Cloud honey point dynamic arrangement method and system based on software-defined spoofing defense

Abstract

The invention provides a cloud honey point dynamic arrangement method and system based on software-defined spoofing defense, and the system comprises a base construction control layer and an execution layer based on software-defined spoofing defense, the control layer comprises a threat sensing unit, a game decision unit and an arrangement control unit, the execution layer comprises a cloud native arrangement unit and a defense resource library; the threat sensing unit collects threat intelligence and generates a structured intelligence object; the game decision-making unit is used for game solving of an optimal response strategy; the arrangement control unit reads the defense strategy state data, generates a strategy configuration instruction according to the optimal response strategy, and issues the strategy configuration instruction to the cloud native arrangement unit; the cloud native arrangement unit responds to the instruction and dispatches a defense resource library to instantiate a Pod comprising a honey point container and a distributed feedback component; the defense resource library is used for maintaining honey point configuration files for generating honey point instances. By applying the system, self-adaptive closed-loop active defense can be realized.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, and particularly relates to a cloud honeypot dynamic arrangement method and system based on software-defined deception defense. BACKGROUND

[0002] With the increasing complexity of network attacks, deception defense technology under the active defense idea has become an important part of modern security architecture.

[0003] At present, deception defense technology has appeared a variety of technical solutions around the automation and dynamic of honeypot / honeypot, but these solutions have several fundamental technical problems when dealing with modern automated and intelligent network threats:

[0004] Static evaluation and optimization of deception defense scheme and dynamic correlation and flow traction of deception defense scheme can only optimize or correlate the stock of honeypot deployment, and there is a problem of insufficient deployment flexibility caused by static resources, which cannot realize flexible resource deployment when facing large-scale attacks.

[0005] The deception defense scheme of dynamic instantiation in the prior art mainly includes triggering a defense response by dragging and changing an authenticated user and a defense response based on the evaluation of the state of the defense party, wherein the defense response speed of the scheme based on user operation is limited by manual intervention, and it is difficult to realize real-time response, and the scheme of defense response based on the evaluation of the state of the defense party still belongs to the category of defense being predictable when dealing with complex attacks, and cannot make intelligent and non-predictable decisions for different attacker intentions in real time.

[0006] Therefore, it is necessary to provide a deception defense configuration method to realize dynamic deployment of timely and targeted active defense strategy. SUMMARY

[0007] The present application relates to the technical field of network security, and particularly relates to a cloud honeypot dynamic arrangement method and system based on software-defined deception defense.

[0008] In a first aspect, the application provides a cloud honeypot dynamic arrangement system based on software-defined deception defense, comprising a base construction control layer and an execution layer based on software-defined deception defense, the control layer comprising a threat perception unit, a game decision unit and an arrangement control unit, the execution layer comprising a cloud native arrangement unit and a defense resource library; the threat perception unit is used for collecting threat intelligence and generating a structured intelligence object; the game decision unit is used for performing game solving according to the structured intelligence object and a current defense strategy configuration to maximize an optimal response strategy of the defense utility; the arrangement control unit has a northbound intention programming interface and a southbound protocol arrangement interface, reads defense strategy state data through the northbound intention programming interface, and generates a strategy configuration instruction according to the optimal response strategy and issues the strategy configuration instruction to the cloud native arrangement unit through the southbound protocol arrangement interface; the cloud native arrangement unit responds to the strategy configuration instruction and performs elastic scheduling and a life cycle of a Pod through a Pod management honeypot, each Pod is deployed with a honeypot container and a distributed feedback component sharing resources with the honeypot container, the distributed feedback component detects intrusion behaviors and reports in real time to the threat perception unit; the defense resource library maintains a honeypot configuration file used for generating a honeypot instance.

[0009] The cloud honeypot dynamic arrangement system based on software-defined deception defense has the beneficial effects that the system is decoupled into a control layer of intelligent decision and an execution layer of elastic execution, the control logic is decoupled from the execution resource, and physical separation of the defense logic and the underlying resource is realized. The game decision is made depending on the attacker strategy captured in real time by the threat perception unit, so that more intelligent and more targeted non-predictive decisions are made, and control intelligence and automatic response are realized. The feedback information of the distributed feedback component is sent back to the control layer in real time, triggering re-modeling and re-decision, so that the system can change the defense topology in real time, and high-reliability and low-risk dynamic adaptive closed-loop active defense is realized.

[0010] In a possible embodiment, the threat perception unit collecting threat intelligence comprises collecting real-time original threat data streams from a network boundary and receiving intrusion behaviors reported by the distributed feedback component; and the threat perception unit generating a structured intelligence object comprises verifying, cleaning and uniformly formatting the collected original threat data streams or the received intrusion behaviors to generate the structured intelligence object.

[0011] In another possible embodiment, the game decision unit performs game solving according to the structured intelligence object and the current defense strategy configuration to maximize the optimal response strategy of the defense utility, comprising: defining a state modeling function to analyze the structured intelligence object into a current attack-defense state; constructing an attack-defense payoff matrix according to the current attack-defense state and the current defense strategy configuration; and solving the optimal response strategy of the defense utility maximization under the current attack-defense state according to the attack-defense payoff matrix.

[0012] In other possible embodiments, the attack-defense payoff matrix defines the net payoff that the defense party can obtain by taking a defense strategy in the current attack-defense state, and the dynamic utility function form of the net payoff is defined to satisfy the following formula: wherein, represents the total payoff that the defense party obtains by taking a defense strategy in the current attack-defense state , and represents the net payoff that the defense party can obtain by taking a defense strategy in the current attack-defense state , and represents the total payoff that the defense party obtains by taking a defense strategy in the current attack-defense state , and represents the cost that the defense party pays for taking a defense strategy in the current attack-defense state , wherein, represents the optimal response strategy solved, represents the defense strategy space, represents the expected net utility in the current attack-defense state.

[0013] The orchestration control unit reads the defense strategy state data, including: in the starting phase, performing a reading operation to obtain initial state data of the defense strategy; in the running phase, when a strategy configuration modification of manual intervention occurs, performing a reading operation to obtain current defense strategy state data.

[0014] The honeypot configuration file maintained by the defense resource library includes a honeypot image and a parameterized configuration template for honeypot parameter configuration, and the parameterized configuration template supports dynamic parameter adjustment.

[0015] The distributed feedback component shares a storage volume and a network namespace with the honeypot; the distributed feedback component monitors the running state and network behavior of the honeypot in real time to obtain raw data, extracts security event information from the raw data, and checks intrusion behavior; when the intrusion behavior is detected, the intrusion behavior is encapsulated into an alarm object according to a predefined structure and reported to the threat perception unit.

[0016] In a second aspect, the present application also provides a cloud honeypot dynamic orchestration method based on software-defined deception defense, which applies the above-mentioned system to perform cloud honeypot dynamic orchestration, including: the threat perception unit collects threat intelligence to generate a structured intelligence object; the game decision unit obtains defense strategy state data from the orchestration control unit, and the game decision unit performs game solving to obtain an optimal response strategy according to the structured intelligence object and the defense strategy state data; the orchestration control unit generates a strategy configuration instruction according to the optimal response strategy and issues the strategy configuration instruction to the cloud-native orchestration unit; and the cloud-native orchestration unit schedules honeypot configuration files in the defense resource library according to the strategy configuration instruction to instantiate a Pod containing a honeypot container and a distributed feedback component.

[0017] In a possible embodiment, in the start-up stage of the cloud honeypot dynamic arrangement system based on software-defined deception defense, the threat perception unit collects original threat data streams from network boundaries and generates structured intelligence objects sent to the game decision unit for game solving.

[0018] In another possible embodiment, the distributed feedback component acquires original data of the honeypot to detect intrusion behaviors, and reports the intrusion behaviors to the threat perception unit when the intrusion behaviors are detected; in the running stage of the cloud honeypot dynamic arrangement system based on software-defined deception defense, when the threat perception unit receives the reported intrusion behaviors, the threat perception unit generates structured intelligence objects according to the intrusion behaviors and sends the structured intelligence objects to the game decision unit for game solving.

[0019] The beneficial effects of the above-mentioned second aspect can be referred to the description of the first aspect. BRIEF DESCRIPTION OF DRAWINGS

[0020] Figure 1 A schematic diagram of a cloud honeypot dynamic arrangement system based on software-defined deception defense provided by the embodiment of the present application;

[0021] Figure 2 A flowchart of a cloud honeypot dynamic arrangement method based on software-defined deception defense provided by the embodiment of the present application. DETAILED DESCRIPTION

[0022] To make the objectives, technical solutions and advantages of the present application clearer, the technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, rather than all the embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative work fall within the scope of protection of the present application. Unless otherwise defined, the technical terms or scientific terms used herein should be understood as the general meanings understood by those skilled in the art in the field of the present application. The similar words such as “comprise” used herein mean that the elements or objects before the words cover the elements or objects listed after the words and their equivalents, without excluding other elements or objects.

[0023] The present embodiment provides a cloud honeypot dynamic arrangement method and system based on software-defined deception defense.

[0024] Referring to the drawings accompanying Figure 1 The cloud honeypot dynamic arrangement system based on software-defined deception defense comprises: a software-defined deception defense (Software-Defined Deception Defense, SD 3The base construction control layer and the execution layer of the cloud honeypot dynamic orchestration system, the control layer includes a threat perception unit, a game decision unit and an arrangement control unit, and the execution layer includes a cloud native arrangement unit and a defense resource library. The control layer and the execution layer in the cloud honeypot dynamic orchestration system are decoupled, the control layer serves as an intelligent decision center, is responsible for centralized management and intelligent decision, the execution layer serves as an elastic operation unit, is responsible for standardizing encapsulation of the computing resources at the bottom, so that the honeypot environment can be quickly created, updated or destroyed according to the demand of the security strategy, thereby supporting the elastic expansion of the defense resources. The control layer includes a northward intention programming interface and a southward protocol arrangement interface, the programmable definition of the defense logic parameters is realized through the northward intention programming interface, and the synchronous and cooperative arrangement of the computing resources and the network path is realized through the southward protocol arrangement interface.

[0025] The threat perception unit is configured to collect threat intelligence and generate a structured intelligence object.

[0026] In a possible embodiment, the threat perception unit collects threat intelligence, including collecting real-time original threat data streams from network boundaries and receiving intrusion behaviors reported by distributed feedback components; and the threat perception unit generates a structured intelligence object, including checking, cleaning and uniformly formatting the collected original threat data streams or received intrusion behaviors to generate the structured intelligence object.

[0027] Exemplarily, the threat perception unit serves as a threat perception interface of the system, is responsible for collecting real-time original threat data streams from network boundaries (such as firewall, IDS log), and is denoted as The threat perception unit is also responsible for receiving intrusion behaviors reported by the execution layer, denoted as The core function of the threat perception unit is data standardization and aggregation, checking, cleaning and uniformly formatting the data, and finally generating a standard structured intelligence object for direct use of the game decision unit, and the standard fields of the standard structured intelligence object include {timestamp, src_ip, src_port, dst_port, protocol, attack_type, confidence}.

[0028] timestamp, src_ip, src_port, dst_port, protocol, attack_type, confidence, where timestamp represents a time stamp, recording the exact time when the threat behavior or alarm event occurs (e.g., 2025-11-19T10:00:01Z); src_ip represents a source IP address, an Internet protocol address of the source end initiating the scanning, probing or attack behavior; src_port represents a source port, a source end port number used by the attacker when initiating the connection; dst_port represents a destination port, a port number (e.g., 80, 22, 445, etc.) of the attack target visited; protocol represents a protocol type, a communication protocol type used by the attack traffic, such as TCP, UDP, ICMP, etc.; attack_type represents an attack type, a specific attack feature classification identified, such as scanning, SQL injection, SSH brute force cracking, RCE, etc.; and confidence represents a confidence level, an accurate probability of the system for the threat judgment (between 0 and 1), used for weight compensation in game decision-making.

[0029] The game decision unit is configured to perform game solving according to the structured intelligence object and the current defense strategy configuration to obtain an optimal response strategy that maximizes the defense utility.

[0030] In one possible embodiment, the game decision unit performs game solving according to the structured intelligence object and the current defense strategy configuration to obtain an optimal response strategy that maximizes the defense utility, including: defining a state modeling function to parse the structured intelligence object into a current attack-defense state; constructing an attack-defense payoff matrix according to the current attack-defense state and the current defense strategy configuration; and solving the optimal response strategy that maximizes the net utility of the defense side in the current attack-defense state according to the attack-defense payoff matrix.

[0031] The attack-defense payoff matrix defines the net payoff that the defense side can obtain by adopting a defense strategy in the current attack-defense state, and the dynamic utility function of the net payoff is defined as follows: wherein, represents the net payoff that the defense side can obtain by adopting a defense strategy in the current attack-defense state, represents the total payoff brought by the defense side executing the defense strategy, represents the cost paid by the defense side executing the defense strategy. The process of solving the optimal response strategy is defined as follows: wherein, represents the optimal response strategy solved, represents a defense strategy space, represents the expected net utility in the current attack-defense state.

[0032] ​​​In one specific embodiment, the structured intelligence object output by the threat perception unit is a raw threat data stream processed by normalization or an intrusion behavior processed by normalization . Specifically, the structured intelligence object output by the threat perception unit in the system startup phase is and the structured intelligence object output by the threat perception unit in the system running phase is .

[0033] The game decision unit is a programmable central decision unit that drives and maintains a global attack-defense state by integrating the standard structured intelligence output by the threat perception unit , thereby achieving dynamic perception of the intrusion situation at the execution layer at the semantic level, and implementing a targeted reorganization strategy through game algorithm, thereby achieving fine and programmable scheduling of the underlying resources.

[0034] The game decision unit includes an attack-defense state modeler, an attack-defense payoff matrix, and a strategy solver. The attack-defense state modeler is used to parse the structured intelligence object output by the threat perception unit into an attack-defense state before modeling the attack-defense state; the attack-defense payoff matrix is a quantitative basis for decision-making by the strategy solver, which formally defines the net payoff that the defense can obtain by adopting a certain defense strategy under the current attack-defense state; the strategy solver observes the current attack-defense state determined by the attack-defense state modeler and solves the optimal response strategy that can maximize the net utility of the defense under the current attack-defense state.

[0035] Define a state modeling function to parse the structured intelligence object into an attack-defense state : For example, when contains scans from the same source IP to multiple unrelated ports (such as {src_ip:A, dst_port:[22, 23, 80, 445]}), is modeled as "Broad_Reconnaissance" (extensive reconnaissance). When contains attack features for specific ports (such as {src_ip:A, dst_port:22, attack_type:"SSH_Exploit_Attempt"}), is modeled as "Aggressive_Exploit_SSH" (aggressive exploit). When is "high-risk RCE attempt", is modeled as "High_Value_Exploit_Attempt" (high-value exploit).

[0036] Specifically, offensive and defensive state modeling is not a simple mechanical mapping of structured intelligence objects, but rather a process implemented through state modeling functions. Achieving alignment and standardization of heterogeneous semantics: Focusing on macroscopic detection behavior, while Both focus on micro-level exploitation features, resulting in differences in intelligence granularity. The attack-defense state modeler transforms differentiated input fields into a consistent discrete state space through a unified structured link. This ensures that the benefit matrix can evaluate the net utility of different defense strategies under the same caliber. During this process, the attack and defense state modeler will also adjust the intelligence source... and Perform confidence-weighted correction. This is due to intrusion behavior reported by the execution layer ( This approach offers higher attack certainty and, through weight compensation, ensures higher priority when triggering state transitions (such as from reconnaissance to high-value exploitation). This confidence-weighted semantic alignment mechanism ensures the discrete state space... It can accurately reflect the true offensive and defensive situation, thereby avoiding decision-making bias caused by heterogeneous data noise.

[0037] The attack-defense state modeler's modeling process is deeply collaborative with the real-time feedback of intrusion behavior from the execution layer to construct an execution-driven dynamic state machine closed loop. When the execution layer captures specific intrusion behavior characteristics of the attacker and transmits the data back to the control layer, the attack-defense state modeler immediately triggers a state transition. This invention, by designing this attack-defense state modeling mechanism centered on state transition, transforms the game decision-making unit from a static evaluation tool into a real-time operating control layer decision-making center. The system achieves rapid tracking of the evolution of attack intentions through a closed loop of receiving execution layer perception information, control layer attack-defense state modeling, state machine transition, and re-solving of defense strategies. This ensures that the system can trigger real-time re-solving of defense strategies based on state transitions, solving the technical problem of traditional defense schemes where strategy adjustments lag behind attack progress.

[0038] The attack-defense payoff matrix defines the net gain that the defender can obtain by adopting a certain defensive strategy under the current attack-defense state. Specifically, the net gain is defined as the difference between the gain and the cost, and its dynamic utility function is formally defined as follows: ,in, This represents the net utility of the defender, indicating the defender's (Cloud Honey Point Dynamic Orchestration System) performance in the current attack and defense state. Below, adopt a defensive strategy space A certain defensive strategy The net benefit that can be obtained is that the optimization objective of the policy solver is to find a value that allows... A strategy to maximize value; represents the total revenue of the defense party, which is a quantitative function for calculating the total revenue of the defense strategy executed by the defense party represents the total revenue of the defense party, which is a quantitative function for calculating the total revenue of the defense strategy executed by the defense party represents the total revenue of the defense party, which is a quantitative function for calculating the total revenue of the defense strategy executed by the defense party represents the defense strategy, which is a specific strategy selected from the defense strategy space of the defense party, the standard form of the defense strategy is {Action, Type, Count, TTL, Placement}, and the specific content form of the defense strategy can be {Action: 'DEPLOY', Type: 'LI-Web', Count: 15, TTL: '3600s', Placement: 'Honeynet-Node-Pool'}.

[0039] The dynamic utility function of the defense party net revenue designed in the application can strictly align the game parameters with the resource quantization benchmarks of the cloud native orchestration unit, thereby supporting executable strategy comparison: in the dynamic utility function, the design of the cost item and the revenue item considers the static and dynamic factors existing in the system from multiple angles, which can resist the countermeasures of the attacker to induce the defense party to over-provision through low-cost probing. Through nonlinear cost-benefit trade-off in the game, the game equilibrium point moves spontaneously with the evolution of attack intention and the fluctuation of real-time environmental factors (such as current cluster computing power load and intelligence freshness). Under this design, the revenue and cost are dynamically fluctuating, and the attacker cannot infer the defense trigger boundary of the system through a limited number of probes, greatly enhancing the unpredictability of the defense topology and effectively solving the technical problem of easy-to-explore and evadable defense boundary.

[0040] Moreover, the defense strategy is defined as an action tuple expressible by the execution layer resource template and the orchestration platform API primitive, and the design of such strategy as code ensures that the game decision result can be accurately mapped to the orchestration atomic operation of the cloud native orchestration unit, realizing deep decoupling and cooperation of decision intelligence and physical execution, and realizing instantaneous reconstruction of the defense topology in the physical execution layer.

[0041] The strategy solver runs a game theory algorithm, adopts an observation and response method, and the current attack and defense state is observed by the attack and defense state modeler determined by the modeling , and the optimal response strategy that can maximize the net utility of the defense party under the current attack and defense state is solved . The solving process of the optimal response strategy can be defined as follows: , wherein represents the solved optimal response strategy, represents the expected net utility under the current attack and defense state.

[0042] To ensure that the game model designed in the application has feasibility in the heterogeneous and dynamic cloud native environment, the application designs the coordination of game decision logic, underlying resource constraints, and system operation robustness:

[0043] When solving the global optimal response strategy, the solver needs to satisfy the resource boundary constraint of , wherein represents the current perceived concurrent attack source index, is the upper limit of the real-time global resource budget fed back by the execution layer. When solving, the resource quota state of the execution layer feedback is synchronously retrieved. If the current cluster resource is in danger, resulting in dramatic increase , the game decision unit will automatically avoid high energy consumption strategies and instead find a suboptimal but low energy consumption defense topology scheme (such as using lightweight container combination instead of heavy virtual machine honeypot) in the strategy space , to ensure that the decision has strong feasibility in the physical environment, so that the solved directly corresponds to the cloud native atomic instructions executable by the execution layer.

[0044] The strategy solving and the feedback mechanism of the execution layer are designed in a closed loop to make the dynamic game stand in engineering. When the execution layer captures high-confidence attack behavior and returns it in real time through a high-performance message channel, the control layer immediately triggers state migration and recalculation of the dynamic utility function. Through this mode of execution-driven decision-making, the strategy solving can quickly iterate with the evolution of attack intentions.

[0045] The system sets cooling time, strategy hysteresis, and change budget control logic during the solving and strategy execution phases. These mechanisms enable the system to achieve a configurable balance between fast response to threats and stable operation / resource control, ensuring that the system can maintain a stable defense posture when facing persistent attacks or high-frequency noise interference, and avoiding negative performance impact on business clusters due to frequent scaling operations.

[0046] The orchestration control unit has a northbound intent programming interface and a southbound protocol orchestration interface. The northbound intent programming interface is used to read defense strategy state data to realize declarative management of the defense strategy. The southbound protocol orchestration interface is used to generate strategy configuration instructions according to the optimal response strategy and send the instructions to the cloud native orchestration unit, so as to realize atomic driving of the underlying resources.

[0047] In a possible embodiment, the reading of the defense strategy state data by the orchestration control unit includes: performing a reading operation in a starting stage to obtain initial state data of the defense strategy; and performing a reading operation in a running stage to obtain current defense strategy state data when a manually intervened strategy configuration modification occurs.

[0048] The orchestration control unit is an instruction translation and sending unit of the control layer, and is a bridge connecting the control layer and the execution layer. Specifically, the orchestration control unit realizes the SD 3 southbound protocol abstraction layer in the architecture. The orchestration control unit is not only a forwarder of instructions of the control layer, but also translates the optimal response strategy output by the game decision unit into atomic operations understandable by the execution layer through predefined mapping logic. The abstract design of the southbound protocol orchestration interface makes the system have cross-platform compatibility, and completely decouples the complex deception defense logic from the orchestration details of the cloud native orchestration unit of the underlying layer.

[0049] In a possible embodiment, the main function of the orchestration control unit can be described as two parts of strategy loading realized through the northbound intent programming interface and instruction translation realized through the southbound protocol orchestration interface. The strategy loading includes: in a system starting stage, the orchestration control unit performs a reading operation to obtain initial state data of the defense strategy to obtain initial values of the total defense benefit and the defense cost of the defense party as initial basis for decision making of the game decision unit; and in a running stage, to realize dynamic adjustment, when an operation and maintenance personnel or a user modifies and saves a strategy configuration in a manually intervened manner, the orchestration control unit re-performs the reading operation to obtain updated quantitative values of the total defense benefit and the defense cost of the defense party and provides the new values obtained to the game decision unit. The instruction translation refers to translation of the optimal response strategy output by the game decision unit into specific and programmable API calls to the execution layer.

[0050] In a specific embodiment, the orchestration control unit is designed as an SD 3 orchestration controller.

[0051] In a specific embodiment, the read operation performed by the orchestration control unit in the system startup phase can be: reading and parsing the YAML / JSON data in the strategy configuration ConfigMap named honeypoint-strategy-matrix to obtain the initial values of the total defense revenue and the defense cost by calling the function in the cloud-native API (i.e., Kubernetes CoreV1Api). In the system running phase, the orchestration control unit initiates a watch long connection to the Kubernetes API server for the ConfigMap. When the operation and maintenance personnel (or user) modifies and saves the strategy configuration object through kubectl edit, etc., the K8s API server will immediately send a MODIFIED event to the orchestration control unit through this connection, and the orchestration control unit will immediately re-execute the read operation to obtain the updated defense revenue and defense cost quantification values.

[0052] The strategy loading mechanism design of the orchestration control unit enables the orchestration control unit to support storing complex attack-defense revenue matrices as standard resource objects of cloud-native orchestration units, realizing the declarative management of "strategy as code". The implementation of "strategy as code" constitutes the northbound programming interface of the cloud honey point dynamic orchestration system based on software-defined deception defense. The security administrator or the upper-layer security orchestration system does not need to concern how the underlying image is pulled, how the container is scaled, and does not need to log in to the specific honey point container instance. It only needs to modify the ConfigMap to dynamically program the intelligence value weight, resource punishment cost, and other game parameters. This northbound driving mode ensures that the deception defense logic can be quickly switched and the topology can be reconstructed with the change of business logic, realizing the software definition of deception defense capability.

[0053] In a specific embodiment, when the orchestration control unit receives the optimal response strategy, it translates it into an instruction output to the K8s API. In the instruction translation process, the orchestration control unit decouples and maps the five-tuple parameters in the optimal response strategy with cloud-native resource objects:

[0054] Action (action meta): mapped to the operation request type of the Kubernetes API. For example, DEPLOY is mapped to the create operation, PATCH / SCALE is mapped to the patch operation, and DELETE is mapped to the delete operation. In addition to the control of the Pod life cycle, Action is also used in SD 3The semantics also cover the dynamic orchestration of the network forwarding plane. For example, when the DEPLOY operation is executed, the controller synchronously issues Service or Ingress rule update instructions to the execution layer, dynamically diverts suspected attack traffic originally directed to the business node to the newly generated honeypot instance by modifying the Label Selector or traffic weight, thereby achieving SD 3 Coordinated orchestration of computing resources and network paths.

[0055] Type (resource type): mapped to the container image label in the Pod template. The controller dynamically obtains the corresponding image address and environment variable template from the deception resource library according to the Type field.

[0056] Count (deployment scale): mapped to the spec.replicas replica number specification of the Deployment resource object, directly controlling the number of concurrent honeypot instances in the cluster.

[0057] TTL (lifetime): mapped to the Pod's lifecycle annotation. The orchestration control unit marks the survival time in the annotations of Metadata, and through the cleaning mechanism of the control layer, it is automatically destroyed at the expiration to maintain the dynamic freshness of the defense topology.

[0058] Placement (deployment location): mapped to the nodeAffinity or nodeSelector node affinity configuration of the cloud-native orchestration unit. This determines whether the honeypot is deployed on a specific security observation zone node or physically isolated from the business node, ensuring the accurate deployment of the defense strategy in the physical cluster.

[0059] Exemplarily, when the optimal response strategy is When the orchestration control unit receives a strategy configuration instruction {Action: 'PATCH', Type: 'LI-Cowrie', Count: 10, TTL: '3600s', Placement: 'honeypoint-node-pool'}, it translates it into a set of composite API call instructions in the following form: client.AppsV1Api().patch_namespaced_deployment(name='cowrie-honeypoint', namespace='default', body={'spec':{'replicas':10,'template':{'metadata':{'annotations':{'deception.io / ttl':'3600s'}},'spec':{'containers':[{'name':'honeypoint','image':'registry / li-cowrie:v1'}], 'nodeSelector':{'pool':'honeypoint-pool'}}}}}).

[0060] The cloud-native orchestration unit responds to the strategy configuration instructions and manages the elastic scheduling and life cycle of the honeypot through the Pods. The honeypot containers and distributed feedback components that share resources with the honeypot containers are deployed in each Pod. The distributed feedback components detect intrusion behaviors and report them to the threat perception unit in real time.

[0061] In a possible embodiment, the cloud-native orchestration unit carries all honeypot container instances in the system and is responsible for the full life cycle management of the honeypot container instances from startup to destruction. According to the resource configuration requirements (such as CPU, memory limit and node affinity rules) issued by the control layer, the cloud-native orchestration unit allocates honeypot containers to the most suitable server nodes in the cluster based on the scheduling algorithm, so that the system can timely respond to the dynamic scaling requirements from a single decoy probe to a large-scale honeynet without human intervention, and ensure a balance between defense resource consumption (i.e., defense cost ) and running performance, achieving elastic defense.

[0062] In a specific embodiment, the cloud-native orchestration unit is constructed using a Kubernetes (K8s) cluster, and a high-level scheduler (Scheduler) is built in to schedule honeypot containers. The orchestration control unit is an SD 3 orchestration controller. The cloud-native orchestration unit exposes a set of standardized, declarative RESTful API interfaces to the control layer to constitute the SD 3programmable foundation, through the RESTful API interface, SD 3 The orchestration controller can accurately manipulate the underlying resources in an infrastructure-as-code manner, manage the rapid replication and expansion of stateless honeypots through Deployment, build dynamic network access portals through Service, and dynamically inject fake environment configurations and false credential data using resource configuration ConfigMap and Secret. This interface design abstracts the complexity of the underlying hardware and network, allowing the control layer to focus only on the logical generation of defense strategies, while the specific landing execution and state maintenance are automatically completed by the cloud-native orchestration unit.

[0063] In one possible embodiment, the distributed feedback component shares a storage volume and a network namespace with the honeypot; the distributed feedback component monitors the running state and network behavior of the honeypot in real time to obtain raw data, extracts security event information from the raw data, and checks intrusion behavior; when an intrusion behavior is detected, the intrusion behavior is encapsulated into an alarm object according to a predefined structure and reported to the threat perception unit.

[0064] The distributed feedback component is a detection unit implanted in the execution layer, mainly responsible for the situation feedback between the execution end and the decision end.

[0065] In one possible embodiment, the entity of the distributed feedback component is a lightweight log proxy container, which adopts the Sidecar design pattern in the cloud-native environment. The distributed feedback component does not modify any code of the honeypot image, but is deployed as an attached container together with the honeypot image in the same Pod (the smallest scheduling unit of Kubernetes). The honeypot container and the distributed feedback component deployed in each Pod share resources, which are specifically set as follows: the distributed feedback component and the honeypot image share the same storage volume and network namespace, the shared storage volume realizes file-level intercommunication, and the distributed feedback component can directly read the log files generated by the honeypot; the shared network namespace realizes transparent reuse of the network stack, and the distributed feedback component can directly listen to the localhost traffic of the honeypot container, thereby realizing non-intrusive accompanying monitoring of the running state and network behavior of the honeypot.

[0066] In one specific embodiment, the work of the distributed feedback component includes local collection and cleaning, and structured alarm reporting, and the specific work flow is as follows:

[0067] The distributed feedback component obtains raw data by tracking the standard output stream or application log file of the honeypot container in real time. In order to reduce the computing pressure of the control layer, the distributed feedback component completes the preliminary cleaning of data on site using regular matching or rule engine at the data source (i.e., inside the Pod). For example, invalid heartbeat packet logs or noise data are automatically filtered out, and only key security event information is extracted.

[0068] When a certain intrusion behavior is detected (e.g., an attacker is identified to perform wget to download a malicious file, or a specific SQL injection feature flow is captured through a shared network interface), the distributed feedback component encapsulates the unstructured intrusion behavior into a predefined JSON alert object, denoted as , at the source side (inside the Pod). Although the encapsulated alert object has a structured feature (e.g., contains a timestamp, a source IP), it is considered as the execution layer feedback data in order to distinguish from the network boundary data. This source-side structured processing eliminates the format difference of heterogeneous honeypot logs, greatly reduces the data cleaning burden of the control layer, and provides high-quality input data for the upper threat perception module.

[0069] Exemplarily, a typical object contains the following fields:

[0070] {

[0071] "timestamp": "2025-11-19T10:00:01Z",

[0072] "src_ip": "192.168.1.5",

[0073] "src_port": 54321,

[0074] "dst_port": 80,

[0075] "protocol": "TCP",

[0076] "attack_type": "SQL_Injection_Attempt",

[0077] "confidence": 0.95

[0078] }

[0079] This structured processing eliminates the format difference of heterogeneous honeypot logs, and provides a unified input standard for the upper game decision engine.

[0080] The encapsulated alert object is transmitted back to the threat perception unit of the control layer in real time through a high-performance internal message channel (e.g., gRPC). This mechanism ensures that the control layer can obtain low-delay real-time situation information, and then quickly update the attack-defense state . With the update of the attack-defense state, the game decision unit will recalculate the total defense revenue and the net utility of the defense , and further triggers the next round of decision (for example: the strategy solver determines that the change in the benefits brought by upgrading the defense strategy is significant, and thus instructs the orchestration control unit to perform dynamic adjustment of the honeypot resources).

[0081] The defense resource library maintains a honeypot configuration file for generating a honeypot instance.

[0082] In a possible embodiment, the honeypot configuration file maintained by the defense resource library includes a honeypot image and a parameterized configuration template for honeypot parameter configuration, and the parameterized configuration template supports dynamic parameter adjustment.

[0083] In a specific embodiment, the defense resource library is a centralized storage and management center of system defense resources, and the defense resource library does not directly run the honeypot, but is responsible for maintaining all standardized static files for generating honeypot instances. Through the classified management of the above defense base resources, the system can quickly combine different types of defense environments without re-writing the code.

[0084] The defense resource library mainly includes two types of resources: multi-modal honeypot images and parameterized configuration templates. The multi-modal honeypot image is a pre-made, standardized container image. In order to meet different defense needs, the multi-modal honeypot image includes environments of different simulation levels, including low-interactive basic simulation images and high-interactive deep simulation images. Specifically, the basic simulation image only simulates the network port or the basic protocol of a specific service (such as simulating an SSH login interface). This type of image occupies very few resources, is suitable for large-scale deployment, and is used for quickly discovering scanning behavior in the network. The deep simulation image contains a complete operating system or a real business application software (such as a Web system with a specific vulnerability). Although this type of image occupies more resources, it can provide a real operating environment for inducing attackers to intrude through vulnerabilities, and thus record the complete attack process. The parameterized configuration template is a set of standardized resource description files, which is a general definition of generating a honeypot. Unlike fixed configuration files, the parameterized configuration template supports dynamic parameter adjustment. During system runtime, the orchestration control unit can inject different parameters into the template (for example: pretending to be a server information of different versions, setting specific false data, or adjusting the service port). The same image combined with different configuration parameters can quickly instantiate honeypot instances with different appearances, improving the diversity of the deception environment.

[0085] The cloud honeypot dynamic arrangement system based on software-defined deception defense provided by the application decouples the control layer and the execution layer, realizes physical separation of the defense control logic and the underlying execution resources, and also enables the security administrator to manage the whole network defense logic by modifying the policy configuration object of the control layer without configuring the honeypot one by one. The arrangement control unit automatically translates the optimal response strategy into underlying API instructions, realizes software definition and dynamic programming of the defense capability, and greatly reduces the operation and maintenance complexity of large-scale deployment.

[0086] The application utilizes the game decision unit and the dynamic benefit matrix to perform cost-benefit analysis according to the real-time behavior value of the attacker, dynamically solves the optimal strategy that maximizes the net utility of the defense party according to the real-time updated attack-defense state, and thus realizes dynamic and intelligent decision-making for different attack intentions. The system can dynamically adjust the defense strength for different attack stages, the defense behavior presents high intelligence and unpredictability, effectively counteracts the evasion detection of the attacker, and solves the rigid problem of defense strategy deployment in the prior art.

[0087] Kubernetes is used as an execution base to realize standardized encapsulation and large-scale (from 0 to N) second-level elastic scaling of deception resources, which can effectively cope with sudden large-scale botnet attacks. Through shared storage volumes and network namespaces, the intrusion behavior can be captured and real-time returned in a non-intrusive manner without modifying the honeypot image and relying on kernel hooks. The feedback mechanism of the innovative distributed feedback component provides a lightweight and non-intrusive intelligence return channel, ensuring that the control layer can realize real-time situational awareness and automatically trigger the OODA closed loop, and realizing closed-loop adaptive active defense.

[0088] Overall, the cloud honeypot dynamic arrangement system based on software-defined deception defense designs a decoupled control layer and execution layer, establishes a mechanism for real-time triggering of defense strategy re-solving based on attack-defense state migration, and forms an active defense system with a new architecture, solves the rigid problem of defense deployment in the prior art, and improves the intelligence and unpredictability of the defense strategy. Designing game decision, constraint conditions specific to the cloud native environment and various coordination of system operation ensures the feasibility of the cloud honeypot dynamic arrangement system based on software-defined deception defense under the new design architecture, and realizes rapid iteration of defense strategy solving with the evolution of attack intentions.

[0089] The accompanying drawings are incorporated in and constitute a part of the specification for the application. Figure 2 The embodiment also provides a cloud honeypot dynamic arrangement method based on software-defined deception defense. The method uses the cloud honeypot dynamic arrangement system in the system embodiment to realize dynamic defense deployment.

[0090] S101: The threat perception unit collects threat intelligence to generate structured intelligence objects.

[0091] In one possible embodiment, in the start-up phase of the cloud honeypot dynamic orchestration system based on software-defined deception defense, the threat perception unit collects raw threat data streams from the network boundary and generates structured intelligence objects sent to the game decision unit for game solving.

[0092] In one possible embodiment, the distributed feedback component obtains raw data of the honeypot to detect intrusion behavior, and reports to the threat perception unit when intrusion behavior is detected; in the running phase of the cloud honeypot dynamic orchestration system based on software-defined deception defense, when the threat perception unit receives the reported intrusion behavior, the threat perception unit generates structured intelligence objects according to the intrusion behavior and sends them to the game decision unit for game solving.

[0093] S102: The game decision unit obtains defense strategy state data from the orchestration control unit, and the game decision unit solves the game according to the structured intelligence objects and the defense strategy state data to obtain the optimal response strategy.

[0094] S103: The orchestration control unit generates a strategy configuration instruction according to the optimal response strategy and issues it to the cloud-native orchestration unit.

[0095] S104: The cloud-native orchestration unit schedules the honeypot configuration file in the defense resource library according to the strategy configuration instruction to instantiate the Pod containing the honeypot container and the distributed feedback component.

[0096] After the cloud honeypot dynamic orchestration system based on software-defined deception defense is started, it enters the initial defense deployment, and then enters the adaptive cycle of defense strategy solving according to the feedback of the execution layer.

[0097] In one specific embodiment, the cloud honeypot dynamic orchestration system based on software-defined deception defense is started, and the threat perception unit of the system monitors the network boundary traffic in real time: it monitors that an external IP initiates a port scanning behavior to an internal network segment. The threat perception unit collects the threat data stream .

[0098] The game decision unit receives data from the threat perception unit, and the attack-defense state modeler uses the function to analyze the behavior into a specific attack-defense state: the current attack-defense state is obtained as a low-cost reconnaissance state.

[0099] The strategy solver is based on the current attack-defense state and the (reward) and (Cost) value, running game theory algorithm: The system assessment believes that, under the "low-cost reconnaissance" state, the resource consumption and operation and maintenance costs of deploying high-interaction honeypots are... Far exceeding the intelligence gains it captured This leads to net utility The decline, therefore, the optimal strategy is solved. This involves deploying low-interaction honeypots for wide-coverage probing. During this process, the policy solver simultaneously retrieves engineering constraints from the execution layer, such as global resource budget, scaling rate limits, and cooldown times. Policy space Perform feasibility filtering to ensure that the output strategy can be used by SD. 3 The orchestration controller executes immediately without incurring resource exhaustion risks. The optimal response strategy output is: {Action:'DEPLOY',Type:'LI-Web',Count:15,TTL:'3600s',Placement:'Low-Priority-Node'}.

[0100] The orchestration and control unit receives the optimal response policy and translates it into specific, programmable Kubernetes API call instructions. This process achieves precise orchestration and delivery of underlying defense resources by mapping Action to operation request type, Type to container image tag, Count to replica count specification, TTL to lifecycle annotation, and Placement to node affinity configuration: when the five-tuple of the above optimal response policy is received, SD... 3 The orchestration controller calls the API to create a Deployment resource containing 15 replicas, specifying a low-interaction image, annotating it with a 1-hour lifecycle, and scheduled to a low-priority node. Meanwhile, SD... 3 The orchestration controller synchronously updates the Service forwarding rules to ensure that suspected attack traffic is accurately directed to the newly generated low-interaction honeypots.

[0101] The cloud-native orchestration unit at the execution layer responds to API commands: the scheduler launches 15 honeypot container instances (Pods) and their bound distributed feedback components (Sidecars) on the cluster nodes. At this point, the dynamic deployment of the initial defense deployment phase is complete.

[0102] Then, the cloud honey point dynamic orchestration system based on software-defined deception defense enters an adaptive loop of solving defense strategies and dynamically orchestrating honey point scheduling according to the iterative defense strategies, based on feedback from the execution layer.

[0103] When an attacker is lured into one of the low-interaction honeypots deployed and tries to perform a high-risk operation (such as SQL injection). The distributed feedback component (Sidecar) deployed within the Pod captures this characteristic traffic by sharing the network namespace, generates structured alerts and feeds back to the control layer in real time.

[0104] The threat perception unit receives high-confidence alert data from the execution layer . The game decision unit immediately updates the state according to the new alert data , and migrates the state from "low-cost reconnaissance" to "high-value exploitation attempt". The strategy solver recalculates : At this time, the intelligence gain from capturing the TTPs of this high-value attacker significantly increases, covering the deployment cost of the high-interaction honeypot . The optimal strategy changes to: immediately upgrade the defense level. When the state transitions from reconnaissance to high-value exploitation attempt, the marginal benefit item of the payoff matrix changes structurally, and the system triggers a strategy level upgrade accordingly; at the same time, through hysteresis and budget control changes, avoid topology shock caused by multiple alerts in a short time. At this time, the output optimal response strategy is: {Action:'DEPLOY',Type:'HI-Web-Vuln',Count:1,TTL:'7200s',Placement: 'High-Fidelity-Zone'} and {Action:'DELETE',Type:'LI-Web',Count:15,TTL: '0',Placement:'Any'}.

[0105] The orchestration control unit receives the iteratively optimized response strategy, issues a re-orchestration instruction to reconfigure the defense topology in real time: destroy the old low-interaction Pod, and deploy a high-interaction Pod containing specific vulnerabilities in the high-fidelity zone, achieving targeted deep luring. Through the southbound protocol orchestration interface, the traffic switching instruction is issued synchronously to dynamically attract the attacker's ongoing session to the high-interaction environment, achieving targeted deep luring.

[0106] All related content of each functional unit involved in the above system embodiment can be applied to the functional unit of the method, and will not be repeated here.

[0107] Those skilled in the art can clearly understand the technical solutions of the present application according to the above description of the embodiments, and for the convenience and brevity of description, only the division of the above functional modules is taken as an example, and in actual application, the above functions can be completed by different functional modules according to needs, that is, the internal structure of the device is divided into different functional modules to complete all or part of the functions described above. The specific working process of the system, device and unit described above can refer to the corresponding process in the foregoing method embodiments, and will not be repeated here.

[0108] The functional units in each embodiment of the present application can be integrated in one processing unit, or each unit can exist physically, or two or more units can be integrated in one unit. The integrated unit can be realized in the form of hardware or in the form of a software functional unit.

[0109] The integrated unit, if realized in the form of a software functional unit and sold or used as an independent product, can be stored in a computer readable storage medium. Based on such understanding, the technical solutions of the embodiments of the present application essentially or in other words the part that contributes to the prior art or the whole or part of the technical solutions can be embodied in the form of a software product. The computer software product is stored in a storage medium, and includes a number of instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) or a processor to execute all or part of the steps of the methods described in the embodiments of the present application. The foregoing storage medium includes: a flash memory, a mobile hard disk, a read-only memory, a random access memory, a magnetic disk or an optical disk, and various media that can store program codes.

[0110] The above description is only a specific implementation of the embodiments of the present application, but the protection scope of the embodiments of the present application is not limited thereto. Any change or replacement within the technical scope disclosed in the embodiments of the present application should be covered in the protection scope of the embodiments of the present application. Therefore, the protection scope of the embodiments of the present application should be subject to the protection scope of the claims.

Claims

1. A dynamic orchestration system for cloud honey points based on software-defined deception defense, characterized in that, include: The control layer and execution layer are built on the foundation of software-defined deception defense. The control layer includes a threat perception unit, a game decision-making unit, and an orchestration control unit. The execution layer includes a cloud-native orchestration unit and a defense resource library. The threat perception unit is used to collect threat intelligence and generate structured intelligence objects; The game decision-making unit is used to solve the optimal response strategy that maximizes the defense effectiveness based on the structured intelligence object and the current defense strategy configuration. The orchestration control unit has a northbound intent programming interface and a southbound protocol orchestration interface. It reads defense strategy status data through the northbound intent programming interface and generates strategy configuration instructions based on the optimal response strategy through the southbound protocol orchestration interface, which are then sent to the cloud-native orchestration unit. The cloud-native orchestration unit responds to policy configuration commands and manages the elastic scheduling and lifecycle of honeypots through Pods. Each Pod deploys a honeypot container and a distributed feedback component that shares resources with the honeypot container. The distributed feedback component detects intrusion behavior and reports it to the threat perception unit in real time. The defense resource library maintains honeypot configuration files used to generate honeypot instances.

2. The system according to claim 1, characterized in that, The threat awareness unit collects threat intelligence by collecting raw threat data streams in real time from the network boundary and receiving intrusion behavior reported by the distributed feedback component; The threat perception unit generates structured intelligence objects by verifying, cleaning, and uniformly formatting the collected raw threat data streams or received intrusion behaviors.

3. The system according to claim 1, characterized in that, The game decision-making unit performs a game-theoretic solution based on the structured intelligence object and the current defense strategy configuration to maximize the optimal response strategy, including: Define a state modeling function to parse the structured intelligence object into the current attack and defense state; Construct an attack and defense benefit matrix based on the current attack and defense status and the current defense strategy configuration; Based on the attack and defense benefit matrix, find the optimal response strategy that maximizes the net utility of the defender under the current attack and defense state.

4. The system according to claim 3, characterized in that, The attack-defense payoff matrix defines the net payoff that the defender can obtain by adopting a defensive strategy under the current attack-defense state. The dynamic utility function of this net payoff is formally defined to satisfy the following formula: ,in, This indicates the current offensive and defensive status of the defending side. The following defensive strategy is adopted in the defensive strategy space. The net profit that can be obtained This indicates that the defending side is implementing a defensive strategy. The total benefits brought about This indicates that the defending side is implementing a defensive strategy. The costs incurred; The formal definition of the process of finding the optimal response strategy satisfies the following formula: ,in, This represents the optimal response strategy obtained by solving the problem. Represents the defense strategy space. This represents the expected net utility under the current offensive and defensive conditions.

5. The system according to claim 1, characterized in that, The orchestration and control unit reads defense strategy status data including: During the startup phase, a read operation is performed to obtain the initial state data of the defense strategy; During the operation phase, when a strategy configuration is modified by manual intervention, a read operation is performed to obtain the current defense strategy status data.

6. The system according to claim 1, characterized in that, The honeypot configuration files maintained by the defense resource repository include honeypot images and parameterized configuration templates for configuring honeypot parameters. The parameterized configuration templates support dynamic parameter adjustments.

7. The system according to claim 1, characterized in that, The distributed feedback component shares storage volumes and network namespaces with the honeypot; The distributed feedback component monitors the honeypot's operating status and network behavior in real time to obtain raw data, extracts security event information from the raw data, and checks intrusion behavior. When an intrusion is detected, the intrusion is encapsulated into an alarm object according to a predefined structure and reported to the threat perception unit.

8. A method for dynamically orchestrating cloud honeypots based on software-defined deception defense, characterized in that, The system described in any one of claims 1-7 is used for dynamic orchestration of cloud honey points, including: The threat perception unit collects threat intelligence and generates structured intelligence objects; The game decision-making unit obtains defense strategy status data from the orchestration and control unit, and performs game solving based on the structured intelligence object and defense strategy status data to obtain the optimal response strategy; The orchestration control unit generates a strategy configuration instruction based on the optimal response strategy and sends it to the cloud-native orchestration unit. The cloud-native orchestration unit schedules the honeypot configuration files in the defense resource repository according to the policy configuration instructions to instantiate Pods containing honeypot containers and distributed feedback components.

9. The method according to claim 8, characterized in that, During the startup phase of the cloud honey point dynamic orchestration system based on software-defined deception defense, the threat perception unit collects raw threat data streams from the network boundary and generates structured intelligence objects, which are then sent to the game decision unit for game solving.

10. The method according to claim 8, characterized in that, The distributed feedback component acquires raw data from honeypots to detect intrusion behavior, and reports the detected intrusion behavior to the threat perception unit. During the operation phase of the cloud honey point dynamic orchestration system based on software-defined deception defense, when the threat perception unit receives a reported intrusion behavior, the threat perception unit generates a structured intelligence object based on the intrusion behavior and sends it to the game decision unit for game solving.

Images