A cloud honey point dynamic arrangement method and system based on software-defined deception defense

Abstract

The application provides a cloud honeypot dynamic arrangement method and system based on software-defined deception defense, the system comprises a base construction control layer and an execution layer based on software-defined deception defense, the control layer comprises a threat perception unit, a game decision unit and an arrangement control unit, and the execution layer comprises a cloud native arrangement unit and a defense resource library; the threat perception unit collects threat intelligence and generates a structured intelligence object; the game decision unit is used for game solving of an optimal response strategy; the arrangement control unit reads defense strategy state data and generates a strategy configuration instruction according to the optimal response strategy, and the strategy configuration instruction is issued to the cloud native arrangement unit; the cloud native arrangement unit responds to the instruction, schedules the defense resource library to instantiate a Pod containing a honeypot container and a distributed feedback component; and the defense resource library maintains a honeypot configuration file used for generating a honeypot instance. Application of the system can realize adaptive closed-loop active defense.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a method and system for dynamic orchestration of cloud honey points based on software-defined deception defense. Background Technology

[0002] As cyberattacks become increasingly complex, deception defense technology based on the concept of proactive defense has become an important component of modern security architecture.

[0003] Currently, various technical solutions have emerged for deception defense technologies, focusing on the automation and dynamism of honeypots / honeysites. However, these solutions face several fundamental technical challenges when dealing with modern automated and intelligent cyber threats:

[0004] Deception defense solutions based on static evaluation and optimization, as well as those based on dynamic correlation and traffic traction, can only optimize or correlate existing honeypot deployments. This results in insufficient deployment elasticity due to static resources, making it impossible to achieve elastic resource deployment when facing large-scale attacks.

[0005] Existing deception defense schemes with dynamic instantiation mainly include those triggered by authenticated users dragging and changing the data, and those based on the assessment of the defender's state. Among these, the user-operated schemes are limited by human intervention and cannot achieve real-time response. The schemes based on the assessment of the defender's state still fall into the category of rigid decision-making that makes the defense predictable when dealing with complex attacks. They cannot make intelligent, non-predictive decisions in real time that are tailored to different attackers' intentions.

[0006] Therefore, it is necessary to provide a deception defense configuration method to enable the dynamic deployment of timely and targeted proactive defense strategies. Summary of the Invention

[0007] The purpose of this invention is to provide a dynamic orchestration method and system for cloud honeypots based on software-defined deception defense, so as to achieve highly reliable closed-loop adaptive proactive defense.

[0008] In a first aspect, the cloud honeypot dynamic orchestration system based on software-defined deception defense provided by this invention includes: a control layer and an execution layer built on the foundation of software-defined deception defense; the control layer includes a threat perception unit, a game decision unit, and an orchestration control unit; the execution layer includes a cloud-native orchestration unit and a defense resource library; the threat perception unit is used to collect threat intelligence and generate structured intelligence objects; the game decision unit is used to solve the optimal response strategy to maximize the defense effectiveness based on the structured intelligence objects and the current defense strategy configuration; the orchestration control unit has a northbound intent programming interface and a southbound protocol orchestration interface, reads defense strategy status data through the northbound intent programming interface, and generates strategy configuration instructions based on the optimal response strategy through the southbound protocol orchestration interface and sends them to the cloud-native orchestration unit; the cloud-native orchestration unit responds to the strategy configuration instructions and manages the elastic scheduling and lifecycle of honeypots through Pods; each Pod deploys a honeypot container and a distributed feedback component that shares resources with the honeypot container; the distributed feedback component detects intrusion behavior and reports it to the threat perception unit in real time; the defense resource library maintains honeypot configuration files used to generate honeypot instances.

[0009] The beneficial effects of the cloud honeypot dynamic orchestration system based on software-defined deception defense provided by this invention are as follows: It decouples the system into a control layer for intelligent decision-making and an execution layer for elastic execution, decoupling control logic from execution resources and achieving physical separation between defense logic and underlying resources. It relies on the attacker's strategy captured in real time by the threat perception unit for game-theoretic decision-making, thereby making more intelligent and targeted non-predictive decisions, achieving intelligent control and automatic response. By sending feedback information from the distributed feedback component back to the control layer in real time, triggering re-modeling and re-decision-making, the system can change the defense topology in real time, achieving highly reliable, low-risk, dynamic adaptive closed-loop proactive defense.

[0010] In one possible embodiment, the threat perception unit collects threat intelligence by collecting raw threat data streams in real time from the network boundary and receiving intrusion behaviors reported by the distributed feedback component; the threat perception unit generates structured intelligence objects by verifying, cleaning, and uniformly formatting the collected raw threat data streams or received intrusion behaviors to generate structured intelligence objects.

[0011] In another possible embodiment, the game decision-making unit solves the game to find the optimal response strategy that maximizes the defense utility based on the structured intelligence object and the current defense strategy configuration, including: defining a state modeling function to parse the structured intelligence object into the current attack and defense state; constructing an attack and defense payoff matrix based on the current attack and defense state and the current defense strategy configuration; and solving the optimal response strategy that maximizes the net utility of the defender under the current attack and defense state based on the attack and defense payoff matrix.

[0012] In other possible embodiments, the attack-defense payoff matrix defines the net payoff that the defender can obtain by adopting a defensive strategy under the current attack-defense state. The dynamic utility function of this net payoff is formally defined to satisfy the following formula: ,in, This indicates the current offensive and defensive status of the defending side. The following defensive strategy is adopted in the defensive strategy space. The net profit that can be obtained This indicates that the defending side is implementing a defensive strategy. The total benefits brought about This indicates that the defending side is implementing a defensive strategy. The cost incurred; the formal definition of the process of solving the optimal response strategy satisfies the following formula: ,in, This represents the optimal response strategy obtained by solving the problem. Represents the defense strategy space. This represents the expected net utility under the current offensive and defensive conditions.

[0013] The orchestration control unit reads defense strategy status data including: performing a read operation during the startup phase to obtain the initial status data of the defense strategy; and performing a read operation during the operation phase to obtain the current defense strategy status data when there is a manual intervention to modify the strategy configuration.

[0014] The honeypot configuration files maintained by the defense resource repository include honeypot images and parameterized configuration templates for configuring honeypot parameters. The parameterized configuration templates support dynamic parameter adjustments.

[0015] The distributed feedback component shares storage volume and network namespace with the honeypot; the distributed feedback component monitors the honeypot's operating status and network behavior in real time to obtain raw data, extracts security event information from the raw data and checks intrusion behavior; when intrusion behavior is detected, it encapsulates the intrusion behavior into an alarm object according to a predefined structure and reports it to the threat perception unit.

[0016] Secondly, this invention also provides a dynamic orchestration method for cloud honeypots based on software-defined deception defense. The method, using the aforementioned system for dynamic orchestration of cloud honeypots, includes: a threat perception unit collecting threat intelligence to generate structured intelligence objects; a game-theoretic decision unit obtaining defense strategy status data from the orchestration control unit; the game-theoretic decision unit performing game-theoretic solutions based on the structured intelligence objects and the defense strategy status data to obtain the optimal response strategy; the orchestration control unit generating a strategy configuration instruction based on the optimal response strategy and issuing it to the cloud-native orchestration unit; and the cloud-native orchestration unit scheduling honeypot configuration files in the defense resource repository according to the strategy configuration instruction to instantiate a Pod containing a honeypot container and a distributed feedback component.

[0017] In one possible embodiment, during the startup phase of the cloud honey point dynamic orchestration system based on software-defined deception defense, the threat perception unit collects raw threat data streams from the network boundary and generates structured intelligence objects, which are then sent to the game decision unit for game solving.

[0018] In another possible embodiment, the distributed feedback component acquires the raw data of the honeypot to detect intrusion behavior, and reports it to the threat perception unit when an intrusion behavior is detected. During the operation of the cloud honeypot dynamic orchestration system based on software-defined deception defense, when the threat perception unit receives the reported intrusion behavior, the threat perception unit generates a structured intelligence object based on the intrusion behavior and sends it to the game decision unit for game solving.

[0019] For the beneficial effects of the second aspect mentioned above, please refer to the description of the first aspect mentioned above. Attached Figure Description

[0020] Figure 1 A schematic diagram of a cloud honey point dynamic orchestration system based on software-defined deception defense provided in an embodiment of the present invention;

[0021] Figure 2 This is a flowchart illustrating a dynamic orchestration method for cloud honeypots based on software-defined deception defense, provided in an embodiment of the present invention. Detailed Implementation

[0022] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions in the embodiments of this invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this invention. All other embodiments obtained by those skilled in the art based on the embodiments of this invention without inventive effort are within the scope of protection of this invention. Unless otherwise defined, the technical or scientific terms used herein should have the ordinary meaning understood by those skilled in the art. The terms "comprising" and similar expressions used herein mean that the element or object preceding the word covers the element or object listed following the word and its equivalents, but do not exclude other elements or objects.

[0023] This embodiment provides a method and system for dynamic orchestration of cloud honeypots based on software-defined deception defense.

[0024] See the instruction manual appendix Figure 1 The cloud honeypot dynamic orchestration system based on software-defined deception defense includes: Software-Defined Deception Defense (SDD) 3The system's foundation consists of a control layer and an execution layer. The control layer includes a threat perception unit, a game-theoretic decision-making unit, and an orchestration control unit. The execution layer includes a cloud-native orchestration unit and a defense resource library. In the cloud honeypot dynamic orchestration system, the control and execution layers are decoupled. The control layer acts as the intelligent decision-making center, responsible for centralized management and intelligent decision-making. The execution layer acts as an elastic operation unit, responsible for standardizing and encapsulating the underlying computing resources, enabling them to quickly create, update, or destroy honeypot environments according to security policy requirements, thereby supporting the elastic scaling of defense resources. The control layer includes a northbound intent programming interface and a southbound protocol orchestration interface. The northbound intent programming interface enables programmable definition of defense logic parameters, while the southbound protocol orchestration interface enables synchronous and collaborative orchestration of computing resources and network paths.

[0025] The threat perception unit is used to collect threat intelligence and generate structured intelligence objects.

[0026] In one possible embodiment, the threat perception unit collects threat intelligence by collecting raw threat data streams in real time from the network boundary and receiving intrusion behaviors reported by the distributed feedback component; the threat perception unit generates structured intelligence objects by verifying, cleaning, and uniformly formatting the collected raw threat data streams or received intrusion behaviors to generate structured intelligence objects.

[0027] For example, the threat awareness unit, as the system's threat awareness interface, is responsible for collecting raw threat data streams in real time from the network boundary (such as firewalls and IDS logs), denoted as... The threat awareness unit is also responsible for receiving intrusion behavior reports from the execution layer, denoted as... The core function of the threat perception unit is data standardization and aggregation. It verifies, cleans, and uniformly formats data to ultimately generate standard structured intelligence objects that can be directly used by the game decision-making unit. Its standard fields include {timestamp, src_ip, src_port, dst_port, protocol, attack_type, confidence}.

[0028] Where: timestamp represents the precise time when the threat behavior or alarm event occurred (e.g., 2025-11-19T10:00:01Z); src_ip represents the source IP address, the source Internet Protocol address that initiated the scanning, probing, or attack behavior; src_port represents the source port, the source port number used by the attacker when initiating the connection; dst_port represents the destination port, the port number accessed by the target (e.g., 80, 22, 445, etc.); protocol represents the protocol type, the communication protocol type used by the attack traffic, such as TCP, UDP, ICMP, etc.; attack_type represents the attack type, the specific attack feature classification identified, such as scanning, SQL injection, SSH brute-force attacks, RCE, etc.; confidence represents the confidence level, the probability (between 0 and 1) of the system's accurate judgment of the threat, used for weight compensation in game-theoretic decision-making.

[0029] The game decision-making unit is used to solve the optimal response strategy that maximizes the defense effectiveness based on the structured intelligence object and the current defense strategy configuration.

[0030] In one possible embodiment, the game decision-making unit performs a game-theoretic solution to maximize the defense utility based on the structured intelligence object and the current defense strategy configuration, including: defining a state modeling function to parse the structured intelligence object into the current attack and defense state; constructing an attack and defense payoff matrix based on the current attack and defense state and the current defense strategy configuration; and solving for the optimal response strategy that maximizes the net utility of the defender under the current attack and defense state based on the attack and defense payoff matrix.

[0031] The attack-defense payoff matrix defines the net payoff that the defender can obtain by adopting a defensive strategy under the current attack-defense state. The dynamic utility function of this net payoff is formally defined to satisfy the following formula: ,in, This indicates the current offensive and defensive status of the defending side. The following defensive strategy is adopted in the defensive strategy space. The net profit that can be obtained This indicates that the defending side is implementing a defensive strategy. The total benefits brought about This indicates that the defending side is implementing a defensive strategy. The cost incurred; the formal definition of the process of solving the optimal response strategy satisfies the following formula: ,in, This represents the optimal response strategy obtained by solving the problem. Represents the defense strategy space. This represents the expected net utility under the current offensive and defensive conditions.

[0032] In one specific embodiment, the structured intelligence object output by the threat perception unit is a standardized raw threat data stream. Or intrusion behavior after standardization Specifically, during the system startup phase, the structured intelligence objects output by the threat perception unit are: During the system operation phase, the structured intelligence objects output by the threat perception unit are... .

[0033] The game decision-making unit is a programmable central decision-making unit that drives and maintains a global offensive and defensive state by integrating standard structured intelligence output from the threat perception unit. This enables dynamic perception of the intrusion situation at the execution layer at the semantic level, and the generation of targeted reordering strategies through game theory algorithms, thereby achieving fine-grained and programmable scheduling of underlying resources.

[0034] The game decision-making unit includes an attack-defense state modeler, an attack-defense payoff matrix, and a strategy solver. Before attack-defense state modeling, the modeler is used to parse the structured intelligence objects output by the threat perception unit into attack-defense states. The attack-defense payoff matrix is ​​the quantitative basis for the strategy solver to make decisions, and formally defines the net payoff that the defender can obtain by taking a certain defense strategy under the current attack-defense state. The strategy solver observes the current attack-defense state determined by the attack-defense state modeler and solves the optimal response strategy that maximizes the net utility of the defender under the current attack-defense state.

[0035] Define a state modeling function Structured intelligence objects are parsed into offensive and defensive states. : For example, when When a scan includes multiple unrelated ports from the same source IP (e.g., {src_ip:A,dst_port:[22,23,80,445]}), It is modeled as "Broad Reconnaissance". When When it contains attack signatures targeting a specific port (such as {src_ip:A,dst_port:22,attack_type:"SSH_Exploit_Attempt"}), It was modeled as "Aggressive_Exploit_SSH". When When attempting a "high-risk RCE", It is modeled as "High_Value_Exploit_Attempt".

[0036] Specifically, offensive and defensive state modeling is not a simple mechanical mapping of structured intelligence objects, but rather a process implemented through state modeling functions. Achieving alignment and standardization of heterogeneous semantics: Focusing on macroscopic detection behavior, while Both focus on micro-level exploitation features, resulting in differences in intelligence granularity. The attack-defense state modeler transforms differentiated input fields into a consistent discrete state space through a unified structured link. This ensures that the benefit matrix can evaluate the net utility of different defense strategies under the same caliber. During this process, the attack and defense state modeler will also adjust the intelligence source... and Perform confidence-weighted correction. This is due to intrusion behavior reported by the execution layer ( This approach offers higher attack certainty and, through weight compensation, ensures higher priority when triggering state transitions (such as from reconnaissance to high-value exploitation). This confidence-weighted semantic alignment mechanism ensures the discrete state space... It can accurately reflect the true offensive and defensive situation, thereby avoiding decision-making bias caused by heterogeneous data noise.

[0037] The attack-defense state modeler's modeling process is deeply collaborative with the real-time feedback of intrusion behavior from the execution layer to construct an execution-driven dynamic state machine closed loop. When the execution layer captures specific intrusion behavior characteristics of the attacker and transmits the data back to the control layer, the attack-defense state modeler immediately triggers a state transition. This invention, by designing this attack-defense state modeling mechanism centered on state transition, transforms the game decision-making unit from a static evaluation tool into a real-time operating control layer decision-making center. The system achieves rapid tracking of the evolution of attack intentions through a closed loop of receiving execution layer perception information, control layer attack-defense state modeling, state machine transition, and re-solving of defense strategies. This ensures that the system can trigger real-time re-solving of defense strategies based on state transitions, solving the technical problem of traditional defense schemes where strategy adjustments lag behind attack progress.

[0038] The attack-defense payoff matrix defines the net gain that the defender can obtain by adopting a certain defensive strategy under the current attack-defense state. Specifically, the net gain is defined as the difference between the gain and the cost, and its dynamic utility function is formally defined as follows: ,in, This represents the net utility of the defender, indicating the defender's (Cloud Honey Point Dynamic Orchestration System) performance in the current attack and defense state. Below, adopt a defensive strategy space. A certain defensive strategy The net benefit that can be obtained is that the optimization objective of the policy solver is to find a value that allows... A strategy to maximize value; Represents the total benefit to the defender, and is used to calculate the execution of a defense strategy. The total benefit or positive value derived is quantified by a function. In this invention, the total benefit of the defender represents the total benefit in the current state. Next, by deploying defense strategies The intelligence value that can be captured (e.g., successfully capturing attackers' TTPs) can be obtained by deploying honeypoint-web. Represents the cost to the defender, which is used to calculate the cost of implementing a defense strategy. The quantification function of the costs that must be paid: the cost to the defender is composed of static resource consumption (such as CPU, memory, etc.), cloud-based dynamic overhead (such as container cold start, image pull and scheduling latency), and system stability costs (such as the overhead of change frequency caused by frequent switching of defense strategies); Describing a defense strategy is done from the defender's strategy space. The specific strategy selected is a defense strategy. The standard form of the defense strategy is {Action, Type, Count, TTL, Placement}. For example, the specific content of the defense strategy can be: {Action:'DEPLOY', Type:'LI-Web', Count:15, TTL:'3600s', Placement:'Honeynet-Node-Pool'}.

[0039] The dynamic utility function for the defender's net gain designed in this invention can strictly align game parameters with the resource quantification benchmark of cloud-native orchestration units, thereby supporting executable strategy comparisons. In the dynamic utility function, the design of cost and gain terms considers both static and dynamic factors in the system from multiple perspectives, enabling it to counter attackers' attempts to induce excessive scaling by the defender through low-cost probing. In the game, a non-linear cost-benefit trade-off causes the game equilibrium point to spontaneously shift with the evolution of attack intent and fluctuations in real-time environmental factors (such as current cluster computing power load and intelligence freshness). Under this design, gains and costs fluctuate dynamically, making it impossible for attackers to infer the system's defense trigger boundary through a limited number of probes. This greatly enhances the unpredictability of the defense topology and effectively solves the technical problem of defense boundaries being easily probed and evaded.

[0040] Furthermore, the defense strategy is defined as an action tuple that can be expressed by execution layer resource templates and orchestration platform API primitives. This strategy-as-code design ensures that the game decision results can be accurately mapped to the orchestration atomic operations of cloud-native orchestration units, achieving deep decoupling and collaboration between decision intelligence and physical execution, and realizing instantaneous reconstruction of the defense topology at the physical execution layer.

[0041] The strategy solver runs a game theory algorithm, employing an observation and response method to observe the current attack and defense state as determined by the attack and defense state modeler. And solve for the net utility of the defender under the current attack and defense state. Maximize the optimal response strategy The process of solving the optimal response strategy can be formally defined as follows: ,in, This represents the optimal response strategy obtained by solving the problem. This represents the expected net utility under the current offensive and defensive conditions.

[0042] To ensure the feasibility of the game theory model designed in this invention in heterogeneous and dynamic cloud-native environments, this invention designs a synergy between game decision-making logic and underlying resource constraints, as well as system operational robustness:

[0043] When solving for the globally optimal response strategy, the solver must be defined to satisfy the following conditions: Resource boundary constraints, among which, This indicates the index of the currently detected concurrent attack sources. This refers to the real-time global resource budget ceiling reported by the execution layer. During the solution process, the resource quota status reported by the execution layer is retrieved synchronously. If the current cluster resources are critically low, [further action is taken]. The surge is approaching The game decision-making unit will automatically avoid high-energy-consuming strategies and instead focus on strategies in the strategy space. The goal is to find suboptimal but low-energy defense topology solutions (e.g., using lightweight container combinations to replace heavyweight virtual machine honeypots) to ensure the strong feasibility of decisions in the physical environment, and to make the solutions... It directly corresponds to cloud-native atomic instructions that can be executed at the execution layer.

[0044] A closed-loop design is implemented between the strategy solving and the feedback mechanism of the execution layer to ensure the validity of dynamic game theory in engineering. When the execution layer detects high-confidence attack behavior and transmits it back in real time through a high-performance message channel, the control layer immediately triggers state transitions and recalculations of the dynamic utility function. This execution-driven decision-making model ensures that strategy solving can iterate rapidly as the attack intent evolves.

[0045] The system incorporates control logic such as cooldown time, policy hysteresis, and change budget during the solution and strategy execution phases. These mechanisms enable the system to achieve a configurable balance between rapid threat response and operational stability / resource control, ensuring that the system can maintain a stable defense posture when facing persistent attacks or high-frequency noise interference, and avoiding negative performance impacts on the business cluster caused by frequent scaling operations.

[0046] The orchestration control unit has a northbound intent programming interface and a southbound protocol orchestration interface. It reads defense policy status data through the northbound intent programming interface to achieve declarative management of defense policies, and generates policy configuration instructions based on the optimal response policy through the southbound protocol orchestration interface and sends them to the cloud-native orchestration unit to achieve atomic driving of underlying resources.

[0047] In one possible embodiment, the orchestration control unit reads the defense strategy status data by: performing a read operation during the startup phase to obtain the initial status data of the defense strategy; and performing a read operation to obtain the current defense strategy status data when there is a manual intervention to modify the strategy configuration during the operation phase.

[0048] The orchestration control unit, as the instruction translation and issuance unit of the control layer, serves as a bridge connecting the control layer and the execution layer. Specifically, the orchestration control unit implements SD... 3 The southbound protocol abstraction layer in the architecture. The orchestration control unit is not simply a forwarder of control layer instructions, but rather transforms the optimal response strategy output by the game decision unit into atomic operations understandable to the execution layer through predefined mapping logic. This abstract design of the southbound protocol orchestration interface enables the system to have cross-platform compatibility, completely decoupling the complex deception defense logic from the orchestration details of the underlying cloud-native orchestration unit.

[0049] In one possible embodiment, the main functions of the orchestration control unit can be described as two parts: policy loading implemented through the northbound intent programming interface and instruction translation implemented through the southbound protocol orchestration interface. Policy loading includes: during system startup, the orchestration control unit performs a read operation to obtain the initial state of the defense strategy, acquiring initial values ​​for the defender's total revenue and cost as the initial basis for the game decision-making unit's decision; during operation, to achieve dynamic adjustment, when maintenance personnel or users modify and save the policy configuration through manual intervention, the orchestration control unit re-executes the read operation to obtain the updated quantified values ​​of the defender's total revenue and cost, and provides the new values ​​to the game decision-making unit. Instruction translation refers to translating the optimal response strategy output by the game decision-making unit into specific, programmable API calls from the translation layer to the execution layer.

[0050] In one specific embodiment, the orchestration control unit is designed as an SD 3 Programming controller.

[0051] In one specific embodiment, the read operation performed by the orchestration control unit during system startup can be as follows: by calling a function in the cloud-native API (i.e., Kubernetes CoreV1 API), the unit reads and parses the YAML / JSON data in the policy configuration ConfigMap named honeypoint-strategy-matrix to obtain the initial values ​​of the total defender's benefit and cost. During system operation, the orchestration control unit initiates a long-lived watch connection to the Kubernetes API server for the ConfigMap. When an operations staff member (or user) modifies and saves the policy configuration object using methods such as kubectl edit, the Kubernetes API server immediately sends a MODIFIED event to the orchestration control unit through this connection. Upon receiving this event, the orchestration control unit immediately re-executes the read operation to obtain the updated quantified values ​​of the total defender's benefit and cost.

[0052] The policy loading mechanism of the orchestration control unit is designed to support storing complex attack and defense benefit matrices as standard resource objects of cloud-native orchestration units, achieving declarative management of "policy as code." This "policy as code" implementation constitutes the northbound programming interface of the cloud honeypot dynamic orchestration system based on software-defined deception defense. Security administrators or upper-layer security orchestration systems do not need to concern themselves with how the underlying image is pulled or how containers are scaled, nor do they need to log into specific honeypot container instances. They only need to modify the ConfigMap to dynamically program game parameters such as intelligence value weights and resource penalty costs. This northbound driven model ensures that the deception defense logic can quickly and instantly switch and restructure its topology as business logic changes, achieving software-defined deception defense capabilities.

[0053] In one specific embodiment, when the orchestration control unit receives the optimal response policy, it translates it into an instruction output to the Kubernetes API. During the instruction translation process, the orchestration control unit decouples the five-tuple parameters in the optimal response policy from the cloud-native resource objects:

[0054] Action (action metaphrase): Maps to the type of operation request in the Kubernetes API. For example, DEPLOY maps to the create operation, PATCH / SCALE maps to the patch operation, and DELETE maps to the delete operation. Besides controlling the Pod lifecycle, Actions in SD... 3The semantics also encompass dynamic orchestration of the network forwarding plane. For example, when a DEPLOY operation is executed, the controller synchronously sends Service or Ingress rule update instructions to the execution layer. By modifying the Label Selector or traffic weights, suspected attack traffic originally directed to business nodes is dynamically redirected to newly generated honeypot instances, thereby achieving SD (Secure, Deploy, and Operate) functionality. 3 Coordinated orchestration of computing resources and network paths.

[0055] Type (Resource Type): Mapped to the container image tag in the Pod template. The controller dynamically retrieves the corresponding image address and environment variable template from the deception repository based on the Type field.

[0056] Count (Deployment Scale): Mapped to the spec.replicas specification of the Deployment resource object, directly controlling the concurrent number of honeypot instances in the cluster.

[0057] TTL (Time To Live): Mapped to the lifecycle annotations of Pods. The orchestration and control unit marks the time to live in the metadata annotations, and implements automatic destruction upon expiration through the cleanup mechanism of the control layer to maintain the dynamic freshness of the defense topology.

[0058] Placement: Mapped to the node affinity configuration of the cloud-native orchestration unit, either nodeAffinity or nodeSelector. This determines whether the honeypot is deployed on a specific security observation node or physically isolated from business nodes, ensuring the accurate deployment of defense strategies within the physical cluster.

[0059] For example, when the optimal response strategy is received... When `={Action:'PATCH',Type:'LI-Cowrie',Count:10,TTL:'3600s',Placement: 'honeypoint-node-pool'}` is executed, the orchestration control unit will translate it into a set of composite API call instructions in the following form: `client.AppsV1Api().patch_namespaced_deployment(name='cowrie-honeypoint',namespace='default',body={'spec':{'replicas':10,'template':{'metadata':{'annotations':{'deception.io / ttl':'3600s'}},'spec':{'containers':[{'name':'honeypoint','image':'registry / li-cowrie:v1'}], 'nodeSelector':{'pool':'honeypoint-pool'}}}}}}`.

[0060] The cloud-native orchestration unit responds to policy configuration commands and manages the elastic scheduling and lifecycle of honeypots through Pods. Each Pod deploys honeypot containers and distributed feedback components that share resources with the honeypot containers. The distributed feedback components detect intrusion behavior and report it to the threat awareness unit in real time.

[0061] In one possible implementation, the cloud-native orchestration unit hosts all honeypot container instances in the system and is responsible for the entire lifecycle management of these instances, from startup to destruction. Based on resource configuration requirements (such as CPU and memory limits and node affinity rules) issued by the control layer, the cloud-native orchestration unit uses a scheduling algorithm to allocate honeypot containers to the most suitable server nodes in the cluster for execution. This allows the system to respond promptly to dynamic scaling needs, from single decoy probes to large-scale honeynets, without manual intervention, ensuring minimal defense resource consumption (i.e., defender costs). Achieving a balance between performance and resilience is key to achieving resilient defense.

[0062] In one specific embodiment, the cloud-native orchestration unit is built using a Kubernetes (K8s) cluster and has a built-in advanced scheduler. The advanced scheduler schedules honeypot containers, and the orchestration control unit is SD. 3 Orchestration Controller. The cloud-native orchestration unit exposes a standardized, declarative RESTful API interface to the control layer, constituting SD... 3The programmable foundation, through RESTful API interfaces, SD 3 The orchestration controller can precisely manipulate underlying resources using an infrastructure-as-code approach. It leverages Deployments to manage the rapid replication and scaling of stateless honeypots, constructs dynamic network access points through Services, and dynamically injects spoofed environment configurations and fake credential data using resource configuration ConfigMaps and Secrets. This interface design abstracts away the complexity of the underlying hardware and network, allowing the control layer to focus only on the logical generation of defense strategies, while the specific execution and state maintenance are automatically handled by the cloud-native orchestration unit.

[0063] In one possible embodiment, the distributed feedback component shares a storage volume and network namespace with the honeypot; the distributed feedback component monitors the honeypot's operating status and network behavior in real time to obtain raw data, extracts security event information from the raw data and checks intrusion behavior; when intrusion behavior is detected, it encapsulates the intrusion behavior into an alarm object according to a predefined structure and reports it to the threat perception unit.

[0064] The distributed feedback component is a detection unit embedded in the execution layer, mainly responsible for the situational feedback between the execution end and the decision-making end.

[0065] In one possible implementation, the distributed feedback component is a lightweight log broker container, employing the Sidecar design pattern in a cloud-native environment. The distributed feedback component does not modify any code of the honeypoint image; instead, it is deployed as an auxiliary container within the same Pod (Kubernetes' smallest scheduling unit). The honeypoint containers deployed within each Pod share resources with the distributed feedback component. Specifically, the distributed feedback component and the honeypoint image share the same storage volume and network namespace. The shared storage volume enables file-level interoperability, allowing the distributed feedback component to directly read log files generated by the honeypoint. The shared network namespace enables transparent reuse of the network stack, allowing the distributed feedback component to directly monitor the localhost traffic of the honeypoint containers, thus achieving non-intrusive monitoring of the honeypoint's operational status and network behavior.

[0066] In a specific embodiment, the distributed feedback component operates by including localized data collection and cleaning, and structured alarm reporting. The specific workflow is as follows:

[0067] The distributed feedback component obtains raw data by tracking the standard output stream of the honeypot container or application log files in real time. To reduce the computational burden on the control layer, the distributed feedback component performs preliminary data cleaning on-site at the data source (i.e., inside the Pod) using regular expression matching or a rule engine. For example, it automatically filters out invalid heartbeat logs or noisy data, extracting only critical security event information.

[0068] When a confirmed intrusion is detected (such as identifying an attacker executing wget to download a malicious file, or capturing specific SQL injection traffic through a shared network interface), the distributed feedback component encapsulates the unstructured intrusion behavior into a predefined JSON alert object at the source (within the Pod), denoted as . Although the encapsulated alarm objects already possess structured characteristics (such as timestamps and source IPs), they are treated as execution-layer feedback data to distinguish them from network boundary data. This source-side structured processing eliminates the format differences of heterogeneous honeypot logs, greatly reduces the data cleaning burden on the control layer, and provides high-quality input data for upper-layer threat perception modules.

[0069] For example, a typical The object contains the following fields:

[0070] {

[0071] "timestamp": "2025-11-19T10:00:01Z",

[0072] "src_ip": "192.168.1.5",

[0073] "src_port": 54321,

[0074] "dst_port": 80,

[0075] "protocol": "TCP",

[0076] "attack_type": "SQL_Injection_Attempt",

[0077] "confidence": 0.95

[0078] }

[0079] This structured processing eliminates the format differences between heterogeneous honeypot logs, providing a unified input standard for the upper-level game decision engine.

[0080] The encapsulated alarm objects are transmitted back to the threat awareness unit in the control layer in real time via a high-performance internal messaging channel (such as gRPC). This mechanism ensures that the control layer can obtain low-latency, real-time situational information, thereby rapidly updating the attack and defense status. As the offensive and defensive states update, the game decision-making unit will recalculate the defender's total gains. and defensive net effectiveness This triggers the next round of decision-making (for example, the strategy solver determines that the benefits of upgrading the defense strategy are significantly different at this time, and thus instructs the orchestration control unit to perform dynamic adjustment of honeypot resources).

[0081] The defense resource repository maintains the honeypot configuration files used to generate honeypot instances.

[0082] In one possible embodiment, the honeypot configuration file maintained by the defense resource repository includes a honeypot image and a parameterized configuration template for configuring honeypot parameters, the parameterized configuration template supporting dynamic parameter adjustment.

[0083] In one specific embodiment, the defense resource repository serves as the centralized storage and management center for the system's defense resources. The repository does not directly run honeypots; instead, it maintains all standardized static files used to generate honeypot instances. Through the categorized management of these fundamental defense resources, the system can quickly assemble different types of defense environments without rewriting code.

[0084] The defense resource library mainly includes two types of resources: multimodal honeypot images and parameterized configuration templates. Multimodal honeypot images are pre-made, standardized container images. To meet different defense needs, multimodal honeypot images include environments with different levels of simulation, including low-interaction basic simulation images and high-interaction deep simulation images. Specifically, basic simulation images only simulate the network ports or basic protocols of specific services (such as simulating an SSH login interface). These images consume very few resources and are suitable for large-scale deployment, used to quickly detect scanning behavior in the network. Deep simulation images contain complete operating systems or real business application software (such as web systems with specific vulnerabilities). Although these images consume more resources, they provide a realistic operating environment to induce attackers to infiltrate through vulnerabilities, thereby recording the complete attack process. Parameterized configuration templates are a set of standardized resource description files, which are the general definitions for generating honeypots. Unlike fixed configuration files, parameterized configuration templates support dynamic parameter adjustment. During system runtime, the orchestration control unit can inject different parameters into the template (e.g., masquerading as different versions of server information, setting specific fake data, or adjusting service ports). The same image, combined with different configuration parameters, can be used to quickly instantiate honeypot instances with different appearances, thereby increasing the diversity of the deception environment.

[0085] The cloud honeypot dynamic orchestration system based on software-defined deception defense provided by this invention decouples the control layer from the execution layer, achieving physical separation between defense control logic and underlying execution resources. This also eliminates the need for security administrators to configure honeypots individually; instead, they can manage the entire network's defense logic by modifying the policy configuration object in the control layer. The orchestration control unit automatically translates the optimal response strategy into underlying API instructions, realizing software-defined and dynamic programming of defense capabilities, significantly reducing the operational complexity of large-scale deployments.

[0086] This invention utilizes game theory decision-making units and a dynamic payoff matrix to perform cost-benefit analysis based on the real-time value of the attacker's behavior. It dynamically solves for the optimal strategy that maximizes the defender's net utility based on the constantly updated attack and defense status, thereby achieving dynamic and intelligent decision-making for different attack intentions. This ensures that the system can dynamically adjust its defense strength according to different attack stages, making the defense behavior highly intelligent and unpredictable, effectively countering attackers' evasion and detection, and solving the problem of rigid defense strategy deployment in existing technologies.

[0087] Leveraging Kubernetes as the execution platform, standardized encapsulation of deception resources and large-scale (from 0 to N) second-level elastic scaling are achieved, effectively responding to sudden large-scale botnet attacks. Through shared storage volumes and network namespaces, non-intrusive capture and real-time feedback of intrusion behavior are achieved without modifying the honeypot image or relying on kernel hooks. The innovative distributed feedback component's feedback mechanism provides a lightweight, non-intrusive intelligence feedback channel, ensuring the control layer can perceive situational changes in real time and automatically trigger the OODA loop, achieving closed-loop adaptive proactive defense.

[0088] Overall, the cloud honeypot dynamic orchestration system based on software-defined deception defense of this invention forms a novel proactive defense system by designing a decoupled control layer and execution layer, and establishing a mechanism for real-time triggering and resolving defense strategies with attack-defense state transitions as the core. This solves the problem of rigid defense deployment in existing technologies and improves the intelligence and unpredictability of defense strategies. The design of game theory decision-making, the constraints unique to the cloud-native environment, and the coordination of various aspects of system operation ensure the feasibility of the cloud honeypot dynamic orchestration system based on software-defined deception defense under the new design architecture, and enables rapid iteration of defense strategy solutions as attack intentions evolve.

[0089] See the instruction manual appendix Figure 2 This embodiment also provides a method for dynamic orchestration of cloud honey points based on software-defined deception defense. This method applies the dynamic orchestration system for cloud honey points in the above system embodiment to achieve dynamic defense deployment. The method includes:

[0090] S101: The threat perception unit collects threat intelligence and generates structured intelligence objects.

[0091] In one possible embodiment, during the startup phase of the cloud honey point dynamic orchestration system based on software-defined deception defense, the threat perception unit collects raw threat data streams from the network boundary and generates structured intelligence objects, which are then sent to the game decision unit for game solving.

[0092] In one possible embodiment, the distributed feedback component acquires raw data from honeypots to detect intrusion behavior, and reports it to the threat perception unit when intrusion behavior is detected. During the operation phase of the cloud honeypot dynamic orchestration system based on software-defined deception defense, when the threat perception unit receives the reported intrusion behavior, the threat perception unit generates a structured intelligence object based on the intrusion behavior and sends it to the game decision unit for game solving.

[0093] S102: The game decision-making unit obtains the defense strategy status data from the orchestration and control unit, and performs game solving based on the structured intelligence object and the defense strategy status data to obtain the optimal response strategy.

[0094] S103: The orchestration control unit generates a strategy configuration instruction based on the optimal response strategy and sends it to the cloud-native orchestration unit.

[0095] S104: The cloud-native orchestration unit schedules honeypot configuration files in the defense resource repository according to policy configuration instructions to instantiate Pods containing honeypot containers and distributed feedback components.

[0096] After startup, the cloud honey point dynamic orchestration system based on software-defined deception defense enters the initial defense deployment stage, and then enters an adaptive loop to solve the defense strategy based on the feedback from the execution layer.

[0097] In one specific embodiment, the cloud honeypot dynamic orchestration system based on software-defined deception defense is activated. The system's threat awareness unit monitors network boundary traffic in real time: detecting external IPs initiating port scans on internal network segments. The threat awareness unit collects this threat data stream. .

[0098] The game decision-making unit receives data from the threat perception unit, and the attack and defense state modeler uses functions This behavior is analyzed into a specific offensive and defensive state: the current offensive and defensive state is a low-cost reconnaissance state.

[0099] The strategy solver is based on the current attack and defense state. and loaded from the policy configuration ConfigMap (Profits) and (Cost) value, running game theory algorithm: The system assessment believes that, under the "low-cost reconnaissance" state, the resource consumption and operation and maintenance costs of deploying high-interaction honeypots are... Far exceeding the intelligence gains it captured This leads to net utility The decline, therefore, the optimal strategy is solved. This involves deploying low-interaction honeypots for wide-coverage probing. During this process, the policy solver simultaneously retrieves engineering constraints from the execution layer, such as global resource budget, scaling rate limits, and cooldown times. Policy space Perform feasibility filtering to ensure that the output strategy can be used by SD. 3 The orchestration controller executes immediately without incurring resource exhaustion risks. The optimal response strategy output is: {Action:'DEPLOY',Type:'LI-Web',Count:15,TTL:'3600s',Placement:'Low-Priority-Node'}.

[0100] The orchestration and control unit receives the optimal response policy and translates it into specific, programmable Kubernetes API call instructions. This process achieves precise orchestration and delivery of underlying defense resources by mapping Action to operation request type, Type to container image tag, Count to replica count specification, TTL to lifecycle annotation, and Placement to node affinity configuration: when the five-tuple of the above optimal response policy is received, SD... 3 The orchestration controller calls the API to create a Deployment resource containing 15 replicas, specifying a low-interaction image, annotating it with a 1-hour lifecycle, and scheduled to a low-priority node. Meanwhile, SD... 3 The orchestration controller synchronously updates the Service forwarding rules to ensure that suspected attack traffic is accurately directed to the newly generated low-interaction honeypots.

[0101] The cloud-native orchestration unit at the execution layer responds to API commands: the scheduler launches 15 honeypot container instances (Pods) and their bound distributed feedback components (Sidecars) on the cluster nodes. At this point, the dynamic deployment of the initial defense deployment phase is complete.

[0102] Then, the cloud honey point dynamic orchestration system based on software-defined deception defense enters an adaptive loop of solving defense strategies and dynamically orchestrating honey point scheduling based on the iterative defense strategies, according to the feedback from the execution layer.

[0103] When an attacker is lured into one of the low-interaction honeypots and attempts to perform a high-risk operation (such as SQL injection), the distributed feedback component (Sidecar) deployed within the Pod captures this characteristic traffic through a shared network namespace and generates a structured alert. And transmit it back to the control layer in real time.

[0104] The threat perception unit received high-confidence alarm data from the execution layer. The game decision-making unit immediately updates the status based on the new alarm data. The state is shifted from "low-cost reconnaissance" to "high-value exploitation attempt." The policy solver recalculates. The intelligence gains from capturing the TTPs of this high-value attacker at this time. Significantly increased, covering the deployment cost of high-interaction honeypots. Optimal strategy Change to: Immediately upgrade defense level. When the state transitions from reconnaissance to high-value exploitation attempt, the marginal benefit items in the benefit matrix undergo a structural change, triggering a strategy level upgrade accordingly. Simultaneously, hysteresis and budget adjustment controls prevent topology oscillations caused by multiple alarms in a short period. The optimal response strategy output at this time is: {Action:'DEPLOY',Type:'HI-Web-Vuln',Count:1,TTL:'7200s',Placement: 'High-Fidelity-Zone'} and {Action:'DELETE',Type:'LI-Web',Count:15,TTL: '0',Placement:'Any'}.

[0105] The orchestration control unit receives the optimal response strategy after iteration and issues re-orchestration commands to reconstruct the defense topology in real time: destroying old low-interaction Pods and deploying high-interaction Pods containing specific vulnerabilities in high-fidelity areas to achieve targeted deep trapping. Traffic switching commands are synchronously issued through the southbound protocol orchestration interface to dynamically redirect the attacker's ongoing sessions to the high-interaction environment, achieving targeted deep trapping.

[0106] All relevant content of the functional units involved in the above system embodiments can be referenced to the functional units applied in the method, and will not be repeated here.

[0107] Through the above description of the embodiments, those skilled in the art will clearly understand that, for the sake of convenience and brevity, only the division of the above functional modules is used as an example. In practical applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above. The specific working process of the system, device, and unit described above can be referred to the corresponding process in the foregoing method embodiments, and will not be repeated here.

[0108] In the embodiments of this application, the functional units can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0109] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solutions of the embodiments of this application, essentially, or the parts that contribute to the prior art, or all or part of the technical solutions, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) or processor to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as flash memory, portable hard disk, read-only memory, random access memory, magnetic disk, or optical disk.

[0110] The above description is merely a specific implementation of the embodiments of this application, but the protection scope of the embodiments of this application is not limited thereto. Any changes or substitutions within the technical scope disclosed in the embodiments of this application should be covered within the protection scope of the embodiments of this application. Therefore, the protection scope of the embodiments of this application should be determined by the protection scope of the claims.

Claims

1. A dynamic orchestration system for cloud honey points based on software-defined deception defense, characterized in that, include: The control layer and execution layer are built on the foundation of software-defined deception defense. The control layer includes a threat perception unit, a game decision-making unit, and an orchestration control unit. The execution layer includes a cloud-native orchestration unit and a defense resource library. The threat perception unit is used to collect threat intelligence and generate structured intelligence objects; The game decision-making unit is used to solve the optimal response strategy that maximizes the defense effectiveness based on the structured intelligence object and the current defense strategy configuration. The orchestration control unit has a northbound intent programming interface and a southbound protocol orchestration interface. It reads defense strategy status data through the northbound intent programming interface and generates strategy configuration instructions based on the optimal response strategy through the southbound protocol orchestration interface, which are then sent to the cloud-native orchestration unit. The cloud-native orchestration unit responds to policy configuration commands and manages the elastic scheduling and lifecycle of honeypots through Pods. Each Pod deploys a honeypot container and a distributed feedback component that shares resources with the honeypot container. The distributed feedback component detects intrusion behavior and reports it to the threat perception unit in real time. The defense resource library maintains honeypot configuration files used to generate honeypot instances.

2. The system according to claim 1, characterized in that, The threat awareness unit collects threat intelligence by collecting raw threat data streams in real time from the network boundary and receiving intrusion behavior reported by the distributed feedback component; The threat perception unit generates structured intelligence objects by verifying, cleaning, and uniformly formatting the collected raw threat data streams or received intrusion behaviors to generate structured intelligence objects.

3. The system according to claim 1, characterized in that, The game decision-making unit performs a game-theoretic solution based on the structured intelligence object and the current defense strategy configuration to maximize the optimal response strategy, including: Define a state modeling function to parse the structured intelligence object into the current attack and defense state; Construct an attack and defense benefit matrix based on the current attack and defense status and the current defense strategy configuration; Based on the attack and defense benefit matrix, find the optimal response strategy that maximizes the net utility of the defender under the current attack and defense state.

4. The system according to claim 3, characterized in that, The attack-defense payoff matrix defines the net payoff that the defender can obtain by adopting a defensive strategy under the current attack-defense state. The dynamic utility function of this net payoff is formally defined to satisfy the following formula: ,in, This indicates the current offensive and defensive status of the defending side. The following defensive strategy is adopted in the defensive strategy space. The net profit that can be obtained This indicates that the defending side is implementing a defensive strategy. The total benefits brought about This indicates that the defending side is implementing a defensive strategy. The costs incurred; The formal definition of the process of finding the optimal response strategy satisfies the following formula: ,in, This represents the optimal response strategy obtained by solving the problem. Represents the defense strategy space. This represents the expected net utility under the current offensive and defensive conditions.

5. The system according to claim 1, characterized in that, The orchestration and control unit reads defense strategy status data including: During the startup phase, a read operation is performed to obtain the initial state data of the defense strategy; During the operation phase, when a strategy configuration is modified by manual intervention, a read operation is performed to obtain the current defense strategy status data.

6. The system according to claim 1, characterized in that, The honeypot configuration files maintained by the defense resource repository include honeypot images and parameterized configuration templates for configuring honeypot parameters. The parameterized configuration templates support dynamic parameter adjustments.

7. The system according to claim 1, characterized in that, The distributed feedback component shares storage volumes and network namespaces with the honeypot; The distributed feedback component monitors the honeypot's operating status and network behavior in real time to obtain raw data, extracts security event information from the raw data, and checks intrusion behavior. When an intrusion is detected, the intrusion is encapsulated into an alarm object according to a predefined structure and reported to the threat perception unit.

8. A method for dynamically orchestrating cloud honeypots based on software-defined deception defense, characterized in that, The system described in any one of claims 1-7 is used for dynamic orchestration of cloud honey points, including: The threat perception unit collects threat intelligence and generates structured intelligence objects; The game decision-making unit obtains defense strategy status data from the orchestration and control unit, and performs game solving based on the structured intelligence object and defense strategy status data to obtain the optimal response strategy; The orchestration control unit generates a strategy configuration instruction based on the optimal response strategy and sends it to the cloud-native orchestration unit. The cloud-native orchestration unit schedules the honeypot configuration files in the defense resource repository according to the policy configuration instructions to instantiate Pods containing honeypot containers and distributed feedback components.

9. The method according to claim 8, characterized in that, During the startup phase of the cloud honey point dynamic orchestration system based on software-defined deception defense, the threat perception unit collects raw threat data streams from the network boundary and generates structured intelligence objects, which are then sent to the game decision unit for game solving.

10. The method according to claim 8, characterized in that, The distributed feedback component acquires raw data from honeypots to detect intrusion behavior, and reports the detected intrusion behavior to the threat perception unit. During the operation phase of the cloud honey point dynamic orchestration system based on software-defined deception defense, when the threat perception unit receives a reported intrusion behavior, the threat perception unit generates a structured intelligence object based on the intrusion behavior and sends it to the game decision unit for game solving.

Images