An important activity network security attack early warning method

Abstract

The application provides a kind of important activity network security attack early warning method before including: according to the system features of heavy protection system, construct deception system, deception system includes Web real-time communication module and multiple simulation interaction module, design false login function, the deception system is deployed in cloud server;Attack record of deception system and attack record of heavy protection system are de-duplication processing and obtain attack record set;Analysis of the access behavior information of attacker determines the type of attacker, design targeted defense measures;Generate early warning report and send early warning report and targeted defense measures to heavy protection system.The application of the method can collect data through the deception system, dynamically generate a security warning report and assess the risk of the attacker.Based on the early warning results, the heavy protection system can be guided to take defensive measures to improve the defense capabilities.The deception capability and dynamic defense level of the heavy protection system can be effectively enhanced, and the ability to deal with advanced persistent threats is improved.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a method for early warning of network security attacks on important events. Background Technology

[0002] With the development of cyberattacks, major events have become new targets. Due to their public accessibility, major events face severe cyber threats, and as time-sensitive systems, they often have short lifecycles and high attack value. Therefore, developing effective early warning mechanisms for major event systems is crucial for protecting these systems.

[0003] To address the system protection challenges of critical events, critical event network security systems typically employ proactive defense by filtering malicious attacker IPs in advance. Attacker identification generally utilizes two methods: filtering malicious attackers based on threat intelligence and proactively capturing attackers using honeypots. However, these techniques lack the ability to detect and intercept potential attacker behavior in advance, making effective early warning difficult.

[0004] Threat intelligence is a dataset recording attacker behavior. However, publicly available threat intelligence records often contain overly broad information about attackers and lack specificity for defense targets. Closed-source threat intelligence records, while often targeted at key activities, suffer from significant data lag in collection, relying solely on historical data for intelligence gathering. This makes them ill-suited for proactive defense against key activities over a timeline. Furthermore, firewall filtering systems based on threat intelligence struggle to defend against new types of attackers; they become completely ineffective if the attacker is no longer part of the threat intelligence database.

[0005] Honeypots, as a traditional proactive defense device, defend protected systems by creating fake services to attract attackers. Due to cost constraints, honeypots are typically set up as a single, non-interactive page, only recording attacker requests and struggling to effectively infer the intentions of different attackers. Secondly, honeypots are usually located as subdomains of the protected system. When attackers perform domain analysis, they are lured to access subdomains other than the business function domain to capture attackers. Therefore, this honeypot deployment strategy is ineffective for proactive defense. Often, while the domain is detected, attackers simultaneously attack the real business system, rather than targeting the honeypot in the non-business system's subdomain. Thus, this method of proactively capturing attackers through honeypots is insufficient for pre-emptive defense of critical systems.

[0006] Therefore, it is necessary to provide a forward-looking early warning method for critical protection systems in order to improve the dynamic defense level of critical protection systems. Summary of the Invention

[0007] The purpose of this invention is to provide a method for early warning of cybersecurity attacks during important events, so as to improve the dynamic defense level of critical protection systems.

[0008] Firstly, the method for early warning of cybersecurity attacks on critical activities provided by this invention includes: extracting system characteristics of the critical protection system; constructing a deception system based on the system characteristics, the deception system including a Web real-time communication module and multiple simulated interaction modules; designing fake login functions for the multiple simulated interaction modules; deploying the deception system in a cloud server; and opening the interface access function of the deception system; monitoring and recording attack records of the deception system; obtaining attack records of the critical protection system; deduplicating the attack records of the deception system and the attack records of the critical protection system to obtain an attack record set; analyzing the attack record set to obtain attacker access behavior information; classifying attackers according to the access behavior information to determine attacker types; designing targeted defense measures based on attacker types; generating an early warning report based on the attacker access behavior information and the determined attacker types; and sending the early warning report and targeted defense measures to the critical protection system.

[0009] The beneficial effects of the critical network security attack early warning method provided by this invention are as follows: It collects data by deceiving the system, dynamically generates security early warning reports, and conducts risk assessments of attackers. Based on the early warning results, it can guide the critical security system to take defensive measures and improve its defense capabilities. It can effectively enhance the deception capability and dynamic defense level of the critical security system, and improve its ability to cope with advanced persistent threats.

[0010] In one possible embodiment, the Web real-time communication module is used to communicate with the attacker in real time to obtain the attacker's real IP address. The attack records of the deception system include the attacker's real IP address. The module monitors and records the attack records of the deception system, and performs deduplication processing on the attack records of the deception system and the attack records of the security system to obtain a set of attack records. This includes: monitoring the attack access information received by the deception system, merging the attack access information according to the attacker's real IP address to obtain the attack records of the deception system; comparing the attack records of the deception system and the attack records of the security system to determine duplicate records, and performing deduplication processing on the duplicate records to obtain a set of attack records.

[0011] In another possible embodiment, the attacker's access behavior information is obtained by analyzing the attack record set. The attacker is then classified and the attacker type is determined based on the access behavior information. This includes: obtaining the attacker's access behavior information by statistically analyzing the attacker's access content and intrusion behavior based on the attack record set; determining that attackers who make multiple attack attempts or take actual intrusion actions within a set time unit are malicious attackers, determining that attackers who do not make attack attempts but access multiple secondary interfaces are curious attackers, and determining that attackers who only access the primary interface are probing attackers.

[0012] Other possible embodiments include designing targeted defense measures based on attacker type, including: defense measures against malicious attackers include blocking IPs and blocking access; defense measures against curious attackers include strengthening the security policy of the simulated interaction module accessed by curious attackers and restricting access; and defense measures against probing attackers include marking probing attackers and continuously monitoring their access information.

[0013] After analyzing the attack log set to obtain the attacker's access behavior information, the system also includes: strengthening the local threat intelligence of the security protection system based on the access behavior information. The local threat intelligence includes the attacker's IP, attacker attributes, attack time, access frequency, access module, and attack commands.

[0014] Dynamic defense strategies for the critical protection system are generated based on early warning reports and local threat intelligence; dynamic defense strategies include setting up CAPTCHAs and access restrictions.

[0015] Extract the system features of the critical protection system, including: extract the interface style, interaction logic and functional modules of the critical protection system.

[0016] Secondly, this invention also provides a pre-warning device for cybersecurity attacks on critical events, comprising: a deception system construction unit, used to extract system characteristics of the critical protection system, construct a deception system based on the system characteristics, the deception system including a Web real-time communication module and multiple simulated interaction modules, designing fake login functions for the multiple simulated interaction modules, deploying the deception system in a cloud server, and opening the interface access function of the deception system; a monitoring unit, used to monitor and record attack records of the deception system, obtain attack records of the critical protection system, and perform deduplication processing on the attack records of the deception system and the attack records of the critical protection system to obtain an attack record set; an analysis unit, used to analyze the attack record set to obtain attacker access behavior information, classify attackers according to the access behavior information to determine the attacker type, and design targeted defense measures based on the attacker type; and an early warning unit, used to generate an early warning report based on the attacker access behavior information and the determined attacker type, and send the early warning report and targeted defense measures to the critical protection system.

[0017] Thirdly, the present invention also provides a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the aforementioned method for early warning of cybersecurity attacks on important activities.

[0018] Fourthly, the present invention also provides an electronic device, comprising: a processor and a memory; the memory being used to store a computer program; the processor being used to execute the computer program stored in the memory, so that the electronic device performs the aforementioned method for early warning of cybersecurity attacks on important activities.

[0019] For the beneficial effects of the second to fourth aspects mentioned above, please refer to the description of the first aspect mentioned above. Attached Figure Description

[0020] Figure 1 A flowchart illustrating a method for early warning of cybersecurity attacks on important activities, provided by an embodiment of the present invention;

[0021] Figure 2 A schematic diagram of the architecture of a method for early warning of cybersecurity attacks on important activities provided by an embodiment of the present invention;

[0022] Figure 3 A schematic diagram of an early warning device for cybersecurity attacks on important activities provided in an embodiment of the present invention;

[0023] Figure 4 This is a schematic diagram of an electronic device structure provided in an embodiment of the present invention. Detailed Implementation

[0024] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions in the embodiments of this invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this invention. All other embodiments obtained by those skilled in the art based on the embodiments of this invention without inventive effort are within the scope of protection of this invention. Unless otherwise defined, the technical or scientific terms used herein should have the ordinary meaning understood by those skilled in the art. The terms "comprising" and similar expressions used herein mean that the element or object preceding the word covers the element or object listed following the word and its equivalents, but do not exclude other elements or objects.

[0025] This embodiment provides a method, device, medium, and electronic device for early warning of cybersecurity attacks on important events.

[0026] See Figure 1 and Figure 2Methods for early warning of cybersecurity attacks during important events include:

[0027] S101: Extract the system characteristics of the critical protection system, construct a deception system based on the system characteristics, the deception system includes a web real-time communication module and multiple simulated interaction modules, design fake login functions for multiple simulated interaction modules, deploy the deception system on a cloud server, and open the interface access function of the deception system.

[0028] In one possible embodiment, the system features of the critical protection system are extracted, including: extracting the interface style, interaction logic and functional modules of the critical protection system.

[0029] In one specific embodiment, the critical security system is analyzed to extract its key characteristic elements, including interface style, interaction logic, and functional modules. To ensure the deception system accurately simulates the real environment and improves the deception effect, it is also necessary to evaluate the core business processes within the critical security system, considering key parts of interest to attackers from their perspective, including but not limited to login pages, database operations, management systems, API interfaces, and file upload entry points. After analyzing and extracting the system characteristics of the critical security system, the deception system is designed and constructed based on these characteristics.

[0030] To improve the quality of deception defense, multiple simulated interaction modules are designed to impersonate functional modules of the security system during the deception system construction. These modules can be disguised as OA management systems, operation and maintenance consoles, and database management panels. To ensure that each functional module allows for deep interaction, the simulated interaction modules need to support input boxes, buttons, operation feedback, and dynamic content loading to increase the realism of the disguised system. Furthermore, a fake login function is designed within the simulated interaction modules. This fake login function is designed to prevent login attempts regardless of the user's attempts, and it includes a normal error reporting mechanism to respond to login attempts. This ensures that attackers cannot log in to any functional module, regardless of their attempts. The design of the fake login function creates a "no-exit dilemma" mechanism for attackers within the deception system. No matter how many functional modules an attacker tries, they cannot log in, and the deception system guides attackers into a deeper deception environment during the interaction process, extending the deception time and improving the quality of attack data collection.

[0031] The deception system also includes a Web Real-Time Communication (WebRTC) module, which interacts with the attacker. Based on the UDP protocol, WebRTC uses audio and video communication channels and STUN technology to discover the client's public IP address behind NAT. This allows WebRTC to bypass the attacker's proxy and directly obtain the attacker's real IP address. The WebRTC module is configured to target situations where attackers typically use proxies to conceal their IP address, and proxies usually handle application-layer protocols. By bypassing proxies and directly obtaining the attacker's real IP address, the system reduces the impact of attacker concealment techniques during information gathering and allows for the collection of more crucial attacker information. Furthermore, by accessing the attacker's system interfaces, such as operating system, browser configuration, and personal settings, the system enriches the collected attack profile and intelligence.

[0032] The deception system is deployed on a cloud server with open API access. For example, a deception website's web service could be deployed in Apache with an open HTTP port. Attackers can then obtain and exploit this system using methods such as web search engines. Remotely isolating the deception system reduces its direct connection to the real system and increases the difficulty for attackers to trace the real system, making it harder for them to track down the network assets of the critical system.

[0033] S102: Monitor and record the attack records of the deception system, obtain the attack records of the critical protection system, and perform deduplication processing on the attack records of the deception system and the attack records of the critical protection system to obtain a set of attack records.

[0034] In one possible embodiment, the Web real-time communication module is used to communicate with the attacker in real time to obtain the attacker's real IP address, and the attack records of the deception system include the attacker's real IP address. Monitoring and recording the attack records of the deception system, and performing deduplication processing on the attack records of the deception system and the attack records of the security system to obtain an attack record set, includes: monitoring the attack access information received by the deception system; merging the attack access information according to the attacker's real IP address to obtain the attack records of the deception system; comparing the attack records of the deception system and the attack records of the security system to identify duplicate records; and performing deduplication processing on the duplicate records to obtain the attack record set.

[0035] In a specific implementation, access logs need to be saved for all deception services within the deception system. For example, for web deception services, all attacker requests, including GET and POST requests, can be obtained through Apache / Nginx logs. Additionally, SSH services also record all login records. Since normal users do not access the deception system, any access received by the deception system can be considered abnormal behavior. Analyzing the access logs recorded by the deception system can reveal malicious attacker actions. Establishing a monitoring mechanism to monitor and record attack logs received by the deception system facilitates the analysis of attacker information, enabling the creation of a more clearly defined attack profile.

[0036] The deception system of the present invention can obtain the attacker's real IP through the set Web real-time communication module. After recording the attacker's access information, it can merge the access information according to the attacker's real IP to obtain all the information of the same attacker's access to the deception system and form the attack record received by the deception system, so as to clarify the attacker's attack intention.

[0037] By obtaining attack records from the deception system and conducting collision tests with threat intelligence in the critical protection system, duplicate records between the deception system and the critical protection system can be identified. Deduplication can be performed to streamline the obtained attack information, facilitating further analysis and refinement.

[0038] S103: Analyze the attack record set to obtain the attacker's access behavior information, classify the attackers according to the access behavior information to determine the attacker type, and design targeted defense measures based on the attacker type.

[0039] In one possible embodiment, the attacker's access behavior information is obtained by analyzing the attack record set. The attacker is then classified and the attacker type is determined based on the access behavior information. This includes: obtaining the attacker's access behavior information by statistically analyzing the attacker's access content and intrusion behavior based on the attack record set; determining that attackers who make multiple attack attempts or take actual intrusion actions within a set time unit are malicious attackers, determining that attackers who do not make attack attempts but access multiple secondary interfaces are curious attackers, and determining that attackers who only access primary interfaces are probing attackers.

[0040] Targeted defense measures are designed based on attacker type, including: defense measures against malicious attackers include blocking IPs and blocking access; defense measures against curious attackers include strengthening the security policy of the simulated interaction module accessed by curious attackers and restricting access; defense measures against probing attackers include marking probing attackers and continuously monitoring their access information.

[0041] In one possible embodiment, after analyzing the attack record set to obtain the attacker's access behavior information, the method further includes: strengthening the local threat intelligence of the critical protection system based on the access behavior information. The local threat intelligence includes the attacker's IP address, attacker attributes, attack time, access frequency, access module, and attack instructions.

[0042] In a specific embodiment, after obtaining the attack record set, it will be analyzed to obtain the attacker's access behavior information. The analysis includes: statistical records of the attacker's access content and intrusion behavior, such as the specific functional modules accessed, request parameters, and access duration, and then analyzing the attacker's potential threats and the attacker's degree of curiosity about the functional modules.

[0043] For example, attacker behavior can be categorized into three types: malicious attackers, curious attackers, and probing attackers. For instance, an attacker who makes multiple attack attempts within a set time unit or engages in substantive intrusion activities such as brute-force attacks is considered a malicious attacker. The set time unit can be determined by the administrator based on experience, with the aim of identifying attackers who make multiple attack attempts within a short period. For malicious attackers, whether they are new types can be determined by whether they are detected by threat intelligence. If an attacker accesses multiple secondary interfaces without engaging in substantive intrusion, they are classified as a curious attacker. Although a curious attacker does not take any substantive attack measures, their focus on business functions implies a potential attack surface in the defense system; therefore, curious attackers' curiosity about business functions also requires targeted defense in real critical security systems. If an attacker only explores a small portion of the system's primary interface (IP or homepage) and does not show curiosity about other page functions, they are inferred to be a probing attacker. For probing attackers, although these probing activities may not directly threaten the defense system, they still have the potential to provide attack intelligence for subsequent attackers.

[0044] After identifying the attacker type, targeted defense measures are designed based on the attacker type to guide the security system in implementing effective dynamic defense according to the attacker's intent. For example, defense measures against malicious attackers include blocking IP addresses and restricting access. Defense measures against curious attackers include strengthening the security policies of simulated interaction modules accessed by curious attackers and restricting access. Defense measures against probing attackers include marking probing attackers and continuously monitoring their access information.

[0045] In one specific embodiment, analyzing the attack log set to obtain attacker access behavior information can be used to strengthen the local threat intelligence of the security protection system. Threat intelligence includes, but is not limited to, attacker IP address, physical attributes, proxy usage, attack time, access frequency, the set of functional modules accessed by the attacker, potentially interesting business modules, and the attacker's attack commands. By integrating and correlating the collected attacker access behavior information with local threat intelligence, the local threat intelligence information can be enriched, attack patterns can be further extracted, defense priorities can be strengthened in a targeted manner, and new security threats can be identified.

[0046] S104: Generate an early warning report based on the attacker's access behavior information and the identified attacker type, and send the early warning report and targeted defense measures to the critical protection system.

[0047] In one possible embodiment, an early warning report can be generated based on the attacker's access behavior information and the identified attacker type. The early warning report includes the attacker's source, accessed module, access time, etc. The early warning report and targeted defense measures are sent to the critical security system. The early warning report can provide advance warning to the critical security system, and the designed targeted defense measures can directly notify the security operation and maintenance of the critical security system to take defensive measures to achieve early defense.

[0048] In one possible embodiment, a dynamic defense strategy for the critical protection system is generated based on early warning reports and local threat intelligence. The dynamic defense strategy includes setting up CAPTCHAs and access restrictions.

[0049] For example, the security protection system can dynamically adjust its defense strategies, such as blocking or monitoring the behavior of suspicious users. Defensive measures can be added to the early warning module, such as setting access controls in modules that attackers are curious about, restricting in-depth access by some curious attackers or probes.

[0050] In one possible embodiment, after receiving the warning information, the security system performs vulnerability screening based on the attacker's attack behavior to check for related vulnerabilities. If related vulnerabilities are found, they can be patched in a timely manner to reduce the attack surface.

[0051] This invention provides a method for early warning of cybersecurity attacks on critical activities. By constructing a highly realistic deception system and employing a "no-exit dilemma" mechanism, it guides attackers into deeper interactions, making the deception difficult to detect, extending the attacker's exposure time, and improving the quality of attack data. By analyzing attacker intent through data such as access behavior, operating habits, and functional module preferences, attackers are categorized into malicious, curious, and probing attackers, enhancing the ability to accurately identify potential threats with fine granularity. Through real-time recording and analysis of attack behavior, a lightweight data processing mechanism is established to enrich local threat intelligence, forming dynamic security early warnings and enabling targeted defense based on attacker type and intent preferences.

[0052] This invention provides a method for early warning of cybersecurity attacks on critical events. It collects data through a deception system, dynamically generates security warning reports, and conducts risk assessments of attackers. Based on the warning results, it can guide critical security systems to take defensive measures and integrate attack data into a local threat intelligence database to optimize attack pattern analysis and improve overall defense capabilities. This closed-loop defense strategy effectively enhances the deception capabilities and dynamic defense level of critical security systems, improving their ability to respond to advanced persistent threats.

[0053] See the instruction manual appendix Figure 3 This embodiment also provides a pre-warning device for cybersecurity attacks on important events, which is used to implement the above-described method embodiment. The device includes:

[0054] The deception system construction unit 201 is used to extract the system characteristics of the security system, construct the deception system based on the system characteristics, the deception system includes a Web real-time communication module and multiple simulated interaction modules, design fake login functions for the multiple simulated interaction modules, deploy the deception system on a cloud server, and open the interface access function of the deception system.

[0055] The monitoring unit 202 is used to monitor and record the attack records of the deception system, obtain the attack records of the security system, and perform deduplication processing on the attack records of the deception system and the attack records of the security system to obtain a set of attack records.

[0056] Analysis unit 203 is used to analyze the attack record set to obtain the attacker's access behavior information, classify the attackers according to the access behavior information to determine the attacker type, and design targeted defense measures based on the attacker type.

[0057] The early warning unit 204 is used to generate an early warning report based on the attacker's access behavior information and the determined attacker type, and send the early warning report and the targeted defense measures to the critical protection system.

[0058] All relevant content of each step involved in the above method embodiments can be referenced from the functional description of the corresponding functional module, and will not be repeated here.

[0059] In other embodiments of this application, an electronic device is disclosed, such as... Figure 4 As shown, the electronic device 300 may include: one or more processors 301; a memory 302; a display 303; one or more application programs (not shown); and one or more computer programs 304. These devices can be connected via one or more communication buses 305. The one or more computer programs 304 are stored in the memory and configured to be executed by the one or more processors 301. The one or more computer programs 304 include instructions that can be used to perform actions such as... Figure 1 And the various steps in the corresponding embodiments.

[0060] Through the above description of the embodiments, those skilled in the art will clearly understand that, for the sake of convenience and brevity, only the division of the above functional modules is used as an example. In practical applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above. The specific working process of the system, device, and unit described above can be referred to the corresponding process in the foregoing method embodiments, and will not be repeated here.

[0061] In the embodiments of this application, the functional units can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0062] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solutions of the embodiments of this application, essentially, or the parts that contribute to the prior art, or all or part of the technical solutions, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) or processor to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as flash memory, portable hard disk, read-only memory, random access memory, magnetic disk, or optical disk.

[0063] The above description is merely a specific implementation of the embodiments of this application, but the protection scope of the embodiments of this application is not limited thereto. Any changes or substitutions within the technical scope disclosed in the embodiments of this application should be covered within the protection scope of the embodiments of this application. Therefore, the protection scope of the embodiments of this application should be determined by the protection scope of the claims.

Claims

1. A method for early warning of cybersecurity attacks on important events, characterized in that, include: Extract the system characteristics of the critical protection system, construct a deception system based on the system characteristics, the deception system includes a Web real-time communication module and multiple simulated interaction modules, design fake login functions for the multiple simulated interaction modules, deploy the deception system on a cloud server, and open the interface access function of the deception system. The extraction of the system characteristics of the critical protection system includes: extracting the interface style, interaction logic and functional modules of the critical protection system. Monitor and record the attack records of the deception system, obtain the attack records of the critical protection system, and perform deduplication processing on the attack records of the deception system and the attack records of the critical protection system to obtain an attack record set; The attacker's access behavior information is obtained by analyzing the attack record set. The attackers are classified according to the access behavior information to determine the attacker type. Targeted defense measures are designed based on the attacker type. An early warning report is generated based on the attacker's access behavior information and the identified attacker type, and the early warning report and the targeted defense measures are sent to the critical protection system. Analyzing the attack record set yields attacker access behavior information. Based on this access behavior information, attackers are categorized to determine their type, including: The attacker's access behavior information is obtained by statistically analyzing the attacker's access content and intrusion behavior based on the attack record set. Based on the access behavior information, attackers who make multiple attack attempts or take actual intrusion actions within a set time unit are identified as malicious attackers; attackers who do not make attack attempts but access multiple secondary interfaces are identified as curious attackers; and attackers who only access the primary interface are identified as probing attackers. Design targeted defense measures based on the aforementioned attacker types, including: Defense measures against such malicious attackers include blocking IP addresses and obstructing access; Defense measures against such curious attackers include strengthening the security policies of the simulated interaction modules accessed by the curious attackers and restricting access; Defense measures against such probe attackers include marking probe attackers and continuously monitoring their access information.

2. The method according to claim 1, characterized in that, The Web real-time communication module is used to communicate with the attacker in real time and obtain the attacker's real IP address. The attack records of the deception system include the attacker's real IP address. The attack records of the deception system are monitored and recorded. The attack records of the deception system and the attack records of the security system are deduplicated to obtain a set of attack records, including: Monitor the attack access information received by the deception system, and obtain the attack record of the deception system by merging the attack access information according to the attacker's real IP; The attack records of the deception system and the attack records of the security system are compared to identify duplicate records. The duplicate records are then deduplicated to obtain a set of attack records.

3. The method according to claim 1, characterized in that, After analyzing the attack record set to obtain the attacker's access behavior information, the method also includes: The local threat intelligence of the critical protection system is enhanced based on the access behavior information. The local threat intelligence includes attacker IP, attacker attributes, attack time, access frequency, access module, and attack instructions.

4. The method according to claim 3, characterized in that, Based on the aforementioned early warning reports and local threat intelligence, a dynamic defense strategy for the critical protection system is generated. The dynamic defense strategy includes setting up CAPTCHAs and access restrictions.

5. A network security attack early warning device for important activities, characterized in that, The device includes: A deception system construction unit is used to extract the system characteristics of the critical protection system, construct a deception system based on the system characteristics, the deception system includes a Web real-time communication module and multiple simulated interaction modules, design fake login functions for the multiple simulated interaction modules, deploy the deception system on a cloud server, and open the interface access function of the deception system. The extraction of the system characteristics of the critical protection system includes: extracting the interface style, interaction logic and functional modules of the critical protection system. The monitoring unit is used to monitor and record the attack records of the deception system, obtain the attack records of the security system, and perform deduplication processing on the attack records of the deception system and the attack records of the security system to obtain a set of attack records. The analysis unit is used to analyze the attack record set to obtain the attacker's access behavior information, classify the attackers according to the access behavior information to determine the attacker type, and design targeted defense measures based on the attacker type. The early warning unit is used to generate an early warning report based on the attacker's access behavior information and the determined attacker type, and send the early warning report and the targeted defense measures to the critical protection system. Analyzing the attack record set yields attacker access behavior information. Based on this access behavior information, attackers are categorized to determine their type, including: The attacker's access behavior information is obtained by statistically analyzing the attacker's access content and intrusion behavior based on the attack record set. Based on the access behavior information, attackers who make multiple attack attempts or take actual intrusion actions within a set time unit are identified as malicious attackers; attackers who do not make attack attempts but access multiple secondary interfaces are identified as curious attackers; and attackers who only access the primary interface are identified as probing attackers. Design targeted defense measures based on the aforementioned attacker types, including: Defense measures against such malicious attackers include blocking IP addresses and obstructing access; Defense measures against such curious attackers include strengthening the security policies of the simulated interaction modules accessed by the curious attackers and restricting access; Defense measures against such probe attackers include marking probe attackers and continuously monitoring their access information.

6. A computer-readable storage medium storing a computer program thereon, characterized in that, When the computer program is executed by the processor, it implements the method for early warning of cybersecurity attacks on important activities as described in any one of claims 1 to 4.

7. An electronic device, characterized in that, include: Processor and memory; The memory is used to store computer programs; The processor is used to execute the computer program stored in the memory to cause the electronic device to perform the pre-warning method for cybersecurity attacks on important activities as described in any one of claims 1 to 4.

Images