A multi-level honeynet architecture attack isolation method and system

Abstract

The application discloses a multi-level honeycomb architecture attack isolation method and system, relates to the technical field of attack isolation, and if the detection statistics is greater than or equal to a preset detection threshold, incremental processing is performed on a first number of suspicious attack sessions, a second number of attack sessions is obtained, maximum likelihood estimation is performed based on a third number of normal interaction sessions and the second number of attack sessions, a session category corresponding to a maximum probability result is determined, attack sessions corresponding to the maximum probability result are marked and isolated, a fourth number of remaining interaction sessions is obtained, virtual service configuration and interaction strategies of multi-level honeycomb nodes are dynamically adjusted based on the fourth number of remaining interaction sessions, virtual topology and decoy asset distribution are updated, and attack behavior is continuously guided into a honeycomb environment. The isolation method significantly improves the accuracy of attack detection, thereby realizing efficient isolation and intelligence utilization of complex network attacks.

Description

Technical Field

[0001] This invention relates to the field of attack isolation technology, specifically to an attack isolation method and system with a multi-layered honeycomb architecture. Background Technology

[0002] An isolation system is a comprehensive network security defense solution. It achieves graded protection through a multi-layered design, using a honeynet as the core trapping environment to construct realistic attack scenarios. It relies on a reasonable architecture to achieve efficient collaboration in data capture, analysis, and response. It uses attack isolation mechanisms to ensure that attack behavior is limited to a controllable range and will not attack real assets. Finally, it operates as a whole system with the capabilities of automated processing, dynamic defense, and scalable upgrades. This system can not only protect the network security of core networks, but also reverse-engineer attacker behavior to support attack intelligence gathering and defense strategy optimization.

[0003] The existing technology has the following drawbacks:

[0004] 1. The isolation mechanism is crude and lacks dynamism. After detecting attack traffic, it usually blocks the entire system or transfers it to a honeypot. However, this approach lacks a tiered processing and iterative optimization mechanism, which can easily lead to two types of problems: First, over-isolation, where normal business sessions are mistakenly affected, impacting business continuity; second, insufficient isolation, where some hidden or progressive attacks are not eliminated in time, and the attack chain may still extend to the real system.

[0005] 2. Honeynet resource scheduling is static and lacks adaptive guidance capabilities. When deploying honeypots or honeynets, fixed topologies and service configurations are often used. After identifying the characteristics of the virtual environment, attackers can bypass the honeynet through evasion strategies and enter the core business system. At the same time, the profiles of honeynet nodes cannot be adjusted according to the attack evolution process, making it impossible to continuously lure attackers in the long term. Summary of the Invention

[0006] The purpose of this invention is to provide an attack isolation method and system based on a multi-layered honeynet architecture, constructing a closed-loop system of detection-isolation-update-output, which significantly improves the accuracy of attack detection, thereby achieving efficient isolation and intelligence utilization of complex network attacks.

[0007] To achieve the above objectives, the present invention provides the following technical solution: an attack isolation method for a multi-layered honeycomb architecture, the method comprising:

[0008] S10: Collect access sessions from users or attackers in the target network and their corresponding traffic characteristics, combine them with the virtual asset profiles of multi-layer honeynet nodes, obtain the residual vector information of attack interactions, and calculate the detection statistics based on the residual vector information.

[0009] S20: If the detection statistic is greater than or equal to the preset detection threshold, then perform incremental processing on the first number of suspicious attack sessions to obtain the second number of attack sessions. Based on the third number of normal interaction sessions and the second number of attack sessions, perform maximum likelihood estimation to determine the session category corresponding to the maximum probability result, and mark and isolate the attack sessions corresponding to the maximum probability result to obtain the fourth number of remaining interaction sessions.

[0010] S30: Based on the fourth number of remaining interactive sessions, dynamically adjust the virtual service configuration and interaction strategy of the multi-layer honeynet nodes, update the virtual topology and decoy asset distribution, and continuously guide attack behavior into the honeynet environment;

[0011] S40: Repeat steps S10 to S30 until the preset termination condition is met;

[0012] S50: After the preset termination condition is met, output the isolated multi-level attack behavior information and form attack intelligence data.

[0013] Preferably, if the detection statistic is greater than or equal to a preset detection threshold, incremental processing is performed on the first number of suspicious attack sessions to obtain the second number of attack sessions. The steps of performing maximum likelihood estimation based on the third number of normal interaction sessions and the second number of attack sessions to determine the session category corresponding to the highest probability result, and marking and isolating the attack sessions corresponding to the highest probability result to obtain the fourth number of remaining interaction sessions include:

[0014] When the detection statistics are greater than or equal to the preset detection threshold, the access session is marked as a suspicious attack session and enters the incremental analysis process;

[0015] By supplementing multi-dimensional features and tracking dynamic behavior, false alarms are gradually eliminated, and malicious sessions are screened out.

[0016] Obtain the first set of suspicious sessions, and then filter out the second set of attack sessions through incremental processing;

[0017] The maximum likelihood estimation method is introduced. By comparing the third number of normal interaction sessions with the second number of attack sessions, the probability of each session belonging to the attack or normal category is calculated. The category corresponding to the highest probability is selected as the final judgment result, and a sample set is constructed. The corresponding discrimination model is created simultaneously based on the sample set.

[0018] The discrimination model identifies sessions not identified as attacks and attack sessions with a first confidence level as the fourth number of remaining interactive sessions.

[0019] Preferably, the calculation process of the maximum likelihood estimation method is as follows: extract the common features of the normal interactive sessions to form a multi-dimensional feature vector; construct a likelihood function for the normal category based on the feature distribution of the normal interactive sessions; calculate the value range and probability density of the normal interactive sessions in each feature dimension through the multi-dimensional feature vector; construct a likelihood function for the attack category based on the attack sessions; for each session to be judged, calculate the normal probability of it belonging to the normal category and the attack probability of it belonging to the attack category; compare the probability values ​​of the session belonging to the normal category and the attack category; if the attack probability is greater than the normal probability, it is finally judged as an attack session; if the attack probability is less than or equal to the normal probability, it is judged as a normal interactive session.

[0020] Preferably, the step of constructing the sample set includes:

[0021] Attack session samples: Attack sessions with second-level confidence that have been filtered through incremental processing;

[0022] Normal interactive session samples: randomly selected from normal sessions that were not labeled within the same time period.

[0023] Preferably, the steps of obtaining a first set of suspicious sessions and filtering out a second set of attack sessions through incremental processing include:

[0024] Observe the interaction pattern of the session within a preset time window and check whether the session is related to other known attack IPs, malicious domains, or attack methods.

[0025] If a session interacts with decoy assets in the honeynet, its attack intent confidence increases. After verification, sessions with a detection statistic ≥ the second preset detection threshold are set as the second number of attack sessions.

[0026] Preferably, based on the fourth number of remaining interactive sessions, the steps of dynamically adjusting the virtual service configuration and interaction strategy of the multi-layered honeycomb nodes, updating the virtual topology and decoy asset distribution, and continuously guiding attack behavior into the honeycomb environment include:

[0027] Analyze the remaining interactive sessions in the fourth quantity to extract behavioral features and interaction patterns;

[0028] Based on the extracted behavioral features, unsupervised clustering is performed on the remaining interactive sessions in the fourth quantity to identify different user behavior groups.

[0029] Within each cluster, analyze whether there is any abnormal behavior. If so, compare the abnormal behavior with the virtual service configuration of the current honeynet node.

[0030] Based on the comparison results, the virtual service configuration and interaction strategy of the multi-layer honeycomb nodes will be dynamically optimized.

[0031] Preferably, the adjustment process for the virtual service configuration is as follows: based on the service access needs in the fourth number of remaining interactive sessions that are not covered by the current honeynet, add corresponding virtual service nodes and adjust the data returned by the Web management interface;

[0032] The adjustment process of the interaction strategy is as follows: adjust the response strategy of the honeynet node according to different user roles. If the remaining interaction sessions in the fourth quantity show that the user accesses the order management system on a weekday, the honeynet will increase the activity of the order management system interface during this period and automatically deploy a fake historical order archive compressed package near the interface path.

[0033] Preferably, the step of combining the virtual asset profiles of multi-layered honeycomb nodes to obtain residual vector information of attack interactions, and calculating detection statistics based on the residual vector information, includes:

[0034] When the collected access sessions reach the honeynet node, their traffic characteristics are compared with the virtual asset profile of the corresponding node, the difference between the two is calculated, and an attack interaction residual vector is generated.

[0035] Based on the generated attack interaction residual vector, detection statistics are calculated to quantify the degree of anomaly in access behavior.

[0036] Preferably, the termination conditions include: the attack behavior is isolated, the attack chain information is collected through honeynet interaction, or the network service is no longer under attack.

[0037] Preferably, an attack isolation system with a multi-layered honeynet architecture includes a statistics calculation module, a session processing module, a dynamic adjustment module, and an output module;

[0038] The statistics calculation module is used to collect access sessions from users or attackers in the target network and their corresponding traffic characteristics. Combined with the virtual asset profiles of multi-layer honeynet nodes, it obtains the residual vector information of attack interactions and calculates the detection statistics based on the residual vector information.

[0039] The session processing module is used to perform incremental processing on the first number of suspicious attack sessions if the detection statistic is greater than or equal to the preset detection threshold, to obtain the second number of attack sessions. Based on the third number of normal interaction sessions and the second number of attack sessions, the maximum likelihood estimation is performed to determine the session category corresponding to the maximum probability result. The attack sessions corresponding to the maximum probability result are marked and isolated to obtain the fourth number of remaining interaction sessions.

[0040] The dynamic adjustment module is used to dynamically adjust the virtual service configuration and interaction strategy of the multi-layer honeynet nodes based on the fourth number of remaining interactive sessions, update the virtual topology and decoy asset distribution, and continuously guide attack behavior into the honeynet environment.

[0041] The output module is used to repeatedly execute the steps of the statistics calculation module, the session processing module, and the dynamic adjustment module until the preset termination condition is met; after the preset termination condition is met, the isolated multi-level attack behavior information is output and attack intelligence data is formed.

[0042] The technical effects and advantages provided by the present invention in the above technical solution are as follows:

[0043] This invention proposes a dynamic defense process with closed-loop characteristics through a multi-layered honeycomb architecture attack isolation method:

[0044] 1. In the detection phase, a modeling approach using residual vectors and detection statistics is introduced to quantify the differences between attacker interactions and honeynet virtual profiles, thereby measuring the degree of anomaly at a mathematical level and significantly reducing the probability of false positives and false negatives.

[0045] 2. In the isolation phase, incremental processing and maximum likelihood estimation methods are introduced to progressively weight the judgment of suspicious attack sessions and determine the maximum probability result by comparing it with the normal interaction session, so as to achieve more refined attack identification and isolation and avoid business interference caused by a one-time crude block.

[0046] 3. A dynamic update mechanism is proposed during the orchestration phase to adjust the service configuration and topology of honeynet nodes in real time based on the remaining interactions, so that attackers are always in a state of being guided and deceived, increasing the cost of evasion and ensuring that attack activities are continuously locked within the honeynet environment.

[0047] 4. Under iterative control, by repeatedly executing detection, isolation and update steps until multiple termination conditions are met, the system ensures that not only is the attack intercepted, but the complete attack chain is also recorded, thus ensuring that the system has a persistent defense capability against progressive and long-term latent attacks.

[0048] 5. The output stage transforms the isolation results into structured attack intelligence data, including attack chains, session behavior patterns, tools and TTPs information, providing directly usable input for upper-layer defense systems (such as SIEM / SOAR), thereby realizing the transformation from simple defense to intelligent security situation awareness. Attached Figure Description

[0049] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in this invention. For those skilled in the art, other drawings can be obtained based on these drawings.

[0050] Figure 1 A flowchart illustrating the attack isolation method for a multi-layered honeycomb architecture provided in this embodiment of the invention;

[0051] Figure 2 This is a structural block diagram of an attack isolation system with a multi-layered honeycomb architecture provided in an embodiment of the present invention. Detailed Implementation

[0052] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0053] Example

[0054] Please see Figure 1 As shown, the attack isolation method for the multi-layered honeycomb architecture provided in this embodiment specifically includes the following steps:

[0055] S10: Collect access sessions from users or attackers in the target network and their corresponding traffic characteristics, combine them with the virtual asset profiles of multi-layer honeycomb nodes to obtain residual vector information of attack interactions; calculate detection statistics based on the residual vector information to measure the degree of abnormality of access behavior.

[0056] S20: If the detection statistic is greater than or equal to the preset detection threshold, then perform incremental processing on the first number of suspicious attack sessions to obtain the second number of high-confidence attack sessions; perform maximum likelihood estimation based on the third number of normal interaction sessions and the second number of attack sessions to determine the session category corresponding to the maximum probability result; and mark and isolate the attack sessions corresponding to the maximum probability result to obtain the fourth number of remaining interaction sessions.

[0057] S30: Based on the fourth number of remaining interactive sessions, dynamically adjust the virtual service configuration and interaction strategy of the multi-layer honeynet nodes; by updating the virtual topology and decoy asset distribution, ensure that attack behavior is continuously guided to the honeynet environment.

[0058] S40: Repeat steps S10 to S30 until the preset termination condition is met;

[0059] The termination conditions include, but are not limited to: the attack behavior being completely isolated, the honeynet interaction collecting complete attack chain information, or the core network services no longer being attacked.

[0060] S50: After the preset termination condition is met, output the isolated multi-layered attack behavior information and form attack intelligence data; the data is used to support subsequent defense strategy optimization and security situation awareness.

[0061] Please see Figure 2 This embodiment provides an attack isolation system with a multi-layered honeynet architecture, including a statistics calculation module, a session processing module, a dynamic adjustment module, and an output module;

[0062] The statistics calculation module is used to collect access sessions from users or attackers in the target network and their corresponding traffic characteristics. Combined with the virtual asset profiles of multi-layer honeynet nodes, it obtains the residual vector information of attack interactions. Based on the residual vector information, it calculates the detection statistics and sends the detection statistics to the session processing module.

[0063] The session processing module is used to perform incremental processing on the first number of suspicious attack sessions if the detection statistic is greater than or equal to the preset detection threshold, to obtain the second number of attack sessions. Based on the third number of normal interaction sessions and the second number of attack sessions, the maximum likelihood estimation is performed to determine the session category corresponding to the maximum probability result. The attack sessions corresponding to the maximum probability result are marked and isolated to obtain the fourth number of remaining interaction sessions. The fourth number of remaining interaction sessions are sent to the dynamic adjustment module.

[0064] The dynamic adjustment module is used to dynamically adjust the virtual service configuration and interaction strategy of the multi-layer honeynet nodes based on the fourth number of remaining interactive sessions, update the virtual topology and decoy asset distribution, and continuously guide attack behavior into the honeynet environment.

[0065] The output module is used to repeatedly execute the steps of the statistics calculation module, the session processing module, and the dynamic adjustment module until the preset termination condition is met; after the preset termination condition is met, the isolated multi-level attack behavior information is output and attack intelligence data is formed.

[0066] In addition, it should be noted in this embodiment that:

[0067] S10: Collect access sessions from users or attackers in the target network and their corresponding traffic characteristics, combine them with the virtual asset profiles of multi-layer honeycomb nodes to obtain residual vector information of attack interactions; calculate detection statistics based on the residual vector information to measure the degree of abnormality of access behavior.

[0068] Deploy traffic acquisition modules at key observation points in the target network (such as perimeter firewalls, core switches, server front-end proxies, etc.) to capture access sessions from users or attackers and their associated traffic data in real time. The raw data collected includes, but is not limited to:

[0069] Source / destination IP addresses, port numbers, protocol types (e.g., TCP / UDP / HTTP), access timestamps, session duration, etc. Packet size distribution, session frequency, connection establishment / termination patterns, transport layer flags (e.g., SYN / ACK / FIN), application layer protocol characteristics (e.g., HTTP session methods, URL paths, User-Agent, Cookies, etc.). User or attacker interaction patterns (e.g., number of login attempts, file access paths, database query statements), session temporal characteristics (e.g., burstiness, periodicity), and deviations from historical baselines.

[0070] The honeynet environment consists of multiple layers of virtual nodes (such as web servers, database servers, mail servers, IoT simulation devices, etc.), and each node is configured with a virtual asset profile to describe its normal behavior patterns. These profiles are dynamically generated based on the following information:

[0071] Open ports and service types, running application versions, operating system fingerprints, configuration file templates, etc. By observing the access behavior of normal users over a long period, establish typical interaction patterns for these nodes, such as: common HTTP session paths (e.g., / index.html, / api / login), valid parameter formats (e.g., username length limits, password complexity requirements), and typical response time ranges. Allowed SQL query types (e.g., SELECT but restricted to DROPTABLE), valid table and field names, and common query parameter ranges. Accessible directory structures and allowed file types for download (e.g., .pdf, .docx but excluding .exe).

[0072] The profile is continuously updated through a rule engine (such as regular expression matching and whitelist mechanism) to ensure that it can accurately reflect the normal behavioral boundaries of each virtual asset in the current network environment.

[0073] When a collected access session reaches a honeycomb node, the system compares its traffic characteristics with the corresponding node's virtual asset profile, calculates the difference between the two, and generates an attack interaction residual vector (RIV). Each dimension of the vector represents the degree of deviation of a specific behavioral feature from the expected baseline. Key features are extracted from the raw traffic data (such as whether the session's URL path matches the set of legitimate paths, whether the data packet size exceeds the normal range, and whether the number of login failures exceeds the threshold). For each feature, its deviation from the normal range defined in the virtual asset profile is calculated. For example, if an HTTP session accesses / admin / delete_all_users.php (an illegitimate path), the residual value of the path feature is set to high deviation (e.g., 1.0); if it accesses / home.html (a legitimate path), the residual value is close to 0. If a database query contains a DROPTABLE statement (an illegal operation), the residual value of the SQL feature is set to high deviation; if it is only a SELECT FROM users (a legitimate query), the residual value is close to 0. The residual values ​​of all key features are combined into a multi-dimensional vector, namely the Attack Interaction Residual Vector (RIV). Its dimensions may include: path legitimacy, parameter compliance, session frequency anomaly, protocol behavior deviation, etc. The higher the value of the vector, the greater the deviation of the current access behavior from the normal baseline, and the higher the potential malicious possibility.

[0074] Based on the generated attack interaction residual vector, the system further calculates a detection statistic (DS) to quantify and assess the anomaly level of the access behavior. The calculation logic of the statistic is as follows:

[0075] Different weights are assigned to each dimension in the RIV (e.g., the weight of critical path access is higher than that of ordinary parameter verification), and the weighted total residual value is calculated. For example, if the weight of the DROPTABLE operation is 0.9, while the weight of ordinary parameter errors is 0.2, the former contributes more to the DS. The calculated DS value is compared with the DS distribution of historical normal interaction sessions (e.g., using methods such as percentiles and standard deviation deviation) to determine the degree of abnormality of the current session. For example, if the DS value exceeds the 95th percentile of historical normal interaction sessions, it is judged as highly abnormal; if the DS value is between the 90th and 95th percentiles, it is judged as moderately abnormal; if the DS value is below the 90th percentile, it is considered normal or low-risk behavior. The detection statistics are ultimately used for attack session screening in the S20 phase to ensure that only access sessions with high abnormality are analyzed and isolated in depth.

[0076] S20: If the detection statistic is greater than or equal to the preset detection threshold, then perform incremental processing on the first number of suspicious attack sessions to obtain the second number of high-confidence attack sessions; perform maximum likelihood estimation based on the third number of normal interaction sessions and the second number of attack sessions to determine the session category corresponding to the maximum probability result; and mark and isolate the attack sessions corresponding to the maximum probability result to obtain the fourth number of remaining interaction sessions.

[0077] The initial set of suspicious sessions (N_SS) consists of all sessions with DS ≥ Threshold_T, which may include real attacks, Advanced Persistent Threat (APT) probes, or a small number of false positives (such as abnormal business operations). Each session in N_SS undergoes multiple rounds of feature enhancement analysis, including but not limited to: observing the session's interaction patterns within a preset time window (e.g., whether it continuously initiates high-risk sessions, whether it attempts lateral movement); checking whether the session is associated with other known attack IPs, malicious domains, or attack methods (such as TTPs) (e.g., the same source IP has previously been marked in an attack intelligence database). If the session interacts with decoy assets in the honeynet (e.g., a fake administrator backend, a sensitive database) (e.g., attempting to download fake financial data files), its attack intent confidence is significantly increased. Through the above incremental processing, the system filters out a second set (N_HS) of high-confidence attack sessions from N_SS, namely those sessions whose malicious probability exceeds the secondary judgment threshold (Threshold_HS) after verification (e.g., overall confidence ≥ 90%). If a session is initially marked as suspicious (N_SS) due to high-frequency port scanning (DS=0.85), but is subsequently found to be attempting to access the database backup directory (high-risk path) in the honeynet and sending malformed SQL injection payloads, it may be upgraded to a high-confidence attack session (N_HS) after incremental analysis.

[0078] To further reduce the risk of misjudgment, the system introduces the maximum likelihood estimation (MLE) method. By comparing the normal interaction sessions in the third number (N_NS) with the attack sessions in N_HS, the system calculates the probability that each session belongs to the attack or normal category, and finally selects the category corresponding to the highest probability as the final judgment result.

[0079] Sample set construction:

[0080] Attack session samples (N_HS) are attack sessions with a second confidence level filtered through incremental processing (e.g., 100 sessions). Normal interaction session samples (N_NS) are randomly selected from sessions not marked as suspicious by S10 within the same time period (e.g., 1000 sessions), ensuring coverage of various normal business behaviors (such as user login and file download). It should be noted that the confidence level provided in this embodiment is specifically between 0 and 10, where the first confidence level ranges from 3 to 6 and the second confidence level ranges from 6 to 9, to facilitate subsequent processing.

[0081] Maximum Likelihood Estimation (MLE) Processing Flow:

[0082] Common features (such as session path validity residuals, parameter compliance residuals, protocol behavior deviations, etc.) of the normal interaction sessions (N_HS+N_NS) are extracted to form a unified multi-dimensional feature vector (similar to but more concise than the RIV in S10). Based on the feature distribution of N_NS (the normal interaction sessions), a likelihood function (LikelihoodFunction_Normal) for the normal category is constructed. The typical value range and probability density of the normal interaction session in each feature dimension are calculated using the multi-dimensional feature vector. Similarly, a likelihood function (LikelihoodFunction_Attack) for the attack category is constructed based on N_HS (the attack sessions). For each session to be judged (whether it is a session in N_HS or N_NS), the normal probability of belonging to the normal category and the attack probability of belonging to the attack category are calculated respectively (i.e., the product or weighted sum of the feature vectors under the likelihood functions of each category). The probability values ​​of the session belonging to the normal category and the attack category are compared. If the attack probability is greater than the normal probability, the session is ultimately determined to be an attack session; if the attack probability is less than or equal to the normal probability, the session is determined to be a normal interaction session. The core advantage of MLE is that it utilizes the actual distribution difference between normal and attack sessions, rather than relying on a fixed threshold, thus it can handle edge cases more accurately (such as some sessions having a DS slightly higher than the threshold but actually being false positives).

[0083] Based on the judgment result of maximum likelihood estimation (MLE):

[0084] Perform double labeling (e.g., malicious IP + attack type label) and take immediate isolation measures, including but not limited to:

[0085] Subsequent packets from the session are dropped at the firewall / IPS level. Connections to the honeynet node are forcibly closed (e.g., by sending an RST packet). Complete interaction details (e.g., session content, response behavior, residual vector values) are recorded in the attack intelligence database for subsequent analysis. After this step, the number of attack sessions remaining is reduced to the low-confidence portion (N_HS_residual) of the second number (N_HS), while high-confidence attack sessions are isolated.

[0086] Remaining interactive sessions (N_RS) include two types:

[0087] The discrimination model identifies sessions not judged as attacks (e.g., sessions judged as normal by MLE, or previously unmarked N_NS sessions). Attack sessions with a first confidence level are isolated (if the system adopts a conservative strategy, only high-confidence attack sessions are isolated; other suspicious sessions are not processed). Finally, the system obtains a fourth number (N_RS) of remaining interaction sessions, which are considered safe or require further observation and can continue to participate in subsequent dynamic optimization of the honeynet environment (S30 stage). Example:

[0088] Assuming an initial N_SS = 150 records (DS ≥ Threshold_T), after incremental processing, N_HS = 80 records (high confidence suspicious). Then, MLE determines that 60 of these are attack sessions (attack probability > 95%) and isolates them. The remaining 20 records are not isolated because their probability is close to the threshold (e.g., attack probability 60%). Together with N_NS, they constitute N_RS = 1100 records (normal + low-risk sessions).

[0089] S30: Based on the fourth number of remaining interactive sessions, dynamically adjust the virtual service configuration and interaction strategy of the multi-layer honeynet nodes; by updating the virtual topology and decoy asset distribution, ensure that attack behavior is continuously guided to the honeynet environment.

[0090] A deep analysis is conducted on the remaining interactive sessions in the fourth batch to extract their key behavioral characteristics and interaction patterns, which serve as the basis for dynamic adjustments to the honeynet. The core logic of this process is: by analyzing the real interactive behaviors of normal or low-risk users, weak links or uncovered scenarios in the current honeynet configuration are identified, thereby guiding subsequent optimization directions.

[0091] Extracting multidimensional features from the fourth quantity, including but not limited to:

[0092] The types of virtual services frequently accessed by users (e.g., web management interface, API interface, database query port), commonly used session methods (e.g., GET / POST ratio), and typical parameter passing patterns (e.g., login form fields, API key location). The time period distribution of session establishment (e.g., working hours vs. non-working hours), session interval patterns (e.g., uniform access vs. sudden high-frequency sessions), and session duration range. The virtual paths frequently accessed by users (e.g., / dashboard, / api / v1 / data), the types of files downloaded (e.g., PDF reports, Excel spreadsheets), and the functional modules invoked (e.g., user information query, order export).

[0093] Based on the extracted behavioral features, different user behavior groups are identified (e.g., administrator users, regular employee users, and automation tool users). Within each cluster, further analysis is conducted to determine if any anomalous behaviors exist (e.g., in a cluster of administrator users, individual sessions frequently attempt to access atypical management paths like / admin / debug). These anomalous behaviors are compared with the virtual service configuration of the current honeynet nodes to identify which services (e.g., an undeployed financial system simulation interface), paths (e.g., the uncovered / legacy_api), or interaction logic (e.g., a lack of multi-factor authentication simulation) might be needed by real users but not currently provided by the honeynet, or which potential attack entry points (e.g., low-frequency access to sensitive paths) are not adequately monitored.

[0094] If analysis reveals that a large number of normal user sessions in N_RS frequently access the / reports directory of the virtual web server (to download daily report data), but the current honeynet only deploys static placeholder files in this directory without dynamic interaction logic, then this path may become a target for attackers to probe (such as to find real data leakage points). The decoy attribute of this path needs to be added in subsequent optimizations.

[0095] Based on the above behavioral characteristic analysis results, the system dynamically optimizes the Virtual-Service-Configuration (VSC) and Interaction-Strategy (IS) of the multi-layered honeycomb nodes according to the comparison results, in order to improve the simulation of real user behavior and the attractiveness of the honeycomb to attack behaviors. Virtual service configuration processing flow:

[0096] Based on service access requests in N_RS that are not currently covered by the honeynet (e.g., users frequently call API Gateway v2 but the honeynet only deploys v1), add corresponding virtual service nodes (e.g., simulating API Gateway v2 authentication logic and response format). For frequently accessed services (e.g., the web management interface), adjust the detail of the returned data (e.g., upgrading from static HTML to a dynamically rendered dashboard) and the realism of error messages (e.g., simulating a real insufficient permissions error code instead of the common 403) to increase the realism of the interaction. For paths in N_RS that users attempt to access but are not fully implemented in the current honeynet (e.g., / admin / logs), supplement with corresponding virtual files or interaction logic (e.g., returning a fake log file but embedding honey bait tags).

[0097] Interaction strategy adjustment logic:

[0098] Adjust the response strategy of honeynet nodes based on different user roles (e.g., administrator vs. regular user) (e.g., display more sensitive menu options after administrator login, while displaying only basic functions for regular users). Target common attacker objectives (e.g., database credentials, configuration files) by deploying high-value decoy assets (e.g., forged database backup files containing fake but enticing data) near frequently accessed paths in N_RS (e.g., the / backup directory adjacent to the / config directory). Simulate non-ideal states of real services (e.g., occasional network latency, timeout errors for some functions) to prevent the honeynet from being identified as a fake environment by attackers due to its overly perfect nature. If N_RS shows that users frequently access the / orders / export interface of the order management system between 9-10 AM on weekdays, the honeynet can increase the activity of this interface during this period (e.g., return dynamically generated order data) and deploy forged historical order archive compressed packages (decoy assets) near the interface path.

[0099] In addition to service configuration and interaction strategies, the system further optimizes the virtual topology (VT) and decoy asset distribution (DAD) of the honeynet. By adjusting the logical layout of the network architecture and the placement of key assets, attackers are guided to penetrate the honeynet environment according to a preset path.

[0100] Virtual topology adjustment:

[0101] Based on the attacker's potential penetration path in N_RS (e.g., first accessing the web frontend and then attempting to redirect to the backend database), adjust the logical connection relationships of the honeynet nodes (e.g., set the virtual network latency between the web server and the database server to more closely resemble a real enterprise environment). For advanced attack methods (e.g., using DNS tunnels or ICMP covert communication), add edge nodes to the topology (e.g., simulating DNS servers or email gateways) and configure corresponding communication protocol support to lure attackers into the honeynet monitoring range when using covert channels.

[0102] Adjustment of decoy asset distribution:

[0103] In N_RS, densely deploy low-interaction decoys (such as a fake README.txt file containing false project information) and high-interaction decoys (such as a simulated administrator login page that records attacker input) around areas frequently accessed by users or potential attackers (such as the web server root directory and API interface paths). Periodically (e.g., every 24 hours), randomly adjust the location of some high-value decoy assets (e.g., move the financial database backup from / data / backup to / archive / old_data) to prevent attackers from understanding the fixed distribution pattern of honeynet assets through long-term observation. If N_RS shows that attackers often scan port 80 (web service) of the honeynet first and then attempt to access the HTTPS interface on port 443, the honeynet topology can be optimized to make the connection path between the web server and the SSL termination node closer to the real architecture, and a fake SSL certificate management panel (high-interaction decoy) can be deployed near port 443.

[0104] S40: Repeat steps S10 to S30 until a preset termination condition is met; the termination condition includes, but is not limited to: the attack behavior is completely isolated, the honeynet interaction collects complete attack chain information, or the core network services are no longer attacked.

[0105] The complete process chain from S10 to S30 is repeated in a fixed or dynamically adjusted time window (such as every 5 minutes, every hour, or adaptively adjusted according to changes in network traffic) to form a continuous closed loop of "detection-analysis-optimization".

[0106] Each iteration is based on the optimization results of the previous cycle: the honeynet configuration updated in S30 directly affects the detection accuracy of the next cycle S10 (e.g., more realistic decoy assets can induce attackers to expose more features), while the attack data isolated in S20 provides key input for the strategy adjustment in S30 (e.g., the common paths of isolated attacks can guide the focus of decoy deployment).

[0107] The iterative process does not continue indefinitely, but rather determines the termination time through a combination of multiple conditions, ensuring efficient convergence of the system after the defense objective is met. The preset termination conditions fall into three typical scenarios, and the system triggers termination through real-time monitoring and logical judgment:

[0108] If, within multiple consecutive cycles (e.g., N ≥ 3 iterations), no sessions exceeding the preset threshold (Threshold_T) are detected in the detection statistics calculated by S10 (i.e., no new attack sessions are filtered out by S20), or all detected attack sessions are successfully isolated by S20 and no residual attack behavior is found in subsequent monitoring (e.g., no abnormal connections are verified through traffic mirroring). If an attack (e.g., a DDoS probe or SQL injection attack) is detected and isolated in the initial cycle, and similar attack characteristics (e.g., high-frequency malicious sessions, malformed payloads) completely disappear in subsequent cycles, and the honeynet nodes do not capture any new attack traffic, then the attack behavior is considered to have been completely suppressed.

[0109] By analyzing the attack sessions isolated by S20 and the interaction data captured by the honeynet after S30 optimization, if the entire attack chain sequence (including attack methods, tool usage, and key path access order) from the initial intrusion attempt (such as port scanning) to the final goal achievement (such as data theft or privilege escalation) is successfully reconstructed, and the attack chain covers the main attack scenarios in the current network environment (such as covering high-risk vulnerability exploitation in OWASP Top 10), the system constructs a timeline graph of the attack event (such as scanning → vulnerability detection → credential theft → lateral movement) by correlating and analyzing the timestamps, session paths, payload content, and response logs of the honeynet nodes. When the graph contains all key nodes without significant omissions, the attack chain information is considered complete. For web application attacks, if the honeynet captures the entire process of the attacker scanning open ports (80 / 443) → detecting CMS vulnerabilities (such as WordPress plugin vulnerabilities) → using vulnerabilities to upload a WebShell → executing system commands through the WebShell → attempting to access the database credential file, then the complete attack chain condition is met.

[0110] Based on real-time assessments of business continuity monitoring metrics (such as the availability of core services, the integrity of critical data, and the success rate of user authentication), if no attacks affecting core business (such as destructive operations against database servers or fraudulent user sessions) are detected within a continuous period (e.g., M≥24 hours), and the performance metrics of the business system (such as response latency and error rate) recover to baseline levels, the monitoring dimensions include: availability of core services (such as payment systems and identity authentication services) ≥99.9%; zero tampering / leakage events of critical data (such as user privacy information and transaction records); and an abnormal rejection rate of user login / transaction sessions ≤0.1%. If an e-commerce platform's core payment interface was attacked, leading to an increase in transaction failure rates, but after iterative optimization, the payment success rate recovered to 99.95% within 24 consecutive hours and no new payment fraud sessions occurred, then the core business attack is considered resolved.

[0111] When any preset termination condition is met, the system will terminate the iteration loop from S10 to S30 and enter the attack intelligence output stage (S50). At this time, the honeynet environment has reached the following state:

[0112] Through continuous isolation and guidance, malicious behavior in the network is significantly suppressed (attack behavior is completely isolated) or fully controlled (attack chain information is complete). The virtual service configuration, interaction strategy, and topology of the honeynet have undergone multiple rounds of optimization, highly matching the current network environment and attacker behavior patterns, and possessing the ability to continuously defend against new types of attacks. The operational stability and security of core services have been verified, and the risk exposure of users and critical data has been reduced to an acceptable level. The termination mechanism ensures the efficient utilization of system resources (such as computing overhead and network bandwidth), while providing the final input benchmark (such as a complete attack behavior dataset and an optimized honeynet configuration snapshot) for attack intelligence generation and defense strategy optimization in the S50 phase.

[0113] S50: After the preset termination condition is met, output the isolated multi-layered attack behavior information and form attack intelligence data; the data is used to support subsequent defense strategy optimization and security situation awareness.

[0114] This stage, as the final step in the multi-layered honeynet architecture attack isolation method, is initiated after the pre-set termination conditions in S40 are met (the attack behavior is completely isolated, the honeynet interaction collects complete attack chain information, or the core network services are no longer under attack). Its core objective is to deeply process and analyze the isolated attack behavior data, outputting high-value attack intelligence to provide solid support for the optimization of subsequent network security defense strategies and accurate security posture awareness. The specific processing flow is as follows:

[0115] After the preset termination conditions are met, the system first comprehensively integrates the attack sessions marked and isolated in S20 and the relevant interaction data collected during the honeynet optimization process in S30. This data comes from a wide range of sources, covering multiple layers from the network layer to the application layer, including information on attacker access sessions, response information, interaction time sequences, attack methods and tools used, and more.

[0116] To facilitate subsequent analysis, the system structures this raw data. Based on the characteristics and attributes of the attack behavior, it categorizes it into different levels and types. For example, based on network layer, it classifies attacks into network layer attacks (such as DDoS attacks and port scanning), transport layer attacks (such as TCP connection hijacking), and application layer attacks (such as SQL injection and cross-site scripting attacks). Based on attack stages, it categorizes them into information gathering stage, intrusion attempt stage, privilege escalation stage, and data theft stage. This structured integration clearly presents the full picture and internal logical relationships of the attack behavior, laying the foundation for further in-depth analysis.

[0117] Based on the integrated multi-layered attack behavior information, the system uses a series of specialized processing logics to generate attack intelligence data. The process mainly includes the following key steps:

[0118] Deeply analyze structured attack data to extract key characteristics of attack behavior, such as the source IP address, target port, attack protocol, and attack payload. Analyze and compare these characteristics using machine learning and pattern recognition algorithms to identify common attack patterns and techniques. For example, by analyzing large amounts of SQL injection attack data, identify common injection statement patterns and parameter construction methods; by analyzing DDoS attack data, identify the characteristics of attack traffic and the distribution patterns of attack sources.

[0119] Correlation analysis is performed on extracted attack features and identified attack patterns to identify relationships between different attack behaviors and potential attack organizations or attackers. By analyzing factors such as the correlation of attack source IP addresses, the similarity of attack methods, and the continuity of attack time, an attack correlation graph is constructed to trace the source and propagation path of the attack. For example, by analyzing the source IP addresses and attack methods of multiple attack sessions, it can be found that they may originate from the same attack organization or use the same attack tools, thereby determining the correlation of the attacks and potential attackers.

[0120] Based on the results of attack feature extraction, pattern recognition, and correlation analysis, the system constructs an attack intelligence data model, transforming attack behavior information into standardized attack intelligence data. The model includes information across multiple dimensions, such as attack type, attack source, attack target, attack time, attack method, and attack impact, and is represented using a unified format and standard to facilitate sharing and use across different systems and platforms.

[0121] The generated attack intelligence data has significant application value, primarily used to support subsequent defense strategy optimization and security situation awareness, specifically in the following aspects:

[0122] (1) By analyzing attack intelligence data, security teams can gain a deeper understanding of attackers' behavioral patterns and attack methods, and promptly identify vulnerabilities and shortcomings in existing defense strategies. Based on the information provided by the attack intelligence data, security teams can adjust and optimize defense strategies in a targeted manner, such as strengthening the protection of specific ports and protocols, updating the rules of intrusion detection and prevention systems, and deploying new security protection equipment and technologies. For example, if attack intelligence data shows that attackers frequently exploit vulnerabilities in a specific version of software, the security team can promptly upgrade or patch the software to prevent similar attacks from occurring.

[0123] (2) Attack intelligence data provides security teams with a comprehensive view of network security posture, helping them understand the security status and potential attack risks in the network in real time. Through real-time monitoring and analysis of attack intelligence data, security teams can promptly detect abnormal attack behaviors and potential security attacks, and take corresponding preventive measures in advance to ensure the safe and stable operation of the network. For example, if attack intelligence data shows a sudden increase in attack activity in a certain area, the security team can strengthen network traffic monitoring and protection in that area to improve network security.

[0124] (3) In the event of a security incident, attack intelligence data can provide important reference for emergency response and handling. Security teams can use attack intelligence data to understand the attacker's attack methods and targets, quickly locate the attack source and affected systems, and take effective emergency response measures, such as isolating the attacked system, restoring data and system functions, and holding the attacker accountable. For example, if attack intelligence data shows that the attacker used a specific type of malware to launch the attack, the security team can quickly identify the characteristics and behavior of the malware, take corresponding detection and removal measures, and prevent the further spread and damage of the malware.

[0125] In the description of this specification, references to terms such as "an embodiment," "example," "specific example," etc., indicate that a specific feature, structure, material, or characteristic described in connection with the embodiment or example is included in at least one embodiment or example of the invention. In this specification, illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples.

[0126] The preferred embodiments of the present invention disclosed above are merely illustrative of the invention. These preferred embodiments do not exhaustively describe all details, nor do they limit the invention to specific implementations. Clearly, many modifications and variations can be made based on the content of this specification. This specification selects and specifically describes these embodiments to better explain the principles and practical applications of the invention, thereby enabling those skilled in the art to better understand and utilize the invention. The invention is limited only by the claims and their full scope and equivalents.

Claims

1. An attack isolation method for a multi-layered honeycomb architecture, characterized in that: The method includes: S10: Collect access sessions from users or attackers in the target network and their corresponding traffic characteristics. Combine this with the virtual asset profiles of multi-layered honeycomb nodes to obtain residual vector information of attack interactions. Calculate detection statistics based on the residual vector information, including: When a collected access session reaches a honeycomb node, its traffic characteristics are compared with the corresponding node's virtual asset profile. The difference between the two is calculated, and an attack interaction residual vector is generated. Based on the generated attack interaction residual vector, detection statistics are calculated to quantitatively assess the degree of abnormality of access behavior; S20: If the detection statistic is greater than or equal to the preset detection threshold, incremental processing is performed on the first number of suspicious attack sessions to obtain the second number of attack sessions. Maximum likelihood estimation is then performed on the third number of normal interaction sessions and the second number of attack sessions to determine the session category corresponding to the highest probability result. The attack sessions corresponding to the highest probability result are then marked and isolated to obtain the fourth number of remaining interaction sessions, including: When the detection statistics are greater than or equal to the preset detection threshold, the access session is marked as a suspicious attack session and enters the incremental analysis process. By supplementing multi-dimensional features and dynamically tracking behavior, false alarms are gradually eliminated, and malicious sessions are filtered out. Obtain a first set of suspicious sessions, and then, through incremental processing, filter out a second set of attack sessions. A maximum likelihood estimation method is introduced. By comparing a third number of normal interaction sessions with a second number of attack sessions, the probability of each session belonging to the attack or normal category is calculated. The category corresponding to the highest probability is selected as the final judgment result, and a sample set is constructed. Simultaneously, a corresponding discriminant model is created based on the sample set. The discrimination model identifies sessions not identified as attacks and attack sessions with a first confidence level as the fourth number of remaining interactive sessions. S30: Based on the fourth number of remaining interactive sessions, dynamically adjust the virtual service configuration and interaction strategy of the multi-layered honeycomb nodes, update the virtual topology and decoy asset distribution, and continuously guide attack behavior into the honeycomb environment, including: Analyze the remaining interactive sessions in the fourth set to extract behavioral features and interaction patterns. Based on the extracted behavioral features, unsupervised clustering is performed on the remaining interaction sessions in the fourth set to identify different user behavior groups. Within each cluster, analyze whether there is any anomalous behavior. If so, compare the anomalous behavior with the virtual service configuration of the current honeynet node. Based on the comparison results, the virtual service configuration and interaction strategy of the multi-layer honeycomb nodes will be dynamically optimized; S40: Repeat steps S10 to S30 until the preset termination condition is met; S50: After the preset termination condition is met, output the isolated multi-level attack behavior information and form attack intelligence data.

2. The attack isolation method for a multi-layered honeycomb architecture according to claim 1, characterized in that: The calculation process of the maximum likelihood estimation method is as follows: Common features of normal interactive sessions are extracted to form a multi-dimensional feature vector. Based on the feature distribution of the normal interactive sessions, a likelihood function for the normal category is constructed. The value range and probability density of the normal interactive session in each feature dimension are calculated using the multi-dimensional feature vector. A likelihood function for the attack category is constructed based on the attack session. For each session to be judged, the normal probability of it belonging to the normal category and the attack probability of it belonging to the attack category are calculated. The probability values ​​of the session belonging to the normal category and the attack category are compared. If the attack probability is greater than the normal probability, it is finally judged as an attack session; if the attack probability is less than or equal to the normal probability, it is judged as a normal interactive session.

3. The attack isolation method for the multi-layered honeycomb architecture according to claim 1, characterized in that: The steps for constructing the sample set include: Attack session samples: Attack sessions with second-level confidence that have been filtered through incremental processing; Normal interactive session samples: randomly selected from normal sessions that were not labeled within the same time period.

4. The attack isolation method for a multi-layered honeycomb architecture according to claim 1, characterized in that: The step of obtaining a first set of suspicious sessions and filtering out a second set of attack sessions through incremental processing includes: Observe the interaction pattern of the session within a preset time window and check whether the session is related to other known attack IPs, malicious domains, or attack methods. If a session interacts with decoy assets in the honeynet, its attack intent confidence increases. After verification, sessions with a detection statistic ≥ the second preset detection threshold are set as the second number of attack sessions.

5. The attack isolation method for a multi-layered honeycomb architecture according to claim 1, characterized in that: The adjustment process for the virtual service configuration is as follows: based on the service access requirements in the fourth number of remaining interactive sessions that are not covered by the current honeynet, add corresponding virtual service nodes and adjust the data returned by the Web management interface; The adjustment process of the interaction strategy is as follows: adjust the response strategy of the honeynet node according to different user roles. If the remaining interaction sessions in the fourth quantity show that the user accesses the order management system on a weekday, the honeynet will increase the activity of the order management system interface during this period and automatically deploy a fake historical order archive compressed package near the interface path.

6. The attack isolation method for a multi-layered honeycomb architecture according to claim 1, characterized in that: The termination conditions include: the attack behavior is isolated, the attack chain information is collected through honeynet interaction, or the network service is no longer under attack.

7. A multi-layered honeycomb architecture attack isolation system, used to implement the attack isolation method according to any one of claims 1-6, characterized in that: It includes a statistics calculation module, a session processing module, a dynamic adjustment module, and an output module; The statistics calculation module is used to collect access sessions from users or attackers in the target network and their corresponding traffic characteristics. Combined with the virtual asset profiles of multi-layered honeycomb nodes, it obtains residual vector information of attack interactions. Based on this residual vector information, it calculates detection statistics, including: When a collected access session reaches a honeycomb node, its traffic characteristics are compared with the corresponding node's virtual asset profile. The difference between the two is calculated, and an attack interaction residual vector is generated. Based on the generated attack interaction residual vector, detection statistics are calculated to quantitatively assess the degree of abnormality of access behavior; The session processing module is used to perform incremental processing on a first number of suspicious attack sessions if the detection statistic is greater than or equal to a preset detection threshold, to obtain a second number of attack sessions. Based on a third number of normal interaction sessions and the second number of attack sessions, maximum likelihood estimation is performed to determine the session category corresponding to the highest probability result. The attack sessions corresponding to the highest probability result are then marked and isolated to obtain a fourth number of remaining interaction sessions, including: When the detection statistics are greater than or equal to the preset detection threshold, the access session is marked as a suspicious attack session and enters the incremental analysis process. By supplementing multi-dimensional features and dynamically tracking behavior, false alarms are gradually eliminated, and malicious sessions are filtered out. Obtain a first set of suspicious sessions, and then, through incremental processing, filter out a second set of attack sessions. A maximum likelihood estimation method is introduced. By comparing a third number of normal interaction sessions with a second number of attack sessions, the probability of each session belonging to the attack or normal category is calculated. The category corresponding to the highest probability is selected as the final judgment result, and a sample set is constructed. Simultaneously, a corresponding discriminant model is created based on the sample set. The discrimination model identifies sessions not identified as attacks and attack sessions with a first confidence level as the fourth number of remaining interactive sessions. The dynamic adjustment module is used to dynamically adjust the virtual service configuration and interaction strategy of multi-layer honeycomb nodes based on the fourth number of remaining interactive sessions, update the virtual topology and decoy asset distribution, and continuously guide attack behavior into the honeycomb environment, including: Analyze the remaining interactive sessions in the fourth set to extract behavioral features and interaction patterns. Based on the extracted behavioral features, unsupervised clustering is performed on the remaining interaction sessions in the fourth set to identify different user behavior groups. Within each cluster, analyze whether there is any anomalous behavior. If so, compare the anomalous behavior with the virtual service configuration of the current honeynet node. Based on the comparison results, the virtual service configuration and interaction strategy of the multi-layer honeycomb nodes will be dynamically optimized; The output module is used to repeatedly execute the steps of the statistics calculation module, the session processing module, and the dynamic adjustment module until the preset termination condition is met; after the preset termination condition is met, the isolated multi-level attack behavior information is output and attack intelligence data is formed.

Images