Mimicry honeypot adaptive defense generation method based on Minimax-Q algorithm game

Abstract

The invention belongs to the technical field of network space security and reinforcement learning, and discloses a mimicry honeypot adaptive defense generation method based on a Minimax-Q algorithm game, and the method comprises the steps: building a mimicry honeypot attack and defense game model, and carrying out the initialization of an attacker, a mimicry honeypot and a network state; solving Bayesian Nash equilibrium of the game model, and selecting a heterogeneous executive group with the highest income evaluation in the current network state as a standby executive group according to an equilibrium result; and judging the output of the service executive through a multi-level judgment mechanism, triggering the scheduling of the standby executive group when the judgment of the virtualization layer is abnormal, and selecting and replacing the abnormal executive from the standby executive group according to the evaluation of the security defense value. According to the method, a defense strategy with high fraudulence and high security can be adaptively generated under an incomplete information condition, the trapping capability and the ontology security of the honeypot are effectively improved, and the method is suitable for a complex and changeable network confrontation environment.

Description

Technical Field

[0001] This application belongs to the field of cyberspace security and reinforcement learning technology, specifically relating to a mimicry honeypot adaptive defense generation method based on Minimax-Q algorithm game theory. Background Technology

[0002] With the continuous evolution of cyberattack techniques, sophisticated attack methods such as Advanced Persistent Threats (APTs) and zero-day exploits are emerging in large numbers, posing a severe challenge to cybersecurity defense systems. Traditional passive defense technologies (such as firewalls, antivirus software, and intrusion detection technologies) are difficult to effectively deal with unknown threats and targeted attacks due to their retrospective and static nature. Against this backdrop, active defense technologies, represented by honeypots, have emerged. They attract and deceive attackers by deploying disguised resources, and capture attack behaviors and intentions during the interaction process, providing an effective means for threat intelligence gathering and attack attribution.

[0003] However, traditional honeypot technology faces two major problems in practical deployment: first, insufficient deception. Attackers often use anti-honeypot techniques such as fingerprinting and behavioral analysis to easily expose the disguise, rendering the deception ineffective; second, weak core security. Once a honeypot is compromised, attackers may use it as a springboard to penetrate the internal network, causing secondary damage. To improve the concealment and security of honeypots, researchers have proposed improved schemes such as dynamic honeypots and layered honeypots, and enhanced their flexibility and scalability through virtualization technology. Although these methods have improved the deception ability of honeypots to some extent, they still fail to effectively guarantee the security of the honeypot itself and are difficult to resist advanced attacks such as virtualization escape.

[0004] In recent years, the introduction of the concept of Mimic Defense has provided a new approach to improving the intrinsic security of systems. It effectively increases the uncertainty and robustness of the system by constructing a dynamic, heterogeneous, and redundant pool of execution entities and combining multi-modal adjudication and dynamic scheduling mechanisms. On the other hand, game theory and reinforcement learning are widely used in network attack and defense modeling to solve for the Nash equilibrium of defense strategies, thereby achieving adaptive decision-making. Existing research, such as honeypot allocation methods based on Stackelberg games and dynamic honeypot strategy optimization based on Q-learning, while improving the adaptability of defense, mostly relies on simplified attacker models or the assumption of complete information, making it difficult to characterize complex adversarial scenarios in real networks where information asymmetry and attacker types are unknown. Furthermore, existing methods often focus on improving the success rate of decoys, failing to deeply integrate the dynamic scheduling of the mimic architecture with the ontological security protection of the honeypot.

[0005] Therefore, there is an urgent need for a honeypot defense generation method that can balance high deception capability with high ontological security and adapt to dynamic attack and defense game under incomplete information, in order to cope with increasingly complex and ever-changing network threats. Summary of the Invention

[0006] To address the shortcomings of traditional honeypots, such as insufficient deception and weak ontological security, and the inability of existing dynamic defense strategies to adapt to incomplete information game scenarios, this application provides a mimicry honeypot adaptive defense generation method based on the Minimax-Q algorithm game. This method specifically includes the following steps:

[0007] Step 1: Construct a mimicry honeypot attack and defense game model G. Initialize the current attacker, mimicry honeypot, and network state. Define the mimicry honeypot attack and defense game model G as an octet G = {N, S, A, H, π, U, Φ, P}. A}, where N is the set of attackers and mimic honeypots, S is the set of game states, A is the set of attacker actions, H is the set of mimic honeypot actions, π is the set of strategies of attackers and mimic honeypots, U is the payoff function, Φ is the attacker type, and P A The prior probability of the mimicry honeypot for the attacker type distribution;

[0008] Step 2: Using the Minimax-Q multi-agent reinforcement learning algorithm, solve the Bayesian Nash equilibrium of the mimicry honeypot attack and defense game model G. Based on the equilibrium result, select the heterogeneous executor group with the highest benefit evaluation under the current network in the mimicry honeypot system to form the backup executor group.

[0009] Step 3: The output of the business execution entity placed in the mimicry honeypot is adjudicated through a multi-level adjudication mechanism. When the virtualization layer adjudication result of the business execution entity is abnormal, the backup execution entity group scheduling is triggered. Based on the security defense value evaluation result, a new business execution entity is selected from the backup execution entity group to replace an abnormal execution entity in the mimicry honeypot system.

[0010] A further improvement in this application is that, in step 1, in the mimicry honeypot attack and defense game model G,

[0011] N = {attacker, honeypot} is the set of attackers and mimic honeypots, where attacker represents attacker and honeypot represents mimic honeypot;

[0012] S = {s1, s2, ... s} n} represents the set of game states consisting of all attack and defense states, and each game state represents a network state;

[0013] A = {A1, A2, ..., A} n Let} be the set of attacker actions, where A k={a1,a2,…,a m} is the attacker in state s k A set of actions;

[0014] H = {H1,H2,…H} n} represents the set of actions for mimicking honeypots, where H k ={h1,h2,…,h m} is a mimicry honeypot in state s k The set of actions, specifically the selection of which execution groups constitute the mimicry honeypot;

[0015] This is a set of strategies for attackers and mimicry honeypots, where Represented as type The attacker in state s k The following strategy Choose a for the attacker m The probability of π; h (s k )=(σ h (s k ,h1),…,σ h (s k ,h m )) indicates that the mimicry honeypot is in state s k The strategy under σx(s) k ,h m Select a defensive action (i.e., execute the action group h) for the mimicry honeypot. m The probability of;

[0016] U = {Q, V} is the payoff function, where Q = (Q a Q h Let V be the state-action-reward function for both the attacker and the mimicry honeypot, where V = (V a V h ) is the state-value reward function for both the attacker and the mimicry honeypot;

[0017] Attacker type;

[0018] This represents the prior probability of the mimicry honeypot for the attacker type distribution.

[0019] A further improvement in this application is that, in step 2, the Minimax-Q algorithm is used to solve for the Bayesian Nash equilibrium, specifically including the following steps:

[0020] Step 2.1: Initialize the state-action reward function Q (h) State value revenue function V (h) and network status;

[0021] Step 2.2: The mimicry honeypot selects a defense action h based on the current network state s. m (i.e., select the execution body group), and obtain the attacker's state s based on the execution body state in the mimicry honeypot. i The attack strategy adopted and the benefit assessment of obtaining the mimicry honeypot. and the new network state after the transfer i ′ ;

[0022] Step 2.3, in the new network state s i ′ Next, calculate the current state-action reward function Q. (h) State value revenue function V (h) And explore with probability ε, 0≤ε≤1, randomly select the next action, and exploit the attacker in state s with probability 1-ε. i The attack strategy adopted is to select the action with the highest current Q value;

[0023] Step 2.4: Repeat step 2.3 until the Minimax-Q multi-agent reinforcement learning algorithm converges or reaches the set number of iterations, output the optimal executor group of the mimicry honeypot, and form a backup executor group.

[0024] A further improvement in this application is that, in step 2.2, a benefit assessment is calculated. The deception value (DA), security defense value (SDA), and computational resource overhead are jointly determined, and the specific steps include the following:

[0025] Step 2.2.1: The deception value DA is used to quantify the ability of the mimicry honeypot to attract and deceive attackers. It is jointly determined by the similarity (B) of the mimicry honeypot's business layer and the sweetness, and the calculation formula is as follows:

[0026] DA = Similarity(B) * Sweetness

[0027] in:

[0028] The business layer similarity (B) is calculated by comparing the Jaccard similarity between the business layer vulnerability vector and the real system vulnerability vector. It is used to measure the similarity between the honeypot and the real system. The calculation formula is as follows:

[0029]

[0030] in, This represents the set of business layer vulnerability vectors for a mimicry honeypot. A set of vulnerability vectors representing a real system. Representing vectors The value of each component equals the number of components with a value of 2. Representing vectors The number of components whose values ​​are greater than 0;

[0031] The Sweetness score is calculated by statistically analyzing the Common Vulnerability Scoring System (CVSS) scores of the business layer vulnerabilities exposed by the mimicry honeypot and the frequency with which they are exploited by attackers. It reflects the attractiveness of the honeypot to attackers, and the calculation formula is as follows:

[0032]

[0033] Wherein, CVSS indicates the degree of harm caused by an attacker exploiting the vulnerability, f ij f represents the frequency of vulnerability exploitation. ij =A ij / A t A ij A represents the number of attacks captured by the mimicry honeypot within a time period. t v represents the total number of attacks suffered within the time period, v represents the total number of vulnerabilities contained in the business implementation method, and n represents the number of business implementation methods in a single honeypot.

[0034] Step 2.2.2: The Security Defense Value (SDA) is used to quantify the security protection capability of the mimicry honeypot entity. It is jointly determined by the virtualization layer similarity (V) and the virtualization layer confidence, and the calculation formula is as follows:

[0035] SDA=(1-Similarity(V))*Confidence

[0036] Wherein: the virtualization layer similarity (V) is calculated by comparing the feature vectors of different virtualization technology platforms;

[0037] The virtualization layer confidence level is dynamically updated based on historical adjudication results, reflecting the operational reliability of the virtualization technology. When the confidence level falls below a set threshold, a scheduling replacement mechanism is triggered. The calculation formula is as follows:

[0038]

[0039] Among them, y n Y(t) represents the local decision result of virtualization technology n at time t, and Y(t) represents the global decision result output by the large number arbiter of the virtualization layer at time t. Let ζ be the denoting constant. n (T) represents the number of times virtualization technology n has been selected into the mimicry honeypot system up to time T;

[0040] Step 2.2.3: The computational resource overhead is used to quantify the system resource consumption required for the operation of the mimicry honeypot. It is composed of CPU utilization and memory utilization, and the calculation formula is as follows:

[0041] Overhead k =CPU k +Memory k

[0042] Among them, CPU k This represents the CPU overhead and memory usage required by the execution group k currently deployed in the mimicry honeypot. k This represents the memory overhead required for execution group k currently deployed in the mimicry honeypot;

[0043] Step 2.2.4: Combine the results of steps 2.2.1-2.2.3 using a product approach to calculate the benefit assessment R. h :

[0044]

[0045] A further improvement in this application is that, in step 2.3, the current state-action reward function Q is calculated. (h) State value revenue function V (h) And it is explored with probability ε, specifically including the following steps:

[0046] Step 2.3.1: Update the state value reward function V (h) :

[0047]

[0048] Where -i represents the attacker, Let Q be the state-action reward function, and in multi-agent reinforcement learning, Q is... h (s i (The value is unknown.) The time difference method from the Q-Learning algorithm is introduced to approximate the equilibrium point and update the state-action reward function Q. h The calculation formula is as follows:

[0049]

[0050] Where α is the learning rate, 0 < α ≤ 1, and γ is the discount factor. It is a benefit assessment;

[0051] Step 2.3.2: Explore with probability ε and randomly select the next defensive action h. m With probability 1-ε, the attacker exploits the situation in state s. i The attack strategy adopted is to select the action with the highest current Q value.

[0052] A further improvement to this application is that step 3 specifically includes the following steps:

[0053] Step 3.1: Perform virtualization layer majority judgment. Compare the virtualization layer output results of all business execution entities in the mimicry honeypot. When the virtualization layer output of an individual business execution entity is inconsistent with the majority of other business execution entities, it is determined that the business execution entity is under virtualization escape attack and the business execution entity is marked as an abnormal execution entity.

[0054] Step 3.2: Perform a minority decision at the business layer. Decision on the business layer output of the business execution entity that has passed the decision at the virtualization layer. Select the output results that show abnormality or have vulnerability characteristics as the final response to be fed back to the attacker in order to maintain the deceptiveness of the honeypot and attract the attacker to conduct in-depth interaction.

[0055] Step 3.3: When the virtualization layer's large number of decisions detects an abnormal executor, it immediately triggers the scheduling of the backup executor group; the backup executor group scheduling selects candidate executor groups containing all normal executors from the backup executor pool based on the composition of the current normal executors;

[0056] Step 3.4: Update the Security Defense Value (SDA) and the Virtualization Layer Trustworthiness (Confidence):

[0057] SDA=(1-Similarity(V))*Confidence

[0058]

[0059] The beneficial effects of this application are:

[0060] (1) This application constructs a heterogeneous and redundant execution pool and forms a dynamic set of defense actions, providing a rich selection of disguises and switching space for the mimicry honeypot, fundamentally improving the deceptiveness and concealment of the honeypot, and effectively resisting the attacker's detection behavior.

[0061] (2) This application innovatively combines the incomplete information game model with the Minimax-Q reinforcement learning algorithm, which can adaptively approximate the Bayesian Nash equilibrium strategy through online learning without knowing the type of attacker, thus helping to improve the intelligent decision-making ability in complex adversarial environments.

[0062] (3) This application designs a benefit function that integrates multi-dimensional indicators, namely deception value, security defense value and computational resource consumption, and introduces a dynamic scheduling mechanism based on multi-level adjudication. It can efficiently capture attacks while simultaneously sensing and blocking penetration attempts against the honeypot itself, thus achieving synergistic optimization of capture capability and its own security strength. Attached Figure Description

[0063] Figure 1 This is a schematic diagram of the generation method of this application.

[0064] Figure 2 This is a diagram of the adaptive defense decision architecture for the mimicry honeypot in this application.

[0065] Figure 3 This is a flowchart illustrating the scheduling and execution process of the backup execution unit group in this application.

[0066] Figure 4 This is a comparison chart of the defensive benefits of the method in this application and existing technology methods. Detailed Implementation

[0067] The technical solution of the present invention will be further described in detail below with reference to the accompanying drawings.

[0068] This application provides a method for adaptive defense generation of mimicry honeypots based on the Minimax-Q algorithm game theory. This method constructs a heterogeneous and redundant execution pool and forms a dynamic set of defense actions, providing mimicry honeypots with rich camouflage options and switching space, fundamentally improving the deceptiveness and stealth of honeypots. At the same time, combined with the Minimax-Q algorithm, it can adaptively generate the optimal defense strategy when the attacker type is uncertain, realizing the synergistic optimization of trapping capability and its own security strength.

[0069] like Figure 1 As shown, the adaptive defense generation method for mimicry honeypots in this application specifically includes the following steps:

[0070] Step 1: Construct a mimicry honeypot attack and defense game model G. Initialize the current attacker, mimicry honeypot, and network state. The mimicry honeypot system provides multiple heterogeneous service execution entities, each consisting of a virtualization layer and a service layer. Arrange and combine all service execution entities to form multiple candidate execution entity groups. For example... Figure 2 As shown, each of the aforementioned business execution entities consists of a business layer and a virtualization layer, with the following specific contents: The business layer is used to simulate real network services and applications, including but not limited to operating systems, web servers, applications, databases, and scripting languages; this layer actively exposes controllable security vulnerabilities to attract and lure attackers to interact and capture their attack behavior; the virtualization layer provides the business layer with a runtime isolation and encapsulation environment, which is implemented based on different virtualization technologies, including but not limited to KVM, VMware, and VirtualBox; this layer aims to shield attacks against the host machine and the mimicry honeypot itself, ensuring that attack activities are controlled within the virtual environment and preventing risks such as virtualization escape.

[0071] The business execution entity of this application adopts a heterogeneous design. The diversity of the business layer and virtualization layer enhances the unpredictability of the system and improves the defense effect.

[0072] The mimicry honeypot attack and defense game model G is defined as an octet G = {N,S,A,H,π,U,Φ,P}. A}, where N is the set of attackers and mimic honeypots, N = {attacker, honeypot}, where attacker represents the attacker and honeypot represents the mimic honeypot; S is the set of game states, S = {s1, s2, ... s n Let {} be the set of game states consisting of all attack and defense states, where each game state represents a network state; A is the set of attacker actions, A = {A1, A2, ..., A}. n Let} be the set of attacker actions, where A k ={a1,a2,…,a m} is the attacker in state s k The set of actions; H is the set of actions for the mimicry honeypot, H = {H1, H2, ... H} n} represents the set of actions for mimicking honeypots, where H k ={h1,h2,…,h m} is a mimicry honeypot in state s k The set of actions, specifically the selection of which execution groups constitute the mimicry honeypot; π represents the set of strategies for both the attacker and the mimicry honeypot. This is a set of strategies for attackers and mimicry honeypots, where Represented as type The attacker in state s k The following strategy Choose a for the attacker m The probability of π; h (s k )=(σ h (s k ,h1),…,σ h (s k ,h m )) indicates that the mimicry honeypot is in state s k The following strategy, σ h (s k ,h m Select a defensive action (i.e., execute the action group h) for the mimicry honeypot. m The probability; U is the payoff function, U={Q,V} is the payoff function, where Q=(Q a Q h Let V be the state-action-reward function for both the attacker and the mimicry honeypot, where V = (V a V h) represents the state-value reward function for both the attacker and the mimicry honeypot; Φ represents the attacker type. Attacker type; P A Let be the prior probability of the mimicry honeypot for the attacker type distribution. This application defines the prior probability of the mimicry honeypot against the attacker type distribution. By defining a complete game theory model, it provides a theoretical foundation for the Minimax-Q algorithm, making the solution of defense strategies more scientific and effective.

[0073] Step 2: Using the Minimax-Q multi-agent reinforcement learning algorithm, solve the Bayesian Nash equilibrium of the mimicry honeypot attack and defense game model G. Based on the equilibrium result, select the heterogeneous executor group with the highest benefit evaluation under the current network in the mimicry honeypot system to form the backup executor group.

[0074] In this step, the Minimax-Q algorithm is used to solve for the Bayesian Nash equilibrium, which specifically includes the following steps:

[0075] Step 2.1: Initialize the state-action reward function Q (h) State value revenue function V (h) and network status;

[0076] Step 2.2: The mimicry honeypot selects a defense action h based on the current network state s. m (i.e., select the execution body group), and obtain the attacker's state s based on the execution body state in the mimicry honeypot. i The attack strategy adopted and the benefit assessment of obtaining the mimicry honeypot. and the new network state after the transfer i ′ .

[0077] Calculate the benefit assessment The deception value (DA), security defense value (SDA), and computational resource overhead are jointly determined, and the specific steps include the following:

[0078] Step 2.2.1: The deception value DA is used to quantify the ability of the mimicry honeypot to attract and deceive attackers. It is jointly determined by the similarity (B) of the mimicry honeypot's business layer and the sweetness, and the calculation formula is as follows:

[0079] DA = Similarity(B) * Sweetness

[0080] in:

[0081] The business layer similarity (B) is calculated by comparing the Jaccard similarity between the business layer vulnerability vector and the real system vulnerability vector. It is used to measure the similarity between the honeypot and the real system. The calculation formula is as follows:

[0082]

[0083] in, This represents the set of business layer vulnerability vectors for a mimicry honeypot. A set of vulnerability vectors representing a real system. Representing vectors The value of each component equals the number of components with a value of 2. Representing vectors The number of components whose values ​​are greater than 0;

[0084] The Sweetness score is calculated by statistically analyzing the Common Vulnerability Scoring System (CVSS) scores of the business layer vulnerabilities exposed by the mimicry honeypot and the frequency with which they are exploited by attackers. It reflects the attractiveness of the honeypot to attackers, and the calculation formula is as follows:

[0085]

[0086] Wherein, CVSS indicates the degree of harm caused by an attacker exploiting the vulnerability, f ij f represents the frequency of vulnerability exploitation. ij =A ij / A t A ij A represents the number of attacks captured by the mimicry honeypot within a time period. t v represents the total number of attacks suffered within the time period, v represents the total number of vulnerabilities contained in the business implementation method, and n represents the number of business implementation methods in a single honeypot.

[0087] Step 2.2.2: The Security Defense Value (SDA) is used to quantify the security protection capability of the mimicry honeypot entity. It is jointly determined by the virtualization layer similarity (V) and the virtualization layer confidence, and the calculation formula is as follows:

[0088] SDA=(1-Similarity(V))*Confidence

[0089] Wherein: the virtualization layer similarity Similarity(V) is calculated by comparing the feature vectors of different virtualization technology platforms. The calculation method of business layer Similarity(B) can be referred to. The smaller the value, the stronger the heterogeneity and the higher the security.

[0090] The virtualization layer confidence level is dynamically updated based on historical adjudication results, reflecting the operational reliability of the virtualization technology. When the confidence level falls below a set threshold, a scheduling replacement mechanism is triggered. The calculation formula is as follows:

[0091]

[0092] Among them, y n Y(t) represents the local decision result of virtualization technology n at time t, and Y(t) represents the global decision result output by the large number arbiter of the virtualization layer at time t. Let ζ be the denoting constant. n (T) represents the number of times virtualization technology n has been selected into the mimicry honeypot system up to time T;

[0093] Step 2.2.3: The computational resource overhead is used to quantify the system resource consumption required for the operation of the mimicry honeypot. It is composed of CPU utilization and memory utilization, and the calculation formula is as follows:

[0094] Overhead k =CPU k +Memory k

[0095] Among them, CPU k This represents the CPU overhead and memory usage required by the execution group k currently deployed in the mimicry honeypot. k This represents the memory overhead required for execution group k currently deployed in the mimicry honeypot;

[0096] Step 2.2.4: Combine the results of steps 2.2.1-2.2.3 using a product approach to calculate the benefit assessment R. h :

[0097]

[0098] Step 2.3, in the new network state s i ′ Next, calculate the current state-action reward function Q. (h) State value revenue function V (h) And explore with probability ε, 0≤ε≤1, randomly select the next action, and exploit the attacker in state s with probability 1-ε. i The attack strategy adopted is to select the action with the highest current Q-value. The reward function Q for the current state and action is calculated. (h) State value revenue function V (h) And it is explored with probability ε, specifically including the following steps:

[0099] Step 2.3.1: Update the state value reward function V (h) :

[0100]

[0101] Where -i represents the attacker, Let Q be the state-action reward function, if Q h (s i Given that ,·), we can directly use linear programming to solve for state s. i The Nash equilibrium point at time, but in multi-agent reinforcement learning, Q... h (s i (The value is unknown.) The time difference method from the Q-Learning algorithm is introduced to approximate the equilibrium point and update the state-action reward function Q. h The calculation formula is as follows:

[0102]

[0103] Where α is the learning rate, 0 < α ≤ 1, and γ is the discount factor. It is a benefit assessment;

[0104] Step 2.3.2: Explore with probability ε and randomly select the next defensive action h. m With probability 1-ε, the attacker exploits the situation in state s. i The attack strategy adopted is to select the action with the highest current Q value.

[0105] Step 2.4: Repeat step 2.3 until the Minimax-Q multi-agent reinforcement learning algorithm converges or reaches the set number of iterations, output the optimal executor group of the mimicry honeypot, and form a backup executor group.

[0106] Step 3: The output of the business execution entity placed in the mimicry honeypot is adjudicated through a multi-level adjudication mechanism. When the virtualization layer adjudication result of the business execution entity is abnormal, the backup execution entity group scheduling is triggered. Based on the security defense value evaluation result, a new business execution entity is selected from the backup execution entity group to replace an abnormal execution entity in the mimicry honeypot system.

[0107] like Figure 3 As shown, step 3 specifically includes the following steps:

[0108] Step 3.1: Perform virtualization layer majority judgment. Compare the virtualization layer output results of all business execution entities in the mimicry honeypot. When the virtualization layer output of an individual business execution entity is inconsistent with the majority of other business execution entities, it is determined that the business execution entity is under virtualization escape attack and the business execution entity is marked as an abnormal execution entity.

[0109] Step 3.2: Perform a minority decision at the business layer. Decision on the business layer output of the business execution entity that has passed the decision at the virtualization layer. Select the output results that show abnormality or have vulnerability characteristics as the final response to be fed back to the attacker in order to maintain the deceptiveness of the honeypot and attract the attacker to conduct in-depth interaction.

[0110] Step 3.3: When the virtualization layer's large number of decisions detects an abnormal executor, it immediately triggers the scheduling of the backup executor group; the backup executor group scheduling selects candidate executor groups containing all normal executors from the backup executor pool based on the composition of the current normal executors;

[0111] Step 3.4: Update the Security Defense Value (SDA) and the Virtualization Layer Trustworthiness (Confidence):

[0112] SDA=(1-Similarity(V))*Confidence

[0113]

[0114] This application's multi-level adjudication mechanism employs dual adjudication at the business layer and virtualization layer to monitor the honeypot's operational status in real time, detecting output anomalies and underlying attack behaviors. Upon detection of an anomaly, the backup execution group scheduler immediately switches to the optimal backup execution group based on the Security Defense Value (SDA) assessment results, enabling rapid isolation and recovery of the abnormal component and contributing to improved system reliability and adaptive defense capabilities.

[0115] like Figure 4 As shown, the defensive reward of this application remains at the highest level throughout the entire iteration process, basically stable around 1, which is significantly better than the existing method (Method 2). The existing method adopts a random game-based approach, which is robust in general, but it is limited by convergence speed and learning accuracy, which prevents its defensive reward from breaking through 0.78, significantly lower than that of this application.

[0116] The above description is only a preferred embodiment of the present invention. The scope of protection of the present invention is not limited to the above embodiments. Any equivalent modifications or changes made by those skilled in the art based on the content disclosed in the present invention should be included within the scope of protection set forth in the claims.

Claims

1. A method for generating adaptive defenses of mimicry honeypots based on Minimax-Q game theory, characterized in that: The mimicry honeypot adaptive defense generation method specifically includes the following steps: Step 1: Construct a mimicry honeypot attack and defense game model G. Initialize the current attacker, mimicry honeypot, and network state. Define the mimicry honeypot attack and defense game model G as an octet G = {N, S, A, H, π, U, Φ, P}. A }, where N is the set of attackers and mimic honeypots, S is the set of game states, A is the set of attacker actions, H is the set of mimic honeypot actions, π is the set of strategies of attackers and mimic honeypots, U is the payoff function, Φ is the attacker type, and P A The prior probability of the mimicry honeypot for the attacker type distribution; Step 2: Using the Minimax-Q multi-agent reinforcement learning algorithm, solve the Bayesian Nash equilibrium of the mimicry honeypot attack and defense game model G. Based on the equilibrium result, select the heterogeneous executor group with the highest benefit evaluation under the current network in the mimicry honeypot system to form the backup executor group. Step 3: The output of the business execution entity placed in the mimicry honeypot is adjudicated through a multi-level adjudication mechanism. When the virtualization layer adjudication result of the business execution entity is abnormal, the backup execution entity group scheduling is triggered. Based on the security defense value evaluation result, a new business execution entity is selected from the backup execution entity group to replace an abnormal execution entity in the mimicry honeypot system.

2. The method for generating adaptive defense of mimicry honeypots based on Minimax-Q game theory according to claim 1, characterized in that: In step 1, in the mimicry honeypot attack and defense game model G, N = {attacker, honeypot} is the set of attackers and mimic honeypots, where attacker represents attacker and honeypot represents mimic honeypot; S = {s1, s2, ... s} n } represents the set of game states consisting of all attack and defense states, and each game state represents a network state; A = {A1, A2, ..., A} n Let} be the set of attacker actions, where A k ={a1,a2,…,a m } is the attacker in state s k A set of actions; H = {H1,H2,…H} n } represents the set of actions for mimicking honeypots, where H k ={h1,h2,…,h m } is a mimicry honeypot in state s k A set of actions; This is a set of strategies for attackers and mimicry honeypots, where Represented as type The attacker in state s k The following strategy Choose a for the attacker m The probability of π; h (s k )=(σ h (s k ,h1),…,σ h (s k ,h m )) indicates that the mimicry honeypot is in state s k The following strategy, σ h (s k ,h m Select a defensive action (i.e., execute the action group h) for the mimicry honeypot. m The probability of; U = {Q, V} is the payoff function, where Q = (Q a Q h Let V be the state-action-reward function for both the attacker and the mimicry honeypot, where V = (V a V h ) is the state-value reward function for both the attacker and the mimicry honeypot; Attacker type; This represents the prior probability of the mimicry honeypot for the attacker type distribution.

3. The method for generating adaptive defense of mimicry honeypots based on Minimax-Q game theory according to claim 1, characterized in that: Step 2 involves using the Minimax-Q algorithm to solve for the Bayesian Nash equilibrium, specifically including the following steps: Step 2.1: Initialize the state-action reward function Q (h) State value revenue function V (h) and network status; Step 2.2: The mimicry honeypot selects a defense action h based on the current network state s. m (i.e., select the execution body group), and obtain the attacker's state s based on the execution body state in the mimicry honeypot. i The attack strategy adopted and the benefit assessment of obtaining the mimicry honeypot. and the new network state after the transfer i ′ ; Step 2.3, in the new network state s i ′ Next, calculate the current state-action reward function Q. (h) State value revenue function V (h) And explore with probability ε, 0≤ε≤1, randomly select the next action, and exploit the attacker in state s with probability 1-ε. i The attack strategy adopted is to select the action with the highest current Q value; Step 2.4: Repeat step 2.3 until the Minimax-Q multi-agent reinforcement learning algorithm converges or reaches the set number of iterations, output the optimal executor group of the mimicry honeypot, and form a backup executor group.

4. The method for generating adaptive defense of mimicry honeypots based on Minimax-Q game theory according to claim 3, characterized in that: In step 2.2, the benefit assessment is calculated. The deception value (DA), security defense value (SDA), and computational resource overhead are jointly determined, and the specific steps include the following: Step 2.2.1: The deception value DA is used to quantify the ability of the mimicry honeypot to attract and deceive attackers. It is jointly determined by the similarity (B) of the mimicry honeypot's business layer and the sweetness, and the calculation formula is as follows: DA = Similarity(B) * Sweetness in: The business layer similarity (B) is calculated by comparing the Jaccard similarity between the business layer vulnerability vector and the real system vulnerability vector. It is used to measure the similarity between the honeypot and the real system. The calculation formula is as follows: in, This represents the set of business layer vulnerability vectors for a mimicry honeypot. A set of vulnerability vectors representing a real system. Representing vectors The value of each component equals the number of components with a value of 2. Representing vectors The number of components whose values ​​are greater than 0; The Sweetness score is calculated by statistically analyzing the Common Vulnerability Scoring System (CVSS) scores of the business layer vulnerabilities exposed by the mimicry honeypot and the frequency with which they are exploited by attackers. It reflects the attractiveness of the honeypot to attackers, and the calculation formula is as follows: Wherein, CVSS indicates the degree of harm caused by an attacker exploiting the vulnerability, f ij f represents the frequency of vulnerability exploitation. ij =A ij / A t A ij A represents the number of attacks captured by the mimicry honeypot within a time period. t v represents the total number of attacks suffered within the time period, v represents the total number of vulnerabilities contained in the business implementation method, and n represents the number of business implementation methods in a single honeypot. Step 2.2.2: The Security Defense Value (SDA) is used to quantify the security protection capability of the mimicry honeypot entity. It is jointly determined by the virtualization layer similarity (V) and the virtualization layer confidence, and the calculation formula is as follows: SDA=(1-Similarity(V))*Confidence Wherein: the virtualization layer similarity (V) is calculated by comparing the feature vectors of different virtualization technology platforms; The virtualization layer confidence level is dynamically updated based on historical adjudication results, reflecting the operational reliability of the virtualization technology. When the confidence level falls below a set threshold, a scheduling replacement mechanism is triggered. The calculation formula is as follows: Among them, y n Y(t) represents the local decision result of virtualization technology n at time t, and Y(t) represents the global decision result output by the large number arbiter of the virtualization layer at time t. Let ζ be the denoting constant. n (T) represents the number of times virtualization technology n has been selected into the mimicry honeypot system up to time T; Step 2.2.3: The computational resource overhead is used to quantify the system resource consumption required for the operation of the mimicry honeypot. It is composed of CPU utilization and memory utilization, and the calculation formula is as follows: Overhead k =CPU k +Memory k Among them, CPU k This represents the CPU overhead and memory usage required by the execution group k currently deployed in the mimicry honeypot. k This represents the memory overhead required for execution group k currently deployed in the mimicry honeypot; Step 2.2.4: Combine the results of steps 2.2.1-2.2.3 using a product approach to calculate the benefit assessment R. h :

5. The method for generating adaptive defense of mimicry honeypots based on Minimax-Q game theory according to claim 4, characterized in that: In step 2.3, the current state-action reward function Q is calculated. (h) State value revenue function V (h) And it is explored with probability ε, specifically including the following steps: Step 2.3.1: Update the state value reward function V (h) : Where -i represents the attacker, Let Q be the state-action reward function, and in multi-agent reinforcement learning, Q is... h (s i (The value is unknown.) The time difference method from the Q-Learning algorithm is introduced to approximate the equilibrium point and update the state-action reward function Q. h The calculation formula is as follows: Where α is the learning rate, 0 < α ≤ 1, and γ is the discount factor. It is a benefit assessment; Step 2.3.2: Explore with probability ε and randomly select the next defensive action h. m With probability 1-ε, the attacker exploits the situation in state s. i The attack strategy adopted is to select the action with the highest current Q value.

6. The method for generating adaptive defense of mimicry honeypots based on Minimax-Q game theory according to claim 1, characterized in that: Step 3 specifically includes the following steps: Step 3.1: Perform virtualization layer majority judgment. Compare the virtualization layer output results of all business execution entities in the mimicry honeypot. When the virtualization layer output of an individual business execution entity is inconsistent with the majority of other business execution entities, it is determined that the business execution entity is under virtualization escape attack and the business execution entity is marked as an abnormal execution entity. Step 3.2: Perform a minority decision at the business layer. Decision on the business layer output of the business execution entity that has passed the decision at the virtualization layer. Select the output results that show abnormality or have vulnerability characteristics as the final response to be fed back to the attacker in order to maintain the deceptiveness of the honeypot and attract the attacker to conduct in-depth interaction. Step 3.3: When the virtualization layer's large number of decisions detects an abnormal executor, it immediately triggers the scheduling of the backup executor group; the backup executor group scheduling selects candidate executor groups containing all normal executors from the backup executor pool based on the composition of the current normal executors; Step 3.4: Update the Security Defense Value (SDA) and the Virtualization Layer Trustworthiness (Confidence): SDA=(1-Similarity(V))*Confidence

Images