Calculate the betweenness centrality of each candidate evaluation node in the weighted attack path graph;

[0121] Betweenness centrality is used to measure the proportion of times a candidate evaluation node is passed through in all shortest paths in the attack path graph. The higher the betweenness centrality, the stronger the control power of the node in the potential attack path.

[0122] S53. Calculate the path probability weight for each candidate evaluation node;

[0123] The path probability weight is the sum of the joint propagation probabilities of all attack paths with the candidate evaluation node as the relay node. The propagation probability of a single path is the product of the risk weight values ​​of all edges in the path. The larger the path probability weight, the higher the node's guiding ability in the attack path propagation.

[0124] S54. Extract the normalized business importance weight of each candidate evaluation node;

[0125] The normalized business importance weight is derived from the result of normalization of business system labels and is used to reflect the importance of the business system associated with the candidate evaluation node. The higher the normalized business importance weight, the greater the impact of the node on key businesses.

[0126] S55. For each candidate evaluation node, based on betweenness centrality, path probability weight, and normalized business importance weight, combined with trapping strategy adjustment parameters, a weighted sum and difference is performed to obtain a trapping value score;

[0127] The trapping value score is used to comprehensively measure the balance between the trapping benefits and business risks of the candidate evaluation node. A higher trapping value score indicates that the node is suitable for target vulnerability configuration.

[0128] S56. Sort all candidate evaluation nodes according to the trapping value score, and filter them in combination with the business impact threshold and the network security baseline risk threshold to screen out the target vulnerability configurations and generate a target vulnerability configuration list.

[0129] Optionally, the S6 includes the following steps:

[0130] S61. Input the target vulnerability configuration list into the security orchestration automation module. The security orchestration automation module parses the asset nodes, trapping objectives, and resource requirements corresponding to each target vulnerability configuration in the target vulnerability configuration list. The asset nodes, trapping objectives, and resource requirements are used to subsequently generate a deployment plan.

[0131] S62. Collect the operating status information in the current network environment. The operating status information includes network resource occupancy, system load status and business operation window information. The network resource occupancy indicates the remaining amount of computing resources of each physical node or virtual node. The system load status indicates the average CPU and memory usage per unit time. The business operation window information indicates the scheduling authority range for business critical periods and non-critical periods.

[0132] S63. Construct a weakness deployment constraint scheduling model. The weakness deployment constraint scheduling model comprehensively considers the trapping value score of the asset node corresponding to each target weakness configuration, the resource idleness and business interference tolerance of the target node location. The trapping value score represents the trapping profit capability of the target weakness configuration, the resource idleness represents the current resource surplus status of the deployment target location, and the business interference tolerance is used to quantify the acceptable impact range of the deployment on the business system. The three are weighted by the policy adjustment parameters to form a deployment priority function. The deployment priority function is used to measure the deployment priority of the target weakness configuration. The larger the value of the deployment priority function, the more suitable the target weakness configuration is for priority deployment.

[0133] S64. Sort all target vulnerability configurations according to the deployment priority function, and generate a vulnerability deployment plan based on the resource distribution map and the business operation window schedulable strategy. The vulnerability deployment plan is used to determine the deployment location, deployment time, and deployment method of each target vulnerability configuration in the actual network environment.

[0134] S65. Inject the target vulnerability configuration into a predetermined network location according to the vulnerability deployment plan. The predetermined network location includes a physical node, a virtual node, a container environment, or an isolated partition. Activate the vulnerability configuration on the corresponding asset node, and form a vulnerability bait node after activation.

[0135] S66. A traceable audit hook is implanted in each vulnerability decoy node. The traceable audit hook is used to record the behavior trajectory of external visitors to the vulnerability decoy node. The behavior trajectory includes port detection, service interaction, vulnerability exploitation and lateral movement attempts. The behavior trajectory will be used for subsequent attack path map updates and generative adversarial network retraining.

[0136] S67. Logically group all successfully deployed weakness decoy nodes to form a weakness decoy cluster. The weakness decoy cluster serves as the core decoy area of ​​the network decoy system and participates in subsequent decoy interaction analysis and dynamic optimization.

[0137] Example 1: In the data center of a large financial technology company, the network infrastructure is huge, including hundreds of physical servers, dozens of virtualization clusters, and massive business application systems. The company has always attached great importance to information security. However, with the increasing frequency of advanced persistent threats (APTs), ransomware attacks, and targeted infiltration, the traditional honeypot-based trapping solution has gradually exposed its shortcomings, such as templated deployment, weak trapping effect, easy identification and bypass of bait, separation of the trapping network from the real business environment, incomplete acquisition of attack chain information, and inability to dynamically adjust the deployment according to the threat. In response to this, the company decided to adopt the present invention - "Network Defense System Vulnerability Induction Method Based on the Fusion of Conditional Generative Adversarial Network and Attack Path Graph" to achieve active, efficient, and intelligent trapping defense.

[0138] In April 2025, the company deployed the above-mentioned defense system in the IDC area of ​​the East China headquarters, connecting it to the asset management platform, security situation awareness platform, traffic monitoring platform and automated security orchestration platform. The system first collected the current data center asset list in full, including 1,275 physical servers, 840 virtual nodes, 1,251 database instances and more than 350 business subsystems. The vulnerability scanning engine simultaneously outputs the latest high-risk vulnerabilities (CVE-2024-15829, etc.) and configuration defect information. The network traffic logs for the past month (March-April 2025) totaled 3.2TB, involving thousands of security alerts such as lateral detection, abnormal logins, and unauthorized access.

[0139] By standardizing formats and fields, the system generates a structured cybersecurity situational awareness dataset. This dataset covers each asset node's device type (e.g., web server / database server / middleware node), operating system (Linux / Windows), IP address, port distribution, service fingerprint, and historical alert tags. Asset nodes, vulnerability edges, and permission relationships are combined to form a directed multi-attribute attack path graph. All nodes and edges are assigned risk weights based on CVSS scores, business weights, and external intelligence. For example, database node "db-101" has a CVSS score of 9.6 due to the high-risk vulnerability CVE-2024-15829 and is a core node for settlement services, so its business weight is set to 0.95. The vulnerability edge connecting "web-55" to "db-101" has a risk weight of 0.83, while the high-privilege access edge connecting "jump-07" to "web-55" has a weight of 0.76.

[0140] On this basis, the system performs graph semantic encoding on each asset node and edge, converting the node's attributes such as device type, operating system type, IP address, and open service combination into vector form. The risk weight, path probability distribution, and business importance weight are all quantified and embedded in the conditional vector set together with the attacker's preferences (such as target database-type assets, preferred lateral penetration paths, etc.), ultimately forming a complete semantic context input.

[0141] The system starts a conditional generative adversarial network and inputs the above-mentioned conditional vector set and Gaussian noise. The generator uses a hierarchical attention mechanism to weight different nodes and edges to achieve local adaptation. After initial training, the generator automatically synthesizes multiple candidate vulnerability configuration samples, such as automatically generating an open Redis 6379 weak password service, simulating real business log residues, and formulating strategically controllable file write permissions. The first discriminator compares historical vulnerability configuration samples collected from real production environments (such as the "oracle-db test instance default password" that has been exploited in reality) and scores the feature similarity of candidate samples. The second discriminator combines the context of the attack path graph to determine the semantic consistency between the generated sample and the conditional vector, and focuses on whether the bait is reasonable with the real business logic and service combination.

[0142] The system's vulnerability security constraint module automatically screens out high-risk decoys that don't meet security baselines. For example, it rejects vulnerabilities that could be exploited laterally in core production databases, allowing only highly interactive pseudo-vulnerabilities to be exposed. Ultimately, after 100 rounds of adversarial learning training, the candidate vulnerability configuration set converged stably, taking an average of 4 minutes per round with a training set of 4,500 samples. After convergence, the average discriminator error rate was less than 1.7%.

[0143] For each candidate vulnerability, the system automatically maps it to an attack path graph and calculates betweenness centrality, path probability weight, and normalized business importance weight. For example, the "web-55" node ranks in the top 10% in betweenness centrality and is traversed by 19 of the 30 possible attack paths. Its cumulative path probability weight is 0.73, and its business importance weight is 0.41. After comprehensively evaluating the decoy value scores, 14 nodes, including "web-55," "app-102," and "proxy-10," were selected as targets for this round of decoy deployment.

[0144] The security orchestration automation module generates a detailed deployment plan based on current resource usage (average CPU utilization of 32%, 18GB of memory remaining per node), the business operation window (maintenance period from 2:00 PM to 6:00 PM), and the priority of the deception operation. It automatically injects the target vulnerability configuration into nine physical nodes and five virtual nodes. All deployments are embedded with traceable audit hooks, recording the entire process of external connections, command injection, unauthorized access, and other operations, and collecting them in a security log server.

[0145] During the first week of implementation (April 7 to April 13, 2025), the system detected 426 external scanning behaviors, 41 abnormal interactions, and six simulated intrusions by the real-world attack drill team. All detected events were tracked in detail, triggering source tracing and alerting. In the same business scenario, the enterprise also compared the effectiveness of traditional template-based honeypots (such as classic low-interaction web honeypots and static port decoys) to detect malicious activity. The comparison data is as follows:

[0146] The method of the present invention lured a real attack drill team 6 times and captured all the details of the attack chain. The traditional template honeypot only lured it once and did not fully restore the attack path.

[0147] The false alarm rate of the method of the present invention is 2.4%, while the false alarm rate of the traditional template honeypot is 8.1%.

[0148] The average time for tracing the source of the trapping event by the method of the present invention is 5.1 minutes, while that of the traditional template honeypot is 18.4 minutes.

[0149] The time from deployment to first effective trapping for the proposed method is 2.8 hours, while that for traditional template honeypots is 10.2 hours. In the training samples, the average fingerprint similarity between the pseudo-vulnerability configurations collected by the proposed method and real historical vulnerabilities is 0.94, while that for traditional template honeypots is 0.62.

[0150] In the trapping event data, the attack probability of the trapped nodes by the method of the present invention is significantly higher than that of the non-trapped nodes (0.29 for the trapped nodes and 0.08 for the non-trapped nodes).

[0151] In addition, the following are some sample data for training and production operation of the method of the present invention (forged examples):

[0152] Training samples:

[0153] Real vulnerability sample: {asset type: database, OS: Linux, service: mysql 3306, configuration: root / 123456, historical utilization: high};

[0154] Generated vulnerability sample: {asset type: database, OS: Linux, service: mysql 3306, configuration: root / test123, historical utilization: high};

[0155] Real vulnerability sample: {asset type: Web service, OS: Windows, service: IIS 80, configuration: default page, historical utilization: medium};

[0156] Generated vulnerability sample: {asset type: Web service, OS: Windows, service: IIS 80, configuration: simulated default page, historical utilization: medium};

[0157] Actual operation:

[0158] Trapped into an APT attack team that exploits the CVE-2024-15829 vulnerability to attempt horizontal penetration, and is induced into a quarantine honeypot, the attack chain is restored. Trapped into an automated scanning tool that misjudges a fake FTP weak password node, does not mislead the real production environment. Trapped into a new malicious script that tries to access a high-interactive Redis weak password node multiple times, all interaction data is archived in real time.

[0159] The vulnerability induction method of the network defense system based on the condition generation adversarial network and the attack path graph fusion provided by the application, through the multi-level innovative fusion and algorithm design, significantly improves the authenticity, dynamic, controllability and induction efficiency of the network trapping system, which is embodied in the following aspects:

[0160] Firstly, the application collects network security situation awareness data, integrates and time-aligns asset list information, vulnerability scanning results, traffic log data and security alarm data, and constructs a high-fidelity weighted attack path graph, realizing accurate modeling of complex network topology and fragile face distribution.

[0161] In the construction of the weighted attack path graph, the application clearly integrates multi-source heterogeneous data such as asset nodes, vulnerability edges, permission relationships and business importance into a unified graph structure, and jointly weights the vulnerability scoring factor, permission risk factor and business importance weight, so that the attack path graph not only reflects the threat transmission channel, but also quantifies the asset business value and network risk, providing a measurable and traceable graph semantic environment for the vulnerability induction link.

[0162] In the conditional generative adversarial network design, the application innovatively introduces a feature self-adaptive weighting algorithm based on a hierarchical attention mechanism, encodes the context information of nodes and edges in the attack path graph into a conditional vector, fuses asset attributes, path probability distribution, business impact weight and attacker preference features, and realizes "graph-generation" deep semantic alignment. Compared with the traditional honeypot scheme which only relies on templates or rules, the method can generate "highly similar, controllable and credible" pseudo-weakness configurations in real time, effectively preventing attackers from bypassing through fingerprint identification.

[0163] In the generative adversarial training phase, the application designs a double discriminator + weakness security constraint structure, the first discriminator adopts fine-grained hierarchical feature comparison, effectively constraining the local consistency of generated samples and real weaknesses, the second discriminator determines the consistency of candidate weaknesses and attack path graph conditions based on semantic attention mechanism, and the weakness security constraint module quantifies the business risk of the generated configuration, ensuring that the output sample always does not break the security baseline. Through comprehensive discrimination and constraint optimization, the mechanism realizes the unification of high trapping value and low business risk.

[0164] In the weakness evaluation and screening link, the application proposes a comprehensive evaluation algorithm of trapping value, which combines node betweenness centrality, path probability weight and normalized business impact weight, uses adjustable strategy parameters for weighted balance, effectively selects target weaknesses with high value and low interference, cooperates with dynamic resource scheduling and business window restriction, realizes optimal deployment through a security orchestration automation platform, and forms a continuously evolving and elastic weakness decoy cluster.

[0165] Finally, the closed-loop learning mechanism of the application realizes real-time collection of attack behavior logs through traceable audit hooks on decoy nodes, feeds back the interaction data to the attack path graph and the generation network, continuously iteratively optimizes the trapping strategy, and realizes adaptive threat guidance and evolution of the trapping system.

[0166] The above is only the preferred specific embodiment of the application, but the protection scope of the application is not limited thereto, any person skilled in the art can make equivalent replacement or change according to the technical solution and inventive concept of the application within the technical range disclosed by the application, which should be covered within the protection scope of the application.

Claims

1. A network defense system vulnerability simulation method based on generative adversarial networks, characterized in that: include: S1. Generate cybersecurity situational awareness dataset; S2. Construct a directed multi-attribute attack path graph based on the cybersecurity situational awareness dataset and assign weights based on asset nodes, vulnerability edges, and permission relationships to obtain a weighted attack path graph. S3. Perform graph semantic encoding on the weighted attack path graph and map the condition vector set; S4. Initialize the conditional generative adversarial network, use the random noise vector and the condition vector set as input, train the generator to output the candidate vulnerability configuration set, and obtain the converged candidate vulnerability configuration set; S5. Map the converged candidate vulnerability configuration set to a weighted attack path graph. Invoke the vulnerability assessment model to comprehensively score the asset nodes to which the candidate vulnerability configuration set belongs in the weighted attack path graph. Filter out target vulnerability configurations based on the comprehensive score, business impact threshold, and security baseline constraints, and generate a target vulnerability configuration list. S6. Input the target vulnerability configuration list into the security orchestration automation module to generate a vulnerability deployment plan. According to the vulnerability deployment plan, vulnerability decoy nodes are deployed at predetermined network locations. The target vulnerability configuration is injected into the corresponding asset nodes, along with traceable audit hooks, to form a vulnerability decoy cluster. S7. Collect detection behavior logs, exploitation behavior logs, and lateral movement behavior logs for the vulnerability bait cluster in real time to generate an attacker interaction behavior dataset. Update the weighted attack path graph and conditional vector set based on the attacker interaction behavior dataset, and perform online fine-tuning on the conditional generative adversarial network to re-execute steps S5 and S6.

2. A network defense system vulnerability simulation method based on generative adversarial network according to claim 1, characterized in that: The generation of the network security situation awareness data set includes collecting asset inventory information, vulnerability scanning results, traffic log data and security alarm data, and performing format unification, field regularization and time alignment processing.

3. The method for simulating network defense system vulnerabilities based on a generative adversarial network according to claim 2, characterized in that: The S2 comprises the following steps: S21. Define each asset in the cybersecurity situation awareness dataset as an asset node; S22. For each asset node with a known vulnerability, extract the vulnerability identifier based on the vulnerability scan results and create a directed edge for the vulnerability in the attack path graph; S23. Analyze the connection relationship between asset nodes based on traffic log data, extract the permission call relationship, and establish permission edges in the attack path graph for asset nodes with access rights; S24. Construct an attack path graph. The attack path graph consists of a set of asset nodes and a set of directed edges. The directed edge set includes all directed edges formed by vulnerability relationships and permission relationships. The attack path graph is used to describe the dependencies and propagation relationships between assets, vulnerabilities, and permissions in the network. S25. Assign a risk weight value to each directed edge in the attack path graph; S26. Calculate the cumulative risk value of the outbound edge set of each asset node in the attack path graph. The cumulative risk value is the sum of the risk weight values ​​of all outbound edges of the asset node. The cumulative risk value is used to measure the attack propagation tendency of the asset node in the attack path graph.

4. The method for simulating network defense system vulnerabilities based on a generative adversarial network according to claim 3, characterized in that: The S3 comprises the following steps: S31. Extract the basic attributes of each asset node in the weighted attack path graph, and encode the device type, operating system type, IP address, and open service combination of the asset node through the asset node attribute embedding encoding function to obtain the asset node attribute vector; S32. Extract the risk weight value of each directed edge in the weighted attack path graph, combine each risk weight value with its edge type, and obtain a risk edge vector; S33. Calculate the path probability value for each attack path from a potential attack source node to a target key node in the weighted attack path graph; S34. Extract the business importance weight of each asset node in the weighted attack path graph. The business importance weight is derived from the business system label. The business importance weight is normalized to obtain the normalized business importance weight. S35. Generate an attacker preference feature vector based on attack history data and behavior profiles; S36. Concatenate the asset node attribute vector, risk edge vector, path probability distribution set, normalized business importance weight, and attacker preference feature vector to jointly construct a conditional vector set.

5. The method for simulating network defense system vulnerabilities based on a generative adversarial network according to claim 4, characterized in that: The S4 comprises the following steps: S41. Initialize a conditional generative adversarial network model, wherein the conditional generative adversarial network model includes a generator, a first discriminator, a second discriminator, and a vulnerability security constraint module; S42. Generate a random noise vector; S43. The random noise vector is concatenated with the conditional vector set and then fed into the generator. The generator then adaptively weights the concatenated input features using a hierarchical attention mechanism based on the goal of inducing network defense system weaknesses. This mechanism dynamically captures the importance differences of attack path nodes and edges in the conditional vector set in the network attack and defense context, and outputs a set of candidate vulnerability configurations. S44. The candidate vulnerability configuration set and the true vulnerability configuration sample are input into the first discriminator. The first discriminator adopts a hierarchical difference determination strategy for fine-grained differences in vulnerability configuration features and outputs a fine-grained difference determination result of the consistency between the candidate vulnerability configuration set and the true vulnerability configuration sample. S45. The candidate vulnerability configuration set and the corresponding condition vector set are input into the second discriminator. The second discriminator performs a comprehensive attention matching calculation based on the network attack and defense semantic consistency of the vulnerability configuration in the attack path diagram, and outputs the semantic consistency attention matching result between the candidate vulnerability configuration set and the corresponding condition vector set; S46. Construct a vulnerability security constraint module. The vulnerability security constraint module generates a security assessment factor for the vulnerability configuration based on the security baseline constraint. The security assessment factor quantifies the network attack and defense security risk of each candidate vulnerability configuration. S47. Define a loss function for the generator, where the loss function of the generator includes a comprehensive penalty of the fine-grained difference determination result of the consistency of the first discriminator, the semantic consistency attention matching result of the second discriminator, and the security assessment factor; S48. Define loss functions for the first discriminator and the second discriminator. The loss function of the first discriminator is used to constrain its accuracy in determining the fine-grained difference between the candidate vulnerability configuration and the true vulnerability configuration sample. The loss function of the second discriminator is used to constrain its accuracy in determining the semantic consistency attention matching result between the candidate vulnerability configuration and the corresponding condition vector set. S49. The loss functions of the generator, the first discriminator, and the second discriminator are alternately optimized through the adversarial learning method, and the network parameters of the generator, the first discriminator, and the second discriminator are iteratively updated until the candidate vulnerability configuration set output by the generator satisfies both the fine-grained difference in consistency with the true vulnerability configuration sample and the semantic consistency attention matching with the corresponding conditional vector set, and both meet the convergence conditions, and the security assessment factor is lower than the set security baseline threshold, thereby obtaining the final converged candidate vulnerability configuration set.

6. A network defense system vulnerability simulation method based on generative adversarial network according to claim 5, characterized in that: The S5 comprises the following steps: S51. Map the converged candidate vulnerability configuration set output by the generator to the weighted attack path graph, and determine the target asset node associated with each vulnerability configuration in the candidate vulnerability configuration set; S52. Calculate the betweenness centrality of each candidate evaluation node in the weighted attack path graph; S53. Calculate the path probability weight for each candidate evaluation node; S54. Extract the normalized business importance weight of each candidate evaluation node; S55. For each candidate evaluation node, based on betweenness centrality, path probability weight, and normalized business importance weight, combined with trapping strategy adjustment parameters, a weighted sum and difference is performed to obtain a trapping value score; S56. Sort all candidate evaluation nodes according to the trapping value score, and filter them in combination with the business impact threshold and the network security baseline risk threshold to screen out the target vulnerability configurations and generate a target vulnerability configuration list.

7. A network defense system vulnerability simulation method based on generative adversarial network according to claim 6, characterized in that: The S6 comprises the following steps: S61. Input the target vulnerability configuration list into the security orchestration automation module. The security orchestration automation module parses the target vulnerability configuration list to identify the asset nodes, trapping objectives, and resource requirements corresponding to each target vulnerability configuration. The asset nodes, trapping objectives, and resource requirements are used to generate a deployment plan. S62. Collect the operating status information in the current network environment, including network resource occupancy, system load status, and business operation window information. The network resource occupancy indicates the remaining computing resources of each physical node or virtual node, the system load status indicates the average CPU and memory usage per unit time, and the business operation window information indicates the scheduling authority range for business critical and non-critical periods; S63. Construct a vulnerability deployment constraint scheduling model. The vulnerability deployment constraint scheduling model comprehensively considers the trapping value score of each target vulnerability configuration corresponding to the asset node, the resource slack at the target node's location, and the service interference tolerance. The trapping value score represents the trapping profitability of the target vulnerability configuration, and the resource slack represents the current resource surplus status at the deployment target location. These three factors are weighted by policy adjustment parameters to form a deployment priority function. S64. Sort all target vulnerability configurations according to the deployment priority function, combine the resource distribution map and the business operation window scheduling strategy to generate a vulnerability deployment plan, which is used to determine the deployment location, deployment time, and deployment method of each target vulnerability configuration in the actual network environment; S65. Inject the target vulnerability configuration into a predetermined network location according to the vulnerability deployment plan. The predetermined network location may include a physical node, a virtual node, a container environment, or an isolated partition. Activate the vulnerability configuration on the corresponding asset node, forming a vulnerability decoy node after activation. S66. Embed a traceable audit hook in each vulnerability decoy node. The traceable audit hook is used to record the behavior of external visitors to the vulnerability decoy node, including port probing, service interaction, vulnerability exploitation, and lateral movement attempts. S67. Logically group all successfully deployed vulnerability decoy nodes to form a vulnerability decoy cluster.

Images