Network security dynamic protection method

Abstract

The invention discloses a network security dynamic protection method, and belongs to the technical field of network security dynamic protection. The method comprises the following steps: monitoring a network access request of a target system, identifying a suspicious behavior pattern of the network access request, and generating a dynamic interaction response; guiding an access subject initiating the network access request to a virtual protection environment through the dynamic interaction response; and in the virtual protection environment, collecting depth behavior data of the access subject, and updating a global protection strategy of the target system according to the depth behavior data. Meanwhile, the depth behavior data serve as a training sample to train a preset behavior prediction model, the trained behavior prediction model is utilized to predict potential attack behaviors, and matched virtual protection environment resources are pre-configured. According to the method, active trapping and deep analysis of attack behaviors are realized, the initiative and dynamic adaptability of system protection are improved, and the perspectiveness of resource scheduling is enhanced.

Description

Technical Field

[0001] This invention relates to the field of dynamic network security protection technology, and in particular to a dynamic network security protection method that can actively lure attackers and achieve self-evolution of strategies. Background Technology

[0002] Currently, security threats to network systems are becoming increasingly complex and covert. Traditional static defense methods, such as firewalls and intrusion detection systems, mainly rely on predefined rules and signature databases for protection. Existing advanced protection technologies have begun to adopt dynamic defense concepts. Typical technical solutions usually include: monitoring access request traffic in the network and performing real-time matching and identification based on known attack characteristics or behavioral rules; and executing pre-set response actions such as blocking or alerting for identified suspicious or malicious requests.

[0003] However, the protective effects achievable by such existing technical solutions have significant limitations. First, in the response phase, their methods are mostly passive blocking or simple isolation, failing to conduct in-depth investigations into the attacker's intentions, tools, and tactics, thus missing the opportunity to obtain high-quality threat intelligence, resulting in protection strategies consistently lagging behind attack methods. Second, their protection environments and strategies are often static or have long change cycles, lacking a closed-loop mechanism that can lure attackers into continuous activity and automatically collect their in-depth behavioral data in the process. Therefore, existing solutions fail to meet the higher requirements for dealing with advanced persistent threats and other emerging attacks in terms of the depth of behavioral data analysis, the degree of automation in updating protection strategies, and the ability to predict and prepare for potential future attacks. Summary of the Invention

[0004] The purpose of this application is to address the problems of passive protection methods, lagging policy updates, and lack of attack prediction capabilities in existing technologies. This application provides a dynamic network security protection method, which aims to achieve proactive trapping and in-depth analysis of attack behaviors, as well as self-evolution and proactive deployment of protection strategies.

[0005] In some embodiments of this application, a dynamic network security protection method is provided, including: Monitor network access requests of the target system, identify suspicious behavior patterns of the network access requests, and generate dynamic interactive responses; The dynamic interactive response guides the access subject that initiated the network access request to the virtual protection environment. In the virtual protection environment, deep behavioral data of the accessing subject is collected, and the global protection policy of the target system is updated based on the deep behavioral data.

[0006] In some embodiments of this application, the network access requests of the monitored target system include: The network access requests are collected in real time, and multiple dimensions of traffic characteristics are used to form a real-time behavior vector. The real-time behavior vector is input into the dynamic behavior baseline model and compared with the baseline behavior to obtain the deviation. The dynamic behavior baseline model is generated by machine learning on historical network data of the target system during periods without attack interference. When the deviation exceeds a preset threshold, the network access request is determined to contain a suspicious behavior pattern.

[0007] In some embodiments of this application, identifying suspicious behavioral patterns in the network access requests and generating dynamic interactive responses includes: Based on the deviation, extract the abnormal feature sequence of the network access request; The abnormal feature sequence is input into a multi-level behavior analysis engine, which decomposes and maps the abnormal feature sequence to identify suspicious behavior pattern types. The multi-level behavior analysis engine includes clustering algorithms and sequence matching models; A response strategy library is established based on historical network data, and the corresponding response template is retrieved from the response strategy library according to the type of suspicious behavior pattern. Generate dynamic interactive responses based on the response template; The response strategy library includes response templates for different suspicious behavior patterns. Each response template predefines interaction logic, content spoofing parameters, and redirection rules.

[0008] In some embodiments of this application, the abnormal feature sequence is input to a multi-level behavior analysis engine, which decomposes and maps the abnormal feature sequence to identify suspicious behavior pattern types, including: The abnormal feature sequence is decomposed into four dimensions: time-series features, protocol features, topology features, and payload features. The feature components of the four dimensions are respectively input into the clustering algorithm and sequence matching model in the multi-level behavior analysis engine; The clustering algorithm is used to perform unsupervised clustering analysis on the feature components to generate feature clusters, and each feature cluster is mapped to a preset suspicious behavior pattern type. Each predefined suspicious behavior pattern type corresponds to a preset behavior pattern sequence. The sequence matching model is used to perform similarity matching between the feature components and the preset behavior pattern sequences corresponding to the mapped preset suspicious behavior pattern types to obtain the matching degree; When the matching degree exceeds the preset matching degree threshold, the abnormal feature sequence is mapped to the corresponding suspicious behavior pattern type; Based on the mapping results of the clustering algorithm and the sequence matching model, the suspicious behavior pattern type corresponding to the network access request is output.

[0009] In some embodiments of this application, dynamic interactive responses include: The dynamic interactive response includes fake response content simulating the normal service of the target system, an injected delayed feedback strategy, and embedded transparent redirection code. Based on the dynamic interactive response and the transparent redirection code, the access subject is guided to the virtual protection environment.

[0010] In some embodiments of this application, within the virtual protection environment, deep behavioral data of the accessing subject is collected, and the global protection policy of the target system is updated based on the deep behavioral data, including: In the virtual protection environment, the service interface and behavioral logic of the target system are simulated to continuously interact with the access subject. Based on the interaction logic and content masquerading parameters defined in the response template, false response content is provided, and a delayed feedback strategy is selectively injected to collect in-depth behavioral data of the access subject. The deep behavioral data includes the interaction sequence, attack payload attempts, and intent characteristics of the accessing subject in the virtual protection environment; Based on the deep behavioral data, behavioral pattern mining and attack chain analysis are performed to identify new types of attack behaviors. The novel attack behaviors include new attack methods and variations of known attacks; Based on the novel attack behavior, update the global protection strategy of the target system.

[0011] Some embodiments of this application also include: The suspicious behavior patterns identified by the multi-level behavior analysis engine are further classified. Based on the influence parameters of the feature cluster, the priority of each suspicious behavior pattern type is calculated. The influence parameters include security risk level, probability of successful attack, and potential loss. The feature clusters are generated by performing unsupervised clustering analysis on the feature components using the clustering algorithm, and each feature cluster corresponds to multiple attack methods. Adjust the allocation order of response strategies based on the calculated priorities.

[0012] In some embodiments of this application, the priority of each suspicious behavior pattern type is calculated using the following formula to calculate the priority score:

[0013] Where: P represents priority score, F represents attack frequency, S represents attack success rate, I represents potential impact level, W1 represents the weight coefficient of attack frequency, W2 represents the weight coefficient of attack success rate, W3 represents the weight coefficient of potential impact level, and W1+W2+W3=1. Based on the calculated priority score P, the types of suspicious behavior patterns are sorted.

[0014] In some embodiments of this application, the method further includes: Using deep behavioral data as training samples, a pre-defined behavior prediction model is trained to obtain the trained behavior prediction model. Using the trained behavior prediction model, potential attack behaviors are predicted, and virtual protection environment resources that match the predicted potential attack behaviors are pre-configured.

[0015] In some embodiments of this application, the method further includes: The deep behavioral data is preprocessed to extract multi-dimensional behavioral features and form a training sample set. The multi-dimensional behavioral features are generated based on the temporal features, protocol features, topology features, and payload features of deep behavioral data. A behavior prediction model is constructed based on historical network data. The training sample set is input into the behavior prediction model, and the model is trained by machine learning algorithm. During the training process, the model parameters are dynamically adjusted according to the distribution characteristics of the training sample set. The trained behavior prediction model is obtained; Based on the trained behavior prediction model, the predicted potential behavior is obtained, and based on the predicted potential behavior, the predicted behavior characteristics and predicted resource requirements are identified. Based on the predicted behavioral characteristics and predicted resource requirements, computing resources, storage resources, and network resources are allocated from the resource pool; Configure the allocated resources to simulate the service interfaces and behavioral logic of the target system, forming a virtual protection environment that matches the predicted potential attack behavior; The scale of resource allocation is adaptively adjusted based on the confidence level of the prediction results.

[0016] Compared with existing technologies, the network security dynamic protection method of this application has the following advantages: By constructing a virtual protection environment and dynamically guiding suspicious access, we have achieved proactive trapping and in-depth behavioral analysis of attackers, thereby transforming passive defense into proactive awareness. This effectively obtains deep threat intelligence that traditional blocking strategies cannot provide, and solves the problem that static protection strategies lag behind attack evolution.

[0017] By training a behavior prediction model based on deep behavioral data and pre-configuring protection resources, the self-evolution of protection strategies and the forward-looking deployment of defense measures have been achieved. This has significantly enhanced the ability to predict and intervene in potential attack paths, improved the intelligence level and resource utilization efficiency of the overall protection system, and effectively responded to advanced persistent threats. Attached Figure Description

[0018] Figure 1 This is a flowchart illustrating a preferred embodiment of a network security dynamic protection method according to this application. Detailed Implementation

[0019] The specific embodiments of this application will be described in further detail below with reference to the accompanying drawings and examples. The following examples are used to illustrate this application, but are not intended to limit the scope of this application.

[0020] In the description of this application, it should be understood that the terms "center", "upper", "lower", "front", "rear", "left", "right", "vertical", "horizontal", "top", "bottom", "inner", "outer", etc., indicate the orientation or positional relationship based on the orientation or positional relationship shown in the accompanying drawings. They are only for the convenience of describing this application and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, or be constructed and operated in a specific orientation. Therefore, they should not be construed as limitations on this application.

[0021] The terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Therefore, a feature defined as "first" or "second" may explicitly or implicitly include one or more of that feature. In the description of this application, unless otherwise stated, "a plurality of" means two or more.

[0022] In the description of this application, it should be noted that, unless otherwise expressly specified and limited, the terms "installation," "connection," and "linking" should be interpreted broadly. For example, they can refer to a fixed connection, a detachable connection, or an integral connection; they can refer to a mechanical connection or an electrical connection; they can refer to a direct connection or an indirect connection through an intermediate medium; and they can refer to the internal connection between two components. Those skilled in the art can understand the specific meaning of the above terms in this application based on the specific circumstances.

[0023] like Figure 1 As shown in the preferred embodiment of this application, a dynamic network security protection method includes: Monitor network access requests of the target system, identify suspicious behavior patterns of the network access requests, and generate dynamic interactive responses; The dynamic interactive response guides the access subject that initiated the network access request to the virtual protection environment. In the virtual protection environment, deep behavioral data of the accessing subject is collected, and the global protection policy of the target system is updated based on the deep behavioral data.

[0024] In some embodiments of this application, the network access requests of the monitored target system include: The network access requests are collected in real time, and multiple dimensions of traffic characteristics are used to form a real-time behavior vector. The real-time behavior vector is input into the dynamic behavior baseline model and compared with the baseline behavior to obtain the deviation. The dynamic behavior baseline model is generated by machine learning on historical network data of the target system during periods without attack interference. When the deviation exceeds a preset threshold, the network access request is determined to contain a suspicious behavior pattern.

[0025] In this embodiment, the preset threshold is a dynamic quantile determined based on the statistical distribution characteristics of the deviation data of all network access requests in the historical network data, and can be adjusted according to the drift of the dynamic behavior baseline model.

[0026] In this embodiment, the traffic characteristics include: request timing distribution, protocol state transition sequence, API access logic topology, and load entropy value characteristics.

[0027] In this embodiment, the dynamic behavior baseline model is obtained by machine learning training on historical network data of the target system during periods free from attack interference. The baseline behavior represented by this model refers to a quantitative benchmark of the system's network access behavior under normal conditions. Its specific manifestations include, but are not limited to: normal traffic feature vectors: a normal value range or distribution cluster of vectors composed of multiple dimensions of traffic features extracted from historical network data (such as requests per second, session duration, packet size, protocol type distribution, etc.); normal behavior sequence patterns: a probabilistic model or state transition diagram of operation sequences with temporal relationships generated during legitimate user access (such as "login → access homepage → query data → logout"); and normal interaction logic rules: compliant request-response patterns defined based on network protocol specifications and application logic. Comparing the real-time behavior vector with the baseline behavior essentially involves inputting the real-time behavior vector into the dynamic behavior baseline model to calculate its deviation or anomaly score from the aforementioned normal behavior benchmark.

[0028] In this embodiment, the dynamic percentile includes: the system continuously collects and sorts the deviation values ​​of all network access requests within a historical time window to form a statistical distribution; based on a preset alarm ratio strategy, such as capturing only the 0.5% of requests with the highest deviation (this 0.5% is the preset percentile), the system automatically calculates the corresponding dynamic percentile value, such as the 99.5th percentile, and sets the specific deviation value corresponding to the 99.5th percentile, assuming this value is 85, as the current adaptive threshold; this process continuously loops, allowing the threshold to be dynamically adjusted according to the fluctuations in the overall distribution of network behavior. When the deviation generally increases, the threshold automatically moves up to prevent false alarms; when it generally decreases, the threshold moves down to improve detection sensitivity, thereby achieving stable control of the alarm volume and automatic adaptation to the drift of the normal behavior baseline.

[0029] In some embodiments of this application, identifying suspicious behavioral patterns in the network access requests and generating dynamic interactive responses includes: Based on the deviation, extract the abnormal feature sequence of the network access request; The abnormal feature sequence is input into a multi-level behavior analysis engine, which decomposes and maps the abnormal feature sequence to identify suspicious behavior pattern types. The multi-level behavior analysis engine includes clustering algorithms and sequence matching models; A response strategy library is established based on historical network data, and the corresponding response template is retrieved from the response strategy library according to the type of suspicious behavior pattern. Generate dynamic interactive responses based on the response template; The response strategy library includes response templates for different suspicious behavior patterns. Each response template predefines interaction logic, content spoofing parameters, and redirection rules.

[0030] In this embodiment, suspicious behavior patterns include scanning and probing, brute-force attacks, protocol abuse, or data leakage.

[0031] In this embodiment, the multi-level behavior analysis engine is the core analysis component in the dynamic network security protection method. Its main function is to perform in-depth analysis and classification of abnormal feature sequences to identify specific suspicious behavior patterns. Through multi-level analysis techniques, the engine ensures accurate identification of abnormal behavior in network access requests, thereby providing a basis for generating dynamic interactive responses. Specifically, its functions include: by analyzing abnormal feature sequences, the engine can distinguish different types of attack behaviors; for example, scanning and probing typically involves numerous port or service probes, brute-force attacks manifest as multiple authentication attempts, protocol abuse may violate protocol specifications, and data leakage involves unauthorized data transmission; the engine processes abnormal feature sequences in real time during runtime, quickly outputting suspicious behavior types so that the system can generate timely responses; and the engine can continuously optimize the analysis model by combining historical data and the current network environment risk level to improve detection accuracy.

[0032] In this embodiment, the response template predefines interaction logic, content masquerading parameters, and redirection rules. The interaction logic defines the dialogue flow and decision rules between the system and the suspicious access subject, simulating the complex behavior of a real service to make attackers believe they are interacting with a real, stateful system, thereby exposing more of their intentions and methods. Content masquerading parameters are the specific data and configurations used to generate deceptive response content, enhancing the realism of the deception and preventing it from being easily detected by attackers due to its crudeness, thus extending the interaction time and collecting more data. Redirection rules define the mechanism for seamlessly and covertly transferring the access subject from an initial, monitored point of contact to a deeper virtual protection environment, achieving secure isolation, diverting attack traffic from real assets, and guiding it to a customized environment where its behavioral data can be securely observed, analyzed, and collected.

[0033] In some embodiments of this application, the abnormal feature sequence is input to a multi-level behavior analysis engine, which decomposes and maps the abnormal feature sequence to identify suspicious behavior pattern types, including: The abnormal feature sequence is decomposed into four dimensions: time-series features, protocol features, topology features, and payload features. The feature components of the four dimensions are respectively input into the clustering algorithm and sequence matching model in the multi-level behavior analysis engine; The clustering algorithm is used to perform unsupervised clustering analysis on the feature components to generate feature clusters, and each feature cluster is mapped to a preset suspicious behavior pattern type. Each predefined suspicious behavior pattern type corresponds to a preset behavior pattern sequence. The sequence matching model is used to perform similarity matching between the feature components and the preset behavior pattern sequences corresponding to the mapped preset suspicious behavior pattern types to obtain the matching degree; When the matching degree exceeds the preset matching degree threshold, the abnormal feature sequence is mapped to the corresponding suspicious behavior pattern type; Based on the mapping results of the clustering algorithm and the sequence matching model, the suspicious behavior pattern type corresponding to the network access request is output.

[0034] In this embodiment, the multi-level behavior analysis engine integrates two main machine learning models: clustering algorithms and sequence matching models. These models work together to analyze anomalous feature sequences from different perspectives: clustering aims to group network access requests with similar anomalous features together, thereby discovering potential attack patterns. Sequence matching models are used to analyze sequence data, identifying behavior by comparing the similarity of input sequences with predefined pattern sequences. Sequence matching models can capture temporal dependencies in these sequences, improving identification accuracy.

[0035] In this embodiment, the abnormal feature sequence is extracted from the deviation between the real-time behavior vector of the network access request and the dynamic behavior baseline model, and it contains abnormal features in multiple dimensions.

[0036] In this embodiment, the multi-dimensional feature decomposition of the abnormal feature sequence includes the engine breaking down the abnormal feature sequence into finer-grained feature components or sub-sequences for easier analysis. In this embodiment, each feature cluster is mapped to a preset suspicious behavior pattern type. This process relies on a clustering algorithm and a sequence matching model. The clustering algorithm groups the decomposed features, with each cluster corresponding to a typical behavior pattern. The sequence matching model calculates the similarity between the decomposed sequence and the predefined behavior pattern sequence. If the matching degree exceeds a threshold, it is mapped to the corresponding behavior type. Finally, the engine combines the results of clustering and sequence matching to output one or more suspicious behavior pattern types for subsequent response template retrieval.

[0037] In some embodiments of this application, dynamic interactive responses include: The dynamic interactive response includes fake response content simulating the normal service of the target system, an injected delayed feedback strategy, and embedded transparent redirection code. Based on the dynamic interactive response and the transparent redirection code, the access subject is guided to the virtual protection environment.

[0038] In this embodiment, the delayed feedback strategy refers to introducing random or gradually increasing response delays. For example, waiting 5 to 10 seconds before responding to each request. For attacks that rely on high-speed requests, delayed feedback can reduce their efficiency by tens or even hundreds of times, drastically reducing the number of attempts they can make per unit of time; moreover, long waits will wear down the attacker's patience, potentially leading them to believe that the network conditions are poor or the target system is underperforming, thus causing them to abandon the attack or turn to other targets; at the same time, maintaining a connection for a long time will consume the attacker's network and system resources.

[0039] In this embodiment, embedding transparent redirect code refers to embedding code in the returned response packet that is not easily detected by the accessing entity, causing its browser or client to automatically redirect to a preset virtual protection environment. Once an attacker enters the virtual protection environment, the system can record their every move under absolute security, including the tools they use, the attack payloads they attempt, and the data they intend to steal. Ultimately, this ensures that the real core business system and data are not subject to any substantial damage.

[0040] In this embodiment, a virtual protection environment refers to forging a response that is almost identical to that of the real system. By providing a virtual protection environment, attackers are encouraged to proceed to the next step, thereby exposing more of their attack methods and intentions.

[0041] In some embodiments of this application, within the virtual protection environment, deep behavioral data of the accessing subject is collected, and the global protection policy of the target system is updated based on the deep behavioral data, including: In the virtual protection environment, the service interface and behavioral logic of the target system are simulated to continuously interact with the access subject. Based on the interaction logic and content masquerading parameters defined in the response template, false response content is provided, and a delayed feedback strategy is selectively injected to collect in-depth behavioral data of the access subject. The deep behavioral data includes the interaction sequence, attack payload attempts, and intent characteristics of the accessing subject in the virtual protection environment; Based on the deep behavioral data, behavioral pattern mining and attack chain analysis are performed to identify new types of attack behaviors. The novel attack behaviors include new attack methods and variations of known attacks; Based on the novel attack behavior, update the global protection strategy of the target system.

[0042] In this embodiment, the virtual protection environment is an isolated simulation system configured to simulate the normal service interface of the target system. It has a deep behavioral data collection function to securely monitor and record the interactive behavior of the accessing subject. The virtual protection environment also continuously interacts with the accessing subject according to the challenge mechanism or delayed feedback strategy injected in the dynamic interactive response, so as to extend its stay time and enhance the data collection effect.

[0043] In this embodiment, after receiving a response containing redirection code, the client of the accessing entity automatically initiates a new network request to the virtual protection environment. This is the actual action of physically transferring the potential threat from the real system to the virtual environment. It completes the path switching of the attack traffic; at the same time, a well-designed redirection operation will carry as much session information as possible from the original request, making the attacker believe that they are still in the same session, thus enhancing the continuity of the deception.

[0044] In this embodiment, seamless booting to the virtual environment is not a single technology, but rather the ultimate effect and user experience achieved through transparent redirection code and operations. The emphasis is on making the entire booting process smooth, natural, and imperceptible.

[0045] In this embodiment, deep behavioral data refers to more detailed and contextualized behavioral information collected in a virtual protection environment, through continuous interaction with the accessing subject while simulating real services, that goes beyond basic traffic characteristics. Specifically, it includes: the complete steps and sequence of an attacker's actions in the virtual environment, such as first accessing page A, then attempting interface B, and finally submitting data C; the specific content of malicious code, SQL injection statements, system commands, and uploaded malicious files actually entered or uploaded by the attacker; and the attack targets and methods inferred by analyzing their behavioral sequences and payloads, such as whether they are searching for a database, attempting to obtain a user list, or trying to seize system control.

[0046] In this embodiment, behavioral pattern mining and attack chain analysis is a data analysis process that deeply processes the collected deep behavioral data: using data mining and machine learning techniques, recurring and regular behavioral combinations are discovered from a large amount of deep behavioral data. This transforms the raw, chaotic "deep behavioral data" into valuable and understandable security threat intelligence. Only through this analysis can we accurately determine the type of threat we are currently facing and what new characteristics its methods possess.

[0047] In this embodiment, "novel attack methods" or "variations of known attacks" are specific conclusions drawn from behavioral pattern mining and attack chain analysis. Novel attack methods refer to entirely new attack methods or vulnerability exploitation techniques that have never been recorded before by the security community or this system. Variations of known attacks refer to modifications or evolutions of existing attack methods, designed to bypass protection systems based on known characteristics.

[0048] In this embodiment, the update of the global protection strategy is specifically reflected in three aspects: 1. Updating the dynamic behavior baseline model: enabling the model to learn new normal and abnormal behavior patterns, improving the accuracy of identifying similar new attacks in the future. 2. Updating the response strategy library: creating new or optimizing old response templates based on newly discovered attack methods, so that the trapping and interaction effects are better when encountering similar attacks again. 3. Updating the adaptive threshold: adjusting the detection sensitivity according to the overall risk level, finding a new balance between false positives and false negatives (for example, the emergence of new attacks may mean an increased risk level).

[0049] In some embodiments of this application, the method further includes: The suspicious behavior patterns identified by the multi-level behavior analysis engine are further classified. Based on the influence parameters of the feature cluster, the priority of each suspicious behavior pattern type is calculated. The influence parameters include security risk level, probability of successful attack, and potential loss. The feature clusters are generated by performing unsupervised clustering analysis on the feature components using the clustering algorithm, and each feature cluster corresponds to multiple attack methods. Adjust the allocation order of response strategies based on the calculated priorities.

[0050] In some embodiments of this application, the priority of each suspicious behavior pattern type is calculated using the following formula to calculate the priority score:

[0051] Where: P represents priority score, F represents attack frequency, S represents attack success rate, I represents potential impact level, W1 represents the weight coefficient of attack frequency, W2 represents the weight coefficient of attack success rate, W3 represents the weight coefficient of potential impact level, and W1+W2+W3=1. Based on the calculated priority score P, the types of suspicious behavior patterns are sorted.

[0052] In this embodiment, the occurrence frequency of a specific suspicious behavior pattern type within a unit of time is statistically analyzed and quantified by combining it with attack activity indicators in historical network data. The analysis is based on the proportion of similar suspicious behavior patterns in historical network data that ultimately lead to security vulnerabilities, or by estimating the number of successful attack attempts in the deep behavioral data recorded in the virtual protection environment. The assessment evaluates the potential damage to the data confidentiality, integrity, and availability of the target system if the suspicious behavior pattern type is successfully attacked, and quantifies this by combining it with the importance level of the affected services. The initial values ​​of the weighting coefficients W1, W2, and W3 are pre-set based on the overall distribution and severity of various attacks in historical network data and can be adjusted according to the latest evolutionary direction reflected in the deep behavioral data. In this embodiment, the training sample set is a structured data collection formed by cleaning, organizing, and feature extraction of a large amount of deep behavioral data collected in a virtual protection environment. Deep behavioral data includes interaction behavior sequences, attack payload attempts, and intent features. Therefore, the training sample set consists of features extracted from this data that can be understood by the model. Specifically, these include: temporal features; protocol compliance features; behavioral sequence features; payload content features; and topological interaction features.

[0053] In this embodiment, building a behavior prediction model based on historical network data is a model building process that combines historical experience with the latest threat intelligence. Its core lies in enabling the model to learn from the known before predicting the unknown. First, a suitable machine learning model architecture needs to be selected. Given the strong time-series characteristics of behavioral data, recurrent neural networks such as LSTM (Long Short-Term Memory) and GRU (Gated Recurrent Unit) are often chosen. These models excel at learning patterns from sequential data. Normal network traffic data collected during periods without attack interference, as well as historical data from earlier periods confirming attacks, are used. The selected model is initially trained using historical data. The goal is for the model to learn to distinguish between normal behavior and the basic patterns of various known attack behaviors. This pre-trained model is continuously retrained using the latest collected training sample set. The latest attack techniques captured in the virtual protection environment immediately become new learning materials for the model, enabling it to quickly learn and adapt to the evolution of attack techniques.

[0054] In some embodiments of this application, the method further includes: Using deep behavioral data as training samples, a pre-defined behavior prediction model is trained to obtain the trained behavior prediction model. Using the trained behavior prediction model, potential attack behaviors are predicted, and virtual protection environment resources that match the predicted potential attack behaviors are pre-configured.

[0055] In some embodiments of this application, the method further includes: The deep behavioral data is preprocessed to extract multi-dimensional behavioral features and form a training sample set. The multi-dimensional behavioral features are generated based on the temporal features, protocol features, topology features, and payload features of deep behavioral data. A behavior prediction model is constructed based on historical network data. The training sample set is input into the behavior prediction model, and the model is trained by machine learning algorithm. During the training process, the model parameters are dynamically adjusted according to the distribution characteristics of the training sample set. The trained behavior prediction model is obtained; Based on the trained behavior prediction model, the predicted potential behavior is obtained, and based on the predicted potential behavior, the predicted behavior characteristics and predicted resource requirements are identified. Based on the predicted behavioral characteristics and predicted resource requirements, computing resources, storage resources, and network resources are allocated from the resource pool; Configure the allocated resources to simulate the service interfaces and behavioral logic of the target system, forming a virtual protection environment that matches the predicted potential attack behavior; The scale of resource allocation is adaptively adjusted based on the confidence level of the prediction results.

[0056] In this embodiment, behavioral features refer to multi-dimensional features extracted from deep behavioral data that describe the behavioral patterns of the accessing entity. These features include, but are not limited to: temporal features; protocol features; topology features; and payload features. These features are obtained through preprocessing and feature engineering of deep behavioral data and are used to quantify the patterns, intentions, and methods of attack behavior. As input to the behavioral prediction model, they help the model identify the evolutionary patterns of attack behavior. These features make predictions more accurate, thereby enabling early threat identification.

[0057] In this embodiment, resource requirements refer to the types and quantities of resources needed to build and run the virtual protection environment, based on predictions of potential future attacks. If a predicted attack involves large amounts of data uploads, more storage resources are needed. If a predicted attack requires high-frequency interactions, more computing and network resources are needed.

[0058] In this embodiment, the resource pool is a centrally managed and dynamically allocated collection of resources, including computing resources, storage resources, and network resources. When a future attack is predicted, the system can quickly allocate resources from the resource pool to configure a virtual protection environment without manual intervention, thus improving response speed. The resource pool can automatically expand or shrink based on the threat level and prediction confidence level to ensure efficient resource utilization. More resources can be allocated during peak attack periods and released during calmer periods.

[0059] In this embodiment, the virtual protection environment resources specifically include: computing resources: referring to processing and computing power, used to run simulation services, execute challenge mechanisms, and handle interaction logic; storage resources: referring to data storage capacity, used to store deep behavioral data, attack payloads, log files, and virtual environment state information; and network resources: referring to network connectivity and bandwidth resources, used to handle network traffic, implement redirection, and simulate network service interfaces. These resources collectively construct an isolated and controllable virtual protection environment capable of realistically simulating the behavior of the target system, interacting with the accessing entity, thereby collecting deep behavioral data and consuming the attacker's time and resources.

[0060] In this embodiment, the confidence level represents the model's certainty about the prediction and is used to adjust the allocation of resources in the virtual protection environment. A high confidence level indicates a reliable prediction, and the system will allocate more resources to enhance the protection effect. A low confidence level indicates high prediction uncertainty, and the system will allocate fewer resources to avoid waste. Furthermore, the confidence level is correlated with the network environment risk level; when the overall risk increases, the confidence level threshold may be adjusted to improve detection sensitivity. This allows the system to dynamically balance false positives and false negatives.

[0061] In this embodiment, the scale of resource allocation is adaptively adjusted based on the confidence level of the prediction results to balance protection effectiveness and resource consumption. By fully configuring resources, the virtual environment can more realistically simulate the target system, extend the attacker's interaction time, and collect more in-depth behavioral data, thereby improving the level of security protection. However, over-allocation of resources may lead to increased costs, decreased system performance, or disruption of normal services. The system dynamically adjusts the scale of resource allocation based on the prediction confidence level. At high confidence levels, priority is given to protection effectiveness, and more resources are allocated. At low confidence levels, priority is given to resource conservation, and fewer resources are allocated. This balance ensures the economy and sustainability of network security protection, avoiding over-protection or under-protection.

[0062] The above description is only a preferred embodiment of this application. It should be noted that for those skilled in the art, several improvements and substitutions can be made without departing from the technical principles of this application, and these improvements and substitutions should also be considered within the scope of protection of this application.

Claims

1. A dynamic network security protection method, comprising the following steps: Monitor network access requests of the target system, identify suspicious behavior patterns of the network access requests, and generate dynamic interactive responses; The dynamic interactive response guides the access subject that initiated the network access request to the virtual protection environment. In the virtual protection environment, deep behavioral data of the accessing subject is collected, and the global protection policy of the target system is updated based on the deep behavioral data.

2. The network security dynamic protection method according to claim 1, characterized in that, The network access requests of the monitored target system include: The network access requests are collected in real time, and multiple dimensions of traffic characteristics are used to form a real-time behavior vector. The real-time behavior vector is input into the dynamic behavior baseline model and compared with the baseline behavior to obtain the deviation. The dynamic behavior baseline model is generated by machine learning on historical network data of the target system during periods without attack interference. When the deviation exceeds a preset threshold, the network access request is determined to contain a suspicious behavior pattern.

3. The network security dynamic protection method according to claim 2, characterized in that, Identify suspicious behavioral patterns in the network access requests and generate dynamic interactive responses, including: Based on the deviation, extract the abnormal feature sequence of the network access request; The abnormal feature sequence is input into a multi-level behavior analysis engine, which decomposes and maps the abnormal feature sequence to identify suspicious behavior pattern types. The multi-level behavior analysis engine includes clustering algorithms and sequence matching models; A response strategy library is established based on historical network data, and the corresponding response template is retrieved from the response strategy library according to the type of suspicious behavior pattern. Generate dynamic interactive responses based on the response template; The response strategy library includes response templates for different suspicious behavior patterns. Each response template predefines interaction logic, content spoofing parameters, and redirection rules.

4. The network security dynamic protection method according to claim 3, characterized in that, The abnormal feature sequence is input into a multi-level behavior analysis engine, which decomposes and maps the abnormal feature sequence to identify suspicious behavior pattern types, including: The abnormal feature sequence is decomposed into four dimensions: time-series features, protocol features, topology features, and payload features. The feature components of the four dimensions are respectively input into the clustering algorithm and sequence matching model in the multi-level behavior analysis engine; The clustering algorithm is used to perform unsupervised clustering analysis on the feature components to generate feature clusters, and each feature cluster is mapped to a preset suspicious behavior pattern type. Each predefined suspicious behavior pattern type corresponds to a preset behavior pattern sequence. The sequence matching model is used to perform similarity matching between the feature components and the preset behavior pattern sequences corresponding to the mapped preset suspicious behavior pattern types to obtain the matching degree; When the matching degree exceeds the preset matching degree threshold, the abnormal feature sequence is mapped to the corresponding suspicious behavior pattern type; Based on the mapping results of the clustering algorithm and the sequence matching model, the suspicious behavior pattern type corresponding to the network access request is output.

5. The network security dynamic protection method according to claim 4, characterized in that, Dynamic interactive responses, including: The dynamic interactive response includes fake response content simulating the normal service of the target system, an injected delayed feedback strategy, and embedded transparent redirection code. Based on the dynamic interactive response and the transparent redirection code, the access subject is guided to the virtual protection environment.

6. The network security dynamic protection method according to claim 5, characterized in that, In the virtual protection environment, deep behavioral data of the accessing entity is collected, and the global protection policy of the target system is updated based on the deep behavioral data, including: In the virtual protection environment, the service interface and behavioral logic of the target system are simulated to continuously interact with the access subject. Based on the interaction logic and content masquerading parameters defined in the response template, false response content is provided, and a delayed feedback strategy is selectively injected to collect in-depth behavioral data of the access subject. The deep behavioral data includes the interaction sequence, attack payload attempts, and intent characteristics of the accessing subject in the virtual protection environment; Based on the deep behavioral data, behavioral pattern mining and attack chain analysis are performed to identify new types of attack behaviors. The novel attack behaviors include new attack methods and variations of known attacks; Based on the novel attack behavior, update the global protection strategy of the target system.

7. The network security dynamic protection method according to claim 6, characterized in that, Also includes: The suspicious behavior patterns identified by the multi-level behavior analysis engine are further classified. Based on the influence parameters of the feature cluster, the priority of each suspicious behavior pattern type is calculated. The influence parameters include security risk level, probability of successful attack, and potential loss. The feature clusters are generated by performing unsupervised clustering analysis on the feature components using the clustering algorithm, and each feature cluster corresponds to multiple attack methods. Adjust the allocation order of response strategies based on the calculated priorities.

8. The network security dynamic protection method according to claim 7, characterized in that, The priority of each suspicious behavior pattern type is calculated using the following formula to determine the priority score: Where: P represents priority score, F represents attack frequency, S represents attack success rate, I represents potential impact level, W1 represents the weight coefficient of attack frequency, W2 represents the weight coefficient of attack success rate, W3 represents the weight coefficient of potential impact level, and W1+W2+W3=1. Based on the calculated priority score P, the types of suspicious behavior patterns are sorted.

9. The network security dynamic protection method according to claim 8, characterized in that, Also includes: Using deep behavioral data as training samples, a pre-defined behavior prediction model is trained to obtain the trained behavior prediction model. Using the trained behavior prediction model, potential attack behaviors are predicted, and virtual protection environment resources that match the predicted potential attack behaviors are pre-configured.

10. The network security dynamic protection method according to claim 9, characterized in that, Also includes: The deep behavioral data is preprocessed to extract multi-dimensional behavioral features and form a training sample set. The multi-dimensional behavioral features are generated based on the temporal features, protocol features, topology features, and payload features of deep behavioral data. A behavior prediction model is constructed based on historical network data. The training sample set is input into the behavior prediction model, and the model is trained by machine learning algorithm. During the training process, the model parameters are dynamically adjusted according to the distribution characteristics of the training sample set. The trained behavior prediction model is obtained; Based on the trained behavior prediction model, the predicted potential behavior is obtained, and based on the predicted potential behavior, the predicted behavior characteristics and predicted resource requirements are identified. Based on the predicted behavioral characteristics and predicted resource requirements, computing resources, storage resources, and network resources are allocated from the resource pool; Configure the allocated resources to simulate the service interfaces and behavioral logic of the target system, forming a virtual protection environment that matches the predicted potential attack behavior; The scale of resource allocation is adaptively adjusted based on the confidence level of the prediction results.

Images