A method and device for proactive countermeasures against network attacks based on dynamic intelligent honeypots

Abstract

This invention discloses a proactive countermeasure method and device for network attacks based on dynamic intelligent honeypots, relating to the field of network security technology. The method's response generation engine uses a hierarchical command classifier to perform real-time security classification of input commands; the command prediction engine uses a hybrid neural network model fusing Bi-LSTM and Transformer to predict the attacker's subsequent behavior and actively guides the attack path through a target-oriented algorithm incorporating decoy scores; the automatic file generation engine dynamically constructs a highly realistic virtual environment based on a large language model and uses steganography to embed countermeasure payloads into multimodal files. This invention combines the realism of high-interaction honeypots with the security of low-interaction honeypots, accurately predicting attack intent and achieving a closed-loop defense from passive trapping to proactive source tracing and countermeasures, effectively solving the technical problems of traditional honeypots being easily identifiable, having escape risks, and lacking proactive guidance capabilities.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a method and apparatus for proactively countering network attacks based on dynamic intelligent honeypots. Background Technology

[0002] In the current cybersecurity defense system, honeypot technology, as a proactive deception method, attracts attackers by simulating systems or services with security vulnerabilities, thereby delaying attacks, analyzing attack behavior, and collecting threat intelligence. However, existing honeypot technologies are mainly divided into two categories: low-interaction honeypots and high-interaction honeypots, both of which have significant inherent flaws.

[0003] Low-interaction honeypots construct traps by simulating limited service protocols and basic command responses. For example, they might simulate an SSH service that only returns pre-defined static responses to login attempts and a few commands like `ls` and `id`. This approach has poor interactivity, making it easy for attackers to bypass the honeypot by sending non-standard commands or probing subtle differences in protocol implementations to perform fingerprinting. Furthermore, because they cannot support complex attack payloads, they are unlikely to induce attackers to expose deep-seated tactics, techniques, and procedures, resulting in limited value for the threat intelligence collected.

[0004] High-interaction honeypots attempt to solve the interactivity problem by providing a complete, real operating system within an isolated environment such as a virtual machine or container. This allows attackers to execute arbitrary commands and interact with the real file system, processes, and services. While this can collect richer attack data, it introduces a fatal security escape risk: attackers may exploit unknown vulnerabilities in the operating system kernel or virtualization software to escape from the isolated environment and subsequently attack the host machine or internal network, turning defenses into attack springboards. Furthermore, high-interaction honeypots consume significant amounts of CPU, memory, and storage resources, making large-scale, diversified deployment difficult. The recovery and cleanup process after a system is compromised is complex and time-consuming. More critically, once deployed, the environment of existing high-interaction honeypots is static, lacking the ability to predict and proactively guide attacker intent. They can only respond passively and cannot intelligently guide attacks to pre-set trap areas.

[0005] Therefore, the cybersecurity field urgently needs a new honeypot technology that can balance high-fidelity interaction, absolute security, resource efficiency, and intelligent proactive guidance capabilities. Summary of the Invention

[0006] In view of the above-mentioned defects or deficiencies in the prior art, the present invention provides a method and apparatus for proactive countermeasures against network attacks based on dynamic intelligent honeypots, which solves all or part of the technical problems mentioned in the background art.

[0007] One aspect of the present invention provides a proactive countermeasure method for network attacks based on dynamic intelligent honeypots, comprising: classifying and identifying input commands from an attacker; if the input command is a high-risk operation command, generating a false response to the input command, and predicting subsequent commands of the input command according to a hybrid context prediction model to obtain a set of output probability distributions of candidate commands; constructing a comprehensive scoring model for candidate commands based on the output probability and decoy score of each candidate command, ranking the comprehensive scores of each candidate command to obtain the top N candidate commands with the highest comprehensive scores, and pre-generating corresponding simulated responses for the top N candidate commands with the highest comprehensive scores; wherein, the decoy score is used to measure the correlation between the candidate command and the preset decoy, and the preset decoy is a trap file or trap data that induces the attacker to interact; if the subsequent command input by the attacker matches one of the top N candidate commands with the highest comprehensive scores, the pre-generated corresponding simulated response is sent to the attacker; wherein, the simulated response is used to induce the attacker to obtain hidden countermeasure payloads.

[0008] In another aspect, the present invention provides a network attack proactive countermeasure device based on dynamic intelligent honeypots, comprising: a command classification module configured to classify and identify input commands from an attacker; a command prediction module configured to generate a false response to the input command if the input command is a high-risk operation command, and predict subsequent commands of the input command according to a hybrid context prediction model to obtain a set of output probability distributions of candidate commands; an inducible command generation module configured to construct a comprehensive scoring model of candidate commands based on the output probability and decoy score of each candidate command, sort the comprehensive scores of each candidate command to obtain the top N candidate commands with the highest comprehensive scores, and pre-generate corresponding simulated responses for the top N candidate commands with the highest comprehensive scores; wherein, the decoy score is used to measure the correlation between the candidate command and the preset decoy, and the preset decoy is a trap file or trap data that induces the attacker to interact; and a simulated response feedback module configured to send the pre-generated corresponding simulated response to the attacker if the subsequent command input by the attacker matches one of the top N candidate commands with the highest comprehensive scores; wherein, the simulated response is used to induce the attacker to obtain hidden countermeasure payloads.

[0009] The technical solution of this invention constructs a honeypot system that provides a high-fidelity interactive experience while fundamentally eliminating the risk of security escape. This honeypot system can accurately predict the attacker's command sequence, thereby optimizing response latency and intelligently guiding attack behavior. Based on high-level role settings, it automatically generates a logically consistent deceptive environment containing deep decoys. Furthermore, the honeypot system integrates proactive countermeasures, enabling reverse control of the attacker's host when the attacker steals and uses the decoy file, completing a closed loop from passive defense to proactive counterattack.

[0010] The main innovative points of this invention include:

[0011] (1) Hierarchical command classifier. It combines hashing, regular expressions, and lightweight machine learning models to achieve efficient, low-cost, and accurate real-time scheduling of input commands. The classifier adopts a hierarchical classification algorithm, filtering layer by layer, avoiding complex model inference for all commands.

[0012] (2) Hybrid Context Prediction Model. This model innovatively integrates the advantages of bidirectional long short-term memory networks and Transformer encoders, enabling a deeper understanding of the context and temporal relationships of command sequences, accurately capturing the temporal dependencies and key features in command sequences, and improving prediction accuracy.

[0013] (3) Induced command generation algorithm. By introducing a decoy score into the comprehensive scoring function, the command prediction not only pursues accuracy, but also actively and intelligently leads the attacker to the preset trap.

[0014] (4) Countermeasure Load Injection Module. Combined with LLM content generation, it can embed countermeasure loads in multimodal files in a highly covert manner, greatly improving the success rate of active countermeasures. Attached Figure Description

[0015] Other features, objects, and advantages of this application will become more apparent from the following detailed description of non-limiting embodiments with reference to the accompanying drawings:

[0016] Figure 1 This is a flowchart illustrating a proactive countermeasure method against network attacks based on a dynamic smart honeypot, provided in one embodiment of this application.

[0017] Figure 2 This is a schematic diagram of a network attack proactive countermeasure device based on a dynamic smart honeypot, provided in another embodiment of this application;

[0018] Figure 3 This is a schematic diagram of the structure of an electronic device provided in another embodiment of this application. Detailed Implementation

[0019] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0020] The terminology used in the embodiments of this invention is for the purpose of describing particular embodiments only and is not intended to limit the invention. The singular forms “a,” “the,” and “the” used in the embodiments of this invention are also intended to include the plural forms unless the context clearly indicates otherwise.

[0021] This application provides a proactive countermeasure method for network attacks based on dynamic intelligent honeypots. This method combines a dynamic intelligent honeypot system with a large language model (LLM), deep learning prediction algorithms, and proactive countermeasure mechanisms, aiming to build an intelligent, dynamic, and countermeasure-capable deception defense system.

[0022] This example demonstrates a complete workflow in a highly realistic application scenario. Suppose an administrator wants to deploy a honeypot to trap hackers attempting to exploit cloud platform misconfigurations. The honeypot simulates a development and operations host with a CI / CD misconfiguration.

[0023] See Figure 1 The network attack proactive countermeasure method based on dynamic intelligent honeypot of the present invention is implemented through the following steps:

[0024] Step S101: Classify and identify the attacker's input commands.

[0025] Specifically, through the system management interface, the administrator defines the role of the honeypot instance as: "A containerized development environment for a DevOps engineer, responsible for the project's CI / CD process, but with incorrect AWS key configuration." Upon receiving this role definition, the system launches an automatic file generation engine. The large language model agent within the engine parses the role definition, understanding that a development environment containing a Node.js application, Docker container configuration, CI / CD pipeline files, and AWS credentials needs to be built. After the development environment is built, the large language model agent dynamically generates the structure and content of a virtual file system, including: source code (.py, .js), configuration files (.conf, .yml), documents (.md, .pdf), images (.jpg, .png), etc. The large language model agent selects suitable carriers from various files in the virtual file system, and then embeds counter-payloads in the carriers in a covert manner, including: (1) embedding encoded shellcode in code comments, metadata, or non-critical logic; (2) using steganography (such as the Least Significant Bit (LSB) algorithm) to hide the binary data of the payload in the pixel values ​​of an image or the metadata of a document. Finally, a normal business script is created, and a trigger command is set in the business script. The trigger command is used to automatically extract the hidden counter-payload from the specified carrier and execute it when the attacker executes the business script. The above method is far more covert than directly placing a malicious executable file, and is more likely to lure experienced attackers. At this point, a dynamic honeypot environment containing deep decoys and counter-traps is ready.

[0026] The response generation engine is the system's gateway, responsible for the rapid and accurate analysis and scheduling of every input from attackers, ensuring the system achieves an optimal balance between security and simulation fidelity. At the heart of the response generation engine is a hierarchical command classifier, which filters input commands layer by layer through a hierarchical classification algorithm, avoiding complex model inference for all commands and thus achieving millisecond-level responses.

[0027] Hierarchical classification algorithms include:

[0028] The first layer is a hash-based whitelist filtering system.

[0029] The system calculates the hash value of the command input by the attacker (also known as the attacking host) and determines whether the hash value falls within a pre-stored set of hashes for high-frequency secure commands (i.e., low-risk operation commands such as ls, pwd, whoami, and date). If it does, the input command is classified as a secure execution command (i.e., a low-risk operation command). The response generation engine schedules this command to be executed by the underlying real system kernel. The kernel returns a realistic list of the current directory, including folders such as .aws, app, documents, and scripts. The attacker receives the response. The entire process is extremely short, indistinguishable from a real system.

[0030] The second layer is risk pattern matching based on regular expressions.

[0031] For commands that do not match the hash value whitelist, a set of predefined regular expressions are used for matching to identify high-risk operation patterns. If any regular expression matching a high-risk operation pattern is found, it is directly identified as a simulated command and blocked, i.e., a high-risk operation command.

[0032] The third layer is a heuristic comprehensive scoring model based on lightweight machine learning.

[0033] If the hash value of the input command is not in the hash set and does not match any regular expression in the regular expression rule set, then the feature vector of the input command is extracted and input into a pre-trained lightweight machine learning model, and scored using a scoring function. The risk score for each input command is calculated:

[0034]

[0035] in, This indicates that a command has been entered. This represents the Sigmoid function. Represents the eigenvector. Let b represent the weight vector, and b represent the bias term.

[0036] If the risk score of the input command is greater than the preset threshold, the input command will be judged as a high-risk operation command; otherwise, it will be judged as a low-risk operation command.

[0037] Step S102: If the input command is a high-risk operation command, a false response to the input command is generated, and subsequent commands of the input command are predicted according to the hybrid context prediction model to obtain a set of output probability distributions of candidate commands.

[0038] Specifically, when an input command is determined to be a high-risk operation command, it is forwarded to the command prediction engine, which generates a false response to the input command. The significance of the false response is that if the system consistently returns "no permission" or "no response" to an attacker's high-risk operation commands, it may not be a problem once or twice, but if this happens repeatedly, an experienced attacker will suspect that this is a highly restricted environment or a honeypot. Therefore, it is necessary to return false responses to avoid the aforementioned problems.

[0039] The command prediction engine then activates a hybrid context prediction model to predict subsequent commands of the input command, obtaining a set of output probability distributions for candidate commands. The hybrid context prediction model includes: an embedding layer configured to segment each input command in the historical input command sequence and map it to a high-dimensional vector representation; a bidirectional long short-term memory (LSTM) network layer configured to receive the output vector of the embedding layer and capture the temporal dependencies between historical input command sequences through forward and backward LSM networks. For example, an attacker, after viewing a directory, immediately attempts to read cloud service credentials, indicating their intention to find access keys to the cloud environment; a Transformer encoder layer configured to receive the output sequence of the bidirectional LSM network layer and calculate the association weights between commands in the output sequence using a multi-head self-attention mechanism. For example, the command to read cloud service credentials in the previous step suggests that the attacker is highly likely to perform an operation related to cloud resources in the next step; and an output layer configured to receive the output of the Transformer encoder layer, transform it through a fully connected network, and then normalize it using a Softmax function, ultimately outputting a probability distribution covering all possible command words to represent the likelihood of subsequent commands.

[0040] Step S103: Based on the output probability and decoy score of each candidate command, construct a comprehensive scoring model for the candidate commands, sort the comprehensive scores of each candidate command, obtain the top N candidate commands with the highest comprehensive scores, and pre-generate corresponding simulated responses for the top N candidate commands with the highest comprehensive scores; wherein, the decoy score is used to measure the correlation between the candidate command and the preset decoy, and the preset decoy is a trap file or trap data that induces the attacker to interact.

[0041] Specifically, if only the probability distribution covering all possible command words obtained in step S102 is used to extract possible subsequent commands, it can only accurately predict possible subsequent commands, but cannot proactively and intelligently lead the attacker into a pre-set trap. To achieve this, this step employs an inducible command generation algorithm, constructing a comprehensive scoring model for candidate commands based on the output probability and decoy score of each candidate command, which can be expressed as:

[0042] =

[0043] in, This represents the candidate commands output by the mixed context prediction model; Candidate commands representing the output of the mixed context prediction model The output probability; The decoy score is used to measure the correlation between candidate commands and preset decoys, where preset decoys refer to trap files or trap data that induce attackers to interact. This represents a balancing factor used to adjust the weight between prediction accuracy and predictive power; its value can be determined empirically.

[0044] As can be seen from the comprehensive scoring model, the score of the candidate commands output by the inducible command generation algorithm considers both the model's predicted probability and the potential of the path to lead to a pre-set decoy (such as a file containing a counter-payload). Therefore, by simply embedding triggers for automatically acquiring counter-payloads in the response content of the top-scoring candidate commands, the attacker's attack direction can be actively guided, making it easier for the attacker to fall into a pre-set counter-payload trap. To achieve this, the comprehensive scores of each candidate command are sorted to obtain the top N candidate commands with the highest comprehensive scores. Corresponding simulated responses are pre-generated for these top N candidate commands, and triggers for automatically acquiring counter-payloads are embedded in the simulated responses.

[0045] Step S104: If the subsequent command input by the attacker matches one of the top N candidate commands with the highest comprehensive score, the pre-generated corresponding simulated response is sent to the attacker; wherein, the simulated response is used to induce the attacker to obtain the hidden countermeasure payload.

[0046] Specifically, when an attacker enters a command again, if the entered command happens to match one of the top N candidate commands with the highest overall score, the system can directly retrieve the corresponding simulated response from the cache and return it to the attacker. The response time can be controlled within milliseconds. This extremely fast response perfectly simulates the performance of a real system, completely eliminating any doubts the attacker might have. Furthermore, the simulated response is used to induce the attacker to obtain hidden countermeasures.

[0047] For example, when an attacker sees the mock response `sync_s3.sh`, they might perceive it as a valuable automation script related to AWS credentials and download it to their host. To analyze the script's logic, the attacker might also download the `project_architecture.png` image for reference. When the attacker runs `bashsync_s3.sh` in their local environment, the trigger command within the script is executed. This successfully extracts the hidden MSF reverse shell payload from the `project_architecture.png` image and executes it on the attacker's own host. The payload connects back to a pre-deployed listener in the system's security operations center. Thus, the defender's system not only identifies the source of the attack but also successfully gains control of the attacker's host, achieving precise attribution and effective legal countermeasures, completing a closed loop from initial trapping to final countermeasures.

[0048] The method described in this embodiment enables accurate prediction of the attacker's command sequence, thereby optimizing response latency and intelligently guiding attack behavior. Based on high-level role settings, it automatically generates a logically consistent deceptive environment containing deep decoys. When the attacker steals and uses the decoy file, it achieves reverse control of the attacker's host.

[0049] See Figure 2 Another embodiment of the present invention provides a network attack proactive countermeasure device 200 based on a dynamic smart honeypot, comprising: a command classification module 201, a command prediction module 202, an induced command generation module 203, and a simulated response feedback module 204. This network attack proactive countermeasure device 200 based on a dynamic smart honeypot can execute the network attack proactive countermeasure method based on a dynamic smart honeypot in the method embodiment.

[0050] Specifically, the network attack proactive countermeasure device 200 based on dynamic intelligent honeypots includes:

[0051] Command classification module 201 is configured to classify and identify the input commands of attackers;

[0052] The command prediction module 202 is configured to generate a false response to the input command if the input command is a high-risk operation command, and predict the subsequent commands of the input command according to the hybrid context prediction model to obtain a set of output probability distributions of candidate commands.

[0053] The inducement command generation module 203 is configured to construct a comprehensive scoring model for candidate commands based on the output probability and decoy score of each candidate command, sort the comprehensive scores of each candidate command to obtain the top N candidate commands with the highest comprehensive scores, and pre-generate corresponding simulated responses for the top N candidate commands with the highest comprehensive scores; wherein, the decoy score is used to measure the correlation between the candidate command and the preset decoy, and the preset decoy is a trap file or trap data that induces the attacker to interact;

[0054] The simulation response feedback module 204 sends a pre-generated simulation response to the attacker if the subsequent command input by the attacker matches one of the top N candidate commands with the highest comprehensive score; wherein the simulation response is used to induce the attacker to obtain the hidden countermeasure payload.

[0055] It should be noted that the network attack proactive countermeasure device 200 based on dynamic smart honeypot provided in this embodiment, which can be used to execute the technical solutions of various method embodiments, has a similar implementation principle and technical effect to the method, and will not be described again here.

[0056] See Figure 3 Another embodiment of the present invention provides an electronic device 300, which is used to implement the network attack proactive countermeasure method based on dynamic smart honeypots in the method embodiment. The electronic device 300 in the embodiments of the present invention may include, but is not limited to, devices constituting network security systems and business platforms such as smartphones, tablets, PCs, laptops, and servers. Figure 3 The electronic device 300 shown is merely an example and should not be construed as limiting the functionality and scope of use of the embodiments of the present invention.

[0057] like Figure 3 As shown, the electronic device 300 may include a processing device (e.g., a central processing unit, a graphics processing unit, etc.) 301, which can perform various appropriate actions and processes to implement the methods of the embodiments described herein, based on a program stored in a read-only memory (ROM) 302 or a program loaded from a storage device 308 into a random access memory (RAM) 303. The RAM 303 also stores various programs and data required for the operation of the electronic device 300. The processing device 301, ROM 302, and RAM 303 are interconnected via a bus 305. An input / output (I / O) interface 304 is also connected to the bus 305.

[0058] Typically, the following devices can be connected to I / O interface 304: input devices 306 including, for example, touchscreens, touchpads, keyboards, mice, cameras, microphones, accelerometers, gyroscopes, etc.; output devices 307 including, for example, liquid crystal displays (LCDs), speakers, vibrators, etc.; storage devices 308 including, for example, magnetic tapes, hard disks, etc.; and communication devices 309. Communication device 309 allows electronic device 300 to communicate wirelessly or wiredly with other devices to exchange data. Although Figure 3 An electronic device 300 with various devices is shown; however, it should be understood that it is not required to implement or possess all of the devices shown. More or fewer devices may be implemented or possessed alternatively.

[0059] The above description is merely a preferred embodiment of the present invention. Those skilled in the art should understand that the scope of disclosure involved in the present invention is not limited to the technical solutions formed by specific combinations of the above-described technical features, but should also cover other technical solutions formed by arbitrary combinations of the above-described technical features or their equivalent features without departing from the above-described concept. For example, technical solutions formed by substituting the above-described features with (but not limited to) technical features with similar functions disclosed in the present invention.

Claims

1. A network attack active countermeasure method based on a dynamic intelligent honeypot, characterized in that, The method comprises the following steps: calculating a hash value of an input command of an attacker, determining whether the hash value is located in a hash set of low-risk operation commands, and if yes, determining the input command as a low-risk operation command, otherwise, determining whether the input command matches a predefined regular expression rule set, and if yes, determining the input command as a high-risk operation command; If the hash value of the input command is not in the hash set and does not match any regular expression in the regular expression rule set, a feature vector of the input command is extracted, the feature vector is input into a pre-trained lightweight machine learning model, and a risk score of the input command is calculated by a scoring function The risk score of each input command is calculated: ; wherein, represents an input command, represents a Sigmoid function, represents a feature vector, represents a weight vector, and b represents a bias term; if the risk score of the input command is greater than a preset threshold, the input command is determined as a high-risk operation command, otherwise, it is determined as a low-risk operation command; if the input command is a high-risk operation command, generating a false response of the input command, and predicting a subsequent command of the input command according to a hybrid context prediction model to obtain an output probability distribution of a group of candidate commands; constructing a comprehensive scoring model of the candidate commands according to an output probability of each candidate command and a decoy score, ranking comprehensive scores of each candidate command to obtain a top N candidate command with the highest comprehensive score, and pre-generating a corresponding simulation response for the top N candidate command with the highest comprehensive score; wherein the decoy score is used to measure the relevance between the candidate command and a preset decoy, and the preset decoy is a trap file or trap data for luring the attacker to interact; if the subsequent command input by the attacker matches one of the top N candidate commands with the highest comprehensive score, the corresponding simulation response is sent to the attacker; wherein the simulation response is used to induce the attacker to obtain a hidden countermeasure payload.

2. The network attack active countermeasure method based on a dynamic intelligent honeypot according to claim 1, characterized in that, The hybrid context prediction model comprises: an embedding layer configured to map each input command in a historical input command sequence into a high-dimensional vector representation after tokenization; a bidirectional long short-term memory network layer configured to receive an output vector of the embedding layer and capture a time sequence dependency between the historical input command sequence through a forward long short-term memory network and a reverse long short-term memory network; a Transformer encoder layer configured to receive an output sequence of the bidirectional long short-term memory network layer and calculate an association weight between each command in the output sequence by using a multi-head self-attention mechanism; an output layer configured to receive an output of the Transformer encoder layer, perform transformation through a fully connected network, and then perform normalization processing by a Softmax function to finally output a probability distribution covering all possible command words to represent the possibility of a subsequent command. 3.The network attack active countermeasure method based on dynamic intelligent honeypot of claim 1, wherein, Further comprising: generating a virtual file system and an application environment matched with a current system role positioning through a large language model agent; filtering suitable carriers from various files of the virtual file system, and then embedding a countermeasure payload in the carriers in a hidden manner; creating a normal business script, and setting a trigger command in the business script, the trigger command being used to automatically extract the hidden countermeasure payload from the specified carrier and execute the countermeasure payload when the attacker executes the business script.

4. A network attack active countermeasure device based on a dynamic intelligent honeypot, characterized in that, comprises: a command classification module configured to calculate a hash value of an input command of an attacker, determine whether the hash value is located in a hash set of low-risk operation commands, and if yes, determine the input command as a low-risk operation command, otherwise, determine whether the input command matches a predefined regular expression rule set, and if yes, determine the input command as a high-risk operation command; If the hash value of the input command is not in the hash set and does not match any regular expression in the regular expression rule set, a feature vector of the input command is extracted, the feature vector is input into a pre-trained lightweight machine learning model, and a risk score of the input command is calculated by a scoring function The risk score of each input command is calculated: ; wherein, represents an input command, represents a Sigmoid function, represents a feature vector, represents a weight vector, and b represents a bias term; if the risk score of the input command is greater than a preset threshold, the input command is determined as a high-risk operation command, otherwise, it is determined as a low-risk operation command; The command prediction module is configured to generate a false response of the input command and predict a subsequent command of the input command according to a hybrid context prediction model to obtain an output probability distribution of a group of candidate commands if the input command is a high-risk operation command. The induced command generation module is configured to construct a comprehensive score model of the candidate commands according to an output probability of each candidate command and a decoy score, sort comprehensive scores of the candidate commands to obtain the first N candidate commands with the highest comprehensive scores, and pre-generate corresponding simulation responses of the first N candidate commands with the highest comprehensive scores; wherein the decoy score is used to measure an association degree between the candidate command and a preset decoy, and the preset decoy is a trap file or trap data for inducing interaction of the attacker. The simulation response feedback module is configured to send the pre-generated corresponding simulation response to the attacker if the subsequent command input by the attacker matches one of the first N candidate commands with the highest comprehensive scores; wherein the simulation response is used to induce the attacker to obtain the hidden countermeasure payload.

5. The network attack active countermeasure device based on a dynamic intelligent honeypot according to claim 4, characterized in that, The hybrid context prediction model in the command prediction module comprises: An embedding layer configured to map each input command in a historical input command sequence into a high-dimensional vector representation after tokenization; A bidirectional long short-term memory network layer configured to receive an output vector of the embedding layer and capture a time sequence dependency between the historical input command sequence through a forward long short-term memory network and a reverse long short-term memory network; A Transformer encoder layer configured to receive an output sequence of the bidirectional long short-term memory network layer and calculate an association weight between each command in the output sequence by using a multi-head self-attention mechanism; An output layer configured to receive an output of the Transformer encoder layer, perform transformation through a fully connected network, and finally output a probability distribution covering all possible command words by normalization processing of a Softmax function, so as to represent a possibility of a subsequent command.

6. The network attack active countermeasure device based on a dynamic intelligent honeypot of claim 4, wherein, Further comprising: A countermeasure payload injection module configured to generate a virtual file system and an application environment matched with a current system role by a large language model agent; Filtering suitable carriers from various files of the virtual file system, then embedding a countermeasure payload in the carriers in a hidden manner; creating a normal business script, and setting a trigger command in the business script, the trigger command being used to automatically extract the hidden countermeasure payload from the specified carrier and execute the countermeasure payload when the attacker executes the business script.

Images