Attack chain identification method and device for honey array attack trapping information

Abstract

The invention provides an attack chain identification method and device for honey array attack trapping information. The method comprises the following steps: constructing training data; constructing a tactical recognition task set, constructing a support set and a query set for each task according to the training data, and performing meta-training on each task to obtain a tactical matching model; constructing a tactical prototype dictionary in the tactical matching model; aggregating attack trapping information output by the honey array, generating a structured treaded honey point information list according to the attack trapping information and a preset format, and inputting the treaded honey point information list into a tactical matching model to be matched with the tactical prototype dictionary to obtain a matched tactical stage; performing keyword extraction of tactical stages by using a large language model, performing matching analysis on each tactical stage to obtain a TTP label, and splicing the TTP labels of the tactical stages to form an attack chain. By applying the method, honey array output data can be directly processed, a complete attack chain is constructed, and operable intelligence insight is provided for active defense in time.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a method and apparatus for identifying attack chains targeting honeypot attack decoy information. Background Technology

[0002] Currently, proactive defense systems are becoming a key strategy for dealing with Advanced Persistent Threats (APTs). APT attacks are orchestrated by highly specialized attack groups that remain lurking in target networks for extended periods to steal sensitive data or disrupt critical infrastructure. APT attack processes typically follow a multi-stage, highly structured pattern, with close tactical coordination and logical connections between each stage. This systematic nature necessitates a shift in defense systems from passive response to proactive defense.

[0003] In proactive defense, honeycombs serve as a core component. By deploying decoy environments to simulate real services, they lure attackers into engaging in malicious behavior and generate raw output data containing session logs, behavioral patterns, and probing requests. This data contains a wealth of attack tactics and techniques. It is essential to automatically extract TTPs from the honeycomb output and transform the attacker's attack phases into a TTP chain to guide proactive defense.

[0004] However, some attack tactics are rare and frequently mutate, resulting in a clear long-tail distribution of TTPs (Targeted Attack Tactics). Current techniques, such as rule-based and preprocessing methods, typically require manually defined features and large amounts of labeled data. Supervised learning combined with rule bases for long-tail tactic identification also relies heavily on labeled data. Clearly, existing technologies struggle to adapt to rapidly evolving attack methods. Furthermore, APT attacks often employ unknown variants and low-frequency tactics, the coefficients of which may be missing in the training data. Therefore, existing methods are ineffective in identifying these long-tail tactics, easily leading to missed detections of advanced threats.

[0005] Furthermore, existing technologies for processing honeycomb array output information suffer from several drawbacks: insufficient honeycomb array data processing capabilities, poor long-tail tactic identification performance, and a lack of effective evolution patterns in attack chain analysis. The session logs and behavioral trajectories output by honeycombs contain a large number of probing requests and noise interference, and existing technologies lack sufficient noise resistance when processing them, easily leading to misjudgments or missed detections. Long-tail tactics appear very infrequently in the training data, making it difficult for the model to learn effective feature representations. Moreover, the model design does not consider few-sample learning scenarios, making it unable to effectively distinguish similar but different tactical variants. Methods based on fixed rules cannot cover unknown attack variants and lack generalization ability. Existing technologies often analyze individual security events in isolation when constructing attack chains, easily leading to attack chain breaks or misjudgments.

[0006] Therefore, it is necessary to provide an attack chain identification method for honey trapping information to efficiently and accurately extract complete TTPs from unstructured honey output data. Summary of the Invention

[0007] The purpose of this invention is to provide an attack chain identification method for honeycomb attack trapping information, so as to efficiently and accurately extract complete TTPs from honeycomb attack trapping information and identify attack chains.

[0008] Firstly, the attack chain identification method for honey trap attack information provided by this invention includes: acquiring publicly available threat intelligence, TTP descriptions, and threat intelligence annotation datasets; extracting behavioral description text of the TTP and corresponding tactical tags to form training data; constructing a tactical identification task set; constructing a support set and query set for each task based on the training data; training and updating the parameters of the meta-training model on each task; constructing a validation set; fine-tuning the updated meta-training model using the validation set; updating the hyperparameters when the training loss converges to obtain the trained tactical matching model; constructing a tactical prototype dictionary in the tactical matching model for tactical phase matching; aggregating the attack trap information output by the honey trap; generating a structured list of compromised honey trap information according to a preset format based on the attack trap information; inputting the list of compromised honey trap information into the tactical matching model and matching it with the tactical prototype dictionary to obtain the matched tactical phase; using a large language model to extract keywords for the tactical phase; for each tactical phase, combining the compromised honey trap information of the tactical phase, keywords of the preceding phase and subsequent phases into the large language model for TTP matching analysis to obtain TTP tags; and concatenating the TTP tags of each tactical phase to form an attack chain.

[0009] The beneficial effects of the attack chain identification method for honeypot attack trapping information provided by this invention are as follows: the tactical matching model obtained through meta-training can directly process honeypot data, gain the ability to summarize logic from a very small number of samples, and thus achieve high-accuracy identification of TTPs. By combining keywords from the preceding and following stages as constraints to accurately understand the temporal dependencies between tactics, a structured and complete attack chain can be output.

[0010] In one possible embodiment, training and updating the meta-trained model parameters on each task includes: for a task, performing gradient descent on the support set to obtain task parameters, using the task parameters to calculate the meta-loss on the query set and updating the global parameters; after training all tasks in the tactical identification task set, obtaining general transferable parameters, and using the general transferable parameters to update the meta-trained model parameters.

[0011] In another possible embodiment, the validation set includes positive and negative samples. Positive samples are correct tactical description texts labeled with the corresponding tactic. Negative samples include defensive behavior samples, incorrectly identified tactical samples, and irrelevant samples labeled with the negative class. The training loss function is a composite form: positive sample cross-entropy + ... × Negative sample discrimination loss + prototype centering regularization term, where This represents hyperparameters.

[0012] In other possible embodiments, constructing a tactical prototype dictionary in the tactical matching model includes: determining a set of tactical classes based on a set of tactical identification tasks; for each tactical class, mapping it to a set of vectors based on the corresponding support set samples, and calculating the mean or weighted center of the vector set as a tactical prototype vector.

[0013] In the tactical prototype dictionary storage structure, the storage item corresponding to each tactical class includes the tactical prototype vector, update time, merged new sample, and decayed old prototype.

[0014] The attack trapping information output by the honey array includes: preset time thresholds and causal clue judgment criteria; when the monitoring time of the honey array reaches the set length of the time threshold, the attack trapping information output by the honey array is aggregated; if it is detected that there are attack trapping information that meet the causal clue judgment criteria, the attack trapping information output by the honey array within the current time period is aggregated.

[0015] The default format for the list of compromised honeypots is that each compromised honeypot includes the honeypot type, interaction level, and attack feature summary.

[0016] The process involves inputting a list of "honey spots to be violated" information into a tactical matching model and matching it with the tactical prototype dictionary to obtain the matched tactical stage. This includes: converting the list of "honey spots to be violated" information into a high-dimensional semantic vector; calculating the similarity between the high-dimensional semantic vector and each tactical prototype in the tactical prototype dictionary; and obtaining the tactical stage corresponding to the "honey spot" information based on the tactical prototype with the highest similarity. The similarity calculation satisfies the following formula: ,in, This represents the similarity between a high-dimensional semantic vector and a tactical prototype. This indicates that the honey spot has been violated. High-dimensional semantic vectors Indicates tactical prototype The vector, Indicates temperature parameter, This is the normalization term.

[0017] Based on the timestamps or session order corresponding to the honeypot information, the preceding adjacent tactical phase of the current phase is taken as the pre-phase, and the following adjacent phase of the current phase is taken as the post-phase. TTP matching analysis is performed on a large language model, combining the honeypot information of the tactical phase, keywords from the pre-phase, and post-phase, to obtain TTP tags. The TTP tags of each tactical phase are then concatenated to form an attack chain. This includes: inputting keywords from the pre-phase and post-phase as additional inputs along with the honeypot information of the tactical phase into the large language model, weighting the influence of keywords using an attention mechanism, and outputting matching TTP tags; capturing the temporal dependencies between the output TTP tags, and concatenating the TTP tags of each tactical phase based on these temporal dependencies to form an attack chain.

[0018] Secondly, this invention also provides an attack chain identification device for honey trap attack information, comprising: a data acquisition unit, used to acquire publicly available threat intelligence, TTP descriptions, and threat intelligence labeled datasets, and extract behavioral description texts of TTPs and corresponding tactical tags to form training data; a meta-training unit, used to construct a tactical identification task set, construct a support set and a query set for each task based on the training data, train and update the meta-training model parameters on each task, construct a validation set, fine-tune the updated meta-training model using the validation set, and update the hyperparameters to obtain the trained tactical matching model when the training loss converges; and a dictionary construction unit, used for... The system constructs a tactical prototype dictionary in the tactical matching model for tactical phase matching. The tactical matching unit aggregates the attack trapping information output by the honey trapping array, generates a structured list of honey trapping points according to a preset format based on the attack trapping information, and inputs the list of honey trapping points into the tactical matching model to match with the tactical prototype dictionary to obtain the matched tactical phase. The attack chain identification unit uses a large language model to extract keywords for the tactical phase. For each tactical phase, it combines the honey trapping information of the tactical phase, the keywords of the preceding phase and the subsequent phases into the large language model to perform TTP matching analysis to obtain TTP tags, and splices the TTP tags of each tactical phase to form an attack chain.

[0019] For the beneficial effects of the second aspect mentioned above, please refer to the description of the first aspect mentioned above. Attached Figure Description

[0020] Figure 1 A flowchart illustrating an attack chain identification method for honeycomb attack trapping information provided in an embodiment of the present invention;

[0021] Figure 2 A schematic diagram of an attack chain identification device for honeycomb attack trapping information provided in an embodiment of the present invention;

[0022] Figure 3This is a schematic diagram of an electronic device structure provided in an embodiment of the present invention. Detailed Implementation

[0023] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions in the embodiments of this invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this invention. All other embodiments obtained by those skilled in the art based on the embodiments of this invention without inventive effort are within the scope of protection of this invention. Unless otherwise defined, the technical or scientific terms used herein should have the ordinary meaning understood by those skilled in the art. The terms "comprising" and similar expressions used herein mean that the element or object preceding the word covers the element or object listed following the word and its equivalents, but do not exclude other elements or objects.

[0024] This embodiment provides a method and apparatus for identifying attack chains based on honeycomb attack trapping information.

[0025] See the instruction manual appendix Figure 1 Attack chain identification methods for honey trap attack information include:

[0026] S101: Obtain publicly available threat intelligence, TTP descriptions, and threat intelligence labeled datasets, and extract the behavioral description text of TTPs and corresponding tactical labels to form training data.

[0027] In one specific embodiment, the data sources used for subsequent meta-training are publicly available threat intelligence, TTP text descriptions from the MITRE ATT&CK website, and publicly available threat intelligence labeled datasets. After acquiring the data, the behavioral description text of each TTP and the corresponding tactical label are extracted to form training data for subsequent applications.

[0028] S102: Construct a set of tactical identification tasks, build a support set and a query set for each task based on the training data, train and update the parameters of the meta-training model on each task, construct a validation set, fine-tune the updated meta-training model using the validation set, and update the hyperparameters when the training loss converges to obtain the trained tactical matching model.

[0029] In one possible implementation, task units within the tactical identification task set are constructed through random sampling. Each task includes a support set and a query set. The support set consists of expert-verified behavioral description text and standard MITREATT&CK tactical labels, designed to cover "high-frequency variants + typical expressions + very low-frequency long-tail variants." The query set is used to test the model's adaptability. Both the support set and the query set are text-label pairs derived from the same publicly available data, but diversity is ensured through random sampling, covering both high-frequency and long-tail tactics. Negative samples are injected into some tasks and labeled as negative sample data. These injected negative samples include defensive operation samples, mismatched tactical samples, and irrelevant out-of-domain text.

[0030] In one possible embodiment, training and updating the meta-trained model parameters on each task includes: for a task, performing gradient descent on the support set to obtain task parameters, using the task parameters to calculate the meta-loss on the query set and updating the global parameters; after training all tasks in the tactical identification task set, obtaining general transferable parameters, and using the general transferable parameters to update the meta-trained model parameters.

[0031] In one possible embodiment, the validation set includes positive samples and negative samples. Positive samples are correct tactical description texts labeled with the corresponding tactic. Negative samples include defensive behavior samples, incorrectly identified tactical samples, and irrelevant samples labeled with the negative class. The training loss function is a composite form: positive sample cross-entropy + ... × Negative sample discrimination loss + prototype centering regularization term, where This represents hyperparameters.

[0032] In a specific embodiment, the base model for meta-training is designed using qwen3 embedding (a lightweight large language model based on qwen3 4B fine-tuning). To reduce cost and resource consumption during training, this method uses MemoryOptimizer for real-time memory monitoring / active cleanup; mixed precision is used during training (forward FP16, key parameters FP32 are retained); model parameters adopt NF4 format 4-bit quantization and double quantization strategy to reduce GPU memory usage and support single-card (e.g., 3090) training / inference.

[0033] Meta-training involves both inner and outer loop training. The inner loop training includes: the model learning from the current parameters... Starting from the support set, perform one or more gradient descent operations to obtain specific task parameters. The parameter update satisfies the following formula: ,in, Indicates the learning rate. This represents gradient operation. This represents the loss function on the support set (such as cross-entropy loss). Inner loop training allows the model to be fine-tuned quickly with a small number of samples, starting from existing general knowledge, rather than retraining the entire model for a specific task.

[0034] The outer loop training computes the meta-loss on the query set and updates the global parameters. The loss minimization objective is the outer expected loss, specifically including: in multiple tasks The expected value is taken from the top, and the minimum value is obtained after adaptation in the inner loop on the query set. The meta-loss objective is calculated to satisfy: ,in, This represents the expected value, which is the average across multiple tasks. Indicates task distribution. This represents the loss function on the query set. The model is continuously trained on different tasks to adjust its initial parameters so that it can adapt well to various tasks. Finally, after inner and outer loop training, a general transferable parameter is obtained.

[0035] A validation set is constructed, and hyperparameters are tuned using this set to achieve a balance between high recall and low false positives. The validation set includes positive and negative samples, defined in the same way as the task units in the tactical identification task set: positive samples are correct tactical description texts (e.g., TTP descriptions extracted from MITRE), labeled with the corresponding tactic; negative samples include defensive behavior samples, mislabeled tactical samples, and irrelevant text (e.g., normal system logs), labeled with the negative class. Loss calculation is based on these samples: positive sample cross-entropy encourages correct classification; negative sample discrimination loss penalizes misclassification; prototype centering regularization prevents excessive dispersion of prototype vectors. The samples in the validation set are constructed all at once before training to ensure coverage of diverse scenarios. The training loss during validation set tuning is designed as a composite: positive sample cross-entropy + × Negative sample discrimination loss + Prototype centering regularization term (to prevent excessive propagation of prototypes). This is a hyperparameter.

[0036] The meta-training design enables the model to learn common and rapid adaptation strategies from multiple small tasks, achieving "few-shot learning ability + noise resistance + semantic-level prototype discrimination ability": When encountering a new tactic with only a very small number of samples, the model only needs a small number of gradient updates (1–5 inner loops) to extract the abstract semantic rules of the tactic from the support set, rather than relying on a large number of similar examples to fit surface keywords; multi-level negative samples (defensive behavior, mislabeled tactics, irrelevant text) and label perturbations are introduced during training, enabling the model to learn to distinguish between situations such as "suspicious but harmless" and "superficially similar but semantically different" in the inner and outer loops, thereby automatically filtering probing behaviors in the noisy raw logs of the honeynet, reducing false positives and false negatives, and solving the problems of noise resistance and adaptive discrimination boundaries. Thus, the trained tactical matching model can quickly and accurately identify common and rare (long-tail) tactics with only a small number of manually labeled tactical prototypes, and can directly handle the raw output of the honeynet, robustly resisting probing noise. The tactical matching model can continuously adapt to emerging tactical variations and noisy environments, laying the core semantic foundation for subsequent tactical mapping and attack chain extraction.

[0037] S103: Construct a tactical prototype dictionary in the tactical matching model for tactical phase matching.

[0038] In one possible embodiment, constructing a tactical prototype dictionary in the tactical matching model includes: determining a set of tactical classes based on a set of tactical identification tasks; for each tactical class, mapping it to a set of vectors based on the corresponding support set samples, and calculating the mean or weighted center of the vector set as a tactical prototype vector.

[0039] In the tactical prototype dictionary storage structure, the storage item corresponding to each tactical class includes the tactical prototype vector, update time, merged new sample, and decayed old prototype.

[0040] In a specific embodiment, the construction of the tactical prototype dictionary is carried out as follows: for each tactical class The corresponding support set samples are mapped to a vector set through an embedding function, and the mean or weighted center is calculated as the tactical prototype vector. Among them, calculating the mean (simple average) as a tactical prototype vector is suitable for scenarios where all samples are equally important, and the calculation is simple and fast; calculating the weighted center (such as weighting based on sample confidence or importance) as a tactical prototype vector is suitable for situations where sample quality is uneven, for example, expert-annotated samples can be assigned higher weights.

[0041] A dynamic dictionary can be built, and the prototype storage structure supports online timestamp updates, merging new examples, and decaying old prototypes to adapt to tactical evolution. Merging new examples refers to recalculating the center position of the prototype vector in the tactical prototype dictionary to maintain accuracy after adding a new sample. Decaying old prototypes refers to gradually reducing the weight of old samples to adapt to tactical evolution. These operations ensure that the prototype dictionary is dynamically updated, avoiding obsolescence.

[0042] In one possible implementation, when applying the tactical matching model for actual tactical phase matching, upon encountering a new variant and after manual verification, the sample is added to the corresponding tactical prototype, triggering a local update or a periodic global meta-update. Specifically, a new variant requiring manual verification is determined to have appeared when the following conditions occur: low model confidence, i.e., the similarity score between the input sample and the existing prototype is below a preset threshold; an unknown pattern appears, i.e., the honeycomb output contains rare keywords or behaviors that cannot match existing tactics; signs of tactical evolution, such as significant changes in attack methods (e.g., from traditional PowerShell to cloud API abuse). Local updates refer to updating the prototype vector of a specific tactic in real time (e.g., recalculating the mean) after encountering a new variant and after manual verification, only modifying the prototype dictionary and not involving model parameters; global meta-updates refer to periodically retraining the entire meta-training model according to a planned time period, updating all parameters to absorb a large amount of new data. Local updates only affect the stored items of the prototype dictionary (e.g., vector values, timestamps); global updates modify model weights.

[0043] S104: Aggregate the attack and trapping information output by the honey array, generate a structured list of honey trapping points according to the attack and trapping information in a preset format, and input the list of honey trapping points into the tactical matching model and match it with the tactical prototype dictionary to obtain the matching tactical stage.

[0044] In one possible embodiment, the attack trapping information output by the honey array includes: a preset time threshold and a causal clue judgment standard; when the monitoring time of the honey array reaches the set length of the time threshold, the attack trapping information output by the honey array is aggregated; if it is detected that there are attack trapping information that meet the causal clue judgment standard, the attack trapping information output by the honey array in the current time period is aggregated.

[0045] In one specific embodiment, the timing for aggregating attack trapping information output by the honeycomb array is determined based on two criteria: a preset time threshold and causal clue determination. Typically, attack trapping information output by the honeycomb array is aggregated within a time period equal to the preset time threshold. When attack trapping information can be identified as causal clues, the attack trapping information output by the honeycomb array within the time period from the last aggregation point to the current time is aggregated, and the honeycomb monitoring time period is recalculated. This aggregation method of attack trapping information output by the honeycomb array retains key signals from the original logs while minimizing information loss with minimal preprocessing costs, forming an initial input set for subsequent semantic understanding. For example, situations where attack trapping information can be identified as causal clues include: continuous behavior from the same source IP, the same payload hash, or related network domains.

[0046] The attack trapping information output by the honeycomb array is a structured summary of the honeycomb array's monitoring of all honeypots. This summary is generated after an attacker launches an attack and triggers a honeypot, based on honeypot logs and related system logs. During the aggregation of attack trapping information, information for each honeypot is extracted, including honeypot identifier, interaction level, high-risk indicator, timestamp, source IP / user agent, etc. The system also extracts event summaries and corresponding system traces. The aggregated information is output in a unified format to form a list of compromised honeypot information, containing several textualized honeypot information entries. Each compromised honeypot entry includes the honeypot type, interaction level, and attack characteristic summary.

[0047] For example, the list of compromised honeypots includes: Email gateway phishing honeypot (high-interaction phishing honeypot): attack characteristics include malicious Excel attachment delivery, tricking users into enabling macros; PowerShell terminal honeypot (medium-interaction command line honeypot): attack characteristics include Base64 encoded command download payload; System task scheduling honeypot (low-interaction service simulation honeypot): attack characteristics include creating fake system tasks using schtasks; File system honeypot (high-interaction file system honeypot): attack characteristics include traversing the file system and performing AES encryption; Network egress cloud service honeypot (medium-interaction cloud API honeypot): attack characteristics include AWS S3 Bucket data leakage.

[0048] In one possible embodiment, the list of honey spots to be violated is input into a tactical matching model and matched with a tactical prototype dictionary to obtain the matching tactical stage. This includes: converting the list of honey spots to be violated into a high-dimensional semantic vector; calculating the similarity between the high-dimensional semantic vector and each tactical prototype in the tactical prototype dictionary; and obtaining the tactical stage corresponding to the honey spot information based on the tactical prototype with the highest similarity. The similarity calculation satisfies the following formula: ,in, This represents the similarity between a high-dimensional semantic vector and a tactical prototype. This indicates that the honey spot has been violated. High-dimensional semantic vectors; Indicates tactical prototype ; This represents a temperature parameter used to control the sharpness of the output distribution. This is a normalization term used to ensure that the sum of all similarities is 1.

[0049] In one possible embodiment, when applying the tactical matching model for matching inference, the similarity between the high-dimensional semantic vector and each tactical prototype in the tactical prototype dictionary is calculated using cosine or dot product methods. Furthermore, a temperature-regulated softmax algorithm is used in the calculation to balance the recognition sensitivity of common tactics and long-tail tactics. Temperature parameter Control the sharpness of the output distribution: Low The enhanced model has a higher ability to distinguish rare tactics. Improve the model's tolerance to high-frequency categories. Temperature parameter. Based on the characteristics of data distribution, the system dynamically adjusts itself. The dynamic adjustment mechanism is as follows: when there are many long-tail tactics, reduce... To enhance sensitivity to rare tactics; to improve when common tactics dominate. False alarms due to imbalance. Specific temperature parameter adjustments can be determined by defining the relationship between the proportion of long-tail tactics in the information to be inferred and the magnitude of temperature parameter adjustments. This is achieved through... Through dynamic adjustment, the model can balance accuracy and recall when facing real threat intelligence with extremely uneven sample distribution.

[0050] The tactical matching model, obtained after meta-training, leverages its deep semantic understanding and noise resistance capabilities to convert the honeypot information list into high-dimensional semantic vectors. It can directly process noisy data containing probing requests and error messages, automatically filtering noise and focusing on genuine attack intent, ensuring robustness at the input stage. The model can directly process the summarized honeypot output, simplifying the system architecture, reducing the risk of information loss, and improving processing efficiency. After processing, the tactical matching model can directly output the most likely tactical stage label. The tactical matching process supports millisecond-level response, meeting the streaming processing requirements of honeypot data. The few-shot learning capability gained through meta-training allows the tactical matching model to quickly adapt to new attack patterns, dynamically updating the tactical prototype through a continuous learning mechanism to maintain effective detection of APT attacks. The advantage of this step lies in its high efficiency and real-time performance, with very low average latency, providing a critical time window for proactive defense.

[0051] S105: Use a large language model to extract keywords for the tactical phase. For each tactical phase, combine the information of the honey spots that have been breached in the tactical phase with the keywords of the preceding and subsequent phases and input them into the large language model to perform TTP matching analysis to obtain TTP tags. Then, concatenate the TTP tags of each tactical phase to form an attack chain.

[0052] In one possible embodiment, keyword extraction for the tactical phase using a large language model includes: analyzing the list of compromised honey spots using a large language model and extracting key feature words related to each tactical phase obtained through a tactical matching model.

[0053] This approach combines honeypot detection information from the tactical phase with keywords from preceding and subsequent phases input into a large language model to perform TTP matching analysis and obtain TTP tags. The TTP tags from each tactical phase are then concatenated to form an attack chain. This process includes: inputting keywords from preceding and subsequent phases as additional input along with honeypot detection information from the tactical phase into the large language model; weighting the influence of keywords using an attention mechanism to output matching TTP tags; capturing the temporal dependencies between the output TTP tags; and concatenating the TTP tags from each tactical phase based on these temporal dependencies to form the attack chain. Specifically, based on the timestamp or session order corresponding to the honeypot detection information, the preceding adjacent tactical phase of the current phase is designated as the preceding phase, and the following adjacent phase of the current phase is designated as the subsequent phase.

[0054] In one specific embodiment, a context-constrained approach is used for TTP matching: the tactical phase for TTP matching is the current phase, and the information on the honeypots exploited in the current phase is used as the core analysis subject. Keywords from preceding and subsequent phases are also input into the large language model as important contextual constraints for analysis. During the matching process, the large language model references keyword information from preceding and subsequent phases and uses an attention mechanism to capture sequence dependencies. This context-constrained matching method allows the large language model to understand the behavior of the current phase based on the overall context of the attack chain, ensuring that each TTP matching result is not only based on local information but also conforms to the logical order of the overall attack narrative.

[0055] For example, when matching the "C2 communication" phase, the model references keywords from the preceding "initial intrusion" phase (such as the type of vulnerability used) and keywords from the subsequent "data exfiltration" phase (such as target server information). Contextual cues enable the model to infer correct matches even when these long-tail tactics appear very infrequently in the training data, significantly reducing false negatives and false positives.

[0056] After obtaining the TTP tags for each tactical phase, an attention model is used to capture the temporal dependencies between the TTP tags, which are then used to concatenate the TTP tags to form an attack chain. The final output is a complete and logically coherent TTP chain.

[0057] The final attack chain identification result is structured and operable, as shown in the following example:

[0058] Initial Access: Distributes malicious Excel attachments via phishing emails.

[0059] Corresponding technology: T1566 spear-phishing accessory.

[0060] Analysis: The honeycomb system captured email delivery behavior. Based on the keywords "phishing email" and "attachment," the model inferred from the context that it was in the initial access phase.

[0061] Execution: Triggers the PowerShell script when macros are enabled.

[0062] Corresponding technology: T1059.001 PowerShell.

[0063] Analysis: Honeycomb logs record macro executions and PowerShell calls, and the model identifies these as execution tactics through sequence dependencies.

[0064] Persistence: Creates scheduled tasks to maintain access.

[0065] Corresponding technology: T1053.005 planned task.

[0066] Analysis: Honeycomb detected the creation of planned tasks, and the model mapped to persistent tactics, even though this variant was rare in the training data.

[0067] Impact: Encrypts local files.

[0068] Corresponding technology: T1486 Data encryption is used for influence.

[0069] Analysis: The encryption behavior of the honey array output file is inferred by the model from the preceding stages to influence tactics.

[0070] Command and Control: Data leaked via cloud storage API.

[0071] Corresponding technology: T1537 Service Abuse.

[0072] Analysis: Honeycomb detected abnormal external connections, and the model matched the C2 tactic based on the keyword "cloud storage API" and context.

[0073] Context-constrained TTP matching incorporates multi-stage contextual information, enabling the system to better understand the attacker's overall intent and behavioral logic, reducing misjudgments caused by insufficient local information. Sequence dependency analysis ensures the logical coherence of the output, allowing security teams to obtain a complete, accurate, and actionable description of the attack process, providing a reliable basis for subsequent threat response and defense strategy development. Overall, the context-constrained approach achieves accurate analysis and description of complex, multi-stage attacks, significantly improving the effectiveness and reliability of network security defenses.

[0074] The attack chain identification method for honey trap attack information provided by this invention enables the tactical matching model to acquire the capabilities of a large language model through meta-training. This allows for direct processing of the original honey trap data. An attention-based embedding layer directly maps variable-length sentences into high-dimensional semantic vectors, avoiding information loss. Simultaneously, through a negative sample strategy introduced during training, the model possesses strong noise resistance, effectively filtering probing requests and erroneous information. Experimental results show that this method improves data processing efficiency by over 40% and significantly enhances information fidelity, providing a more reliable data foundation for subsequent analysis.

[0075] By constructing a tactical prototype dictionary through meta-learning, employing a temperature-regulated similarity calculation mechanism, and combining few-shot learning capabilities, the model can infer the essential features of tactics (such as the core of "maintaining access rights" in "persistence" tactics) from a very small number of samples, rather than superficial patterns.

[0076] This innovative approach automates attack chain construction and context awareness. Employing a multi-round context constraint matching mechanism, it uses keywords extracted from preceding and subsequent stages as constraints during the analysis of each TTP phase, combined with an attention model to capture sequence dependencies. It accurately understands the temporal dependencies between tactics (e.g., "persistence" must follow "initial access"), outputting a structured and complete TTP chain. This enables security teams to quickly understand the full picture of an attack based on the output information, reducing response time from hours to minutes, significantly improving threat hunting and incident response efficiency.

[0077] This attack chain identification method for honeypot attack decoy information maps the honeypot output and TTP (Targeted Attack Transaction) chain of an active defense system, thus serving the system. It deeply integrates large language models and cybersecurity knowledge, overcoming the reliance on large amounts of labeled data inherent in traditional methods and significantly improving the ability to identify novel attack techniques and long-tail tactics. By directly processing honeypot output data to construct a complete TTP attack chain, it provides timely and actionable intelligence insights for security teams, especially those working with honeypot active defense systems.

[0078] See the instruction manual appendix Figure 2This embodiment also provides an attack chain identification device for honeycomb attack trapping information, which is used to implement the above method embodiment. The device includes:

[0079] The data acquisition unit 201 is used to acquire publicly available threat intelligence, TTP descriptions, and threat intelligence labeled datasets, and extract the behavioral description text of TTPs and corresponding tactical labels to form training data.

[0080] The meta-training unit 202 is used to construct a set of tactical identification tasks. It constructs a support set and a query set for each task based on the training data, trains and updates the parameters of the meta-training model on each task, constructs a validation set, and fine-tunes the updated meta-training model through the validation set. When the training loss converges, it updates the hyperparameters to obtain the trained tactical matching model.

[0081] Dictionary building unit 203 is used to build a tactical prototype dictionary in the tactical matching model for tactical phase matching.

[0082] The tactical matching unit 204 is used to aggregate the attack and trapping information output by the honey array, generate a structured list of honey trapping points according to a preset format based on the attack and trapping information, and input the list of honey trapping points into the tactical matching model and match it with the tactical prototype dictionary to obtain the matched tactical stage.

[0083] The attack chain identification unit 205 is used to extract keywords for the tactical stage using a large language model. For each tactical stage, it combines the information of the honey spots that have been compromised in the tactical stage with the keywords of the preceding and subsequent stages to perform TTP matching analysis on the large language model to obtain TTP tags. The TTP tags of each tactical stage are then spliced ​​together to form an attack chain.

[0084] All relevant content of each step involved in the above method embodiments can be referenced from the functional description of the corresponding functional module, and will not be repeated here.

[0085] In other embodiments of this application, an electronic device is disclosed, such as... Figure 3 As shown, the electronic device 300 may include: one or more processors 301; a memory 302; a display 303; one or more application programs (not shown); and one or more computer programs 304. These devices can be connected via one or more communication buses 305. The one or more computer programs 304 are stored in the memory and configured to be executed by the one or more processors 301. The one or more computer programs 304 include instructions that can be used to perform actions such as... Figure 1 And the steps in the corresponding embodiments.

[0086] Through the above description of the embodiments, those skilled in the art will clearly understand that, for the sake of convenience and brevity, only the division of the above functional modules is used as an example. In practical applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above. The specific working process of the system, device, and unit described above can be referred to the corresponding process in the foregoing method embodiments, and will not be repeated here.

[0087] In the embodiments of this application, the functional units can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0088] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solutions of the embodiments of this application, essentially, or the parts that contribute to the prior art, or all or part of the technical solutions, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) or processor to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as flash memory, portable hard disk, read-only memory, random access memory, magnetic disk, or optical disk.

[0089] The above description is merely a specific implementation of the embodiments of this application, but the protection scope of the embodiments of this application is not limited thereto. Any changes or substitutions within the technical scope disclosed in the embodiments of this application should be covered within the protection scope of the embodiments of this application. Therefore, the protection scope of the embodiments of this application should be determined by the protection scope of the claims.

Claims

1. A method for identifying attack chains based on honeycomb attack trapping information, characterized in that, include: Obtain publicly available threat intelligence, TTP descriptions, and threat intelligence labeled datasets, and extract the behavioral description text of TTPs and corresponding tactical labels to form training data; Construct a set of tactical identification tasks, build a support set and a query set for each task based on the training data, train and update the parameters of the meta-training model on each task, construct a validation set, fine-tune the updated meta-training model through the validation set, and update the hyperparameters when the training loss converges to obtain the trained tactical matching model. In the tactical matching model, a tactical prototype dictionary is constructed for tactical phase matching; The attack and trapping information output by the aggregated honey array is used to generate a structured list of honey spots that have been violated according to a preset format. The list of honey spots that have been violated is then input into the tactical matching model and matched with the tactical prototype dictionary to obtain the matched tactical stage. Keyword extraction for tactical phases is performed using a large language model. For each tactical phase, TTP matching analysis is performed by combining the information of the honey spots that have been breached in the tactical phase with the keywords of the preceding and subsequent phases. TTP tags are then concatenated to form an attack chain.

2. The method according to claim 1, characterized in that, The meta-trained model parameters are updated on each task, including: For a task, gradient descent is performed on the support set to obtain task parameters. The meta-loss is then calculated on the query set using the task parameters, and the global parameters are updated. After training all tasks in the tactical identification task set, general transferable parameters are obtained, and the parameters of the meta-trained model are updated using the general transferable parameters.

3. The method according to claim 1, characterized in that, The validation set includes positive and negative samples. Positive samples are correct tactical description texts labeled with the corresponding tactic. Negative samples include defensive behavior samples, misidentified tactical samples, and irrelevant samples labeled with the negative class. The training loss function is a composite form: positive sample cross-entropy. Negative sample discrimination loss plus prototype centering regularization term, where... This represents hyperparameters.

4. The method according to claim 1, characterized in that, Constructing a tactical prototype dictionary in the tactical matching model includes: Determine the set of tactical classes based on the set of tactical identification tasks; For each tactical class, the corresponding support set samples are mapped to a vector set, and the mean or weighted center of the vector set is calculated as the tactical prototype vector.

5. The method according to claim 1, characterized in that, In the tactical prototype dictionary storage structure, the storage item corresponding to each tactical class includes the tactical prototype vector, update time, merged new sample, and decayed old prototype.

6. The method according to claim 1, characterized in that, The attack and trapping information output by the aggregated honeycomb array includes: Preset time thresholds and causal clue judgment criteria; When the monitoring time of the honey array reaches the set time threshold, the attack trapping information output by the honey array is aggregated. If attack and trapping information is detected to meet the causal clue judgment criteria, the attack and trapping information output by the honeycomb array within the current time period is aggregated.

7. The method according to claim 1, characterized in that, The default format for the list of compromised honeypots is that each compromised honeypot includes the honeypot type, interaction level, and attack feature summary.

8. The method according to claim 1, characterized in that, The list of compromised honey spots is input into the tactical matching model and matched with the tactical prototype dictionary to obtain the matched tactical phase, including: Convert the list of compromised honey spots into a high-dimensional semantic vector; Calculate the similarity between the high-dimensional semantic vector and each tactical prototype in the tactical prototype dictionary. Based on the tactical prototype with the highest similarity, obtain the tactical stage corresponding to the honey spot information. The similarity calculation satisfies the following formula: ,in, This represents the similarity between a high-dimensional semantic vector and a tactical prototype. This indicates that the honey spot has been violated. High-dimensional semantic vectors A vector representing a tactical prototype. Indicates temperature parameter, This is the normalization term.

9. The method according to claim 1, characterized in that, Based on the timestamp or session order corresponding to the information of the honey spot being violated, the preceding adjacent tactical phase of the current phase is the pre-sequence phase, and the following adjacent phase of the current phase is the subsequent phase. By combining information on honeypots breached during the tactical phase with keyword input from preceding and subsequent phases using a large language model, TTP matching analysis is performed to obtain TTP tags. These TTP tags from each tactical phase are then concatenated to form an attack chain, including: Keywords from the preceding and subsequent stages are used as additional inputs, along with information about honey spots being stepped on in the tactical stage, and then fed into the large language model. The influence of keywords is weighted by an attention mechanism, and the matching TTP tags are output. Capture the temporal dependencies between the output TTP tags, and concatenate the TTP tags of each tactical stage to form an attack chain based on the temporal dependencies.

10. An attack chain identification device for honeycomb attack trapping information, characterized in that, The device includes: The data acquisition unit is used to acquire publicly available threat intelligence, TTP descriptions, and threat intelligence labeled datasets, and extract the behavioral description text of TTPs and corresponding tactical labels to form training data. The meta-training unit is used to construct a set of tactical identification tasks. Based on the training data, it constructs a support set and a query set for each task, trains and updates the parameters of the meta-training model on each task, constructs a validation set, and fine-tunes the updated meta-training model through the validation set. When the training loss converges, it updates the hyperparameters to obtain the trained tactical matching model. A dictionary construction unit is used to construct a tactical prototype dictionary in the tactical matching model for tactical phase matching. The tactical matching unit is used to aggregate the attack and trapping information output by the honey array, generate a structured list of honey spots that have been violated according to a preset format based on the attack and trapping information, and input the list of honey spots that have been violated into the tactical matching model and match it with the tactical prototype dictionary to obtain the matched tactical stage. The attack chain identification unit is used to extract keywords for tactical phases using a large language model. For each tactical phase, it combines the information of the honey spots that have been compromised in the tactical phase with the keywords of the preceding and subsequent phases and inputs them into the large language model to perform TTP matching analysis to obtain TTP tags. The TTP tags of each tactical phase are then concatenated to form an attack chain.

Images