Method and system for constructing a dynamic threat capture system

Abstract

The application provides a construction method and system of a dynamic threat capturing system, relates to the technical field of system construction, and comprises the following steps: acquiring heterogeneous security data, extracting a three-domain behavior portrait to construct a multi-dimensional feature vector, and identifying attack features; dynamically constructing a virtual target environment to guide attacks, acquiring threat data based on multi-modal perception; constructing a feature library for comparison, predicting an attack path, and generating protection rules; deploying protection measures to acquire countermeasure data, updating the feature library to optimize the rules. The application can realize accurate identification, effective trapping and continuous confrontation of network threats, and improve the network security protection capability.

Description

TECHNICAL FIELD

[0001] The present application relates to system construction technology, in particular to a method and system for constructing a dynamic threat capture system. BACKGROUND

[0002] With the rapid development of information technology, network security threats are increasingly complex and changeable, and traditional static protection methods have been difficult to meet the security protection needs in today's network environment. At present, various network attack methods are constantly upgraded, and the techniques used by attackers are increasingly concealed, and the attack path is more complex, bringing great challenges to network security protection. Under this background, dynamic threat capture technology has gradually become a research hotspot in the field of network security, and its core idea is to attract and capture attackers by building a virtual environment, analyze attack behavior characteristics, and form an effective protection strategy.

[0003] Traditional threat capture systems mainly focus on single-dimensional security data analysis and lack comprehensive processing capabilities for heterogeneous security data. In actual application, the types of security data generated in the network environment are diverse, including network traffic, system logs, user behavior, etc. There are complex associations between these data, and single-dimensional data analysis cannot fully reflect the behavior characteristics of attackers, resulting in insufficient accuracy of threat identification.

[0004] Existing threat capture systems mostly adopt static protection architecture, which cannot dynamically adjust protection strategies according to attack characteristics. This fixed protection mode allows attackers to discover system protection weaknesses through long-term observation, thereby bypassing protection measures to carry out attacks. At the same time, the static protection architecture is difficult to cope with the changing attack strategies of attackers, and cannot achieve continuous and effective threat protection.

[0005] In addition, the traditional threat capture system has limited capabilities in threat behavior analysis and prediction, and lacks accurate prediction of subsequent attacker behavior. Due to the lack of a perfect threat behavior feature library and behavior model, the system cannot infer the subsequent attack path that may be taken by the attacker based on the captured attack characteristics, which results in the lack of foresight in the deployment of protection measures, and only passive response to the attacks that have occurred, and cannot achieve active protection. SUMMARY

[0006] The embodiments of the present application provide a method and system for constructing a dynamic threat capture system, which can solve the problems in the prior art.

[0007] In a first aspect of the embodiments of the present application, a method for constructing a dynamic threat capture system is provided, comprising:

[0008] acquiring heterogeneous security data in a target network environment, extracting a three-domain behavior portrait based on the heterogeneous security data, constructing a multi-dimensional feature vector, and identifying threat attack characteristics through feature matching of the three-domain behavior portrait.

[0009] constructing a virtual target environment with a layered protection architecture according to the attack characteristics, guiding the attack characteristics into the virtual target environment, and performing multi-modal sensing based on a feature template of the three-domain behavior portrait to obtain threat behavior data;

[0010] constructing a threat behavior feature library, comparing the threat behavior data with the three-domain behavior portrait, predicting a subsequent attack path, and generating a protection rule;

[0011] deploying a corresponding protection measure in the virtual target environment according to the protection rule, continuously obtaining countermeasure behavior data of the attack characteristics through multi-modal sensing, updating the threat behavior feature library based on the countermeasure behavior data, and optimizing the protection rule to realize continuous countermeasures against the attack characteristics.

[0012] extracting a three-domain behavior portrait based on the heterogeneous security data, constructing a multi-dimensional feature vector, and identifying attack characteristics with threats through feature matching of the three-domain behavior portrait, including:

[0013] extracting a three-dimensional feature vector from the heterogeneous security data, constructing a behavior state node by feature splicing the three-dimensional feature vector, calculating a state transition probability between the behavior state nodes to construct a state transition edge, and constructing the behavior state node and the state transition edge into a behavior evolution graph;

[0014] calculating a behavior similarity deviation and a state transition anomaly degree between adjacent behavior state nodes based on the behavior evolution graph, and marking a behavior state node as a mutation node if the behavior similarity deviation is greater than a preset similarity threshold and the state transition anomaly degree is greater than a preset anomaly threshold;

[0015] adaptingively adjusting a feature weight in the three-dimensional feature vector according to the mutation node to generate an adjusted feature weight, and weighting and fusing the three-dimensional feature vector based on the adjusted feature weight to construct a three-domain behavior portrait;

[0016] calculating a feature matching degree of a to-be-identified behavior portrait and a historical behavior portrait, calculating an evolution prediction probability of the to-be-identified behavior portrait based on the behavior evolution graph, calculating an identification score according to the feature matching degree and the evolution prediction probability, identifying an attack characteristic of the to-be-identified behavior portrait based on the identification score, and feeding back an identification result to the behavior evolution graph for updating to realize dynamic identification of the attack characteristic.

[0017] calculating a feature matching degree of a to-be-identified behavior portrait and a historical behavior portrait, calculating an evolution prediction probability of the to-be-identified behavior portrait based on the behavior evolution graph, calculating an identification score according to the feature matching degree and the evolution prediction probability, including:

[0018] inputting the to-be-identified behavior portrait and the historical behavior portrait into a discriminator of the generative adversarial network, modeling a matching degree of the to-be-identified behavior portrait and the historical behavior portrait through the discriminator, and outputting a feature matching degree;

[0019] extracting adjacent nodes of the node corresponding to the to-be-identified behavior portrait, generating a behavior evolution path based on the adjacent nodes by a generator of the generative adversarial network, mapping the behavior evolution path to a behavior evolution graph, evaluating the authenticity of the behavior evolution path based on the behavior evolution graph by a discriminator of the generative adversarial network, outputting a correlation feature between nodes in the behavior evolution graph, and obtaining a fusion correlation score;

[0020] exploring a candidate path set with the node corresponding to the to-be-identified behavior portrait as a starting point in the behavior evolution graph by a generator of the generative adversarial network, and evaluating the authenticity of each candidate path in the candidate path set based on the fusion correlation score by the discriminator to obtain a path probability;

[0021] inputting the candidate path set into a decision tree ensemble model, performing evolution trend prediction on each candidate path based on the path probability by the decision tree ensemble model, outputting an evolution prediction probability, inputting the feature matching degree and the evolution prediction probability into the decision tree ensemble model, and obtaining an identification score through multi-tree collaborative decision of the decision tree ensemble model.

[0022] dynamically constructing a virtual target environment with a layered protection architecture according to the attack feature, guiding the attack feature into the virtual target environment, and performing multi-modal perception based on the feature template of the three-domain behavior portrait to obtain threat behavior data, including:

[0023] dividing the virtual target environment into different unit sets, extracting an environment feature vector from an original target environment, constructing a digital twin model based on the environment feature vector, generating an environment mapping through the digital twin model, inputting the attack feature into the digital twin model to generate a mapping result, deploying the digital twin model in the different unit sets, and constructing a path evaluation based on the mapping result;

[0024] evaluating each candidate guide path in a candidate guide path set based on the path evaluation, selecting a candidate guide path with the highest evaluation score as an optimal guide path, guiding the attack feature into the virtual target environment based on the optimal guide path, and constructing an analysis module;

[0025] The observation data in the virtual target environment is feature extracted by using the analysis module to obtain multi-dimensional features; the multi-dimensional features are input into the digital twin model for fusion to obtain fusion features, and the observation data is threat labeled based on the fusion features to obtain threat behavior data.

[0026] A threat behavior feature library is constructed, the threat behavior data is compared with the three-domain behavior portrait in terms of features, a subsequent attack path is predicted, and a protection rule is generated, including:

[0027] The threat behavior features are represented as n-dimensional feature vectors, the n-dimensional feature vectors are used to construct a feature evolution graph, the n-dimensional feature vectors are mapped to a three-domain behavior portrait, a matching probability of the three-domain behavior portrait is calculated based on the feature state transition probability in the feature evolution graph, and a feature matching degree is calculated according to the matching probability and a preset weight coefficient;

[0028] An attack evolution graph is constructed according to the feature state transition probability, an attack path probability is calculated using the attack evolution graph, the optimal attack path is predicted by combining the attack path probability and the feature matching degree, and a protection rule is generated based on the optimal attack path.

[0029] An attack evolution graph is constructed according to the feature state transition probability, an attack path probability is calculated using the attack evolution graph, the optimal attack path is predicted by combining the attack path probability and the feature matching degree, and a protection rule is generated based on the optimal attack path.

[0030] The attack evolution graph includes an attack state node set and a state transition edge set, and the attack evolution graph is used to generate a new attack state node and a state transition edge according to the attack state node set, and evaluate the structural similarity of the new attack state node and the state transition edge;

[0031] An evolution graph quality evaluation function is constructed based on the structural similarity and the evaluation score, and the attack evolution graph is iteratively optimized according to the evolution graph quality evaluation function to obtain an optimized attack evolution graph;

[0032] The optimized attack evolution graph is input into the evolution graph quality evaluation function, a candidate attack path is generated based on the current attack state, a path transition probability is calculated between adjacent attack state nodes in the candidate attack path;

[0033] A path feature vector of the candidate attack path is extracted, a feature matching degree of the path feature vector and a preset feature state vector is calculated, a path feasibility evaluation value is obtained by combining the path transition probability and the feature matching degree, and the optimal attack path is selected from the candidate attack path according to the path feasibility evaluation value.

[0034] deploying a corresponding protection measure in the virtual target environment according to the protection rule, and continuously acquiring the attack feature confrontation behavior data through multi-modal perception includes:

[0035] deploying a protection measure in a virtual target environment according to a protection rule, acquiring attack feature confrontation behavior data in the virtual target environment by using a multi-agent collaborative perception mechanism, calculating an attack feature confrontation strategy evolution direction based on the confrontation behavior data, updating the protection rule according to the confrontation strategy evolution direction, and redeploying the updated protection rule in the virtual target environment.

[0036] In a second aspect of the embodiment of the application, a construction system of a dynamic threat capture system is provided, and the construction system comprises:

[0037] A first unit is configured to acquire heterogeneous security data in a target network environment, extract a three-domain behavior portrait based on the heterogeneous security data, construct a multi-dimensional feature vector, and identify an attack feature with a threat through feature matching of the three-domain behavior portrait;

[0038] A second unit is configured to dynamically construct a virtual target environment with a layered protection architecture according to the attack feature, guide the attack feature into the virtual target environment, and acquire threat behavior data based on multi-modal perception of a feature template of the three-domain behavior portrait;

[0039] A third unit is configured to construct a threat behavior feature library, compare the threat behavior data with the three-domain behavior portrait, predict a subsequent attack path, and generate a protection rule;

[0040] A fourth unit is configured to deploy a corresponding protection measure in the virtual target environment according to the protection rule, continuously acquire attack feature confrontation behavior data through multi-modal perception, update the threat behavior feature library based on the confrontation behavior data, and optimize the protection rule to realize continuous confrontation of the attack feature.

[0041] In a third aspect of the embodiment of the application, an electronic device is provided, and the electronic device comprises:

[0042] a processor;

[0043] a memory for storing processor-executable instructions;

[0044] The processor is configured to invoke the instructions stored in the memory to execute the method described above.

[0045] In a fourth aspect of the embodiment of the application, a computer-readable storage medium is provided, and the computer-readable storage medium stores computer program instructions, and the computer program instructions are executed by a processor to implement the method described above.

[0046] The beneficial effects of the present application are as follows:

[0047] The present application realizes deep analysis of multi-source heterogeneous security data by constructing a dynamic threat capture system, accurately identifies threat features by using three-domain behavior portrait and feature matching technology, effectively improves the accuracy and real-time performance of threat discovery, and reduces the false positive rate.

[0048] Based on the hierarchical protection architecture of the virtual target environment, the present application can guide the attack behavior to the safe isolation area for deep analysis, realize the continuous monitoring and data collection of the attacker behavior, ensure the safety of the production environment, obtain comprehensive attack behavior features, and provide data support for protection strategy optimization.

[0049] The present application realizes adaptive adjustment of protection measures by constructing and continuously updating the threat behavior feature library, combining attack path prediction and dynamic protection rule generation, forms a closed-loop threat countermeasure mechanism, greatly improves the persistence and effectiveness of network security protection capability, and can cope with the evolving network attack threat. BRIEF DESCRIPTION OF DRAWINGS

[0050] Figure 1 The flowchart of the construction method of the dynamic threat capture system of the embodiment of the present application is shown in

[0051] Figure 2 The attack guiding and feature extraction flowchart based on digital twinning of the embodiment of the present application is shown in

[0052] Figure 3 The attack path optimization evaluation flowchart based on the evolutionary graph of the embodiment of the present application is shown in DETAILED DESCRIPTION

[0053] In order to make the purpose, technical scheme and advantages of the embodiment of the present application clearer, the technical scheme in the embodiment of the present application will be described clearly and completely below in combination with the drawings in the embodiment of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor are within the scope of protection of the present application.

[0054] The technical scheme of the present application will be described in detail below with specific embodiments. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described in some embodiments.

[0055] Figure 1 The flowchart of the construction method of the dynamic threat capture system of the embodiment of the present application is shown in Figure 1 as shown, the method comprises:

[0056] acquire heterogeneous security data in a target network environment, extract a three-domain behavior portrait based on the heterogeneous security data, construct a multi-dimensional feature vector, and identify attack features with threats through feature matching of the three-domain behavior portrait;

[0057] dynamically construct a virtual target environment with a layered protection architecture according to the attack features, guide the attack features into the virtual target environment, and perform multi-modal perception based on a feature template of the three-domain behavior portrait to acquire threat behavior data;

[0058] construct a threat behavior feature library, compare the threat behavior data with the three-domain behavior portrait, predict subsequent attack paths, and generate protection rules;

[0059] deploy corresponding protection measures in the virtual target environment according to the protection rules, continuously acquire countermeasure behavior data of the attack features through multi-modal perception, update the threat behavior feature library based on the countermeasure behavior data, and optimize the protection rules to achieve continuous countermeasures against the attack features.

[0060] In an optional implementation, extracting a three-domain behavior portrait based on the heterogeneous security data, constructing a multi-dimensional feature vector, and identifying attack features with threats through feature matching of the three-domain behavior portrait include:

[0061] extracting a three-dimensional feature vector from the heterogeneous security data, constructing behavior state nodes by feature splicing the three-dimensional feature vector, calculating state transition probabilities between the behavior state nodes to construct state transition edges, and constructing the behavior state nodes and the state transition edges into a behavior evolution graph;

[0062] calculating behavior similarity deviations and state transition abnormality degrees between adjacent behavior state nodes based on the behavior evolution graph, and marking behavior state nodes with a behavior similarity deviation greater than a preset similarity threshold and a state transition abnormality degree greater than a preset abnormality threshold as mutation nodes;

[0063] adaptively adjusting feature weights in the three-dimensional feature vector according to the mutation nodes to generate adjusted feature weights, and performing weighted fusion on the three-dimensional feature vector based on the adjusted feature weights to construct a three-domain behavior portrait;

[0064] calculate a feature matching degree of a to-be-identified behavior portrait and a historical behavior portrait, calculate an evolution prediction probability of the to-be-identified behavior portrait based on the behavior evolution graph, calculate an identification score according to the feature matching degree and the evolution prediction probability, perform attack feature identification on the to-be-identified behavior portrait based on the identification score, and feed back an identification result to the behavior evolution graph for updating to achieve dynamic identification of attack features.

[0065] Heterogeneous security data from different security devices are collected, including network traffic data, system log data and user behavior data. Three-dimensional feature vectors are extracted from the collected heterogeneous security data, including network domain feature vectors, host domain feature vectors and user domain feature vectors. The network domain feature vectors include source IP address, target IP address, source port, target port, protocol type and other features; the host domain feature vectors include process ID, system call sequence, file access record and other features; the user domain feature vectors include login time, operation behavior sequence, access resource type and other features.

[0066] The three-dimensional feature vectors are combined by feature splicing to construct behavior state nodes. For example, for a user A operation behavior, the extracted features are: network domain feature [192.168.1.100, 80, TCP], host domain feature [process 4721, read system file], user domain feature [14:30:25, database query], and the behavior state node is constructed by feature splicing. The state transition probability between behavior state nodes is calculated to construct state transition edges, for example, the probability of user A's operation behavior changing from "database query" to "file download" is 0.03. The behavior state nodes and state transition edges are constructed into a behavior evolution graph, which reflects the evolution process of user behavior over time.

[0067] Based on the behavior evolution graph, the behavior similarity deviation between adjacent behavior state nodes is calculated. The behavior similarity deviation is realized by calculating the cosine distance between the feature vectors of adjacent nodes. The larger the cosine distance, the lower the similarity and the greater the deviation. For two adjacent behavior state nodes of user B, the calculated behavior similarity deviation value is 0.82. At the same time, the state transition anomaly degree is calculated. The state transition anomaly degree is calculated by the difference between the current observed transition probability and the historical transition probability. For example, the anomaly degree of user B's behavior transition is 0.75. The behavior state nodes with behavior similarity deviation greater than the preset similarity threshold 0.70 and state transition anomaly degree greater than the preset anomaly threshold 0.65 are marked as mutation nodes.

[0068] According to the identified mutation nodes, the feature weights in the three-dimensional feature vectors are adaptively adjusted. The adjustment method is to increase the weight of the abnormal feature corresponding dimension in the mutation node and reduce the weight of the normal feature corresponding dimension. For example, in the detection of user C's behavior mutation, the original weight is [0.3, 0.4, 0.3] (respectively corresponding to network domain, host domain, user domain), and the adjusted weight is [0.5, 0.3, 0.2]. Based on the adjusted feature weight, the three-dimensional feature vectors are weighted and fused to construct a three-domain behavior portrait.

[0069] For the behavior to be identified, the feature matching degree of the behavior image to be identified and the historical behavior image is calculated, and the feature matching degree is realized by calculating the similarity between the feature vectors, for example, the feature matching degree of a suspicious operation of user D and its historical behavior image is 0.35. The evolution prediction probability of the behavior image to be identified is calculated based on the behavior evolution graph, and the evolution prediction probability represents the possibility of the current behavior state changing into the historical attack behavior state, for example, the prediction probability of the current behavior of user D changing into the known attack mode is 0.82. The identification score is calculated according to the feature matching degree and the evolution prediction probability, and the calculation formula of the identification score is: identification score=(1-feature matching degree)×0.6+evolution prediction probability×0.4, and the calculation result of user D is (1-0.35)×0.6+0.82×0.4=0.69. When the identification score is greater than the preset threshold 0.60, it is determined that the behavior has attack characteristics.

[0070] Based on the identification score, the attack characteristic identification of the behavior image to be identified is performed, and the identification result is fed back to the behavior evolution graph for updating, for example, for a behavior of user E, the calculated identification score is 0.75, which is greater than the preset threshold 0.60, and it is determined that the behavior is an attack behavior, and the behavior is added to the corresponding attack behavior node of the behavior evolution graph, and the related state transition probability is updated. By continuously accumulating the identification result to update the behavior evolution graph, the accuracy of subsequent attack characteristic identification is improved, and dynamic identification of attack characteristics is realized.

[0071] In actual application, the security data of an intranet of an enterprise is analyzed, and it is detected that user F continuously attempts to access sensitive ports of multiple servers in a short time, and the network domain characteristics show obvious abnormalities, and the behavior similarity deviation reaches 0.88, and the state transition abnormality degree is 0.79, which are both greater than the preset threshold. The system adaptively adjusts the feature weight, and the network domain weight is increased from 0.33 to 0.60, and the identification score is calculated to be 0.82, and the port scanning attack behavior is successfully identified, and the attack mode is updated to the behavior evolution graph for rapid identification of subsequent similar attacks.

[0072] Through the above technical solutions, the embodiment can dynamically construct a three-domain behavior image based on heterogeneous security data, realize accurate identification of network attack behaviors, and improve the network security protection capability.

[0073] In an optional embodiment, the feature matching degree of the behavior image to be identified and the historical behavior image is calculated, the evolution prediction probability of the behavior image to be identified is calculated based on the behavior evolution graph, and the identification score is calculated according to the feature matching degree and the evolution prediction probability, including:

[0074] inputting the to-be-identified behavior image and the historical behavior image into a discriminator of the generative adversarial network, modeling a matching degree of the to-be-identified behavior image and the historical behavior image through the discriminator, and outputting a feature matching degree;

[0075] extracting adjacent nodes of the node corresponding to the to-be-identified behavior image, generating a behavior evolution path based on the adjacent nodes by a generator of the generative adversarial network, mapping the behavior evolution path to a behavior evolution graph, evaluating authenticity of the behavior evolution path based on the behavior evolution graph by a discriminator of the generative adversarial network, outputting correlation features between nodes in the behavior evolution graph, and obtaining a fusion correlation score;

[0076] exploring a candidate path set with the node corresponding to the to-be-identified behavior image as a starting point in the behavior evolution graph by a generator of the generative adversarial network, evaluating authenticity of each candidate path in the candidate path set based on the fusion correlation score by the discriminator to obtain a path probability;

[0077] inputting the candidate path set into a decision tree ensemble model, performing evolution trend prediction on each candidate path based on the path probability by the decision tree ensemble model, outputting an evolution prediction probability, inputting the feature matching degree and the evolution prediction probability into the decision tree ensemble model, and obtaining an identification score through multi-tree collaborative decision of the decision tree ensemble model.

[0078] When calculating the feature matching degree of the to-be-identified behavior image and the historical behavior image, the behavior image needs to be preprocessed and standardized. The behavior image is a set of multi-dimensional feature vectors, including network domain, host domain and application domain behavior features. Network domain features include traffic features, protocol features and connection features; host domain features include process features, file features and registry features; application domain features include interface call features, data access features and user interaction features. To ensure the comparability of the features, the features in each dimension are normalized so that the feature values are distributed between 0 and 1. For example, for network traffic features, the original traffic value is 1024 data packets per second, and the normalized feature value is 0.75; for process creation frequency features, the original frequency is 8 times per minute, and the normalized feature value is 0.62. The to-be-identified behavior image and the historical behavior image are both represented as 128-dimensional feature vectors, each dimension corresponding to a specific behavior feature.

[0079] When the to-be-identified behavior image and the historical behavior image are input into the discriminator of the generative adversarial network, a deep neural network architecture is used to implement the discriminator model, and the discriminator is composed of a feature extraction layer, a feature interaction layer, and a discrimination output layer. The feature extraction layer uses a convolutional neural network to extract local features and global features of the behavior image; the feature interaction layer calculates a similarity matrix between the to-be-identified behavior image and the historical behavior image through an attention mechanism; and the discrimination output layer outputs a matching probability through a fully connected network and a sigmoid activation function. The discriminator training uses a large number of labeled behavior image pairs, and uses a cross-entropy loss function to optimize the model parameters. The training data set contains 100,000 positive samples (pairs of behavior images of the same type) and 100,000 negative samples (pairs of behavior images of different types). For example, a pair of APT attack behavior images and historical APT attack behavior images constitutes a positive sample pair, and a pair of APT attack behavior images and DDoS attack behavior images constitutes a negative sample pair. The training process uses a small batch gradient descent method with a batch size of 64, an initial learning rate of 0.001, uses a learning rate decay strategy, and trains for 150 cycles.

[0080] When the discriminator models the matching degree of the to-be-identified behavior image and the historical behavior image, the discriminator simultaneously receives the two behavior images as input. The discriminator first extracts deep feature representations of the two behavior images through the feature extraction layer to obtain two feature vectors with a dimension of 512. Then, the similarity matrix of the two feature vectors is calculated through the feature interaction layer to capture key matching points and difference points of the two behavior images. Finally, the discrimination output layer generates a matching score ranging from 0 to 1, and the closer the score is to 1, the higher the matching degree. For example, for a certain malware behavior, the to-be-identified behavior image and the historical behavior image of a known malware family A are evaluated by the discriminator to obtain a matching score of 0.92, and the matching score with the historical behavior image of a malware family B is 0.45, and the matching score with the normal software behavior image is 0.08. This indicates that the to-be-identified behavior belongs to the malware family A.

[0081] When outputting the feature matching degree, the original output of the discriminator is post-processed and calibrated. The post-processing includes threshold screening and probability calibration. The threshold screening sets a minimum matching threshold, for example, 0.5, and the matching results below the threshold are filtered out. The probability calibration uses a temperature scaling method to adjust the original probability distribution and improve the accuracy of probability estimation. The calculation of the feature matching degree considers the matching results of multiple historical behavior portraits and uses a weighted average method, with the weights determined by the confidence of the historical behavior portraits. For example, for a certain unknown network attack behavior, the matching degrees with three historical attack behavior portraits are 0.87 (weight 0.4), 0.76 (weight 0.35), and 0.65 (weight 0.25), respectively. The calculated comprehensive feature matching degree is 0.781. The feature matching degree, as an important component of the recognition score, reflects the static similarity between the behavior to be identified and the known behavior pattern.

[0082] When extracting the adjacent nodes of the behavior portrait to be identified, the operation is based on the behavior evolution graph, which is a directed and weighted graph structure. The nodes represent behavior states, and the edges represent state transition relationships. The weight of the edge represents the transition probability. The behavior portrait to be identified is mapped to a certain node in the behavior evolution graph through feature matching, and then the forward adjacent nodes (nodes pointing to the node) and the backward adjacent nodes (nodes pointed to by the node) of the node are extracted. The extraction of adjacent nodes uses a graph traversal algorithm, and the number of hops is limited to 2, that is, all nodes within 2 hops of the target node are extracted. For the extracted adjacent nodes, the importance score is calculated according to the weight of the edge, and the top 10 nodes with the highest importance score are selected as the key adjacent nodes. For example, for the behavior portrait to be identified mapped to the "data theft" behavior node, the key forward adjacent nodes extracted include "lateral movement" (weight 0.85), "privilege escalation" (weight 0.72), and "information collection" (weight 0.63); the key backward adjacent nodes include "data encryption" (weight 0.56) and "trace removal" (weight 0.78).

[0083] When the generator of the generative adversarial network generates the behavior evolution path based on the adjacent nodes, the generator adopts a sequence generation model structure, and the generator is composed of an encoder, an evolution prediction layer, and a decoder. The encoder encodes the feature vector of the adjacent node into a context vector; the evolution prediction layer predicts the behavior evolution trend based on the context vector; and the decoder generates the behavior sequence according to the evolution trend. The generation process adopts an autoregressive manner, generates one behavior node each time, and then adds the newly generated node to the sequence as a condition for the next generation. To enhance the diversity of the generation results, a beam search strategy is adopted to retain the top 5 candidate sequences with the highest probability. The training of the generator adopts a combination of adversarial training and supervised training, and uses historical attack chain data as real samples. For example, for the "network scanning" behavior node, the generator generates 5 evolution paths based on its adjacent nodes, such as "network scanning → exploit → privilege escalation → lateral movement → data theft" and "network scanning → exploit → backdoor implantation → remote control → data theft".

[0084] When mapping the behavior evolution path to the behavior evolution graph, it is necessary to align and match the generated behavior sequence with the known path in the behavior evolution graph. The alignment process considers the node semantic similarity and path structure similarity. The node semantic similarity is obtained by calculating the cosine similarity of the node feature vector; and the path structure similarity is obtained by comparing the path length, node order and jump mode. For each node in the generated path, find the most similar node in the behavior evolution graph for mapping. If a node has no exact match in the graph, select the most similar node with a similarity exceeding a threshold value of 0.8. If the similarity is below the threshold value, the node is regarded as a newly discovered behavior mode and is added to the behavior evolution graph. For example, the generated path "network scanning → exploit → backdoor implantation → remote control → data theft" is mapped to the behavior evolution graph, and the mapping similarity of each node is 1.0, 0.95, 0.88, 0.92 and 1.0 respectively, indicating that the path has a good matching degree in the graph.

[0085] When the discriminator based on the generative adversarial network evaluates the authenticity of the behavior evolution path according to the behavior evolution graph, the discriminator receives the mapped path as input and evaluates its similarity to the real attack chain. The evaluation process considers two aspects: path legitimacy and path rationality. Path legitimacy checks whether the path conforms to the basic laws of behavior evolution, such as whether there are logical conflicts or impossible jumps; path rationality evaluates the likelihood of the path occurring in a real scenario based on historical statistical data. The discriminator uses a graph convolution network to extract the structural features of the path, uses a recurrent neural network to extract the sequence features of the path, and then outputs a authenticity score through a multi-layer perceptron, ranging from 0 to 1. For example, for the mapped path "network scanning → exploit → backdoor implantation → remote control → data theft", the discriminator gives a legitimacy score of 0.95, a rationality score of 0.88, and a comprehensive authenticity score of 0.92, indicating that the path is a real attack behavior sequence.

[0086] When the association features between nodes in the output behavior evolution graph are fused to obtain the fusion association score, multiple association features between nodes are extracted. The association features include direct connection strength, indirect connection strength, co-occurrence frequency, and transfer time features. The direct connection strength represents the weight of the direct connection between two nodes; the indirect connection strength represents the comprehensive strength of the connection through intermediate nodes; the co-occurrence frequency represents the frequency of the two nodes appearing together in the same attack sequence; and the transfer time feature represents the average time interval from one node to another. The association features are integrated through a feature fusion network to output a fusion association score ranging from 0 to 1. For example, for the two nodes "exploit" and "privilege escalation", the extracted association features include direct connection strength 0.82, indirect connection strength 0.25, co-occurrence frequency 0.75, and average transfer time interval 3 minutes, and the fused association score is 0.78, indicating that there is a strong association between the two behavior nodes.

[0087] In the behavior evolution graph, the generator of the generative adversarial network is used to explore the candidate path set starting from the node corresponding to the behavior portrait to be identified. Deep reinforcement learning technology is used to guide path generation. The generator is regarded as an agent, and the behavior evolution graph is regarded as an environment. The goal of the agent is to find a high-probability attack path. The exploration process uses the Monte Carlo tree search algorithm, which selects the most potential node to expand each time to balance exploration and utilization. The path generation process sets the maximum length to 10, the maximum exploration depth to 5, and the number of generated candidate paths to 20. For each generated path, the coverage rate and diversity score are calculated to ensure the representativeness and comprehensiveness of the candidate path set. For example, for the exploration starting from "network scanning", the generated candidate path set includes "network scanning → exploit → privilege escalation → lateral movement → data theft" (coverage rate 0.85), "network scanning → weak password cracking → credential theft → remote login → configuration modification" (coverage rate 0.72), and 20 different attack paths.

[0088] When the discriminator evaluates the authenticity of each candidate path in the candidate path set based on the fusion correlation score, the discriminator scores each candidate path. The scoring process takes into account the fusion correlation score of each pair of adjacent nodes in the path and the structural characteristics of the path as a whole. The fusion correlation score of the adjacent node pair in the path calculates the local authenticity of the path through weighted averaging; the structural characteristics of the path calculate the global authenticity of the path through the similarity with the historical attack path. The local authenticity and global authenticity are combined to obtain the comprehensive authenticity score of the path, which is then converted to the path probability through the softmax function. For example, for the candidate path "network scanning → exploit → privilege escalation → lateral movement → data theft", the local authenticity score is 0.85, the global authenticity score is 0.92, the comprehensive authenticity score is 0.88, and the converted path probability is 0.15, indicating that among all the candidate paths, this path has a 15% probability of being a real attack path.

[0089] When the candidate path set is input into the decision tree ensemble model, a random forest or gradient boosting decision tree is used as the ensemble model. The decision tree ensemble model is composed of multiple decision trees, each of which is trained based on a different subset of features and samples. The model input includes the path feature vector, which contains the path length, node type distribution, transition pattern, time feature, and path probability. The model training uses historical attack path data, with the label being the real evolution result of the path. The training process uses the cross-validation method to ensure the generalization ability of the model. For example, the model contains 100 decision trees, each with a maximum depth of 10, a minimum leaf node sample size of 5, a feature randomness parameter of 0.7, and a Gini impurity as the splitting criterion.

[0090] According to the evolutionary trend prediction of each candidate path based on the path probability of the decision tree ensemble model, the ensemble model outputs the prediction result of each candidate path. The prediction result includes path completion probability, key node achievement probability and target realization probability. The path completion probability represents the possibility of the path being executed completely in the expected order; the key node achievement probability represents the possibility of the key behavior node in the path being executed; and the target realization probability represents the possibility of the attack target being realized. The three probabilities are calculated by weighted average to obtain the comprehensive evolutionary prediction probability. For example, for the path "network scanning → exploit → privilege escalation → lateral movement → data theft", the path completion probability is 0.78, the key node (data theft) achievement probability is 0.85, the target realization (data leakage) probability is 0.82, and the calculated comprehensive evolutionary prediction probability is 0.81, indicating that the path has a high realization possibility.

[0091] When the feature matching degree and the evolutionary prediction probability are input into the decision tree ensemble model, a two-level decision model is constructed. The two-level model uses the same ensemble architecture as the previous level, but the input features only include the feature matching degree and the evolutionary prediction probability. The feature matching degree reflects the static similarity between the to-be-identified behavior and the known behavior pattern; and the evolutionary prediction probability reflects the dynamic trend of the future development of the to-be-identified behavior. The two-level model comprehensively evaluates the nature and risk of the to-be-identified behavior through the combination of the two indicators. The model training uses historical identification cases, and the labels are the real categories and risk levels of the behaviors. For example, for a potential APT attack behavior, the feature matching degree is 0.781 and the evolutionary prediction probability is 0.81, which are used as the input features of the two-level model.

[0092] When the recognition score is obtained through the multi-tree collaborative decision of the decision tree ensemble model, each decision tree in the ensemble model independently makes a prediction, and then the final result is obtained through voting or weighted average. For classification tasks, the majority voting method is used, and the class with the most votes is selected as the prediction result; for regression tasks, the weighted average method is used, and the average value of all tree prediction values is calculated as the final prediction value. The calculation of the recognition score comprehensively considers the confidence of the behavior category judgment and the accuracy of the risk level evaluation, and the score range is 0 to 100, the higher the score, the more reliable the recognition result and the higher the risk. For example, for the aforementioned potential APT attack behavior, 80% of the decision trees in the ensemble model judge it as an APT attack (category confidence 0.8), and the average risk score is 85 (standardized to 0.85), and the calculated recognition score is 85x0.8=68, indicating that the behavior is an APT attack and has a high security risk. The recognition score is an important basis for subsequent security decisions, and is used to trigger corresponding defense measures and response strategies.

[0093] In an optional implementation, the virtual target environment with a layered protection architecture is dynamically constructed according to the attack features, the attack features are guided into the virtual target environment, and multi-modal perception is performed based on a feature template of the three-domain behavior portrait to obtain threat behavior data, including:

[0094] The virtual target environment is divided into different unit sets, an environment feature vector is extracted from an original target environment, a digital twin model is constructed based on the environment feature vector, an environment mapping is generated through the digital twin model, and an attack feature is input into the digital twin model to generate a mapping result; the digital twin model is deployed in the different unit sets, and a path evaluation is constructed based on the mapping result;

[0095] Each candidate guiding path in a candidate guiding path set is evaluated based on the path evaluation, and a candidate guiding path with the highest evaluation score is selected as an optimal guiding path; the attack feature is guided into the virtual target environment based on the optimal guiding path, and an analysis module is constructed;

[0096] The observation data in the virtual target environment are subjected to feature extraction by using the analysis module to obtain multi-dimensional features; the multi-dimensional features are input into the digital twin model for fusion to obtain fused features, the observation data are subjected to threat labeling based on the fused features, and threat behavior data are obtained.

[0097] As shown in Figure 2 , the method includes:

[0098] When the virtual target environment with a layered protection architecture is dynamically constructed according to attack features, the basic architecture of the virtual target environment needs to be determined. The virtual target environment is realized in a manner of combination of container technology and virtual machine technology, application layer components are realized by using lightweight containers, and core business systems are realized by using full virtualization technology. The basic architecture includes three levels of network layer, host layer and application layer, the network layer simulates enterprise network topology, including border routers, firewalls, switches and other devices; the host layer simulates various operating systems and servers, including file servers, database servers and web servers; and the application layer simulates various business applications, including mail systems, office systems and management platforms. Each level uses independent resource pool management, and through a resource scheduler, computing, storage and network resources are allocated on demand.

[0099] When dividing the virtual target environment into different cell sets, it is divided according to functions, security levels and business relevance. The cell set is mainly divided into boundary cells, business cells and data cells. The boundary cells include the external network access area, the DMZ area and the security protection area, which are responsible for external traffic access and primary filtering; the business cells include the web service area, the application service area and the management service area, which are responsible for business logic processing; the data cells include the data storage area, the data processing area and the data backup area, which are responsible for data management. The cells are connected through a secure channel to realize business flow. For example, in the e-commerce scenario, the boundary cells deploy load balancers and WAFs, the business cells deploy order processing and payment services, and the data cells deploy user databases and transaction databases. The communication between the cells strictly configures access control rules according to the principle of least privilege.

[0100] When extracting the environment feature vector from the original target environment, a combination of passive scanning and active probing is used. Passive scanning collects network communication data through traffic mirroring technology, and active probing obtains system configuration information through authentication and authorization. The extracted feature vector includes three types of network topology features, service component features and interaction behavior features. Network topology features describe network structure and communication mode, including IP address segment, subnet division, routing strategy and traffic distribution; service component features describe system and application configuration information, including operating system type, version number, open port, running service and patch status; interaction behavior features describe business process and data flow, including service invocation relationship, data access mode and user behavior mode. The feature vector is represented by 128 dimensions, of which network topology features account for 48 dimensions, service component features account for 42 dimensions, and interaction behavior features account for 38 dimensions.

[0101] When constructing the digital twin model based on the environment feature vector, a multi-layer graph structure is used to represent the model, with the bottom layer being a physical resource graph representing the distribution of computing, storage and network resources; the middle layer being a service component graph representing the deployment of various services and applications; and the upper layer being a business process graph representing business logic and data flow. The graph structures of each layer are associated through vertical mapping to form a complete twin model. The model construction process uses an incremental learning method, with the initial model being constructed based on static configuration information, and then continuously optimized and adjusted through real-time monitoring data. For example, the initial model constructs the physical resource graph based on network topology scanning results, the service component graph based on service discovery results, and the business process graph based on traffic analysis results. Model parameters are obtained through historical data training, such as the association strength between nodes, service dependency probability and business call frequency, etc.

[0102] When generating the environment mapping through the digital twin model, entities and relationships in the target environment are mapped into the virtual environment. The mapping process includes node mapping, edge mapping, and attribute mapping. Node mapping maps entity devices to virtual instances, such as mapping physical servers to virtual machines. Edge mapping maps network connections to virtual links, such as mapping local area network connections to virtual networks. Attribute mapping maps entity characteristics to configuration parameters, such as mapping service configurations to parameter settings of virtual instances. When mapping, resource limitations and performance requirements are considered, and non-critical components are appropriately simplified. For example, for an e-commerce platform, the mapping generates a virtual environment containing 3 boundary unit nodes, 5 business unit nodes, and 2 data unit nodes. Twelve virtual links are established between the nodes, 25 key service components are configured, and 103 configuration parameters are set.

[0103] When inputting attack features into the digital twin model to generate mapping results, attack features are represented as feature vectors, containing three parts of information: attack target, attack means, and attack path. Attack target describes the attacker's intention, such as data theft, service interruption, or privilege escalation. Attack means describes the techniques used by the attacker, such as SQL injection, buffer overflow, or social engineering. Attack path describes the attack sequence, such as reconnaissance-vulnerability exploitation-privilege escalation-lateral movement-data theft. The model simulates the propagation process of attack behavior in the target environment according to the input attack features, and generates attack impact range and affected asset list. For example, for the SQL injection attack feature, the mapping result generated by the model shows that the web server and database server are in high-risk state, the user data table and transaction record table are the main affected assets, and the attack impact range covers the business unit and data unit.

[0104] When deploying digital twin models in different unit sets, a distributed deployment architecture is adopted, with each unit set deploying a local model instance responsible for monitoring and analyzing behavior within the unit. Local models exchange information through secure channels to form a collaborative analysis network. The complexity of local models is adjusted according to the importance and resource situation of the unit. Key units deploy full-featured models, and non-critical units deploy lightweight models. Model deployment adopts an adaptive resource allocation strategy, dynamically adjusting computing resources according to business load and security posture. For example, when a high-intensity attack is detected, the model's computing resource allocation is automatically increased to improve analysis and processing capabilities.

[0105] When constructing the path evaluation based on the mapping results, the connections between nodes in the virtual environment are regarded as the guide paths. The path evaluation considers three dimensions: guidance effect, resource consumption, and risk control. The guidance effect evaluates the attractiveness of the path to the attack behavior, including target value, environment fidelity, and response delay; the resource consumption evaluates the cost of path implementation, including computing resources, storage resources, and network resources; the risk control evaluates the risks introduced by the path, including information leakage risk, overflow infection risk, and misjudgment risk. The evaluation results are represented as a comprehensive score, with a score range of 0 to 100, and a higher score indicating a better path. For example, for a certain SQL injection attack feature, the guide path from the web server to the test database has an evaluation score of 85, and the guide path from the web server to the production database has an evaluation score of 45.

[0106] When evaluating each candidate guide path in the candidate guide path set based on the path evaluation, a multi-factor weighted scoring method is used, and the evaluation factors include path attractiveness, technical feasibility, resource efficiency, risk controllability, and defense value. The path attractiveness evaluates the induction effect of the path on the attacker, with a weight of 0.25; the technical feasibility evaluates the difficulty of path implementation, with a weight of 0.20; the resource efficiency evaluates the resource utilization rate of the path, with a weight of 0.15; the risk controllability evaluates the security boundary strength of the path, with a weight of 0.25; the defense value evaluates the intelligence collection value of the path, with a weight of 0.15. The score range of each factor is 0 to 10, and the comprehensive score is calculated by weighted average. For example, the scores of a certain candidate guide path are: path attractiveness 8 points, technical feasibility 7 points, resource efficiency 9 points, risk controllability 8 points, and defense value 9 points, and the calculated comprehensive score is 8.15 points.

[0107] When selecting the candidate guide path with the highest evaluation score as the optimal guide path, the top three paths with the highest scores are analyzed in detail, considering the current security situation and defense strategy. The detailed analysis includes path complexity analysis, emergency adaptability analysis, and long-term benefit analysis. The path complexity analysis evaluates the implementation difficulty and maintenance cost; the emergency adaptability analysis evaluates the ability to respond to attack changes; the long-term benefit analysis evaluates the continuous defense value. According to the detailed analysis results, the original scores are adjusted, and the path with the highest adjusted score is finally selected as the optimal guide path. For example, for a certain DDoS attack feature, the guide path with the highest initial score has a score decrease after detailed analysis, while the path ranked second initially becomes the final choice due to its good adaptability and high long-term benefit.

[0108] When guiding attack features into the virtual target environment based on the optimal guide path, fine-grained traffic scheduling and session management are implemented. Traffic scheduling uses software-defined network technology to dynamically adjust traffic forwarding rules according to the matching degree of attack features. Session management ensures the continuity and authenticity of the guide process through session replication and state synchronization technology. The guide process is divided into three stages: identification, transfer and maintenance. The identification stage uses deep packet inspection technology to identify traffic that meets attack features; the transfer stage redirects the identified traffic to the virtual environment through transparent proxy technology; the maintenance stage ensures the continuity of interaction through session maintenance technology. For example, for a network scanning attack, the identification stage detects a large number of port scanning requests, the transfer stage redirects these requests to the corresponding service port in the virtual environment, and the maintenance stage maintains the attacker's interest by simulating real service responses.

[0109] When constructing the analysis module, a hierarchical decoupling architecture design is adopted, and the analysis module includes a data collection layer, a feature extraction layer, a behavior analysis layer, and a decision output layer. The data collection layer is responsible for collecting raw data from the virtual environment, including network traffic, system logs, and application events; the feature extraction layer is responsible for extracting valuable features from raw data, including statistical features, sequence features, and semantic features; the behavior analysis layer is responsible for identifying behavior patterns based on features, including normal behavior patterns and abnormal behavior patterns; the decision output layer is responsible for generating analysis results and defense recommendations, including threat levels, attack types, and coping strategies. Modules communicate through standard interfaces, supporting plug-in extensions. For example, for a network layer attack, the data collection layer collects network packets, the feature extraction layer extracts traffic features, the behavior analysis layer identifies a DDoS attack pattern, and the decision output layer generates a high-risk alarm and traffic cleaning recommendation.

[0110] When using the analysis module to extract features from observation data in the virtual target environment, a multi-level feature extraction strategy is adopted. Basic feature extraction extracts statistical quantities from raw data, such as traffic size, packet length distribution, and time interval; behavior feature extraction extracts patterns from interaction sequences, such as access order, operation frequency, and command type; context feature extraction extracts semantic features in combination with environmental information, such as resource sensitivity, operation legality, and behavior abnormality. Feature extraction uses a combination of deep learning and expert rules, balancing automation and accuracy. For example, for an application layer attack, the multi-dimensional features extracted include HTTP request frequency (75 times per second), abnormal parameter proportion (35%), sensitive operation proportion (60%), resource access dispersion (0.25), and authentication failure rate (80%).

[0111] When the multi-dimensional features are input into the digital twin model for fusion to obtain fused features, a multi-modal feature fusion technology is adopted, and the feature fusion is divided into three levels of early fusion, mid-fusion and late fusion. The early fusion is performed in the feature extraction stage, and the original data of different sources are jointly processed; the mid-fusion is performed in the feature representation stage, and the feature vectors of different types are combined; and the late fusion is performed in the decision stage, and different analysis results are integrated. The fusion process considers the correlation and complementarity between the features, and gives different features appropriate weights. For example, for a certain mixed attack, the network feature weight is 0.4, the host feature weight is 0.35, and the application feature weight is 0.25. The fused features can comprehensively reflect each dimension of the attack behavior.

[0112] When the fused features are used to mark the observation data to obtain threat behavior data, a hierarchical marking strategy is adopted. The marking process includes behavior classification, threat assessment and marking generation. The behavior classification divides the observed behavior into three categories of normal, suspicious and malicious; the threat assessment calculates the harm degree of the behavior, which is divided into three levels of low, medium and high; and the marking generation generates a structured threat marking according to the classification and assessment results, which contains behavior type, threat level, impact range, confidence and recommended measures and the like. The marking data is stored in a standard format, which is convenient for subsequent analysis and sharing. For example, for a certain SQL injection attack behavior, the generated threat marking shows that the behavior type is "Web application attack-SQL injection", the threat level is "high", the impact range is "database server and user data table", the confidence is "95%", and the recommended measures are "update WAF rules and patch application vulnerabilities". Through the threat marking, the original observation data is converted into structured threat behavior data, which provides a basis for subsequent defense decisions.

[0113] In an optional implementation, a threat behavior feature library is constructed, the threat behavior data is compared with the three-domain behavior portrait in terms of features, a subsequent attack path is predicted, and a protection rule is generated, which includes:

[0114] The threat behavior features are represented as n-dimensional feature vectors, the n-dimensional feature vectors are used to construct a feature evolution graph, the n-dimensional feature vectors are mapped to the three-domain behavior portrait, a matching probability of the three-domain behavior portrait is calculated based on a feature state transition probability in the feature evolution graph, and a feature matching degree is calculated according to the matching probability and a preset weight coefficient;

[0115] An attack evolution graph is constructed according to the feature state transition probability, an attack path probability is calculated using the attack evolution graph, the optimal attack path is predicted by combining the attack path probability and the feature matching degree, and a protection rule is generated based on the optimal attack path.

[0116] Collect multi-source heterogeneous threat behavior data, including network traffic logs, system operation logs, and application access logs. Preprocess the collected data to remove noise and redundant information and extract key features. Feature extraction uses a deep learning model to convert raw data into a feature vector. For network traffic, for example, extract source IP, destination IP, port number, protocol type, packet size, transmission rate, etc.; for system operation, extract process creation time, file access path, registry modification, etc.; for application access, extract login frequency, access resource type, operation behavior sequence, etc.

[0117] When representing threat behavior features as n-dimensional feature vectors, set the feature dimension n to 128, with each dimension corresponding to a behavior feature. Each element in the feature vector has a value between 0 and 1, representing the weight of that feature. For example, for DDoS attack behavior, the dimension weight value in its feature vector representing high frequency and small packet size is 0.95, the dimension weight value representing same-source multi-target is 0.87, and the dimension weight value representing TCP SYN flag is 0.92. This representation method allows different threat behaviors to form clusters in vector space, facilitating subsequent matching and identification.

[0118] In the process of constructing the feature evolution graph using n-dimensional feature vectors, each feature vector is treated as a node in the graph, and the edges between nodes represent the transition relationship of behavior states. The weight of the edge is calculated from historical observation data, representing the probability of state transition. For example, the transition probability from the port scanning feature vector to the exploit feature vector is 0.75, indicating that there is a 75% chance of observing a vulnerability exploitation behavior after observing a port scanning behavior. The feature evolution graph uses a directed weighted graph structure for storage, with each node containing a feature vector and its corresponding threat type identifier.

[0119] When mapping n-dimensional feature vectors to three-domain behavior portraits, the three-domain behavior portraits include network domain, host domain, and application domain. The network domain portrait describes network communication behavior features such as traffic patterns, protocol preferences, and communication objects; the host domain portrait describes system operation behavior features such as process activity, file operation, and resource usage; and the application domain portrait describes application layer behavior features such as user interaction, function call, and data processing. The mapping process is achieved through feature decomposition and recombination, which decomposes the 128-dimensional feature vector into three sub-vectors corresponding to the behavior features of the three domains, with dimensions of 48, 42, and 38 respectively. The mapping algorithm uses a self-adaptive weighting method guided by domain knowledge to automatically adjust the mapping weights based on feature attributes.

[0120] When calculating the matching probability of the three-domain behavior portrait based on the feature state transition probability in the feature evolution graph, for the input unknown behavior, its feature vector is extracted and the similarity with the known threat behavior feature vector in the feature library is calculated. The similarity calculation uses the cosine similarity method, and the value closer to 1 indicates a higher matching degree. For vectors with a similarity exceeding the threshold value of 0.8, the state transition probability in the feature evolution graph is extracted. For example, the similarity between a certain unknown behavior and the command and control behavior in APT attack is 0.86, and the state transition probability matrix of the behavior vector obtained from the feature evolution graph is [0.12, 0.35, 0.45, 0.08], corresponding to the transition probabilities to the next state respectively.

[0121] When calculating the feature matching degree according to the matching probability and the preset weight coefficient, the domain weight coefficient is introduced, and the weight coefficients of the network domain, host domain and application domain are 0.35, 0.40 and 0.25 respectively, reflecting the importance of different domains in threat judgment. The matching degree calculation formula is the weighted sum of the matching probability of each domain and the corresponding weight. Taking a certain malware as an example, the network domain matching probability is 0.92, the host domain matching probability is 0.85, and the application domain matching probability is 0.78, and the calculated comprehensive matching degree is 0.92×0.35 + 0.85×0.40 + 0.78×0.25 = 0.855.

[0122] When constructing the attack evolution graph according to the feature state transition probability, the attack behavior sequence is modeled using Markov decision process. The attack evolution graph is a directed graph, where nodes represent attack states and edges represent attack behaviors, and the weight on the edge represents the state transition probability. When establishing the attack evolution graph, the initial state and the termination state are first determined, the initial state is reconnaissance behavior, and the termination state is data theft or system destruction. The intermediate states include attack stages such as vulnerability exploitation, privilege escalation, and lateral movement. The transition between states is obtained by statistical analysis of historical attack data, for example, the transition probability from the "privilege escalation" state to the "lateral movement" state is 0.68, indicating that the attacker has a 68% chance of attempting to move laterally within the network after obtaining higher privileges.

[0123] When calculating the attack path probability using the attack evolution graph, the forward algorithm is used to calculate all paths and their probabilities from the initial state to the termination state. The path probability is the product of all transition probabilities on the path. For example, the probability of the path "reconnaissance → vulnerability exploitation → privilege escalation → lateral movement → data theft" is 0.85×0.72×0.68×0.75=0.31, indicating that the attacker has a 31% chance of completing the attack along this path. The path probability calculation considers the continuity of multi-step attack chains and reflects the sequence characteristics of attack behaviors.

[0124] When predicting the optimal attack path by combining attack path probability and feature matching degree, the comprehensive risk score of each attack path is calculated. The risk score is the weighted combination of path probability and current state feature matching degree. The path weight is 0.6, and the matching degree weight is 0.4. Taking a detected suspicious behavior as an example, its feature matching degree is 0.855, and the attack path probability most related to it is 0.31. The calculated comprehensive risk score is 0.31x0.6+0.855x0.4=0.528. Calculate the risk score of all paths, and select the path with the highest score as the optimal attack path. This method considers both historical attack patterns and current observed features, improving prediction accuracy.

[0125] When generating protection rules based on the optimal attack path, for each attack state in the path, its feature vector is extracted and converted into specific protection strategies. Protection rules include network protection rules, host protection rules, and application protection rules. Network protection rules include access control lists, traffic filtering rules, and abnormal traffic blocking rules; host protection rules include process behavior restrictions, file access control, and system configuration reinforcement; application protection rules include interface access restrictions, data processing verification, and user behavior audit. Rule generation uses a template matching method, selects the corresponding protection template according to the attack characteristics, and parameterizes according to the specific environment. For example, for the detected command and control behavior, the generated network protection rules include "block all TCP connections with IP address 10.20.30.40", the host protection rules include "restrict the network communication rights of process exploit.exe", and the application protection rules include "add secondary identity verification for database query operations".

[0126] The deployment strategy of protection rules considers the risk level and protection cost of each node in the attack path. The risk level is determined by the node's position in the attack path and the attack success probability. Protection cost includes resource consumption and impact on normal business. In the case of limited resources, protection rules for high-risk nodes are deployed first. Protection rules are stored in the rule library in a standard format, including rule ID, trigger condition, execution action, priority, and effective range fields. The rule evaluation mechanism checks rule validity regularly and adjusts rule parameters or eliminates inefficient rules based on protection effect and false positive rate.

[0127] In practical application, after deploying the protection system on an e-commerce platform, a credential stuffing attack against user accounts was successfully detected and blocked. The system first identified abnormal login behavior with a feature matching degree of 0.89, predicted the probability of the attacker's next attempt to elevate privileges as 0.42, and calculated the comprehensive risk score as 0.612. The system automatically generated and deployed protection rules including IP flow control, account lock, and secondary verification, effectively blocking the attack and protecting user account security.

[0128] In an optional implementation, the method further comprises: constructing an attack evolution graph according to the feature state transition probability, calculating an attack path probability by using the attack evolution graph, and combining the attack path probability with the feature matching degree to predict an optimal attack path.

[0129] The attack evolution graph comprises a set of attack state nodes and a set of state transition edges, and the attack evolution graph is used to generate a new attack state node and a state transition edge according to the set of attack state nodes, and to evaluate the structural similarity of the new attack state node and the state transition edge.

[0130] An evolution graph quality evaluation function is constructed based on the structural similarity and the evaluation score, and the attack evolution graph is iteratively optimized according to the evolution graph quality evaluation function to obtain an optimized attack evolution graph.

[0131] The optimized attack evolution graph is input into the evolution graph quality evaluation function, a candidate attack path is generated based on a current attack state, a path transition probability is calculated between adjacent attack state nodes in the candidate attack path, and the path transition probability is combined with a feature matching degree to obtain a path feasibility evaluation value.

[0132] A path feature vector of the candidate attack path is extracted, the feature matching degree between the path feature vector and a preset feature state vector is calculated, the path transition probability is combined with the feature matching degree to obtain a path feasibility evaluation value, and an optimal attack path is selected from the candidate attack path according to the path feasibility evaluation value.

[0133] As shown in FIG. 1, Figure 3 the method comprises:

[0134] The attack evolution graph comprises a set of attack state nodes and a set of state transition edges, and the attack state node represents a state reached by an attacker in a network, such as obtaining user permissions, accessing a specific server, etc. The state transition edge represents a transition path from one attack state to another attack state. After constructing an initial attack evolution graph, a new attack state node and a state transition edge are generated according to the set of existing attack state nodes. The specific operation process is as follows: the existing attack state nodes are analyzed, and the feature attributes of each node are identified, including permission level, accessible resources, vulnerability utilization, etc.; based on these feature attributes, a new attack state is generated through a preset state evolution rule; at the same time, a state transition edge from the existing node to the new node is established, and an initial transition probability value is assigned to each transition edge. For example, if the current attack state is "obtain ordinary user permissions", two new attack state nodes "promote to administrator permissions" and "move horizontally to adjacent servers" are generated, and the corresponding state transition edges are established.

[0135] The structural similarity of the newly generated attack state node and the state transition edge is evaluated, and the structural similarity calculation considers the topological relationship between nodes, node attribute similarity, and edge characteristics. In specific implementation, the system first constructs an adjacency matrix between nodes to record the connection relationship between nodes; for each pair of nodes, the similarity between their attribute vectors is calculated, including attack type, target resource, required permission, etc. dimensions; finally, the overall structural similarity between the node pair is obtained by integrating the topological position of the node and the attribute similarity. For example, two attack state nodes both represent "database server privilege escalation", and both are connected to the "obtain sensitive data" node, so their structural similarity is high.

[0136] Based on the structural similarity and the evaluation score, an evolution graph quality evaluation function is constructed, which comprehensively considers the integrity, consistency and practicability of the attack evolution graph. The input of the evaluation function includes the node set, edge set, structural similarity matrix between nodes of the attack evolution graph and the preset evaluation weight. The evaluation score calculation process includes: graph coverage score, which measures the coverage degree of the evolution graph to the attack path; structural redundancy score, which identifies and punishes redundant nodes and paths with similar structure; path rationality score, which evaluates whether the generated attack path conforms to the actual attack logic. For example, for an attack evolution graph containing 100 nodes, if it covers 95% of the known attack techniques, the structural redundancy is 15%, and the path rationality score is 0.85, then the comprehensive evaluation score is 0.78.

[0137] According to the evolution graph quality evaluation function, the attack evolution graph is iteratively optimized, redundant nodes with high structural similarity (such as 0.9) are identified and removed; functionally similar state transition edges are merged; state transition probabilities are adjusted to better reflect the actual attack situation; missing but reasonable attack state nodes and transition edges are added. Through multiple rounds of iterative optimization, the system continuously improves the quality of the attack evolution graph until the score of the evaluation function no longer significantly improves or reaches the preset number of iterations. In practical application, an initial attack evolution graph containing 80 nodes and 120 edges is optimized for 10 rounds, and is adjusted to 75 nodes and 115 edges, with the evaluation score improving from 0.65 to 0.88.

[0138] The optimized attack evolution graph is input into an evolution graph quality evaluation function, and a candidate attack path is generated based on the current attack state. The generation process uses a depth-first search algorithm to explore attack paths from the current attack state node. To avoid path explosion, the maximum search depth (e.g., 8) and the maximum number of candidate paths (e.g., 100) are set. For each generated candidate attack path, the state transition probabilities between adjacent attack state nodes in the path are calculated, and these probability values are multiplied to obtain the path transition probability. For example, the transition probabilities of each segment of the path "network scanning → vulnerability discovery → privilege acquisition → data theft" are 0.8, 0.6, and 0.7, respectively, and the overall path transition probability is 0.336.

[0139] The path feature vector of the candidate attack path is extracted, including path length, attack technology type, target resource value, and other dimensions. The feature matching degree of the path feature vector and the preset feature state vector is calculated using the cosine similarity method. The feature matching degree reflects the degree of conformity of the candidate path to the expected attack pattern. The path transition probability and the feature matching degree are combined with equal weights to obtain the path feasibility evaluation value. For example, for a candidate attack path, the path transition probability is 0.336, the feature matching degree is 0.75, and the equal weight combination method is used, then the path feasibility evaluation value is 0.543.

[0140] The candidate attack paths are sorted according to the path feasibility evaluation value, and the path with the highest evaluation value is selected as the optimal attack path. In actual application scenarios, such as network security protection systems, the system generates 50 candidate attack paths, calculates the feasibility evaluation value of each path, and finally identifies the path "external network scanning → exploiting Web application vulnerabilities → obtaining Web server privileges → lateral movement to database servers → escalating privileges → stealing core data" with an evaluation value of 0.82 as the optimal attack path, providing guidance for security protection strategy formulation.

[0141] Through the above method, the system can effectively construct and optimize the attack evolution graph, and comprehensively utilize path probability and feature matching degree to predict attack paths, providing decision support for network security protection.

[0142] In an optional implementation, according to the protection rule, a corresponding protection measure is deployed in the virtual target environment, and the attack feature countermeasure behavior data is continuously obtained through multi-modal perception, including:

[0143] According to the protection rule, a protection measure is deployed in the virtual target environment, and the attack feature countermeasure behavior data in the virtual target environment is obtained using a multi-agent collaborative perception mechanism. The countermeasure strategy evolution direction of the attack feature is calculated based on the countermeasure behavior data, the protection rule is updated according to the countermeasure strategy evolution direction, and the updated protection rule is redeployed in the virtual target environment.

[0144] In the process of deploying protection measures in the virtual target environment according to the protection rules, the structure and content of the protection rules are parsed, and the protection rules usually contain attack feature identification conditions, response actions, priorities, and execution logic elements. For example, for a distributed denial of service (DDoS) attack protection rule, its identification conditions include "source IP address dispersion > 0.85", "request frequency per unit time > 500 times / sec", "TCP SYN packet ratio > 75%" and the like; the response actions include "discard related data packets", "limit source IP access frequency", or "start traffic cleaning" and the like. The system converts these rules into executable protection strategies and deploys corresponding protection components at key nodes of the virtual target environment, such as traffic filters at network boundaries, abnormal behavior detectors at application layers, and system resource monitors and the like.

[0145] The virtual target environment is a simulation environment of the real target system, including network topology, service components, data flow, and business logic. In the embodiment, the virtual environment is composed of multiple virtual machines and containers connected through software-defined networks. The environment simulates a typical three-layer architecture application system, including a load balancing layer, an application service layer, and a data storage layer, and is configured with a similar business traffic pattern as the production environment. The protection measures are deployed in the virtual firewall at the network entrance, the web application protection system in front of the application server, and the host protection agent of each node, forming a multi-level protection system.

[0146] In the implementation of obtaining attack feature countermeasure data in the virtual target environment using the multi-agent collaborative perception mechanism, the system deploys multiple types of intelligent perception agents, including network traffic analysis agents, system behavior monitoring agents, log analysis agents, and application state monitoring agents. These agents are distributed at different locations in the virtual environment and are responsible for data collection and preliminary analysis in specific domains. For example, network traffic analysis agents are located at key network nodes to capture data packets and extract traffic features; system behavior monitoring agents are deployed in host systems to record system calls and resource usage; log analysis agents collect and parse logs generated by various components; and application state monitoring agents track the running state and response time changes of application programs.

[0147] The core of multi-agent collaborative perception is information sharing and collaborative analysis between agents. The raw data collected by each agent is transmitted to the central coordinator through a secure communication channel. The coordinator realizes data fusion, establishes event correlation, and forms a global view. For example, when a suspicious web request pattern is detected, the network traffic analysis agent extracts the features and notifies the coordinator, which immediately requests the system behavior monitoring agent and the application state monitoring agent of the related server to provide supplementary information to determine whether there is an attack attempt and its actual impact on the system.

[0148] In practical applications, the multi-agent collaborative perception mechanism can capture the countermeasures taken by attackers against existing protection rules. For example, when the basic protection rules block requests containing keywords such as "SELECT" and "UNION", attackers use techniques such as character encoding transformation, comment insertion, or semantic equivalent replacement to bypass detection. The multi-agent system captures these transformed request contents through network traffic agents, while the application state monitoring agent observes that the database executes unexpected queries, and the system behavior monitoring agent records abnormal data access patterns. The coordinator integrates this information to identify the specific countermeasures used by the attacker, such as splitting "SELECT" into "SEL" + "ECT" or using hexadecimal encoding.

[0149] The collection of countermeasure data includes dimensions such as original request content, transformation technique features, bypass success rate, and target system response. In a test against a web application, the system collected 400 samples of attackers attempting to bypass XSS protection through HTTP parameter pollution, using different parameter encoding methods and injection positions. The system recorded the request details, bypass results, and server responses for each attempt, and found that 27% of the transformed attacks successfully bypassed existing rules. These successful samples mainly used techniques such as HTML entity encoding and event handler nesting.

[0150] Based on the countermeasure data, the system clusters and extracts features from the collected countermeasure samples to identify the main countermeasure types and techniques used by attackers. By comparing attack samples from different periods, the system can discover the evolution trend of attack features, such as the transition from simple character replacement to complex context-aware obfuscation.

[0151] In the analysis of the evolution direction of countermeasures, a vector representation of attack features is constructed, including dimensions such as syntax structure, semantic features, and execution effects. By comparing successful bypass samples and blocked samples, the system identifies effective countermeasures. In the aforementioned XSS attack case, the system analyzes and finds that attackers are transitioning from single encoding to multi-layer nested encoding, and are beginning to use specific browser parsing differences to bypass detection. In addition, attackers have increased indirect triggering methods based on DOM operations, which are difficult to detect through static rules.

[0152] During the process of updating the protection rules and redeploying according to the evolution direction of the countermeasures, the system automatically generates rule patches or completely new rule entries, including extending feature matching patterns, increasing detection depth, adjusting threshold parameters, and optimizing response strategies. For the multi-layer encoded XSS attacks discovered, the system adds recursive decoding processing and context-sensitive input validation rules. To deal with DOM operation type attacks, the system adds dynamic detection logic based on browser behavior simulation.

[0153] The updated rules are automatically verified and tested to ensure that they can effectively protect known countermeasures while not significantly increasing false positive rates or affecting system performance. In the test environment, the updated XSS protection rules reduce the previous bypass rate of 27% to 3%, while the false positive rate is controlled within an acceptable range (less than 0.5%). After the rule verification passes, the system deploys the updated protection rules to the virtual target environment, replacing or supplementing the original rules, and continuously monitors their effectiveness.

[0154] Through this continuous "deployment-sensing-analysis-update" loop mechanism, the system can adapt to the changing attack countermeasures and maintain the effectiveness of the protection measures. This dynamic adaptive protection method significantly improves the system's ability to protect against unknown variant attacks.

[0155] The method further comprises:

[0156] The method further comprises:

[0157] A network tunnel is established to implement traffic steering. The SDN controller establishes a dedicated tunnel between the enterprise Internet gateway and the network where the threat capture system is located, forming an independent traffic channel. Tunnel technology can use GRE, VXLAN, or IPsec protocols to ensure the security and reliability of data transmission. For example, when using a GRE tunnel, tunnel interfaces are created on the enterprise gateway and the router connected to the threat capture system, respectively, and source and destination addresses and key parameters are configured to establish a point-to-point connection. The two ends of the tunnel are identified as tunnel-1, which becomes the forwarding target for subsequent steering policies. The network tunnel not only provides a traffic transmission channel, but also ensures that malicious traffic does not pollute the enterprise network through isolation mechanisms. Even if the threat capture system is compromised, attackers cannot use it as a stepping stone to access other systems in the internal network.

[0158] Malicious traffic detection uses a multi-level defense mechanism. At the network layer, the firewall analyzes traffic characteristics through deep packet inspection technology to identify known attack characteristics. At the application layer, security defense software monitors service requests and responses to detect abnormal access patterns. At the system layer, behavior monitoring components analyze process activity and file operations to detect suspicious behavior. When potential threats are detected, the intrusion detection module extracts key information such as source IP address, target IP address, protocol type, and application layer characteristics to construct threat characteristic descriptions. For example, for a web application attack, the detection module detected that the source IP address 1.2.1.5 initiated 500 login requests to the 10.1.1.1 server within 60 seconds, with a login failure rate of 95%, which matches the attack characteristics of password brute force cracking. The intrusion detection module marks this IP as a malicious source and triggers subsequent defense measures.

[0159] Threat intelligence analysis enhances detection capabilities, especially for unknown threats. The threat intelligence module receives data provided by the intrusion detection module, including IP addresses, domain names, URLs, file hashes, and behavior characteristics, and compares them with the threat intelligence library. The intelligence library contains descriptions of known indicators of compromise (IOCs) and attacker tactics, techniques, and procedures (TTPs). The comparison process uses a fuzzy matching algorithm that supports partial feature matching and behavior similarity calculation. For example, even if the attack IP is not included in the intelligence library, but its behavior pattern has a similarity of 85% to the attack methods of known APT organizations, it will be judged as a high-risk threat. The analysis results include threat type, credibility score, and attack phase judgment, which are fed back to the intrusion detection module to assist decision-making.

[0160] The deployment of the threat capture system adopts different strategies according to the enterprise resource conditions. For an enterprise with a large number of external servers but limited threat capture resources, an on-demand deployment mode is adopted. For an enterprise with fewer external servers and sufficient resources, a pre-deployment mode can be adopted. In the on-demand deployment mode, after the cloud computing management platform receives a deployment request containing a malicious IP address and a target IP address, a virtual machine is created on the threat capture server, and a corresponding threat capture system image is loaded according to the target IP address. For example, after detecting attacks on 10.1.1.1 and 10.1.1.2, the platform creates two virtual machines, loads the images corresponding to the two IP addresses respectively, and configures a virtual network environment with a gateway address of 10.1.1.255. After the virtual machine starts, the threat capture system immediately enters a running state and is ready to receive redirected attack traffic. Although the threat capture system uses the same IP address as the real server, it does not cause address conflicts or interfere with normal network operation because it does not publish routing information on the enterprise internal network.

[0161] The creation and issuance of the diversion strategy is the core mechanism of attack traffic redirection. After the SDN controller receives a strategy creation request containing a malicious source IP and a target IP, it generates and issues precise matching rules on the network device. On the enterprise Internet gateway, a diversion strategy matching the source IP of the malicious address is created to direct the hit traffic into the tunnel interface. On the router connected to the threat capture system, a diversion strategy matching the destination IP of the malicious source IP is created to direct the backhaul traffic back to the tunnel. For example, for attack traffic with source IP 1.2.1.1 to 1.2.1.10, a source address matching rule is created on the Internet gateway with a forwarding action to tunnel-1, and a destination address matching rule is created on router-2 with a forwarding action to tunnel-1. This strategy configuration ensures that only malicious traffic is redirected to the threat capture system, while normal user access is not affected, achieving precise protection.

[0162] The traffic forwarding and interactive response mechanism ensures that the attacker is unaware of the environment switching. When attack traffic reaches the enterprise gateway, it is identified by matching the diversion strategy and encapsulated into a tunnel message to be forwarded to the router where the threat capture system is located. The router sends the original message to the corresponding IP threat capture system after unencapsulating it. After receiving the attack message, the threat capture system can generate response messages that meet the protocol requirements due to the high consistency of the environment with the real server. These response messages are encapsulated into a tunnel by the router and returned to the enterprise gateway, and then forwarded to the attack source. The entire process is completely transparent to the attacker, from network connection, protocol interaction to application response, which is no different from directly attacking the real server, providing a highly realistic deception environment. For example, for an attacker's SQL injection attempt on a Web application, the threat capture system not only returns appropriate HTTP response codes and page content, but also simulates database query delays and error messages to enhance the realism of the interaction.

[0163] The resource recycling process after the attack ends ensures efficient operation of the system. The intrusion detection module monitors attack activities by setting a timeout timer. If no traffic from the malicious IP is detected within the preset time (e.g., 15 minutes), it is determined that the attack has ended. Before releasing the threat capture resources, the intrusion detection module first updates the firewall rules to add the confirmed malicious IP to the deny list, preventing the attack from returning. Then it notifies the cloud computing management platform to stop the corresponding threat capture system instance and notifies the SDN controller to delete the related diversion strategy. The cloud computing management platform exports the attack data and system logs recorded by the threat capture system before shutting down the virtual machine for subsequent research by security analysts. After exporting, the virtual machine state is suspended or saved, and the computing and storage resources are released. After receiving the notification, the SDN controller deletes the diversion strategy on the enterprise gateway and router, and restores the normal network routing.

[0164] The continuous updating mechanism of threat intelligence improves the defense effectiveness. Based on the attack data collected by the threat capture system, new threat features are extracted, including attack source information, attack method characteristics, and vulnerability exploitation patterns, which are updated to the threat intelligence library. This closed-loop mechanism enables the defense system to learn from each attack and continuously improve its ability to identify unknown threats. For example, a captured attack exploited an undisclosed zero-day vulnerability. By analyzing the attack traffic and system behavior logs, the feature pattern was extracted and added to the detection rule library, enabling early identification and interception of similar attacks the next time. This adaptive learning capability significantly improves the defense effect against advanced persistent threats (APTs).

[0165] In practical applications, a financial service provider successfully captured and analyzed a targeted attack on its online banking system after deploying the dynamic threat capture system. The attack first scanned the target system architecture and then attempted to exploit application layer vulnerabilities to gain access. After the intrusion detection module identified the abnormal scanning behavior, it marked the source IP as a malicious address and triggered the threat capture system deployment process. The attack traffic was seamlessly directed to the threat capture environment, and the attacker continued their penetration attempts, including vulnerability exploitation and privilege escalation. The entire attack process was recorded, and the security team analyzed the unknown vulnerabilities in the application and promptly patched the real system, avoiding potential data leakage risks. The attacker was unaware of the environmental changes and eventually abandoned the attack after multiple attempts. This case demonstrates the dual value of the dynamic threat capture system in protecting critical business systems while collecting high-value threat intelligence.

[0166] In a second aspect of the embodiments of the present application, a construction system of a dynamic threat capture system is provided, comprising:

[0167] The first unit is configured to acquire heterogeneous security data in a target network environment, extract a three-domain behavior portrait based on the heterogeneous security data, construct a multi-dimensional feature vector, and identify an attack feature with a threat through feature matching of the three-domain behavior portrait.

[0168] The second unit is configured to dynamically construct a virtual target environment with a layered protection architecture according to the attack feature, guide the attack feature into the virtual target environment, and acquire threat behavior data through multi-modal perception based on a feature template of the three-domain behavior portrait.

[0169] The third unit is configured to construct a threat behavior feature library, compare the threat behavior data with the three-domain behavior portrait, predict a subsequent attack path, and generate a protection rule.

[0170] The fourth unit is configured to deploy a corresponding protection measure in the virtual target environment according to the protection rule, continuously acquire countermeasure behavior data of the attack feature through multi-modal perception, update the threat behavior feature library based on the countermeasure behavior data, and optimize the protection rule to realize continuous countermeasures against the attack feature.

[0171] In a third aspect, an electronic device is provided, including:

[0172] a processor;

[0173] a memory for storing processor-executable instructions;

[0174] The processor is configured to invoke the instructions stored in the memory to execute the method described above.

[0175] In a fourth aspect, a computer-readable storage medium is provided, which stores computer program instructions. The computer program instructions are executed by a processor to implement the method described above.

[0176] The present application can be a method, device, system and / or computer program product. The computer program product can include a computer readable storage medium having computer readable program instructions loaded thereon for performing various aspects of the present application.

[0177] Finally, it should be noted that: the above embodiments are only used to illustrate the technical solutions of the present application, and not to limit them; although the present application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that: it can still modify the technical solutions recorded in the foregoing embodiments, or make equivalent replacement for part or all of the technical features; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the scope of the technical solutions of the embodiments of the present application.

Claims

1. A method of constructing a dynamic threat capture system, characterized by, The method comprises the following steps: extracting a three-dimensional feature vector from the heterogeneous security data, constructing a multi-dimensional feature vector, and identifying threat attack features through feature matching of the three-domain behavior portrait, comprising: extracting a three-dimensional feature vector from the heterogeneous security data, constructing a behavior state node by concatenating the three-dimensional feature vector, calculating the state transition probability between the behavior state nodes to construct a state transition edge, and constructing the behavior state node and the state transition edge into a behavior evolution graph; based on the behavior evolution graph, calculate the behavior similarity deviation and state transition anomaly degree between adjacent behavior state nodes, and mark the behavior state node with a mutation node if the behavior similarity deviation is greater than a preset similarity threshold and the state transition anomaly degree is greater than a preset anomaly threshold; According to the mutation node, the feature weight in the three-dimensional feature vector is adaptively adjusted to generate an adjusted feature weight; based on the adjusted feature weight, the three-dimensional feature vector is weighted and fused to construct a three-domain behavior portrait; Calculate the feature matching degree of the to-be-identified behavior portrait and the historical behavior portrait, calculate the evolution prediction probability of the to-be-identified behavior portrait based on the behavior evolution graph, and calculate the identification score according to the feature matching degree and the evolution prediction probability; based on the identification score, the attack feature of the to-be-identified behavior portrait is identified, and the identification result is fed back to the behavior evolution graph for updating, so as to realize dynamic identification of the attack feature; According to the attack feature, a virtual target environment with a layered protection architecture is dynamically constructed, the attack feature is introduced into the virtual target environment, and multi-modal perception is performed based on the feature template of the three-domain behavior portrait to obtain threat behavior data; Construct a threat behavior feature library, compare the threat behavior data with the three-domain behavior portrait, predict the subsequent attack path, and generate a protection rule; According to the protection rule, deploy corresponding protection measures in the virtual target environment, continuously obtain the countermeasure behavior data of the attack feature through multi-modal perception; based on the countermeasure behavior data, update the threat behavior feature library and optimize the protection rule, so as to realize continuous countermeasures for the attack feature.

2. The method of claim 1, wherein, Calculate the feature matching degree of the to-be-identified behavior portrait and the historical behavior portrait, calculate the evolution prediction probability of the to-be-identified behavior portrait based on the behavior evolution graph, and calculate the identification score according to the feature matching degree and the evolution prediction probability, comprising: input the to-be-identified behavior portrait and the historical behavior portrait into the discriminator of the generative adversarial network, model the matching degree of the to-be-identified behavior portrait and the historical behavior portrait through the discriminator, and output the feature matching degree; extract the adjacent nodes of the to-be-identified behavior portrait, generate a behavior evolution path based on the adjacent nodes according to the generator of the generative adversarial network, map the behavior evolution path to the behavior evolution graph, and output the correlation features between the nodes in the behavior evolution graph according to the discriminator of the generative adversarial network based on the behavior evolution graph. Get the fusion correlation score; The generator of the generative adversarial network is used to explore a candidate path set starting from a node corresponding to the behavior image to be identified in the behavior evolution graph, and a path probability of each candidate path in the candidate path set is obtained based on the authenticity evaluation of the discriminator according to the fusion correlation score; The candidate path set is input into a decision tree ensemble model, an evolution trend of each candidate path is predicted based on the path probability according to the decision tree ensemble model, and an evolution prediction probability is output; the feature matching degree and the evolution prediction probability are input into the decision tree ensemble model, and an identification score is obtained through multi-tree collaborative decision of the decision tree ensemble model.

3. The method of claim 1, wherein, The virtual target environment with a hierarchical protection architecture is dynamically constructed according to the attack features, the attack features are guided into the virtual target environment, and multi-modal perception is performed based on the feature template of the three-domain behavior image to obtain threat behavior data, including: The virtual target environment is divided into different unit sets, an environment feature vector is extracted from the original target environment, a digital twin model is constructed based on the environment feature vector, an environment mapping is generated through the digital twin model, and the attack features are input into the digital twin model to generate a mapping result; the digital twin model is deployed in the different unit sets, and a path evaluation is constructed based on the mapping result; Each candidate guide path in the candidate guide path set is evaluated based on the path evaluation, and the candidate guide path with the highest evaluation score is selected as the optimal guide path; the attack features are guided into the virtual target environment based on the optimal guide path, and an analysis module is constructed; The analysis module is used to extract features from observation data in the virtual target environment to obtain multi-dimensional features; the multi-dimensional features are input into the digital twin model for fusion to obtain fusion features, and the observation data is threat labeled based on the fusion features to obtain threat behavior data.

4. The method of claim 1, wherein, A threat behavior feature library is constructed, the threat behavior data and the three-domain behavior image are compared in features, a subsequent attack path is predicted, and a protection rule is generated, including: The threat behavior features are represented as n-dimensional feature vectors, the n-dimensional feature vectors are used to construct a feature evolution graph, the n-dimensional feature vectors are mapped to a three-domain behavior image, a matching probability of the three-domain behavior image is calculated based on a feature state transition probability in the feature evolution graph, and a feature matching degree is calculated according to the matching probability and a preset weight coefficient; An attack evolution graph is constructed according to the feature state transition probability, an attack path probability is calculated using the attack evolution graph, the optimal attack path is predicted by combining the attack path probability and the feature matching degree, and a protection rule is generated based on the optimal attack path.

5. The method of claim 4, wherein, An attack evolution graph is constructed according to the feature state transition probability, an attack path probability is calculated using the attack evolution graph, the optimal attack path is predicted by combining the attack path probability and the feature matching degree, and a protection rule is generated based on the optimal attack path. The attack evolution graph includes a set of attack state nodes and a set of state transition edges, and a new attack state node and a state transition edge are generated from the set of attack state nodes based on the attack evolution graph, and a structural similarity of the new attack state node and the state transition edge is evaluated; An evolution graph quality evaluation function is constructed based on the structural similarity and an evaluation score, and the attack evolution graph is iteratively optimized based on the evolution graph quality evaluation function to obtain an optimized attack evolution graph; The optimized attack evolution graph is input into the evolution graph quality evaluation function, a candidate attack path is generated based on a current attack state, a state transition probability between adjacent attack state nodes in the candidate attack path is calculated to obtain a path transition probability; A path feature vector of the candidate attack path is extracted, a feature matching degree between the path feature vector and a preset feature state vector is calculated, the path transition probability and the feature matching degree are combined to obtain a path feasibility evaluation value, and an optimal attack path is selected from the candidate attack path based on the path feasibility evaluation value.

6. The method of claim 1, wherein, According to the protection rule, corresponding protection measures are deployed in the virtual target environment, and the attack feature is continuously acquired through multi-modal perception to obtain countermeasure behavior data, including: According to the protection rule, protection measures are deployed in the virtual target environment, and multi-agent collaborative perception mechanism is used to acquire attack feature countermeasure behavior data in the virtual target environment; the countermeasure behavior data is used to calculate the evolution direction of the attack feature countermeasure strategy, and the protection rule is updated according to the evolution direction of the countermeasure strategy, and the updated protection rule is redeployed in the virtual target environment.

7. A construction system for a dynamic threat capture system for implementing the method according to any one of the preceding claims 1-6, characterized in that, Comprising: The first unit is configured to acquire heterogeneous security data in a target network environment, extract a three-domain behavior portrait based on the heterogeneous security data, construct a multi-dimensional feature vector, and identify attack features with threats through feature matching of the three-domain behavior portrait; The second unit is configured to dynamically construct a virtual target environment with a layered protection architecture according to the attack features, guide the attack features into the virtual target environment, and perform multi-modal perception based on a feature template of the three-domain behavior portrait to acquire threat behavior data; The third unit is configured to construct a threat behavior feature library, compare the threat behavior data with the three-domain behavior portrait, predict subsequent attack paths, and generate a protection rule; The fourth unit is configured to deploy corresponding protection measures in the virtual target environment according to the protection rule, and continuously acquire attack feature countermeasure behavior data through multi-modal perception; the threat behavior feature library is updated based on the countermeasure behavior data, and the protection rule is optimized to realize continuous countermeasures against the attack features.

8. An electronic device, comprising: Comprising: A processor; A memory for storing processor-executable instructions; The processor is configured to call the instructions stored in the memory to execute the method of any one of claims 1 to 6.

9. A computer-readable storage medium having stored thereon computer program instructions, wherein, The computer program instructions are executed by the processor to implement the method of any one of claims 1 to 6.

Images