A method for identifying attack techniques and tactics facing a honeycomb linkage

Abstract

The application provides a method for identifying attack technology and tactics facing the linkage of honeycomb, comprising: encoding and constructing a training data set according to malicious sample data and associated TTP labels; constructing an interpretable discriminant model for binary classification modeling to obtain the behavior trigger weight vector and bias term of the malicious sample; extracting explicit trigger rules to construct a mapping inference rule library; obtaining alarm data, extracting behavior clues based on a preset standard behavior dimension set and converting to obtain a trigger identifier, mapping the alarm data into an alarm behavior vector; constructing a prediction TTP label set of the alarm behavior vector and recording the trigger path; packaging behavior semantic data, constructing an execution strategy response rule set, mapping the behavior semantic data in the execution strategy response rule set to obtain an execution strategy, and adjusting the deployment of the honeycomb according to the execution strategy. The method can construct and realize the accurate identification and transparent inference of the potential TTP in the attack activity, and support the linkage scheduling of the defense system.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, and in particular to an attack technology and tactic identification method for a honeynet linkage. BACKGROUND

[0002] In the modern network attack and defense confrontation system, attack behavior has changed from traditional single-point vulnerability exploitation to structured, phased, and highly contextual linkage multi-stage attack chains. Such attack patterns are usually composed of a series of operation steps with tactical semantics, referred to as "Tactics-Techniques-Procedures" (TTPs). Attack semantic reasoning capability centered on TTPs has become a key technology direction for threat detection and attack attribution. Deception defense strategies combined with TTPs have become the core direction of the current network security defense system transformation.

[0003] Existing technologies mainly use deep learning-based methods, graph structure-based semantic modeling methods, and rule template methods based on expert knowledge to identify TTPs. Although significant progress has been made in TTP identification tasks, there are still shortcomings in explainability and adaptability, and the practical value is relatively low:

[0004] Deep learning-based methods rely on a large number of labeled samples for end-to-end modeling. Although they have strong feature fitting capabilities, their reasoning paths are usually implicit in high-dimensional representation spaces, lacking clear logical chains. Therefore, when outputting TTP labels, it is difficult to provide intuitive explanation basis or auditable decision rules. This "black box" will lead to insufficient decision-making credibility in the network security scenario. Moreover, this type of method is easily affected by abnormal behavior features or unknown attack samples, resulting in incorrect judgments.

[0005] Graph structure modeling methods can theoretically capture high-order dependency relationships between attack behaviors and are suitable for complex attack path analysis. However, in practice, there are two key limitations: on the one hand, this method highly depends on the structural integrity of behavior sequences or attack chains, and when the observed data is fragmented and context is missing, the model performance significantly decreases; on the other hand, since its learning process is mostly based on existing graph structure data, it is difficult to cope with the diversity and variant patterns of attack behaviors, and its generalization ability for new TTPs is relatively weak. This type of method has high uncertainty in dynamic defense scenarios.

[0006] Rule matching methods have good explainability and engineering controllability, and can quickly locate known TTP behaviors in specific attack scenarios. However, its core relies on manually constructed and maintained rule libraries, which have limited coverage and difficulty in discovering unknown behavior patterns. Moreover, as attack methods evolve, rules become obsolete quickly, requiring high update and maintenance costs, relying on domain expert experience, and lacking self-adaptation ability. In addition, this type of method has a relatively rigid abstraction of attack behavior, with weak behavior feature generalization ability.

[0007] Therefore, it is necessary to provide a TTP identification method to improve the interpretability and adaptability of TTP identification, and to provide practical technical support for the deception defense system against APT threats. Summary of the Invention

[0008] The purpose of this invention is to provide a method for identifying attack techniques and tactics in honeypot linkage, so as to improve the interpretability and adaptability of TTP identification and provide practical technical support for the deception defense system against APT threats.

[0009] In a first aspect, the attack technique and tactical identification method for honeycomb linkage provided by this invention includes: acquiring malicious sample data; encoding the malicious sample data and associated TTP tags and constructing a training dataset, wherein the training dataset includes the sample behavior vector of the malicious sample and the corresponding tag target vector; constructing an interpretable discriminant model, wherein the interpretable discriminant model is used to perform binary classification modeling on the sample behavior vector and the tag target vector to obtain the behavior trigger weight vector and bias term for each tag dimension of the malicious sample; extracting explicit triggering rules based on the behavior trigger weight vector and bias term for each tag dimension; constructing a mapping inference rule base based on the explicit triggering rules; and acquiring alarms. The data is extracted based on a preset set of standard behavioral dimensions to obtain behavioral clues and trigger identifiers. Alarm data is mapped to alarm behavior vectors based on the trigger identifiers. The alarm behavior vectors and the mapping inference rule base are used to determine whether the alarm data corresponding to the alarm behavior vectors triggers TTP tags. Based on the trigger determination results, a predicted TTP tag set for the alarm behavior vectors is constructed and the trigger path is recorded. The predicted TTP tag set and the trigger path are structured and encapsulated according to a set format to form behavioral semantic data. An execution strategy response rule set is constructed. The behavioral semantic data is mapped in the execution strategy response rule set to obtain the execution strategy. The honeycomb deployment is adjusted according to the execution strategy.

[0010] The beneficial effects of the attack technique and tactic identification method for honeycomb linkage provided by this invention are as follows: by using structured behavior vectors as an intermediary bridge, a TTP tag mapping model is constructed, mapping rules are automatically extracted to generate an inference rule base, and further linkage mapping with the honeycomb system strategy module is realized, providing accurate, transparent and controllable semantic support and response basis for attack perception and dynamic induction.

[0011] In one possible embodiment, encoding and constructing a training dataset based on malicious sample data and associated TTP tags includes: encoding and defining malicious sample data to form sample behavior vectors; extracting TTP tags associated with malicious samples based on expert-approved tags and encoding them into tag target vectors; and constructing a training dataset based on the sample behavior vectors and tag target vectors.

[0012] In another possible embodiment, the interpretable discriminant model includes an input layer, a linear discriminant layer, and an output layer; the input layer receives a training dataset and constructs training sample pairs based on the training dataset; the linear discriminant layer performs weighted summation calculation based on the features of the training sample pairs to learn the linear relationship between each behavior dimension and the target TTP label; the output layer maps the linear discriminant results to label trigger probabilities and outputs the behavior trigger weight vector and bias term for each label dimension, as well as the logical expression structure corresponding to each label dimension.

[0013] In other possible embodiments, explicit triggering rules are extracted based on the behavior triggering weight vector and bias term for each label dimension, including: determining whether the behavior weight triggering vector meets the set conditions, retaining the key behavior dimensions that meet the set conditions based on the determination result; mapping the key behavior dimensions to logical expressions, and constructing explicit triggering rules to form executable rule expressions: ,in, For TTP tags The corresponding set of key behavioral feature indices Indicates the first Each sample behavior vector This represents the minimum threshold number of triggered actions set based on experience. Indicates whether the key behavioral dimension triggers the TTP tag. The flag variable.

[0014] Based on a preset set of standard behavioral dimensions, behavioral clues are extracted. The alarm data is then mapped into alarm behavior vectors according to the behavioral clues. This includes: extracting behavioral clues from the set of standard behavioral dimensions through keyword matching, regular expression parsing, dependency relation or syntactic parsing, and event template matching; converting the behavioral clues into trigger identifiers to determine whether the triggering conditions of each behavioral dimension are met; and mapping the alarm data into alarm behavior vectors by identifying whether the attack events in the alarm data trigger each behavioral dimension.

[0015] Based on the alarm behavior vector and the mapping inference rule base, determine whether the attack event corresponding to the alarm behavior vector triggers the TTP tag, including: Let the alarm behavior vector be... x=[ x 1 , x 2 ,…, x d ]∈{0,1 } d The first in the mapping inference rule base The mapping function corresponding to each TTP tag is denoted as . ,in, Indicates the behavioral dimension identifier that triggers the attack event. The Sigmoid function represents logistic regression. Represents the binarized weights. Indicates the bias term; for each TTP label Calculate its activation probability. If it satisfies Then it is considered that TTP has been triggered. This indicates the set confidence threshold.

[0016] Based on the trigger judgment result, construct the predicted TTP tag set of the alarm behavior vector and record the trigger path, including: construct the predicted TTP tag set of the alarm behavior vector by forming the set of all TTP tags triggered by the alarm behavior vector; for each tag in the predicted TTP tag set, record the set of behavior dimensions with non-zero weights corresponding to the tag.

[0017] Secondly, this invention also provides a tactical identification device for attack techniques related to honeycomb linkage, comprising: a training dataset construction unit for acquiring malicious sample data, encoding the malicious sample data and associated TTP tags, and constructing a training dataset, the training dataset including sample behavior vectors of malicious samples and corresponding label target vectors; a model construction unit for constructing an interpretable discriminant model, the interpretable discriminant model being used to perform binary classification modeling on the sample behavior vectors and label target vectors to obtain the behavior trigger weight vectors and bias terms for each label dimension of the malicious sample; and a rule base construction unit for extracting explicit trigger rules based on the behavior trigger weight vectors and bias terms for each label dimension, and constructing a mapping inference rule base based on the explicit trigger rules; The alarm acquisition unit is used to acquire alarm data, extract behavioral clues based on a preset standard behavioral dimension set and convert them into trigger identifiers, and map the alarm data into alarm behavior vectors according to the trigger identifiers. The TTP tag identification unit is used to determine whether the alarm data corresponding to the alarm behavior vector triggers a TTP tag according to the alarm behavior vector and the mapping inference rule base, construct a predicted TTP tag set for the alarm behavior vector according to the trigger determination result and record the trigger path. The linkage mechanism construction unit is used to structure and encapsulate the predicted TTP tag set and the trigger path according to a set format to form behavioral semantic data, construct an execution strategy response rule set, map the behavioral semantic data into the execution strategy response rule set to obtain the execution strategy, and adjust the honeycomb deployment according to the execution strategy.

[0018] Thirdly, the present invention also provides a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the above-mentioned attack technique and tactical identification method for honeycomb linkage.

[0019] Fourthly, the present invention also provides an electronic device, comprising: a processor and a memory; the memory being used to store a computer program; the processor being used to execute the computer program stored in the memory, so that the electronic device performs the above-described attack technique tactical identification method for honeycomb linkage.

[0020] For the beneficial effects of the second to fourth aspects mentioned above, please refer to the description of the first aspect mentioned above. Attached Figure Description

[0021] Figure 1 A flowchart illustrating an attack technique and tactic identification method for honeycomb array linkage provided in an embodiment of the present invention;

[0022] Figure 2 A schematic diagram of an attack technique tactical identification device for honeycomb linkage provided in an embodiment of the present invention;

[0023] Figure 3 This is a schematic diagram of an electronic device structure provided in an embodiment of the present invention. Detailed Implementation

[0024] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions in the embodiments of this invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this invention. All other embodiments obtained by those skilled in the art based on the embodiments of this invention without inventive effort are within the scope of protection of this invention. Unless otherwise defined, the technical or scientific terms used herein should have the ordinary meaning understood by those skilled in the art. The terms "comprising" and similar expressions used herein mean that the element or object preceding the word covers the element or object listed following the word and its equivalents, but do not exclude other elements or objects.

[0025] This embodiment provides a method for identifying attack techniques and tactics related to honeycomb array coordination. See the appendix to the specification. Figure 1 The method includes:

[0026] S101: Obtain malicious sample data, encode the malicious sample data and associated TTP tags, and construct a training dataset. The training dataset includes the sample behavior vector of the malicious sample and the corresponding label target vector.

[0027] In one possible embodiment, encoding malicious sample data and associated TTP tags to construct a training dataset includes: encoding and defining malicious sample data to form a sample behavior vector; extracting TTP tags associated with malicious samples based on expert-approved tags and encoding them into a tag target vector; and constructing a training dataset based on the sample behavior vector and the tag target vector.

[0028] In one specific embodiment, clearly labeled malicious samples are selected from the security analysis system. These selected malicious samples include complete attack process records and are confirmed by experts to correspond to one or more standardized TTP codes (such as tactical and technical tags in the MITRE ATT&CK framework). A complete set of behavioral dimensions is defined for each malicious sample to map its activity content into a vector representation in the standardized system behavior space. ,in, This represents the behavioral dimension of a malicious sample; for each malicious sample , This indicates the number of defined behavioral dimensions. Each dimension... For each atomic system behavior (such as "establishing an external connection", "modifying a registry key", "executing a PowerShell command"), the system behavior of a malicious sample can be represented as a multi-hot encoded vector of sample behavior. x i =[ x i 1 , x i 2 ,…, x i k ] ⊤ ∈{0,1 } k ,in, ,vector Each component This is used to identify whether malicious samples trigger the corresponding system behavior dimension, realizing a discrete mapping from the original behavior to the standardized behavior space, forming structured features that can be used as input for logistic regression.

[0029] Simultaneously, based on the expert-approved tags, the TTP tag set associated with the malicious sample is extracted and encoded into a tag target vector: ,in, This indicates the total number of currently defined TTP tags. This indicates that a malicious sample triggered the TTP tag. The described attack techniques or tactics.

[0030] By traversing and encoding N malicious samples, the corresponding sample behavior vectors and label target vectors are obtained. A training dataset is then constructed based on the sample behavior vectors and label target vectors. .

[0031] The constructed training dataset has the advantages of clear structure, reliable labels, and good scalability: it adopts a unified dimensional coding behavior pattern and has the ability to compare and model across scenarios; based on security experts and knowledge base annotations, it can ensure the technical accuracy of the output labels; and it supports subsequent multi-label and multi-dimensional modeling to adapt to knowledge updates in dynamic threat scenarios.

[0032] S102: Construct an interpretable discriminant model. The interpretable discriminant model is used to perform binary classification modeling on the sample behavior vector and the label target vector to obtain the behavior trigger weight vector and bias term for each label dimension of the malicious sample.

[0033] In one possible embodiment, the interpretable discriminant model includes an input layer, a linear discriminant layer, and an output layer; the input layer receives a training dataset and constructs training sample pairs based on the training dataset; the linear discriminant layer performs weighted summation calculation based on the features of the training sample pairs to learn the linear relationship between each behavior dimension and the target TTP label; the output layer maps the linear discriminant result to the label trigger probability, and outputs the behavior trigger weight vector and bias term for each label dimension, as well as the logical expression structure corresponding to each label dimension.

[0034] Interpretable discriminative models are based on training datasets For the set of sample behavior vectors and its corresponding label target vector Perform label-by-label binary classification modeling (i.e., for each label dimension) Train the discriminator separately to achieve discriminant targeting for each TTP label dimension. Independently construct a discriminative model with interpretability, forming a model based on behavior vectors. (Probability mapping from label to whether it is triggered) is obtained by applying a linear discriminant function and learning the parameters to the sample behavior vector to obtain each label dimension. Behavior trigger weight vector With bias term This leads to the formal logical expression corresponding to the weight vector and bias, which serves as an executable triggering rule for subsequent rule base construction and reasoning.

[0035] In one possible embodiment, to ensure the interpretability of the model results and the usability of rule extraction, a logistic regression model is selected as the core inference foundation of the interpretable discriminant model. The construction process of the interpretable discriminant model includes defining the model structure and setting pre-judgment rules. When building the model, the separability of each TTP label dimension in the training dataset is first judged: if there is at least one trainable sample in the data corresponding to the dimension, the model training process is started and the corresponding interpretable discriminant model is built; if the sample in the dimension contains only a single category or there are insufficient samples, modeling is skipped and it is marked as "non-inference label" to avoid the impact of training noise on the quality of inference rules.

[0036] In the interpretable discriminant model, a linear logistic regression model is used to model each label dimension, and its decision function has the following form: ,in, Indicates the relationship with the first The weight of the behavioral dimension associated with each TTP tag Indicates the bias term. This represents the Sigmoid activation function. This represents the vector inner product. The decision function is determined by the parameter information (i.e., the behavioral feature weight vector and bias term) learned during the training phase of the interpretable discriminative model. It is achieved by weighting and summing the behavioral vectors of the input samples and then mapping them to a probability output using the Sigmoid activation function. The decision function is both a direct result of the interpretable discriminative model parameter learning and the computational basis for subsequent explicit rule extraction and label determination. Its specific functions include: serving as a mathematical expression of the model training results, used to quantify the relationship between sample behavior and TTP label triggering; in the rule extraction stage, selecting key behavioral dimensions based on the significance of each feature weight in the decision function to generate corresponding explicit triggering rules; and in the rule extraction stage, selecting key behavioral dimensions based on the significance of each feature weight in the decision function to generate corresponding explicit triggering rules.

[0037] For example, the model structure of the interpretable discriminant model includes an input layer, a linear discriminant layer, and an output layer. The input layer receives a training dataset to represent the triggering state of the sample in each behavioral dimension. The linear discriminant layer performs a weighted summation of the received features to learn the linear relationship between each behavioral dimension and the target TTP label. The output layer maps the result to the label triggering probability through the Sigmoid activation function to achieve interpretable binary classification output.

[0038] In a specific embodiment, the construction of an interpretable discriminative model specifically includes: for each label dimension Construct training sample pairs ,in, Does the malicious sample trigger the TTP label? The indicative variables; each dimension is modeled separately using a logistic regression model of the following form: The model is trained using maximum likelihood estimation for parameter learning. L (t) =- 1 N t ∑ i=1 N t [ y i (t) log P ( y (t) =1| x i )+(1- y i (t) ) log ( 1-P( y (t) =1| x i ))] ,in For the first The number of malicious samples under each label dimension. This is determined by minimizing the loss function. Find the optimal parameter vector , Optimize model parameters using cross-validation with a secure validation set.

[0039] The interpretable discriminative model obtains its final weights after training and optimization. The model's output structure includes each label dimension. Behavior trigger weight vector With bias term Each label dimension The corresponding logical expression structure is the probability output of the interpretable discriminant model when making a judgment on each label. By training the model and optimizing this probability through backpropagation, this weight vector can be learned.

[0040] To avoid overfitting and improve interpretability, the interpretable discriminative model introduces a feature selection mechanism during training, selecting the most discriminative behavioral dimension as an explicit trigger condition.

[0041] The output structure of an interpretable discriminant model can serve as the foundational data for rule extraction. By tightly integrating data-driven modeling mechanisms with logical structure expression, interpretable discriminant models provide a standardized, structured, and interpretable discriminant model system for rule explicitation and reasoning system construction.

[0042] S103: Extract explicit triggering rules based on the behavior triggering weight vector and bias term of each label dimension, and construct a mapping inference rule base based on the explicit triggering rules.

[0043] In one possible embodiment, explicit triggering rules are extracted based on the behavior triggering weight vector and bias term of each label dimension, including: determining whether the behavior weight triggering vector meets the set conditions, retaining the key behavior dimensions that meet the set conditions based on the determination result; mapping the key behavior dimensions into logical expressions, and constructing explicit triggering rules to form executable rule expressions: ,in, For TTP tags The corresponding set of key behavioral feature indices Indicates the first Each sample behavior vector This represents the minimum threshold number of triggered actions set based on experience. Indicates whether the key behavioral dimension triggers the TTP tag. The flag variable.

[0044] For example, the specific process of extracting explicit triggering rules based on the parameters (behavior triggering weight vectors and bias terms for each label dimension) obtained from the interpretable discriminative model includes: for each label dimension Read the parameter pair of behavior trigger weight vector from the trained interpretable discriminative model. and bias terms The behavior trigger weight vector reflects the degree of influence of each system behavior dimension on the label; based on set conditions (such as sorting the behavior trigger weight vectors by absolute value and retaining the top K behavior dimensions), key behavior dimensions are retained to form an explicit trigger behavior set. ,in Thresholds set by security experts based on experience; key behavioral dimensions are mapped to logical expressions to construct explicit triggering rules: That is, when the sample triggers the set simultaneously When the key behavior is in the process, predict the trigger tag. , This represents the threshold for the number of triggered behaviors. Based on the explicit triggering rules, the key behavior dimensions are binarized (i.e., non-zero weight dimensions are assigned a value of 1, and the rest are set to 0), forming an executable rule expression: ,in, For TTP tags The corresponding set of key behavioral feature indices This represents the minimum threshold number of triggered actions set based on experience, which can be determined according to the bias term. Adjustments are made to the proportion of positive samples. Executable rule expressions can be equivalently transformed from the linear discriminant function in the logistic regression model, and dimensionality is reduced while preserving interpretability.

[0045] The explicit trigger rule reflects the explicit correspondence between "which combinations of behaviors" and "what attack labels". The executable rule expression describes in boolean logic form the mapping path of "which combinations of behaviors will trigger a certain attack label", with good auditability and decision transparency, meeting the basic requirements for causal traceability in security scenarios.

[0046] In a possible embodiment, the inference rules for all dimensions are uniformly organized into a structured knowledge base, denoted as the mapping inference rule base: . Each rule object includes the following fields: Tag identifier (TTP ID): The standard number corresponding to the ATT&CK knowledge system; Trigger behavior set (Feature Set): The system behavior dimension index and its semantic label specifically involved; Trigger expression (Logic Expression): The formal rule logic threshold; Confidence weight (Optional): Obtained by calculating metrics in the training model (such as accuracy, weight amplitude), used for subsequent inference fusion.

[0047] The mapping inference rule base is encapsulated in a structured manner such as JSON / YAML, supporting rule retrieval, version update, and seamless docking with downstream inference modules. Essentially, it constitutes a knowledge representation structure of the domain logic layer that maps from system behaviors to attack labels, which can be used to explain the model decision results, enhance the response credibility, and assist subsequent联动处置机制.

[0048] S104: Obtain the alarm data, extract behavior clues based on the preset standard behavior dimension set and convert to obtain the trigger identifier, and map the alarm data to the alarm behavior vector according to the trigger identifier.

[0049] In a possible embodiment, the obtained alarm data refers to the alarm events, log fragments or threat indicators (IoCs) collected in the actual network environment. The specific data collected is the original data from components such as security devices, host monitoring systems, and network intrusion detection systems (NIDS), including: Host behavior logs (such as process startup, file operations, registry modifications, etc.); Network communication events (such as abnormal port access, remote connection attempts); Threat detection alarms (such as malicious IP access, feature rule matching); IOC metric items (such as hashes, domain names, paths, behavior labels, etc.).

[0050] In one possible embodiment, behavioral clues are extracted based on a preset set of standard behavioral dimensions, and alarm data is mapped into alarm behavior vectors according to the behavioral clues. This includes: extracting behavioral clues from the set of standard behavioral dimensions through keyword matching, regular expression parsing, dependency relation or syntactic parsing, and event template matching; converting the behavioral clues into trigger identifiers for determining whether the triggering conditions of each behavioral dimension are met; and mapping the alarm data into alarm behavior vectors by identifying whether attack events in the alarm data trigger each behavioral dimension.

[0051] In one specific embodiment, to achieve structured mapping of alarm data, a system behavior semantic mapper is constructed. This mapper combines natural language processing techniques with predefined rules to map alarm data to a set of standard behavioral dimensions. Alignment. Each behavioral dimension. It has a clear definition and triggering conditions, for example: : Does PowerShell exist on startup? : Has lateral connection behavior on port 445 been detected? : Whether directory permissions have been tampered with.

[0052] The alignment process extracts behavioral cues from standardized events in a standard behavioral dimension set based on rules and lightweight parsing. This primarily employs keyword matching (e.g., "powershell", "net.exe"), regular expressions (capturing port / command parameters), dependency relations or simple syntactic parsing (identifying subject-verb-object relationships to distinguish between "creating a file" and "accessing a file"), and event template matching (mapping different expressions to the same semantic event). Furthermore, leveraging LLM's semantic understanding capabilities, and based on a predefined behavioral dimension mapping table, the extracted behavioral cues are converted into atomic trigger identifiers, thereby mapping attack events within a specific time period into alarm behavior vectors. ,Right now .

[0053] The standard behavioral dimension set is a pre-constructed set. The selection of these dimensions is based on semantic abstraction and behavioral ontology architecture summarization by security experts of common attack payloads in the threat sample library and low-level system events generated during the execution of malicious samples in an isolated sandbox environment. Specifically, based on the common characteristics of attack behaviors at the operating system level, operations such as processes, files, registry entries, services, and networks observed in sandbox logs are summarized and mapped into a set of semantically clear minimum security operation units (i.e., system behavioral atoms). The setting of these atomic dimensions follows three principles: observability, distinguishability, and coverage. They must be directly detectable from system logs, distinguish key operations at different attack stages, and cover the main behavioral types required for typical attack chains. The final determined behavioral dimension set ensures the integrity of semantic expression and provides a unified and stable feature space foundation for the subsequent TTP identification model.

[0054] In cases where some behavioral clues are missing or ambiguous, the original logs or alerts may not be fully parsed into complete vectors. In a preferred embodiment, the acquired alert data is further semantically enhanced based on LLM before behavioral vector mapping, performing completion reasoning on missing fields within a known context to improve the completeness and robustness of the behavioral representation.

[0055] In one specific embodiment, a prompt template for interacting with a large language model to convert structured alert data into natural language is provided, such as: "The following log indicates that a host may have been compromised: 'Remote host xxx attempted to execute commands via WMI'. Please determine the corresponding system behavior dimensions in this {malicious behavior template} and output their binary vector representations."

[0056] The alarm behavior vector generation method provided by this invention enables the system to cover diverse input expressions and enhances the applicability of alarm behavior vector generation in real network environments.

[0057] S105: Determine whether the alarm data corresponding to the alarm behavior vector triggers the TTP tag based on the alarm behavior vector and the mapping inference rule base, construct the predicted TTP tag set of the alarm behavior vector based on the trigger determination result and record the trigger path.

[0058] In one possible embodiment, determining whether an attack event corresponding to an alarm behavior vector triggers a TTP tag based on the alarm behavior vector and a mapping inference rule base includes: assuming the alarm behavior vector is... x=[ x 1 , x 2 ,…, x d ]∈{0,1 } d The first in the mapping inference rule base The mapping function corresponding to each TTP tag is denoted as . ,in, Indicates the behavioral dimension identifier that triggers the attack event. The Sigmoid function represents logistic regression. Represents the binary weights (representing the behavioral dimension) Whether to participate in the triggering of this TTP). Indicates the bias term; for each TTP label Calculate its activation probability. If it satisfies Then it is considered that TTP has been triggered. This indicates the set confidence threshold.

[0059] In one possible embodiment, constructing a predicted TTP tag set for the alarm behavior vector based on the trigger judgment result and recording the trigger path includes: constructing a predicted TTP tag set for the alarm behavior vector from all TTP tag sets triggered by the alarm behavior vector; and for each tag in the predicted TTP tag set, recording the set of behavior dimensions with non-zero weights corresponding to the tag.

[0060] In a specific embodiment, since an attack event may trigger multiple TTP tags simultaneously, a multi-tag output mechanism is designed: all TTP tags triggered by the alarm behavior vector constitute the predicted TTP set for that alarm behavior vector. For each identified label i, its trigger path is also recorded, which is the set of behavioral dimensions with non-zero weights. This is used for complex explanations and visualizations. Ultimately, the output of the alarm behavior vector triggering result is a set of structured results, including: the identified TTP tag number and semantic name, the corresponding confidence level (predicted probability), the triggered behavior dimension and conditional logic, and the underlying mapping rule expression. A possible example of the alarm behavior vector triggering result output is shown in Table 1 below:

[0061] Table 1 Alarm Behavior Vector Trigger Results

[0062] .

[0063] S106: The predicted TTP tag set and trigger path are structured and encapsulated according to the set format to form behavioral semantic data. An execution strategy response rule set is constructed. The execution strategy is obtained by mapping the behavioral semantic data into the execution strategy response rule set. The honey array deployment is adjusted according to the execution strategy.

[0064] In one possible embodiment, in order to achieve the linkage and adaptation between TTP inference results and honey array deployment strategy generation, and to support engineering applications in honey array system (i.e., dynamic trapping and defense induction system) strategy generation and resource scheduling, an intermediate semantic abstraction mechanism and strategy mapping framework based on TTP inference results are designed to open up the semantic conversion path between attack behavior inference results and honey array system response actions, thereby providing a theoretical basis and executable solution for realizing semantically driven strategy defense generation.

[0065] Specifically, to achieve semantic integration between the multi-label TTP judgment results generated based on alarm behavior vectors and the policy generation module, a structured data representation format for encapsulating key semantic units in the judgment output is designed, including: TTP_ID: the activated attack technique label (aligned to the MITRE ATT&CK coding system); Trigger_Behaviors: the set of explicit behavioral dimensions used to trigger the label; Contextual_Factors: optional context variables (such as attack host type, source node, event sequence complexity, etc.); Confidence_Score: the prediction confidence score of the activated label; Action_Intent: the attack intent layer summary parsed based on the inference path and behavior combination pattern (such as lateral movement, command control, persistence, etc.). This structured representation serves as the behavioral semantic data unit, forming an intermediate bridge from interpretable inference output to policy mapping.

[0066] A mapping rule set of "behavioral semantics → policy action" is constructed based on structured behavioral semantic data units to guide the honeypot system in executing policy-level response decisions. The design of the mapping rule set integrates TTP type, key behavioral combinations, and contextual factors to derive executable policy instructions. The constructed policy mapping patterns include, but are not limited to: when the TTP_ID belongs to a lateral penetration technique (such as T1021), and the behavioral combination indicates a cross-host control attempt, it is mapped to the policy action of "enhancing the density of decoy nodes in a specific subnet"; when the inference result involves persistent TTPs (such as T1053), and the target is inferred to be a critical business host based on the context, the deployment policy of "honey bait resource replacement and enhanced simulation module" is executed; if the inference result contains multiple weak activation events with long-tail tags, the system will construct an inference path confidence graph based on Confidence_Score, and then decide on the inducement response policy of "generating a virtual attack path and adjusting the decoy entry point". The policy mapping rules are implemented using a structured configuration format (such as YAML / JSON), which has good maintainability and extensibility, and supports interface linkage with the honeypot control module.

[0067] After policy mapping based on the mapping rule set, the linked operations obtained from the mapping are executed by calling the standardized interface of the honey array defense control module to achieve real-time guidance and policy reconstruction for attackers. Specifically, this includes: adjust_bait_nodes(): adjusting the deployment density and topology location of the decoy nodes according to the policy instructions; update_emulated_services(): changing the honey node simulation service configuration to match the current attack technology characteristics; generate_deceptive_paths(): constructing deceptive false attack paths based on the inference path; output_traceable_explanations(): generating a rule chain explanation report with auditing capabilities to assist manual judgment and policy feedback optimization.

[0068] By designing a linkage mechanism between TTP inference results and honey array deployment strategies, an automated mapping between attack behavior semantics and honey array defense strategies is achieved, effectively supporting the rapid response capability and adaptability evolution of the honey array system in dynamic adversarial environments, and improving the intelligence and strategy controllability of the overall defense system.

[0069] The attack technique and tactic identification method for honeycomb linkage provided by this invention maps the original attack activities to a uniformly defined system behavior dimension, forming a highly comparable behavior vector representation that reflects threat patterns. This projection method breaks through the limitations of existing deep learning or rule matching methods that rely on attack context structure or specific log patterns, making the behavior representation more universal and robust.

[0070] We employ a logistic regression model to learn the mapping relationship between malicious behavior vectors and multi-label TTP targets, enabling automatic rule extraction and structured expression, reducing reliance on manual rule design, and constructing explicit trigger logic expressions through a sparsity coefficient selection strategy, which has good interpretability and reasoning transparency.

[0071] By extracting behavioral triggering conditions and weight rules from model training, a structured mapping rule library from behavior to TTP is constructed, which can be dynamically expanded and iterated, and is suitable for continuous integration of new TTP samples.

[0072] Building upon the inference results, a semantic bridge is introduced between "behavioral vectors, TTP tags, and honeycomb strategies," constructing a honeycomb linkage scheduling mechanism driven by interpretable inference results. By identifying the TTP tags and their triggering logic, matching decoy strategy templates can be dynamically activated, enabling coordinated strategies such as honeycomb decoy configuration, induction path reconstruction, or simulation service adjustment. This mechanism overcomes the limitations of traditional TTP identification methods, which only focus on classification results and lack the ability to connect with honeycomb response strategies, providing a structurally complete inference input for intelligent scheduling in highly dynamic defense scenarios.

[0073] The attack technique and tactic identification method for honeycomb linkage introduces novel mechanisms in attack behavior representation, TTP mapping modeling, and rule maintenance, which are significantly different from existing technologies and enhance the practical value of the identification system in terms of universality, interpretability, and maintainability.

[0074] See the instruction manual appendix Figure 2 This embodiment also provides a tactical identification device for attack techniques related to honeycomb array linkage, which is used to implement the above-described method embodiment. The device includes:

[0075] The training dataset construction unit 201 is used to acquire malicious sample data, encode the malicious sample data and associated TTP tags, and construct a training dataset. The training dataset includes the sample behavior vector of the malicious sample and the corresponding label target vector.

[0076] Model building unit 202 is used to build an interpretable discriminant model. The interpretable discriminant model is used to perform binary classification modeling on sample behavior vectors and label target vectors to obtain the behavior trigger weight vector and bias term for each label dimension of the malicious sample.

[0077] The rule base construction unit 203 is used to extract explicit triggering rules based on the behavior triggering weight vector and bias term of each label dimension, and to construct a mapping inference rule base based on the explicit triggering rules.

[0078] The mapping unit 204 is used to acquire alarm data, extract behavioral clues based on a preset set of standard behavioral dimensions and convert them into trigger identifiers, and map the alarm data into alarm behavior vectors according to the trigger identifiers.

[0079] The TTP tag identification unit 205 is used to determine whether the alarm data corresponding to the alarm behavior vector triggers the TTP tag based on the alarm behavior vector and the mapping inference rule base, construct the predicted TTP tag set of the alarm behavior vector based on the trigger judgment result and record the trigger path.

[0080] The linkage mechanism construction unit 206 is used to structure and encapsulate the predicted TTP tag set and trigger path into behavioral semantic data according to the set format, construct the execution strategy response rule set, map the behavioral semantic data into the execution strategy response rule set to obtain the execution strategy, and adjust the honey array deployment according to the execution strategy.

[0081] All relevant content of each step involved in the above method embodiments can be referenced from the functional description of the corresponding functional module, and will not be repeated here.

[0082] In other embodiments of this application, an electronic device is disclosed, such as... Figure 3As shown, the electronic device 300 may include: one or more processors 301; a memory 302; a display 303; one or more application programs (not shown); and one or more computer programs 304. These devices can be connected via one or more communication buses 305. The one or more computer programs 304 are stored in the memory and configured to be executed by the one or more processors 301. The one or more computer programs 304 include instructions that can be used to perform actions such as... Figure 1 And the steps in the corresponding embodiments.

[0083] Through the above description of the embodiments, those skilled in the art will clearly understand that, for the sake of convenience and brevity, only the division of the above functional modules is used as an example. In practical applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above. The specific working process of the system, device, and unit described above can be referred to the corresponding process in the foregoing method embodiments, and will not be repeated here.

[0084] In the embodiments of this application, the functional units can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0085] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solutions of the embodiments of this application, essentially, or the parts that contribute to the prior art, or all or part of the technical solutions, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) or processor to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as flash memory, portable hard disk, read-only memory, random access memory, magnetic disk, or optical disk.

[0086] The above description is merely a specific implementation of the embodiments of this application, but the protection scope of the embodiments of this application is not limited thereto. Any changes or substitutions within the technical scope disclosed in the embodiments of this application should be covered within the protection scope of the embodiments of this application. Therefore, the protection scope of the embodiments of this application should be determined by the protection scope of the claims.

Claims

1. A method for identifying attack techniques and tactics in honeycomb-based coordinated attacks, characterized in that, include: Malicious sample data is acquired, and the malicious sample data and associated TTP tags are encoded to construct a training dataset. The training dataset includes the sample behavior vector of the malicious sample and the corresponding tag target vector. An interpretable discriminant model is constructed, which is used to perform binary classification modeling on the sample behavior vector and the label target vector to obtain the behavior trigger weight vector and bias term for each label dimension of the malicious sample; Explicit triggering rules are extracted based on the behavior triggering weight vector and bias term of each label dimension, and a mapping inference rule base is constructed based on the explicit triggering rules. Acquire alarm data, extract behavioral clues based on a preset set of standard behavioral dimensions and convert them into trigger identifiers, and map the alarm data into alarm behavior vectors according to the trigger identifiers; Based on the alarm behavior vector and the mapping inference rule base, determine whether the alarm data corresponding to the alarm behavior vector triggers the TTP tag. Based on the trigger determination result, construct the predicted TTP tag set of the alarm behavior vector and record the trigger path. The predicted TTP tag set and trigger path are structured and encapsulated according to the set format to form behavioral semantic data. An execution strategy response rule set is constructed, and the execution strategy is obtained by mapping the behavioral semantic data into the execution strategy response rule set. The honey array deployment is adjusted according to the execution strategy.

2. The method according to claim 1, characterized in that, The malicious sample data and associated TTP tags are encoded and a training dataset is constructed, including: The malicious sample data is encoded and defined to form a sample behavior vector; Based on the expert-approved tags, the TTP tags associated with malicious samples are extracted and encoded into tag target vectors; A training dataset is constructed based on the sample behavior vector and the label target vector.

3. The method according to claim 1, characterized in that, An interpretable discriminant model consists of an input layer, a linear discriminant layer, and an output layer; The input layer receives the training dataset and constructs training sample pairs based on the training dataset; The linear discriminant layer performs a weighted summation calculation based on the features of the training sample pairs to learn the linear relationship between each behavioral dimension and the target TTP label; The output layer maps the linear discrimination result to the tag trigger probability, and outputs the behavior trigger weight vector and bias term for each tag dimension, as well as the logical expression structure corresponding to each tag dimension.

4. The method according to claim 1, characterized in that, Explicit triggering rules are extracted based on the behavior triggering weight vector and bias term for each label dimension, including: Determine whether the behavior weight trigger vector meets the set conditions, and retain the key behavior dimensions that meet the set conditions based on the determination result; Map key behavioral dimensions to logical expressions, and construct explicit triggering rules to form executable rule expressions: ,in, For TTP tags The corresponding set of key behavioral feature indices Indicates the first Each sample behavior vector This represents the minimum threshold number of triggered actions set based on experience. Indicates whether the key behavioral dimension triggers the TTP tag. The flag variable.

5. The method according to claim 1, characterized in that, Behavioral clues are extracted based on a preset set of standard behavioral dimensions. Alarm data is then mapped into alarm behavior vectors based on these behavioral clues, including: Behavioral clues are extracted from the standard behavioral dimension set through keyword matching, regular expression parsing, dependency relation or syntactic parsing, and event template matching. The behavioral clues are converted into trigger identifiers to determine whether the triggering conditions for each behavioral dimension are met; By identifying whether the attack events in the alarm data trigger each behavioral dimension, the alarm data is mapped into an alarm behavior vector.

6. The method according to claim 1, characterized in that, Determining whether the attack event corresponding to the alarm behavior vector triggers a TTP tag based on the alarm behavior vector and the mapping inference rule base includes: Let the alarm behavior vector be The mapping reasoning rule base contains the first... The mapping function corresponding to each TTP tag is denoted as . ,in, Indicates the behavioral dimension identifier that triggers the attack event. The Sigmoid function represents logistic regression. Represents the binarized weights. Indicates the bias term; For each TTP tag Calculate its activation probability. If it satisfies Then it is considered that TTP has been triggered. This indicates the set confidence threshold.

7. The method according to claim 6, characterized in that, Based on the trigger determination result, a predicted TTP tag set for the alarm behavior vector is constructed and the trigger path is recorded, including: The set of all TTP tags triggered by the alarm behavior vector constitutes the predicted TTP tag set of the alarm behavior vector; For each label in the predicted TTP label set, record the set of behavioral dimensions with non-zero weights corresponding to the label.

8. A tactical identification device for attack techniques in honeycomb array linkage, characterized in that, The device includes: The training dataset construction unit is used to acquire malicious sample data, encode the malicious sample data and associated TTP tags, and construct a training dataset. The training dataset includes the sample behavior vector of the malicious sample and the corresponding tag target vector. The model building unit is used to build an interpretable discriminant model, which is used to perform binary classification modeling on the sample behavior vector and the label target vector to obtain the behavior trigger weight vector and bias term for each label dimension of the malicious sample. The rule base construction unit is used to extract explicit triggering rules based on the behavior triggering weight vector and bias term of each label dimension, and to construct a mapping inference rule base based on the explicit triggering rules. The mapping unit is used to acquire alarm data, extract behavioral clues based on a preset set of standard behavioral dimensions and convert them into trigger identifiers, and map the alarm data into alarm behavior vectors according to the trigger identifiers. The TTP tag identification unit is used to determine whether the alarm data corresponding to the alarm behavior vector triggers a TTP tag based on the alarm behavior vector and the mapping inference rule base, and to construct a predicted TTP tag set for the alarm behavior vector and record the trigger path based on the trigger determination result; The linkage mechanism construction unit is used to structure and encapsulate the predicted TTP tag set and trigger path into behavioral semantic data according to a set format, construct an execution strategy response rule set, map the behavioral semantic data into the execution strategy response rule set to obtain the execution strategy, and adjust the honey array deployment according to the execution strategy.

9. A computer-readable storage medium storing a computer program thereon, characterized in that, When the computer program is executed by the processor, it implements the attack technique and tactical identification method for honeycomb linkage as described in any one of claims 1 to 7.

10. An electronic device, characterized in that, include: Processor and memory; The memory is used to store computer programs; The processor is used to execute the computer program stored in the memory, so that the electronic device performs the attack technique tactical identification method for honeycomb linkage as described in any one of claims 1 to 7.

Images