Attacker intention-driven host bait adaptive generation method

Abstract

The invention discloses an attacker intention-driven host bait adaptive generation method, and belongs to the technical field of network security protection. The method comprises the steps that important data needed in the bait generation process are initialized in a host machine, and a needed service program is installed in a bait host; analyzing the action record of the attacker in the trapping environment to identify the potential penetration intention of the attacker; generating a response action script by combining semantic comprehension and text generation capability of the multi-modal large language model, the action matrix of the intention-deception trapping system and the penetration intention of the attacker; and the trapping system executes a corresponding action according to the response action script and updates an intention-deception trapping system action matrix. By applying the method, the problems that a traditional trapping environment is insufficient in personalized configuration capacity, and the trapping environment lacks self-adaptive change can be solved. The use of the large language model can also reduce the dependence on the domain knowledge of safety personnel, reduce the workload and improve the bait generation efficiency.

Description

An attacker intent-driven adaptive host decoy generation method Technical Field

[0001] This invention relates to the field of network security protection technology, and specifically to an attacker intent-driven adaptive host decoy generation method. Background Technology

[0002] Proactive security defense refers to a security strategy that proactively detects, prevents, and defends against cybersecurity threats by deploying security measures in advance. This strategy includes not only defense against known threats but also defense against potential threats. Deception defense is a major category of proactive security defense methods. These methods do not focus on directly blocking attackers' actions but rather on preventing penetration by obfuscating the attack surface. Deception defense technology lures attackers by simulating target network resources. Its core idea is to create one or more virtual systems or services, making it difficult for attackers to distinguish between real systems and fake resources. This wastes the attacker's time, exposes their behavior, and diverts their attention, thus providing more security for the system. A representative product of deception defense technology is the honeypot. A honeypot is a system or network area deliberately designed to attract attackers. It looks like a valuable target but is actually a fully controlled system used to monitor and record attack activities. When attackers interact with the honeypot, they unknowingly reveal their attack methods, techniques, and procedures. Honeypots can collect information about threat actors, monitor attackers' interactions with systems in detail to analyze attack patterns, vulnerability exploits, and malware usage, and can also divert attackers' attention from their actual targets, thereby protecting critical assets. Honeybait, on the other hand, is a deception defense product different from honeypots. It is a fake piece of information or a fake resource, such as a file or a username / password pair. Because honeybait does not contain any meaningful information, anyone accessing or using this information can be considered an attacker or an unauthorized user. Furthermore, when a source tracing program is embedded in the honeybait file, it can help defenders pinpoint the attacker's IP address and obtain information related to the attacker's host.

[0003] While existing deception defense technologies can achieve highly realistic service and deception environments, the currently constructed deception and trapping environments still have the following shortcomings: First, there is a contradiction between uniformly configured host decoys and the personalized penetration intentions of different attackers. Existing high-interaction trapping environments generally employ high-interaction honeypot technology built on real physical hosts or virtualized host operating systems. Before startup, these high-interaction trapping environments deploy decoy elements such as programs, fake files, and fake accounts that the defender plans to present to the attacker. Once the high-interaction trapping environment is started, it will not actively modify the programs and data within the environment. However, each attacker has their own penetration intentions or attack preferences. In particular, advanced attackers will plan and set targets in advance, such as stealing critical data, extortion, or disrupting critical services. Pre-deployed decoys are difficult to actively trap and confirm the attacker's final penetration intentions. Second, the generation and configuration of current host decoys rely on expert knowledge. File decoys placed in the trapping environment are generally based on file templates generated by expert knowledge, and then the defender modifies some key fields according to the actual deployment environment during deployment. This approach lacks adaptability and flexibility to real-world usage scenarios. Similarly, programs launched in the decoy environment also rely on expert knowledge for pre-deployment and lack contextual consistency with the entire deception and decoy environment. Third, current decoy environments cannot proactively induce attackers to expose a complete chain of intent evidence. Traditional decoys can only provide defenders with high-confidence attack trigger signals, but the attacker's ultimate penetration intent can often only be inferred from a limited number of historical interactions, rather than proactively analyzing and verifying the attacker's ultimate penetration intent with high credibility by placing host decoys. Finally, current host decoy generation methods struggle to achieve intelligent understanding and adaptive generation of host-layer deception resources. Existing host decoy design and deployment methods remain at the stage of predefined templates and static configuration, lacking intelligent modeling and dynamic generation techniques.

[0004] In summary, there is an urgent need for a host-level adaptive decoy generation method to improve the shortcomings of existing deception and trapping environments. Summary of the Invention

[0005] The purpose of this invention is to provide an attacker intent-driven adaptive host decoy generation method. This method analyzes the attacker's potential penetration intent using an embedded language model combined with a large language model, and then designs response action scripts based on the large language model and penetration intent to achieve adaptive host decoy generation. This allows the defender to adaptively generate host decoys that best match the attacker's preferences based on the different potential penetration intents of various attackers. This invention significantly improves the attractiveness of the decoy environment, enhances its adaptability to different attack preferences, reduces the defender's reliance on expert knowledge, and improves the consistency between the decoy and the decoy environment context. It represents a new and effective tool in the field of proactive network attack defense to enhance the defender's proactive decoy capabilities, bringing new technological innovation and improvement to the field of network security, and effectively addressing the shortcomings summarized in the background art.

[0006] To achieve the above objectives, the present invention provides the following technical solution: an attacker intent-driven host decoy adaptive generation method, the decoy generation method comprising the following steps:

[0007] S1: The defender initializes the host decoy adaptive generation method on the host machine with key data such as the intent-deception trapping system action matrix and file decoy template, and at the same time installs the necessary service programs on the decoy host.

[0008] S2: When an attacker enters the trapping environment formed by the decoy host and interacts with the environment, the attacker's interaction action sequence in the trapping environment is input into the attacker's potential intent analysis process, which combines the embedded language model and the large language model, and then outputs the identification result of the attacker's next potential penetration intent.

[0009] S3: Combines the semantic understanding and text generation capabilities of a multimodal large language model with the action matrix of the intent-deception trapping system and the attacker's penetration intent to generate response action scripts.

[0010] S4: The decoy system runs response action scripts, thereby executing the processing actions for different types of decoys described in the scripts. Simultaneously, when the response action script executes successfully, the intent label and the corresponding action script are updated in the intent-deception decoy system action matrix.

[0011] In a preferred embodiment, the key data initialization process of the attacker intent-driven host decoy adaptive generation method includes: the defender's security personnel initialize the intent-deception trapping system action matrix, file decoy template, and multimodal large language model action script generated by the host machine based on the environmental context of the network where the protected asset is located; the defender pre-installs the necessary service programs on the decoy host; and the defender's security personnel check whether the data and service programs required for the above process are correctly configured and installed to complete the method initialization.

[0012] In a preferred embodiment, the attacker's potential penetration intent is analyzed based on the interaction logs of the attacker in the decoy environment using an embedded language model and a large language model. This includes: the decoy system records the interaction logs between the attacker and the decoy environment, and then extracts the attacker's attack command sequence from the interaction logs; the attack command sequence is converted into a corresponding attack command embedding vector using an embedded language model, and then the similarity between the attack command embedding vector and the intent embedding vector stored in the intent-deception decoy system's action matrix is ​​calculated. If the similarity exceeds a threshold, the intent label corresponding to the intent embedding vector is output; if the similarity is less than the threshold, the subsequent steps continue, combining the attack command sequence that does not match the intent label with the attacker intent inference prompt word template to form the attacker intent inference prompt word, and then inputting the prompt word into the large language model. The output of the large language model is the attacker's next penetration intent label and intent description.

[0013] In a preferred embodiment, the response action script generation based on a large language model includes: comparing the aforementioned intent tags with intent tags in the intent-deception trapping system action matrix; if the same intent tag exists in the intent-deception trapping system action matrix, the response action script corresponding to the intent tag is output; if no matching intent tag exists, the previously obtained intent tag and intent description are inserted into a deceptive response action design prompt template, and the interaction logs between the attacker and the trapping environment and the description information of the trapping environment are inserted into the prompt template to form response action design prompts. The response action design prompts are input into a multimodal large language model to obtain a dynamically adaptively generated response action script.

[0014] In a preferred embodiment, the decoy system response action script execution process includes: the decoy system response action execution program running on the decoy host reads the aforementioned response action script, and then uses the script execution engine to run the response action script to achieve script execution; if the script execution process is successful, the response action script and the corresponding intent tag and related information are updated to the intent-deception decoy system action matrix; if the script execution process fails, the execution of the response action script is stopped and a failure log is recorded.

[0015] The technical effects and advantages provided by the present invention in the above technical solution are as follows:

[0016] This invention, after initializing the key data and service procedures required by the defender's initialization method, analyzes the interaction sequence between the attacker and the decoy environment using embedded language models and multimodal large language models to obtain the attacker's next potential penetration intent in the current state. Then, based on the obtained potential penetration intent, a multimodal large language model is used to dynamically generate response action scripts that conform to the attacker's penetration intent. Finally, the decoy system executes the corresponding response action scripts to achieve personalized decoy design for different attacker penetration intents. This method provides a new technical option for building more attractive decoy environments in the field of deception defense, allowing defenders to significantly improve the personalization of the decoy environment by adding an adaptive host decoy generation process, building upon existing deception decoy environment construction techniques. Our method employs cutting-edge large language model technology to analyze attacker intent and design response action scripts, thus achieving the most intelligent adaptive host decoy generation method currently available. The realization of this invention will greatly enhance the attractiveness of the decoy environment and its adaptability to different attack preferences, reduce the defender's reliance on expert knowledge, and improve the consistency between the decoy and the context of the decoy environment. It is a new and effective tool for improving proactive decoy capabilities in the field of proactive defense against network attacks, bringing new technological innovations and improvements to the field of network security. Attached Figure Description

[0017] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in this invention. For those skilled in the art, other drawings can be obtained based on these drawings.

[0018] Figure 1 is a flowchart of the method of the present invention.

[0019] Figure 2 is a schematic diagram illustrating the overall process of adaptive generation of host decoys according to the present invention.

[0020] Figure 3 is a schematic diagram of the processing flow of an attacker intent-driven host decoy adaptive generation method provided in an embodiment of the present invention when obtaining the attacker's potential penetration intent.

[0021] Figure 4 is a schematic diagram of the processing flow of an attacker intent-driven host decoy adaptive generation method when a response action script is obtained, according to an embodiment of the present invention.

[0022] Figure 5 is a schematic diagram of the processing flow of an attacker intent-driven host decoy adaptive generation method provided in an embodiment of the present invention when performing a trapping system response action. Detailed Implementation

[0023] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0024] Example: Please refer to Figures 1 to 5. This example describes an attacker intent-driven adaptive host decoy generation method. The selection method includes the following steps:

[0025] S1: The defender initializes the host decoy adaptive generation method on the host machine with key data such as the intent-deception trapping system action matrix and file decoy template, and at the same time installs the necessary service programs on the decoy host.

[0026] S2: When an attacker enters the trapping environment formed by the decoy host and interacts with the environment, the attacker's interaction action sequence in the trapping environment is input into the attacker's potential intent analysis process, which combines the embedded language model and the large language model, and then outputs the identification result of the attacker's next potential penetration intent.

[0027] S3: Combines the semantic understanding and text generation capabilities of a multimodal large language model, the action matrix of an intent-deception trapping system, and the attacker's penetration intent to generate response action scripts.

[0028] S4: The decoy system runs response action scripts, thereby executing the processing actions for different types of decoys described in the scripts. Simultaneously, when the response action script executes successfully, the intent label and the corresponding action script are updated in the intent-deception decoy system action matrix.

[0029] The specific steps are as follows:

[0030] S1: The defender initializes the key data required for the host decoy adaptive generation method on the host machine and installs the necessary service programs on the decoy host.

[0031] In this invention, it is assumed that the decoy environment runs in an isolated virtual host, while a host machine runs outside the virtual host. The data placed at the host level is called host decoy, and this invention categorizes host decoys into file decoys, program decoys, and social decoys. File decoys refer to decoys created based on common document types on computers, such as doc, pptx, and xls decoys. Program decoys refer to programs running on the computer, such as the running MySQL program. Social decoys refer to false information actively exposed to the attacker through chat logs from social communication software.

[0032] Based on the above assumptions, the method of this invention requires the defender to initialize data such as the intent-deception trapping system action matrix, file decoy templates, and defense function libraries that can be directly used when generating action scripts using the multimodal large language model on the host machine at the beginning, for subsequent steps. The intent-deception trapping system action matrix is ​​a logical storage structure where each row corresponds to an attacker's penetration intent and the corresponding trapping system response action. Each row should include the following columns: attack command sequence features, intent label, intent description, associated action script, intent embedding vector, and source. The attack command sequence features are feature descriptions formed by extracting attacker command sequences from datasets or real-world interaction scenarios. The intent label represents the name of the intent, the intent description is a detailed explanation of the intent, the associated action script represents the action the trapping system should execute (the specific action sequence is stored and executed as a program script), and the intent embedding vector is a vectorized representation of the attack command sequence features, used to quickly classify and discover the penetration intent hidden in the attacker's command sequence based on the embedding model during the intent recognition stage. The source indicates whether the rule comes from initial settings or is automatically generated by the multimodal large language model. During the initialization of the intent-deception decoy system's action matrix, several pre-defined attack intents and response action scripts are loaded. These pre-loaded records come from open-source threat intelligence analysis and network traffic datasets. By analyzing the attacker's frequently executed attack command sequences and the file or service records returned by the victim host, a mapping relationship is formed between the attacker's attack command sequences, the attacker's penetration intent, and the victim host's response content, thus forming the matrix records. File decoy templates are created by pre-inserting source-tracing programs into blank files of common file types. These templates are used to insert dynamically generated file content when the decoy system executes its response action scripts, thus forming decoy files. The defense function library defines several commonly used decoy generation functions, such as file forgery functions, program start / stop functions, and social decoy insertion functions. Furthermore, the defender needs to pre-install usable service programs, such as WeChat and MySQL services, on the decoy host to quickly launch the corresponding programs when generating the decoy.

[0033] S2: Based on embedded language models and large language models, analyze the attacker's attack command sequence in the trapping environment to obtain the attacker's potential penetration intent.

[0034] The execution flow of an attacker's potential penetration intent, analyzed based on embedded language models and large language models, is shown in Figure 3 of the manual. Attackers entering the trapping environment through network penetration generally establish interaction with the target system in two ways: one is by connecting to the target system via SSH service to execute commands, and the other is by implanting a backdoor for command execution and obtaining a terminal environment capable of executing commands through a reverse shell. Both methods can be monitored by the trapping environment, which then reads the commands sent by the attacker to the trapping environment and the terminal display content returned by the trapping environment to the attacker. When the attacker interacts with the trapping environment in the above ways, the trapping environment obtains the interaction log between the attacker and the trapping environment. The interaction log is paired according to the attacker's requests and the corresponding trapping environment responses, and then arranged in chronological order to obtain the attacker command-trapping system response interaction sequence. The attack commands in this sequence are extracted sequentially to obtain the attack command sequence.

[0035] The aforementioned attack command sequence is converted into an attack sequence feature vector using an embedding language model. Then, the cosine similarity between this attack sequence feature vector and the intent embedding vector stored in the intent-deception trapping system's action matrix is ​​calculated. If the similarity exceeds a threshold, the potential intent of the attack command sequence is considered to match the intent label corresponding to the intent embedding vector. In this case, the corresponding intent label and intent description are output as the inference result of the attacker's potential penetration intent. If no intent embedding vector has a similarity exceeding the threshold, i.e., the attacker intent inference based on the embedding language model fails, then the attacker penetration intent reasoning process based on a multimodal large language model is used. In this process, this invention designs an "attacker intent inference" prompt template. This prompt template uses a thought chain technique to progressively decompose the implementation steps of attacker intent analysis. Simultaneously, it combines few-shot learning to add common attack command sequences and their corresponding potential attacker intents as examples to the prompt template, and adds detailed explanations from the attack command sequence to the potential penetration intent reasoning in the examples. Then, the aforementioned attack command sequence is embedded into the "attacker intent inference" prompt template to form the prompt. Finally, to avoid duplicate intent labels, existing intent labels and intent descriptions from the intent-deception trapping action matrix are also added to the prompt words. During this process, if the number of tokens for the prompt words exceeds the context window size of the large language model, the oldest attack command is discarded, and the most recent attack command is retained, thus forming a truncated attack command sequence until the number of tokens for the input prompt words is less than the context window size of the large language model. The prompt words are then input into the large language model, and the output is the attacker's intent inference result derived from the attack command sequence, i.e., the intent label and intent description.

[0036] S3: Combines the semantic understanding and text generation capabilities of a multimodal large language model with the action matrix of the intent-deception trapping system and the attacker's penetration intent to generate response action scripts.

[0037] Once the decoy system has deduced the attacker's current penetration intent, the next step is to select or generate a suitable response action script based on that intent. The execution flow for generating the response action script is shown in Figure 4 of the manual. When an intent tag is received, the system first quickly searches the intent-deception decoy system's action matrix to confirm if a matching intent tag exists. If the search is successful, the corresponding response action script is immediately returned.

[0038] When the intent tag fails to be retrieved in the intent-deception trapping system's action matrix, the multimodal large language model is invoked to dynamically generate a response action script. Similarly, to generate high-quality response action scripts, this invention designs a "Response Action Script Design" prompt template. This prompt template contains instructions for the large language model to design the response action script, as well as examples of generating response action scripts based on the attacker's penetration intent to help the large language model understand the script generation task. The prompt template also includes necessary content placeholders, including the defense function library available for the action script, the file system information of the decoy host, the network information of the trapping environment, and the attacker's command-trapping system response interaction sequence. The defense function library available for the action script consists of pre-designed utility functions by security personnel to reduce the number of characters required for the large language model to write action scripts. The defense function library includes file forgery functions, program start / stop functions, and social decoy insertion functions. The file forgery function receives a JSON-formatted function parameter object. File-related operations are then defined within this JSON-formatted object. For example, a function named `fake_txt_create` is defined for spoofing TXT files. This function accepts a JSON parameter named `params`, which contains the following fields: `{"path": the location where the decoy file is placed in the trapping environment, "file_name": the name of the decoy file, "file_content": the content of the decoy file}`. Different file types can have corresponding file creation functions designed. This reduces the number of characters in the generated script and the probability of script failure due to code generation errors. Furthermore, because a custom decoy file creation function is used, security personnel can insert beacons or other traceability code into the generated decoy file during its execution. When an attacker downloads and opens the file locally, it can report the attacker's IP address and host information to the defender, facilitating the defender's ability to trace the attacker. The program start / stop function takes the input program name and the manipulation of program execution, such as starting or stopping the program. The social decoy insertion function takes the desired chat history as input, and when the function executes, it calls a host machine with the same social software installed to send the desired chat history information to the decoy host.

[0039] S4: The trapping system runs the response action script, and then updates the record of the intent-deception trapping system action matrix based on the script execution.

[0040] The execution flow of the decoy system's response action script is shown in Figure 5 of the manual. During the decoy action execution phase, the decoy system receives the response action script generated in the previous phase and then executes it on the decoy host. By executing the response action script on the decoy host, a decoy file matching the attacker's intent is created in the decoy environment, the decoy program is activated, and the social decoy is displayed. The host machine monitors the execution status of the action script on the decoy host. If the above action script execution process is successful, the intent tag and the corresponding action script are updated in the intent-deception decoy system action matrix. In the intent-deception decoy system action matrix, the intent tag corresponds to the intent tag, the intent description corresponds to the intent description, the attack command sequence feature is the attack command sequence extracted from the attacker's interaction record with the decoy environment, the associated action script is the successfully executed action script, and the intent embedding vector is the embedding vector obtained by vectorizing the attack command sequence through an embedding language model; the source is marked as automatically generated. Conversely, if the action script fails to execute, the host machine logs the failure. This log is used by security operations personnel to update the implementation of the trapping system and correct errors. More importantly, it clears the impact of the action script failure on the trapping environment. For example, if the action script expects to create two bait files but an error occurs during execution, resulting in only one bait file being created, then the newly created bait file should be cleared to restore the trapping environment to the state before the action script was executed.

[0041] This application, after obtaining the key data and service procedures required by the defender's initialization method, analyzes the interaction sequence between the attacker and the decoy environment using embedded language models and multimodal large language models to obtain the attacker's next potential penetration intent in the current state. Then, based on the obtained potential penetration intent, a multimodal large language model is used to dynamically generate response action scripts that conform to the attacker's penetration intent. Finally, the decoy system executes the corresponding response action scripts to achieve personalized decoy settings for different attacker penetration intents. This method provides a new technical option for building more attractive decoy environments in the field of deception defense, allowing defenders to significantly improve the personalization of the decoy environment by adding an adaptive host decoy generation process to existing deception decoy environment construction techniques. Our method employs state-of-the-art large language model technology to analyze attacker intent and design response action scripts, thus achieving the most intelligent adaptive host decoy generation method currently available. The realization of this invention will greatly enhance the attractiveness of the decoy environment and its adaptability to different attack preferences, reduce the defender's reliance on expert knowledge, and improve the consistency between the decoy and the decoy environment context. It is a new and effective tool for improving proactive decoy capabilities in the field of proactive defense against network attacks, bringing new technological innovations and improvements to the field of network security.

[0042] The host-based decoy adaptive generation method proposed in this application has the following effects:

[0043] 1) Increase the personalization of the deception and trapping environment: By analyzing the different potential penetration intentions of attackers and combining environmental context information, corresponding deception and decoy designs are dynamically generated to improve the personalization of the trapping environment.

[0044] 2) Balancing personalized decoy generation with cost: This invention pre-sets some common response action scripts by setting an intent-deception trapping system action matrix, reducing the need for dynamic generation of large language models, thereby reducing the need for computing resources and improving the average response speed of the trapping system.

[0045] 3) Reduce reliance on expert knowledge in host decoy generation: Based on the vast knowledge obtained by pre-training a large language model on massive amounts of data, the large language model is used to intelligently generate response action scripts according to the environmental context, historical interaction sequences and attacker penetration intent, thereby greatly reducing the reliance on expert knowledge in the decoy generation process and reducing the effort required by security personnel.

[0046] 4) Enriches the available host decoy types: This invention enriches the available decoy types in existing trapping environment construction methods, and innovatively proposes the concept of social decoys, providing the defender with the possibility of constructing a richer and more diverse trapping environment.

[0047] In the description of this specification, references to terms such as "an embodiment," "example," "specific example," etc., indicate that a specific feature, structure, material, or characteristic described in connection with that embodiment or example is included in at least one embodiment or example of the invention. In this specification, illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples.

[0048] The preferred embodiments of the present invention disclosed above are merely illustrative of the invention. These preferred embodiments do not exhaustively describe all details, nor do they limit the invention to any specific implementation. Clearly, many modifications and variations can be made based on the content of this specification. This specification selects and specifically describes these embodiments to better explain the principles and practical applications of the invention, thereby enabling those skilled in the art to better understand and utilize the invention. The invention is limited only by the claims and their full scope and equivalents.

Claims

1. An attacker intent-driven adaptive host decoy generation method, characterized in that: The selection method Includes the following steps: S1: The defender initializes key data such as the intent-deception trapping system action matrix and file decoy templates required for the host decoy adaptive generation method on the host machine, and installs the necessary service programs on the decoy host. S2: When the attacker enters the trapping environment formed by the decoy host and interacts with it, the attacker's interaction action sequence in the trapping environment is input into an attacker's potential intent analysis method combining embedded language models and large language models. The result is then outputting the identification result of the attacker's next potential penetration intent. S3: Combining the semantic understanding and text generation capabilities of the multimodal large language model, the intent-deception trapping system action matrix, and the attacker's penetration intent, a response action script is generated. S4: The trapping system runs the response action script, thereby executing the generation actions of different types of decoys described in the script. Simultaneously, when the response action script executes successfully, the intent label and the corresponding action script are updated in the intent-deception trapping system action matrix.

2. The attacker intent-driven host decoy adaptive generation method according to claim 1, characterized in that: This is a defense function library that the defender can directly use when initializing and configuring the host decoy adaptive generation method on the host machine, specifically for the intent-deception trapping system action matrix, file decoy templates, and multimodal large language model-generated action scripts. Optional service programs are pre-installed on the decoy host by the defender.

3. The attacker intent-driven host decoy adaptive generation method according to claim 2, characterized in that: The trapping system records the interaction logs between the attacker and the trapping environment, and then extracts the attacker's attack command sequence from the logs. This sequence is converted into corresponding attack command embedding vector representations using an embedding language model. The similarity between these embedding vectors and the intent embedding vector representations stored in the intent-deception trapping system's action matrix is ​​then calculated. If the similarity exceeds a threshold, the intent label corresponding to the intent embedding vector representation is output. If the similarity is less than the threshold, the intent is inferred using a large language model. The attack command sequence is combined with an attacker intent inference prompt template to form attacker intent inference prompts. These prompts are then input into the large language model, whose output represents the attacker's next penetration intent label and intent description.

4. The attacker intent-driven host decoy adaptive generation method according to claim 3, characterized in that: The intent tags obtained in step 2 are compared with the intent tags in the intent-deception trapping system action matrix. If the same intent tag exists in the intent-deception trapping system action matrix, the corresponding response action script is output; otherwise, a multimodal large language model is used to dynamically generate the response action script. The intent tags and intent descriptions obtained in step 2 are inserted into the deceptive response action design prompt template. Simultaneously, the interaction logs between the attacker and the trapping environment, as well as the description information of the trapping environment, are inserted into the prompt template to form the final response action design prompt. The response action design prompt is then input into the multimodal large language model to obtain the dynamically generated response action script.

5. The attacker intent-driven host decoy adaptive generation method according to claim 4, characterized in that: The decoy system's response action execution program, running on the decoy host, executes the actions described in the response action script obtained in step 3, thereby deploying the decoy on the decoy host. If the response action script executes successfully, the successfully executed response action script and the corresponding intent label are updated in the intent-deception decoy system action matrix; otherwise, the execution of the response action script is stopped, and a failure log is recorded.

Images