A method and device for identifying an attack chain of honeynet attack decoy information

Abstract

The application provides an attack chain identification method and device for honeycomb attack trapping information, which comprises the following steps: constructing training data; constructing a set of tactical identification tasks, constructing a support set and a query set for each task according to the training data, and performing meta-training on each task to obtain a tactical matching model; constructing a tactical prototype dictionary in the tactical matching model; aggregating attack trapping information output by a honeycomb, generating a structured honey point information list in a preset format according to the attack trapping information, inputting the honey point information list into the tactical matching model, and matching the tactical matching model with the tactical prototype dictionary to obtain a matched tactical stage; extracting keywords of the tactical stage by using a large language model, performing matching analysis on each tactical stage to obtain a TTP label, and splicing the TTP labels of the tactical stages to form an attack chain. The method can directly process honeycomb output data, construct a complete attack chain, and provide operable intelligence insight for active defense in a timely manner.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, and in particular to a method and device for identifying attack chains of attack-luring information of a honeynet. BACKGROUND

[0002] Currently, the active defense system is becoming a key strategy for coping with advanced persistent threats (APTs). APT attacks are instigated by highly specialized attack organizations, and long-term lurk in target networks to steal sensitive data or destroy critical infrastructure. The APT attack process usually follows a multi-stage, strongly structured mode, and there is close tactical cooperation and logical connection between stages. This systematic characteristic requires the defense system to shift from passive response to active defense.

[0003] In active defense, the honeynet, as a core component, simulates real services by deploying decoy environments, lures attacker behavior, and generates raw output data including session logs, behavior trajectories, and probing requests. These data contain rich attack technique and tactic information. It is necessary to automatically extract TTPs from honeynet output and convert the attacker's attack stages into TTP chains to guide active defense.

[0004] However, some attack tactics are rare, and attack tactics are frequently varied, and TTPs will obviously present a long-tail distribution. In the prior art, the commonly used methods based on rules and preprocessing usually require manual definition of features and a large amount of labeled data. The method combining supervised learning with rule library for long-tail tactic identification relies on a large amount of labeled data. It can be seen that the prior art is difficult to adapt to the rapid evolution of attack methods, and APT attacks often use unknown variants and low-frequency tactics. These long-tail tactics are even missing in the training data. The effect of using the prior art method for identification is poor, which easily leads to high threat missed reports.

[0005] Moreover, the existing technology has the shortcomings of insufficient honeynet data processing capability, poor long-tail tactic recognition effect, and lack of effective evolution rules for attack chain analysis: the session logs and behavior trajectories of the honeynet output contain a large number of probing requests and noise interference. The existing technology lacks sufficient noise resistance when processing them, and is prone to misjudgment or missed reports; long-tail tactics appear very rarely in training data, making it difficult for the model to learn effective feature representation, and the model design does not consider the few-shot learning scenario, which cannot effectively distinguish similar but different tactic variants. The method based on fixed rules cannot cover unknown attack variants, and lacks generalization ability; the existing technology often analyzes each security event in isolation when constructing attack chains, which easily leads to attack chain breakage or misjudgment.

[0006] Therefore, it is necessary to provide a method for identifying attack chains of attack-luring information of a honeynet, to efficiently and accurately extract complete TTPs from unstructured honeynet output data. Summary of the Invention

[0007] The purpose of this invention is to provide an attack chain identification method for honeycomb attack trapping information, so as to efficiently and accurately extract complete TTPs from honeycomb attack trapping information and identify attack chains.

[0008] Firstly, the attack chain identification method for honey trap attack information provided by this invention includes: acquiring publicly available threat intelligence, TTP descriptions, and threat intelligence annotation datasets; extracting behavioral description text of the TTP and corresponding tactical tags to form training data; constructing a tactical identification task set; constructing a support set and query set for each task based on the training data; training and updating the parameters of the meta-training model on each task; constructing a validation set; fine-tuning the updated meta-training model using the validation set; updating the hyperparameters when the training loss converges to obtain the trained tactical matching model; constructing a tactical prototype dictionary in the tactical matching model for tactical phase matching; aggregating the attack trap information output by the honey trap; generating a structured list of compromised honey trap information according to a preset format based on the attack trap information; inputting the list of compromised honey trap information into the tactical matching model and matching it with the tactical prototype dictionary to obtain the matched tactical phase; using a large language model to extract keywords for the tactical phase; for each tactical phase, combining the compromised honey trap information of the tactical phase, keywords of the preceding phase and subsequent phases into the large language model for TTP matching analysis to obtain TTP tags; and concatenating the TTP tags of each tactical phase to form an attack chain.

[0009] The beneficial effects of the attack chain identification method for honeypot attack trapping information provided by this invention are as follows: the tactical matching model obtained through meta-training can directly process honeypot data, gain the ability to summarize logic from a very small number of samples, and thus achieve high-accuracy identification of TTPs. By combining keywords from the preceding and following stages as constraints to accurately understand the temporal dependencies between tactics, a structured and complete attack chain can be output.

[0010] In one possible embodiment, training and updating the meta-trained model parameters on each task includes: for a task, performing gradient descent on the support set to obtain task parameters, using the task parameters to calculate the meta-loss on the query set and updating the global parameters; after training all tasks in the tactical identification task set, obtaining general transferable parameters, and using the general transferable parameters to update the meta-trained model parameters.

[0011] In another possible embodiment, the validation set includes positive and negative samples. Positive samples are correct tactical description texts labeled with the corresponding tactic. Negative samples include defensive behavior samples, incorrectly identified tactical samples, and irrelevant samples labeled with the negative class. The training loss function is a composite form: positive sample cross-entropy + ... × Negative sample discrimination loss + prototype centering regularization term, where This represents hyperparameters.

[0012] In other possible embodiments, constructing a tactical prototype dictionary in the tactical matching model includes: determining a set of tactical classes based on a set of tactical identification tasks; for each tactical class, mapping it to a set of vectors based on the corresponding support set samples, and calculating the mean or weighted center of the vector set as a tactical prototype vector.

[0013] In the tactical prototype dictionary storage structure, the storage item corresponding to each tactical class includes the tactical prototype vector, update time, merged new sample, and decayed old prototype.

[0014] The attack trapping information output by the honey array includes: preset time thresholds and causal clue judgment criteria; when the monitoring time of the honey array reaches the set length of the time threshold, the attack trapping information output by the honey array is aggregated; if it is detected that there are attack trapping information that meet the causal clue judgment criteria, the attack trapping information output by the honey array in the current time period is aggregated.

[0015] The default format for the list of compromised honeypots is that each compromised honeypot includes the honeypot type, interaction level, and attack feature summary.

[0016] The process involves inputting a list of honey spots to be violated into a tactical matching model and matching it with the tactical prototype dictionary to obtain the matched tactical stage. This includes: converting the list of honey spots to be violated into a high-dimensional semantic vector; calculating the similarity between the high-dimensional semantic vector and each tactical prototype in the tactical prototype dictionary; and obtaining the tactical stage corresponding to the honey spot information based on the tactical prototype with the highest similarity. The similarity calculation satisfies the following formula: ,in, This represents the similarity between a high-dimensional semantic vector and a tactical prototype. This indicates that the honey spot has been violated. High-dimensional semantic vectors Indicates tactical prototype The vector, Indicates temperature parameter, This is the normalization term.

[0017] According to the time stamp or session order corresponding to the stepped-on honey point information, the previous adjacent tactical stage of the current stage is a pre-stage, and the next adjacent stage of the current stage is a post-stage; the TTP label is obtained by inputting the stepped-on honey point information of the tactical stage, the keywords of the pre-stage and the post-stage into a large language model for TTP matching analysis, and the attack chain is formed by splicing the TTP labels of each tactical stage, including: the keywords of the pre-stage and the keywords of the post-stage are input into the large language model as additional inputs together with the stepped-on honey point information of the tactical stage, the influence of the weighted keywords is combined with the attention mechanism, and the matched TTP label is output; the time sequence dependence between the output TTP labels is captured, and the attack chain is formed by splicing the TTP labels of each tactical stage according to the time sequence dependence.

[0018] In a second aspect, the application further provides an attack chain identification device for honeycomb attack trapping information, comprising: a data acquisition unit for acquiring public threat intelligence, TTP description and threat intelligence annotation data set, extracting the behavior description text of TTP and corresponding tactical label to form training data; a meta-training unit for constructing a set of tactical identification tasks, constructing a support set and a query set for each task according to the training data, updating the meta-training model parameters on each task, constructing a validation set, and optimizing the training of the meta-training model with updated parameters through the validation set, and updating the hyperparameters to obtain the trained tactical matching model when the training loss converges; a dictionary construction unit for constructing a tactical prototype dictionary in the tactical matching model for tactical stage matching; a tactical matching unit for aggregating the attack trapping information output by the honeycomb, generating a structured stepped-on honey point information list according to the attack trapping information in a preset format, inputting the stepped-on honey point information list into the tactical matching model and the tactical prototype dictionary for matching to obtain the matched tactical stage; an attack chain identification unit for keyword extraction of the tactical stage using a large language model, for each tactical stage, inputting the stepped-on honey point information of the tactical stage, the keywords of the pre-stage and the post-stage into the large language model for TTP matching analysis to obtain the TTP label, and splicing the TTP labels of each tactical stage to form the attack chain.

[0019] The beneficial effects of the above-mentioned second aspect can be referred to the description of the above-mentioned first aspect. BRIEF DESCRIPTION OF DRAWINGS

[0020] Figure 1 A flowchart of an attack chain identification method for honeycomb attack trapping information provided by an embodiment of the application;

[0021] Figure 2 A schematic diagram of an attack chain identification device for honeycomb attack trapping information provided by an embodiment of the application;

[0022] Figure 3An electronic device structure schematic diagram provided by an embodiment of the present application. DETAILED DESCRIPTION

[0023] To make the objectives, technical solutions and advantages of the present application clearer, the technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings of the present application. Obviously, the described embodiments are some but not all of the embodiments of the present application. Based on the embodiments of the present application, all other embodiments obtained by those of ordinary skill in the art without creative work fall within the scope of the present application. Unless otherwise defined, the technical terms or scientific terms used herein should be understood as the common meanings thereof by those of ordinary skill in the art to which the present application belongs. The words such as “comprise” and the like used herein mean that the elements or objects before the words encompass the elements or objects listed after the words and equivalents thereof, and do not exclude other elements or objects.

[0024] The embodiment provides an attack chain identification method and device for honeycomb attack trapping information.

[0025] Referring to the drawings accompanying the specification Figure 1 The attack chain identification method for honeycomb attack trapping information comprises the following steps.

[0026] S101: Obtain public threat intelligence, TTP description and threat intelligence annotation data set, extract the behavior description text of the TTP and the corresponding tactical label to form training data.

[0027] In a specific embodiment, the data source applied in subsequent meta-training is public threat intelligence, TTP text description of the MITRE ATT&CK official website, and a public threat intelligence annotation data set. After obtaining the data, the behavior description text of each TTP and the corresponding tactical label are extracted to form training data for subsequent steps.

[0028] S102: Construct a set of tactical identification tasks, construct a support set and a query set for each task according to the training data, update the meta-training model parameters on each task, construct a verification set, and optimize the training of the meta-training model after updating the parameters through the verification set. When the training loss converges, update the hyperparameters to obtain a trained tactical matching model.

[0029] In a possible embodiment, task units in the set of tactical identification tasks are constructed by random sampling, each task including a support set and a query set. The support set is composed of behavior description texts verified by experts and standard MITREATT&CK tactical labels, and the support set is designed to cover "high-frequency variants + typical expressions + extremely low-frequency long-tail variants". The query set is used to test the adaptability of the model. The support set and the query set are text-label pairs derived from the same public data, but are ensured to be diverse by random sampling, covering high-frequency and long-tail tactics. Negative samples are injected in part of the tasks and labeled as negative sample data. The injected negative samples include defense operation samples, mismatched tactic samples and irrelevant out-of-domain texts.

[0030] In a possible embodiment, the meta-training model parameters are updated on each task, including: for one task, gradient descent is performed on the support set to obtain task parameters, the meta-loss is calculated on the query set using the task parameters, and the global parameters are updated; after training all tasks in the set of tactical identification tasks, the general transferable parameters are obtained, and the meta-training model parameters are updated using the general transferable parameters.

[0031] In a possible embodiment, the validation set includes positive samples and negative samples. The positive samples are correct tactical description texts, and the labels are corresponding tactics. The negative samples include defense behavior samples, mismatched tactic samples and irrelevant samples, and the labels are negative classes. The training loss function is in a composite form: positive sample cross-entropy × negative sample discriminant loss + prototype centering regularization term, wherein, represents a hyperparameter.

[0032] In a specific embodiment, the base model of meta-training is designed to use qwen3 embedding (a lightweight large language model based on qwen3 4B fine-tuning). In order to reduce costs and resource occupation during training, the method uses MemoryOptimizer for real-time memory monitoring / active cleaning; mixed precision (forward FP16, key parameter FP32 reserved) is used during training; model parameters are quantized to NF4 format 4-bit and double quantization strategy to reduce memory occupation to support single card (e.g. 3090) training / pushing.

[0033] When meta-training is performed, inner and outer loop training is performed. The inner loop training includes: the model starts from the current parameters , and performs one or more gradient descents on the support set to obtain specific task parameters . The parameter update satisfies the following formula: , wherein, represents the learning rate, represents gradient operation, represents the loss function on the support set (such as cross-entropy loss). Through inner loop training, the model is not retrained from scratch when facing a specific task, but starts from the existing general knowledge and quickly fine-tunes the parameters suitable for the task through a small number of samples.

[0034] The outer loop training calculates the meta-loss on the query set and updates the global parameters, and the loss minimization target is the outer expectation loss, which specifically includes: taking expectation on multiple tasks Minimize the meta-loss on the query set after inner loop adaptation. The meta-loss target calculation satisfies: Wherein, represents the expectation value, which is averaged on multiple tasks; represents the task distribution, represents the loss function on the query set. The model is continuously trained on different tasks to adjust its initial parameters to make it well adapted to various tasks, and finally a general transferable parameter is obtained after inner and outer loop training.

[0035] A validation set is constructed, and the hyperparameters are tuned through the validation set to balance between high recall and low false alarm. The sample data in the validation set includes positive samples and negative samples, and the definition of positive samples and negative samples is the same as the definition of task units in the construction of the tactical recognition task set: the positive sample is a correct tactical description text (such as a TTP description extracted from MITRE), and the label is the corresponding tactic; The negative samples include defensive behavior samples, mislabeled tactic samples, and irrelevant texts (such as normal system logs), and the label is negative. The loss calculation is based on these samples: positive sample cross-entropy encourages correct classification; negative sample discrimination loss punishes misjudgment; prototype centering regularization term prevents prototype vectors from being too dispersed. The samples in the validation set are constructed once before training to ensure coverage of multiple scenarios. The training loss when tuning the validation set is designed in a composite form: positive sample cross-entropy × negative sample discrimination loss + prototype centering regularization term (to prevent prototype from being too scattered), is a hyperparameter.

[0036] The design of the meta-training enables the model to learn common fast adaptation strategies from multiple small tasks, obtaining "few-shot learning ability + noise resistance ability + semantic level prototype discrimination ability": when encountering a new tactic containing only a few samples, the model can extract the abstract semantic rules of the tactic from the support set with only a small number of gradient updates (1-5 steps of internal loop), instead of relying on a large number of similar examples to fit the surface keywords; the introduction of multi-level negative samples (defensive behaviors, mislabeled tactics, irrelevant texts) and label perturbation in training enables the model to learn to distinguish between "suspicious but harmless" and "similar in appearance but different in semantics" in internal and external loops, thereby automatically filtering exploratory behaviors in the noisy raw logs of honeynet, reducing false positives and false negatives, and solving the adaptive problem of noise resistance and discrimination boundary. Thus, the tactic matching model trained in this way can quickly and accurately identify common and rare (long-tail) tactics with only a small amount of human-labeled tactic prototypes, and can directly process the raw output of honeynet and robustly resist exploratory noise. The tactic matching model can continuously adapt to new emerging tactic variants and noise environments, laying a core semantic foundation for subsequent tactic mapping and attack chain extraction.

[0037] S103: Constructing a tactic prototype dictionary in the tactic matching model for tactic stage matching.

[0038] In one possible embodiment, constructing the tactic prototype dictionary in the tactic matching model includes: determining a tactic class set according to a set of tactic identification tasks; for each tactic class, mapping the corresponding support set samples into a set of vectors, and calculating the mean or weighted center of the set of vectors as a tactic prototype vector.

[0039] In the storage structure of the tactic prototype dictionary, the storage item corresponding to each tactic class includes a tactic prototype vector, an update time, a new sample merging, and an old prototype decay.

[0040] In one specific embodiment, the specific method of constructing the tactic prototype dictionary is as follows: for each tactic class , the corresponding support set samples are mapped into a set of vectors by an embedding function, and the mean or weighted center is calculated as a tactic prototype vector . Among them, calculating the mean (simple average) as the tactic prototype vector is applicable to the scenario where all samples are equally important, and is simple and fast; calculating the weighted center (such as weighting according to sample confidence or importance) as the tactic prototype vector is applicable to the case where sample quality is uneven, for example, expert-labeled samples can be given higher weights.

[0041] A dynamic dictionary can be established, and the prototype storage structure supports online updating of timestamps, merging new samples, and decaying old prototypes to cope with tactical evolution. Among them, merging new samples refers to recalculating the center position of the prototype vector in the tactical prototype dictionary after adding new samples to maintain accuracy. Decaying old prototypes refers to gradually reducing the weight of old samples to adapt to tactical evolution. These operations ensure that the prototype dictionary is dynamically updated and avoids becoming outdated.

[0042] In a possible embodiment, when the tactical matching model is applied to actual tactical phase matching application, when a new variant is encountered and verified by artificial checking, the sample is added to the corresponding tactical prototype and triggers local update or regular global meta update. Specifically, when the following conditions occur, it is determined that a new variant that needs to be artificially checked occurs: the model confidence is low, that is, the similarity score of the input sample with the existing prototype is lower than the preset threshold; unknown mode occurs, that is, when the honeypot output contains rare keywords or behaviors, it cannot be matched with the existing tactics; and signs of tactical evolution, such as obvious variation of attack methods (for example, from traditional PowerShell to abuse of cloud API). Local update refers to updating the prototype vector of a specific tactic (such as recalculating the mean) in real time after encountering a new variant and being artificially checked, only modifying the prototype dictionary, and not involving model parameters; global meta update refers to periodically retraining the entire meta training model according to a planned time period and updating all parameters to absorb a large amount of new data. Local update only affects the storage items (such as vector values and timestamps) of the prototype dictionary; global update modifies the model weight.

[0043] S104: Aggregate the attack lure information of the honeypot output, generate a structured list of stepped-on honeypot points according to the attack lure information according to a preset format, and input the list of stepped-on honeypot points into the tactical matching model and the tactical prototype dictionary to obtain a matched tactical phase.

[0044] In a possible embodiment, aggregating the attack lure information of the honeypot output includes a preset time threshold and a causal clue determination standard; when the honeypot monitoring time reaches the time threshold set length, the attack lure information of the honeypot output is aggregated; and if it is detected that there is attack lure information that satisfies the causal clue determination standard, the attack lure information of the honeypot output in the current time period is aggregated.

[0045] In a specific embodiment, two criteria are used to determine the timing of aggregation of attack-lure information output by the honeypot array, according to a preset time threshold and a causal clue: generally, the length of time monitored by the honeypot array according to the preset time threshold is equal to the attack-lure information output by the honeypot array in the time period of the time threshold; when there is a causal clue between the attack-lure information, the attack-lure information output by the honeypot array in the time period from the last aggregation time point to the current time is aggregated, and the length of time monitored by the honeypot array is recalculated. This aggregation of attack-lure information output by the honeypot array not only retains the key signals of the original log, but also reduces information loss at a minimum preprocessing cost, forming an initial input set for subsequent semantic understanding. For example, situations in which attack-lure information can be judged as a causal clue include: continuous behavior of the same source IP, the same payload hash, or related network domains.

[0046] Attack-lure information output by the honeypot is the structured induction of honeypot logs and related system logs after the attacker implements an attack and triggers the honeypot. When performing aggregation of attack-lure information, information of each honeypot is extracted, including honeypot identification, interaction level, high-risk indicator, timestamp, source IP / user agent, etc. The system also extracts event summaries and corresponding system traces. The aggregated information is output in a unified format to form a list of stepped honeypot information including several text-based stepped honeypot information, each piece of stepped honeypot information including honeypot type, interaction level, and attack feature summary.

[0047] For example, the list of stepped honeypot information is as follows: email gateway phishing honeypot (high-interaction phishing honeypot): attack features include malicious Excel attachment delivery and macro enablement; terminal PowerShell honeypot (medium-interaction command line honeypot): attack features include Base64 encoded command download payload; system task scheduling honeypot (low-interaction service simulation honeypot): attack features include schtasks creation of pseudo system tasks; file system honeypot (high-interaction file system honeypot): attack features include traversing the file system and performing AES encryption; network exit cloud service honeypot (medium-interaction cloud API honeypot): attack features include AWS S3 Bucket data exfiltration.

[0048] In a possible embodiment, the list of stepped honeypot information is input into a tactical matching model and matched with a tactical prototype dictionary to obtain a matched tactical phase, including: converting the list of stepped honeypot information into a high-dimensional semantic vector; calculating the similarity of the high-dimensional semantic vector and each tactical prototype in the tactical prototype dictionary, and obtaining the tactical phase corresponding to the stepped honeypot information according to the tactical prototype with the highest similarity, the similarity calculation satisfying the following formula: wherein, represents the similarity of the high-dimensional semantic vector and the tactical prototype; The high-dimensional semantic vector of the honey point information The high-dimensional semantic vector of the honey point information The vector of the tactical prototype The vector of the tactical prototype The temperature parameter is used to control the sharpness of the output distribution is a normalization term to ensure that the sum of all similarities is 1.

[0049] In one possible embodiment, when the tactical matching model is applied for matching inference, the similarity between the high-dimensional semantic vector and each tactical prototype in the tactical prototype dictionary is calculated by the cosine or dot product calculation method, and the temperature-adjusted softmax is used in the calculation to balance the recognition sensitivity of common tactics and long-tail tactics. The temperature parameter controls the sharpness of the output distribution: lower enhances the ability of the model to distinguish rare tactics, and higher improves the fault tolerance of the model to high-frequency categories. The temperature parameter is dynamically adjusted by the system based on the characteristics of the data distribution. The dynamic adjustment mechanism is: when there are more long-tail tactics, lower to enhance the sensitivity to rare tactics; when common tactics dominate, higher balances false positives. The specific temperature parameter adjustment can be determined by defining the correlation between the proportion of long-tail tactics in the information to be inferred and the adjustment range of the temperature parameter. Through dynamic adjustment of the , the model can balance accuracy and recall rate when facing real threat intelligence with extremely unbalanced sample distribution.

[0050] The tactical matching model obtained after meta-training can convert the honey point information list into a high-dimensional semantic vector using its deep semantic understanding ability and noise resistance, can directly process noisy data containing exploratory requests and incorrect information, automatically filter noise, focus on real attack intent, ensure the robustness of the input stage, and the model can directly process the output of the summarized honeycomb, simplifying the system architecture, reducing the risk of information loss, and improving processing efficiency. The tactical matching model can directly output the most likely tactical phase label after processing, and the tactical matching process supports millisecond-level response, meeting the streaming processing needs of honeycomb data. The few-shot learning ability of the tactical matching model obtained through meta-training enables the model to quickly adapt to new attack patterns, and the continuous learning mechanism dynamically updates the tactical prototype, maintaining effective detection of APT attacks. The advantage of this step is high efficiency and real-time performance, with very low average delay, providing a critical time window for proactive defense.

[0051] S105: Key word extraction of the tactical phase is performed using a large language model. For each tactical phase, the key words of the previous phase and the subsequent phase are input into the large language model in combination with the information about the honey point that is stepped on to perform TTP matching analysis to obtain a TTP label. The TTP labels of the respective tactical phases are spliced to form an attack chain.

[0052] In a possible embodiment, the key word extraction of the tactical phase using the large language model includes: analyzing the list of the information about the honey point that is stepped on using the large language model, and extracting key feature words related to the respective tactical phases obtained through the tactical matching model.

[0053] The TTP matching analysis to obtain the TTP label is performed by inputting the key words of the previous phase and the subsequent phase into the large language model in combination with the information about the honey point that is stepped on. The TTP labels of the respective tactical phases are spliced to form an attack chain. Specifically, the key words of the previous phase and the subsequent phase are input into the large language model as additional inputs together with the information about the honey point that is stepped on. The influence of the key words is weighted by using an attention mechanism, and a matching TTP label is output. The time sequence dependency between the output TTP labels is captured, and the TTP labels of the respective tactical phases are spliced to form an attack chain according to the time sequence dependency. The occurrence time stamp or the session order corresponding to the information about the honey point that is stepped on is used as a reference. The previous adjacent tactical phase of the current phase is used as the previous phase, and the subsequent adjacent phase of the current phase is used as the subsequent phase.

[0054] In a specific embodiment, a method with context constraints is used for TTP matching. The tactical phase for which TTP matching is performed is the current phase. The information about the honey point that is stepped on in the current phase is used as the core analysis subject. The key words of the previous phase and the subsequent phase are used as important context constraints and are input into the large language model for analysis. During the matching process, the large language model refers to the key word information of the previous and subsequent phases, and captures the sequence dependency by using an attention mechanism. The matching method with context constraints enables the large language model to understand the behavior of the current phase based on the overall context of the attack chain, and ensures that each TTP matching result is not only based on local information, but also meets the logical order of the overall attack narrative.

[0055] For example, when matching the "C2 communication" phase, the model refers to the key words of the previous "initial intrusion" phase (such as the type of vulnerability used) and the key words of the subsequent "data exfiltration" phase (such as the target server information). The context clues enable the model to infer the correct matching even when the number of occurrences in the long-tail tactical training data is extremely small, significantly reducing false negatives and false positives.

[0056] After obtaining the TTP label of each tactical phase, the time sequence dependency between the TTP labels is captured by using an attention model to splice the TTP labels to form an attack chain. Finally, a complete and logically coherent TTP chain is output.

[0057] The final output attack chain identification result is structured and operational, and the output example is as follows:

[0058] Initial Access: Malicious Excel attachment distributed through phishing email.

[0059] Corresponding technology: T1566 Spear-phishing attachment.

[0060] Analysis: The honeynet captured the mail delivery behavior, and the model inferred it as the initial access stage based on the keywords "phishing email" and "attachment" combined with the context.

[0061] Execution: PowerShell script triggered after enabling macros.

[0062] Corresponding technology: T1059.001 PowerShell.

[0063] Analysis: The honeynet logs record macro execution and PowerShell invocation, and the model identifies it as the execution tactic through sequence dependency.

[0064] Persistence: Create a scheduled task to maintain access.

[0065] Corresponding technology: T1053.005 Scheduled task.

[0066] Analysis: The honeynet detects the creation of a scheduled task, and the model maps it to the persistence tactic, even though this variant is rare in training data.

[0067] Impact: Encrypt files on the local system.

[0068] Corresponding technology: T1486 Data encryption for impact.

[0069] Analysis: The honeynet outputs file encryption behavior, and the model infers it as the impact tactic combined with the previous stage.

[0070] Command and Control: Exfiltrate data through cloud storage API.

[0071] Corresponding technology: T1537 Service abuse.

[0072] Analysis: The honeynet monitors abnormal external connections, and the model matches the "cloud storage API" keyword and context to the C2 tactic.

[0073] The TTP matching method with context constraints can better understand the overall intention and behavior logic of the attacker by integrating multi-stage context information, reducing misjudgments caused by insufficient local information. The sequence-dependent analysis ensures the logical coherence of the output results, enabling the security team to obtain a complete, accurate, and actionable attack process description, providing a reliable basis for subsequent threat response and defense strategy formulation. Overall, through the context-constrained method, accurate analysis and description of complex multi-stage attacks are achieved, greatly improving the efficiency and reliability of network security defense.

[0074] The attack chain identification method for honeypot attack trapping information provided by the application can make the tactical matching model obtain the ability of a large language model through meta-training, can realize direct processing of original honeypot data, adopt an embedding layer based on an attention mechanism to directly map a variable-length sentence into a high-dimensional semantic vector, and avoid information loss. Meanwhile, through a negative sample strategy introduced in training, the model has strong anti-noise capability and can effectively filter exploratory requests and false information. Actual measurement shows that the data processing efficiency of the method is improved by more than 40%, and the information fidelity is significantly improved, providing a more reliable data basis for subsequent analysis.

[0075] The tactical prototype dictionary is constructed through meta-learning, a similarity calculation mechanism with temperature adjustment is adopted, and a few-shot learning capability is combined, so that the model can induce the essential features (such as the core of the "persistence" tactic "maintaining access permission") of the tactics from a small amount of samples instead of surface patterns.

[0076] The automatic construction and context awareness of the attack chain are innovatively realized. A multi-round context-constrained matching mechanism is adopted, and when analyzing each TTP stage, the keywords extracted from the previous and subsequent stages are taken as constraint conditions, and an attention model is combined to capture the sequence-dependent relationship. The timing dependence between tactics (such as "persistence" must be after "initial access") can be accurately understood, and a structured complete TTP chain can be output. This enables the security team to quickly understand the overall picture of the attack according to the output information, and the response time is shortened from hours to minutes, greatly improving the efficiency of threat hunting and emergency response.

[0077] The attack chain identification method for honeypot attack trapping information maps the honeypot output and the TTP chain of the active defense system, and serves the active defense system. The large language model and the knowledge in the field of network security are deeply integrated, which can break through the dependence on a large amount of labeled data in traditional methods, and significantly improve the identification ability of new attack methods and long-tail tactics. A complete TTP attack chain is constructed by directly processing the honeypot output data, which provides timely and actionable intelligence insights for the security team, especially the honeypot active defense system.

[0078] The accompanying drawings are referred to in the description of the application Figure 2This embodiment also provides an attack chain identification device for honeycomb attack trapping information, which is used to implement the above method embodiment. The device includes:

[0079] The data acquisition unit 201 is used to acquire publicly available threat intelligence, TTP descriptions, and threat intelligence labeled datasets, and extract the behavioral description text of TTPs and corresponding tactical labels to form training data.

[0080] The meta-training unit 202 is used to construct a set of tactical identification tasks. It constructs a support set and a query set for each task based on the training data, trains and updates the parameters of the meta-training model on each task, constructs a validation set, and fine-tunes the updated meta-training model through the validation set. When the training loss converges, it updates the hyperparameters to obtain the trained tactical matching model.

[0081] Dictionary building unit 203 is used to build a tactical prototype dictionary in the tactical matching model for tactical phase matching.

[0082] The tactical matching unit 204 is used to aggregate the attack and trapping information output by the honey array, generate a structured list of honey trapping points according to a preset format based on the attack and trapping information, and input the list of honey trapping points into the tactical matching model and match it with the tactical prototype dictionary to obtain the matched tactical stage.

[0083] The attack chain identification unit 205 is used to extract keywords for the tactical stage using a large language model. For each tactical stage, it combines the information of the honey spots that have been compromised in the tactical stage with the keywords of the preceding and subsequent stages to perform TTP matching analysis on the large language model to obtain TTP tags. The TTP tags of each tactical stage are then spliced ​​together to form an attack chain.

[0084] All relevant content of each step involved in the above method embodiments can be referenced from the functional description of the corresponding functional module, and will not be repeated here.

[0085] In other embodiments of this application, an electronic device is disclosed, such as... Figure 3 As shown, the electronic device 300 may include: one or more processors 301; a memory 302; a display 303; one or more application programs (not shown); and one or more computer programs 304. These devices can be connected via one or more communication buses 305. The one or more computer programs 304 are stored in the memory and configured to be executed by the one or more processors 301. The one or more computer programs 304 include instructions that can be used to perform actions such as... Figure 1 And the various steps in the corresponding embodiments.

[0086] Those skilled in the art can clearly understand the technical solutions of the present application according to the above description of the embodiments, and for the convenience and brevity of description, only the division of the above functional modules is taken as an example, and in actual application, the above functions can be completed by different functional modules according to needs, that is, the internal structure of the device is divided into different functional modules to complete all or part of the functions described above. The specific working process of the system, device and unit described above can refer to the corresponding process in the foregoing method embodiments, and will not be repeated here.

[0087] The functional units in the various embodiments of the present application can be integrated in one processing unit, or each unit can be physically present separately, or two or more units can be integrated in one unit. The integrated unit can be realized in the form of hardware or in the form of a software functional unit.

[0088] The integrated unit, if realized in the form of a software functional unit and sold or used as an independent product, can be stored in a computer readable storage medium. Based on this understanding, the technical solutions of the embodiments of the present application essentially or say the part that contributes to the prior art or the whole or part of the technical solutions can be embodied in the form of a software product. The computer software product is stored in a storage medium, including a plurality of instructions to make a computer device (which can be a personal computer, a server, or a network device, etc.) or a processor execute all or part of the steps of the method described in various embodiments of the present application. The foregoing storage medium includes: a flash memory, a mobile hard disk, a read-only memory, a random access memory, a magnetic disk or an optical disk, and various media that can store program codes.

[0089] The above is only a specific implementation of the embodiments of the present application, but the protection scope of the embodiments of the present application is not limited to this. Any change or replacement within the technical scope disclosed in the embodiments of the present application should be covered in the protection scope of the embodiments of the present application. Therefore, the protection scope of the embodiments of the present application should be subject to the protection scope of the claims.

Claims

1. A method for identifying an attack chain of honeynet attack decoy information, characterized in that, The method comprises the following steps: Obtain public threat intelligence, TTP description and threat intelligence annotation data set, extract the behavior description text of TTP and the corresponding tactical label to form training data; Construct a set of tactical recognition tasks, construct a support set and a query set for each task according to the training data, update the meta-training model parameters on each task, construct a validation set, and optimize the training of the meta-training model after updating the parameters through the validation set, and update the hyperparameters to obtain the trained tactical matching model when the training loss converges; Construct a tactical prototype dictionary in the tactical matching model for tactical phase matching; Aggregate the attack lure information output by the honeypot, generate a structured list of stepped-on honeypot information according to the attack lure information in a preset format, input the stepped-on honeypot information list into the tactical matching model and the tactical prototype dictionary to obtain the matched tactical phase; Use a large language model to extract keywords for the tactical phase, input the keywords of each tactical phase into the large language model for TTP matching analysis to obtain TTP labels, and splice the TTP labels of each tactical phase to form an attack chain.

2. The method of claim 1, wherein, Updating the meta-training model parameters on each task includes: For a task, gradient descent is performed on the support set to obtain task parameters, and the meta-loss is calculated on the query set using the task parameters to update the global parameters; After training all tasks in the set of tactical recognition tasks, obtain the general transferable parameters, and update the meta-training model parameters using the general transferable parameters.

3. The method of claim 1, wherein, The validation set includes positive samples and negative samples, the positive samples are correct tactical description texts, and the labels are corresponding tactics, the negative samples include defense behavior samples, wrong tactical samples and irrelevant samples, and the labels are negative classes; The training loss function is a composite form: cross-entropy of positive samples discrimination loss of negative samples + prototype centering regularization term, where, denotes a hyperparameter.

4. The method of claim 1, wherein, Constructing a tactical prototype dictionary in the tactical matching model includes: Determine a set of tactical classes according to the set of tactical recognition tasks; For each tactical class, map the corresponding support set samples to a vector set, and calculate the mean or weighted center of the vector set as a tactical prototype vector.

5. The method of claim 1, wherein, In the storage structure of the tactical prototype dictionary, the storage item corresponding to each tactical class includes a tactical prototype vector, an update time, a new sample merging and an old prototype decay.

6. The method of claim 1, wherein, Aggregating the attack lure information output by the honeypot includes: A preset time threshold and a causal clue determination standard; When the honeypot monitoring time reaches the time threshold set length, aggregate the attack lure information output by the honeypot; If it is detected that there is attack lure information between them that meets the causal clue determination standard, aggregate the attack lure information output by the honeypot in the current time period.

7. The method of claim 1, wherein, The preset format of the stepped-on honeypot information list is that each stepped-on honeypot information includes a honeypot type, an interaction level and an attack feature abstract.

8. The method of claim 1, wherein, Converting the stepped-on honeypot information list into a high-dimensional semantic vector; Calculate the similarity of the high-dimensional semantic vector and each tactical prototype in the tactical prototype dictionary, and obtain the tactical phase corresponding to the stepped-on honeypot information according to the tactical prototype with the highest similarity, and the similarity calculation satisfies the following formula: ​ ,in, This represents the similarity between a high-dimensional semantic vector and a tactical prototype. This indicates that the honey spot has been violated. High-dimensional semantic vectors A vector representing a tactical prototype. Indicates temperature parameter, This is the normalization term.

9. The method of claim 1, wherein, According to the occurrence time stamp or session order corresponding to the stepped honey point information, the previous adjacent tactical stage of the current stage is a prophase stage, and the next adjacent stage of the current stage is a subsequent stage; The TTP labels of each tactical stage are spliced to form an attack chain, including: The keywords of the prophase stage and the subsequent stage are input into the large language model as additional inputs together with the stepped honey point information of the tactical stage, and the influence of the weighted keywords is combined with the attention mechanism to output the matched TTP labels; The time sequence dependence between the output TTP labels is captured, and the TTP labels of each tactical stage are spliced to form an attack chain according to the time sequence dependence.

10. An attack chain identification device for honeynet attack decoy information, characterized by, The device comprises: A data acquisition unit is configured to acquire public threat intelligence, TTP description and threat intelligence annotation dataset, extract the behavior description text of TTP and corresponding tactical label to form training data; A meta-training unit is configured to construct a set of tactical recognition tasks, construct a support set and a query set for each task according to the training data, train and update the meta-training model parameters on each task, construct a validation set, and optimize the training of the meta-training model with updated parameters through the validation set. When the training loss converges, update the hyperparameters to obtain a trained tactical matching model; A dictionary construction unit is configured to construct a tactical prototype dictionary in the tactical matching model for tactical stage matching; A tactical matching unit is configured to aggregate the attack lure information output by the honey array, generate a structured stepped honey point information list in a preset format according to the attack lure information, input the stepped honey point information list into the tactical matching model and match the tactical prototype dictionary to obtain the matched tactical stage; An attack chain identification unit is configured to extract keywords of the tactical stage using a large language model, input the keywords of the tactical stage, the keywords of the prophase stage and the subsequent stage into the large language model to analyze the TTP matching and obtain the TTP labels of each tactical stage, and splice the TTP labels of each tactical stage to form an attack chain.

Images