TTPs scene analysis method for software-defined deception defense system

Abstract

The invention provides a TTPs scene analysis method for a software defined deception defense system, and relates to the field of network security space. The method provided by the invention comprises the following steps: constructing a network security knowledge graph based on a threat intelligence source; retrieving and extracting attack indexes and observation data based on the network security knowledge graph according to an input attack technology identifier and a predefined semantic path, and generating structured retrieval data; converting the retrieval data into a natural language description text based on a large language model, and performing interactive reasoning through the large language model based on the natural language description text to generate system environment information corresponding to the attack technology identifier; and based on the system environment information, executing an operation corresponding to the attack technology identifier in the simulation environment, verifying the suitability of the system environment information, and correcting the system environment information according to a verification result. According to the invention, verifiable system environment information can be automatically generated, and a scene construction capability is provided for cheating defense.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of network security space, and particularly relates to a TTPs scene analysis method for a software-defined deception defense system. BACKGROUND

[0002] Cybersecurity confrontation is increasingly fierce, and attack behavior has evolved from simple destruction to advanced persistent threat (APT) with stages, concealed paths and flexible tactics. The traditional defense system relying on static rules and feature matching cannot effectively cope with the rapid variation of attack means and its concealed penetration in normal traffic. Under this background, active defense has become an important development direction. Among them, the software-defined deception defense system realizes the efficient trapping and interference of attackers through the unified arrangement and dynamic scheduling of deception resources. In order to improve the intelligent level and response accuracy of such software-defined deception defense system, the industry is exploring the use of knowledge graph to structure the modeling of attack knowledge, and with the help of the powerful semantic understanding and reasoning ability of large language model (LLM), automatically extracting and analyzing attack patterns from massive threat intelligence and interaction logs. The present application focuses on solving the specific problem that the relationship between attack technology tactics (TTP) and environment is not clear, aiming to provide verifiable and executable environment intelligence support for dynamic strategy generation and simulation environment construction in software-defined deception defense.

[0003] However, although the existing technology has made progress, there are still obvious defects in supporting the realization of accurate environment simulation of software-defined deception defense system. First, the analysis of attack technology is mostly limited to the tactical description level, and the specific conditions such as underlying system environment and configuration dependency necessary for its successful execution are often missing or not clearly associated. Second, the relevant environment information is scattered in unstructured reports and logs, which is difficult to be effectively extracted and transformed into structured intelligence that can be directly utilized by machines. Finally, there is often a lack of reliable verification means for the validity of the environment configuration based on the analysis, resulting in the defense strategy generated therefrom may be detached from reality, and the usability and credibility are insufficient. Therefore, it is urgent to provide a solution to improve the above problems. SUMMARY

[0004] The purpose of the present application is to provide a TTPs scene analysis method for a software-defined deception defense system, which can improve the problem of incomplete extraction of environment information dependent on attack technology and lack of empirical verification mechanism.

[0005] The TTPs scene analysis method for a software-defined deception defense system provided by the present application comprises: constructing a network security knowledge graph based on threat intelligence sources; based on the network security knowledge graph, retrieving and extracting attack indicators and observation data according to an input attack technology identifier and a predefined semantic path, and generating structured retrieval data; converting the retrieval data into natural language description text based on a large language model, and generating system environment information corresponding to the attack technology identifier through interactive reasoning based on the natural language description text by the large language model; based on the system environment information, performing operations corresponding to the attack technology identifier in a simulation environment, verifying the adaptability of the system environment information, and modifying the system environment information according to the verification result.

[0006] The application provides a TTPs scene analysis method for a software-defined deception defense system, which realizes automatic and verifiable extraction and reconstruction of system environment information relied on by attack technology from massive threat intelligence through semantic retrieval and interactive reasoning based on attack technology identifier, and closed-loop verification of simulation environment.

[0007] Optionally, when constructing a network security knowledge graph based on threat intelligence sources, the method comprises: collecting threat intelligence data from threat intelligence sources and preprocessing the threat intelligence data; extracting entities from the preprocessed threat intelligence data through named entity recognition technology, extracting relationships between the entities through relationship extraction technology, and modeling the entities as nodes and the relationships as relationships based on a pre-set unified data specification; and constructing the network security knowledge graph based on the modeled entities and relationships; wherein the entities include attackers, malware, tools, attack technologies, attack indicators and observation data; the relationships include attack technology usage relationship of attackers, malware or tools, attack indicator based relationship based on observation data, attack indicator indicating relationship of attackers, malware or tools, and development relationship of malware or tools developed by attackers.

[0008] Optionally, when based on the network security knowledge graph, retrieving and extracting attack indicators and observation data according to an input attack technology identifier and a predefined semantic path, and generating structured retrieval data, the method comprises: using attack technology numbers in the MITRE ATT&CK framework as the attack technology identifier, and locating the corresponding attack technology node in the network security knowledge graph by taking the attack technology identifier as a query entry; based on semantic associations between entities in the network security knowledge graph, constructing a semantic path starting from the attack technology node, passing through malware nodes or tool nodes, attack indicator nodes, and finally reaching observation data nodes; Along the semantic path, the associated malware or tool data, attack indicators and observation data are traversed and extracted; the attack technique identifier, the attack indicators and the observation data are organized in a preset format to generate structured search data.

[0009] Optionally, the threat intelligence source includes MITRE ATT&CK, an open-source malware sample library, an advanced persistent threat analysis report and a threat analysis platform log; the attack indicators include file hash values, IP addresses and domain names; and the observation data includes file operation records, process operation records, registry operation records and network connection records.

[0010] Optionally, when the search data is converted into natural language description text based on a large language model and interactive reasoning is performed through the large language model based on the natural language description text to generate system environment information corresponding to the attack technique identifier, the method includes: The search data is sequentially filled into a preset natural language template based on the large language model to generate the natural language description text; An initial prompt containing the attack technique identifier and the natural language description text is constructed and submitted to the large language model to obtain a preliminary answer; The preliminary answer is parsed, logical consistency verification is performed according to the parsing result and in combination with an external prior knowledge base to generate a follow-up prompt; and the large model is guided to perform at least one subsequent reasoning based on the follow-up prompt; Based on the preliminary answer and the result of at least one subsequent reasoning, system environment information corresponding to the attack technique identifier is generated.

[0011] Optionally, when the search data is sequentially filled into a preset natural language template based on the large language model, the method includes: The behavior category label in the search data is semantically expanded and explained; And / or the timestamp in the search data is converted into a standard date and time format; And / or missing or abnormal fields in the search data are labeled.

[0012] Optionally, the system environment information includes an attack technique number, a system version, a process list, a file path list, a list of normal software and a port list.

[0013] Optionally, when the system environment information is used to perform operations corresponding to the attack technique identifier in a simulation environment, the adaptability of the system environment information is verified, and the system environment information is modified according to the verification result, the method includes: Based on the system environment information, the simulation environment is configured; in the simulation environment, an automated attack simulation framework is called to execute an operation sequence corresponding to the attack technology identification; The system events of the simulation environment are monitored, an execution trajectory is obtained, and the execution trajectory is compared with an expected behavior to determine whether the attack technology corresponding to the attack technology identification is successfully triggered; If it is determined that the attack technology is not successfully triggered, the execution trajectory is analyzed to determine an environment configuration defect, a correction suggestion for the system environment information is generated based on the environment configuration defect, and subsequent simulation verification is iteratively optimized based on the correction suggestion.

[0014] Compared with the prior art, the present application has the following beneficial effects: 1. The present application forms a complete closed-loop process by fusing semantic retrieval of knowledge graph, intelligent reasoning of large language model and empirical verification of automated attack simulation. The process can systematically deduce and construct a high-fidelity system environment configuration for a specific attack technology (TTP), thereby significantly improving the real trigger rate and path reproduction accuracy of attack behavior in a deception defense simulation environment, overcoming the defects of traditional methods relying on static rules and rough environment modeling.

[0015] 2. By using a large language model to perform deep semantic understanding and context reasoning on unstructured threat intelligence and graph retrieval results, the present application can automatically and accurately extract core features constituting the system environment, including but not limited to operating system version, key process, file path, registry item and open port, etc. This greatly reduces the dependence on manual experience and enhances the completeness and accuracy of environment modeling.

[0016] 3. The present application introduces an empirical verification link based on an automated attack simulation framework. By executing TTP behavior in the configured environment and monitoring the results, the system can objectively judge the effectiveness of the environment configuration and automatically analyze the failure reasons to generate targeted correction suggestions. Thus, a verification-error correction closed loop of environment configuration is realized.

[0017] 4. The environment configuration generated by the present application is output in a structured data form, with high modularity and standardization characteristics. The output format adapts to the core needs of a software-defined deception defense system, facilitating the control center to quickly load, dynamically schedule and update the strategy of the honeypot environment, thereby significantly improving the operation efficiency, scene adaptability and automated response capability of the entire defense system. BRIEF DESCRIPTION OF DRAWINGS

[0018] Figure 1 A flowchart of a TTPs scene analysis method for a software-defined deception defense system according to an embodiment of the present application. DETAILED DESCRIPTION

[0019] In order to make the purposes, technical solutions and advantages of the embodiments of the present application clearer, the technical solutions in the embodiments of the present application will be described clearly and completely below. Obviously, the described embodiments are only some of the embodiments of the present application, but not all the embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative work fall within the scope of protection of the present application. Unless otherwise defined, the technical terms or scientific terms used herein should be understood as the usual meanings understood by those of ordinary skill in the art to which the present application belongs. The words such as "comprise" and the like used herein mean that the elements or objects before the words cover the elements or objects listed after the words and their equivalents, and do not exclude other elements or objects.

[0020] Referring to Figure 1 The present application provides a TTPs scene analysis method for a software-defined deception defense system, comprising the following steps: S1, constructing a network security knowledge graph based on threat intelligence sources; based on the network security knowledge graph, attack indicators and observation data are retrieved and extracted according to an input attack technology identifier and a pre-defined semantic path, and structured retrieval data are generated; S2, converting the retrieval data into natural language description text based on a large language model, and generating system environment information corresponding to the attack technology identifier through interactive reasoning of the large language model based on the natural language description text; S3, based on the system environment information, performing operations corresponding to the attack technology identifier in a simulation environment, verifying the adaptability of the system environment information, and modifying the system environment information according to the verification result.

[0021] In some embodiments, in step S1, when constructing the network security knowledge graph based on threat intelligence sources, first, threat intelligence data is collected from multiple public and proprietary threat intelligence sources. These threat intelligence sources include but are not limited to MITRE ATT&CK, open-source malware libraries (such as VirusShare), advanced persistent threat (APT) analysis reports, and threat analysis platform logs. These data cover a wide range of information from attack tactics, malicious samples to specific system behavior observations. Then, the threat intelligence data is cleaned (such as de-duplication, filtering of irrelevant or low-quality data) and standardized in format. Since the original threat intelligence data formats are diverse, they need to be converted into a preset intermediate representation format to facilitate subsequent information extraction engine processing, ensuring data consistency and parsability. Then, through named entity recognition technology, entities are automatically extracted and classified from the preprocessed threat intelligence data. Based on the identified entities, further semantic relationships between entities are extracted through relationship extraction technology. Based on the preset unified data specification, the extracted entities are modeled as nodes in the knowledge graph, and types and attributes are defined for each node; the extracted relationships are modeled as edges connecting the nodes, with types and directions. All nodes and edges that meet the unified specification modeling are imported into the graph database for storage and indexing, and finally form the network security knowledge graph. This graph provides a structured knowledge base for subsequent semantic retrieval starting from attack technology identifiers.

[0022] Specifically, the entity types in the network security knowledge graph include: Attacker refers to an attack organization or threat actor that implements attack activities, such as APT organization number (such as APT28), hacker group, and cybercrime organization; Malware refers to malicious code entities that perform attack behaviors, such as backdoors, worms, Trojans, and ransomware; Tool refers to legal tools or penetration tools used by attackers in the attack process, such as PowerShell and Mimikatz; Attack technology (Tactics, Techniques and Procedures, TTP) refers to attack tactics, techniques, and procedures described in the MITRE ATT&CK framework; Attack indicator refers to observable features used to indicate attack intent or malicious activities, such as hash, IP, domain name, and URL; Observed data refers to system behaviors recorded during actual attack sample execution or threat monitoring, such as file creation, process startup, registry modification, and network connection.

[0023] Specifically, there are semantically clear relationships between entities, and key relationship types include: The use of the relation (uses) indicates that one entity (such as an attacker or malware) uses another entity (such as an attack technique or tool) in an activity. For example, Attacker→TTP / Malware / Tool means that the attacker uses a specific attack technique, malware, or tool, and Malware→TTP / Tool means that the malware implements the technique, calls or integrates tools to perform its functions during the attack. Indicators indicate that a particular attack indicator can be used to infer the presence or activity of a specific entity (such as an attacker or malware). For example, indicator→Attacker / Malware / Tool indicates that an attack indicator points to a specific attack organization, malware, or tool. The "based_on" relation indicates that the judgment of a certain attack indicator is derived from specific observation data. For example, "indicator→observed_data" means that a certain attack indicator is generated based on a certain observation data. The "authorized_by" relationship indicates that a piece of malware or tool was developed or owned by a specific attacker. For example, Malware / Tool→Attacker means that the malware or tool was developed by a particular attacker.

[0024] In some embodiments, in step S1, when retrieving and extracting attack indicators and observation data based on the input attack technique identifier and predefined semantic path according to the network security knowledge graph, and generating structured retrieval data, the attack technique number in the MITREATT&CK framework is used as the attack technique identifier, and the attack technique identifier is used as the query entry point to locate the corresponding attack technique node in the network security knowledge graph; based on the semantic association between entities in the network security knowledge graph, a semantic path is constructed from the attack technique node, through malware or tool nodes, attack indicator nodes, and finally to the observation data node; along the semantic path, associated malware or tool data, attack indicators, and observation data are traversed and extracted; the attack technique identifier, attack indicators, and observation data are organized according to a preset format to generate structured retrieval data. The specific process is as follows: S11. Based on the input attack technique identifier, the system uses this identifier as the query entry point to perform a query in the network security knowledge graph, accurately locating the attack technique node corresponding to that number. The attack technique identifier is the attack technique number (TTP_ID) in the MITRE ATT&CK framework. For example, TTP number T1082 represents "System Information Discovery," used to identify the target host's operating system version, hardware configuration, domain information, etc. S12. The system does not use fixed query statements, but dynamically constructs semantic paths based on the rich semantic relationships predefined in the network security knowledge graph. In a typical embodiment, the typical path "attack technology → malware / tools → attack indicators → observation data" is mainly adopted, which reflects the actual execution chain of the attack behavior. The system first starts from the located attack technology node and explores the associated malware or tool nodes along relationships such as uses. Then, starting from these nodes, it queries the corresponding attack indicator nodes along the indicators relationship. Finally, starting from the attack indicator node, it locates the corresponding observation data node along the based_on relationship. This construction process is semantically driven. If some entities and relationships are missing or interrupted in the graph, the system will automatically adjust the retrieval method according to the actual available nodes. For example, when sample information is insufficient, attack technology nodes can be directly associated with typical attack indicator nodes; when indicators are missing but behavior records exist, they can also be directly linked to observation data through sample behavior entities. The retrieval process prioritizes semantic relevance and data integrity, and dynamically selects the main path or alternative path to ensure that the extracted environmental information is as comprehensive and reliable as possible, and can cover the actual performance of attack techniques in different scenarios. S13. Following the semantic path constructed above, the system performs a traversal query in the graph database. It sequentially visits malware / tool ​​nodes, attack indicator nodes, and observation data nodes along the path, and extracts data from these nodes. The attack indicator data includes hash values, IP addresses, domain names, and other key features used to identify malicious behavior; the observation data includes system behavior records such as files, registry entries, processes, and network connections. S14. Integrate and serialize the context and results of this search. The system organizes the attack technique identifier (which serves as the starting point of the query), the extracted attack indicators, and the observation data list corresponding to each indicator according to a predefined format. In a typical embodiment, this format is JSON. Finally, structured search data is generated.

[0025] To illustrate this more clearly, the following is an example of a structured JSON format for retrieving data. It should be noted that the example below is for illustrative purposes only, demonstrating its core structure, and not a complete definition of the data content. Example as follows: { "ttp_id": "T1082", "indicator": [{ "id": 1493, "hash": "9afd2ccb1..." "behavior": ["networks_operation","mutexes_operation",..] }], "observed_data": [{ "id": 600, "first_observed": 1187089444, "last_observed": 1745485135, "number_observed": 45118, "type": "registry_key", "value":"HKEY_CURRENT_USER\\Software\\Microsoft\\..." }], } The `ttp_id` field records the attack technique identifier used as the query entry point. The `indicator` field encapsulates one or more extracted attack indicator entities. Each indicator object contains a unique identifier (id), a hash value, and associated behavior tags, including but not limited to `files_operation`, `processes_operation`, `registry_keys_operation`, `networks_operation`, `services_operation`, `mutexes_operation`, and `windows_operation`. The `observed_data` field encapsulates the specific behavior observation records corresponding to the indicator. Each record contains a unique identifier (id), behavior type (e.g., file, registry, mutex), first observation time (first_observed), last observation time (last_observed), observation frequency (number_observed), and the observed value (value), among other key attributes. This pre-defined format specification allows heterogeneous node data that was originally scattered throughout the graph to be organized into a unified, serializable data entity that can be directly used as input for subsequent large language model inference.

[0026] In some embodiments, in step S2, when converting the retrieved data into natural language description text based on a large language model, and performing interactive reasoning based on the natural language description text through the large language model to generate system environment information corresponding to the attack technique identifier, the retrieved data is sequentially filled into a preset natural language template based on the large language model (such as GPT3.5, Qwen, LLaMA) to generate natural language description text; an initial prompt containing the attack technique identifier and natural language description text is constructed and submitted to the large language model to obtain a preliminary answer; the preliminary answer is parsed, and logical consistency is checked based on the parsing result and combined with an external prior knowledge base to generate follow-up prompts; the follow-up prompts guide the large model to perform at least one subsequent reasoning; based on the preliminary answer and the result of at least one subsequent reasoning, system environment information corresponding to the attack technique identifier is generated. This system environment information is a key input for policy orchestration and resource scheduling in the software-defined system. The specific process is as follows: S21. The system receives structured retrieval data from S1 and generates a complete and semantically rich natural language description text by orderly filling key fields from the retrieval data into the corresponding placeholders of a preset natural language template. For example, the hash value in the indicator field is filled into a sentence such as "The MD5 value of the sample is {hash_md5}, and the SHA256 value is {hash_sha256}". To enhance the model's understanding of attack behavior, this process includes semantic enhancement operations: expanding the interpretation of abstract labels in the behavior field (e.g., interpreting "mutexes_operation" as "mutexistence operation, often used to prevent multiple instances from running") to improve the accuracy and readability of contextual expression; converting timestamps (first_observed, last_observed) into a standard date and time format to clarify the active time range of the sample, making it easier for the model to capture time-related environmental features; and annotating and prompting potentially missing or abnormal fields to assist in focusing on key areas during subsequent inference. S22. Using the natural language description text and attack technique identifiers generated in S21 as core inputs, the system constructs an initial prompt and submits it to the large language model to obtain a preliminary answer. S23. The system analyzes the initial response from the large language model and guides the response convergence through iterative follow-up questions. Details are as follows: Parsing and Comparison: Based on preset field extraction rules, the system extracts candidate fields such as system version, process name, file path, registry entry, and network port from the text through regular expression matching, keyword positioning, and model recognition. The system then compares the newly extracted fields with the initially input known information item by item, marking missing fields, fields with ambiguous values, and fields that contradict each other. When multiple different system versions, unclear file paths, or registry entries that are inconsistent with the behavior type appear in the answer, the system treats these fields as "items to be clarified." Logical consistency verification: The system also combines external prior knowledge bases (such as MITRE ATT&CK data, operating system specifications, malware behavior databases, IoC databases, network protocol specifications, and vulnerability knowledge bases) to perform logical consistency verification on the model's answers. For example, when the answer contains an operating system that does not match known ATT&CK technology, uses a file path that does not exist in the system specification, or provides hash behavior that is inconsistent with the IoC database record, the system will determine that the field has a logical conflict or contextual contradiction, and automatically generate remedial prompts to request the model to further clarify the meaning of the specific field, confirm whether the path or process belongs to a system component, or determine whether the port number and protocol are reasonable. Follow-up Question Generation and Iteration: Based on the above analysis and verification results, the system automatically generates follow-up questions, resubmitting the content that needs to be supplemented or clarified to the model. For example, it may require confirmation of a specific version number, differentiation between normal software paths and attack paths, or limitation of the system component to which a file path belongs. Through this comparison-supplementation method, the model gradually converges to a complete, clear, and consistent environment description in subsequent generation. During multiple rounds of interaction, the large language model dynamically adjusts its questioning strategy based on the quality of the response. If it finds inconsistencies in the generated information or missing key elements, it automatically adds clarifying prompts or restrictive supplements, prompting the large language model to generate more targeted and actionable answers. Through this cyclical processing method of "answer verification—contradiction detection—remedial prompts," the model gradually converges to an environment description that conforms to the attack technique logic and system specifications during multiple rounds of interaction. To illustrate the interaction process more specifically, the following are examples of prompts that may be used in this process: ① Initial prompt example: "Based on the hash values ​​and observed behavior of the following malicious samples, please infer the possible system environment version and main characteristics in which they may be running:" MD5:e2e4b2f28d29fd19bb28287a4d99ede2 SHA1:01ffc3ee5c2c560d29aaa8ac3d17f0ea4f6c0c09 SHA256:9afd2ccb1e2c434d296a6fa54fa5425c827e4172947c05a7db226076996a3715 File type: PE32 executable (GUI) Intel 80386, for Windows Behavior categories include: network operations, mutex operations (used to prevent multiple instances from running), registry operations, service operations, file operations, and process operations. First observation time: 2023-01-15 08:30:00 Last observation time: 2023-04-20 23:45:00 Please analyze and describe the operating system version and environmental characteristics that this sample may rely on. ②Example of iterative follow-up questions: "This sample involves the registry key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run. Please determine whether this indicates that the sample has persistent intent? Can its behavior be mapped to MITRE ATT&CK technology number T1547.001? Please provide a detailed description in conjunction with the registry path and behavior type." ③Example of environmental exclusion prompts: "The file path of the sample contains the directory 'Program Files\Kaspersky\', which usually points to the installation directory of security software. Please determine whether this path may be a factor interfering with normal software, and whether related processes and files should be excluded during the analysis. Please explain your reasoning." ④ Example of system environment information: Based on the foregoing analysis, please output the multi-dimensional system environment information corresponding to this sample, including: " S24. After multiple rounds of interaction and the model's responses becoming stable and complete, the system finally extracts and structures system environment information from the dialogue content. This information typically includes the TTP number, system version, process list, file path list, and list of normal software and ports.

[0027] In some embodiments, in step S3, based on system environment information, the operation corresponding to the attack technique identifier is executed in the simulation environment to verify the adaptability of the system environment information, and the system environment information is corrected according to the verification results. Based on the system environment information, the simulation environment is configured; in the simulation environment, the automated attack simulation framework is invoked to execute the operation sequence corresponding to the attack technique identifier; system events in the simulation environment are monitored, the execution trajectory is obtained, and the execution trajectory is compared with the expected behavior to determine whether the attack technique corresponding to the attack technique identifier has been successfully triggered; if it is determined that it has not been successfully triggered, the execution trajectory is analyzed to determine the environment configuration defect, and a correction suggestion for the system environment information is generated based on the environment configuration defect. The subsequent simulation verification is iteratively optimized based on the correction suggestion. The environment configuration verified through empirical testing ensures that every environment template delivered to the deception defense system has high reliability and executability. The specific process is as follows: S31. The system receives the system environment information from step S2 and automatically configures a highly controllable simulation environment based on this. This configuration aims to accurately reproduce all inferred items in the environment information list. Specific operations include: setting the specified operating system type and version, creating or implanting necessary file paths, writing corresponding registry entries, starting relevant system services and processes, and opening specific network ports as needed. This step aims to accurately reproduce the target environment inferred by the large language model, laying the foundation for subsequent behavior reproduction. S32. In the configured simulation environment, the system calls the automated attack simulation framework (such as Atomic RedTeam, Caldera) to perform operations. The generated environment configuration is used as input to build the corresponding verification scenario. The system executes the commands, scripts or operation instructions corresponding to TTP according to the preset steps to reproduce the execution process of the actual combat TTP behavior in a specific environment. S33. During simulation execution, the system captures system events generated within the simulation environment in real time, and records the time sequence and return results of each operation step, forming a complete execution trajectory. System events include process tree changes, file read / write operations, registry key modifications, network connection establishment, and service status changes. The system compares the captured execution trajectory with the expected behavior defined based on TTP semantic requirements. For example, it verifies whether key behaviors are triggered, whether the behavior sequence conforms to the technical semantic description, whether the execution path is consistent with the inferred environmental conditions, and whether abnormal return values ​​or failed steps indicate insufficient environment configuration. When the simulated behavior is detected to be highly consistent with the semantic characteristics of the TTP (such as generating a specific file path, modifying a specified registry key, or establishing a target port connection), it can be determined that the environment configuration can support the effective execution of the TTP, i.e., the attack technique has been successfully triggered. If certain key behaviors are not triggered or unexpected system changes occur, i.e., the attack technique has not been successfully triggered, the system will record the failed steps and reasons, providing a basis for subsequent correction of the environment configuration. S34. If the trigger is determined to have failed, the system will perform an adaptation analysis on the current environment configuration based on the captured execution trajectory to identify the specific environment configuration defects that caused the failure. The analysis process first reads the operation instructions, return values, exception logs, and key behaviors that were not triggered corresponding to the failed step, and compares them with the semantic requirements of TTP and the inferred environment fields. For example, it checks whether the target process does not exist, whether the file path is invalid, whether the registry key is missing, whether the port is not open, whether the dependent components are not installed, or whether the permission level is insufficient. Based on the analysis results, the system automatically generates a specific modification suggestion, which may include completing missing files or directories, adjusting registry key values, modifying process startup conditions, adding necessary network ports, switching to a suitable operating system version, or elevating the required permission level. S35. The generated correction suggestions will serve as feedback, driving iterative correction and verification of the system environment information. Depending on the nature of the defect, the system can choose to return to step S2 to re-perform environmental reasoning with the corrected information; or return to step S31 to directly apply the correction suggestions and initiate a new round of simulation verification. This ensures that the final configuration can support the complete triggering of TTP behavior.

[0028] While embodiments of the present invention have been described in detail above, it will be apparent to those skilled in the art that various modifications and variations can be made to these embodiments. However, it should be understood that such modifications and variations fall within the scope and spirit of the invention as set forth in the claims. Furthermore, the invention described herein may have other embodiments and can be implemented or carried out in various ways.

Claims

1. A method for analyzing a TTPs scenario for a software-defined deception defense system, the method comprising: receiving a plurality of TTPs data; and analyzing the plurality of TTPs data to determine a TTPs scenario. The method comprises the following steps: constructing a network security knowledge graph based on threat intelligence sources; based on the network security knowledge graph, retrieving and extracting attack indicators and observation data according to an input attack technology identifier and a predefined semantic path, and generating structured retrieval data; based on a large language model, converting the retrieval data into natural language description text, and based on the natural language description text, performing interactive reasoning through a large language model to generate system environment information corresponding to the attack technology identifier; based on the system environment information, performing operations corresponding to the attack technology identifier in a simulation environment, verifying the adaptability of the system environment information, and modifying the system environment information according to the verification result.

2. The method of claim 1, wherein, When constructing a network security knowledge graph based on threat intelligence sources, the method comprises the following steps: collecting threat intelligence data from threat intelligence sources and preprocessing the threat intelligence data; extracting entities from the processed threat intelligence data through named entity recognition technology, extracting relationships between the entities through relationship extraction technology, and based on a pre-set unified data specification, modeling the nodes of the entities and modeling the relationships of the entities; based on the modeled entities and relationships, constructing the network security knowledge graph; wherein the entities include attackers, malware, tools, attack technologies, attack indicators and observation data; the relationships include attack technology, malware or tool usage relationship, attack indicator based on observation data based relationship, attack indicator indicating attack, malware or tool indicating relationship and malware or tool developed by the attacker.

3. The method of claim 2, wherein, When based on the network security knowledge graph, according to the input attack technology identifier and the predefined semantic path, retrieving and extracting attack indicators and observation data, and generating structured retrieval data, the method comprises the following steps: use the attack technology number in the MITRE ATT&CK framework as the attack technology identifier, and use the attack technology identifier as the query entrance to locate the corresponding attack technology node in the network security knowledge graph; based on the semantic association between entities in the network security knowledge graph, construct a semantic path starting from the attack technology node, passing through malware nodes or tool nodes, attack indicator nodes, and finally reaching observation data nodes; along the semantic path, traverse and extract associated malware or tool data, attack indicators and observation data; organize the attack technology identifier, the attack indicators and the observation data into structured retrieval data according to a pre-set format.

4. The method of claim 1, wherein, The threat intelligence sources include MITRE ATT&CK, open source malware library, advanced persistent threat analysis report and threat analysis platform log; the attack indicators include file hash value, IP address and domain name; the observation data includes file operation record, process operation record, registry operation record and network connection record.

5. The method of claim 1, wherein, When based on a large language model, the retrieval data is converted into natural language description text, and based on the natural language description text, interactive reasoning is performed through a large language model to generate system environment information corresponding to the attack technology identifier, the method comprises the following steps: Based on the large language model, the retrieval data is sequentially filled into a preset natural language template to generate the natural language description text; An initial prompt containing the attack technology identifier and the natural language description text is constructed and submitted to the large language model to obtain a preliminary answer; The preliminary answer is parsed, logical consistency verification is performed according to the parsing result and in combination with an external prior knowledge base to generate a follow-up prompt; and the large model is guided to perform at least one subsequent reasoning based on the follow-up prompt; Based on the preliminary answer and the result of at least one subsequent reasoning, system environment information corresponding to the attack technology identifier is generated.

6. The method of claim 5, wherein, Based on the large language model, when the retrieval data is sequentially filled into a preset natural language template, the following steps are included: The behavior category label in the retrieval data is semantically expanded and explained; And / or the timestamp in the retrieval data is converted into a standard date and time format; And / or missing or abnormal fields in the retrieval data are labeled.

7. The method of claim 1, wherein, The system environment information includes attack technology number, system version, process list, file path list, normal software and port list.

8. The method of claim 1, wherein, Based on the system environment information, the following steps are included when performing operations corresponding to the attack technology identifier in a simulation environment, verifying the adaptability of the system environment information, and modifying the system environment information according to the verification result: Based on the system environment information, the simulation environment is configured; in the simulation environment, an automated attack simulation framework is called to perform an operation sequence corresponding to the attack technology identifier; The system events of the simulation environment are monitored, execution trajectories are obtained, and the execution trajectories are compared with expected behaviors to determine whether the attack technology corresponding to the attack technology identifier is successfully triggered; If it is determined that the attack technology is not successfully triggered, the execution trajectory is analyzed to determine an environment configuration defect, a modification suggestion for the system environment information is generated based on the environment configuration defect, and subsequent simulation verification is iteratively optimized based on the modification suggestion.

Images