Active defense system and method based on multi-protocol dynamic simulation and distributed trapping

Abstract

This invention provides an active defense system and method based on multi-protocol dynamic simulation and distributed decoy. The active defense method based on multi-protocol dynamic simulation and distributed decoy includes the following sub-steps: S1: Constructing a multi-protocol dynamic simulation environment; S2: Deploying distributed decoy nodes; S3: Deep decoy of attack behaviors; S4: Attack chain reconstruction and behavior analysis; S5: Adaptive obfuscation and adversarial enhancement; S6: Automated threat intelligence production and feedback. This invention, through protocol template library loading and state machine initialization, can dynamically generate responses based on real-time session context. Employing dynamic simulation of multiple service protocols, it improves the detection capability of network attacks, enabling faster capture of potential threats and reducing the risk of false negatives and false negatives. Through an automated threat intelligence generation and feedback mechanism, combined with IOC indicator identification, structured output, and real-time response, it can quickly react and adjust defense strategies.

Description

Technical Field

[0001] This invention relates to the field of network security, and in particular to an active defense system and method based on multi-protocol dynamic simulation and distributed trapping. Background Technology

[0002] With the rapid development of information technology, the complexity and diversity of cybersecurity threats are constantly increasing, and traditional cybersecurity defense methods are gradually revealing their shortcomings. Honeypot technology, as an important component of the proactive defense system, can effectively induce attacker behavior by simulating real system resources and record relevant data during the attack process in real time, becoming an important tool in the cybersecurity field. The main purpose of honeypot technology is to improve the ability to detect cyberattacks, capture attacker behavior, and extract threat intelligence, thereby providing more comprehensive security protection for the defense system.

[0003] However, existing technologies still have the following drawbacks:

[0004] 1. Static protocol simulation and simple interaction logic: Existing honeypot systems generally adopt simple simulation of static protocols, which lacks dynamic interaction capabilities and is difficult to adapt to the identification and bypass strategies of advanced attackers, resulting in a significant decrease in the effectiveness of honeypots in complex attack environments.

[0005] 2. Single-point deployment and lack of collaborative analysis: Most honeypot systems are still deployed in a single point or locally, lacking distributed collaboration and correlation analysis between attack behaviors. This makes it impossible to fully and effectively reconstruct the attack path in the network environment, increasing the difficulty of tracing and analysis.

[0006] 3. Passive recording and slow response: Traditional honeypots often use a passive recording mechanism, lacking real-time response capabilities. They cannot make effective strategy adjustments or inducements when an attack occurs, allowing attackers to quickly complete key penetration steps. Summary of the Invention

[0007] The purpose of this invention is to address the shortcomings of existing technologies by proposing an active defense system and method based on multi-protocol dynamic simulation and distributed trapping.

[0008] To achieve the above objectives, the present invention adopts the following technical solution:

[0009] The active defense system and method based on multi-protocol dynamic simulation and distributed trapping include a protocol template library, a business logic dependency simulation module, an active defense module, an attack intent graph generation module, an intelligence context enhancement annotation module, an intelligence context enhancement annotation module, and an active defense rule generation and strategy push module.

[0010] The protocol template library is used to load and initialize templates for various common service protocols, such as MySQL, Redis, Kafka, FTP, HTTP, etc.

[0011] The business logic dependency simulation module is used to add prior state dependencies to the protocol response to enhance the confidentiality of the response.

[0012] The active defense module is used to intercept malicious payloads;

[0013] The attack intent graph generation module is used to construct a visual target-oriented graph;

[0014] The intelligence context enhancement annotation module is used to add contextual descriptions to each IOC metric;

[0015] The proactive defense rule generation and strategy push module is used to generate defense strategies and push them to security protection devices to achieve rapid response.

[0016] The active defense method based on multi-protocol dynamic simulation and distributed trapping includes the following sub-steps:

[0017] S1: Construct a multi-protocol dynamic simulation environment;

[0018] Includes the following sub-steps:

[0019] S11: Loading the protocol template library and initializing the state machine;

[0020] Load a pre-built protocol template library, which contains protocol templates for common services such as MySQL and Redis;

[0021] Each service protocol template corresponds to a state machine. The system generates a corresponding state machine logic tree for each service protocol based on the service protocol template.

[0022] S12: Generate relevant responses based on the session context;

[0023] The protocol engine dynamically generates realistic response data based on the corresponding state logic tree and the session context.

[0024] The session context includes request parameters, authentication status, etc.

[0025] For example, when a database query instruction is detected in a request, the protocol engine generates query results based on a predefined database table structure;

[0026] S13: Injecting false business data;

[0027] The system constructs business scenarios based on service agreement templates and injects random but logically consistent fake business data into the constructed business scenarios;

[0028] The business scenarios include simulating database table structures, API interface paths, configuration files, user login interfaces, etc.

[0029] The fake business data includes, for example, usernames and passwords for simulated user logins, fake database records, and fake paths;

[0030] S14: Enhance the credibility of the trapping environment;

[0031] The camouflaged trapping environment serves to simulate reality, thereby enhancing the credibility of the trapping environment;

[0032] For example: by simulating timestamps, ensure that the time in the response matches the actual system's response latency; by simulating common error messages, ensure that the error messages received by users when errors occur are consistent with the real system;

[0033] S15: Forged protocol state sequence;

[0034] Add pseudo-state sequences to the conventional protocol state machine to simulate the error process of users in a real system;

[0035] S16: Entropy value of control protocol interaction;

[0036] The entropy value of each protocol interaction is calculated using the information entropy formula. The calculated entropy value is then controlled and adjusted to make the response structure random but the statistical distribution conforms to the real system interaction pattern.

[0037] S17: Simulate business logic dependencies;

[0038] The business logic dependency simulation module adds a prerequisite state dependency (such as requiring login to see the table structure) to the protocol response, simulating the dependency relationship in the business logic.

[0039] S2: Deploy distributed trapping nodes;

[0040] Includes the following sub-steps:

[0041] S21: Generate a network topology-aware deployment strategy;

[0042] Use network detection tools or custom scripts to scan the target network and analyze the physical and virtual network structure information in the target network;

[0043] By combining the collected physical and virtual network structure information, a network map is generated using a topology modeling algorithm, identifying key nodes, paths, and vulnerable areas in the target network, obtaining the optimal deployment location of the trapping nodes, and generating the optimal deployment scheme for the trapping nodes.

[0044] S22: Lightweight node image implantation;

[0045] The trapping node is built as a lightweight image and supports deployment in various environments such as physical machines, virtual machines, containers, and cloud environments;

[0046] The deployment and online launch of trapping nodes are accomplished through automated tools;

[0047] S23: Establish an encrypted channel and transmit the trapping logs;

[0048] An encrypted channel is established between the trapping node and the control center using the TLS protocol to transmit trapping logs, which include attack request packets, response packets, file objects, metadata information, etc.

[0049] S24: Centralized control and task scheduling;

[0050] The system establishes a centralized control center. The control center issues trapping strategies, collects data, and displays node status and attack flow in real time based on network status, attack intelligence, and other information. The control center analyzes whether nodes are in normal operating condition. If a node is found to be compromised or fails to respond, it reassigns tasks or adjusts the trapping strategy according to the preset strategy and performs task scheduling adjustments.

[0051] S25: Node security self-protection mechanism;

[0052] The system deploys an active defense module at each trapping node, the active defense module including...

[0053] Security tools such as Web Application Firewalls (WAF), Intrusion Detection Systems (IDS), or sandboxes can detect and block potential malicious payloads, such as malicious scripts, viruses, and malicious commands.

[0054] S26: Inter-node lateral link trapping;

[0055] Simulate lateral communication links in a real-world environment, such as RPC calls, shared directories, and Redis synchronization. By configuring decoy nodes in the simulated lateral communication links, attackers are lured into performing lateral movement operations. As the attacker performs lateral movement, the decoy nodes record their behavior and collect intelligence that the attacker is spreading between different nodes.

[0056] S3: Deep trapping of attack behavior;

[0057] By constructing a multi-interaction layer trap system, attack behaviors are captured throughout the entire path from detection to exploitation; including the following sub-steps:

[0058] S31: Fast detection and response at low interaction layers;

[0059] By simulating service characteristics such as open ports, banner returns, and simple protocol responses, we can identify early-stage attack behaviors such as network scanning and port sniffing.

[0060] S32: Full-stack simulation of high-interaction layer protocols;

[0061] By setting up highly interactive trapping nodes in the network environment, real service interactions can be simulated;

[0062] The actual service interactions include database queries, handling POST requests from web applications, and uploading files;

[0063] By disguising the configuration and modifying the interface, attackers are induced to perform multiple interactions, such as executing remote command injection or uploading malicious files.

[0064] S33: Malicious file interception and isolation storage;

[0065] When attackers submit malicious files to the system through web interfaces, file upload functions, or other means, the system detects and intercepts malicious files in real time; it identifies malicious files and stores them in a secure, isolated sandbox directory.

[0066] The malicious files include WebShell, script Trojans, remote control tools, privilege escalation payload files, etc.

[0067] S34: Dynamic behavior camouflage mechanism;

[0068] During the interaction between the attacker and the system, fake behaviors such as human error messages and parameter verification logic are added to disguise the attacker's actions.

[0069] S35: Construct a command semantic parser;

[0070] In high-interaction nodes, a command semantic parser is constructed; the semantic parser may be an SQL parser, a Shell parser, etc.

[0071] By analyzing the syntax and semantics of the input commands, potential malicious instructions can be identified.

[0072] S36: Real-time upload behavior interception rule engine;

[0073] The uploaded file content is analyzed in real time using a lightweight semantic recognition model to determine whether its structure is secure, including detecting whether the file is an executable script or contains malicious code such as a reverse shell.

[0074] After a user submits an upload request, the real-time upload behavior interception rule engine isolates the file or puts it into a sandbox environment for pre-running before the file is saved.

[0075] S37: Attack path condition guidance mechanism;

[0076] By setting up an attack path that is "uninteresting on the surface but high-value at the core," attackers are induced to engage in multiple rounds of interaction to obtain sensitive information. By gradually revealing information, attackers are made to expose their attack methods and details under specific conditions.

[0077] S4: Attack Chain Reconstruction and Behavioral Analysis;

[0078] By performing aggregated analysis of multiple logs across time and space dimensions, the attacker's complete penetration path and technical process are reconstructed, including the following sub-steps:

[0079] S41: Aggregate logs from multiple trapping nodes to identify potential attack behavior chains;

[0080] The spatiotemporal correlation log fusion algorithm aggregates and correlates logs from multiple trapping nodes based on dimensions such as time window, IP trajectory, and request characteristics to generate a complete attack behavior chain.

[0081] The trapping nodes include network devices, firewalls, intrusion detection systems, etc.

[0082] S42: Reconstruct the attack path;

[0083] Identify the attacker's initial entry point from logs, such as open database ports or web page vulnerabilities; trace the attacker's subsequent activities from the initial entry point, including lateral movement; record the attacker's actions on the network using timestamps and network connection information to identify complete attack steps, including command execution, data access, and theft; integrate the identified attack steps into a visualized attack path.

[0084] S43: Generate a structured annotation report;

[0085] The system has a built-in MITRE ATT&CK knowledge base, which contains various tactics and tactical stages of network attacks; it extracts specific behaviors from the attack behavior chain obtained in step S41 and maps each specific behavior in the attack behavior chain to the corresponding tactical stage; such as reconnaissance, initial access, execution, persistence, lateral movement, etc.

[0086] After mapping is completed, a structured annotation report is generated;

[0087] S44: Generate attacker behavior profile;

[0088] By collecting and analyzing the activity characteristics of attackers, generating attacker profiles based on these characteristics, and extracting screenshots, input streams, etc. for visualization;

[0089] The activity characteristics include attack frequency, preferred protocols, tools used, source IP, and behavior sequence;

[0090] S45: Behavioral trajectory time sliding window analysis mechanism;

[0091] By introducing a fixed-time window, i.e. a sliding window, splicing together scattered attack point behaviors, slow-moving or persistent attack behaviors can be identified.

[0092] S46: Recognition and classification of adversarial behavior;

[0093] A classifier is trained using machine learning algorithms. The trained classifier is then used to identify specific adversarial behaviors, such as SQL injection techniques that bypass WAFs and script obfuscation evasion behaviors. The detected adversarial behaviors are classified and labeled and incorporated into the security intelligence system.

[0094] S47: Construct a visual goal-oriented map;

[0095] Identify attack targets by analyzing logs and network traffic;

[0096] The attack intent graph generation module constructs a visual target-oriented graph based on the identified attack targets and the attack paths reconstructed in step S42.

[0097] S5: Adaptive obfuscation and adversarial enhancement;

[0098] Includes the following sub-steps:

[0099] S51: Protocol layer response obfuscation mechanism;

[0100] By dynamically inserting random delays, error response codes, and fake fields, the automated script execution process is disrupted.

[0101] S52: Dirty data interference technology at the data layer;

[0102] Randomly insert dirty data packets (invalid data), empty bytes, and erroneous structures of a specific size into the communication data to induce attack tools to make misjudgments or parsing errors;

[0103] S53: Unpatched vulnerability simulating boot;

[0104] Based on current mainstream attack hotspots, simulate the response characteristics of known unpatched vulnerabilities to guide attackers to engage in in-depth interactions;

[0105] S54: Dynamically adapt to the selection of countermeasures; dynamically switch obfuscation strategies based on the frequency of the current attack and the type of attack tools used;

[0106] S55: Protocol layer semantic misdirection mechanism;

[0107] By using disguised field names in the returned data, or by forging error messages such as insufficient permissions or empty data, attackers are misled into making incorrect judgments about the service structure and permission status.

[0108] S56: Attack tool signature identification and strategy adaptation mechanism;

[0109] The system identifies the structural characteristics of attack requests and identifies common attack tools. Once the identification is successful, it dynamically loads a dedicated obfuscation strategy to counter the attack tool (such as returning a fake vulnerability success response or inserting a delayed packet).

[0110] S57: Delayed response mechanism to simulate real load;

[0111] By simulating the response characteristics of real services under high concurrency and high load, variable latency or corresponding prompts are introduced into the attack request;

[0112] S58: Decoy vulnerability response construction mechanism;

[0113] Construct a response path and prompt information for the fake vulnerability to guide attackers to launch attacks against the fake vulnerability.

[0114] S6: Automated threat intelligence production and feedback;

[0115] The results of the trapping are transformed into actionable threat intelligence to drive an automated closed-loop response in the defense system, including the following sub-steps:

[0116] S61: Quick extraction of IOC metrics;

[0117] By analyzing various data sources such as network traffic or logs, detection rules are set to identify attack events, and parsing technology is used to extract IOC indicators from the attack events. The IOC indicators include attack source IP, C2 domain name, download link, file hash, payload signature, etc.

[0118] S62: STIX intelligence structured output;

[0119] Encapsulate IOC information and behavioral tags into STIX format, build API interfaces with mainstream security platforms and intelligence exchange systems, and realize real-time data transmission and synchronization.

[0120] S63: Enhance sandbox analysis behavior;

[0121] Automated sandbox execution analysis is performed on uploaded malicious files to extract their network behavior, system API call sequences, and registry / file operation behaviors. wait Dynamic characteristics;

[0122] S64: Defense strategy linkage and distribution mechanism;

[0123] By linking with systems such as firewalls, WAFs, host protection, and EDR, corresponding defense policies are generated based on real-time detected threats, such as IP blocking and signature rules; and the generated alerts and event information are fed back to the user interface through the API interface.

[0124] S65: Intelligence Credibility Scoring Mechanism;

[0125] Based on parameters such as attack path integrity, malicious code confidence, and attack duration, each intelligence item of the IOC metric, such as IP address, domain name, and hash, is given a confidence score and a risk level is marked.

[0126] S66: Intelligence Context Enhancement Annotation;

[0127] The intelligence context enhancement annotation module adds contextual descriptions to each IOC metric, including metadata such as the first occurrence time, the tools used by the attacker, and the attack stage; and annotates related behaviors according to the MITRE ATT&CK knowledge base standard.

[0128] S67: Proactive defense rule generation and strategy push;

[0129] Based on the parameters collected from the attack event, such as path structure, HTTP header characteristics, load patterns, etc., corresponding proactive defense rules are generated, such as WAF rules, YARA rules, or IDS rules; and pushed to the associated security protection devices through the API interface to achieve automatic closed-loop linkage between attack behavior and response strategy.

[0130] Compared with the prior art, the beneficial effects of the present invention are as follows:

[0131] This invention, through loading a protocol template library and initializing a state machine, can dynamically generate responses based on real-time session context. It employs dynamic simulation of multiple service protocols, enhancing the ability to detect network attacks, enabling faster capture of potential threats, reducing the risk of false negatives and false negatives, and overcoming the limitations of traditional honeypot systems that use static protocol simulation.

[0132] By deploying distributed trapping nodes and building a multi-interaction layer trapping system, it is possible to intelligently identify and select the location of trapping nodes, reconstruct the attacker's complete penetration path, and realize a global perspective of network security protection. Compared with the traditional single-point honeypot design, it can more effectively capture attack behavior and formulate effective defense strategies.

[0133] This invention enables rapid response and adjustment of defense strategies through an automated threat intelligence generation and feedback mechanism, combined with IOC indicator identification, structured output, and real-time response. Attached Figure Description

[0134] Figure 1This is a flowchart illustrating the steps of the active defense method based on multi-protocol dynamic simulation and distributed trapping according to the present invention. Detailed Implementation

[0135] To provide a further understanding of the purpose, structure, features, and functions of the present invention, detailed descriptions are provided below with reference to specific embodiments.

[0136] The active defense system and method based on multi-protocol dynamic simulation and distributed trapping include a protocol template library, a business logic dependency simulation module, an active defense module, an attack intent graph generation module, an intelligence context enhancement annotation module, an intelligence context enhancement annotation module, and an active defense rule generation and strategy push module.

[0137] The protocol template library is used to load and initialize templates for various common service protocols, such as MySQL, Redis, Kafka, FTP, HTTP, etc.

[0138] The business logic dependency simulation module is used to add prior state dependencies to the protocol response to enhance the confidentiality of the response.

[0139] The active defense module is used to intercept malicious payloads;

[0140] The attack intent graph generation module is used to construct a visual target-oriented graph;

[0141] The intelligence context enhancement annotation module is used to add contextual descriptions to each IOC metric;

[0142] The proactive defense rule generation and strategy push module is used to generate defense strategies and push them to security protection devices to achieve rapid response.

[0143] This system constructs a highly realistic service environment using protocol templates and state machines, supporting context-aware responses and business data injection to induce attackers to continuously interact. Combined with distributed deployment and a lateral link trapping mechanism, it achieves multi-region trapping coverage. The system possesses command semantic parsing, dynamic upload analysis, and path guidance capabilities, enabling complete capture and reconstruction of the attack chain. Simultaneously, it constructs an adaptive obfuscation mechanism to implement protocol perturbations and pseudo-vulnerability guidance against automated tools. Finally, it extracts IOC metrics and generates structured intelligence, achieving a closed loop of attack awareness and defense. This system features highly reliable simulation, highly robust decoy capabilities, and strong collaborative defense, making it suitable for critical network environments such as government, enterprise, and financial institutions.

[0144] like Figure 1 As shown, the active defense method based on multi-protocol dynamic simulation and distributed trapping includes the following sub-steps:

[0145] S1: Construct a multi-protocol dynamic simulation environment;

[0146] Includes the following sub-steps:

[0147] S11: Loading the protocol template library and initializing the state machine;

[0148] Load a pre-built protocol template library, which contains templates for more than 50 common service protocols such as MySQL and Redis; the templates include the protocol's communication process, data structure, interaction mode, etc.

[0149] Each service protocol template corresponds to a state machine, which defines the various stages of protocol communication, including establishing a connection, exchanging data, and closing the connection. The system constructs a state logic tree corresponding to each service protocol based on the service protocol template.

[0150] S12: Generate relevant responses based on the session context;

[0151] The system's protocol engine dynamically generates realistic response data based on the corresponding state logic tree and the session context.

[0152] The session context includes request parameters, authentication status, etc.

[0153] For example, when a database query instruction is detected in a request, the protocol engine generates query results based on a predefined database table structure;

[0154] S13: Injecting false business data;

[0155] The system constructs business scenarios based on service agreement templates and injects random but logically consistent fake business data into the constructed business scenarios;

[0156] The business scenarios include simulating database table structures, API interface paths, configuration files, user login interfaces, etc.

[0157] The fake business data includes, for example, usernames and passwords for simulated user logins, fake database records, and fake paths;

[0158] S14: Enhance the credibility of the trapping environment;

[0159] The camouflaged trapping environment serves to simulate reality, thereby enhancing the credibility of the trapping environment;

[0160] For example: by simulating timestamps, ensure that the time in the response matches the actual system's response latency; by simulating common error messages, ensure that the error messages received by users when errors occur are consistent with the real system;

[0161] S15: Forged protocol state sequence;

[0162] Add pseudo-state sequences to the conventional protocol state machine to simulate the error process of users in a real system;

[0163] S16: Entropy value of control protocol interaction;

[0164] The entropy value of each protocol interaction is calculated using the information entropy formula. The calculated entropy value is then controlled and adjusted to make the response structure random but the statistical distribution conforms to the real system interaction pattern.

[0165] S17: Simulate business logic dependencies;

[0166] The business logic dependency simulation module adds a prerequisite state dependency (such as requiring login to see the table structure) to the protocol response, simulating the dependency relationship in the business logic.

[0167] By establishing a multi-protocol dynamic simulation environment to simulate various service protocols, it makes it difficult for potential attackers to judge and identify real and fake requests when interacting with the defense system, thereby reducing the risk of being attacked.

[0168] S2: Deploy distributed trapping nodes;

[0169] Includes the following sub-steps:

[0170] S21: Generate a network topology-aware deployment strategy;

[0171] Use network detection tools or custom scripts to scan the target network and analyze the physical and virtual network structure information in the target network;

[0172] By combining the collected physical and virtual network structure information, a network map is generated using a topology modeling algorithm, identifying key nodes, paths, and vulnerable areas in the target network, obtaining the optimal deployment location of the trapping nodes, and generating the optimal deployment scheme for the trapping nodes.

[0173] S22: Lightweight node image implantation;

[0174] The trapping node is built as a lightweight image and supports deployment in various environments such as physical machines, virtual machines, containers, and cloud environments;

[0175] The deployment and online launch of trapping nodes are accomplished through automated tools;

[0176] S23: Establish an encrypted channel and transmit the trapping logs;

[0177] An encrypted channel is established between the trapping node and the control center using the TLS protocol to transmit trapping logs, which include attack request packets, response packets, file objects, metadata information, etc.

[0178] S24: Centralized control and task scheduling;

[0179] The system establishes a centralized control center. The control center issues trapping strategies, collects data, and displays node status and attack flow in real time based on network status, attack intelligence, and other information. The control center analyzes whether nodes are in normal operating condition. If a node is found to be compromised or fails to respond, it reassigns tasks or adjusts the trapping strategy according to the preset strategy and performs task scheduling adjustments.

[0180] S25: Node security self-protection mechanism;

[0181] The system deploys an active defense module at each trapping node, the active defense module including...

[0182] Security tools such as Web Application Firewalls (WAF), Intrusion Detection Systems (IDS), or sandboxes can detect and block potential malicious payloads, such as malicious scripts, viruses, and malicious commands.

[0183] S26: Inter-node lateral link trapping;

[0184] Simulate lateral communication links in a real-world environment, such as RPC calls, shared directories, and Redis synchronization. By configuring decoy nodes in the simulated lateral communication links, attackers are lured into performing lateral movement operations. As the attacker performs lateral movement, the decoy nodes record their behavior and collect intelligence that the attacker is spreading between different nodes.

[0185] By establishing a centralized control center, the system can monitor the status of each trapping node in real time and adjust the trapping strategy according to network conditions and attack intelligence, thereby improving response speed and comprehensive control over network security incidents.

[0186] S3: Deep trapping of attack behavior;

[0187] By constructing a multi-interaction layer trap system, attack behaviors are captured throughout the entire path from detection to exploitation; including the following sub-steps:

[0188] S31: Fast detection and response at low interaction layers;

[0189] By simulating service characteristics such as open ports, banner returns, and simple protocol responses, we can identify early-stage attack behaviors such as network scanning and port sniffing.

[0190] Specifically, simulated port opening: by simulating open ports and responses to common service protocols, the responses include forged banner information or service identifiers, to induce attackers to perform port scanning using scanning tools;

[0191] Simulated banner return: misleading attackers by providing fake banner information or a different system identifier than the actual one;

[0192] Simulated protocol responses: Disguising common network protocols to simulate normal response behavior;

[0193] S32: Full-stack simulation of high-interaction layer protocols;

[0194] By setting up highly interactive trapping nodes in the network environment, real service interactions can be simulated;

[0195] The actual service interactions include database queries, handling POST requests from web applications, and uploading files;

[0196] By disguising the configuration and modifying the interface, attackers are induced to perform multiple interactions, such as executing remote command injection or uploading malicious files.

[0197] S33: Malicious file interception and isolation storage;

[0198] When attackers submit malicious files to the system through web interfaces, file upload functions, or other means, the system detects and intercepts malicious files in real time; it identifies malicious files and stores them in a secure, isolated sandbox directory.

[0199] The malicious files include WebShell, script Trojans, remote control tools, privilege escalation payload files, etc.

[0200] S34: Dynamic behavior camouflage mechanism;

[0201] During the interaction between the attacker and the system, fake behaviors such as human error messages and parameter verification logic are added to disguise the attacker's actions.

[0202] For example, when an attacker attempts to submit malicious input, the system returns a vague error message, misleading the attacker into thinking that there is a problem with the target system; input fields are deliberately designed to respond to certain specific input formats, or to return some preset abnormal responses, etc.

[0203] S35: Construct a command semantic parser;

[0204] In high-interaction nodes, a command semantic parser is constructed; the semantic parser may be an SQL parser, a Shell parser, etc.

[0205] By analyzing the syntax and semantics of the input commands, potential malicious instructions can be identified.

[0206] For example, when the input is SELECT * FROM users WHERE 1=1, the parser can return a fake data table instead of the real database content, thus effectively simulating the attacker's behavior without exposing the real system;

[0207] Through contextual analysis, the command semantic parser can understand the usage context of the command, ensuring that the returned simulation results are consistent with the attacker's expected behavior;

[0208] S36: Real-time upload behavior interception rule engine;

[0209] The uploaded file content is analyzed in real time using a lightweight semantic recognition model to determine whether its structure is secure, including detecting whether the file is an executable script or contains malicious code such as a reverse shell.

[0210] After a user submits an upload request, the real-time upload behavior interception rule engine isolates the file or puts it into a sandbox environment for pre-running before the file is saved.

[0211] This helps reduce risks and ensures that any potential malicious behavior will not affect the main system;

[0212] S37: Attack path condition guidance mechanism;

[0213] By setting up an attack path that is "uninteresting on the surface but high-value at the core," attackers are induced to engage in multiple rounds of interaction to obtain sensitive information. By gradually revealing information, attackers are made to expose their attack methods and details under specific conditions.

[0214] S4: Attack Chain Reconstruction and Behavioral Analysis;

[0215] By performing aggregated analysis of multiple logs across time and space dimensions, the attacker's complete penetration path and technical process are reconstructed, including the following sub-steps:

[0216] S41: Aggregate logs from multiple trapping nodes to identify potential attack behavior chains;

[0217] The spatiotemporal correlation log fusion algorithm aggregates and correlates logs from multiple trapping nodes based on dimensions such as time window, IP trajectory, and request characteristics to generate a complete attack behavior chain.

[0218] The trapping nodes include network devices, firewalls, intrusion detection systems, etc.

[0219] S42: Reconstruct the attack path;

[0220] Identify the attacker's initial entry point from logs, such as open database ports or web page vulnerabilities; trace the attacker's subsequent activities from the initial entry point, including lateral movement; record the attacker's actions on the network using timestamps and network connection information to identify complete attack steps, including command execution, data access, and theft; integrate the identified attack steps into a visualized attack path.

[0221] S43: Generate a structured annotation report;

[0222] The system has a built-in MITRE ATT&CK knowledge base, which contains various tactics and tactical stages of network attacks; it extracts specific behaviors from the attack behavior chain obtained in step S41 and maps each specific behavior in the attack behavior chain to the corresponding tactical stage; such as reconnaissance, initial access, execution, persistence, lateral movement, etc.

[0223] After mapping is completed, a structured annotation report is generated;

[0224] S44: Generate attacker behavior profile;

[0225] By collecting and analyzing the activity characteristics of attackers, generating attacker profiles based on these characteristics, and extracting screenshots, input streams, etc. for visualization;

[0226] The activity characteristics include attack frequency, preferred protocols, tools used, source IP, and behavior sequence;

[0227] Specifically, the attack frequency refers to the frequency of attack events analyzed and changes in attack patterns identified;

[0228] The preference protocol refers to the protocol that records the attacker's preferred method;

[0229] The tools used refer to the tools and frameworks used to identify attackers;

[0230] The source IP is used to associate attack events with the address of the source IP, helping to identify the attacker's geographical location and whether they are using a proxy or VPN;

[0231] The behavior time sequence is used to record the time-series data of the attack behavior, forming a timeline of the attack behavior;

[0232] S45: Behavioral trajectory time sliding window analysis mechanism;

[0233] By introducing a fixed-time window, i.e. a sliding window, splicing together scattered attack point behaviors, slow-moving or persistent attack behaviors can be identified.

[0234] S46: Recognition and classification of adversarial behavior;

[0235] A classifier is trained using machine learning algorithms. The trained classifier is then used to identify specific adversarial behaviors, such as SQL injection techniques that bypass WAFs and script obfuscation evasion behaviors. The detected adversarial behaviors are classified and labeled and incorporated into the security intelligence system.

[0236] S47: Construct a visual goal-oriented map;

[0237] By analyzing logs and network traffic, attack targets can be identified; common attack targets include...

[0238] Database leaks, lateral movement of internal network hosts, C2 server launches, etc.

[0239] The attack intent graph generation module constructs a visual target-oriented graph based on the identified attack targets and the attack paths reconstructed in step S42.

[0240] Target-oriented mapping can trace the source of attacks, identify the source IP, tools and methods used; by analyzing historical attack patterns and target data, attacker behavior models can be established, improving the ability to predict future attacks.

[0241] S5: Adaptive obfuscation and adversarial enhancement;

[0242] Includes the following sub-steps:

[0243] S51: Protocol layer response obfuscation mechanism;

[0244] By dynamically inserting random delays, error response codes, and fake fields, the automated script execution process is disrupted.

[0245] Specifically, random delay: Set a delay range, and randomly delay the response time within the set delay range, so that attackers cannot accurately capture the response rhythm;

[0246] Error code response: Randomly return some error codes during normal operation to confuse the attacker's judgment;

[0247] Spoofing fields: Change the structure of the returned content by adding pseudo or irrelevant fields to hinder the attacker's automated parsing process;

[0248] S52: Dirty data interference technology at the data layer;

[0249] Randomly insert dirty data packets (invalid data), empty bytes, and erroneous structures of a specific size into the communication data to induce attack tools to make misjudgments or parsing errors;

[0250] S53: Unpatched vulnerability simulating boot;

[0251] Based on current mainstream attack hotspots, simulate the response characteristics of known unpatched vulnerabilities to guide attackers to engage in in-depth interactions;

[0252] Specifically, based on current popular attack scenarios, such as common vulnerabilities, similar questions and answers are constructed to attract attackers; some decoy information is embedded in the simulated vulnerability response to encourage attackers to try to exploit these "unpatched" vulnerabilities.

[0253] S54: Dynamically adapting and selecting adversarial strategies;

[0254] The obfuscation strategy is dynamically switched based on the frequency of the current attack and the type of attack tools used; this makes it difficult for attackers to predict the system's true response, thereby delaying the attack and achieving optimal resource utilization and maximizing the deception effect between different types of attacks.

[0255] S55: Protocol layer semantic misdirection mechanism;

[0256] By using disguised field names in the returned data, or by forging error messages such as insufficient permissions or empty data, attackers are misled into making incorrect judgments about the service structure and permission status.

[0257] For example, the field admin_pass can be returned instead of the actual field password_hash;

[0258] It can effectively slow down attackers' understanding of the system structure and permissions, making it more difficult for them to carry out effective attacks.

[0259] S56: Attack tool signature identification and strategy adaptation mechanism;

[0260] The system identifies the structural characteristics of attack requests (such as User-Agent, Payload template, and sending frequency) and identifies common attack tools (such as sqlmap, nmap, and Metasploit). After successful identification, it dynamically loads a dedicated obfuscation strategy to counter the attack tool (such as returning a fake vulnerability success response or inserting a delayed packet).

[0261] By dynamically loading dedicated obfuscation strategies in a timely manner, such as returning fake vulnerability responses or delayed packets, the effectiveness of attacks targeting specific tools can be greatly reduced, protecting the system from harm.

[0262] S57: Delayed response mechanism to simulate real load;

[0263] By simulating the response characteristics of real services under high concurrency and high load, variable delays or corresponding prompts ("System busy", "Query queue", etc.) are introduced into the attack request.

[0264] This can mislead attackers into believing that the system is indeed facing a resource bottleneck, which may cause them to reduce the frequency of their attacks or change their attack methods, giving the system more buffer time to implement other protective measures.

[0265] S58: Decoy vulnerability response construction mechanism;

[0266] Construct a response path and prompt information for the fake vulnerability to guide attackers to launch attacks against the fake vulnerability.

[0267] For example, it can simulate the response formats and paths of known CVEs such as Log4j, Struts, and ThinkPHP to attract attackers to conduct in-depth exploitation of fake targets, and capture their tools, attack code, and command execution paths in real time.

[0268] S6: Automated threat intelligence production and feedback;

[0269] The results of the trapping are transformed into actionable threat intelligence to drive an automated closed-loop response in the defense system, including the following sub-steps:

[0270] S61: Quick extraction of IOC metrics;

[0271] By analyzing various data sources such as network traffic or logs, detection rules are set to identify attack events, and parsing technology is used to extract IOC indicators from the attack events. The IOC indicators include attack source IP, C2 domain name, download link, file hash, payload signature, etc.

[0272] S62: STIX intelligence structured output;

[0273] Encapsulate IOC information and behavioral tags into STIX format, build API interfaces with mainstream security platforms and intelligence exchange systems, and realize real-time data transmission and synchronization.

[0274] S63: Enhance sandbox analysis behavior;

[0275] Automated sandbox execution analysis is performed on uploaded malicious files to extract their network behavior, system API call sequences, and registry / file operation behaviors. wait Dynamic characteristics;

[0276] S64: Defense strategy linkage and distribution mechanism;

[0277] By linking with systems such as firewalls, WAFs, host protection, and EDR, corresponding defense policies are generated based on real-time detected threats, such as IP blocking and signature rules; and the generated alerts and event information are fed back to the user interface through the API interface.

[0278] This mechanism ensures rapid response, forming a "minute-level threat handling closed loop" to reduce potential security risks.

[0279] S65: Intelligence Credibility Scoring Mechanism;

[0280] Based on parameters such as attack path integrity, malicious code confidence, and attack duration, each intelligence item of the IOC metric, such as IP address, domain name, and hash, is given a confidence score and a risk level is marked.

[0281] S66: Intelligence Context Enhancement Annotation;

[0282] The intelligence context enhancement annotation module adds contextual descriptions to each IOC metric, including metadata such as the first occurrence time, the tools used by the attacker, and the attack phase (e.g., "lateral movement" and "persistence"); and annotates related behaviors according to the MITRE ATT&CK knowledge base standard.

[0283] S67: Proactive defense rule generation and strategy push;

[0284] Based on the parameters collected from the attack event, such as path structure, HTTP header characteristics, load patterns, etc., corresponding proactive defense rules are generated, such as WAF rules, YARA rules, or IDS rules; and pushed to the associated security protection devices through the API interface to achieve automatic closed-loop linkage between attack behavior and response strategy.

[0285] The present invention has been described in the above-described embodiments; however, these embodiments are merely examples for implementing the present invention. It must be noted that the disclosed embodiments do not limit the scope of the present invention. Conversely, any modifications and refinements made without departing from the spirit and scope of the present invention are within the scope of patent protection of the present invention.

Claims

1. An active defense method based on multi-protocol dynamic simulation and distributed decoy, characterized in that: The method comprises the following steps: S1: constructing a multi-protocol dynamic simulation environment; S11: protocol template library loading and state machine initialization; loading a pre-constructed protocol template library, the template library containing service protocol templates; each service protocol template corresponding to a state machine, the system generating a corresponding state machine logic tree for each service protocol according to the service protocol template; S12: generating a relevant response based on a session context; based on the corresponding state logic tree, the protocol engine dynamically generating a simulated response data according to the session context; S13: injecting false business data; constructing a business scenario based on the service protocol template, and injecting random but logical false business data in the constructed business scenario; S14: improving the credibility of the trapping environment; S15: forging a protocol state sequence; S16: controlling the entropy value of protocol interaction; S17: simulating business logic dependence; S2: deploying distributed trapping nodes; S21: generating a network topology-aware deployment strategy; S22: implanting a lightweight node image; constructing the trapping node as a lightweight image; completing the batch deployment and online of the trapping node through an automated tool; S23: constructing an encrypted channel and transmitting trapping logs; S24: centralized control and task scheduling; S25: node security self-protection mechanism; S26: inter-node horizontal link trapping; simulating a horizontal communication link in a real environment, and through the configuration of the trapping node, inducing an attacker to perform a horizontal movement operation in the simulated horizontal communication link, and recording the behavior of the attacker and collecting the intelligence of the attacker in the propagation between different nodes when the attacker performs the horizontal movement; S3: deep trapping of attack behavior; S31: low-interaction-layer fast detection response; S32: high-interaction-layer protocol full-stack simulation; S33: malicious file interception and isolated storage; S34: dynamic behavior camouflage mechanism; S35: constructing a command semantic parser; S36: uploading behavior real-time interception rule engine; S37: attack path condition guiding mechanism; S4: attack chain reconstruction and behavior analysis; S41: aggregating logs from multiple trapping nodes to identify a potential attack behavior chain; aggregating and correlating the logs of multiple trapping nodes through a spatiotemporal correlation log fusion algorithm to generate a complete attack behavior chain; S42: reconstructing an attack path; identifying an initial intrusion entry of an attacker from the logs, tracking subsequent activities of the attacker from the initial intrusion entry, recording each action of the attacker in the network by using a timestamp and network connection information, identifying complete attack steps, and integrating the identified attack steps into a visual attack path; S43: generating a structured annotation report; S44: generating an attacker behavior portrait; S45: behavior trajectory time sliding window analysis mechanism; S46: adversarial behavior identification and classification; S47: constructing a visual target-oriented graph; S5: adaptive confusion and adversarial enhancement; S51: protocol layer response confusion mechanism; S52: data layer dirty data interference technology; S53: unpatched vulnerability simulation guidance; S54: dynamically adapting to select an adversarial strategy; S55: protocol layer semantic misleading mechanism; S56: Attack tool feature recognition and strategy adaptation mechanism; S57: Delay response simulation real load mechanism; S58: Decoy type vulnerability response construction mechanism; S6: Automatic threat intelligence production and feedback; S61: IOC indicator rapid extraction; S62: STIX intelligence structured output; S63: Enhanced sandbox analysis behavior; S64: Defense strategy linkage distribution mechanism; S65: Intelligence credibility scoring mechanism; S66: Intelligence context enhancement labeling; S67: Active defense rule generation and strategy push.

2. The active defense method based on multi-protocol dynamic simulation and distributed trapping of claim 1, wherein: Step S1 includes the following sub-steps: S1: Construct a multi-protocol dynamic simulation environment; S11: Load protocol template library and initialize state machine; S12: Generate relevant responses based on session context; S13: Inject false business data; S14: Improve the credibility of the trapping environment; S15: Fake protocol state sequence; S16: Control the entropy value of protocol interaction; S17: Simulate business logic dependencies.

3. The active defense method based on multi-protocol dynamic simulation and distributed trapping of claim 1, wherein: Step S2 includes the following sub-steps: S2: Deploy distributed trapping nodes; S21: Generate network topology-aware deployment strategies; S22: Lightweight node image implantation; S23: Build encrypted channels and transfer trapping logs; S24: Centralized control and task scheduling; S25: Node security self-protection mechanism; S26: Inter-node horizontal link trapping. ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ 4. The active defense method based on multi-protocol dynamic simulation and distributed luring of claim 1, wherein: The specific content of step S3 is as follows: S31: Low-interaction layer rapid detection response; Identify the pre-attack behavior by simulating service features; S32: High-interaction layer protocol full-stack simulation; Set up high-interaction luring nodes in the network environment to simulate real service interaction; disguise the configuration modification interface to lure the attacker to interact multiple times; S33: Malicious file interception and isolated storage; Detect and intercept malicious files in real time when the attacker submits malicious files; Identify malicious files and store them in a secure isolated sandbox directory; S34: Dynamic behavior camouflage mechanism; Add real behavior camouflage during the interaction between the attacker and the system; S35: Build a command semantic parser; Build a command semantic parser in the high-interaction node; analyze the syntax and semantics of the input command to identify potential malicious instructions; S36: Upload behavior real-time interception rule engine; Analyze the file content in real time through a lightweight semantic recognition model to determine whether the structure is safe; after the user submits an upload request, the upload behavior real-time interception rule engine isolates the file before it is saved or puts it in a sandbox environment for pre-execution; S37: Attack path condition guidance mechanism; Set up an attack path to induce the attacker to interact multiple times to obtain sensitive information.

5. The active defense method based on multi-protocol dynamic simulation and distributed luring of claim 1, wherein: The specific content of step S4 is as follows: S41: Aggregate logs from multiple luring nodes to identify potential attack behavior chains; S42: Reconstruct attack paths; S43: Generate structured annotation reports; The built-in MITRE ATT&CK knowledge base contains various tactics and tactic stages of network attacks; extract specific behaviors from the attack behavior chains obtained in step S41, map each specific behavior in the attack behavior chain to the corresponding tactic stage; after mapping, generate a structured annotation report; S44: Generate attacker behavior portraits; Collect and analyze the activity characteristics of the attacker, and generate an attacker portrait based on the activity characteristics for visual display; S45: Behavior trajectory time sliding window analysis mechanism; Identify slow-moving or persistent attack behaviors by introducing a fixed time period window, i.e., a sliding window, to splice scattered attack point behaviors; S46: Antagonistic behavior identification and classification; Train a classifier using machine learning algorithms, use the trained classifier to identify specific antagonistic behaviors, classify and label the detected antagonistic behaviors, and include them in the security intelligence system; S47: Build a visual target-oriented graph; Identify attack targets by analyzing logs and network traffic; the attack intent graph generation module constructs a visual target-oriented graph based on the identified attack targets and the reconstructed attack paths in step S42.

6. The active defense method based on multi-protocol dynamic simulation and distributed luring of claim 1, wherein: The specific content of step S5 is as follows: S51: Protocol layer response confusion mechanism; Automated script running flow is disturbed by dynamically inserting random delay, error response code, and disguised field interference; S52: Data layer dirty data interference technology; Randomly insert specific size dirty data packets, i.e. invalid data, null bytes and error structure, in communication data to induce attack tools to produce misjudgment or parsing error; S53: Unpatched vulnerability simulation boot; Simulate the response characteristics of known unpatched vulnerabilities according to the current mainstream attack hotspots to guide attackers to interact in depth; S54: Dynamic adaptation of countermeasures selection; According to the frequency of the current attack and the type of attack tool used, dynamically switch the confusion strategy; Real-time statistics of the number of attack requests from the same attack source or to the same trap node per unit time; Determine whether it is low attack frequency or high attack frequency according to the number of requests; Identify the type of tool used by the attacker by analyzing the structural characteristics of the attack request; According to the frequency of the attack and the type of attack tool used, select and load the matching countermeasures from the preset confusion strategy library; S55: Protocol layer semantic misleading mechanism; By using disguised field name or fake error prompt in the returned data, the attacker is induced to make a mistake in judging the service structure and permission situation; S56: Attack tool feature recognition and strategy adaptation mechanism; Identify the structural characteristics of the attack request, identify common attack tools, and dynamically load special confusion strategies that counter the attack tools; S57: Delay response simulation real load mechanism; By simulating the response characteristics of real services under high concurrency and high load, variable delay or corresponding prompts are introduced in the attack request; S58: Decoy vulnerability response construction mechanism; Construct the response path and prompt information of the pseudo vulnerability to guide the attacker to attack the pseudo vulnerability.

7. The active defense method based on multi-protocol dynamic simulation and distributed trapping of claim 1, wherein: The specific content of step S6 is as follows: S61: IOC indicator rapid extraction; By analyzing network traffic or log and other data sources, set detection rules to identify attack events, and use parsing technology to extract IOC indicators in attack events; S62: STIX intelligence structured output; Encapsulate the information of the IOC indicator and the behavior label into STIX format, build API interface with mainstream security platforms and intelligence exchange systems, and realize real-time transmission and synchronization of data; S63: Enhanced sandbox analysis behavior; Automatically perform sandbox analysis on uploaded malicious files to extract dynamic characteristics; S64: Defense strategy linkage distribution mechanism; According to the threats detected in real time, generate corresponding defense strategies, and feed back the generated alarms and event information to the user interface through the API interface; S65: Intelligence credibility scoring mechanism; Score the credibility of each item of the IOC indicator and mark the risk level; S66: Intelligence context enhancement labeling; Through the intelligence context enhancement labeling module, add context explanation to each IOC indicator, and mark the related behavior according to the MITREATT&CK knowledge base standard; S67: Active defense rule generation and strategy pushing; According to the parameters collected in the attack event, the corresponding active defense rules are generated and pushed to the associated security protection device through the API interface, so as to realize the automatic closed-loop linkage of attack behavior and response strategy.

Images