A method and system for distributed network deception defense based on honeycomb

Abstract

The application discloses a kind of distributed network deception defense method and system based on honeycomb, it is related to network defense technical field, the method includes: the policy level code of parsing collected, detect whether there is abnormal state, and mark abnormal node and its policy level, when being in the mode of degraded defense, according to policy level adjustment honeypot trigger condition and response threshold, the product of first preset proportion value and benchmark interaction flow threshold is set as decoy trigger condition, the product of second preset proportion value and minimum action flow threshold is set as response threshold, when policy level is normal and not the minimum value, trigger condition and response threshold under full defense mode are basis, execute comprehensive defense strategy.This defense system realizes abnormal detection, mode determination and parameter adaptive configuration to the honeycomb node under different operating conditions, and strategy back and full network update after triggering defense, to ensure that still can maintain effective defense under the condition of resource limitation or node anomaly.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network defense, in particular to a distributed network deception defense method and system based on a honeycomb. BACKGROUND

[0002] The distributed network deception defense system is an active security technology, which attracts and guides attack traffic into a controllable environment by deploying virtual decoy nodes, fake assets and services in multiple locations and multiple levels, thereby obtaining intelligence, delaying penetration and misleading attack paths in the early stage of attack. Compared with traditional passive defense, it has the characteristics of distribution, dynamics and intelligence, and can realize cross-domain cooperation, defense depth and threat intelligence closed loop in complex environments such as cloud computing, Internet of Things, industrial control and military networks, effectively coping with high-level threats such as APT, zero-day vulnerabilities and automated attacks.

[0003] However, the existing defense system relies on attack features, threat intelligence or periodic manual configuration to adjust defense strategies, lacks dynamic decision-making ability based on the real-time running state of the honeypot node, and in actual operation, the honeypot nodes distributed in different geographical locations and network topologies are prone to running abnormities such as disconnection, resource loading failure and response delay exceeding the standard. If these abnormities are not identified and handled in time, it will lead to a decrease in the deception defense capability of the whole network, and even some nodes will fail, and attack traffic will bypass the honeycomb. SUMMARY

[0004] Therefore, the purpose of the present application is to provide a distributed network deception defense method and system based on a honeycomb, which aims to solve the problem of decreased deception defense capability of the distributed network when the honeypot node in the prior art abnormity.

[0005] The present application provides a distributed network deception defense method based on a honeycomb, which comprises the following steps:

[0006] S1: Collect the running state of the honeypot nodes distributed in the whole network, and encode the deception strategy level of each node through strategy level coding;

[0007] S2: Analyze the collected strategy level code, detect whether there is an abnormal state, and mark the abnormal nodes and their strategy level;

[0008] S3: If the strategy level is abnormal, the defense parameters will not be adjusted according to the real-time strategy level, and the abnormal information will be displayed, and the threat analysis will be carried out in the control logic with the reference strategy level 0;

[0009] S4: If the strategy level is normal, read the current strategy level, and determine the defense mode according to its value;

[0010] S5: When in the degraded defense mode, adjusting the honeypot trigger condition and response threshold according to the policy level, setting the decoy trigger condition as the product of the first preset proportion value and the benchmark interaction flow threshold; setting the response threshold as the product of the second preset proportion value and the lowest action flow threshold;

[0011] S6: Judging whether the intrusion behavior meets the condition of starting the defense response according to the adjusted decoy trigger condition and response threshold;

[0012] S7: When the policy level is normal and not the lowest value, executing the comprehensive defense strategy according to the trigger condition and response threshold in the full defense mode;

[0013] S8: Once the defense action is triggered, returning the attack behavior, attack path, trigger condition and policy level to the defense control center, and synchronously updating the policy level and deception configuration of the honeypot nodes in the whole network.

[0014] Further, the above-mentioned distributed network deception defense method based on the honeynet, wherein step S2: analyzing the collected policy level code, detecting whether there is an abnormal state, and marking the abnormal node and its policy level, comprises the following steps:

[0015] The time sequence state of the node is recovered, a sliding state object is maintained for each node, the code frames of a preset number of time slices in a preset time period are integrated, and the determinable state of the node at this moment is reconstructed;

[0016] Different signals are assigned weights, interval determination and out-of-bound counting are respectively performed, the trend type signal is subjected to persistent weighting, the unrecoverable type signal is set as a fatal branch, the abnormal strength score is integrated from the sub-results, and a dominant signal list is given;

[0017] If the abnormal strength score exceeds the abnormal threshold, the abnormal path is entered, if the abnormal strength score is between the observation threshold and the abnormal threshold, the observation state is entered and sampling is started, otherwise it is determined to be normal.

[0018] Further, the above-mentioned distributed network deception defense method based on the honeynet, wherein the time sequence state of the node is recovered, and the processing logic is: a bounded buffer is maintained for each node according to the sequence number, the out-of-order arriving frames are temporarily cached until a continuous sequence is formed or the cache is timed out, and if the cache is timed out and the intermediate frames are still missing, the gap is backfilled in a state interpolation manner.

[0019] Further, the above-mentioned distributed network deception defense method based on the honeynet, wherein step S5: when in the degraded defense mode, adjusting the honeypot trigger condition and response threshold according to the policy level, setting the decoy trigger condition as the product of the first preset proportion value and the benchmark interaction flow threshold; setting the response threshold as the product of the second preset proportion value and the lowest action flow threshold, comprises the following steps:

[0020] According to the current policy level L, a recommended coefficient pair is selected from the policy library, the candidate coefficient is damped by a steady-state controller, and if it is out of range, it is rolled back to the nearest stable value and the reason is recorded;

[0021] According to the protocol family, the corresponding reference interaction traffic threshold is taken, and the fluctuation factor and business calendar of the protocol in the recent observation window are fused;

[0022] According to the endpoint or resource path within the protocol, the first preset ratio value is multiplied by the corresponding reference interaction traffic threshold to obtain a candidate threshold;

[0023] The second preset ratio value is multiplied by the lowest action traffic threshold to obtain a candidate threshold, which is used as the reference of the action gradient.

[0024] Further, the above-mentioned distributed network deception defense method based on the honeycomb, wherein the candidate coefficient is damped by a steady-state controller, including three elements of uplink and downlink different thresholds, minimum residence time and buffer confirmation, to prevent the first preset ratio value and the second preset ratio value from swinging in the critical region, and to set a safety boundary for the first preset ratio value and the second preset ratio value.

[0025] Further, the above-mentioned distributed network deception defense method based on the honeycomb, wherein step S3: if the policy level is abnormal, the defense parameters are no longer adjusted according to the real-time policy level, and the abnormal information is displayed, and the threat analysis is carried out with the reference policy level 0 in the control logic, including the following steps:

[0026] Receiving an abnormal marker object, if the abnormal category is fatal, it is set to forced freezing;

[0027] A freezing lease is created for the abnormal marker object to block subsequent expansion, level up or policy drift triggered by the L level;

[0028] The abnormal marker object is switched to the reference policy level 0, and the minimum reach of identifying threats is retained.

[0029] Further, the above-mentioned distributed network deception defense method based on the honeycomb, wherein the abnormal marker object is received, including the abnormal category, the dominant signal, the abnormal intensity, the entering time, the production capacity limit bit, the interpolation density and the cross-validation result; a freezing lease is created for the abnormal marker object, including the freezing start time, the minimum residence time and the allowed minimum action set and the unfreezing criterion placeholder.

[0030] Further, the above-mentioned distributed network deception defense method based on the honeycomb, wherein step S4: if the policy level is normal, the current policy level is read, and the defense mode is determined according to the value, including the following steps:

[0031] Receive the latest policy level coding frame and state snapshot, confirm that the abnormal aggregation score is in the normal zone, and there is no established frozen lease;

[0032] If the residual fatal flag is detected, immediately reject entering step S4 and return to step S3 for processing;

[0033] Confirm the validity of the input by the serial number / timestamp, and lock the policy decision context of the time slice;

[0034] Map the discrete policy level L to two types of operation modes: full defense or degraded defense.

[0035] Further, the above-mentioned distributed network deception defense method based on honeypot, wherein the discrete policy level L is mapped to two types of operation modes: full defense or degraded defense, comprises the following steps:

[0036] Read the policy level L and check whether its source is affected by the capacity limit flag;

[0037] If the policy level L is the lowest level, output the degraded defense mode; otherwise, output the full defense mode.

[0038] Another object of the present application is to provide a distributed network deception defense system based on honeypot, which is used to implement the above-mentioned defense method, comprising an encoding and marking module, a judgment module, an adjustment module and a policy execution module;

[0039] The encoding and marking module is used to collect the running state of the honeypot nodes distributed in the whole network, and encode the deception policy level of each node through policy level coding; analyze the collected policy level coding, detect whether there is an abnormal state, and mark the abnormal nodes and their policy levels;

[0040] The judgment module is used to, if the policy level is abnormal, no longer adjust the defense parameters according to the real-time policy level, and instead display abnormal information and perform threat analysis with the reference policy level 0 in the control logic; if the policy level is normal, read the current policy level, and determine the defense mode according to its value;

[0041] The adjustment module is used to, when in the degraded defense mode, adjust the honeypot trigger condition and response threshold according to the policy level, set the decoy trigger condition to the product of the first preset proportion value and the reference interaction flow threshold; set the response threshold to the product of the second preset proportion value and the lowest action flow threshold;

[0042] The policy execution module is used to determine whether the intrusion behavior meets the condition of starting the defense response according to the adjusted decoy trigger condition and response threshold; when the policy level is normal and not the lowest value, execute the full defense strategy according to the trigger condition and response threshold in the full defense mode.

[0043] The present application quantifies the running state of the honeypot node (including the decoy type, service configuration, virtual asset quantity, deployment strength and health status) into processable policy level data by introducing a policy level coding mechanism, and implements policy level based anomaly detection and defense mode determination in the control logic. When the node policy level is abnormal, it can automatically reduce to the baseline policy level and maintain the minimum defense strength, ensuring that it still has basic trapping and monitoring capabilities in the case of insufficient resources or partial node failure. In the degraded mode, the decoy trigger condition and response threshold are dynamically calculated and adjusted according to the preset proportion, effectively balancing resource consumption and defense effect, and avoiding performance degradation caused by overload operation; in the full defense mode, high-intensity deception defense is performed, including full-flow recording, decoy resource dynamic expansion, cross-node linkage countermeasure and intelligence backhaul. At the same time, after triggering the defense action, the attack behavior, attack path, trigger condition and policy level are returned to the defense control center, and the strategy is updated synchronously in the whole network, realizing dynamic closed-loop control and adaptive optimization of distributed honeynet defense, thereby significantly improving the availability, flexibility and defense synergy efficiency of the system. The problem of decline of distributed network deception defense capability when the honeypot node in the prior art is abnormal is solved. BRIEF DESCRIPTION OF DRAWINGS

[0044] Figure 1 Flowchart of the method for distributed network deception defense based on honeynet in the first embodiment of the present application;

[0045] The following specific embodiments will further illustrate the present application in conjunction with the above-mentioned drawings. DETAILED DESCRIPTION

[0046] In order to facilitate the understanding of the present application, the present application will be described more fully below with reference to the related drawings. Several embodiments of the present application are shown in the drawings. However, the present application can be realized in many different forms and is not limited to the embodiments described herein. On the contrary, the purpose of providing these embodiments is to make the disclosure of the present application more thorough and comprehensive.

[0047] It should be noted that when an element is referred to as being "fixed to" another element, it can be directly on the other element or there can be a middle element. When an element is referred to as being "connected" to another element, it can be directly connected to the other element or there can be a middle element. The terms "vertical", "horizontal", "left", "right" and similar expressions used herein are for illustrative purposes only.

[0048] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application belongs. The terminology used in the description herein is for describing particular embodiments only and is not intended to be limiting of the application. As used herein, the term "and / or" includes any and all combinations of one or more of the associated listed items.

[0049] Embodiment 1: Please refer to Figure 1 As shown in the figure, the embodiment provides a distributed network deception defense method based on a honeycomb, and the defense method comprises the following steps:

[0050] S1: Collect the running state of the honeycomb nodes distributed in the whole network, and encode the deception strategy level of each node through strategy level coding.

[0051] Among them, the running state of the honeycomb node includes bait type, simulated service configuration, virtual asset quantity and deployment intensity. When encoding the deception strategy level of each node, BCD code can be used to represent different strategy levels, corresponding to different deception complexity and resource consumption.

[0052] S2: Analyze the collected strategy level code, detect whether there is an abnormal state, and mark the abnormal node and its strategy level.

[0053] Among them, the abnormal state at least includes honeycomb node offline, resource loading failure, response delay exception, etc.

[0054] S3: If the strategy level is abnormal, the defense parameters will not be adjusted according to the real-time strategy level, and the abnormal information will be displayed, and the threat analysis will be carried out in the control logic with the reference strategy level 0.

[0055] Among them, the reference strategy level 0 is the lowest deception intensity, and the trigger conditions and response thresholds under the full defense mode are used at the same time, so as to ensure the basic trapping and monitoring ability under abnormal conditions.

[0056] S4: If the strategy level is normal, read the current strategy level, and determine the defense mode according to the value.

[0057] Specifically, if the strategy level is not the lowest value, it is determined that the system is in full defense mode; if the strategy level is the lowest value, it is determined that the system is in degraded defense mode (low resource deception running state).

[0058] S5: When in degraded defense mode, adjust the honeycomb trigger condition and response threshold according to the strategy level: set the bait trigger condition to the product of the first preset proportion value and the reference interaction flow threshold; set the response threshold to the product of the second preset proportion value and the lowest action flow threshold.

[0059] S6: Determine whether the intrusion behavior meets the condition of starting the defense response based on the adjusted bait trigger condition and response threshold.

[0060] In the degraded mode, determine whether the intrusion behavior meets the condition of starting the defense response based on the adjusted bait trigger condition and response threshold (such as recording attack packets, blocking sessions, guiding to a deep honeypot environment, etc.).

[0061] S7: When the policy level is normal and not the lowest value, execute the full defense strategy based on the trigger condition and response threshold in the full defense mode.

[0062] Specifically, the full defense strategy includes full flow recording, dynamic extension of bait resources, cross-node joint countermeasures, and threat intelligence feedback.

[0063] S8: Once the defense action is triggered, the system feeds back the attack behavior, attack path, trigger condition, and policy level to the defense control center, and synchronously updates the policy level and deception configuration of the honeypot nodes in the entire network.

[0064] In either the degraded or full defense mode, once the defense action is triggered, the system feeds back the attack behavior, attack path, trigger condition, and policy level to the defense control center, and synchronously updates the policy level and deception configuration of the honeypot nodes in the entire network, achieving dynamic closed-loop defense and adaptive optimization of the entire network policy.

[0065] Embodiment 2: The present embodiment provides a distributed network deception defense system based on a honeynet, which includes a coding and marking module, a judgment module, an adjustment module, and a policy execution module.

[0066] Coding and marking module: Collect the running state of the honeypot nodes distributed in the entire network, and encode the deception policy level of each node through policy level coding; analyze the collected policy level coding, detect whether there is an abnormal state, and mark the abnormal nodes and their policy levels; send the abnormal node marking results and policy levels to the judgment module.

[0067] Judgment module: If the policy level is abnormal, do not adjust the defense parameters according to the real-time policy level, display abnormal information, and perform threat analysis with the reference policy level 0 in the control logic; if the policy level is normal, read the current policy level, determine the defense mode according to its value, and send the judgment result to the adjustment module.

[0068] Adjustment module: When in the degraded defense mode, adjust the honeypot trigger condition and response threshold according to the policy level, set the bait trigger condition to the product of the first preset proportion value and the reference interaction flow threshold; set the response threshold to the product of the second preset proportion value and the lowest action flow threshold, and send the adjustment results to the policy execution module.

[0069] Policy execution module: based on the adjusted bait trigger condition and response threshold, it is judged whether the intrusion behavior meets the condition of starting defense response; when the policy level is normal and not the lowest value, the trigger condition and response threshold in the full defense mode are used as the basis to execute the full defense strategy.

[0070] Embodiment 3:

[0071] S1: Collect the running state of the honeypot nodes distributed in the whole network, including the bait type, simulated service configuration, virtual asset quantity and deployment strength, and encode the deception strategy level of each node (BCD code can be used to represent different strategy levels, corresponding to different deception complexity and resource consumption).

[0072] In the VPC / VNet, data center and edge node of each tenant or business domain, the honeypot nodes are uniformly registered and discovered. Each node generates a unique identifier when deployed (which can be concatenated by tenant identifier, region, availability zone, subnet, and node sequence), and declares its bait profile: bait type (host / service / application / industrial protocol, etc.), simulated service list (port, protocol family, version paratope strategy), virtual asset list (pseudo-database, pseudo-file system, pseudo-certificate library, pseudo-API), deployment strength (resource quota, bait complexity, interaction depth level). After the node starts, a secure channel is established with the control plane (two-way authentication and key rotation), and the state and heartbeat are reported periodically.

[0073] The node pushes the basic telemetry according to the fixed sampling period: system utilization (CPU / memory / disk / network), interaction session characteristics (new session speed, concurrent session number, average session duration, failure / success ratio), response quality (handshake success rate, p95 delay, packet loss ratio), attack behavior count (probe hit, weak password attempt, directory traversal, known exploit chain feature hit), environment health (container / process probe, file handle, port listening state). The control plane timestamps each index with node ID, tenant domain label, and performs data integrity check (sequence number continuity, heartbeat interval compliance, signature verification).

[0074] Further, in order to eliminate the differences in hardware specifications and load of different nodes, it is necessary to map the original index to a unified dimension. Specifically:

[0075] Configure the value range and abnormal range for each type of indicator, select the corresponding mapping template according to node specifications and service types, perform interval stretching and threshold outside truncation on indicators such as latency, packet loss, concurrency, and rate to make them enter the unified scoring interval, use time window accumulation and denoising for discrete events (such as feature hits), and dynamically adjust the window length according to business peaks and valleys; if there is a missing or delayed arrival: first backfill the smoothed value at the last time; if the number of acceptable consecutive missing times is exceeded, the indicator is set as unavailable and a health degradation flag is triggered; for indicators with obvious jitter, apply exponential decay smoothing to emphasize recent observations and preserve historical trends; the smoothing strength can be determined by the node role (core nodes are more cautious).

[0076] Each node maintains an independent baseline, which is layered according to time (weekday / weekend, intra-day period), protocol family, and bait complexity. In the cold start phase, collect a period of observation data (e.g., one to two weeks) to establish an initial baseline; after entering the stable period, fine-tune the baseline daily, combining the latest distribution characteristics with historical statistics, but limit the single-day deviation amplitude to avoid short-term exceptions from changing the baseline; the health calculation function takes multi-dimensional indicator aggregation as the core: set weights for performance-related, interaction-related, attack-related, and environment-related indicators, aggregate each category to get four sub-scores, and then combine the total health according to the node role weight; if a key indicator is unavailable or continuously bad, the total health directly triggers a downgrade signal (with a reason code), prioritizing diagnostic transparency.

[0077] The system needs to quantify the deception strength as an important input for subsequent policy level determination. Bait complexity is evaluated by dimensions such as service mimicry depth, protocol diversity, interaction script coverage, pseudo-data authenticity level, and trap density; deployment strength is evaluated by dimensions such as resource quota, concurrent access capability, deep honeypot linkage capability, horizontal replication cost, and expansion upper limit; standardize the scores in their respective dimensions, and generate an available deception capacity score, which is used to constrain the upper limit of the policy level (when the capacity is insufficient, the level is prohibited from being raised).

[0078] Further, the policy level L is used to express the deception strength that the node should adopt, and its output needs to consider health, baseline deviation, and attack pressure.

[0079] Collect three types of input, including health, baseline deviation, and attack pressure strength; set three thresholds including the minimum level, the regular level, and the full defense level, corresponding to different trigger condition ranges; if the health is below the minimum threshold or the key indicator is unavailable, the output candidate level is the minimum level, and the reason is marked; if the health is normal but the baseline deviation is significant and the attack pressure is not high, the output candidate level is the regular level (emphasizing monitoring and light expansion); if the health is normal and the attack pressure is significant, the output candidate level is the full defense level;

[0080] Further, the candidate level is checked for consistency with the available fraud capacity: if the candidate is higher than the upper limit of the capacity, it is adjusted to the upper limit of the capacity;

[0081] Hysteresis and minimum residence time are applied to the level change between adjacent time points to avoid frequent level switching.

[0082] The final strategy level is output, along with the decision explanation (health interval, main driving indicators, and whether it is capacity limited).

[0083] To ensure the stability of cross-language implementation, the strategy level needs to be encoded into a fixed-length strategy level encoding frame, and the level field is represented by BCD.

[0084] Construct the encoding frame field: version, timestamp, tenant ID, node ID, strategy level (BCD), health interval code, baseline deviation level code, attack pressure level code, capacity limit flag, signature; the strategy level field is represented by two-bit BCD, with reserved expansion space (such as 00 - lowest level, 01 - regular, 02 - enhanced, 03 - full protection); the encoding frame is signed for integrity and replay protection (with an incremental sequence) before transmission; both the control plane and the data plane implement the parser, and reject and alarm for abnormal frames (missing fields, signature failure, and large time drift).

[0085] To avoid frequent switching in the critical area, the system introduces steady-state control to the level decision, requiring more stringent continuous observation for up-regulation and allowing more sensitive triggers for down-regulation, ensuring safety first; after the level change, the level can only be changed again when strong trigger conditions occur before the residence time expires; only when the peak value lasts for more than a specified duration will it be counted in the decision; if the decision times out, the last stable level will be followed, and a self-check will be triggered on the collection side.

[0086] Assuming that a node is in peak period: CPU utilization is high but stable, p95 delay increases slightly, session concurrency and new rate increase significantly, and attack feature hits increase rapidly; the health degree remains in the normal interval, and the baseline deviation is mainly from the interaction rate and attack pressure. The decision function points the candidate level to full protection, but resource assessment shows that the deep honeypot quota is insufficient, and the capacity upper limit only supports the enhanced level; the steady-state control considers that the last period just increased from regular to enhanced and the residence time has not ended, so it decides to continue to maintain the enhanced level, and marks the capacity limit and residence lock flags in the encoding frame. This output ensures the balance of safety first, resource sustainability, and system stability.

[0087] S2: Analyze the collected strategy level encoding, detect whether there are abnormal states (such as honeypot node offline, resource loading failure, response delay anomaly, etc.), and mark the abnormal nodes and their strategy levels.

[0088] Further, a sliding state object is maintained for each node, which integrates the encoding frames of a preset number of time slices within a preset time period, such as the encoding frames of the last several time slices, to reconstruct the determinable state of the node at the current time. The health sub-dimensions (performance, interaction, attack, and environment) are respectively time-weighted and fused, with higher weights for recent frames; the baseline deviation code and the attack pressure code adopt a peak retention + decay strategy to ensure that short-term sharp changes are not immediately completely smoothed out; the capacity limit flag performs sticky retention until the resource probe explicitly releases the bottleneck. The goal of state reconstruction is to provide a sensitive and robust instantaneous image for anomaly identification.

[0089] In the distributed honeynet scenario, the anomalies mainly include: node offline / heartbeat loss, resource loading failure / process crash, response delay anomaly / packet loss anomaly, policy level jump anomaly, encoding frame tampering or replay, missing or self-contradictory observation data, etc. Each type of anomaly corresponds to several observation signals, such as: no valid frame is seen for a certain number of consecutive sampling periods (heartbeat loss); container / process survival probe fails multiple times (loading failure); time delay interval code is continuously in the worst bin and packet loss code is deteriorating (response anomaly); policy level BCD repeatedly rises and falls in a short time and does not meet the minimum residence requirement (jump anomaly); signature or sequence anomaly (tampering / replay); key field missing or conflict (data anomaly).

[0090] Further, anomaly identification does not rely on a single threshold, but uses multi-signal synthesis judgment. The core is an anomaly aggregation function:

[0091] Input is multi-class observation signals from state reconstruction (e.g. heartbeat continuous missing count, probe failure count, delay and packet loss interval code track, policy level change track, signature / sequence legality, field integrity, interpolation flag density, etc.). Different signals are assigned weights (higher weight for higher security risk), respectively interval determination and out-of-bound counting; for trend type signals, persistence weighting is used (continuous out-of-bound scores higher than occasional out-of-bound); for non-recoverable type signals (such as signature illegal), set as immediately fatal branch; each sub-result is combined into an abnormal intensity score, and the dominant signal list is given (for interpretability). The output is the abnormal intensity score and the abnormal category candidate set. If the score exceeds the abnormal threshold, enter the abnormal path; if the score is between the observation threshold and the abnormal threshold, enter the observation state and start more intensive sampling; otherwise, it is determined to be normal. To avoid critical oscillation and false positives, a steady-state control is introduced in the decision chain. The decision to enter the anomaly requires that the abnormal condition be met continuously for the entry residence time, while the exit from the anomaly requires that no high-weight signal be triggered again in a longer observation period; for policy level jumps, different thresholds are added for uplink and downlink, i.e. the uplink (from normal to abnormal) is more stringent, and the downlink (from abnormal to normal) is more cautious; for short-term peaks, a buffer confirmation is used, and only when the abnormal intensity is still higher than the threshold at the end of the buffer period, it is officially listed. This strategy ensures that the system reacts quickly at the peak of the attack, while maintaining stable decision-making in a noisy environment.

[0092] To reduce single-point errors, the system performs horizontal and vertical cross-validation on the decision results. Horizontally, adjacent honeypot nodes within the same subnet or the same availability zone share some network conditions, and if similar delay / packet loss deterioration occurs in multiple points at the same time, it is more likely to be a link-level anomaly rather than a node-level anomaly; vertically, data plane observations (eBPF, FlowLogs) and control plane probes (processes, containers) confirm each other, and only when both types of signals are consistent does the abnormal confidence increase. When cross-validation points to a higher level of failure (such as AZ-level network jitter), the node will still be marked as affected, but the abnormal category will be accompanied by upstream causes to facilitate subsequent handling.

[0093] Once in the abnormal path, an abnormal marker object is generated for the node. Record node identification, tenant domain, current policy level, abnormal category, dominant signal, abnormal intensity, entry time, expected impact range, whether accompanied by capacity restriction, interpolation flag density, cross-validation result; prepare minimal handling suggestions for the defense link (e.g. forced fallback to baseline level, suspend expansion, reserve high-sensitivity trigger conditions). The abnormal marker object is written to the alarm bus and the policy orchestration queue as direct trigger input for S3.

[0094] Further, each abnormal / normal determination generates an audit record, facilitating review and compliance. The record content includes:

[0095] Input frame snapshots (desensitized), parsing and repair logs, time weights of each sub-dimension in state reconstruction, intermediate results of abnormal aggregation functions (including the contribution of each signal), steady-state control state (residence timer, uplink and downlink threshold hit), cross-validation details, final conclusion and output time. The explainable output to the outside will present the dominant reason and evidence chain in simple sentences, which is convenient for manual quick confirmation.

[0096] Example 1:

[0097] Due to cross-regional link jitter, frame disorder and intermittent missing occur at a certain node. Through time sequence recovery and interpolation, the system will smooth the short gap; because the continuous missing count does not reach the residence time length, the abnormal aggregation function score falls within the observation interval, and finally does not enter the anomaly, only enters the observation state and increases the sampling density.

[0098] Example 2:

[0099] A node appears signature verification failure and sequence rollback, which is determined as tampering / replay. This signal belongs to the fatal branch, which does not need to be buffered, and directly enters the abnormal path; the abnormal marking object suggests that S3 immediately falls back to the reference level, freezes the expansion and triggers the key rotation and channel reconstruction.

[0100] Example 3:

[0101] The same availability zone multiple nodes simultaneously appear delay deterioration and packet loss increase, and the cross-validation points to the upstream link event. Each node is marked as affected-link level, and the dominant signal in abnormal intensity comes from the network side. S3 is recommended to perform flow limiting and temporary policy convergence at the domain level, rather than shrinking resources node by node.

[0102] S3: If the policy level is abnormal, the defense parameters will not be adjusted according to the real-time policy level, and the abnormal information will be displayed, and the threat analysis will be performed with the reference policy level 0 (the lowest fraud intensity) in the control logic, while the trigger conditions and response thresholds under the full defense mode are still used, to ensure that the basic trapping and monitoring capabilities are maintained under abnormal conditions.

[0103] Switch the node / domain to the reference policy level 0 (the lowest fraud intensity), but still retain the minimum reach that can identify threats. Load the latest valid reference snapshot of the node (including port whitelist, minimum protocol mimic configuration, lightweight identity trap, and deep honeypot diversion target). If there is no snapshot, apply the default reference template according to the node type (host / service / application / industrial control has a template respectively). Disable all non-reference service mimicry and high-interaction scripts, and only retain the minimum necessary exposure (such as 1-2 easy-to-detect ports + lightweight interaction protocol stack). Disable dynamic bait extension and cross-node replication capabilities to avoid expanding the attack surface or exhausting resources during the anomaly period. Publish L0 switch success confirmation event to the data plane, and record the switch time and failure rollback point.

[0104] Inherit the trigger conditions and response thresholds of the full protection mode under L0, maintain high sensitivity detection and actionable judgment, but do not do high-cost disposal. Read the trigger condition set and response threshold set of this node / domain from the full protection parameter library (such as weak password multiple failures, directory traversal, protocol violation sequence, known exploit chain fragment hit, etc.). Scope down the condition set: keep the judgment logic unchanged, but limit the action range to record + diversion + light blocking; mark high-cost actions such as expansion, cross-domain scheduling, and rewritten routing as frozen. Write the inherited condition set to the execution plane (eBPF / ACL / WAF / proxy) to ensure that the detection capability does not decay; at the same time, reduce the load of high-cost evidence (such as full-flow PCAP) according to the sampling strategy.

[0105] Further, control the resource consumption and risk exposure during the control exception period, while ensuring observability and traceability. Allow recording metadata, key request headers, sampling PCAP, session termination, and diversion to a honeypot; prohibit bait horizontal replication, protocol family expansion, deep script automatic installation, and wide-area countermeasures. High-value protocols and hit feature flows are highly sampled, and low-value protocols are lowly sampled; for homologous high-frequency events, event merging is used to reduce disk writing and alarm storms. Traffic guidance uses one-way diversion (to a honeypot / isolation network segment) and does not do re-annotation and induced countermeasures; the SDN layer only performs the minimum ACL adjustment to avoid mis-cutting business segments. Limit the number of diversion sessions and evidence entries per minute, and trigger soft backoff when the quota is reached, retaining only key evidence.

[0106] Under the minimum exposure surface, maximize the effective evidence density to ensure the availability of subsequent tracing and forensic evidence. Enable key field white list collection: URL path, command sequence, authentication failure reason, abnormal handshake phase, TTP label, etc.; mask sensitive fields (such as fake credentials, tenant identifier). Increase the deep recording level of sessions that hit the characteristic (complete request packet, server response header, context label), and maintain lightweight telemetry for the rest. For link layer / host layer, align the time sequence labels (unified time source and drift correction) to ensure cross-domain alignment and attack graph splicing. Storage uses write-ahead compression + hierarchical hotness, with hot evidence hot storage and low-value evidence cold storage; when over-allocated, discard the lowest-weight items in order of value.

[0107] When there are signs of tampering, replay, or high-confidence intrusion, quickly restore the trusted root. Immediately rotate the node control channel key; only allow minimal collection and necessary heartbeats before channel reconstruction. Perform integrity checks on configurations and images; if the check fails, automatically roll back to the latest trusted version and store the difference snapshot. Temporarily place the affected node on the isolation list and only accept signed instructions from trusted orchestrators. After completing channel reset, trigger S2's quick recheck again to confirm that the anomaly has been resolved or downgraded.

[0108] Stable and repeatable orchestration of the minimum set of actions allowed in abnormal state to enforcement plane and forensics plane.

[0109] 1) Generate a treatment plan according to the abnormal category (such as only drainage + forensics, drainage + light block, freeze and reset channel), plan expressed in structured list, including target object, action, priority and rollback point.

[0110] 2) Issue the plan to the relevant executor (SDN, WAF, agent, eBPF, deep honeypot entrance) through SOAR / control plane, and wait for idempotent confirmation.

[0111] 3) Roll back to the rollback point for failed steps, and report the failure evidence and environment state together, avoiding semi-configuration state.

[0112] 4) After the treatment is completed, update the remaining time of the freeze lease, and enter the monitoring observation period.

[0113] Give clear and verifiable conditions for returning to normal adaptation from abnormal state. Read the freeze lease; if the minimum residence time is not reached, directly reject the unfreezing request. Check if the abnormal aggregation score of S2 is in the normal zone for multiple consecutive periods, and the fatal class signal is zero; for link-level abnormalities, there must be upstream recovery events. Load the candidate level of L in shadow mode, simulate trigger and threshold hits, do not actually expand / schedule, and observe stability for a short period. If the evaluation is passed, unfreeze and hand over to the normal strategy processing of S4; otherwise, extend the freeze and record the rejection reason.

[0114] Further, ensure that each step during the abnormal period has a causal chain and evidence chain.

[0115] Generate abnormal treatment records including input abnormal objects, freeze leases, switching snapshots, inherited triggers / thresholds, action white lists, sampling and quotas, treatment plan execution logs, failure rollback and final state. Use simple and verifiable statements to explain why to enter abnormal, why to adopt L0, why to keep full defense trigger, why to prohibit expansion, and when to unfreeze. Reports are presented in tenant dimension and node dimension, supporting export for compliance and forensic needs.

[0116] Example: Signature illegal + sequence rollback

[0117] Judged as a fatal abnormality, AbnormalIntake() enters forced freeze; ChannelSanitize() rotates the key and rolls back the image; baseline L0 takes effect and only retains the minimum collection; after rechecking, enter the normal strategy processing of S4.

[0118] S4: If the policy level is normal, read the current policy level, and determine the defense mode according to its value:

[0119] Policy level is not the lowest value → the system is in full defense mode;

[0120] Policy level is the lowest value → the system is in degraded defense mode (low resource fraud running state).

[0121] Only in normal state, S4 is entered, and conflicts with abnormal state and frozen state are eliminated.

[0122] 1) Receive the latest policy level code frame and state snapshot from S2, confirm that the abnormal aggregation score is in the normal zone, and there is no frozen lease established by S3.

[0123] 2) If residual fatal markers (such as signature illegal) are detected, immediately reject entering S4 and return to S3 for processing.

[0124] 3) Confirm that the input is the latest valid by serial number / timestamp, and lock the policy decision context of this time slice to avoid concurrent coverage.

[0125] Map the discrete policy level L to two types of running mode: full defense or degraded defense. Read L (such as BCD: 00 = lowest, 01 / 02 = normal / strong, 03 = full defense), and check if its source is affected by the capacity limit flag (if limited, record but do not change the judgment). If L is the lowest level, output the degraded defense mode; otherwise, output the full defense mode. To avoid frequent mode swings, return the candidate mode for processing.

[0126] Keep the mode stable under real attack fluctuations and business jitter, and avoid jitter. Read the last time effective mode and its minimum residence timer; if the residence time is not reached, unless the strong switching condition is triggered, the original mode is maintained. Set different thresholds for uplink and downlink: from degraded to full defense, longer continuous observation and stricter health degree / pressure combination are required; from full defense to degraded, faster switching is allowed, but it needs to be confirmed that the attack pressure has fallen and there is no fatal signal. For short-term peaks, use buffer confirmation: accumulate evidence strength in the buffer period, and still meet at the end of the period to switch. Output the final mode and switching reason summary (for audit).

[0127] According to the final mode, assemble the deliverable policy package, including trigger conditions, response thresholds, bait arrangement and diversion strategy.

[0128] The degraded defense mode template includes light exposure, reserved high sensitivity trigger, limited high cost action, and value-based layered sampling. The full defense mode template includes full trigger and threshold, dynamic expansion of bait, cross-node linkage, and deep honeypot diversion.

[0129] Select different intensity sub-templates (e.g., protocol quasiparticle depth, script coverage, forensic granularity) according to the fine-grained differences of L (e.g., L1 / L2 / L3). Fuse custom policies of tenants / business domains (whitelisted ports, specific TTP concerns, compliance clauses), and resolve conflicts with templates (tenant customizations take precedence over general templates). Generate a policy package containing trigger condition sets, response threshold sets, bait resource graphs, diversion / blocking rules, forensic sampling plans, version numbers, and rollback points.

[0130] Ensure that the policy package matches the current available resources to avoid releasing and overloading. Read the current resource snapshot (CPU / memory / bandwidth / deep honeypot quota / storage IOPS). Estimate the cost of each item in the policy package (e.g., CPU per additional bait instance, storage write per forensic granularity, control plane overhead across node coordination). If the budget is exceeded, perform priority pruning: retain high-value, high-hit actions; downgrade or postpone low-value high-cost items; mark capacity-limited and feedback to the policy specification. Generate an executable policy package.

[0131] Fine-tune triggers and thresholds based on recent false positive / negative performance, attack profiles, and business hours to improve overall cost-effectiveness. Read the recent period's detection evaluation (false positive rate, false negative rate, trigger-action conversion rate, key TTP coverage). Increase action thresholds or add combined evidence requirements for high false positive conditions; lower trigger thresholds and increase forensic granularity for key chains prone to false negatives. Maintain trigger sensitivity, but set action thresholds to prioritize minimal sufficient actions first to avoid over-disposition. Output the calibrated policy package with fine-tuning records (for easy backtracking).

[0132] Safely and idempotently distribute the policy to the execution surface and verify its effectiveness. Use phased release: first shadow load (no action, only observe hits and costs), then small traffic gray scale, and finally full landing; each step has a timeout and rollback point. Distribute to SDN / ACL / WAF / eBPF / proxy executors one by one, wait for idempotent confirmation, read the effective rules and counters from the execution surface, compare with the expected policy, and if they are inconsistent, immediately roll back and alert. Record the release version, range, and effective time, and enter the observation period.

[0133] Explicitly define the system behavior when information is insufficient or execution fails. If the policy assembly process lacks key parameters (e.g., missing baseline or missing tenant customization), prefer conservative templates and limit the release range; also generate an insufficient information flag for subsequent completion. If release fails or readback is inconsistent, automatically roll back to the last stable version; if there are multiple consecutive failures, trigger S3's benchmark switching and freeze short observation. If resources exceed the limit during the observation period, immediately perform action pruning + sampling enhancement, and initiate resource expansion evaluation (without blocking core monitoring).

[0134] Example:

[0135] L=02 (enhanced), ModeSelector gives candidate full defense; HysteresisController switches through buffering confirmation; PolicyAssembler assembles dynamic decoy extension and cross-node linkage; ResourceBudgeter finds deep honeypot quota tight, cuts part of high-cost scripts; RiskCalibrator reduces trigger threshold for high-value chain; RolloutOrchestrator shadow→gray→full; RuntimeSupervisor monitors hit quality and resource level, stable performance.

[0136] S5: When in degraded defense mode, adjust honeypot trigger conditions and response thresholds according to policy levels:

[0137] Set the decoy trigger condition as the product of the first preset proportion value and the baseline interaction flow threshold;

[0138] Set the response threshold as the product of the second preset proportion value and the minimum action flow threshold.

[0139] Input and baseline definition. Threshold adjustment of degraded mode has two types of input:

[0140] One is the baseline interaction flow threshold per node / tenant, denoted as F_base, which is used to characterize the expected interaction intensity of the decoy port or protocol under normal operation; the other is the minimum action flow threshold, denoted as I_min, which is used to characterize the minimum evidence intensity required for triggering the minimum sufficient disposal in the historical confirmed malicious scenarios. For each protocol family and port, the session concurrency, request rate, handshake failure density, and abnormal operation ratio of a stable period in the past are denoised and time-layered to obtain the periodized F_base; the evidence window (such as abnormal request count per minute, password brute-force failure group, and directory traversal hit count) of the labeled malicious samples is extracted to obtain I_min. If the historical data is insufficient, the adjacent node or near neighbor of the same business domain is migrated, and the source is marked as insufficient to facilitate subsequent rapid convergence.

[0141] The selection of the proportionality coefficient and the anti-shake. The preset proportion values a and b are used to generate the decoy trigger condition T_trigger and the response threshold T_action in the degraded mode. According to the current policy level L (subdivision within the degradation hierarchy, such as L0 / L0+), a recommended coefficient pair is selected from the policy library (for example, L0 takes a smaller a and a larger b to improve detection sensitivity and suppress excessive disposal; L0+ moderately relaxes b); the candidate coefficient is subjected to anti-shake through a steady-state controller, which specifically includes different thresholds for uplink and downlink, minimum residence time, and buffer confirmation of three elements to prevent a / b from frequently swinging in the critical zone. At the same time, safety boundaries are set for a / b (for example, a cannot be lower than the minimum interaction required by the sampling lower limit, and b cannot be lower than the minimum action evidence required by forensic availability), and if it exceeds the boundary, it will be rolled back to the last stable value and the reason will be recorded.

[0142] Generation and refinement of decoy trigger conditions. According to the protocol family (HTTP / SSH / SMB / database / industrial control protocol, etc.), the corresponding F_base is used, and the fluctuation factor and business calendar (peak / valley period) of the protocol in the recent observation window are fused; within the protocol, it is further refined according to the endpoint or resource path (for example, login endpoints, management endpoints, and file write endpoints are set separately), and the candidate threshold is obtained by multiplying a by the corresponding F_base. Subsequently, three types of corrections are applied: first, pulse suppression, which sets a small persistence requirement for burst short pulse traffic (for example, it needs to meet the standard for multiple sampling pieces); second, autocorrelation deduction, which deducts periodic benign tasks (backup, health probe) according to the signature; third, neighborhood consistency, if the adjacent nodes in the same subnet are all normal and only the current node is abnormal, the threshold is adjusted to resist isolated noise. Finally, a clear T_trigger is output for each protocol / endpoint, along with the source and correction description.

[0143] Response threshold and action gradient. The processing logic for generating T_action is: multiply I_min by b to get the candidate threshold, but it is not directly used for single-evidence decision-making, but as a reference for action gradient. The action gradient from light to heavy is recording and labeling, session weight reduction and rate limiting, session blocking, diversion to deep honeypot, and triggering in-domain action. In the degraded mode, only the first three grades and safe diversion are open, and high-cost cross-domain expansion and wide-area countermeasures are prohibited. To reduce false positives, the threshold determination uses a combined evidence mechanism: for example, it requires that at least two of the weak password failure group, abnormal request path hit, and session stick time anomaly are met simultaneously within a short time window, and the strength of any evidence is not less than a certain proportion of T_action. If the evidence only meets a single condition, it enters the observation state and increases the sampling without immediate disposal.

[0144] Further, the essence of degradation is resource sustainability + detection not offline. After generating T_trigger and T_action, call the resource budgeter to estimate the CPU / memory / bandwidth / storage IOPS overhead of this round of strategy, if the predicted limit is exceeded, prefer to retain the threshold of high-value protocols and high-hit endpoints, and tighten the threshold, and increase the threshold or down-sample for low-value areas. And introduce risk calibrator to read recent false positives / false negatives and key TTP coverage, raise the action threshold or increase the evidence combination requirement for high false positive conditions, and moderately lower the trigger threshold for high false negative chains but limit the action level. This double constraint will output a pruning list after each adjustment, ensuring that any relaxation or tightening has a basis and is traceable.

[0145] To avoid the fragmentation of strategies caused by degradation, align the new threshold of the node with the domain baseline window of the same tenant and protocol, and if the deviation exceeds the allowed bandwidth, force convergence to the acceptable interval within the domain. For multiple nodes in the same availability zone, if there is link-level jitter, uniformly apply a gentle float to avoid a large number of false triggers. Check if it conflicts with upstream control strategies (such as WAF global rules, SDNACL), if it conflicts, use the more stringent upstream as the standard, and explicitly mark the explanation as being constrained by the upstream.

[0146] Thresholds and thresholds are not one-time full effect, first load with shadow strategy, only record hits and cost without executing actions; if the hit quality meets the expectations (hit sample precision and resource cost controllable) during the shadow period, enter small traffic gray release, select a small number of endpoints and subnets to take effect; during the gray period, enable read-back verification, read back the rule counter and actual action from the execution surface, and check if it is consistent with the expected threshold, if not, automatically roll back and output the deviation report; after gray pass, full landing, and mark version number, release time and rollback point.

[0147] During the degradation operation, the system continuously subscribes to trigger and action event streams, and monitors key indicators such as diversion success rate, evidence efficiency, resource level and alarm storm risk. If there are signs of a sharp increase in hits but weak evidence, prefer to raise T_action and enable stricter combined evidence; if resources are approaching the red line, temporarily raise T_trigger for low-value protocols and increase the sampling ratio threshold; if there are no effective hits in multiple observation windows and resources are sufficient, slightly lower T_trigger to restore sensitivity. In boundary cases (such as data delay or missing some indicators), the system uses the latest stable version and triggers a supplementary sample, if the missing time is not recovered, it falls back to a more conservative default degradation template, maintaining minimal observability without amplifying the disposal surface.

[0148] Each generation, revision and release of the threshold and gate will generate a complete audit record, including the source of the input baseline (F_base / I_min), the selection of alpha / beta and the anti-jitter state, the T_trigger and T_action of each protocol / endpoint, the resource and risk pruning list, the gray scale and read-back result, the deviation processing and the final version information. The external exposure statement presents why the downgrade can still maintain high sensitivity detection, why the action level is limited, why it is tightened or relaxed on a specific protocol, ensuring sufficient traceability and persuasiveness for subsequent trigger judgment and disposal in S6.

[0149] S6: In the downgrade mode, the adjusted bait trigger condition and response threshold are used to determine whether the intrusion behavior meets the conditions for starting the defense response (such as recording attack packets, blocking sessions, guiding to a deep honeypot environment, etc.).

[0150] Further, the real-time traffic in the downgrade mode and the host-side telemetry are converted into a unified judgment input stream.

[0151] 1) Access source: eBPF / Netfilter events, proxy / WAF logs, honeypot service behavior logs, system call and process tree snapshots, VPCFlowLogs.

[0152] 2) Standardized fields: unified primary key (timestamp, five-tuple, session ID, node ID, tenant ID), action semantics (request type, login result, file / command operation), protocol features (method, status code, exception reason), context (geography / ASN, User-Agent, authentication policy).

[0153] 3) Denoising and deduplication: signature recognition and benign pattern labeling are performed on retransmission packets, probe pulses and health check requests; the same events within the same session are merged and counted to prevent alarm storms.

[0154] Further, the atomic events are mapped to evidence items that can be compared with thresholds, and intensity evaluation is performed within a sliding time window.

[0155] The evidence template library includes weak password brute force, directory traversal, SQL / NoSQL injection sequence, command injection, file writing to sensitive path, horizontal scanning, protocol violation sequence, known exploit chain fragments, and deep abnormality of honeypot interaction. The mapping rule defines the matching conditions for each type of template (e.g. login failure count combination + source IP stickiness + username change pattern mapping to password brute force evidence). Time window aggregation maintains short window / medium window (e.g. 1 minute / 5 minutes) count and trend for each type of evidence; the short window is used for agile response, and the medium window is used for stable judgment. Correlation enhancement includes merging the intensity of the same evidence from the same source on multiple nodes / endpoints, marking multi-point consistency, and improving confidence.

[0156] T_trigger (bait trigger condition) and T_action (response threshold) output according to S5, combined with evidence combination logic, to determine whether to trigger defense. If the intensity of a certain evidence in the short window reaches the T_trigger of the corresponding protocol / endpoint, it is recorded as a trigger candidate. For high false alarm evidence (such as a single 404 probe), it needs to be superimposed with other evidence (such as the appearance of a directory traversal path hit or abnormal session stick time in the same window) to reach the minimum sufficient set to enter the trigger confirmation. When the combined intensity of the combined evidence reaches T_action, enter the actionable branch; if it does not reach T_action but exceeds T_trigger, enter the observation and weighted sampling branch. Introduce the minimum residence time and buffer confirmation (such as confirming the trigger only when both consecutive short windows meet), to avoid critical jitter. {Determination result: observation / trigger candidate / trigger confirmation, evidence set, intensity score, confidence, recommended action level}.

[0157] In degraded mode, only the minimum sufficient action is performed, both to achieve isolation / evidence collection goals and to avoid excessive consumption.

[0158] Action gradient:

[0159] Level A: Record / Label (default) - Complete record of key fields and context labels;

[0160] Level B: Session weight reduction / rate limiting - Limit source rate, delay response to increase attack cost;

[0161] Level C: Session blocking - Immediately terminate sessions that meet the combined evidence and intensity reach T_action;

[0162] Level D: Deep honeypot diversion - divert sessions into deep environment for further observation;

[0163] (Degraded mode does not trigger wide-area countermeasures and large-scale expansion of decoys).

[0164] According to the recommended action level and resource budget, the action with lower cost and sufficient evidence is preferred; when the resources approach the red line, it is automatically downgraded to A / B; when the evidence intensity is extremely high and is a high-value TTP, C / D is allowed. Actions issued through SOAR / SDN / WAF / agent must receive idempotent confirmation; failure will fall back to the lower level of action and record the reason.

[0165] Ensure that the triggered treatment does not cause resource exhaustion or business damage. Set a per-minute upper limit for blocking the flow depth; when exceeded, only high-confidence sessions are retained. Only perform shadow assessment on business whitelist sources; reduce the action level for gray list (historical mild anomalies) and prioritize logging and rate limiting. If the executor has an exception or a publication lag, immediately switch to a safe state that only records and limits speed to avoid congestion caused by busy waiting. If multiple nodes trigger the same upstream link alarm at the same time, suspend blocking and use diversion and logging instead to prevent mis-cutting business.

[0166] Any rule issuance and action change caused by any trigger must be verifiable and rollbackable. Perform a shadow assessment on the action to be executed (record the sessions and resources that will be affected if the action is executed), and confirm that the cost is acceptable. First, implement it on a small number of nodes or endpoints, and monitor the hit quality and resource occupation. Read the counter / state from the executor, and compare it with the expected action; if the deviation is greater than the threshold, roll back and enter the observation state. Generate a version number and rollback point for each action release, and include it in the audit chain.

[0167] Ensure that even the minimum action can produce high-value evidence to support subsequent S8 linkage and strategy updates. Preserve the request / response metadata, key packet fields, system call fragments, and environment labels completely; extract available IoCs (IP / domain name / JA3 / path fragment, etc.) and TTP labels (such as break-in-lateral-deployment sequence) and write them into the intelligence library; add edges (source->target->action) to the attack graph and accumulate evidence weights to provide context for S7 / S8 full defense and linkage.

[0168] Provide clear and verifiable evidence for each decision to trigger / not trigger. Record inputs (T_trigger / T_action, evidence set, window count, combined rule hit situation), outputs (action, scope, executor receipt), resource impact, and exceptions. Generate an explainable text: explain why the trigger / does not trigger, why the action level is selected, whether it is constrained by resources / upper policy, and attach a key evidence summary. Audit records support tenant / node two-dimensional retrieval and export.

[0169] S7: When the policy level is normal and not the lowest value, execute the comprehensive defense strategy based on the trigger conditions and response thresholds in the full defense mode, including full-flow logging, dynamic expansion of decoy resources, cross-node linkage countermeasures, and threat intelligence feedback.

[0170] In full defense mode, the highest intensity signal collection is enabled to avoid missing threats due to sampling or degradation. All interactive data packets, simulated service logs, virtual asset access tracks, system call chains, and file I / O monitoring records of all honeypot nodes are accessed. The sampling rate limit is removed, full-flow capture mode is adopted, and hierarchical caching between memory buffer and streaming storage is used to reduce packet loss rate. Through a distributed message queue (such as Kafka / RabbitMQ), node data is pushed to the defense control center in real time, ensuring a delay within seconds. NTP is used to synchronize timestamps, and node ID and policy level tags are added to all records to ensure that multi-source data can be aligned in the decision engine.

[0171] Further, with the richer evidence set in full defense mode, multi-dimensional threat assessment is performed.

[0172] Evidence types include network protocol anomalies (TCP flag abnormal combination, HTTP field deformity), attack pattern matching (SQL injection, XSS, RCE, etc.), honeypot interaction depth, instruction sequence and file operation anomalies, and lateral movement path identification.

[0173] Fusion logic:

[0174] High-risk known exploit requests (such as CVEs) directly meet T_trigger; if multiple low-intensity evidence appears in the same time window and is consistent in origin, calculate the comprehensive intensity score; when attack behavior is observed simultaneously on multiple honeypot nodes, the intensity value is increased, and it is marked as a cross-node threat.

[0175] Decision output:

[0176] Below T_trigger → Enter observation mode; Reach T_trigger but below T_action → Local response; Reach or exceed T_action → Enter comprehensive disposal (full network cooperation).

[0177] In full defense mode, resource budget is sufficient, and high-intensity defense actions can be performed simultaneously, with SDN controllers or firewall ACLs immediately cutting off matching traffic. Attack sessions are directed to high-interaction honeypots to collect more tactical technical procedures (TTPs), return specially designed response packets, or induce traffic to control nodes for reverse information collection. Schedule cloud honeypot resource pools to dynamically increase high-value decoys (such as databases, sensitive documents, API interfaces) to increase attacker dwell time and exposure.

[0178] According to the real-time characteristics of attack behavior, dynamically adjust the type and scale of decoy. If the attack targets the database port, deploy more database honeypot nodes quickly. Introduce virtual assets similar to attack features (such as simulated environments matching the attacked CMS version). Recycle temporary decoys that have no interaction after the timeout time arrives to save resources. According to the attack frequency and concurrent connection number, increase or decrease the decoy nodes in real time to ensure sufficient trapping capacity.

[0179] Convert the latest attack data into useful intelligence to support subsequent defense optimization and external collaboration. Extract IoC (IP, domain name, URL path, file Hash), TTP label, session context, and generate STIX or OpenIOC format data packets. Send intelligence to the defense control center through an encrypted channel, and optionally push it to external threat intelligence platforms (CTI). Record the time, source node, and trigger condition of intelligence generation to ensure traceability and credibility.

[0180] S8: Regardless of the downgrade or full defense mode, once the defense action is triggered, the system will return the attack behavior, attack path, trigger condition and policy level to the defense control center, and synchronize the policy level and deception configuration of the full network honeypot nodes, achieving dynamic closed-loop defense and full network policy adaptive optimization.

[0181] In the defense control center, dynamically adjust the policy level according to the newly received threat intelligence to achieve precise and adaptive deception configuration optimization.

[0182] Based on attack intensity (attack frequency, concurrent session number, rule hit severity) and attack breadth (number of affected nodes), calculate the comprehensive threat score. If the attack involves zero-day exploits or cross-region coordinated attacks, the threat score will be proportionally increased. If the threat score ≥ high-risk threshold → the target node and associated node policy level is adjusted to the highest deception strength (e.g. increase the diversity and interaction depth of decoys). If the threat score is in the medium-low range → reduce unnecessary resource occupation while ensuring defense effect, adjust the policy level to medium strength. Determine whether the adjusted policy will cause resource imbalance in the whole network, such as causing overload in a certain data center, then redistribute the policy level to balance resource pressure.

[0183] The new policy level and deception configuration are quickly and consistently synchronized and distributed in the whole network. The node set that needs to be synchronized is determined according to the attack path and threat association. In the low-delay scenario, message middleware (such as Kafka and ZeroMQ) is used for broadcast push. In the high-security scenario, point-to-point update is performed through encrypted RPC call or configuration synchronization protocol (such as etcd and Consul). Raft or Paxos protocol is used to ensure the strong consistency of the whole network nodes in policy update, avoiding policy mismatch caused by network partition or node delay. If the policy synchronization fails, it is automatically rolled back to the last known stable policy level, and the abnormal node is marked for subsequent troubleshooting.

[0184] The policy update of the whole network node is not only successfully distributed, but also correctly takes effect in the running environment, and has traceability. Self-checking task is performed on each node to confirm that the policy level, bait deployment state, resource loading result and the configuration distributed by the control center are completely consistent. The node returns the verification result and the actual running state to the control center to form the mapping of policy version and node running snapshot. If it is found that part of the node policy does not take effect, the secondary distribution or resource reloading process is triggered, and the repair log is recorded. All policy update operations are recorded in the tamper-proof audit log (such as block chain type log storage) to support security audit and responsibility traceability.

[0185] Further, through the stage processing logic, a dynamic closed-loop defense mechanism is formed:

[0186] After the attack, the information is immediately returned and triggers the policy update; after the policy optimization, the whole network node obtains the latest defense configuration; after the policy takes effect, it is verified to ensure that the system enters the optimal defense state; in the whole process, the system resource and deception ability are adaptively adjusted according to the threat situation, ensuring that neither the resource is excessively consumed nor the defense ability is reduced.

[0187] The technical features of each of the above embodiments can be combined arbitrarily. In order to make the description simple, not all possible combinations of the technical features in the above embodiments are described, however, as long as the combination of the technical features does not exist contradictory, it should be considered as the scope of the present disclosure.

[0188] Those skilled in the art will appreciate that the logic and / or steps represented in the flow diagrams, or otherwise described herein, can be embodied in

[0189] More specific examples (a non-exhaustive list) of the computer readable storage medium include the following: an electrical connection having one or more wires (electrical device), a portable computer diskette (magnetic device), a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or Flash memory), an optical fiber device, and a portable compact disc read-only memory (CDROM). Additionally, the computer readable storage medium can also be paper or another suitable medium upon which the program is printed, as the program can be electronically captured, for example, via optical scanning of the paper or other medium, then compiled, interpreted, or otherwise processed in a suitable manner, if necessary, and then stored in a computer memory.

[0190] It should be understood that aspects of the application can be implemented in hardware, software, firmware or combinations thereof. In the above embodiments, various steps or methods can be implemented in software or firmware that is stored in memory and executed by a suitable instruction execution system. For example, if implemented in hardware, as in another embodiment, any of the following technologies, known in the art, or combinations thereof, can be used: a discrete logic circuit having logic gates for implementing logic functions upon data signals, an application specific integrated circuit having appropriate combinational logic gates, a programmable gate array (PGA), a field programmable gate array (FPGA), or the like.

[0191] In the description of the present specification, the description of the terms "one embodiment", "some embodiments", "an example", "a specific example", or "some examples" and the like means that the specific features, structures, materials or characteristics described in connection with the embodiment or example are included in at least one embodiment or example of the present application. In the present specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Also, the specific features, structures, materials or characteristics described can be combined in any one or more embodiments or examples in an appropriate manner.

[0192] The above embodiments only express several implementation manners of the present application, and the description is more specific and detailed, but it should not be understood as a limitation on the patent scope of the present application. It should be noted that for ordinary skilled persons in the art, without departing from the concept of the present application, several modifications and improvements can be made, which are all within the protection scope of the present application. Therefore, the protection scope of the patent of the present application should be subject to the appended claims.

Claims

1. A distributed network deception defense method based on honeycomb arrays, characterized in that: The defense method includes the following steps: S1: Collect the running status of honeypot nodes distributed across the entire network, and encode the deception policy level of each node through policy-level coding; S2: Parse the collected policy-level codes, detect whether there are abnormal states, and mark the abnormal nodes and their policy levels; S3: If the policy level is abnormal, the defense parameters will no longer be adjusted according to the real-time policy level. Instead, the abnormal information will be displayed, and threat analysis will be performed in the control logic based on the baseline policy level 0. S4: If the policy level is normal, read the current policy level and determine the defense mode based on its value; S5: When in degraded defense mode, adjust the honeypot triggering condition and response threshold according to the strategy level. Set the decoy triggering condition to the product of the first preset ratio value and the baseline interaction traffic threshold; set the response threshold to the product of the second preset ratio value and the minimum action traffic threshold. S6: Based on the adjusted decoy triggering conditions and response thresholds, determine whether the intrusion behavior meets the conditions for initiating a defense response; S7: When the strategy level is normal and not the lowest value, the full defense strategy is executed based on the triggering conditions and response thresholds in the full defense mode. S8: Once a defense action is triggered, the attack behavior, attack path, triggering conditions, and policy level will be sent back to the defense control center, and the policy level and deception configuration of all honeypot nodes in the network will be updated simultaneously.

2. The distributed network deception defense method based on honeycomb array according to claim 1, characterized in that: Step S2: Parse the collected policy-level codes, detect the existence of abnormal states, and mark abnormal nodes and their policy levels, including the following steps: The temporal state of the nodes is restored by maintaining a sliding state object for each node and reconstructing the determinate state of the node at this moment by combining the encoded frames of a preset number of time slices within a preset time period. Different signals are assigned weights, and interval judgment and boundary count are performed separately. Trend signals are continuously weighted, and irrecoverable signals are set as fatal branches. The sub-results are combined into an anomaly intensity score, and a list of dominant signals is given. If the abnormality intensity score exceeds the abnormality threshold, the abnormality path is entered; if the abnormality intensity score is between the observation threshold and the abnormality threshold, the observation state is entered and sampling is started; otherwise, it is judged as normal.

3. The distributed network deception defense method based on honeycomb array according to claim 2, characterized in that: The timing state of the nodes is restored. The processing logic is as follows: maintain a bounded buffer for each node according to the sequence number, and temporarily buffer out-of-order frames until a continuous sequence is formed or the buffer times out. If the buffer times out and there are still missing intermediate frames, the gaps are filled by state interpolation.

4. The distributed network deception defense method based on honeycomb array according to claim 3, characterized in that: Step S5: When in degraded defense mode, adjust the honeypot triggering condition and response threshold according to the strategy level, and set the decoy triggering condition to the product of the first preset ratio value and the baseline interaction traffic threshold. Setting the response threshold as the product of a second preset ratio value and a minimum action flow threshold includes the following steps: Based on the current policy level L, select suggested coefficient pairs from the policy library, debouncing the candidate coefficients through the steady-state controller, and if they exceed the limit, back to the most recent stable value and record the reason. The corresponding baseline interaction traffic thresholds are taken for each protocol family, and the fluctuation factors of the protocol in the most recent observation window are combined with the business calendar. Within the protocol, further refinement is made by endpoint or resource path, and the first preset ratio value is multiplied by the corresponding baseline interaction traffic threshold to obtain the candidate threshold. The candidate threshold is obtained by multiplying the second preset ratio value by the minimum motion flow threshold, and is used as the benchmark for the motion gradient.

5. The distributed network deception defense method based on honeycomb array according to claim 4, characterized in that: The candidate coefficients are de-jittered by a steady-state controller, which includes three elements: different thresholds for uplink and downlink, minimum dwell time, and buffer confirmation. This prevents the first and second preset ratio values ​​from oscillating in the critical region, while setting safety boundaries for the first and second preset ratio values.

6. The distributed network deception defense method based on honeycomb array according to claim 3, characterized in that: Step S3: If the policy level is abnormal, the defense parameters will no longer be adjusted according to the real-time policy level. Instead, the abnormal information will be displayed, and threat analysis will be performed in the control logic based on the baseline policy level 0, including the following steps: Receives an exception flag object; if the exception type is fatal, it is set to forced freeze. Create a freeze lease for the abnormal marked object to prevent subsequent expansion, level upgrade or policy drift triggered by L level; Switch the anomaly-marked object to baseline policy level 0 to preserve the minimum reach for threat identification.

7. The distributed network deception defense method based on honeycomb array according to claim 6, characterized in that: Receive anomaly marker objects, including anomaly category, dominant signal, anomaly strength, entry time, capacity limit bit, interpolation density, and cross-validation results; create a freeze lease for the anomaly marker object, including freeze start time, minimum dwell time, minimum allowed action set, and unfreeze criterion placeholders.

8. The distributed network deception defense method based on honeycomb array according to claim 6, characterized in that: Step S4: If the policy level is normal, read the current policy level and determine the defense mode based on its value, including the following steps: Receive the latest policy-level encoded frame and status snapshot, confirm that the abnormal aggregation score is in the normal zone and that there are no established freeze leases; If a residual fatal mark is detected, immediately refuse to proceed to step S4 and return to step S3 for processing; The input is validated by the sequence number / timestamp, and the policy decision context for that time slice is locked. The discrete strategy level L is mapped to two operating modes: full defense or degraded defense.

9. The distributed network deception defense method based on honeycomb array according to claim 8, characterized in that: Mapping discrete policy levels L to two operating modes: full defense or degraded defense, includes the following steps: Read the policy level L and check if its source is affected by the capacity constraint flag; If strategy level L is the lowest level, output the downgraded defense mode; otherwise, output the full defense mode.

10. A distributed network deception defense system based on honeycomb arrays, used to implement the defense method according to any one of claims 1-9, characterized in that: It includes an encoding and marking module, a judgment module, an adjustment module, and a strategy execution module; Encoding and Tagging Module: Used to collect the running status of honeypot nodes distributed across the entire network, and encode the deception policy level of each node through policy level encoding; parse the collected policy level encoding, detect whether there are abnormal states, and mark abnormal nodes and their policy levels; Judgment module: If the policy level is abnormal, the defense parameters will no longer be adjusted according to the real-time policy level, but the abnormal information will be displayed, and threat analysis will be performed in the control logic based on the baseline policy level 0; if the policy level is normal, the current policy level will be read and the defense mode will be determined according to its value. Adjustment module: When in degraded defense mode, adjust the honeypot triggering conditions and response thresholds according to the strategy level, and set the decoy triggering conditions to the product of the first preset ratio value and the baseline interaction traffic threshold. Set the response threshold to the product of the second preset ratio value and the minimum action flow threshold; Strategy execution module: Used to determine whether an intrusion behavior meets the conditions for initiating a defense response, based on the adjusted decoy trigger conditions and response thresholds; When the strategy level is normal and not at the lowest value, the full defense strategy is executed based on the triggering conditions and response thresholds in the full defense mode.

Images