A honeynet-based attack trapping and analysis method and system

Abstract

The application discloses a kind of attack trapping and analysis method and system based on honeynet, it is related to attack analysis technical field, including: attack interaction data and associated attack chain trajectory set are collected;Divide attack behavior unit, construct behavior space posture matrix;Two-dimensional behavior relationship atlas is constructed, interpolation enhancement is carried out to sub-time granularity, and the behavior node after interpolation is upgraded to three-dimensional semantic space;Attack path trend analysis is carried out to attack behavior unit, and attack path bending law model is constructed;Attack chain trajectory set, the behavior node in three-dimensional semantic space and the like parameter are input into attack path bending law model, and output is trapping response strategy, and dynamically adjusts honeynet environment.The application can automatically adjust honeypot type and position according to attack behavior change, effectively improve the structural clarity and processing precision of attack behavior data, and facilitate to directly use attack behavior identification result for trapping strategy optimization.

Description

Technical Field

[0001] This invention relates to the field of attack analysis technology, specifically a method and system for attack trapping and analysis based on honeynets. Background Technology

[0002] Existing honeynet attack trapping and analysis technologies have some shortcomings, including: attack behavior analysis is still limited to shallow event recording, lacking context modeling and behavior chain reconstruction capabilities, making it difficult to identify complex or phased attack processes; the system has limited modeling capabilities in the time dimension and semantic space, failing to effectively express the spread path and potential strategies of attack behavior, thus reducing the completeness of behavior analysis.

[0003] Based on this, a method and system for attack trapping and analysis based on honeynets is provided, which can eliminate the drawbacks of existing technical solutions. Summary of the Invention

[0004] The purpose of this invention is to provide a method and system for attack trapping and analysis based on honeynets, so as to solve the problems of the shortcomings of existing honeynet attack trapping and analysis technologies in the background art.

[0005] To achieve the above objectives, the present invention provides the following technical solution:

[0006] A honeynet-based attack trapping and analysis method specifically includes the following steps:

[0007] Step S1: Construct a simulated environment through a distributed honeycomb node system, run honeypot agents on various virtual services, and continuously collect attack interaction data and related attack chain trajectory sets;

[0008] Step S2: Based on the stage division rules of the attack chain trajectory set, perform attribution analysis and behavior slicing on the collected attack interaction data, divide it into multiple attack behavior units, calculate the attack path traffic length distribution and proportion of each stage, extract the mainstream flow vector in the attack interaction data, and construct the behavior space posture matrix.

[0009] Step S3: Construct a two-dimensional behavior relationship graph for each attack behavior unit, rasterize the interaction events, and perform sub-temporal granular interpolation enhancement in the temporal dimension, preserving the original semantics and time labels of the events, and upsizing the interpolated behavior nodes to a three-dimensional semantic space.

[0010] Step S4: Based on the attack chain trajectory set and the behavior nodes in the upgraded three-dimensional semantic space, perform attack path trend analysis on all attack behavior units in multiple consecutive stages of the attack chain trajectory set, extract the path curvature, jump rhythm and repeated access pattern of the attack path, and construct an attack path bending law model.

[0011] Step S5: Input the attack chain trajectory set, behavior nodes and path curvature, jump rhythm and repeated access pattern in the three-dimensional semantic space into the attack path curvature law model, and output the trapping response strategy adapted to the attack behavior. Dynamically adjust the honeynet environment according to the trapping response strategy.

[0012] The path curvature in step S4 is used to quantify the severity of the directional change of the attack behavior in the three-dimensional semantic space. The path curvature is defined by analyzing the spatial vector turning angle between adjacent attack behavior units: for three consecutive behavior nodes in the attack chain , , Each node contains three-dimensional coordinates. First, calculate the nodes. arrive Direction vector and nodes arrive Direction vector Then, the local turning angle is determined by the vector angle calculation function. By calculating the curvature of all consecutive triplet nodes in the attack chain, a path curvature sequence is generated to describe the overall bending distribution characteristics of the attack path.

[0013] The jump rhythm focuses on the jump frequency and time interval patterns of attackers in different semantic categories or time intervals. The jump frequency and time interval patterns of the jump rhythm are extracted by statistically analyzing the number of semantic category jumps and the time interval distribution between adjacent behavior nodes. The jump frequency is calculated as the number of semantic category jumps occurring within a unit time or a unit path length. The time interval pattern is calculated by statistically analyzing the time difference between adjacent key operations and generating a histogram or cumulative distribution function of the time interval.

[0014] The repeated access pattern is used to detect whether an attacker revisits a semantic node or time interval multiple times. By constructing a node access frequency matrix and a local path loop detection algorithm, two types of repeated behaviors are identified, including semantic node repetition and path segment looping.

[0015] In step S4, the processing steps for the attack path curvature model include:

[0016] A path curvature sequence is constructed based on the path curvature, and the kernel density of the path curvature sequence is estimated.

[0017] Based on the statistical results of redirection rhythm and repeated access patterns, the attacker's redirection decision rules are summarized.

[0018] Mark duplicate nodes or duplicate path segments as dependent nodes and define the upper limit on the number of times a dependent node can be visited repeatedly;

[0019] The output is a set of parameters describing the dynamic characteristics of the attack path, including path curvature distribution parameters, jump decision rules, and repeated access constraints.

[0020] Further, step S2 includes the following steps:

[0021] Step S21: Based on predefined phase division rules, set semantically driven phase boundaries and perform attribution analysis and behavior slicing on attack interaction data;

[0022] Step S22: Calculate the attack path traffic length distribution and proportion characteristics corresponding to each attack behavior unit to quantify the scale and transmission characteristics of attack interaction data within the stage.

[0023] Step S23: Construct a behavior space pose matrix to map the multidimensional features of each attack behavior unit to a three-dimensional geometric space, thereby realizing the geometric representation of the attack behavior.

[0024] Furthermore, the attribution analysis in step S2 specifically includes:

[0025] Based on the phase division results generated in the attack chain trajectory set, the phase attribution determination is performed on each data unit in the attack interaction data.

[0026] For each data unit, its associated metadata and content features are extracted, and multi-dimensional matching is performed with the feature rule base of each stage in the current attack chain trajectory set to determine the finest granular stage to which each data unit belongs.

[0027] Furthermore, the behavior slice in step S2 specifically includes:

[0028] Behavioral slicing is performed on continuous attack interaction data according to phase boundaries. Continuous data units belonging to the same phase are clustered into an attack behavior unit. Each attack behavior unit contains all relevant raw traffic fragments and structured operation sequences within the phase, along with a phase identifier, time range, and associated target service information.

[0029] Furthermore, step S2 also includes: uniformly correcting the attack chain trajectory set so that its main attack path is aligned with the X-axis, the lateral attack features are aligned with the Y-axis, and the noise dimension is mapped to the Z-axis. Combined with the data distribution boundary after attitude normalization, the attack behavior data range corresponding to each attack chain segment is determined, thus completing the structured segmentation of the attack behavior data.

[0030] Furthermore, the decoy response strategy in step S5 includes the decoy service type, the degree of interaction response camouflage, and the attack log labeling strategy dimension. According to the decoy response strategy, the honeynet environment is dynamically adjusted by adjusting at least one of the decoy service type, the degree of interaction response camouflage, or the attack log labeling strategy dimension.

[0031] Furthermore, the simulated environment in step S1 is used to lure potential attackers to carry out real intrusion behavior, the attack interaction data includes multiple unclassified raw traffic samples, and the attack chain trajectory set consists of multiple staged attack sessions.

[0032] A honeynet-based attack trapping and analysis system, applied to a honeynet-based attack trapping and analysis method, includes:

[0033] The data acquisition module constructs a simulated environment through a distributed honeycomb node system, runs honeypot agents on various virtual services, and continuously collects attack interaction data and related attack chain trace sets.

[0034] The data processing module is used to perform attribution analysis and behavior slicing on the collected attack interaction data according to the stage division rules of the attack chain trajectory set, calculate the attack path traffic length distribution and proportion of each stage, extract the mainstream flow vector in the attack interaction data, and construct the behavior space posture matrix.

[0035] The interpolation mapping module is used to construct a two-dimensional behavior relationship graph for each attack behavior unit, rasterize the interaction events, and perform sub-temporal granular interpolation enhancement in the temporal dimension, preserving the original semantics and time labels of the events, and upsizing the interpolated behavior nodes to a three-dimensional semantic space.

[0036] The bait response strategy generation module is used to analyze the attack path trends at each stage of the attack chain trajectory set, extract the path curvature, jump rhythm and repeated access patterns of the attack path, construct the attack path curvature law model, and generate corresponding bait response strategies based on the attack path curvature law model, and dynamically adjust the honeynet environment according to the bait response strategies.

[0037] Compared with the prior art, the beneficial effects of the present invention are as follows:

[0038] 1. This invention constructs a simulated environment through a distributed honeycomb node system, which enables a comprehensive simulation of real network service scenarios, improves the ability to capture diverse attacks, and can automatically adjust the honeypot type and location according to changes in attack behavior;

[0039] 2. This invention divides complex raw attack interaction data into categories through attack behavior attribution analysis and normalization correction mechanisms, establishes a unified behavior coordinate system, effectively improves the structural clarity and processing accuracy of attack behavior data, and further enhances the modeling ability of behavior diffusion paths and improves the completeness of behavior chain reconstruction by combining two-dimensional rasterization processing and sub-temporal interpolation mechanisms.

[0040] 3. This invention achieves a high degree of semantic and structural unity among multiple attack behavior units by constructing an attack path bending law model and performing spatial bending alignment processing. This makes the two-dimensional behavior relationship graph not only have temporal logical continuity but also spatial behavior consistency. Furthermore, through the trapping response strategy and dynamic adjustment mechanism, a closed-loop optimization path for attack trapping is realized, which makes it easy to directly use the attack behavior identification results for trapping strategy optimization. Attached Figure Description

[0041] Figure 1 This is a schematic diagram illustrating the steps of the attack trapping and analysis method of the present invention.

[0042] Figure 2 This is a schematic diagram of the attack trapping and analysis system of the present invention.

[0043] Figure label annotations: Data acquisition module 10, data processing module 20, interpolation mapping module 30, trapping response strategy generation module 40. Detailed Implementation

[0044] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and embodiments.

[0045] Example 1

[0046] In this embodiment, as Figure 1 As shown, this invention provides a honeynet-based attack trapping and analysis method, specifically including the following steps:

[0047] Step S1: Construct a simulated environment through a distributed honeycomb node system, run honeypot agents on various virtual services, and continuously collect attack interaction data and related attack chain trajectory sets;

[0048] Specifically, a multi-layered, multi-protocol simulated environment is constructed through a distributed honeycomb node system to lure potential attackers into committing real intrusions. The honeycomb-based attack trapping and analysis system runs honeypot agents on various virtual services (such as Web, SSH, databases, etc.) to continuously collect attack interaction data and associated attack chain trajectory sets. The attack interaction data includes multiple unclassified raw traffic samples, and the attack chain trajectory set consists of multiple staged attack sessions. The attack chain trajectory set is a set of behavioral sequences that are structured and generated by the honeypot agent during the attack interaction process. Each attack chain trajectory contains multiple staged attack sessions. The attack session division is based on a time continuity detection algorithm, and the stage division is based on a predefined semantic rule base (such as information detection, vulnerability exploitation, privilege escalation, etc.).

[0049] Specifically, each honeypot node is equipped with a lightweight, high-concurrency honeypot proxy module. This module is responsible for listening to and responding to various connection requests for the simulated service. At the same time, it captures all raw traffic data generated during the interaction between the attacker and the honeypot service in a non-intrusive manner in real time. This includes, but is not limited to, TCP / IP 5-tuple information, transport layer payload content, application layer protocol interaction messages, HTTP request headers and form data, SSH protocol authentication phase interaction messages, database query statements and return result fragments, etc. Such raw traffic samples retain their original format and time series characteristics during collection and are not pre-classified or labeled to ensure that the original context information and potential mutation characteristics of the attack behavior can be preserved in the subsequent analysis process.

[0050] In addition to the original traffic samples, the honeypot proxy synchronously records and structurally generates attack chain trajectory sets, which are complete sets of behavioral sequences implemented by the attacker in the honeypot environment. Each attack chain trajectory consists of several phased attack sessions, and each attack session is accompanied by key metadata, such as the originating IP address, connection start / end timestamps, target service type and port, session duration, and the temporal relationship of the operation steps within the session. A single attack session is defined as a series of operations continuously initiated by the attacker within a certain time window (usually with session timeout mechanism or connection interruption event as the boundary) after establishing a connection with a specific simulated service (such as an SSH port of a certain IP address or a certain web path). These operations include, but are not limited to: directory traversal attempts, SQL injection payload submissions, and file uploads for web services; brute-force attacks on SSH services (including continuous login requests with different username / password combinations) and command execution sequences after successful login; connection authentication attempts, sensitive table query commands, and data export operations for database services.

[0051] The honeynet-based attack trapping and analysis system performs hierarchical processing and correlation analysis on the collected raw traffic samples and attack chain trajectory sets:

[0052] Honeypot proxies work in parallel with kernel-level traffic mirroring (such as the libpcap / DPDK packet capture engine) and application-layer protocol parsing plugins (dedicated decoding modules for protocols such as HTTP, SSH, and databases). On one hand, they persistently store the raw network traffic in pcap format or a custom binary stream format (preserving complete packet sequences and timestamp information). On the other hand, they perform protocol semantic parsing on the application-layer interaction content, extracting key operation fields (such as URI paths, request methods, User-Agent headers, and POST form parameters in HTTP requests; username / password attempt records and shell command sequences executed after successful login in the SSH protocol; and SELECT / INSERT / UPDATE operation statements and target table names in the database protocol). The parsed structured data is then bound to the raw traffic sample using a unique session identifier (such as a 5-tuple combined with a timestamp hash value), forming a data unit that combines the raw traffic with semantic operations.

[0053] Based on the session temporal continuity detection algorithm, the system clusters continuous interactive behaviors into independent attack sessions. Each attack session is further divided into multiple operation stages. The division of each stage is based on a predefined behavioral semantic rule base. The stage division results and the specific parameters of the corresponding operations together constitute a structured description of the attack chain trajectory. For example, for SSH services, stage 1 is the authentication attempt stage (including all username / password submission behaviors before login), and stage 2 is the session maintenance stage (all command execution behaviors after successful login and before the session terminates). For Web services, stage 1 is the information probing stage (such as directory scanning, robots.txt access, and common vulnerability path attempts), stage 2 is the vulnerability exploitation stage (such as SQL injection payload submission and file inclusion attacks), and stage 3 is the privilege escalation / data theft stage (such as attempting to read / etc / passwd and downloading database backup files).

[0054] The session continuity detection algorithm sorts connection events with the same source IP and target service port in ascending order of timestamps. If the time interval between adjacent connections is less than a preset threshold (e.g., the preset threshold is 30 seconds, which can be adjusted according to the actual scenario), and the target service type has not changed, it is determined to be a continuation of the same attack session. If the time interval exceeds the preset threshold or the target service port / type changes, a new attack session instance is generated.

[0055] Specifically, to enhance the depth of attack behavior analysis, the system extracts key semantic features (such as specific URIs or POST parameters in HTTP requests, keywords in SSH commands, and table names in database queries) for each operation step in the attack chain trajectory through a traffic-behavior alignment algorithm. In the original traffic sample, the system locates the actual traffic segment corresponding to the operation step through payload content matching (such as regular expression matching or byte sequence comparison) and marks the position of the segment in the overall session flow (such as TCP stream sequence number and packet offset). This enables the precise association between the attacker's specific operation (such as the input of malicious commands or the submission of payloads) and its original network transmission data. The above process not only preserves the macro-level temporal logic of the attack behavior but also restores the micro-level details of data transmission.

[0056] Step S2: Based on the stage division rules of the attack chain trajectory set, perform attribution analysis and behavior slicing on the collected attack interaction data, divide it into multiple attack behavior units, calculate the attack path traffic length distribution and proportion of each stage, extract the mainstream flow vector in the attack interaction data, and construct the behavior space posture matrix.

[0057] Specifically, after completing the construction and phase division of the attack chain trajectory set, the system further performs fine-grained behavioral unit division and spatial pose modeling on the collected raw attack interaction data. This process includes: based on predefined phase division rules (as mentioned above, semantically driven phase boundaries are set for different service types (such as Web, SSH, and database), for example, the information detection vulnerability exploitation data theft phase of HTTP service, the authentication attempt session maintenance phase of SSH service, etc.), performing attribution analysis (i.e., determining the specific attack phase to which each data unit, whether it is a traffic fragment or an operation command, belongs) and behavioral slicing (cutting continuous interaction traffic into independent attack behavior units according to phase boundaries), and then completing the geometric representation and standardized alignment of attack behavior in the multi-dimensional feature space through traffic feature statistics, flow vector extraction, and behavioral spatial pose matrix construction. Step S2 specifically includes:

[0058] Step S21: Based on predefined phase division rules, set semantically driven phase boundaries and perform attribution analysis and behavior slicing on attack interaction data;

[0059] Step S22: Calculate the attack path traffic length distribution and proportion characteristics corresponding to each attack behavior unit to quantify the scale and transmission characteristics of attack interaction data within the stage.

[0060] For each Behavioral Action Unit (BAU), the system further calculates the distribution and proportion of the corresponding attack path traffic length to quantify the scale and transmission characteristics of the attack interaction data within that stage. Simultaneously, the system extracts the mainstream flow vector of the Behavioral Action Unit to characterize the macroscopic transmission direction characteristics of the attack interaction data. An attack action unit refers to a data set formed by dividing the attack interaction data into stages and slices of behavior. It includes all relevant original traffic fragments, structured operation sequences, and their metadata (such as stage identifiers, time ranges, and target service information) within the same stage. Behavior / event nodes refer to the mapping points of the attack action unit in a two-dimensional behavior relationship graph or a three-dimensional semantic space. Each behavior node corresponds to a specific event in the attack action unit and includes features such as the event's time, semantic category, and threat level. Behavior nodes are a spatialized and structured representation used for path analysis and model building. An attack action unit contains multiple behavior nodes.

[0061] The process of obtaining the attack path traffic length distribution includes:

[0062] For all raw traffic samples within the attack unit, the corresponding payload length (i.e., the actual number of application layer data bytes transmitted, excluding the fixed overhead of protocol headers such as IP / TCP / UDP) is accumulated according to the transmission direction (inbound traffic from attacker to honeypot, outbound traffic from honeypot to attacker). This generates a two-dimensional length sequence (total number of bytes of inbound traffic, total number of bytes of outbound traffic). The distribution of traffic in different size ranges is described by histograms or cumulative distribution functions (CDF). For example, 80% of the inbound traffic payload length is concentrated in the 100-1000 byte range, indicating that this stage is dominated by short interactive commands.

[0063] The process of obtaining the mainstream flow vector includes:

[0064] The total number of bytes of inbound traffic and the total number of bytes of outbound traffic are normalized to generate a two-dimensional vector. ,in, For the percentage of inbound traffic, For outbound traffic percentage, and satisfying For example: if the inbound traffic of an attacking unit accounts for 70% and the outbound traffic accounts for 30%, then its main flow vector is: This indicates that during this phase, the attacker actively sends commands, while the honeypot returns responses as a secondary factor.

[0065] Step S23: Construct a behavior space posture matrix to map the multidimensional features of each attack behavior unit (including the main flow vector, key statistics of traffic length distribution, stage type identifier, target service type, etc.) to a three-dimensional geometric space to realize the geometric representation of attack behavior and unify the differences of different attack behavior units in terms of traffic scale, transmission direction and behavior complexity.

[0066] In this embodiment, the attack chain trajectory set is uniformly corrected so that the main attack path is aligned with the X-axis, the lateral attack features are aligned with the Y-axis, and the noise dimension is mapped to the Z-axis. Combined with the data distribution boundary after attitude normalization, the range of attack behavior data corresponding to each attack chain segment is determined, and the structured segmentation of attack behavior data is completed.

[0067] Constructing a behavior space attitude matrix essentially maps the multi-dimensional features of each attack behavior unit (including its main flow vector, flow length distribution, etc.) to a unified three-dimensional reference coordinate system, thereby achieving a standardized geometric representation of the attack behavior. Attitude here refers to the position and direction vector of the attack behavior in the feature space, where the position is determined by its eigenvalues ​​and the direction is determined by the feature change trend of the behavior unit relative to the preceding and following behaviors.

[0068] The specific calibration process is as follows:

[0069] Align the main attack path (i.e., the sequence of key operations performed by the attacker to achieve core objectives such as gaining database privileges or executing system commands, for example, executing the sudo privilege escalation command after successful authentication in an SSH service or a file upload vulnerability payload in a web service) onto the X-axis. The X-axis represents the intensity of the main attack direction (which can be quantified by the number of high-threat operations or the complexity of key payloads within the main attack phase). Align the lateral attack characteristics (i.e., auxiliary or probing operations, such as directory scanning or weak password attempts in the initial stage, which are not directly destructive behaviors) onto the Y-axis. The Y-axis represents the lateral exploration breadth of the attack (which can be quantified by the number of non-critical operations or the frequency of low-threat requests). The noise dimension (i.e., data perturbations that are weakly correlated with the main attack path, such as normal connection requests during the protocol handshake phase, heartbeat packets, and other irrelevant traffic) is mapped to the Z-axis. The Z-axis represents the background interference intensity of the attack data. The noise dimension refers to the data components in the collected raw interaction data that are extremely weakly correlated with the identified main attack path and lateral attack features in terms of protocol semantics and temporal logic, such as normal protocol handshake packets, network background traffic, meaningless duplicate requests, or encrypted payloads that cannot be decrypted.

[0070] Specifically, based on the orientation-normalized data distribution boundary (i.e., the cubic space formed by the minimum / maximum projection values ​​of all attack behavior units on the X / Y / Z axes), an independent data range can be assigned to each attack behavior unit in the attack chain trajectory, completing structured segmentation, as follows:

[0071] Based on the mainstream flow vector and attack path traffic length distribution statistics of each attack behavior unit, calculate its projection value on the X / Y / Z axes. For example, if the mainstream flow vector of a certain attack behavior unit shows an extremely high proportion of inbound traffic (e.g....) If the phase type of another attack unit is vulnerability exploitation (main attack path), its X-axis projection value is high, reflecting the intensity of the main attack; if the phase type of another attack unit is information probing (side attack characteristics) and contains a large number of low-threat directory scanning requests, its Y-axis projection value is high; if a certain attack unit contains a large number of protocol handshake packets or invalid TCP retransmission data (noise dimension), its Z-axis projection value is high. Through the above process, the behavioral characteristics of all attack units are uniformly transformed into the same geometric space, eliminating the representation bias caused by differences in service type or traffic scale.

[0072] Based on the ranking of X-axis projection values ​​(intensity of the main attack path), the set of attack behavior units corresponding to the main attack path is first delineated (such as the units with the top 20% of X-axis projection values). Then, it is expanded to side attack features (units with the second highest Y-axis projection values) and noise dimensions (units with significant Z-axis projection values). Finally, the start and end timestamp range and associated traffic / operation data segments in the original data stream are defined for each attack behavior unit. The above process can realize the structured segmentation of attack behavior data, so that each segment corresponds to an attack behavior unit with clear semantics, standardized posture features and independent data range, which can be directly used for subsequent attack pattern mining, threat intelligence generation or defense strategy verification.

[0073] Step S3: Construct a two-dimensional behavior relationship graph for each attack behavior unit. Rasterize the interaction events (including key data packets in the original traffic such as HTTP request messages, SSH command submission packets, and database query request packets) and perform sub-temporal granular interpolation enhancement in the temporal dimension. Calculate the relative interval of event nodes in each segment of attack behavior data in the time axis and protocol semantic dimension. Using this as the resolution, map the behavior nodes to the two-dimensional behavior grid. Use multi-neighbor interpolation to expand potential attack path nodes, simulate the attacker's behavior diffusion process, preserve the original semantics and time labels of the events, and upgrade the interpolated behavior nodes to a three-dimensional semantic space.

[0074] Specifically, for all interactive events and their corresponding response packets within each attack behavior unit, as well as discrete behaviors in the structured operation sequence (such as executed shell commands, submitted form parameters, and database operation statements), event nodes are extracted to generate an initial set of behavior events. Each event node contains the following attributes:

[0075] The event's precise timestamp (derived from the timestamp of the original traffic packet or the parsing result of the protocol parsing module), the operation type and protocol context describing the event (examples include: HTTP_GET_probe path SSH_COMMAND_execute ls -laDATABASE_QUERY_SELECT_table_name_users), distinguishing between request-type events (such as HTTP requests initiated by the client, SSH command input) and response-type events (such as HTTP status codes returned by the server, command execution results), and correlation identifiers (Correlation ID, used to mark related events in the same interaction process, such as HTTP requests and their corresponding response packets being associated through TCP stream sequence numbers, and SSH commands and their returned output being associated through session context).

[0076] Based on the above attributes, a two-dimensional behavioral relationship graph (2D-BRG) is constructed. The horizontal axis (X-axis) represents the temporal order of events (arranged in ascending order of timestamps), and the vertical axis (Y-axis) represents the protocol semantic category of the events (mapped through a predefined semantic classification system, such as information detection, vulnerability exploitation, privilege escalation, and data theft, with each category corresponding to a unique Y-axis coordinate value). Each event node is mapped to a two-dimensional coordinate point in this 2D-BRG. ,in This is the time-normalized value of the event (for example, the relative time position of the event within the BAU time range, ranging from [0,1]). Encode values ​​for the semantic category of the event (example: Y=1 for HTTP probe, Y=3 for SSH command, Y=5 for database query).

[0077] To improve the resolution of behavioral events in the spatiotemporal dimension, the system performs rasterization processing on interactive events, dividing the continuous timeline and protocol semantic dimension into discrete units of fixed size (i.e., grids). The specific operation of grid division is as follows:

[0078] Based on the total time span of the attack behavior unit (The difference between the end timestamp and the start timestamp) divides the timeline into... A time grid of equal width, for example: If Set grid width ,but Each time grid The interval is and According to the protocol semantic category (e.g., 5 common attack semantics), dividing the vertical axis into A discrete semantic grid, each semantic grid It corresponds to a unique protocol semantic category;

[0079] Each event node Mapped to the corresponding time raster With semantic grid (via The category encoding is directly determined, thus forming a rasterized event matrix. , It contains several matrix elements, as shown in the example: , indicating the first The time grid and the first If an event node exists within a semantic grid, it is marked as 1; otherwise, it is marked as 0.

[0080] Considering that the original interaction events may exhibit temporal sparsity, such as an attacker submitting only a few critical commands within a certain time period with long intervals of no operation, this invention further introduces sub-temporal granularity interpolation enhancement technology to simulate the continuous diffusion process of attacker behavior. The specific interpolation enhancement process is as follows:

[0081] For each time grid For sparse event regions within a time grid (e.g., only one event node within three consecutive time grids), this invention generates potential behavior nodes through multi-neighborhood interpolation based on the time interval and semantic correlation of neighboring event nodes. The interpolation targets include two categories: if the time grid... With adjacent grid or If all event nodes exist, then in the time grid A transitional behavior node is inserted, with its timestamp being the median time point of the raster. The semantic label is inferred through the protocol semantic correlation of neighboring events (for example, if all neighboring events are information detection events, the interpolated node's semantic label is "detection continuation"). If the same time raster... If an event exists in multiple semantic categories, it is associated with the operation logic based on the chronological order of the event, and a transition node is inserted between adjacent semantic grids to enhance the coherence of the behavior path.

[0082] The event nodes generated by the above interpolation operations all retain the original event's time label (accurate to the median time point of the interpolation calculation) and original semantic label (inferred from neighboring events or logically deduced), and are marked as interpolation nodes. Together with the original event nodes, they constitute an enhanced two-dimensional behavioral raster map. To further characterize the semantic depth and contextual association of attack behaviors, this invention upgrades the rasterized interpolated two-dimensional behavioral nodes (including original nodes and interpolation nodes) to a three-dimensional semantic space, where a new axis is added as the Z-axis, used to characterize the semantic extension dimension of the event (examples include: threat level of the behavior, contextual dependency strength, and correlation with the main attack path). It is calculated through a semantic extension function. If the event is a critical attack step (such as executing the sudo command after successful SSH login), the Z value is high (e.g., Z=0.9). If it is an auxiliary probe (such as an initial directory scan), the Z value is low (e.g., Z=0.2). If it is a transition node generated by interpolation, the Z value is linearly interpolated based on the threat level of neighboring critical events.

[0083] In the three-dimensional semantic space, the original X-axis is used to retain the original time axis information (normalized timestamp) to reflect the temporal evolution of the behavior, and the original Y-axis is used to retain the original protocol semantic axis information (semantic category encoding) to reflect the operation type of the behavior. The upgraded three-dimensional behavior node not only retains the original event's time label and original semantic label, but also enhances the ability to express the threat of the behavior and contextual relevance through the Z-axis. For example, an original HTTP probe event (Y=1, Z=0.1) is located in the low Z-value region in the three-dimensional space, while its subsequent associated SQL injection attempt event (Y=4, Z=0.8) is located in the high Z-value region. The two form a clear attack path evolution trajectory through the continuity of the time axis (X-axis).

[0084] Step S4: Based on the attack chain trajectory set and the behavioral nodes in the upgraded 3D semantic space, perform attack path trend analysis on all attack behavior units (the set of 3D behavioral nodes after segmentation in step S2 and upgrade in step S3) in multiple consecutive stages of the attack chain trajectory set (such as from the information detection stage to the vulnerability exploitation stage and then to the privilege escalation stage). Extract the path curvature, jump rhythm and repeated access pattern of the attack path, and construct an attack path bending law model. This attack path bending law model makes its path bending characteristics consistent with the original attack chain trend, so as to achieve semantic alignment and rhythm consistency of attack behavior.

[0085] Step S5: Input the attack chain trajectory set, behavior nodes and path curvature, jump rhythm and repeated access pattern in the three-dimensional semantic space into the attack path curvature law model, and output a trapping response strategy adapted to the attack behavior. Dynamically adjust the honeynet environment according to the trapping response strategy. The trapping response strategy includes the decoy service type, the degree of interaction response camouflage and the attack log labeling strategy dimension. According to the trapping response strategy, the honeynet environment is dynamically adjusted by adjusting at least one of the decoy service type, the degree of interaction response camouflage or the attack log labeling strategy dimension.

[0086] Through a multi-dimensional parameter linkage algorithm, the output parameters of the attack path curvature pattern model (such as the attack stage corresponding to the peak of the path curvature distribution, the key time interval in the jump rhythm, and the nodes marked by the repeated access pattern) are mapped to the above three strategy dimensions to generate a set of trap response strategies. Based on the generated trap response strategies, the honeynet environment is dynamically adjusted through automated configuration interfaces (such as Ansible playbooks and honeypot management APIs), including but not limited to the following operations:

[0087] In the target network area (such as a simulated border gateway or intranet server cluster), start or switch the specified decoy service type (e.g., disable low-interaction static web services and start high-interaction dynamic e-commerce website simulation services); modify the response generation rules of the honeypot proxy module (e.g., adjust the command execution return content template of the SSH service, or the query result filtering logic of the database service) to make it consistent with the degree of camouflage of the interactive response defined in the policy; update the classification rules and label weights of attack logs (e.g., increase the storage priority of high-threat-level logs, or enable the aggregation compression strategy for repeated access logs) to ensure efficient collection and accurate labeling of attack traces;

[0088] Specifically, the analysis of the path curvature distribution and stage behavior trends in the attack path curvature pattern model identifies the main attack direction in the attack path, i.e., the key stage or semantic category where the attacker is most likely to concentrate resources to break through, including:

[0089] Peak detection is performed on the path curvature sequence to locate node intervals where the path curvature is significantly higher than that of the neighborhood. These intervals correspond to rapid changes in the attack direction.

[0090] Based on the semantic category of the primary attack direction (determined by the Y-axis protocol semantic label, such as DATABASE_QUERY for nodes corresponding to high curvature intervals), the system selects matching decoy service types from a pre-set decoy service library (including low-interaction static services, medium-interaction dynamic services, and high-interaction full-featured services). If the primary attack direction is database operation, high-interaction database services (such as MySQL / Oracle simulation services that support multi-table queries and stored procedure execution) are deployed first. If the primary attack direction is privilege escalation (semantic category PRIVILEGE_ESCALATION), high-interaction operating system shell services (such as SSH services that simulate Linux root privileges) are deployed. At the same time, based on the prediction of subsequent stages of the attack path (inferring the possible targets of the next stage through the jump rhythm rules in APCRM, such as attempting data export after database operation), related decoy services (such as file sharing services or FTP services) are deployed to form a coherent trapping service chain.

[0091] Extract the jump rhythm features from the attack path curvature pattern model, and adjust the degree of camouflage of the honeypot service's interaction response accordingly. Specifically:

[0092] For high-frequency jump scenarios (such as when an attacker switches semantic categories on average every two action nodes), reduce the complexity of the interactive response (such as only returning a basic prompt when executing commands on the SSH service to avoid prematurely exposing system vulnerability details) to accelerate the attacker's probing process between different services and extend their stay in the honeynet.

[0093] For low-frequency but critical jump scenarios (such as attack paths showing a privilege escalation attempt every 10 nodes with time intervals concentrated within 3 seconds), improve the interactive response details of the corresponding nodes (such as returning some real data fragments for sensitive queries on database services, and failing to simulate permission verification for sudo commands on SSH services but returning near-real error messages), to induce attackers to invest more effort in in-depth operations.

[0094] For time-sensitive operations (such as critical privilege escalation operations that typically occur within a time difference of less than 5 seconds between adjacent action nodes, as shown in the attack path curvature model), adjust the response latency parameters of the honeypot service (e.g., set the response time for critical commands to 2-4 seconds to simulate the processing latency of a real system) to enhance the naturalness and credibility of the interaction.

[0095] Furthermore, this invention also dynamically enhances the interactive stickiness of the corresponding service based on the repeated access pattern (such as an attacker repeatedly revisiting a certain probe path). For example, for repeatedly accessed HTTP probe paths, dynamic content that changes with the number of accesses is returned (such as simulating a successful login), gradually inducing the attacker to shift from information gathering to substantive attacks.

[0096] Based on the path curvature characteristics (e.g., high curvature regions correspond to key attack steps) and stage semantic labels in the attack path curvature pattern model, we define label classification rules and priority marking strategies for attack logs: For high curvature nodes (i.e., points of abrupt change in attack direction, such as a change from information probing to vulnerability exploitation) and their associated operation sequences (e.g., submitted SQL injection payloads, executed privilege escalation commands), we attach high threat level labels (e.g., CRITICAL_ATTACK_STEP) and semantic category labels (e.g., EXPLOIT_ATTEMPT) to ensure the rapid retrieval of core attack behaviors in the logs; For repeatedly accessed nodes (e.g., multiple submissions of the same probe request), we attach behavior pattern labels (e.g., REPEATED_PROBE) and frequency statistics labels (e.g., PROBE_COUNT=3) to analyze the attacker's probing strategies; For low curvature but persistent nodes (e.g., long-term directory browsing or command enumeration), we attach behavior persistence labels (e.g., PERSISTENT_EXPLORATION) to help determine the attacker's patience and target clarity.

[0097] The attack log labeling policy dimension also supports alignment by time axis (such as labeling each log entry with the corresponding behavior timestamp and three-dimensional spatial coordinates), which facilitates subsequent attack path visualization and correlation analysis.

[0098] In this embodiment, the attribution analysis in step S2 specifically includes:

[0099] Based on the phase division results already generated in the attack chain trajectory set (each phase includes a clear start and end timestamp, associated target service port and operation semantic type), the system performs phase attribution determination on each data unit in the attack interaction data (such as a single TCP packet, HTTP request message, SSH command line or database query statement).

[0100] For each data unit, extract its associated metadata (such as source IP, target port, timestamp, protocol type) and content features (such as the URI path of the HTTP request, keywords of the SSH command, and table name of the database operation). Perform multi-dimensional matching (matching dimensions include time window overlap, protocol consistency, and operation semantic similarity) by comparing it with the feature rule base of each stage in the current attack chain trajectory set (for example, the feature rule of stage 1 is to contain directory traversal keywords (such as .. / ) or common vulnerability paths (such as / admin / login.php), and the feature rule of stage 2 is to contain SQL injection payloads (such as OR 1=1 --) or file upload form submission). Determine the finest-grained stage to which each data unit belongs (if there are data units that cross stage boundaries, such as a TCP stream that spans two stages, then they are assigned to the dominant stage according to the main operation semantics or time proportion).

[0101] In this embodiment, the behavior slice in step S2 specifically includes:

[0102] After completing the attribution analysis, the system performs behavioral slicing on continuous attack interaction data according to the stage boundaries, clustering continuous data units belonging to the same stage into an attack behavior unit. Each attack behavior unit contains all relevant raw traffic fragments within the stage (such as the complete session stream of all HTTP request / response messages, SSH commands and return results within the stage) and structured operation sequences (such as the list of executed commands and the set of submitted form parameters), and is accompanied by a stage identifier (such as Web_Stage 2_Exploitation), time range (start / end timestamps) and associated target service information (such as IP:Port combination). This process ensures the semantic consistency and temporal integrity of each attack behavior unit in subsequent analysis and avoids cross-stage interference.

[0103] In this embodiment, the path curvature in step S4 is used to quantify the severity of the directional change of the attack behavior in the three-dimensional semantic space. The path curvature is defined by analyzing the spatial vector turning angle between adjacent attack behavior units: for three consecutive behavior nodes in the attack chain , , Each node contains three-dimensional coordinates. First, calculate the nodes. arrive Direction vector and nodes arrive Direction vector Then, the local turning angle is determined by the vector angle calculation function (which calculates the angle between two vectors based on the dot product and the magnitude of the vectors; the larger the angle, the more drastic the change in direction). The normalized value of this angle is used as the curvature value of the local path segment. By calculating the curvature of all consecutive triplet nodes in the attack chain, a path curvature sequence is generated to describe the overall bending distribution characteristics of the attack path.

[0104] Specifically, the jump rhythm focuses on the frequency and temporal interval patterns of attackers' jumps in different semantic categories or time intervals. By statistically analyzing the distribution of semantic category jumps and time intervals between adjacent behavioral nodes, the sub-features of the jump rhythm are extracted: jump frequency and temporal interval patterns. Jump frequency is calculated as the number of semantic category jumps occurring within a unit time or unit path length, and temporal interval patterns are calculated as the time difference between adjacent key operations, generating a histogram or cumulative distribution function of the time interval.

[0105] Specifically, the repeated access pattern is used to detect whether an attacker revisits a semantic node or time interval multiple times. By constructing a node access frequency matrix (recording the number of times each three-dimensional node is accessed) and a local path loop detection algorithm (if a subsequence (such as HTTP probe path A → SSH login → HTTP probe path A) is detected to be repeated in a continuous sequence of nodes in the attack chain, it is marked as a loop access pattern), two types of repeated behaviors are identified: semantic node repetition (such as submitting the same SQL injection payload multiple times) and path segment loop (such as probing the directory first, then attempting to log in, and then repeating the directory probing loop).

[0106] Based on the above three types of features (path curvature sequence, jump rhythm feature results, and repeated access pattern markers), an attack path curvature pattern model is constructed. The processing steps of the attack path curvature pattern model include:

[0107] Based on the path curvature, a path curvature sequence is constructed, and the kernel density of the path curvature sequence is estimated. The probability distribution of curvature values ​​is fitted by nonparametric methods, such as identifying the attack direction change interval corresponding to the high curvature peak. Then, typical curvature patterns of attack paths are generated, such as low curvature smooth advance → high curvature sharp turn breakthrough → medium curvature oscillation adjustment.

[0108] Based on the statistical results of jump rhythm and repeated access patterns, the attacker's jump decision rules are summarized. For example, when the duration of the probing phase exceeds the threshold, the probability of jumping to the vulnerability exploitation phase increases to 80%, or critical privilege escalation operations usually occur within a time difference of less than 3 seconds between adjacent behavior nodes.

[0109] Mark duplicate nodes or duplicate path segments as dependent nodes, and define the maximum number of times a dependent node can be accessed repeatedly (e.g., a maximum of 2 times for the same probe path) and the triggering conditions (e.g., triggering backtracking probe only after privilege escalation fails).

[0110] The output is a set of parameters describing the dynamic characteristics of the attack path, including path curvature distribution parameters, jump decision rules, and repeated access constraints.

[0111] Specifically, the results of the above attribution analysis and behavior slicing operation directly determine the granularity of the attack behavior unit. The calculated traffic characteristics and geometric representation data are the core inputs for the subsequent S3 rasterization processing and dimensionality increase operation, ensuring the consistency of data flow between each step. The analysis process in step S4 closely depends on the original attack interaction data in step S1 and the dimensionality increase data in step S3, realizing the characterization of the dynamic characteristics of attack behavior. The parameter set describing the dynamic characteristics of the attack path directly provides a quantitative matching basis for the core dimensions of the S5 trapping response strategy, ensuring the targeting and rationality of the strategy generation.

[0112] Example 2

[0113] The difference from Example 1 is that, as in Example 2, ... Figure 2 As shown, the present invention also provides a honeynet-based attack trapping and analysis system, applied to a honeynet-based attack trapping and analysis method, comprising:

[0114] The data acquisition module 10, corresponding to step S1, constructs a simulated environment through a distributed honeycomb node system, runs honeypot agents on various virtual services, continuously collects attack interaction data and associated attack chain trajectory sets, and sends the attack chain trajectory sets to the data processing module 20 and the trapping response strategy generation module 40.

[0115] The data processing module 20, corresponding to step S2, is used to perform attribution analysis and behavior slicing on the collected attack interaction data according to the stage division rules of the attack chain trajectory set, calculate the attack path traffic length distribution and proportion of each stage, extract the mainstream flow vector in the attack interaction data, construct the behavior space attitude matrix, and send the attack behavior unit division result and the space attitude matrix to the interpolation mapping module 30.

[0116] Interpolation mapping module 30, corresponding to step S3, is used to construct a two-dimensional behavior relationship graph for each attack behavior unit, perform rasterization processing on the interaction events, and perform sub-temporal granular interpolation enhancement in the temporal dimension, retain the original semantics and time labels of the events, upgrade the interpolated behavior nodes to the three-dimensional semantic space, and send the interpolation enhancement results to the trapping response strategy generation module 40.

[0117] The trapping response strategy generation module 40, corresponding to steps S4~S5, is used to analyze the attack path trends at each stage of the attack chain trajectory set, extract the path curvature, jump rhythm and repeated access pattern of the attack path, construct the attack path curvature law model, and generate the corresponding trapping response strategy based on the attack path curvature law model, and dynamically adjust the honeynet environment according to the trapping response strategy.

[0118] In summary, this invention can automatically adjust the honeypot type and location according to changes in attack behavior, effectively improving the structural clarity and processing accuracy of attack behavior data, and facilitating the direct use of attack behavior identification results for trapping strategy optimization.

[0119] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A honeynet-based attack trapping and analysis method, characterized in that, Specifically, the following steps are included: Step S1: Construct a simulated environment through a distributed honeycomb node system, run honeypot agents on various virtual services, and continuously collect attack interaction data and related attack chain trajectory sets; Step S2: Based on the stage division rules of the attack chain trajectory set, perform attribution analysis and behavior slicing on the collected attack interaction data, divide it into multiple attack behavior units, calculate the attack path traffic length distribution and proportion of each stage, extract the mainstream flow vector in the attack interaction data, and construct the behavior space posture matrix. Step S3: Construct a two-dimensional behavior relationship graph for each attack behavior unit, rasterize the interaction events, and perform sub-temporal granular interpolation enhancement in the temporal dimension, preserving the original semantics and time labels of the events, and upsizing the interpolated behavior nodes to a three-dimensional semantic space. Step S4: Based on the attack chain trajectory set and the behavior nodes in the upgraded three-dimensional semantic space, perform attack path trend analysis on all attack behavior units in multiple consecutive stages of the attack chain trajectory set, extract the path curvature, jump rhythm and repeated access pattern of the attack path, and construct an attack path bending law model. Step S5: Input the attack chain trajectory set, behavior nodes and path curvature, jump rhythm and repeated access pattern in the three-dimensional semantic space into the attack path curvature law model, and output the trapping response strategy adapted to the attack behavior. Dynamically adjust the honeynet environment according to the trapping response strategy. The path curvature in step S4 is used to quantify the severity of the directional change of the attack behavior in the three-dimensional semantic space. The path curvature is defined by analyzing the spatial vector turning angle between adjacent attack behavior units: for three consecutive behavior nodes in the attack chain , , Each node contains three-dimensional coordinates. First, calculate the nodes. arrive Direction vector and nodes arrive Direction vector Then, the local turning angle is determined by the vector angle calculation function. By calculating the curvature of all consecutive triplet nodes in the attack chain, a path curvature sequence is generated to describe the overall bending distribution characteristics of the attack path. The jump rhythm focuses on the jump frequency and time interval patterns of attackers in different semantic categories or time intervals. The jump frequency and time interval patterns of the jump rhythm are extracted by statistically analyzing the number of semantic category jumps and the time interval distribution between adjacent behavior nodes. The jump frequency is calculated as the number of semantic category jumps occurring within a unit time or a unit path length. The time interval pattern is calculated by statistically analyzing the time difference between adjacent key operations and generating a histogram or cumulative distribution function of the time interval. The repeated access pattern is used to detect whether an attacker revisits a semantic node or time interval multiple times. By constructing a node access frequency matrix and a local path loop detection algorithm, two types of repeated behaviors are identified, including semantic node repetition and path segment looping. In step S4, the processing steps for the attack path curvature model include: A path curvature sequence is constructed based on the path curvature, and the kernel density of the path curvature sequence is estimated. Based on the statistical results of redirection rhythm and repeated access patterns, the attacker's redirection decision rules are summarized. Mark duplicate nodes or duplicate path segments as dependent nodes and define the upper limit on the number of times a dependent node can be visited repeatedly; The output is a set of parameters describing the dynamic characteristics of the attack path, including path curvature distribution parameters, jump decision rules, and repeated access constraints.

2. The method for attack trapping and analysis based on honeynets according to claim 1, characterized in that, Step S2 includes the following steps: Step S21: Based on predefined phase division rules, set semantically driven phase boundaries and perform attribution analysis and behavior slicing on attack interaction data; Step S22: Calculate the attack path traffic length distribution and proportion characteristics corresponding to each attack behavior unit to quantify the scale and transmission characteristics of attack interaction data within the stage. Step S23: Construct a behavior space pose matrix to map the multidimensional features of each attack behavior unit to a three-dimensional geometric space, thereby realizing the geometric representation of the attack behavior.

3. The method for attack trapping and analysis based on honeynets according to claim 2, characterized in that, The attribution analysis in step S2 specifically includes: Based on the phase division results generated in the attack chain trajectory set, the phase attribution determination is performed on each data unit in the attack interaction data. For each data unit, its associated metadata and content features are extracted, and multi-dimensional matching is performed with the feature rule base of each stage in the current attack chain trajectory set to determine the finest granular stage to which each data unit belongs.

4. The method for attack trapping and analysis based on honeynets according to claim 3, characterized in that, The behavior slice in step S2 specifically includes: Behavioral slicing is performed on continuous attack interaction data according to phase boundaries. Continuous data units belonging to the same phase are clustered into an attack behavior unit. Each attack behavior unit contains all relevant raw traffic fragments and structured operation sequences within the phase, along with a phase identifier, time range, and associated target service information.

5. The method for attack trapping and analysis based on honeynets according to claim 1, characterized in that, Step S2 further includes: uniformly correcting the attack chain trajectory set so that its main attack path is aligned with the X-axis, the lateral attack features are aligned with the Y-axis, and the noise dimension is mapped to the Z-axis. Combined with the data distribution boundary after attitude normalization, the range of attack behavior data corresponding to each attack chain segment is determined, and the structured segmentation of attack behavior data is completed.

6. The method for attack trapping and analysis based on honeynets according to claim 1, characterized in that, The trapping response strategy in step S5 includes the decoy service type, the degree of interaction response camouflage, and the attack log labeling strategy dimension. According to the trapping response strategy, the honeynet environment is dynamically adjusted by adjusting at least one of the decoy service type, the degree of interaction response camouflage, or the attack log labeling strategy dimension.

7. The method for attack trapping and analysis based on honeynets according to claim 1, characterized in that, The simulated environment in step S1 is used to lure potential attackers to carry out real intrusion behavior. The attack interaction data includes multiple unclassified raw traffic samples, and the attack chain trajectory set consists of multiple staged attack sessions.

8. A honeynet-based attack trapping and analysis system, applied to the honeynet-based attack trapping and analysis method described in any one of claims 1-7, characterized in that, include: The data acquisition module constructs a simulated environment through a distributed honeycomb node system, runs honeypot agents on various virtual services, and continuously collects attack interaction data and related attack chain trace sets. The data processing module is used to perform attribution analysis and behavior slicing on the collected attack interaction data according to the stage division rules of the attack chain trajectory set, calculate the attack path traffic length distribution and proportion of each stage, extract the mainstream flow vector in the attack interaction data, and construct the behavior space posture matrix. The interpolation mapping module is used to construct a two-dimensional behavior relationship graph for each attack behavior unit, rasterize the interaction events, and perform sub-temporal granular interpolation enhancement in the temporal dimension, preserving the original semantics and time labels of the events, and upsizing the interpolated behavior nodes to a three-dimensional semantic space. The bait response strategy generation module is used to analyze the attack path trends at each stage of the attack chain trajectory set, extract the path curvature, jump rhythm and repeated access patterns of the attack path, construct the attack path curvature law model, and generate corresponding bait response strategies based on the attack path curvature law model, and dynamically adjust the honeynet environment according to the bait response strategies.

Images