Multi-source threat intelligence fusion and AI decision-making network attack adaptive response system

Abstract

The invention discloses a network attack adaptive response system and method based on multi-source threat intelligence fusion and AI decision, and belongs to the technical field of network security. The method comprises the following steps: collecting heterogeneous data through a multi-source sensing layer and constructing a network space digital twinborn body updated in real time; the threat cognitive layer is based on ATTamp; the CK framework performs deep threat association analysis to generate an attacker tactical intention map; constructing a multi-agent confrontation simulation environment in a dynamic game decision engine, performing attack and defense game deduction by adopting a Monte Carlo tree search algorithm, and solving a dynamic optimal defense strategy; converting the strategy into an executable defense action plan through a strategy execution layer, and automatically issuing and executing the executable defense action plan; and finally, effect evaluation and feedback learning are carried out in an evolution verification layer to drive the system to evolve continuously. According to the method, a complete closed loop from threat perception, intelligent decision-making to autonomous evolution is realized, and the real-time performance, the self-adaptability and the confrontation intelligence level of network defense are remarkably improved.

Description

Technical Field

[0001] This invention relates to the field of cybersecurity technology, and in particular to a network attack adaptive response system that integrates multi-source threat intelligence fusion and AI decision-making. Background Technology

[0002] As cyberattacks become increasingly complex, covert, and automated, traditional security protection systems based on static rules or single models face severe challenges. Currently, leveraging artificial intelligence technology to integrate multi-source threat intelligence for collaborative defense has become a research hotspot.

[0003] For example, existing technology (CN120768691A) discloses a multi-source security intelligence collaborative analysis method that integrates AI agents. This method analyzes different data sources by constructing multiple AI agents, uses temporal fusion to build a dynamic security posture model, and generates response suggestions. While this method achieves cross-data source correlation analysis, its decision-making process relies on predefined models to generate suggestions, lacking a centralized dynamic decision-making core capable of simulating attacker intent and evaluating the consequences of various adversarial strategies in real time. Existing technology (CN120896800A) discloses a network data security protection system based on AI and big data. This system integrates traffic and asset characteristics through a security central engine to perform multimodal anomaly detection and execute responses. This system achieves feature-level fusion and detection, but its response strategy library is essentially static matching and selection, lacking the ability to proactively simulate and counter attackers' potential evasion tactics in a dynamic adversarial environment. Existing technology (CN120934796A) proposes an intelligent response strategy adaptive generation method that achieves multi-step decision-making by mining attack causal chains and constructing a strategy generator. This method introduces the concept of strategy optimization, but its decision-making process is still based on historical pattern matching and local optimization. It does not construct a decision-making model that can incorporate the defender's resources and costs with the attacker's technology and tactics into a unified framework for real-time game simulation.

[0004] The existing technology (CN121098558A) discloses a relatively complete four-layer analysis and early warning system, integrating data acquisition, intelligent analysis, decision-making early warning, and collaborative response, and applying technologies such as dynamic honeypots and ATT&CK framework weighting. While the system is comprehensive in function, the collaboration between its layers can still be viewed as a linear process of "detection-evaluation-execution." The decision-making early warning layer mainly performs risk scoring and threshold judgment, and the collaborative response layer executes predetermined actions. The system lacks a core game theory learning and inference engine capable of continuously simulating the "attack-defense-re-attack" cycle and autonomously optimizing the overall defense strategy and resource allocation based on the simulation results.

[0005] In summary, while existing technologies have made progress in multi-source data fusion, AI detection, risk assessment, and even automated response, they generally suffer from the following shortcomings: 1) The decision-making process is relatively static or linear, making it impossible to simulate multi-step attack-defense game dynamics in real time; 2) Response strategies lack the ability to predict and specifically counter the adaptive behavior of attackers; 3) The system as a whole lacks sufficient self-evolution and strategy iteration capabilities as an adaptive organism. Therefore, there is an urgent need for a novel adaptive response system capable of simulating the entire attack-defense process, making dynamic game decisions, and driving the closed-loop evolution of the system. Summary of the Invention

[0006] To address the technical problems existing in the prior art, this invention provides a network attack adaptive response method based on multi-source threat intelligence fusion and AI decision-making, comprising the following steps: S110, collecting multi-source heterogeneous data and constructing a cyberspace digital twin, including forming a real-time updated attribute knowledge graph as the cyberspace digital twin, wherein the cyberspace digital twin maps the physical network's assets, traffic, and log status in real time based on the attribute knowledge graph; S120, performing deep threat correlation analysis on the cyberspace digital twin based on the ATT&CK framework to generate an attacker's tactical intent graph containing attack tactics and techniques; S130, constructing a multi-agent adversarial simulation environment based on the attacker's tactical intent graph, using the Monte Carlo tree search algorithm to perform attack and defense game deduction, solving and outputting a dynamically optimal defense strategy; S140, generating an executable defense action plan according to the dynamically optimal defense strategy, and distributing it to security devices for execution through automated orchestration, wherein the defense action plan includes dynamic honeypot deployment instructions; S150. After the defense is executed, the actual attack and defense effect data is collected, the deviation between the actual attack and defense effect data and the game simulation prediction trajectory is calculated, and the deviation is used to incrementally update and evolve the attacker's tactical intent map and the defense strategy model.

[0007] As a preferred embodiment of this application, the step S110 of collecting multi-source heterogeneous data and constructing a cyberspace digital twin specifically includes: capturing full traffic data and extracting application layer metadata through a deep packet inspection engine; collecting host security logs and process events using a lightweight proxy; calling an external threat intelligence platform API to obtain malicious IP and domain intelligence; cleaning, normalizing, and extracting entities from the above data streams through a streaming processing pipeline to construct an attribute knowledge graph containing IP, host, process entities, and associated edges, and maintaining the consistency of the graph's time window through a background cleanup task.

[0008] As a preferred embodiment of this application, the generation of the attacker's tactical intent graph in step S120 specifically includes: performing parallel scanning of the attribute knowledge graph using a hybrid detection engine, wherein the hybrid detection engine includes a signature-based detector, a temporal anomaly detection model, and a graph pattern detection engine; performing spatiotemporal aggregation and causal correlation analysis on the generated atomic alarms to reconstruct the attack chain; and using a natural language processing model to perform similarity matching between the attack chain feature vector and the MITRE ATT&CK knowledge base to map out the specific tactical stages and technical means, thereby generating a structured attacker's tactical intent graph.

[0009] As a preferred embodiment of this application, the game theory simulation based on a multi-agent adversarial environment described in step S130 specifically includes: modeling the attacker as an attacker agent with an objective function, and modeling the defender as a defender agent; initializing the behavioral parameters of the attacker agent based on the probability distribution of a historical attack case library; defining a state space including asset status and network connectivity, an action space including blocking and decoy actions, and a reward function including business losses and defense gains; selecting, expanding, simulating, and backtracking in the adversarial simulation environment using a Monte Carlo tree search algorithm, calculating the long-term value of each defense action, and outputting the optimal hybrid strategy including blocking and decoy probabilities.

[0010] As a preferred embodiment of this application, the step S140 of generating an executable defense action plan based on the dynamic optimal defense strategy specifically includes: converting the abstract optimal hybrid strategy into an instruction script containing action sequences, parameters, and dependencies; using an instruction converter to translate the instruction script into API call instructions for the corresponding brand security device, and attaching a digital signature; if the strategy includes active deception actions, instantiating a honeypot image that conforms to the current environment context in the virtualization resource pool, and redirecting attack traffic to the honeypot through a traffic bootstrap.

[0011] As a preferred embodiment of this application, it also includes a threat classification and response mode judgment step performed before step S130, specifically including: extracting the tactical stage, asset criticality, and propagation rate characteristics of the attack, and calculating a comprehensive threat urgency score; if the comprehensive threat urgency score is higher than a preset threshold, then entering the emergency response mode, triggering a preset rule base to execute a second-level rapid containment action, while the background asynchronously starts game simulation; if the comprehensive threat urgency score is lower than the preset threshold, then entering the deep simulation response mode, directly proceeding to step S130 to make a complete game decision; based on the simulation results and the actual situation, it supports smooth switching and strategy fusion between the emergency response mode and the deep simulation response mode.

[0012] This application also provides a network attack adaptive response system based on multi-source threat intelligence fusion and AI decision-making. The system applies the methods described above and includes: a multi-source perception layer for collecting multi-source heterogeneous data and constructing a cyberspace digital twin; a threat cognition layer for generating an attacker's tactical intent map based on the ATT&CK framework; a dynamic game decision engine for constructing a multi-agent adversarial simulation environment and solving for the dynamic optimal defense strategy; a strategy execution layer for generating and issuing defense action plans, including a dynamic honeypot guidance and management module; and an evolutionary verification layer for collecting defense effect data and driving incremental model updates.

[0013] As a preferred embodiment of this application, the dynamic game decision engine includes: an environment and agent modeling module for converting the attacker's tactical intent graph into a reinforcement learning state representation; a multi-agent adversarial simulation environment for defining attack and defense state transition functions; a policy solver for calculating the long-term value of defensive actions using a Monte Carlo tree search algorithm; and a defense plan generator for converting abstract policies into executable scripts containing conditional branches.

[0014] As a preferred embodiment of this application, the system further includes a response scheduler module added to the upper layer of the dynamic game decision engine, which is used to dynamically select an emergency response mode or a deep simulation response mode based on the threat urgency score.

[0015] This application also provides an electronic device, including a processor, a memory, and a computer program stored in the memory, wherein the processor executes the computer program to implement the method described above.

[0016] This application also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the method described above.

[0017] Compared with the prior art, the beneficial effects of the present invention are as follows: Enhancing decision-making intelligence and adversarial adaptability: By constructing a multi-agent game simulation environment and using algorithms such as Monte Carlo tree search to solve strategies, the system can simulate the attacker's intentions, predict their evasion behavior, and output dynamic optimal defense strategies. This overcomes the limitations of traditional static rule bases or linear decision models and achieves intelligent and dynamic responses in complex adversarial environments.

[0018] Ensuring real-time response and resource efficiency: By introducing a threat classification and response mode judgment mechanism, the system can dynamically select "emergency response mode" or "deep simulation response mode" based on the threat urgency score. This enables rapid containment of high-risk threats within seconds and deep game optimization of low-frequency high-level threats, effectively balancing response speed and decision quality, and improving the system's engineering feasibility in real-world adversarial scenarios.

[0019] Achieving closed-loop evolution and continuous optimization of the system: The defense effect is evaluated from multiple dimensions through the evolutionary verification layer. The actual attack and defense data is compared and analyzed with the inference prediction. The deviation data is used to incrementally update and integrate the attacker behavior model, detection feature library, strategy experience library, etc., so that the system has the ability to learn autonomously and evolve continuously from each confrontation, realizing the leap from "one-time response" to "organism self-evolution".

[0020] Enhanced proactive defense and deception capabilities: The system integrates proactive deception defense measures such as dynamic honeypot deployment and traffic redirection into the defense action plan. It can dynamically deploy decoy resources according to the attack path to achieve proactive trapping, interference and intelligence gathering of attackers, thereby improving the initiative and stealth of the defense system.

[0021] Supports multi-source intelligence fusion and unified situational understanding: Based on cyberspace digital twins and attribute knowledge graphs, the system realizes real-time fusion, entity association and dynamic mapping of multi-source heterogeneous data (traffic, logs, intelligence, etc.), providing a unified, accurate and computable source of facts for threat analysis, intent inference and strategy deduction, and greatly improving the depth and accuracy of situational awareness. Attached Figure Description

[0022] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with the invention and, together with the description, serve to explain the principles of the invention.

[0023] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, for those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0024] Figure 1 This is a flowchart illustrating a network attack adaptive response method based on multi-source threat intelligence fusion and AI decision-making, provided in Embodiment 1 of the present invention.

[0025] Figure 2 This is a schematic diagram of the process for collecting multi-source heterogeneous data and constructing a cyberspace digital twin, provided in Embodiment 1 of the present invention.

[0026] Figure 3 This is a schematic diagram of the process for generating an attacker's tactical intent map provided in Embodiment 1 of the present invention.

[0027] Figure 4 This is a schematic diagram of the game inference process based on a multi-agent adversarial simulation environment provided in Embodiment 1 of the present invention.

[0028] Figure 5 This is a flowchart illustrating the threat classification and response mode determination steps provided in Embodiment 2 of the present invention.

[0029] Figure 6 This is a schematic diagram of the structure of a network attack adaptive response system that integrates multi-source threat intelligence fusion and AI decision-making, provided in Embodiment 3 of the present invention. Detailed Implementation

[0030] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of the present invention, and not all of them. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the scope of protection of the present invention.

[0031] It should be noted that all directional indications (such as up, down, left, right, front, back, etc.) in the embodiments of the present invention are only used to explain the relative positional relationship and movement of each component in a certain specific posture (as shown in the figure). If the specific posture changes, the directional indication will also change accordingly.

[0032] Furthermore, the use of terms such as "first" and "second" in this invention is for descriptive purposes only and should not be construed as indicating or implying their relative importance or implicitly specifying the number of technical features indicated. Therefore, features defined with "first" and "second" may explicitly or implicitly include at least one of those features. Additionally, the technical solutions of the various embodiments can be combined with each other, but only on the basis of being achievable by those skilled in the art. When the combination of technical solutions is contradictory or impossible to implement, such a combination of technical solutions should be considered non-existent and not within the scope of protection claimed by this invention.

[0033] Example 1 This invention provides an adaptive response method for cyberattacks based on multi-source threat intelligence fusion and AI decision-making. The method achieves adaptive, intelligent, and evolutionary defense against cyberattacks through a continuous "perception-cognition-decision-execution-evolution" cycle. Figure 1 As shown, the specific steps are as follows: S110. Multi-source heterogeneous data acquisition and dynamic construction of cyberspace digital twin, including forming a real-time updated attribute knowledge graph as a cyberspace digital twin, wherein the cyberspace digital twin maps the physical network's assets, traffic and log status in real time based on the attribute knowledge graph.

[0034] This step is executed by the multi-source perception layer, with the goal of creating a virtual image—a cyberspace digital twin—that is synchronized in real time with the physical network, computable, and capable of reasoning. The cyberspace digital twin serves as the core data foundation and unified source of fact for all subsequent analysis, decision-making, and inference. Figure 2 As shown, the process includes: capturing full traffic data and extracting application layer metadata through a deep packet inspection engine; collecting host security logs and process events using a lightweight proxy; calling an external threat intelligence platform API to obtain malicious IP and domain intelligence; cleaning, normalizing, and extracting entities from the above data stream through a streaming processing pipeline to construct an attribute knowledge graph containing IP, host, process entities, and related edges; and maintaining the consistency of the graph's time window through a background cleanup task. Specifically, it includes the following steps: S111, Parallel access and preprocessing of heterogeneous data sources, specifically including: The system captures full network traffic data using a deep packet inspection engine deployed on optical splitters or mirror ports of the network core switches. This engine not only parses down to the transport layer (TCP / UDP ports) but also delves into the application layer, extracting structured metadata for protocols such as HTTP / HTTPS, DNS, SMB, and RDP. This includes information such as HTTP request methods, URIs, User-Agents, DNS query domain names and response records, and RDP login usernames. For encrypted TLS traffic, it extracts key metadata from the handshake phase, such as JA3 / JA3S fingerprints, certificate information, and server name indications, without decrypting the content.

[0035] Meanwhile, lightweight agents deployed on critical servers and endpoints begin collecting local security logs, system logs, process creation events, and file operation records. These agents upload formatted log events in real time through secure internal channels. Additionally, the system retrieves security event logs at the network perimeter by calling the Syslog interfaces or management APIs of security devices such as firewalls and intrusion prevention systems. In a separate, asynchronous thread, the external intelligence retrieval module periodically accesses a pre-configured threat intelligence platform API to subscribe to and obtain the latest malicious IP addresses, domain names, URL hashes, exploit signatures, and tactical, technical, and procedural intelligence from advanced persistent threat organizations.

[0036] All data streams from different sources are uniformly connected to a streaming data processing pipeline. At the pipeline inlet, the data is first deduplicated and filtered for invalid fields. Subsequently, the timestamp normalization component converts the timestamps of all events to a unified Coordinated Universal Time (UTC) format, ensuring its accuracy. The IP address enrichment component then appends geolocation information to each IP address event based on the built-in GeoIP database. After these preprocessing operations, the originally heterogeneous raw data is transformed into a unified, field-rich basic security event object stream, ready for subsequent deep processing.

[0037] S112, Entity Extraction, Relationship Discovery, and Graph Structure Construction The system uses a named entity recognition model and a regular expression rule base to automatically extract key security entities from the basic security event stream. Key security entities include, but are not limited to: IP addresses, hostnames, usernames, process names and paths, file hashes, domain names, and registry keys. Each identified entity is assigned a unique identifier and type label.

[0038] The relationship discovery engine works synchronously, analyzing the contextual semantics and network logic of events to dynamically create association edges between entities. For example, when processing a traffic event where "host A (IP_a) initiates a TCP connection to port 445 of host B (IP_b)," the engine creates a "network communication" relationship edge from entity "IP_a" to entity "IP_b," and appends attributes such as "protocol: TCP," "destination port: 445," and "timestamp" to this edge. When processing a log event where "user U successfully starts process P on host H," the engine creates a "login" relationship edge from "user U" to "host H," and a "running" relationship edge from "host H" to "process P." Events from threat intelligence create "belong" relationship edges between "file hash" entities and "malware family" entities.

[0039] All extracted entities and discovered relationships are streamed and associated, then injected into the graph database in real time, forming a continuously growing and evolving attribute knowledge graph. This attribute knowledge graph accurately depicts the elements (assets, users, processes, files) in the network and their interactions, constituting the core data layer of the cyberspace digital twin. Each node and edge in the attribute knowledge graph is timestamped. A background cleanup task automatically removes old data exceeding a preset time window, ensuring the digital twin reflects the latest state of the network.

[0040] S120, Deep Threat Correlation Analysis and Attacker Tactical Intent Map Generation, specifically: Based on the ATT&CK framework, deep threat correlation analysis is performed on the cyberspace digital twin to generate an attacker tactical intent map containing attack tactics and techniques. Among them, such as Figure 3 As shown, generating an attacker's tactical intent graph includes: using a hybrid detection engine to perform parallel scanning of the attribute knowledge graph, the hybrid detection engine including a signature-based detector, a temporal anomaly detection model, and a graph pattern detection engine; performing spatiotemporal aggregation and causal correlation analysis on the generated atomic alerts to reconstruct the attack chain; and using a natural language processing model to perform similarity matching between the attack chain feature vectors and the MITRE ATT&CK knowledge base to map out specific tactical stages and technical means, thereby generating a structured attacker's tactical intent graph.

[0041] Specifically, this step is performed by the threat cognition layer, whose task is to extract a high-level, understandable threat narrative from the massive relationships within the digital twin, namely, "what attack occurred, what the attacker intends to do, and what they are doing." This includes the following steps: S121, Multi-model Parallel Detection and Atomic Alarm Generation The threat awareness layer first activates its internal hybrid detection engine. This engine employs a parallel computing architecture, simultaneously running multiple detection models to scan the attribute knowledge graph. Signature-based detectors quickly compare entity attributes (such as file hashes and IP addresses) with a local malicious indicator database, generating atomic alerts such as "Known malicious file executed." The temporal anomaly detection model establishes a behavioral baseline profile for each user, host, or service group; for example, an LSTM network learns a server administrator's typical login times and operation sequences. When real-time behavioral flow deviates from the baseline by more than a threshold (such as executing a large number of file enumeration commands at 3 AM), the model outputs an atomic alert with an anomaly score, such as "User behavior deviates from baseline, anomaly score 0.92." The graph pattern detection engine directly executes predefined malicious subgraph queries on the digital twin's attribute knowledge graph. For example, a query specifically looks for the pattern "Within 10 minutes, the same external IP address established and immediately closed SMB connections with more than 20 different internal hosts," and if a match is found, an atomic alert of "Suspected network scan" is generated.

[0042] S122, Alarm Aggregation, Correlation and Attack Chain Reconstruction The massive number of atomic alerts generated are fed into the alert correlation and attack chain reconstruction engine. The primary task of this engine is spatiotemporal aggregation, which merges atomic alerts of the same type targeting the same objective within a short period into a single, higher-confidence aggregated alert, significantly reducing the number of alerts. Next, the correlation inference engine begins working. Utilizing the rich relational links provided by the digital twin, the engine calculates the probability of causal relationships between different alerts. For example, it discovers that the "host H1" entity in alert A ("Suspicious PowerShell script execution detected on host H1") is the same entity as the "host H1" in alert B ("Host H1 initiates an abnormal WMI connection to host H2"), and that their occurrences are closely sequential. By querying the knowledge graph, it confirms that WMI connections are a common lateral movement technique. The correlation inference engine then classifies these two alerts with a high probability as belonging to the same attack step and clusters them into a higher-order "suspected lateral movement" event. The alert correlation and attack chain reconstruction engine continues this correlation analysis, attempting to piece together the scattered alerts. Figure 1 These elements, when combined, form a coherent narrative of the attack.

[0043] S123, TTP Mapping and Attacker Intent Graph Generation For each initially reconstructed attack narrative, the TTP Mapping and Intent Analysis module begins to translate and interpret it. This module incorporates a complete MITRE ATT&CK framework knowledge base. The behavioral feature encoder within the module transforms specific actions in the attack narrative (e.g., "using the certutil.exe tool to download a file from a remote URL") into standardized feature vectors. A similarity matcher then calculates the cosine similarity between this feature vector and hundreds of technical description features in the ATT&CK knowledge base, finding the best-matching technical item. The TTP Mapping and Intent Analysis module not only performs one-to-one matching but also infers the attacker's tactical stage (e.g., initial access, execution, persistence, lateral movement, data exfiltration, etc.) based on the order of the attack narrative. Finally, the TTP Mapping and Intent Analysis module integrates all information and outputs a structured attacker tactical intent map. The attacker's tactical intent map clearly identifies the attack chain path involved (e.g., phishing email delivery of malicious attachments --> execution of PowerShell downloader --> intranet probing --> lateral movement to database server), and maps each step to specific ATT&CK techniques and tactics. It also assesses the current stage of the attack and possible objectives (such as stealing customer data), providing decision-makers with highly actionable threat intelligence.

[0044] S130. Solving the dynamic optimal strategy based on multi-agent game theory, specifically: constructing a multi-agent adversarial simulation environment based on the attacker's tactical intent map, using the Monte Carlo tree search algorithm to perform attack and defense game theory, solving and outputting the dynamic optimal defense strategy.

[0045] This step is the core of this invention and is executed by the dynamic game theory decision engine. It transforms static threat analysis into dynamic adversarial simulation, solving for the optimal defense strategy in complex adversarial environments. Figure 4 As shown, the process includes: modeling the attacker as an attacker agent with an objective function, and the defender as a defender agent, wherein the behavioral parameters of the attacker agent are initialized based on the probability distribution of a historical attack case library; defining a state space including asset status and network connectivity, an action space including blocking and decoy actions, and a reward function including business losses and defense gains; and using a Monte Carlo tree search algorithm to select, expand, simulate, and backtrack in the adversarial simulation environment to calculate the long-term value of each defense action and output the optimal hybrid strategy including blocking and decoy probabilities. Specifically, the process includes the following steps: S131. Initialization of the simulation environment and instantiation of the intelligent agent The dynamic game-theoretic decision engine receives an attacker's tactical intent map from the threat cognition layer and a snapshot of the current cyberspace digital twin from the multi-source perception layer. Based on these inputs, the environment and agent modeling module abstracts the real-world threats.

[0046] The environment and agent modeling module models the attacker as one or more attacker agents with clearly defined objectives. The attacker agent's memory and capabilities are defined by the asset nodes it controls (their location in the attacker's tactical intent map), its toolset (such as exploitable vulnerabilities, stolen credentials), and the target model inferred from the TTP mapping (e.g., the ultimate goal is to access a customer database located in a data center subnet). Simultaneously, the attacker agent's behavioral parameters (such as the probability of choosing different ATT&CK techniques, sensitivity to decoys, and the upper limit on the number of persistence attempts) are not only based on the current attack narrative but also initialized with probability distributions by querying a historical attack case library. This historical attack case library stores the statistical characteristics of past attack events, such as "after gaining an initial foothold, the attacker has a 70% probability of attempting lateral movement within 24 hours" and "in attacks against financial systems, the frequency of using credential theft techniques is X%." This probability distribution modeling based on historical data makes the attacker model closer to the statistical patterns of attacker behavior in the real world, improving the accuracy of the inference.

[0047] Meanwhile, the environment and agent modeling module instantiates a defender agent to represent the system itself. Its resources include configurable firewall rule slots, computing resources for deploying usable honeypots, and cost models corresponding to different response actions (including direct computation costs, business interruption risks, etc.).

[0048] S132. Construct an adversarial simulation environment based on reinforcement learning. A dynamic game theory decision engine constructs a multi-agent adversarial simulation environment based on a reinforcement learning paradigm. The core of this simulation environment is a simplified simulator that possesses key network dynamics characteristics. The environment's state S is defined as a feature vector representation of the current digital twin snapshot, encompassing asset vulnerability status, network connectivity matrix, and security policy effectiveness. The attacker's action space A_a contains various attack actions abstracted from the ATT&CK framework, while the defender's action space A_d contains feasible response actions. Each action is associated with execution success rate, required time, resource consumption, and potential impact on business operations. The environment's reward function R is a carefully designed multi-objective function, calculated at the end of each simulation. It comprehensively evaluates the defense effectiveness: negatively penalizing business interruption losses and defense action costs; positively rewarding the degree to which the attack progress is contained, the resource consumption of the attacker, and the intelligence value obtained when deceiving the attacker.

[0049] S133, Monte Carlo Tree Search and Iterative Strategy Solution The dynamic game decision engine employs Monte Carlo tree search as its core solution algorithm. Within the Monte Carlo tree search framework, the root node of the search tree is the current initial state S. Each node represents a game state, and edges represent actions performed by the attacker or defender.

[0050] The search process iteratively proceeds through four phases: the selection phase, starting from the root node, recursively selecting the optimal child node (usually using the UCT algorithm to balance exploration and exploitation), simulating alternating attack and defense actions until a leaf node that has not yet been fully evaluated is reached; the expansion phase, adding one or more new legal action child nodes to the leaf node; the simulation phase, starting from a new node, using a fast preset strategy (such as a random strategy) to simulate subsequent confrontations between attackers and defenders until the simulation termination condition is met (such as a successful attack, the attack being completely contained, or the maximum number of steps being reached), and obtaining a simulated profit value; and the backtracking phase, propagating the profit value of this simulation backward along the path from the leaf node to the root node, updating the number of visits and cumulative profits of all nodes on the path.

[0051] After thousands of such simulations, the statistics (number of accesses, average benefit) of each defense action branch under the root node become clear, thus generating the optimal hybrid strategy. For example, the results might show that, under the current situation, the action of "immediately blocking the attack source IP" can quickly curb the currently visible attack, but the average benefit is average because the attacker may have already prepared a backup channel; while the action of "not blocking temporarily, but deploying a high-interaction honeypot on the path where it is most likely to attack next" has short-term risks, but higher long-term average benefits because it is expected to capture more TTPs of the attacker and mislead their actions. Ultimately, the decision engine outputs a probabilistic strategy: execute the former with a 40% probability and execute the latter with a 60% probability.

[0052] S134. Generate an executable defense action plan. The defense plan generator transforms abstract optimal hybrid strategies into concrete, executable defense action plans. A defense action plan is a detailed instruction script that explicitly lists the sequence of actions to be executed, the specific parameters of each action (e.g., the exact IP address to block, the precise subnet and mirror template for honeypot deployment), the dependencies between actions, key post-execution verification metrics (e.g., verifying whether specific traffic has returned to zero after blocking), and backup plans or escalation paths in case the attacker's response exceeds expectations. This completes an intelligent decision-making process based on deep adversarial simulation.

[0053] S140, Automated orchestration execution and dynamic deception defense deployment, specifically: generating an executable defense action plan based on the dynamic optimal defense strategy, and distributing it to security devices for execution through automated orchestration, wherein the defense action plan includes dynamic honeypot deployment instructions.

[0054] This step is executed by the policy execution layer, responsible for translating intelligent decisions into effective defensive actions in the real world. It serves as a bridge connecting virtual simulations and physical networks. It includes the following sub-steps: S141. Secure Command Conversion and Issuance The policy enforcement layer first receives the defense action plan from the decision engine through its instruction compilation and secure distribution module. At the heart of this module is the instruction translator, which acts like a compiler, translating the abstract defense actions in the action plan into commands that specific security devices or software can understand and execute. For example, the abstract BlockIP (192.168.1.100) action is translated into a set of REST API calls for a specific brand of next-generation firewall, including creating an address object, creating a service object, and finally generating a denial policy and applying it to the corresponding interface. The abstract IsolateHost (Web-SRV-01) action is translated into sending a digitally signed isolation instruction to the Endpoint Detection and Response (EDR) agent installed on that host.

[0055] Before issuing instructions, the digital signature unit generates a digital signature based on asymmetric encryption for each instruction and attaches a precise timestamp. This ensures the integrity and non-repudiation of the instructions, prevents tampering during transmission, and facilitates post-transmission auditing. Subsequently, the secure communication client securely sends these signed instructions to the corresponding policy enforcement endpoints, such as firewall management ports, EDR management platforms, switch controllers, or cloud management platform API gateways, via encrypted channels such as two-way TLS authentication.

[0056] S142, Dynamic Honeypot Guiding and Disguise When the defense action plan includes proactive deception defense actions, the dynamic honeypot bootstrapping and management module is activated. This module maintains a virtualized resource pool and a honeypot image template library. Upon receiving an instruction such as `Deploy Decoy Service(fake_database, segment_10.0.5.0 / 24)`, the module's resource scheduler immediately instantiates a pre-made honeypot image simulating a database service on the virtualization platform or container platform within the specified network segment (10.0.5.0 / 24). The configuration injector injects dynamically generated decoy data (such as fake customer table structures) that conforms to the current environment context into this new honeypot. Simultaneously, the traffic bootstrapping mechanism may fine-tune internal DNS records or routing policies to increase the probability that attackers probing the database server will be directed to this newly deployed honeypot, rather than the real asset. In this way, the system dynamically and precisely deploys static defense resources onto the attack path, achieving proactive deception and interference.

[0057] S143. Execution Status Monitoring and Confirmation For complex response processes involving multiple steps and cross-systems, the automated response orchestration module comes into play. This module is a workflow engine responsible for coordinating the execution order of different actions within the defense action plan. For example, it first issues a command to create a temporary traffic mirroring rule on the firewall, copying suspicious traffic to the analysis device; then, it issues a blocking command; finally, it triggers a log collection task to archive relevant logs. The automated response orchestration module monitors the execution status of each step (success, failure, timeout) and handles exceptions according to pre-defined logic to ensure the reliability of the response process.

[0058] S150, Effect Evaluation, Feedback Learning and System Evolution, specifically: after the defense is executed, collect actual attack and defense effect data, calculate the deviation between the actual attack and defense effect data and the game deduction prediction trajectory, and use the deviation to incrementally update and evolve the attacker's tactical intent map and defense strategy model.

[0059] This step is executed by the evolutionary verification layer, which acts as the system's "immune memory" and learning center. It is responsible for completing the closed loop of the adaptive cycle of "perception-cognition-decision-execution-evolution" and driving the continuous evolution of the entire system's capabilities. It includes the following sub-steps: S151, Multi-dimensional effect data collection Following the execution of the defense action plan, the multidimensional observation data collector at the evolutionary verification layer immediately initiates a targeted monitoring window. The multidimensional observation data collector focuses on network zones, host entities, and user accounts relevant to this response action, continuously pulling subsequent data from the multi-source awareness layer. For example, has the attack traffic disappeared or changed? Are there any new anomalous processes attempting to launch on isolated hosts? Have deployed honeypots received connection requests? Has the attacker changed their TTP (e.g., from exploiting vulnerabilities to password spraying)? Simultaneously, the multidimensional observation data collector also collects business-level metrics to assess whether the defense actions have caused any unintended impact on normal services.

[0060] S152, Deduction - Reality Comparison and Deviation Calculation The simulation-reality comparison analysis module begins its critical effectiveness evaluation. This module extracts the simulated predicted trajectories—predictions of how attackers would react to different defensive actions—from the decision engine's logs. Simultaneously, it acquires the actual observed trajectories from the observation data collector. The module uses a trajectory alignment algorithm to align these two time series and then calculates the deviations in key metrics point by point. For example, predicting that an attacker would stop attacking after being blocked, but actually observing them switching to a C2 server and continuing activity, results in a significant "attacker resilience bias." Predicting that the honeypot would capture a certain exploit attempt, but actually recording a different new attack method, results in an "attacker technique selection bias."

[0061] S153, Incremental Model Training and Knowledge Base Update These quantified biases are the "fuel" for system evolution. The model training and knowledge update service receives this bias data and constructs it into a loss function. Through an online learning interface, it calls the fine-tuning function of the attacker behavior model in the dynamic game decision engine. Using new "actual attacker reactions" data as monitoring signals, it incrementally updates the model parameters, making the model's predictions of similar attacker behavior more accurate in the future. This is equivalent to letting the system remember the true nature of this attacker.

[0062] Simultaneously, the knowledge extraction and formatting tools automatically extract new attack features, new vulnerability exploit fingerprints, and new malicious domain name generation algorithm patterns from newly observed attack data. This new knowledge is structured into a standard format, and the knowledge base management interface then pushes and integrates this new knowledge into the ATT&CK extended knowledge base of the threat cognition layer, the feature library of the anomaly detection model, and the internal threat intelligence base of the multi-source perception layer. This means that the system has not only learned to predict but has also enriched its pathogen identification database.

[0063] Finally, the system will conduct a post-event review of the executed defense action plan. If the plan is verified to have achieved the defense objectives while maintaining controllable costs and without causing significant business impact, it will be abstracted into a strategy template and stored in the strategy experience library. In the future, when the system detects similar threat patterns, the decision engine can directly refer to or quickly adapt to these proven and effective templates, thereby accelerating the decision-making process and improving response efficiency. Through this complete feedback and learning process, the system achieves a leap from one-off intelligent response to continuous intelligent evolution, enabling its defense capabilities to dynamically grow along with changes in the threat environment.

[0064] Example 2 Building upon Example 1, this embodiment proposes a hybrid adaptive response mechanism that integrates threat classification, a pre-defined rule base, and asynchronous game theory to address the computational challenges and latency issues faced by Monte Carlo Tree Search (MCTS) in real-time adversarial scenarios. Specifically, a pre-judgment step (S125) is added before step S130 (dynamic optimal strategy solution based on multi-agent game theory), introducing a graded response mechanism. This method organically combines "rapid containment" and "deep game theory" by adding intelligent classification and path selection before decision-making, balancing real-time response and optimal decision-making. Figure 5 As shown, this step includes: extracting the tactical stage of the attack, the criticality of assets, and the characteristics of the propagation rate, and calculating a comprehensive threat urgency score; if the comprehensive threat urgency score is higher than a preset threshold, an emergency response mode is entered, triggering a pre-set rule base to execute a second-level rapid containment action, while the background asynchronously starts game simulation; if the comprehensive threat urgency score is lower than the preset threshold, a deep simulation response mode is entered, directly proceeding to step S130 for a complete game decision; based on the simulation results and the actual situation, smooth switching and strategy fusion between the emergency response mode and the deep simulation response mode are supported. Specifically, the steps include: S125 Threat Classification and Response Pattern Determination This step is a newly added pre-decision-making process, which is executed collaboratively by the threat cognition layer and the dynamic game decision engine. It rapidly classifies threats based on multi-dimensional features and dynamically selects the most suitable response path.

[0065] Specifically, it includes the following sub-steps: S125a, Quantitative Assessment of Urgency Level Based on the attacker's tactical intent map and the real-time cyberspace digital twin status, the system extracts five key features and calculates a comprehensive threat urgency score through a weighted scoring model.

[0066] The first type of feature is the tactical phase score, which is assigned based on the ATT&CK tactical mapping results, ranging from 1 point for the reconnaissance phase to 5 points for the data infiltration and influence phases.

[0067] The second category is the asset criticality score, which is based on the asset tag library and business dependency graph to classify and score the affected assets.

[0068] The third category is the attack propagation rate, which is calculated by statistically analyzing the rate of change in the number of infected or scanned hosts per unit time.

[0069] The fourth category is the degree of automation of the behavior, which is judged based on the regularity of the attack sequence, the dispersion of time intervals, and other characteristics.

[0070] The fifth category is the valuation of potential business impact. This involves combining data from business continuity contingency plans to estimate the service degradation time, the scale of data breaches, and the level of compliance risks, and then normalizing these to a score of 1-5.

[0071] The overall threat urgency score is calculated using a weighted formula, with each weight configurable. The default weighting emphasizes the tactical phase and asset criticality. This score serves as the core quantitative basis for mode selection.

[0072] S125b, Dynamic Response Mode Selection: The system automatically enters one of two response modes based on the comprehensive threat urgency score and attack characteristics.

[0073] The first mode is the Emergency Response Mode, suitable for high-risk scenarios where the score exceeds the threshold, such as ransomware encryption, DDoS traffic surges, and rapid spread of automated worms. In this mode, the system immediately triggers a pre-set emergency response rule base, executing rapid containment actions within seconds, such as blocking the attack source IP and isolating infected hosts. Simultaneously, the system asynchronously initiates a complete game theory simulation process (steps S130-S134) in the background, providing optimized strategies for subsequent countermeasures and supporting a smooth switch to the newly generated strategy after the buffer period.

[0074] The second type is the in-depth simulation response mode, which is suitable for low-frequency advanced threats with scores below the threshold or the subsequent confrontation phase after an emergency response. The system directly enters the complete game decision-making loop (steps S130 and S150), allowing for a longer simulation time budget, and outputs complex defense plans with multiple steps and conditions, such as deploying honeypots, luring attackers, collecting tactical techniques and procedures, and blocking them when appropriate.

[0075] S125c, smooth switching between modes and strategy fusion mechanism To ensure a coherent and adaptable response process, the system supports smooth switching between two modes. When the emergency response mode is executed, if asynchronous simulation results suggest better or supplementary actions, the system can add new actions without affecting already executed actions, forming a combined strategy of "rapid containment + continuous game theory." Conversely, during in-depth simulations, if the threat situation suddenly escalates, the system can immediately interrupt the simulation, switch to emergency response mode, and resume or restart the simulation once the situation stabilizes.

[0076] This embodiment introduces a tiered response mechanism, resulting in several improvements to the system. First, it ensures real-time response, enabling rapid containment of high-risk threats within seconds and preventing escalation of losses. Second, it optimizes resource allocation, concentrating limited computing power on scenarios truly requiring deep game theory, thus improving overall efficiency. Third, it enhances strategy continuity, supporting smooth switching between modes and strategy fusion, ensuring overall consistency in dealing with complex, multi-stage attacks. Finally, it improves engineering feasibility, significantly reducing the difficulty of implementation and resource pressure in real-time adversarial scenarios without compromising the system's intelligent decision-making capabilities.

[0077] Example 3 This invention also provides a network attack adaptive response system based on multi-source threat intelligence fusion and AI decision-making, applying the methods described in Embodiment 1 or Embodiment 2. The system adopts a five-layer closed-loop architecture, with each layer communicating loosely via a high-throughput, low-latency internal message bus for loosely coupled data exchange and event-driven processes, ensuring system scalability and reliability. Figure 6 As shown, it specifically includes: 01 Multi-source sensing layer The multi-source awareness layer serves as the system's data input port and a real-world image builder. It consists of a set of heterogeneous data acquisition probes strategically deployed at critical network locations. Full network traffic probes, typically developed based on high-performance network processing frameworks such as DPDK or PF_RING, connect directly to the mirrored ports of core switches, capturing and parsing packets at line speed and outputting metadata-rich event streams. Host and endpoint agents are lightweight software programs that collect operating system events, application logs, and security product alerts through secure, authenticated channels, performing initial filtering and formatting. The asset and vulnerability scanner, as a proactive detection component, periodically scans the network address space, as permitted by management policies, identifying live hosts, open ports, running services, and their version information, and correlating this information with known vulnerability databases to uncover potential security risks. The external threat intelligence subscriber maintains connectivity with one or more threat intelligence platforms, receiving the latest threat indicators and attack context information via API pulls or message subscriptions.

[0078] The core of the multi-source perception layer consists of a streaming data processing pipeline and a knowledge graph management module. The data processing pipeline, built on a modern stream computing engine, receives raw data streams from all probes and performs a series of continuous transformation operations: data cleaning to remove noise and invalid records, format normalization to map data from different sources to a unified core event model, and context enrichment to add additional information such as geographic location and asset importance tags to events. The processed, standardized event stream is then fed into the knowledge graph management module in real time. This module includes an entity relation extractor that uses a rule engine and lightweight machine learning models to extract entities and relationships from events; a highly available graph database cluster for storing and querying the constantly evolving network entity relation graph; and a state snapshot service that, upon request, generates a consistent graph snapshot of the entire network or a subnet at a specific point in time, providing a stable data view for upper-layer analysis. This real-time updated graph serves as the system's cyberspace digital twin.

[0079] 02 Threat Cognition Layer The threat awareness layer serves as the system's situational understanding and analysis center. Its core is a hybrid detection engine, employing a microservice architecture to run multiple detection algorithms in parallel. Rule-based detection services quickly match known threat fingerprints and simple attack patterns. Machine learning detection services run multiple anomaly detection models, such as sequence models for User Behavior Entities (UEBAs) and statistical models for host traffic, which discover unknown threats by calculating deviations from historical baselines. The graph query detection service directly sends advanced queries to the underlying graph database to find subgraph structures that match complex attack patterns (such as lateral movement chains and data leakage paths). These detection services work in parallel, outputting initial atomic alerts.

[0080] The Alarm Correlation and Attack Chain Reconstruction Engine is responsible for elevating these low-level alerts to higher-level threat events. It first aggregates alerts to reduce redundancy. Then, its core causal correlation analyzer utilizes the rich relationships between entities in the knowledge graph to calculate the temporal, spatial, and logical correlation probabilities between different alerts. Using probabilistic graphical models or heuristic algorithms, it clusters related alerts into security event chains with causal relationships. The TTP Mapping and Intent Analysis module acts as the "translator" of the threat cognition layer, incorporating a structured MITRE ATT&CK knowledge base. This module receives security event chains and, through natural language processing and feature matching techniques, maps specific attack actions within the event chain to standard techniques and tactics within the ATT&CK framework. This infers the attacker's intent, capabilities, and current attack stage, ultimately outputting a structured attacker tactical intent graph, providing clear and actionable input for decision-making.

[0081] 03 Dynamic Game Decision Engine The dynamic game theory decision engine is the core of the system's intelligent decision-making, and its internal structure is a complex simulation and optimization system. The environment and agent modeling module is responsible for abstracting the input real-world threats into a computable model. It transforms the attacker's tactical intent map and cyberspace digital twin snapshots into state representations in reinforcement learning, and instantiates agents representing the attacker and the defender, assigning them initial states, action capabilities, and objective functions. The multi-agent adversarial simulation environment is a lightweight network simulator that defines the state transition functions that affect the network state through offensive and defensive actions. It can quickly simulate the consequences of a series of actions such as vulnerability exploitation, malicious communication, defense blocking, and deceptive interaction.

[0082] The strategy solver, the "algorithmic brain" of the engine, can be implemented using a variety of advanced algorithms. The Monte Carlo tree search solver explores possible future game paths through extensive random simulations, evaluating the long-term value of different defensive actions. The deep reinforcement learning solver utilizes deep neural networks to approximate the optimal policy and value functions, training itself through interaction with the environment. The game theory equilibrium solver calculates hybrid policy Nash equilibria for highly abstract adversarial scenarios. These solvers ultimately output an optimal or near-optimal defensive strategy under the current complex adversarial situation. The defense plan generator is responsible for "implementing" this abstract strategy, combining specific network configurations and asset information to generate a detailed, actionable defense action plan with conditional branches, which is then delivered to the execution layer.

[0083] 04 Strategy Execution Layer The policy execution layer is the system's action execution mechanism. The instruction compilation and secure distribution module receives the defense action plan and contains an instruction library that maps abstract actions in the plan to API call commands, configuration scripts, or work orders from specific brands and models of security devices, cloud platforms, or management systems. All instructions are digitally signed and timestamped before being sent to ensure their integrity and non-repudiation, and are distributed to policy execution endpoints across the network via secure communication protocols (such as HTTPS two-way authentication). The automated response orchestration module is a workflow engine that orchestrates the execution order of actions, handles dependencies between actions, and monitors the execution status of each step for complex, multi-step, cross-system response processes, ensuring the reliable completion of the entire response process. The dynamic honeypot bootstrapping and management module is specifically responsible for proactive deception defense. It manages a dynamically deployable honeypot resource pool, capable of quickly deploying highly interactive decoy systems at specified network locations based on instructions, configuring corresponding fake services and data, and subtly guiding attack traffic to these honeypots by adjusting network settings.

[0084] 05 Evolution Verification Layer The evolutionary verification layer serves as the learning and evolutionary hub of the system, enabling closed-loop optimization. The multi-dimensional observation data collector activates after each response action, specifically collecting subsequent data on entities and regions related to the action from the multi-source perception layer, forming an effect observation dataset. The inference-reality comparison analysis module is a crucial evaluation unit. It obtains the simulated prediction data stream used for the current decision from the decision engine and performs fine-tuning and comparison with the actual observed data stream, quantifying prediction biases in key dimensions such as attacker behavior and system state. The model training and knowledge update service leverages these biases to drive system evolution: it calls the decision engine's online learning interface to fine-tune internal models such as the attacker behavior model using real data, improving the accuracy of future predictions; simultaneously, it automatically extracts new threat features and TTP patterns from new data and updates them to the knowledge base and detection feature base of the threat cognition layer through the knowledge base management interface; furthermore, it evaluates the actual effectiveness of the defense action plan, abstracting successful strategy cases and storing them in the strategy experience base for future reference and learning. Through the continuous work of this layer, the system can learn from each real-world confrontation, constantly optimizing its detection, decision-making, and response capabilities, and achieving true self-adaptation and self-evolution.

[0085] Corresponding to Embodiment 2 of the present invention, the system in this embodiment adds a response scheduler module on top of the dynamic game decision engine. This module integrates a threat urgency score calculation model and a weight configuration interface, maintains an emergency response rule base and supports visual editing and simulation testing, manages an asynchronous inference task queue to support multi-task parallelism and priority scheduling, and provides a mode switching decision interface for the evolutionary verification layer to trigger dynamic adjustments after effect evaluation.

[0086] Example 4 The present invention also provides an electronic device, including: a processor, a transmitting device, an input device, an output device, and a memory. The processor may be implemented using a general-purpose CPU (Central Processing Unit), a microprocessor, an application-specific integrated circuit, or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided in the embodiments of this application. The memory may be implemented using a read-only memory (ROM), a static storage device, a dynamic storage device, or a random access memory (RAM), and is used to store computer program code. The computer program code includes computer instructions. When the processor executes the computer instructions, the electronic device executes a method as described in any of the above possible implementation methods.

[0087] Example 5 The present invention also provides a computer-readable storage medium storing a computer program, the computer program including program instructions, which, when executed by a processor of an electronic device, cause the processor to perform a method as described in any of the above possible implementations.

[0088] In the description of this specification, the references to terms such as "an embodiment," "example," "specific example," etc., indicate that a specific feature, structure, material, or characteristic described in connection with that embodiment or example is included in at least one embodiment or example of the present invention. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples.

[0089] The above description is merely a specific embodiment of the present invention, enabling those skilled in the art to understand or implement the invention. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the invention. Therefore, the present invention is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features claimed herein.

Claims

1. A network attack adaptive response method based on multi-source threat intelligence fusion and AI decision-making, characterized in that, Includes the following steps: S110. Collect multi-source heterogeneous data and construct a cyberspace digital twin, including forming a real-time updated attribute knowledge graph as the cyberspace digital twin, wherein the cyberspace digital twin maps the physical network's assets, traffic, and log status in real time based on the attribute knowledge graph; S120. Based on the ATT&CK framework, perform deep threat correlation analysis on the cyberspace digital twin to generate an attacker's tactical intent map containing attack tactics and techniques. S130. Construct a multi-agent adversarial simulation environment based on the attacker's tactical intent map, use the Monte Carlo tree search algorithm to perform attack and defense game simulation, solve and output the dynamic optimal defense strategy. S140. Generate an executable defense action plan based on the dynamic optimal defense strategy, and distribute it to security devices for execution through automated orchestration. The defense action plan includes dynamic honeypot deployment instructions. S150. After the defense is executed, collect the actual attack and defense effect data, calculate the deviation between the actual attack and defense effect data and the game deduction prediction trajectory, and use the deviation to incrementally update and evolve the attacker's tactical intent map and defense strategy model.

2. The method according to claim 1, characterized in that, The step S110, which involves collecting multi-source heterogeneous data and constructing a cyberspace digital twin, specifically includes: capturing full traffic data and extracting application layer metadata through a deep packet inspection engine; collecting host security logs and process events using a lightweight proxy; calling an external threat intelligence platform API to obtain malicious IP and domain intelligence; cleaning, normalizing, and extracting entities from each data stream through a streaming processing pipeline; constructing an attribute knowledge graph containing IP, host, process entities, and associated edges; and maintaining the consistency of the graph's time window through a background cleanup task.

3. The method according to claim 1, characterized in that, The generation of the attacker's tactical intent graph in step S120 specifically includes: using a hybrid detection engine to perform parallel scanning of the attribute knowledge graph, wherein the hybrid detection engine includes a signature-based detector, a temporal anomaly detection model, and a graph pattern detection engine; performing spatiotemporal aggregation and causal correlation analysis on the generated atomic alarms to reconstruct the attack chain; and using a natural language processing model to perform similarity matching between the attack chain feature vector and the MITREATT&CK knowledge base to map out the specific tactical stages and technical means, thereby generating a structured attacker's tactical intent graph.

4. The method according to claim 1, characterized in that, The game theory simulation based on the multi-agent adversarial environment described in step S130 specifically includes: modeling the attacker as an attacker agent with an objective function and the defender as a defender agent, wherein the behavioral parameters of the attacker agent are initialized based on the probability distribution of the historical attack case library; defining a state space including asset status and network connectivity, an action space including blocking and decoy actions, and a reward function including business losses and defense gains; selecting, expanding, simulating, and backtracking in the adversarial simulation environment using the Monte Carlo tree search algorithm, calculating the long-term value of each defense action, and outputting the optimal hybrid strategy including the probabilities of blocking and decoy actions.

5. The method according to claim 1, characterized in that, The step S140, which involves generating an executable defense action plan based on the dynamic optimal defense strategy, specifically includes: converting the abstract optimal hybrid strategy into an instruction script containing action sequences, parameters, and dependencies; using an instruction converter to translate the instruction script into API call instructions for the corresponding brand of security devices, and attaching a digital signature; if the strategy includes active deception actions, instantiating a honeypot image that conforms to the current environment context in the virtualization resource pool, and redirecting attack traffic to the honeypot through a traffic bootstrap.

6. The method according to claim 1, characterized in that, It also includes a threat classification and response mode judgment step performed before step S130, specifically including: extracting the tactical stage of the attack, asset criticality, and propagation rate characteristics, and calculating a comprehensive threat urgency score; if the comprehensive threat urgency score is higher than a preset threshold, it enters the emergency response mode, triggers a preset rule base to execute a second-level rapid containment action, and simultaneously starts a game simulation in the background asynchronously; if the comprehensive threat urgency score is lower than the preset threshold, it enters the deep simulation response mode and directly enters step S130 to make a complete game decision; based on the simulation results and the actual situation, it supports smooth switching and strategy fusion between the emergency response mode and the deep simulation response mode.

7. A network attack adaptive response system based on multi-source threat intelligence fusion and AI decision-making, wherein the system applies the method described in any one of claims 1 to 6, characterized in that, include: The multi-source perception layer is used to collect multi-source heterogeneous data and construct a digital twin of cyberspace; the threat cognition layer is used to generate attacker tactical intent maps based on the ATT&CK framework; the dynamic game decision engine is used to construct a multi-agent adversarial simulation environment and solve dynamic optimal defense strategies; the strategy execution layer is used to generate and issue defense action plans, including a dynamic honeypot guidance and management module. The evolutionary verification layer is used to collect defense effectiveness data and drive incremental updates to the model.

8. The system according to claim 7, characterized in that, The dynamic game decision engine includes: an environment and agent modeling module, used to transform the attacker's tactical intent graph into a reinforcement learning state representation; a multi-agent adversarial simulation environment, used to define the attack and defense state transition function; a policy solver, which uses the Monte Carlo tree search algorithm to calculate the long-term value of defensive actions; and a defense plan generator, used to transform abstract policies into executable scripts containing conditional branches.

9. The system according to claim 8, characterized in that, The system also includes a response scheduler module added to the upper layer of the dynamic game decision engine, which is used to dynamically select the emergency response mode or the deep simulation response mode based on the threat urgency score.

10. An electronic device comprising a processor, a memory, and a computer program stored in the memory, characterized in that, When the processor executes the computer program, it implements the method as described in any one of claims 1 to 6.

Images