A network attack and defense simulation engine system based on discrete event driving

Abstract

The application belongs to the technical field of network attack and defense simulation, and discloses a network attack and defense simulation engine system based on discrete event driving, which comprises an event scheduling module, a simulation network construction module, an attack and defense simulation module, a simulation kernel module and a panoramic situation awareness module; the event scheduling module is constructed based on MITRE ATT&CK as a theoretical base and is used for converting all network activities into a schedulable discrete event sequence; the network activities comprise packet sending, protocol timeout and attack triggering; the simulation network construction module can construct a simulation network containing complete business logic. The application can convert the MITRE ATT&CK tactical intention into an ordered event stream through the event scheduling module, and can simultaneously perform dynamic decomposition and re-planning on a high-level target through a hierarchical task network planner in the attack and defense simulation module, and can also reconfigure an attack chain in real time by using an ATT&CK technology ID.

Description

Technical Field

[0001] This application belongs to the field of network attack and defense simulation technology, specifically relating to a network attack and defense simulation engine system based on discrete event-driven simulation. Background Technology

[0002] Network attack and defense simulation technology, as a core supporting tool in the field of cybersecurity, is important in multiple dimensions, including quantitative assessment of network system security posture, scientific verification of the effectiveness of security strategy implementation, and practical training of cybersecurity professionals. By accurately reproducing real-world network architecture, communication protocols, and attack behavior patterns, this technology can systematically expose potential security vulnerabilities and configuration flaws in a controlled environment, providing organizations with repeatable and observable security testing benchmarks. In dealing with advanced persistent threats (APTs), simulation platforms need to support functions such as multi-stage attack chain modeling, covert channel detection, and lateral movement simulation, thereby constructing adversarial scenarios close to real-world conditions to ensure that defense mechanisms can withstand dynamically evolving attack pressure tests.

[0003] In response to the increasingly complex cyber threat landscape, modern network attack and defense simulation systems must achieve high-precision traffic feature reconstruction, in-depth protocol stack analysis, and cross-layer attack penetration path tracing. This requires simulation engines with fine-grained event scheduling capabilities, multi-dimensional data correlation analysis functions, and real-time status monitoring mechanisms to support the simulation of the entire attack lifecycle, from the initial intrusion attempt to privilege escalation. To this end, an effective approach is to construct a technical system based on the MITRE ATT&CK framework (covering attacker tactics, techniques, procedures, and tools) and its corresponding defense knowledge framework D3fEND (covering defender tactics, techniques, procedures, and tools). This system unifies the modeling of attack and defense tactical intentions, technical actions, execution procedures, and related tools defined within it, thereby constructing a complete knowledge system that supports accurate simulation and bidirectional mapping of attack and defense behaviors. Therefore, a new type of network attack and defense simulation engine system is needed.

[0004] For example, the multi-perspective network attack and defense simulation system authorized by China (CN 112104514 B) discloses a system based on complex adaptive systems (CAS) theory. It models the unique attributes, behaviors, and interaction relationships between network attackers, defenders, network information systems, and user behaviors, as well as their behavioral decision-making processes. Through simulation experiments, it simulates and extrapolates attack and defense behaviors in a simulated network environment. This network attack and defense simulation system can be used to analyze the effectiveness of network defense measures and assess the threat posed by different types of adversaries to the target network.

[0005] However, the attack and defense behaviors simulated in the aforementioned network attack and defense simulation systems are based on predefined scripts, which cannot simulate the adaptive, learning, and strategy adjustment capabilities of both sides in real confrontations, and the simulation of complex network environments is also very difficult. In addition, the data collection in attack and defense simulations is mostly focused on performance indicators, lacking the ability to generate multi-dimensional evidence chains for security analysis. Summary of the Invention

[0006] This application provides a network attack and defense simulation engine system based on discrete event-driven simulation, which aims to solve the problems that the behavior of attackers and defenders in existing technologies is often based on predefined scripts, and that data collection in attack and defense simulation is mostly focused on performance indicators, lacking the ability to generate multi-dimensional evidence chains for security analysis.

[0007] A network attack and defense simulation engine system based on discrete event-driven simulation includes an event scheduling module, a simulation network construction module, an attack and defense simulation module, a simulation kernel module, and a panoramic situational awareness module.

[0008] The event scheduling module is built on the theoretical foundation of MITRE ATT&CK and D3fend, and is used to convert all network activities into a schedulable discrete event sequence; the network activities include packet transmission, protocol timeout, and attack triggering;

[0009] The simulation network construction module can build a simulation network containing complete business logic, and reproduce the transaction process and user interaction behavior through module selection, script writing and network model configuration.

[0010] The attack and defense simulation module uses a hierarchical task network planner as its decision-making core. Taking tactical objectives as input and combining the current simulated network situation information, it recursively decomposes high-level objectives into specific, executable ATT&CK technical action sequences through a task decomposition algorithm.

[0011] The simulation kernel module adopts a microservice bus architecture, which decouples and coordinates the various functional modules through event routing and distribution mechanisms, and also has the ability to simulate parallel discrete events.

[0012] The panoramic situational awareness module can collect, fuse, correlate, and analyze multi-source and heterogeneous data generated throughout the simulation process, and extract operational knowledge from it.

[0013] Furthermore, the discrete event sequence includes an execution timestamp and a callback function pointer, as well as its corresponding ATT&CK technology ID.

[0014] Furthermore, the event scheduling module also supports dynamic modification and cancellation of events, which is used to transform tactical intentions into a discrete event stream for execution.

[0015] Furthermore, the simulated network construction module is used to realize full-stack simulation from IaaS to SaaS layers. The bottom layer uses simulation technology to accurately reproduce the physical network topology, including router forwarding rules, switch VLAN division and firewall policies; the middle layer simulates middleware service clusters through an orchestration engine.

[0016] Furthermore, the simulation network construction module also includes a dynamic isolation subunit and a protocol stack implementation subunit;

[0017] The state isolation subunit uses copy-on-write technology to achieve real-time simulation;

[0018] The protocol stack implementation sub-units are layered according to the OSI seven-layer model, and each layer constructs a finite state machine to parse and process the data units of the corresponding protocol.

[0019] Furthermore, the specific content of the attack and defense simulation module includes target transformation, dynamic reprogramming, and processing of discrete event sequences;

[0020] The transformation of the target is based on the hierarchical task network planner taking the ATT&CK tactical target received from the tactical layer drive engine as the initial input, and continuously acquiring situational information of the current network environment.

[0021] The dynamic replanning mechanism can trigger a backtracking mechanism through the hierarchical task network planner when a certain technical action fails, cancel the current failed technical path, and find and try alternative technologies within the same tactical phase based on the current updated situation.

[0022] When processing discrete event sequences, the discrete event sequences output from the event scheduling module are accepted, and discrete low-level alarms are aggregated into security events with higher confidence, and context information is attached.

[0023] The attack and defense simulation module also integrates AI large model technology to achieve intelligent assisted decision-making and automated inference.

[0024] Furthermore, the attack and defense simulation module can also integrate the behavior library into the MITRE ATT&CK framework. The behavior library stores a large number of parameterized attack and defense action meta-words. Action meta-words are the smallest units for agent planning and execution, so that each action can be accurately mapped to the ATT&CK framework.

[0025] Furthermore, the simulation kernel module also includes a storage subunit, which can store the current simulation time, the globally unique identifiers and status indexes of all network assets, and global attack and defense flags. The simulation kernel module adopts a microservice bus architecture and a highly modular and scalable design architecture.

[0026] Furthermore, the panoramic situation awareness module includes a multi-dimensional data acquisition subunit and a situation analysis subunit;

[0027] The multidimensional data acquisition subunit deploys lightweight data probes within the network nodes, security devices, host operating systems, and business applications of the simulation network construction module to collect data streams across all dimensions.

[0028] The situation analysis subunit can use ATT&CK technology ID to continuously query and correlate real-time data streams, reconstruct attack chains from discrete security events according to time sequence and causal logic, and dynamically generate and visualize the current attack's progression path.

[0029] Furthermore, the panoramic situational awareness module supports real-time 3D situational awareness display and recap functions, enabling real-time display of network attack and defense situation, supporting multi-level viewing of network architecture, node connection relationships and business processes, and allowing users to replay and analyze the simulation process.

[0030] Compared with the prior art, this application has at least the following beneficial effects:

[0031] Based on further analysis and research into existing technical problems, this application transforms MITREATT&CK tactical intentions into an ordered event flow through an event scheduling module, and dynamically decomposes and replans high-level targets through a hierarchical task network planner in the attack and defense simulation module, thus completely freeing the system from the constraints of predefined scripts. This allows for adaptive adjustment of the technical path according to the simulation situation, fully and flexibly simulating the complex APT attack chain from initial intrusion to target achievement. Simultaneously, the blue team's defensive response is dynamically generated based on event correlation and analysis, thereby realizing dynamic game theory and continuous evolution of strategies between the attacking and defending sides.

[0032] Meanwhile, the panoramic situational awareness module collects and integrates comprehensive data across network, security, host, business, and agent decision-making through standardized probes deployed at each layer. Utilizing ATT&CK technology, it reconstructs the attack chain in real time, overcoming the limitations of traditional simulations that only focus on performance metrics. This provides comprehensive and quantitative data support for in-depth analysis, defense system effectiveness assessment, and security investment decisions. Attached Figure Description

[0033] Figure 1 This is a block diagram of a network attack and defense simulation engine system based on discrete event-driven simulation, provided as an embodiment of this application. Detailed Implementation

[0034] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments.

[0035] like Figure 1 As shown, this application provides a network attack and defense simulation engine system based on discrete event-driven methods, including an event scheduling module, a simulation network construction module, an attack and defense simulation module, a simulation kernel module, and a panoramic situational awareness module.

[0036] The event scheduling module is built upon the theoretical foundation of MITRE ATT&CK and D3fend, and is used to convert all network activity into a schedulable discrete event sequence. Each discrete event sequence contains not only an execution timestamp and a callback function pointer, but also its corresponding ATT&CK technology ID. This facilitates the logical representation of the discrete event sequence as a visual, executable attack chain.

[0037] D3fend is used to map the correspondence between defensive network security measures and MITRE ATT&CK attack techniques;

[0038] Network activities include packet sending, protocol timeouts, and attack triggering.

[0039] The core of the event scheduling module lies in dynamically maintaining an ordered sequence of events using a priority queue. By comparing the current simulation clock with the scheduled execution time of the event at the head of the queue, the corresponding processing function is triggered precisely. Newly added events are automatically inserted into appropriate positions based on their time attributes to maintain the order of the queue; if multiple events have the same timestamp, they are processed sequentially according to priority or arrival order.

[0040] The event scheduling module also supports dynamic modification and cancellation of events, which is used to transform tactical intentions into a discrete event stream for execution, ensuring the timing accuracy of attack behaviors and the reliable operation of the protocol state machine.

[0041] For example, when the tactical objective is set to "initial access," the event scheduling module selects atomic actions such as phishing email delivery (T1566) and vulnerability exploitation (T1190) from the associated technology library as basic event units. These events are then assigned timestamps and priority attributes conforming to ATT&CK logic and stored in a priority queue, forming an ordered event stream.

[0042] In addition, the event scheduling module supports dynamic modification and cancellation of events, which is used to transform tactical intentions into a discrete event stream for execution, ensuring the timing accuracy of attack behaviors and the reliable operation of the protocol state machine.

[0043] For example, during route convergence, the next-hop information is updated and the relevant forwarding events are rescheduled.

[0044] The core of the simulated network building module lies in achieving full-stack simulation from the IaaS to the SaaS layer. The bottom layer uses simulation technology to accurately reproduce the physical network topology, including router forwarding rules, switch VLAN partitioning, and firewall policies; the middle layer simulates middleware service clusters (such as a microservice architecture managed by Kubernetes) through an orchestration engine.

[0045] The simulation network building module supports the simulation of various wired and wireless communication links, including Ethernet, PPP, IEEE 802.11 series standards, as well as wireless mesh networks, vehicle networks, etc.; it provides rich protocol support, covering a variety of protocols from the physical layer to the application layer; and it supports extended network security-related simulation capabilities, such as DDoS attacks and man-in-the-middle attacks.

[0046] The simulation network building module also includes a dynamic isolation subunit and a protocol stack implementation subunit. The dynamic isolation subunit uses copy-on-write technology to achieve real-time simulation. Initially, both share the same memory page table and disk snapshot.

[0047] When an attacker initiates a write operation, the hardware-assisted emulation layer automatically creates a separate copy of the page for modification. This fine-grained data isolation ensures absolute security in the production environment.

[0048] The protocol stack implementation subunits are implemented layer by layer using the OSI seven-layer model. Each layer constructs a finite state machine to parse and process the data units of the corresponding protocol. It also supports powerful data acquisition capabilities, accurately collecting key data during the simulation process, such as throughput, latency, packet loss rate, and channel utilization, through a built-in tracking system and traffic monitoring module.

[0049] The OSI seven-layer model works by layered encapsulation and peer-to-peer communication. The data sender starts from the application layer (layer 7) and adds control information (header / tail) layer by layer for encapsulation until the physical layer converts it into a bit stream for transmission. The receiver operates in reverse, parsing and stripping the corresponding header layer by layer to complete data decapsulation and transmission. Each layer provides services only through its adjacent layer interface and also provides services to the layer above it. Layers are independent of each other, thus enabling modular decomposition and collaborative operation of complex network communication tasks.

[0050] Taking TCP as an example, its state transitions cover the complete lifecycle stages such as LISTEN→SYN_SENT→ESTABLISHED→FIN_WAIT, and each state transition is driven by a specific event (such as receiving a SYN segment triggering a three-way handshake process).

[0051] The protocol stack implementation subunit has a built-in protocol fuzzing tool that can randomly generate malformed packets and inject them into the stack to test the exception handling capabilities of each layer; while the standard compliance test case library covers various boundary conditions specified in the RFC document.

[0052] Lower-layer protocols provide service primitive interfaces, such as the network layer's sendIPPacket() function, which is called by the transport layer to encapsulate IP headers. Cross-layer interaction achieves loose coupling through a callback registration mechanism, allowing higher-layer protocols to transparently use the unreliable datagram services provided by the lower layers.

[0053] For example, when testing the correctness of the UDP checksum algorithm, intentionally erroneous checksums are constructed to verify whether the receiver's discarding behavior complies with the specification requirements. This ensures the robustness and interoperability of the protocol implementation.

[0054] The attack and defense simulation module uses a hierarchical task network planner as its decision-making core. Taking tactical objectives as input and combining current simulated network situation information, it recursively decomposes high-level objectives into specific, executable ATT&CK technical action sequences through a task decomposition algorithm.

[0055] Meanwhile, the attack and defense simulation module integrates AI large-scale model technology to achieve intelligent assisted decision-making and automated simulation. AI technology can simulate complex network attack and defense scenarios, generating realistic attack behaviors and defense strategies, providing users with an intelligent adversarial experience. The instruction model abstracts complex network attack and defense behaviors into concise instruction sets (such as SQL injection, DDoS attacks, and firewall configuration), freeing commanders from concern themselves with underlying technical details; the system automatically executes technical operations through AI. The AI-driven intelligent agent supports a "human outside the ring" simulation mode, improving simulation efficiency and realism. Details are as follows:

[0056] 1) Goal transformation

[0057] The hierarchical task network planner takes the ATT&CK tactical objectives received from the tactical layer drive engine as initial input and continuously acquires situational information about the current network environment (such as compromised host privileges, available vulnerabilities, and network reachability). Its internal task decomposition algorithm recursively decomposes this high-level objective into a series of progressive sub-objectives (such as "acquiring local administrator privileges," "discovering domain controllers," and "stealing domain administrator credentials"), until it is decomposed into basic ATT&CK technical actions defined in the behavior library that can be directly mapped to discrete events, ensuring the consistency of the attack behavior.

[0058] When a technical action fails, the planner triggers a backtracking mechanism to find alternative techniques based on the current updated situation, simulating the resilience and flexibility in a real APT attack.

[0059] Among them, task decomposition algorithm refers to computational methods for solving complex planning problems, and is not limited to a specific implementation.

[0060] For example, it could be a classic HTN planning algorithm based on state space search (such as SHOP2), which selects a feasible decomposition method by matching the current world state with the task preconditions; it could also be an algorithm based on heuristics or cost evaluation (such as AO* search), which selects the optimal solution when there are multiple decomposition paths; or it could even be a hybrid algorithm that incorporates reinforcement learning elements, which optimizes the selection of decomposition strategies through historical simulation experience, in order to more efficiently generate feasible attack sequences that conform to tactical intentions and adapt to dynamic environments.

[0061] 2) Dynamic reprogramming

[0062] The hierarchical task network planner does not simply execute pre-set scripts. When a technical action fails, the planner triggers a backtracking mechanism. It undoes the failed technical path and, based on the updated situation, searches for and attempts alternative techniques within the same tactical phase (e.g., if exploiting a shared vulnerability fails, it attempts a password spraying attack instead). This ability to automatically adjust attack paths when encountering obstacles allows the red team agent to effectively simulate the resilience and flexibility of real APT attacks.

[0063] 3) Processing discrete event sequences

[0064] It accepts discrete event sequences from the event scheduling module, aggregates discrete low-level alarms into higher-confidence security events (Incidents), and attaches contextual information (such as attack chain stage inference). Then, based on a predefined response rule base and available response actions (such as isolating hosts, blocking IPs, and issuing detection rules), it makes decisions to contain, eliminate, or restore the event.

[0065] 4) Integrate the behavior library into the MITRE ATT&CK framework

[0066] The behavior library stores a large number of parameterized attack and defense action metaphrases. Action metaphrases are the smallest units for agent planning and execution, ensuring that each action accurately corresponds to the ATT&CK framework. Through the provided graphical playbook editor, users can directly drag and drop these metaphrases to flexibly combine them into complex, multi-stage attack and defense playbooks with conditional branches. This ensures that when new attack and defense techniques emerge, they can be immediately invoked by the agent simply by adding them to the library in standard metaphrase form, thus ensuring the system's excellent scalability and timeliness. It supports multi-dimensional network attack and defense models, including atomic models of the physical, information, social, and vulnerability domains, as well as composite models such as instructions, topology, and scenarios, enabling full-element simulation and fine-grained modeling.

[0067] The simulation kernel module adopts a microservice bus architecture, with a highly modular and scalable design. It supports both C++ and Python programming languages ​​and provides flexible development interfaces, making it easy for users to quickly implement complex simulation scenarios.

[0068] It can also decouple and coordinate various functional modules through event routing and distribution mechanisms, and has parallel discrete event simulation capabilities. It can divide the entire simulation topology into multiple logical processes, each responsible for event scheduling and processing within its own partition. Different partition kernels are coordinated through conservative or optimistic time synchronization algorithms (such as conservative synchronization based on global events or optimistic synchronization based on time warps) to ensure the causal correctness of cross-partition event processing. It supports attack and defense simulation of large enterprise networks and even city-level network infrastructure.

[0069] After the event scheduling module generates discrete events with ATT&CK technology IDs, the simulation kernel module receives the event and queries the event handler registry according to the event type (such as "data packet sending event" or "vulnerability detection event"), and accurately routes it to the module responsible for handling that type of event (such as the protocol stack sub-unit in the simulation network construction module or the attack and defense simulation module), thereby improving the scalability of the system.

[0070] The simulation kernel module also includes a storage subunit capable of storing the current simulation time, globally unique identifiers and state indices for all network assets, and global attack / defense flags. When processing an event, the kernel ensures all state changes triggered by that event are accounted for.

[0071] The panoramic situational awareness module can collect, fuse, correlate, and analyze multi-source and heterogeneous data generated throughout the simulation process, and extract operational knowledge from it. This solves the problems of scattered data collection, limited analytical dimensions, and difficulty in supporting in-depth review and decision-making in traditional simulations. The panoramic situational awareness module supports real-time 3D situational awareness display and review functions. Utilizing advanced 3D visualization technology, it displays the network attack and defense situation in real time, supporting multi-level viewing of network architecture, node connection relationships, and business processes. It also supports review functions, allowing users to replay and analyze the simulation process.

[0072] The panoramic situational awareness module includes a multi-dimensional data acquisition subunit and a situational analysis subunit. It provides unified assessment model management functions, pre-configures various assessment models (such as ATT&CK, D3FEND, CIAN, etc.), supports user-defined assessment models, and performs multi-dimensional quantitative analysis of the simulation process.

[0073] The multi-dimensional data acquisition subunit deploys lightweight data probes within the network nodes, security devices, host operating systems, and business applications of the simulation network construction module to collect data streams across all dimensions. The data probes adhere to a unified log standard, collecting comprehensive data including network flow data, system call sequences, security alarms (including ATT&CK technical IDs), performance metrics, decision logs of attack and defense agents, and business transaction records. All data is tagged with high-precision timestamps and asset tags upon generation and transmitted in real-time to the central data lake via a high-throughput message queue (such as Kafka) for storage, providing a complete and consistent data foundation for subsequent analysis.

[0074] The situational analysis subunit can utilize ATT&CK technology IDs to continuously query and correlate real-time data streams, reconstructing attack chains from discrete security events according to chronological order and causal logic, dynamically generating and visually displaying the current attack's progression path. It also supports various evaluation presentation formats, including tables, bar charts, line charts, pie charts, and advanced visualization tools such as heatmaps, tree diagrams, and network diagrams, helping users intuitively understand complex data relationships and network structures.

[0075] For example: T1566.001 (phishing) → T1059.003 (executed via command line) → T1082 (system information discovery).

[0076] Meanwhile, the panoramic situational awareness module can automatically generate structured evaluation reports and supports interactive 3D timeline backtracking interface, allowing users to jump to any moment in the simulation process like operating a video editor, to conduct in-depth review and root cause analysis, which greatly enhances the value of simulation for training, testing and research.

[0077] The simulation kernel module fully utilizes multi-core CPU resources through discrete event-driven and parallel simulation techniques, significantly accelerating simulation speed, especially suitable for large-scale network simulation scenarios. The kernel supports various compilation optimization options, allowing users to select appropriate optimization strategies based on simulation scale and accuracy requirements. Its lightweight design effectively reduces resource consumption, supports rapid startup and destruction of the simulation environment, and offers a significant advantage in ultra-fast simulation.

[0078] In the aforementioned discrete event-driven network attack and defense simulation engine system, the event scheduling module transforms MITRE ATT&CK tactical intentions into an ordered event flow, and the hierarchical task network planner in the attack and defense simulation module dynamically decomposes and replans high-level targets, completely freeing the system from the constraints of predefined scripts. This allows for adaptive adjustment of the technical path based on the simulation situation, fully and flexibly simulating the complex APT attack chain from initial intrusion to target achievement. Simultaneously, the blue team's defensive response is dynamically generated based on event correlation and analysis, thus realizing dynamic game theory and continuous evolution of strategies between the attacking and defending sides.

[0079] Meanwhile, the panoramic situational awareness module collects and integrates comprehensive data across network, security, host, business, and agent decision-making through standardized probes deployed at each layer. Utilizing ATT&CK technology, it reconstructs the attack chain in real time, overcoming the limitations of traditional simulations that only focus on performance metrics. This provides comprehensive and quantitative data support for in-depth analysis, defense system effectiveness assessment, and security investment decisions.

[0080] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

Claims

1. A discrete event driven network attack-defense simulation engine system, characterized in that, The event scheduling module, the simulation network construction module, the attack and defense simulation module, the simulation kernel module, and the panoramic situation awareness module are included. The event scheduling module is constructed based on MITRE ATT&CK and D3fend as a theoretical base, and is used for converting all network activities into a schedulable discrete event sequence; the network activities include packet sending, protocol timeout, and attack triggering. The simulation network construction module can construct a simulation network containing complete business logic, and reproduce transaction processes and user interaction behaviors through module selection, script writing, and network model configuration. The attack and defense simulation module uses a hierarchical task network planner as its decision core, takes tactical targets as input, combines current simulation network situation information, and recursively decomposes high-level targets into specific and executable ATT&CK technical action sequences through a task decomposition algorithm. The simulation kernel module adopts a micro-service bus architecture mode, realizes decoupling and cooperation of various functional modules through an event routing and distribution mechanism, and has parallel discrete event simulation capability. The panoramic situation awareness module can collect, fuse, correlate, and analyze multi-source and heterogeneous data generated in the whole simulation process, and extract operation knowledge therefrom.

2. The network attack-defense simulation engine system based on discrete event driving according to claim 1, wherein, The discrete event sequence contains an execution timestamp and a callback function pointer, and also contains the corresponding ATT&CK technical ID.

3. The network attack-defense simulation engine system based on discrete event driving according to claim 1, wherein, The event scheduling module also supports dynamic modification and cancellation of events, which are used to convert tactical intentions into executable discrete event streams.

4. The network attack-defense simulation engine system based on discrete event driving according to claim 1, characterized in that, The simulation network construction module is used to realize full-stack simulation from the IaaS to the SaaS layer, and the bottom layer uses simulation technology to accurately reproduce the physical network topology structure, including router forwarding rules, switch VLAN division, and firewall policies. The middle layer simulates a middleware service cluster through an orchestration engine.

5. The network attack-defense simulation engine system based on discrete event driving according to claim 1, wherein, The simulation network construction module also includes a dynamic isolation subunit and a protocol stack implementation subunit. The dynamic isolation subunit realizes real-time simulation by using the copy-on-write technology. The protocol stack implementation subunit is layered according to the OSI seven-layer model, and a finite state machine is constructed for each layer to parse and process data units of the corresponding protocol.

6. The network attack-defense simulation engine system based on discrete event driving according to claim 1, wherein, The specific content of the attack and defense simulation module includes target conversion, dynamic re-planning, and processing of discrete event sequences. The target conversion takes the ATT&CK tactical target received from the tactical layer driving engine as the initial input according to the hierarchical task network planner, and continuously acquires situation information of the current network environment. The dynamic re-planning can trigger a backtracking mechanism through the hierarchical task network planner when a technical action fails, revoke the current failed technical path, and find and try alternative techniques within the same tactical stage based on the current updated situation. When processing the discrete event sequence, the attack and defense simulation module accepts the discrete event sequence output from the event scheduling module, aggregates discrete low-level alarms into higher-confidence security events, and adds context information. The attack and defense simulation module also integrates AI large model technology to realize intelligent auxiliary decision-making and automatic deduction.

7. The network attack-defense simulation engine system based on discrete event driving according to claim 1, wherein, The attack and defense simulation module can also integrate a behavior library into the MITRE ATT&CK framework, the behavior library storing a large number of parameterized attack and defense action primitives, the action primitives being the smallest unit of planning and execution of an agent, so that each action can be accurately mapped to the ATT&CK framework.

8. The network attack-defense simulation engine system based on discrete event driving according to claim 1, wherein, The simulation kernel module further comprises a storage subunit capable of storing the current simulation time, the globally unique identifier and state index of all network assets, and the global attack and defense flag, and the simulation kernel module adopts a micro-service bus architecture mode and a highly modular and scalable design architecture.

9. The network attack-defense simulation engine system based on discrete event driving according to claim 1, wherein, The panoramic situation awareness module comprises a multi-dimensional data acquisition subunit and a situation analysis subunit. The multi-dimensional data acquisition subunit deploys lightweight data probes in the network nodes, security devices, host operating systems and business applications of the simulation network construction module to collect full-dimensional data streams. The situation analysis subunit can continuously query and correlate the real-time data streams using the ATT&CK technology ID, reconstruct the attack chain according to the time sequence and causal logic of discrete security events, and dynamically generate and visually display the current attack path.

10. The network attack-defense simulation engine system based on discrete event driving according to claim 9, wherein, The panoramic situation awareness module supports real-time 3D situation display and review functions, can display the network attack and defense situation in real time, supports multi-level viewing of network architecture, node connection relationship and business process, and allows users to replay and analyze the deduction process.

Images