An asset emulation system for threat awareness

Abstract

The application provides an asset simulation system for threat awareness, comprising a simulation module, a decision module, a semantic mapping library, a response agent, a resource storage module and a session library, when an access request of an attacker is received, the decision module first matches the resource type corresponding to the request through the semantic mapping library, if it is static resource access, the decision module directly calls the static simulation resource in the resource storage module and returns the response, if it is dynamic resource access, the decision module triggers the response agent, so that the response agent is started and dynamically interacts with the attacker, records the interaction log, and synchronously updates the session context to the session library. The application realizes high-fidelity replication of static and dynamic resources of the protected assets relying on a vertical large model, and through hierarchical design, can quickly respond to static resource access and deeply interact with dynamic resource access.

Description

Technical Field

[0001] This invention relates to the field of threat perception, and in particular to an asset simulation system for threat perception, which is suitable for core asset protection scenarios in dynamic network environments such as cloud computing and containerization. Background Technology

[0002] Threat awareness services play a crucial role in the security field, enabling real-time monitoring and redirection of threat traffic, providing upfront support for threat capture and behavioral analysis. Currently, threat awareness services focus on "real-time detection + traffic redirection," capturing abnormal network access and attack probing behaviors through various deployment methods. They then forward threat traffic in a targeted manner, forming a "perception-entrapment-analysis" defense loop. This "proactive decoy" approach overcomes the limitations of passive defense, protecting core assets and acquiring critical attack intelligence, making it a key component in emergency response scenarios and defense-in-depth systems.

[0003] Existing threat perception technologies mainly focus on two core areas: traditional deception defense systems and AI-enabled threat perception.

[0004] In the field of traditional deception defense, the core technology currently integrates multi-layered decoys such as honeypots, honeynets, and honeynets to build a comprehensive traffic monitoring and threat redirection system. Honeypots act as front-end probes, identifying abnormal traffic and redirecting it to back-end high-interaction honeypots or honeynets. The back-end system simulates a real operating system and business environment, capturing various attacker behaviors such as probing, vulnerability exploitation, and lateral movement. For example, in a "honeypot + honeyhole" solution, the honeypot can simulate domain controller system privileges and mail server administrator privileges, while the honeyhole uses unknown vulnerabilities as bait to guide attackers deeper, enabling attack behavior collection and tracing for countermeasures.

[0005] In the field of AI-enabled threat perception simulation, existing technologies leverage AI's contextual understanding and generalized reasoning capabilities to optimize the accuracy and efficiency of threat identification in scenarios such as network traffic detection and phishing email identification. While some technologies combine AI with threat perception to optimize decoy configuration and attack behavior identification through machine learning models—for example, models trained based on historical attack data can dynamically adjust honeypot simulation parameters to improve adaptability to specific attack types—deep simulation and real-time interactive optimization of core assets have not yet been achieved.

[0006] The core shortcomings of existing threat awareness technologies are the lack of high-fidelity simulation capabilities, static simulation models, insufficient interactive depth, and a lack of real-time adaptive capabilities. These shortcomings make threat awareness prone to failure, making it difficult to effectively capture attacker tool characteristics, operational processes, and attack intentions, and hindering the accurate construction of attacker profiles. This problem is particularly evident when facing advanced APT groups or experienced attackers, who can easily identify threat awareness service traps through simple command detection or deep interactive verification, thereby interrupting attacks and rendering the awareness service ineffective.

[0007] The aforementioned shortcomings stem from a variety of factors.

[0008] Firstly, simulation model design suffers from static limitations. Early threat awareness services and related simulation systems relied heavily on fixed templates and predefined rules, such as simulating only a simple webpage. The simulation scenarios were limited and lacked the ability to adapt to the dynamic characteristics of real assets. Even with AI-powered threat awareness simulation solutions, model training was often based on historical attack data, resulting in insufficient generalization ability to new attack scenarios or asset characteristics, leading to discrepancies between simulation results and real-world conditions.

[0009] Secondly, there is insufficient depth of interaction and scenario coverage. Early threat awareness services used shallow interactions to control resource consumption, simulating only basic ports or service responses. This could not support deep operations by attackers, nor effectively simulate the complex scenarios and interaction logic of real assets. It was difficult to continuously confuse attackers, resulting in the inability to deeply capture key information such as attacker tools and techniques. While high-interaction solutions are more realistic, they have high maintenance costs, complex configurations, and extremely high system requirements. They are difficult to customize for core assets in different industries and cannot accurately replicate key business characteristics.

[0010] Furthermore, there is a lack of real-time adaptive optimization capabilities. Existing technologies cannot dynamically adjust simulation strategies based on attacker behavior, and there is insufficient linkage with threat intelligence. They fail to optimize decoy configurations using real-time threat data. At the same time, large models are not deeply integrated into simulation model construction and dynamic adjustment, making it impossible to continuously improve simulation accuracy through intelligent reasoning.

[0011] Finally, there are resource and cost constraints. High-precision simulations consume significant computing and storage resources and require highly skilled operations and maintenance teams. Existing solutions, in order to balance deployment costs and operational difficulties, often sacrifice simulation depth, simplifying business logic and reducing the complexity of shallow interactions. Some enterprises, concerned about the potential for high-interaction honeypots to be exploited, tend to adopt shallow interaction solutions, further exacerbating the problem of insufficient simulation accuracy. Summary of the Invention

[0012] Therefore, this invention provides an asset simulation system for threat perception that relies on a vertical large model to achieve high-fidelity replication of the static and dynamic resources of the protected asset, and through hierarchical design, can quickly respond to access to static resources and deeply interact with access to dynamic resources.

[0013] The aforementioned asset simulation system for threat perception includes a simulation module, a decision-making module, a semantic mapping library, a response agent, a resource storage module, and a session library;

[0014] The simulation module is used to simulate static and dynamic resources. It includes a static resource crawling unit, a dynamic raw data construction unit, and a vertical large model for constructing dynamic resources. The static resource crawling unit is used to generate static simulation files that are consistent with real assets. The dynamic raw data construction unit is used to collect dynamic interaction logs of real assets, extract explicit features from them, and construct dynamic interaction feature raw data. The vertical large model for constructing dynamic resources is used to reverse generate the structure, data format, and business logic rules of dynamic resources through explicit interaction features, so as to realize the simulation of dynamic resources.

[0015] The semantic mapping library stores the correspondence between resource, request, and service semantics, and is used to provide semantic matching basis for the decision-making module;

[0016] The decision module is used to determine the request type and decide on the response strategy;

[0017] The responding agent is equipped with semantically enhanced prompts, and the responding agent interacts dynamically with the attacker based on the semantically enhanced prompts.

[0018] The resource storage module is used to store static simulation resources, dynamic simulation resources, semantic mapping rules, and interaction logs;

[0019] The session library is used to store interaction session information between the attacker and the simulation system;

[0020] When an attacker's access request is received, the decision module first matches the resource type corresponding to the request through the semantic mapping library. If it is a static resource access, the decision module directly calls the static simulation resource in the resource storage module and returns a response. If it is a dynamic resource access, the decision module triggers the response agent, which starts up and interacts dynamically with the attacker, records the interaction log, and updates the session context to the session library.

[0021] Furthermore, the simulation module dynamically adjusts, optimizes, and generalizes simulation strategies based on attacker behavior, real-time threat intelligence, and / or interaction logs.

[0022] Furthermore, the simulation module simplifies simulation configuration and maintenance processes by reducing the frequency of interaction.

[0023] Furthermore, the session library also maintains the session context. During multi-round interactions, the responding agent reads the historical records in the session library in real time and dynamically adjusts and optimizes the response strategy.

[0024] Furthermore, the response agent also summarizes the patterns and related characteristics of attackers based on historical attack behaviors, and generalizes and derives new attack behaviors in order to adapt and respond to new attack behaviors.

[0025] Furthermore, the semantically enhanced prompts in the responding agent can be dynamically adjusted based on the industry attributes of the real assets.

[0026] Furthermore, static simulation resources in the resource storage module are stored hierarchically according to a directory structure, while dynamic simulation resources and interaction logs are indexed by timestamps.

[0027] Furthermore, the various modules interact with each other through API interfaces.

[0028] This invention employs a dual-path approach of "static resource crawling and replication + dynamic resource reverse engineering," combined with the semantic understanding and scene generation capabilities of a vertical large-scale model, to achieve dual simulation of both static and dynamic resources of the protected asset. This enhances the simulation accuracy of threat perception services. Furthermore, it differentiates the response logic for static and dynamic resource access by using a hierarchical interaction design. Static resource access directly calls pre-generated static simulation data and quickly returns a response, while dynamic resource access only connects to a response agent, enabling dynamic interaction between the response agent and the attacker. This ensures the depth of interaction while improving the efficiency of the interaction response. Attached Figure Description

[0029] Figure 1 This is a flowchart illustrating the operation of an asset simulation system for threat perception according to an embodiment of the present invention. Detailed Implementation

[0030] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention. Unless otherwise defined, the technical or scientific terms used herein should have the ordinary meaning understood by those skilled in the art. The terms "comprising" and similar expressions used herein mean that the element or object preceding the word covers the element or object listed after the word and its equivalents, but does not exclude other elements or objects.

[0031] This invention provides an asset simulation system for threat perception, including a simulation module, a decision module, a semantic mapping library, a response agent, a resource storage module, and a session library. The simulation module simulates static and dynamic resources, including a static resource crawling unit, a dynamic raw data construction unit, and a dynamic resource construction vertical large model. The static resource crawling unit generates static simulation files consistent with real assets. The dynamic raw data construction unit collects dynamic interaction logs of real assets, extracts explicit features to construct dynamic interaction feature raw data, and the dynamic resource construction vertical large model reverse-engineers the structure, data format, and business logic rules of dynamic resources based on explicit interaction features to achieve dynamic resource simulation. The semantic mapping library stores the correspondence between resources, request phrases, and service semantics, providing semantic matching basis for the decision module. The decision module determines the request type and decides the response strategy. The response agent contains semantically enhanced prompts and interacts dynamically with the attacker based on these prompts. The resource storage module stores static simulation resources, dynamic simulation resources, semantic mapping rules, and interaction logs. The session library stores interaction session information between the attacker and the simulation system.

[0032] When an attacker's access request is received, the decision module first matches the resource type corresponding to the request through the semantic mapping library. If it is a static resource access, the decision module directly calls the static simulation resource in the resource storage module and returns a response. If it is a dynamic resource access, the decision module triggers the response agent, which starts up and interacts dynamically with the attacker, records the interaction log, and updates the session context to the session library.

[0033] This invention employs a dual-path approach of "static resource crawling and replication + dynamic resource reverse engineering," combined with the semantic understanding and scene generation capabilities of a vertical large-scale model, to achieve dual simulation of both static and dynamic resources of the protected asset. This enhances the simulation accuracy of threat perception services. Furthermore, it differentiates the response logic for static and dynamic resource access by using a hierarchical interaction design. Static resource access directly calls pre-generated static simulation data and quickly returns a response, while dynamic resource access only connects to a response agent, enabling dynamic interaction between the response agent and the attacker. This ensures the depth of interaction while improving the efficiency of the interaction response.

[0034] The static resource crawling unit generates static simulation files consistent with real assets in the following manner: First, it collects publicly available static files of the protected assets, such as web page source code, document attachments, and configuration file fragments, using compliant web crawling tools. The collected raw data is then input into the vertical large model, which parses the file type, directory hierarchy, and data format to generate static simulation files consistent with real assets. When generating static simulation files, it is essential to ensure that the path, naming rules, and basic data format of the static simulation files are highly consistent with those of the protected assets.

[0035] The dynamic interaction logs of the protected assets collected by the dynamic dataset construction unit may include, for example, API call records, user operation response data, and business process interaction trajectories. The explicit features in the dynamic interaction logs may include, for example, interface parameter formats, response code rules, data return logic, and permission association relationships.

[0036] Because the dynamic resource construction vertical large model generates the structure, data format and business logic rules of dynamic resources in reverse through explicit interaction features, it treats the protected assets as a black box, without needing to know their internal real architecture. It achieves dynamic resource simulation only through explicit interaction features, thus solving the simulation problem caused by the invisibility of the real architecture of dynamic resources.

[0037] The semantic mapping library stores the correspondence between resources, request terms, and service semantics, including mappings between static file types and access response formats, mappings between dynamic interface parameters and business semantics, and association rules between common attacker requests and simulated resources. Furthermore, since an attacker's request command is a string of symbols, the semantic mapping library can map these symbols into natural language and place them in semantically enhanced prompt word templates. The response agent then interacts with the attacker based on these semantically enhanced prompt words, responding to the attacker's request commands mapped by the semantic mapping library.

[0038] Responsive agents can also be built using large models, which can enhance the depth of interaction and reduce costs compared to traditional high-interaction solutions. Semantic enhancement prompts contain guiding information across dimensions such as business logic constraints, permission rules, and interaction styles. These prompts can be dynamically adjusted based on the industry attributes of the protected assets, such as finance, government affairs, and energy, allowing for tailored approaches for different industries.

[0039] The resource storage module adopts a distributed storage architecture, classifying and storing static simulation resources, dynamic simulation resources, semantic mapping rules, and interaction logs. Static simulation resources are stored hierarchically according to a directory structure, while dynamic simulation resources and interaction logs are indexed by timestamps. This ensures efficient resource access and data querying, while also supporting the long-term retention of massive amounts of interaction data, providing data support for subsequent attack behavior analysis.

[0040] The session library stores interaction session information between the attacker and the simulation system, including request time, accessed resources, operation commands, response content, and session state. The session library also maintains the session context. During multi-round interactions, the responding agent reads the historical records in the session library in real time and dynamically adjusts and optimizes its response strategy. This ensures that the responding agent can accurately connect historical operations across multiple rounds of interaction, avoiding session breaks and ensuring the consistency and rationality of the interaction behavior.

[0041] Furthermore, the simulation module dynamically adjusts, optimizes, and generalizes simulation strategies based on attacker behavior, real-time threat intelligence, and / or interaction logs. Because the simulation module dynamically adjusts, optimizes, and generalizes simulation strategies based on attacker behavior, real-time threat intelligence, and / or interaction logs, it can adapt to new types of attackers and improve simulation accuracy. In the next attacker attack, better simulation resources can be used to perceive, capture, and analyze the attacker.

[0042] Furthermore, the response agent also summarizes the attacker's patterns and correlation characteristics based on historical attack behaviors, and generalizes and derives new attack behaviors to adapt its response to these new attacks. For example, when an attacker interacts with the response agent, they might ask for information such as the date, day of the week, or whether this year is a leap year or a common year. The response agent can generalize and derive the pattern of the attacker asking about time, thus simulating dynamic resources. This allows the response agent to respond when the attacker asks for time information such as whether today is a holiday or how many days are in this month. In other words, the response agent can generalize and derive new attack behaviors based on historical attack behaviors to adapt its response to these new attacks. This allows the response agent to adapt and respond to new attack behaviors when the attacker's behavior changes, without requiring manual rule updates.

[0043] Furthermore, the various modules interact with each other through API interfaces, which are commonly used data interfaces, thus simulating the versatility of the system.

[0044] The operation mechanism of the simulation system of the present invention will be described below.

[0045] The simulation system of this invention operates in two phases: an initialization phase and a runtime response phase. The entire process achieves a closed-loop operation of "simulation construction - request processing - interactive optimization." The specific process is as follows: Figure 1 As shown.

[0046] During the initialization phase, the static resource simulation is initialized first. The static resource crawling unit of the simulation module comprehensively collects the publicly available static resources of the protected assets. The collected file data, such as HTML, CSS, and configuration fragments in HTTP services, or key file templates, command response feature files, and system configuration scripts in SSH services, are input into the vertical large model. The large model parses the directory structure, naming rules, data format, and content characteristics of the files to generate static simulation resources consistent with the real assets and stores them in the resource storage module.

[0047] Next, dynamic resource simulation initialization is performed. The dynamic raw dataset construction unit collects the historical interaction logs of the protected assets and extracts the explicit features to construct the dynamic interaction feature raw data. The dynamic resource construction vertical large model is trained based on this raw dataset and reverse-engineers the structure, data format and business logic rules of the dynamic resources. For example, the layout framework, configuration, effect and code of the page are inferred from the explicit features of the webpage to realize the simulation of the dynamic resources, and the dynamic simulation resources are stored in the resource storage module at the same time.

[0048] Then, the simulation system initializes the association rules in the semantic mapping library based on the industry attributes and business types of the protected assets.

[0049] Finally, the interaction template is initialized, the responding agent loads semantically enhanced prompts adapted to the protected assets, the business logic constraints, permission rules and response styles in the interaction process are clarified, and the preparation work for dynamic interaction is completed.

[0050] During the runtime response phase, after an attacker initiates a network access request, the simulation system first receives the request data, including the access address, request parameters, operation commands, etc. The decision module calls the semantic mapping library and determines the resource type corresponding to the request, such as static or dynamic resources, through keyword matching and semantic analysis.

[0051] If the access is determined to be to a static resource, the decision module directly retrieves the corresponding static simulation resource from the resource storage module and returns it to the attacker according to the response format of the real asset, such as the status code and data transmission protocol of the HTTP service, or the command return format and authentication response characteristics of the SSH service.

[0052] If the access is determined to be a dynamic resource, the responding agent retrieves the corresponding dynamic simulation resource from the resource storage module, initializes the session information in conjunction with the request parameters, and stores the session ID, initial state, and other data into the session library.

[0053] Next, the response agent loads preset semantic enhancement prompts and, combined with the business logic of dynamic resources and the current request content, generates prompts to guide the response agent to respond. The prompts include the permission rules, data formats, and business consistency requirements that the response must follow.

[0054] Then, the responding agent generates an interactive response that conforms to the business logic based on the prompt information, dynamic simulation resources, and session context, and returns it to the attacker. Simultaneously, the simulation system records the request content, response result, and session state of this interaction and updates it to the session database.

[0055] In the case of multi-turn interactions, the responding agent also reads the historical records of the session database in real time, dynamically adjusting and optimizing the response strategy to ensure the consistency and rationality of the interaction behavior. Furthermore, the responding agent summarizes the attacker's patterns and related characteristics based on historical attack behaviors, and generalizes and derives new attack behaviors to adapt responses to these new attacks, thereby avoiding the limitations of traditional static simulation rules.

[0056] Finally, all interaction logs, including request data, response data, session state, and resource access traces, are stored in real time in the resource storage module. This enables in-depth analysis of the attacker's tool characteristics, operation process, and attack intent to build an attacker profile.

[0057] While embodiments of the present invention have been described in detail above, it will be apparent to those skilled in the art that various modifications and variations can be made to these embodiments. However, it should be understood that such modifications and variations fall within the scope and spirit of the invention as set forth in the claims. Furthermore, the invention described herein may have other embodiments and can be implemented or carried out in various ways.

Claims

1. An asset emulation system for threat awareness, characterized in that, It includes a simulation module, a decision-making module, a semantic mapping library, a response agent, a resource storage module, and a session library; The simulation module is used to simulate static and dynamic resources. It includes a static resource crawling unit, a dynamic raw data construction unit, and a dynamic resource construction vertical large model. The static resource crawling unit is used to generate static simulation files that are consistent with real assets. The dynamic raw data construction unit is used to collect dynamic interaction logs of real assets, extract explicit features from them, and construct dynamic interaction feature raw data. The dynamic resource construction vertical large model is used to reverse generate the structure, data format, and business logic rules of dynamic resources through explicit interaction features, so as to realize the simulation of dynamic resources. The semantic mapping library stores the correspondence between resources, request terms, and service semantics, and is used to provide semantic matching basis for the decision module; The decision-making module is used to determine the request type and decide on the response strategy; The response agent contains semantically enhanced prompts, and the response agent dynamically interacts with the attacker based on the semantically enhanced prompts. The resource storage module is used to store static simulation resources, dynamic simulation resources, semantic mapping rules, and interaction logs. The session library is used to store interaction session information between the attacker and the simulation system; When an attacker's access request is received, the decision module first matches the resource type corresponding to the request through the semantic mapping library. If it is a static resource access, the decision module directly calls the static simulation resource in the resource storage module and returns a response. If it is a dynamic resource access, the decision module triggers the response agent, which starts up and interacts dynamically with the attacker, records the interaction log, and updates the session context to the session library.

2. The asset emulation system for threat awareness of claim 1, wherein, The simulation module also dynamically adjusts, optimizes, and generalizes the simulation strategy based on attacker behavior, real-time threat intelligence, and / or interaction logs.

3. The asset emulation system for threat awareness of claim 1, wherein, The simulation module also simplifies simulation configuration and maintenance processes by reducing the frequency of interaction.

4. The asset emulation system for threat awareness of claim 1, wherein, The session library also maintains the session context. During multi-round interactions, the responding agent reads the historical records in the session library in real time and dynamically adjusts and optimizes the response strategy.

5. The asset emulation system for threat awareness of claim 1, wherein, The response agent also summarizes the attacker's patterns and related characteristics based on historical attack behaviors, and generalizes and derives new attack behaviors to adapt and respond to new attack behaviors.

6. The asset emulation system for threat awareness of claim 1, wherein, The semantically enhanced prompts in the response agent can be dynamically adjusted based on the industry attributes of the real assets.

7. The asset emulation system for threat awareness of claim 1, wherein, The static simulation resources in the resource storage module are stored hierarchically according to the directory structure, while the dynamic simulation resources and interaction logs are indexed by timestamps.

8. The asset emulation system for threat awareness of claim 1, wherein, Each module interacts with other modules through API interfaces.

Images