An intelligent target deployment method and system for power scene APT attack

Abstract

The application discloses a kind of intelligent target deployment methods and systems for power scene APT attack, comprising: receiving target scene parameters by MCP client;Context compiler generates high-quality prompt set based on parameter access power knowledge base;Decision server aggregates prompt set, attack log and threat intelligence, and generates vulnerability injection strategy through multi-objective optimization;Large language model generates infrastructure code paradigm multi-modal decoy service description file according to strategy;Security deployment server implements containerization deployment;Log module collects interactive log and stream washing update information base.The application realizes the real-time cooperation of large language model and power field knowledge base through MCP protocol, solves the problem of low efficiency of artificial target and general model field knowledge mismatch, significantly improves APT attack trapping rate and deployment timeliness.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of power system network security, and particularly relates to an intelligent target deployment method and system for APT attacks in a power scenario. BACKGROUND

[0002] With the continuous promotion of the intelligentization and digitalization transformation of new power systems, the security threats faced by the network thereof are increasingly complex and advanced. Advanced persistent threat attacks have become a core challenge for network security in the energy industry. APT attacks have characteristics such as long-term incubation, directional penetration, and multi-stage evolution. Attackers often use means such as supply chain pollution and zero-day vulnerability exploitation to try to steal power grid operation data or destroy critical control systems. In the scenario of high proportion of new energy access, the traditional static defense system centered on the border cannot effectively cope with the cross-domain penetration and hidden control threats of APT attacks. Therefore, it is urgent to build an active defense system with high simulation trapping capability and real-time threat perception capability.

[0003] At present, the defense schemes against APT attacks mainly have the following two technical defects:

[0004] First, the efficiency bottleneck of manually designed Web targets. The existing mainstream scheme relies on security experts to manually build high-simulation Web targets to simulate SCADA monitoring interfaces, power trading system interfaces and other real business systems. Although the simulation degree is high, this method has the following significant defects: the manual construction process is complex and time-consuming, and it takes an average of 2 to 5 working days to develop a single page, which cannot meet the minute-level deployment needs of APT attack incident response; in the face of constantly evolving new attack methods, it is difficult for manual methods to adjust the target structure in a timely manner, resulting in defense lag; in addition, this scheme also needs to rely on professional teams for long-term maintenance, and the deployment and operation and maintenance costs are high.

[0005] Second, the domain knowledge mismatch problem of automatically generating targets based on general large language models. In order to improve efficiency, existing research attempts to introduce large language models to automatically generate target content. However, due to the lack of professional knowledge in the power industrial control field in the training data of general large language models, and the inability to access real-time system data, the generated results have serious deviations: 1) protocol distortion: the field structure of the generated IEC 61850, Modbus and other industrial control protocol interfaces often does not conform to the actual specifications, and is easy to be recognized by attackers; 2) physical distortion: the generated device state data (such as transformer load curve, photovoltaic prediction value) violates the basic physical laws, significantly reducing the credibility of the target, and research shows that the recognition rate of such "physical distortion" targets is as high as 82%; 3) lack of timeliness: the model cannot access the latest device parameters, operating status and attack tactics, resulting in a lack of pertinence of the generated targets, forming "low-value decoys", and the average survival time is short.

[0006] Therefore, how to overcome the above defects and build an intelligent defense system that can automatically and quickly generate high-simulation and high-target Web targets and form a closed-loop learning capability has become a technical problem to be solved in the field. SUMMARY

[0007] To solve the above problems, the application provides an intelligent target deployment method for APT attacks in a power scenario.

[0008] In a first aspect, the application provides an intelligent target deployment method for APT attacks in a power scenario, comprising:

[0009] S1, receiving target Web target scene parameters input by a security administrator through an MCP client, the parameters including target type, simulation degree, protocol type and persistence time;

[0010] S2, the context compiler accesses the power knowledge base based on the scene parameters, obtains power industrial control protocol specifications and device behavior data through a vectorized retrieval component, and generates a high-quality prompt word set containing power field semantics;

[0011] S3, the decision server aggregates the high-quality prompt word set, attack behavior characteristics in the historical attack log library, and vulnerability information from real-time threat intelligence sources, and generates a vulnerability feature injection strategy through a multi-objective optimization algorithm;

[0012] S4, the large language model generates a multi-modal decoy service description file based on the vulnerability feature injection strategy and the high-quality prompt word set;

[0013] S5, containerized deployment is implemented according to the multi-modal decoy service description file, and one or more Web target instances are generated;

[0014] S6, collecting the interaction log of the Web target node, performing stream cleaning and structured processing, and updating the log information library.

[0015] Further, the step S2 comprises:

[0016] Semantic label extraction is performed on the scene parameters to identify the protocol type and page structure requirements;

[0017] The vectorized retrieval component matches related protocol fields and device parameter constraints in the power knowledge base;

[0018] According to the search results, fill in the protocol message format, parameter field and device role attribute information, and generate a prompt word set containing power business logic.

[0019] Further, the vulnerability feature injection strategy generated by the multi-objective optimization algorithm in step S3 is:

[0020] A multi-objective optimization model is established by weighing the attractiveness of the web target of the historical high-risk component, the system deployment cost, the new threat exploitation trend revealed by external threat intelligence, and the potential behavior trajectory revealed by the attacker portrait;

[0021] Automatic reasoning is performed through the multi-objective optimization model to generate a vulnerability feature injection strategy described in a domain-specific language format, which includes target components, injection vulnerability types, and deployment location parameters.

[0022] Further, the multi-modal decoy service description file in step S4 is a JSON format configuration file adopting an infrastructure as code paradigm, which is used to describe the front-end page structure of the web target system, the industrial control protocol simulation interface, the pseudo data generation and interaction induction logic, and the built-in security monitoring and auditing module.

[0023] Further, step S4 further includes a verification step after generating the multi-modal decoy service description file: automatic semantic consistency detection, business logic reasonableness test, and sensitive parameter filtering are performed on the generated multi-modal decoy service description file.

[0024] Further, the implementation containerized deployment in step S5 is to independently package each web target instance in the multi-modal decoy service description file into a Docker container and assign it to a designated physically isolated network node for running.

[0025] Further, the stream cleaning and structuring processing in step S6 includes:

[0026] Protocol analysis and structuring processing are performed on the collected log data to unify them into a standardized Schema;

[0027] A noise filtering mechanism is used to eliminate normal traffic and false trigger requests;

[0028] An abnormality detection algorithm is used to identify undefined abnormal behaviors, and threat labels are generated for key attack behaviors and written into the log information library.

[0029] In a second aspect, the present application provides an intelligent target deployment system for APT attacks in a power scenario, which includes:

[0030] An MCP client module is used to receive user input target web target scenario parameters;

[0031] A context compiler module connected with an electric power knowledge base and a vectorization retrieval component, configured to access the electric power knowledge base through the vectorization retrieval component to perform semantic completion according to the target Web target scene parameters, and generate a high-quality prompt word set containing electric power field semantics; the electric power knowledge base contains electric power standard documents, industrial control system design manuals and vulnerability feature data;

[0032] A decision server module configured to aggregate the high-quality prompt word set, historical attack logs and real-time threat intelligence, and generate an optimal vulnerability feature injection strategy described in a field-specific language format by weighing a multi-objective optimization model of the historical high-risk component Web target attractiveness, system deployment cost, external threat exploitation trend and attacker behavior trajectory;

[0033] A large language model module configured to generate a multi-modal decoy service description file adopting an infrastructure-as-code paradigm according to the high-quality prompt word set and the optimal vulnerability feature injection strategy;

[0034] A security deployment server module configured to package a Web target instance into a Docker container and deploy it in a physically isolated network node according to the multi-modal decoy service description file, and implement containerized deployment;

[0035] A log processing module configured to collect interaction behavior logs of the Web target instance, perform stream cleaning and structured processing, and update a log information database; the stream cleaning and structured processing includes protocol analysis and structured processing, noise filtering, and abnormality discrimination and threat label generation through an abnormality detection algorithm;

[0036] A verification module configured to perform automatic semantic consistency detection, business logic rationality verification and sensitive parameter filtering on the multi-modal decoy service description file generated by the large language model module.

[0037] In a third aspect, an electronic device is provided, which includes at least one processor and a memory connected with the at least one processor in communication, wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the steps of the intelligent target deployment method for APT attacks in the electric power scenario according to any one of the embodiments of the present application.

[0038] In a fourth aspect, the present application further provides a computer-readable storage medium having a computer program stored thereon, and the program instructions are executed by a processor to enable the processor to perform the steps of the intelligent target deployment method for APT attacks in the electric power scenario according to any one of the embodiments of the present application.

[0039] The intelligent target deployment method and system for APT attacks in the power scenario of the application have the following beneficial effects:

[0040] 1. The domain semantic enhancement mechanism driven by prompt words significantly improves the simulation degree of Web targets. The application constructs a semantic enhancement prompt word generation mechanism for the power knowledge base, combines prompt word engineering technology, and effectively makes up for the knowledge defects of general large language models in power industrial control protocols, device behavior, parameter constraints, etc. The system can generate a context prompt set with professional semantics in the power industry in real time, guide the large language model to output high-simulation Web targets with real protocol structure, reasonable physical characteristics, and consistent business logic, significantly improve the credibility of decoys, and reduce the probability of being detected.

[0041] 2. The data collaboration mechanism driven by MCP protocol breaks the data island restriction and realizes intelligent closed-loop perception. The application first introduces MCP protocol as a unified communication bridge between the model and local knowledge sources, log information base, and policy server, realizes the structured information flow transmission between prompt word construction, policy selection, and deployment feedback. This mechanism effectively breaks the data gap problem caused by isolated model operation, enabling the system to integrate multi-source heterogeneous data such as historical attack trajectories, real-time threat intelligence, and topology deployment positions, and build a sustainable learning and iterative optimization APT defense closed-loop architecture. BRIEF DESCRIPTION OF DRAWINGS

[0042] In order to more clearly illustrate the technical solutions of the embodiments of the application, the following will briefly introduce the drawings needed to be used in the embodiment description. Obviously, the drawings in the following description are some embodiments of the application, and for those skilled in the art, other drawings can also be obtained without creative labor on the basis of these drawings.

[0043] Figure 1 A flowchart of an intelligent target deployment method for APT attacks in the power scenario is provided for an embodiment of the application.

[0044] Figure 2 A Web target scene parameter input and MCP client and engine transmission diagram is provided for an embodiment of the application.

[0045] Figure 3 A context compiler generates a high-quality prompt word set interaction diagram in the power field for an embodiment of the application.

[0046] Figure 4 A decision server multi-source data fusion and vulnerability feature injection strategy generation diagram is provided for an embodiment of the application.

[0047] Figure 5The large language model provided by an embodiment of the application generates a multi-modal decoy service description file and a verification graph;

[0048] Figure 6 The Web target instance Docker containerization packaging and physical isolation deployment graph provided by an embodiment of the application;

[0049] Figure 7 The Web target log collection, streaming cleaning and log information database updating graph provided by an embodiment of the application;

[0050] Figure 8 The module interaction architecture diagram of the intelligent target deployment method for the power scenario APT attack provided by an embodiment of the application;

[0051] Figure 9 The structural schematic diagram of the electronic device provided by an embodiment of the application. DETAILED DESCRIPTION

[0052] To make the objectives, technical solutions and advantages of the embodiments of the application clearer, the technical solutions in the embodiments of the application will be described below in a clear and complete manner with reference to the drawings in the embodiments of the application. Obviously, the described embodiments are only some of the embodiments of the application, rather than all the embodiments of the application. Based on the embodiments in the application, all other embodiments obtained by those of ordinary skill in the art without creative work fall within the protection scope of the application.

[0053] Please refer to Figure 1 Fig. 1 shows a flowchart of the intelligent target deployment method for the power scenario APT attack according to an embodiment of the application.

[0054] S1, receiving the target Web target scenario parameters input by the security administrator through the MCP client, the parameters including the target type, the simulation degree, the protocol type and the persistence time;

[0055] Please refer to Figure 2 In this step, the security administrator configures the target scenario through the graphical interface MCP client module. The administrator can select a preset template (such as “photovoltaic power station SCADA monitoring login interface”, “virtual power plant REST API interface”, etc.), or can perform custom configuration. When custom configuration is performed, the specific target type (such as Web background management page), simulation degree (high / medium / low), protocol type (such as IEC 61850, Modbus TCP, DLT645) and persistence time, etc. parameters need to be input.

[0056] The MCP client module encapsulates these structured parameters input by the administrator into a "scene parameter request" message conforming to the MCP protocol, and sends it to the MCP protocol engine of the system. The MCP protocol engine generates a globally unique task ID for this request, and broadcasts the scene parameters to subsequent context compiler modules, decision server modules, etc., triggering the entire deployment process.

[0057] S2, the context compiler accesses the power knowledge base based on the scene parameters, obtains power industrial control protocol specifications and device behavior data through a vectorized retrieval component, and generates a high-quality prompt word set containing power field semantics;

[0058] Specifically, the step S2 includes:

[0059] Semantic label extraction is performed on the scene parameters to identify protocol types and page structure requirements;

[0060] The vectorized retrieval component matches related protocol fields and device parameter constraints in the power knowledge base;

[0061] According to the retrieval result, the protocol message format, parameter field and device role attribute information are filled in to generate a prompt word set containing power business logic.

[0062] Please refer to Figure 3 In this step, after the context compiler module receives the scene parameters broadcast by the MCP protocol engine, it starts the prompt word generation process.

[0063] First, semantic label extraction is performed on the scene parameters to parse the key "protocol type" (such as IEC60870-5-104, Modbus TCP, DLT645, etc.), target component (such as SCADA interface, RTU device, substation control logic, etc.) and "page structure requirement" (such as login interface, parameter interaction page) and other information.

[0064] Next, the compiler calls its integrated vectorized retrieval component (such as FAISS or Milvus) to access the power knowledge base in real time with the above semantic labels as query conditions. The knowledge base stores structured and unstructured data such as power standard documents (such as IEC protocol white paper), industrial control system design manual, typical device parameter table and known vulnerability features. The vectorized retrieval component quickly matches the most relevant information fragments in the knowledge base with the current scene, and performs semantic completion to fill in the protocol message format, common parameter fields, device role attributes, topology context and other information in the industry specifications.

[0065] Finally, the context compiler module will fill the retrieved protocol fields, device parameter constraints, and business logic information into the base prompt template dynamically to generate a high-quality prompt set containing power domain semantics. For example, the generated prompt may include: "Generate a simulated login interface for the smart meter management system under the DLT645 protocol, including real parameter verification processes and protocol field interaction logic. Need to simulate the console style and integrate hidden entry for inducing attackers to input illegal commands."

[0066] S3, the decision server aggregates the high-quality prompt set, attack behavior characteristics in the historical attack log library, and vulnerability information from real-time threat intelligence sources, and generates a vulnerability feature injection strategy through a multi-objective optimization algorithm;

[0067] Specifically, the vulnerability feature injection strategy generated in step S3 through a multi-objective optimization algorithm is:

[0068] Trade off the web target attractiveness of historical high-risk components, system deployment cost, new threat exploitation trends revealed by external threat intelligence, and potential behavior trajectories revealed by attacker portraits, and establish a multi-objective optimization model;

[0069] Automatic reasoning is performed through the multi-objective optimization model to generate a vulnerability feature injection strategy described in a domain-specific language format, which includes target components, injection vulnerability types, and deployment location parameters.

[0070] Please refer to Figure 4 In this step, the decision server module receives scheduling instructions from the MCP protocol engine and high-quality prompt sets from the context compiler module. Then, it actively reads historical attack sessions, exploit chains, and behavior characteristics related to the current target type from the historical attack log library (for example, attackers often scan specific function codes or register addresses). At the same time, it also obtains the latest related vulnerability information (such as a buffer overflow vulnerability CVE-2023-XXXX in a Modbus library) and APT organization tactical reports from real-time threat intelligence sources (such as CVE databases and threat intelligence platforms) through API interfaces.

[0071] The decision server module has a multi-objective optimization model. This model structures and models all the above information as a whole optimization problem. The core of the model is to automatically trade off attractiveness, cost, interaction guidance, and detection breadth as multiple objectives.

[0072] By solving this multi-objective optimization problem, the decision server module automatically infers and generates an optimal vulnerability feature injection strategy described in a domain-specific language format. The strategy file describes parameters such as target components, injection vulnerability types, deployment locations, resource quotas, protocol coverage, etc. The strategy is submitted to the security administrator for final review and confirmation through the MCP protocol engine.

[0073] S4, the large language model generates a multi-modal bait service description file based on the vulnerability feature injection strategy and the high-quality prompt word set;

[0074] Specifically, the multi-modal bait service description file in step S4 is a JSON format configuration file using the infrastructure as code paradigm. The multi-modal bait service description file is used to describe the front-end page structure of the Web target system, the industrial control protocol simulation interface, the pseudo data generation and interaction induction logic, and the built-in security monitoring and auditing module.

[0075] Specifically, step S4 further includes a verification step after generating the multi-modal bait service description file:

[0076] The generated multi-modal bait service description file is subjected to automatic semantic consistency detection, business logic rationality testing, and sensitive parameter filtering.

[0077] Please refer to Figure 5 In this step, after the administrator reviews and approves the strategy, the MCP protocol engine submits the strategy file in the domain-specific language format together with the high-quality prompt word set to the large language model module.

[0078] The large language model module fuses the precise requirements of the strategy and the rich domain context provided by the prompt word set to perform deep reasoning and generate a multi-modal bait service description file. The file adopts the infrastructure as code paradigm and is in standard JSON format. Its content describes in detail the front-end page structure of the Web target system, the industrial control protocol simulation interface, the pseudo data generation and interaction induction logic, and the built-in security monitoring and auditing module. After generation, the verification module immediately starts and performs multiple rounds of automatic verification on the JSON file, including semantic consistency detection, business logic rationality testing, and sensitive parameter filtering. Only the verified file is allowed to enter the deployment link.

[0079] S5, according to the multi-modal bait service description file, implementing containerized deployment to generate one or more Web target instances;

[0080] Specifically, the containerized deployment in step S5 is:

[0081] Packaging each Web target instance in the multi-modal decoy service description file into a Docker container independently, and assigning it to a designated physically isolated network node for running.

[0082] Referring to Figure 6 In this step, the security deployment server module receives the multi-modal decoy service description file (JSON) scheduled by the MCP protocol engine and verified. The module parses the file content and uses container technology such as Docker to package each Web target instance described in the file and its entire dependent environment into a Docker container image independently. To meet the needs of large-scale or complex deployment, the security deployment server module can dynamically adjust the number and distribution of Web target containers based on network partitioning, load balancing, policy priority, and other conditions, and has the ability of elastic scaling, online hot updating, and fast rollback, ensuring that the deployment environment is always stable, flexible, and highly available.

[0083] Subsequently, the deployment module assigns and runs the container instances on designated physically isolated network nodes according to the deployment location specified in the policy file through container orchestration tools. These nodes are located in a special simulation or honeynet area, completely isolated from the core network carrying real power production business in terms of physics and logic, ensuring that attack activities cannot penetrate into the real system. After deployment, a detailed deployment report is automatically generated, including Web target type, node distribution, policy execution, container running status, and other information. The report is pushed to the MCP client by the MCP engine, and the administrator can online accept and adjust the deployment scheme, and if necessary, can roll back or optimize parameters one-click, ensuring that the Web target system is always in the best state of protection and simulation.

[0084] S6, collecting the interaction logs of the Web target nodes, performing stream cleaning and structured processing, and updating the log information database.

[0085] Specifically, the stream cleaning and structured processing in step S6 includes:

[0086] Protocol analysis and structured processing of the collected log data are performed to unify them into a standardized Schema;

[0087] Noise filtering mechanism is used to eliminate normal traffic and false trigger requests;

[0088] Anomaly detection algorithm is used to identify undefined abnormal behaviors, and threat labels are generated for key attack behaviors and written into the log information database.

[0089] Referring to Figure 7In this step, after the Web target node is online, the log processing module begins to work. Its built-in log agent and network probe continuously collect all interactions with the Web target instance, including every access to the front-end page, every request / response frame of the Modbus protocol, and any attempted command injection data.

[0090] The collected raw log data is pushed to the log cleaning server in real time in a streaming manner. The cleaning process includes:

[0091] Protocol parsing and structured processing: The original message is parsed to extract fields such as timestamp, access source, behavior type, protocol parameters, event stage, and response status, and unified into a predefined normalized Schema.

[0092] Noise filtering: Apply rule-based filters to remove access from internal management IPs, normal traffic and false trigger requests such as regular port scanning probes, and only keep high-risk behavior records related to potential attacks.

[0093] Anomaly detection and labeling: Run anomaly detection algorithms (such as Isolation Forest, AutoEncoder, etc.) on the filtered logs. The algorithm can identify behaviors that do not conform to normal interaction patterns, such as writing to a large number of different register addresses in a short period of time. According to attack paths, request parameters, and behavior sequences, the system automatically generates threat labels for detected abnormal behaviors and known attack patterns, such as "suspected horizontal movement scanning", "privilege escalation", "unauthorized access", etc.

[0094] Finally, these high-value log data that have been deeply cleaned, structured, and attached with threat labels are written to the log information database for persistent storage. These logs can not only be used for real-time analysis and alarm by security personnel, but more importantly, the new attack features (TTPs) they contain can be used to update the power knowledge base and enrich the historical attack log library, providing more accurate data input for the next strategy generation of the decision server module, thereby realizing the intelligent defense closed loop of "perception -> decision -> deployment -> feedback -> learning".

[0095] Please refer to Figure 8 , which shows a module interaction architecture diagram of an intelligent target deployment method for APT attacks in the power scenario of the present application.

[0096] As shown in Figure 8 , the MCP client module is used to receive user input target Web target scenario parameters;

[0097] A context compiler module connected with an electric power knowledge base and a vectorization retrieval component, configured to access the electric power knowledge base through the vectorization retrieval component to perform semantic completion according to the target Web target scene parameters, and generate a high-quality prompt word set containing electric power field semantics; the electric power knowledge base contains electric power standard documents, industrial control system design manuals and vulnerability feature data;

[0098] A decision server module configured to aggregate the high-quality prompt word set, historical attack logs and real-time threat intelligence, and generate an optimal vulnerability feature injection strategy described in a domain-specific language format by a multi-objective optimization model that weighs the Web target attractiveness of historical high-risk components, system deployment cost, external threat exploitation trends and attacker behavior trajectory;

[0099] A large language model module configured to generate a multi-modal decoy service description file in an infrastructure-as-code paradigm according to the high-quality prompt word set and the optimal vulnerability feature injection strategy;

[0100] A security deployment server module configured to package a Web target instance into a Docker container and deploy it in a physically isolated network node according to the multi-modal decoy service description file, and implement containerized deployment;

[0101] A log processing module configured to collect interaction behavior logs of the Web target instance, perform stream cleaning and structured processing, and update a log information database; the stream cleaning and structured processing includes protocol analysis and structured processing, noise filtering, and abnormality discrimination and threat label generation through an abnormality detection algorithm;

[0102] A verification module configured to perform automatic semantic consistency detection, business logic reasonableness verification and sensitive parameter filtering on the multi-modal decoy service description file generated by the large language model module.

[0103] It should be understood that, Figure 8 The modules described in the above Figure 1 Correspond to the respective steps in the method described in the above Figure 8 The operations and features described above for the method and the corresponding technical effects are also applicable to the modules in , and will not be described here again.

[0104] In some other embodiments, the present application also provides a computer readable storage medium having a computer program stored thereon, wherein the program instructions are executed by a processor to cause the processor to execute the intelligent target deployment method for APT attacks in the electric power field described in any of the above method embodiments.

[0105] S1. Receive target web target scenario parameters input by the security administrator through the MCP client. The parameters include target type, simulation level, protocol type, and persistence time.

[0106] S2. The context compiler accesses the power knowledge base based on the scenario parameters, obtains power industrial control protocol specifications and equipment behavior data through the vectorized retrieval component, and generates a high-quality prompt word set containing power domain semantics.

[0107] S3. The decision server aggregates the high-quality prompt word set, attack behavior characteristics in the historical attack log library, and vulnerability information from real-time threat intelligence sources, and generates a vulnerability feature injection strategy through a multi-objective optimization algorithm.

[0108] S4. Based on the vulnerability feature injection strategy and high-quality prompt word set, the large language model generates a multimodal decoy service description file;

[0109] S5. Based on the multimodal decoy service description file, implement containerized deployment to generate one or more Web target instances;

[0110] S6. Collect the interaction logs of Web target nodes, perform streaming cleaning and structured processing, and update the log information database.

[0111] Computer-readable storage media may include a stored program area and a stored data area, wherein the stored program area may store an operating system and an application program required for at least one function; the stored data area may store data created based on the use of a smart target deployment system for APT attacks on power scenarios. Furthermore, the computer-readable storage medium may include high-speed random access memory, and may also include memory, such as at least one disk storage device, flash memory device, or other non-volatile solid-state storage device. In some embodiments, the computer-readable storage medium may optionally include memory remotely configured relative to a processor, which can be connected to the smart target deployment system for APT attacks on power scenarios via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0112] Figure 9 This is a schematic diagram of the structure of the electronic device provided in the embodiment of the present invention, such as... Figure 9 As shown, the device includes a processor 310 and a memory 320. The electronic device may also include an input device 330 and an output device 340. The processor 310, memory 320, input device 330, and output device 340 can be connected via a bus or other means. Figure 9The bus is taken as an example. The memory 320 is the computer readable storage medium described above. The processor 310 performs various functions of the server and data processing by running the non-volatile software programs, instructions and modules stored in the memory 320, that is, implements the intelligent target deployment method for APT attacks in the power scenario described above. The input device 330 can receive input digital or character information and generate key signal input related to user settings and function control of the intelligent target deployment system for APT attacks in the power scenario. The output device 340 can include a display device such as a display screen.

[0113] The electronic device described above can execute the method provided by the embodiments of the application, and has the corresponding function modules and beneficial effects of the execution method. Technical details not described in detail in the embodiments can be referred to the method provided by the embodiments of the application.

[0114] As an implementation, the electronic device described above is applied to the intelligent target deployment system for APT attacks in the power scenario, and is used for a client, including: at least one processor; and a memory in communication connection with the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to:

[0115] S1, receiving target Web target scenario parameters input by a security administrator through an MCP client, the parameters including target type, simulation degree, protocol type and persistence time;

[0116] S2, a context compiler accesses a power knowledge base based on the scenario parameters, obtains power industrial control protocol specifications and device behavior data through a vectorization retrieval component, and generates a high-quality prompt word set containing power field semantics;

[0117] S3, a decision server aggregates the high-quality prompt word set, attack behavior characteristics in a historical attack log library and vulnerability information of a real-time threat intelligence source, and generates a vulnerability feature injection strategy through a multi-objective optimization algorithm;

[0118] S4, a large language model generates a multi-modal decoy service description file based on the vulnerability feature injection strategy and the high-quality prompt word set;

[0119] S5, containerized deployment is implemented according to the multi-modal decoy service description file, and one or more Web target instances are generated;

[0120] S6, interaction logs of Web target nodes are collected, and flow cleaning and structured processing are performed, and a log information library is updated.

[0121] Those skilled in the art can clearly understand the implementation of the various embodiments by means of software and necessary general hardware platforms through the description of the above embodiments, and of course, the implementation can also be through hardware. Based on such understanding, the above technical solutions can be embodied in the form of a software product, and the computer software product can be stored in a computer readable storage medium, such as a ROM / RAM, a magnetic disk, an optical disk, etc., and includes a plurality of instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the method of each embodiment or some parts of the embodiment.

[0122] Finally, it should be noted that: the above examples are only used to illustrate the technical solutions of the present application, and not to limit them; although the present application has been described in detail with reference to the foregoing examples, those skilled in the art should understand that: it can still modify the technical solutions recorded in the foregoing examples, or make equivalent replacement for some technical features thereof; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. A method for intelligent target deployment against power scenario APT attack, characterized in that, Comprise: S1, receive the target web target scene parameters input by the security administrator through the MCP client, including target type, simulation degree, protocol type and persistence time; S2, the context compiler accesses the power knowledge base based on the scene parameters, obtains the power industrial control protocol specification and device behavior data through the vectorization retrieval component, and generates a high-quality prompt word set containing power field semantics; S3, the decision server aggregates the high-quality prompt word set, attack behavior characteristics in the historical attack log library and vulnerability information of real-time threat intelligence sources, and generates a vulnerability feature injection strategy through a multi-objective optimization algorithm; S4, the large language model generates a multi-modal bait service description file based on the vulnerability feature injection strategy and the high-quality prompt word set; S5, according to the multi-modal bait service description file, implement containerized deployment, and generate one or more web target instances; S6, collect the interaction log of the web target node, perform stream cleaning and structured processing, and update the log information library.

2. The intelligent target deployment method for power scenario APT attack according to claim 1, characterized in that, Step S2 includes: Semantic label extraction is performed on the scene parameters to identify the protocol type and page structure requirements; Match the relevant protocol fields and device parameter constraints in the power knowledge base through the vectorization retrieval component; According to the retrieval result, fill in the protocol message format, parameter field and device role attribute information, and generate a prompt word set containing power business logic.

3. The intelligent target deployment method for power scenario APT attack according to claim 1, characterized in that, In step S3, the vulnerability feature injection strategy generated by the multi-objective optimization algorithm is: Balance the web target attractiveness of historical high-risk components, system deployment cost, new threat exploitation trends revealed by external threat intelligence, and potential behavior trajectory revealed by attacker portrait, and establish a multi-objective optimization model; Through the multi-objective optimization model, automatic reasoning is performed to generate a vulnerability feature injection strategy described in a domain-specific language format, which includes target components, injection vulnerability types and deployment location parameters.

4. The intelligent target deployment method for power scene APT attack according to claim 1, wherein The multi-modal bait service description file in step S4 is a JSON format configuration file using the infrastructure as code paradigm, which is used to describe the front-end page structure of the web target system, the industrial control protocol simulation interface, the pseudo data generation and interaction induction logic, and the built-in security monitoring and auditing module.

5. The intelligent target deployment method for power scenario APT attack according to claim 1, characterized in that, After generating the multi-modal bait service description file in step S4, the method further includes a verification step: Automatic semantic consistency detection, business logic rationality test and sensitive parameter filtering are performed on the generated multi-modal bait service description file.

6. The intelligent target deployment method for power scenario APT attack according to claim 1, characterized in that, In step S5, the containerized deployment is: Each web target instance in the multi-modal bait service description file is independently packaged as a Docker container and allocated to a designated physically isolated network node for running.

7. The intelligent target deployment method for power scenario APT attack according to claim 1, characterized in that, In step S6, the stream cleaning and structured processing includes: Protocol analysis and structured processing are performed on the collected log data, and unified into a standardized Schema; Noise filtering mechanism is used to eliminate normal traffic and false trigger requests; The abnormal behavior that is not explicitly defined is distinguished by an anomaly detection algorithm, and a threat label is generated for a key attack behavior and written into the log information base.

8. An intelligent target deployment system for power scenario APT attacks, characterized in that, The method comprises the following steps: The MCP client module receives target web target scene parameters input by a user; The context compiler module is connected with a power knowledge base and a vectorization retrieval component, and is used to perform semantic completion by accessing the power knowledge base through the vectorization retrieval component according to the target web target scene parameters, to generate a high-quality prompt word set containing power field semantics; the power knowledge base contains power standard documents, industrial control system design manuals and vulnerability feature data; The decision server module is used to aggregate the high-quality prompt word set, historical attack logs and real-time threat intelligence, and to generate an optimal vulnerability feature injection strategy described in a field-specific language format by weighing a multi-objective optimization model of web target attractiveness of a historical high-risk component, system deployment cost, external threat exploitation trend and attacker behavior trajectory; The large language model module is used to generate a multi-modal decoy service description file in an infrastructure-as-code paradigm according to the high-quality prompt word set and the optimal vulnerability feature injection strategy; The security deployment server module is used to package a web target instance into a Docker container and deploy it in a physically isolated network node according to the multi-modal decoy service description file, to implement containerized deployment; The log processing module is used to collect interaction behavior logs of the web target instance, to perform stream cleaning and structured processing, and to update a log information base; the stream cleaning and structured processing includes protocol analysis and structured processing, noise filtering, and abnormality discrimination and threat label generation through an anomaly detection algorithm; The verification module is used to perform automatic semantic consistency detection, business logic rationality verification and sensitive parameter filtering on the multi-modal decoy service description file generated by the large language model module.

9. An electronic device, comprising: The method comprises the following steps: At least one processor and a memory connected in communication with the at least one processor, wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the method of any one of claims 1 to 7.

10. A computer-readable storage medium having stored thereon a computer program, characterized in that, The program is executed by the processor to implement the method of any one of claims 1 to 7.

Images