Attack intention-driven cloud native honey point dynamic arrangement method and system

Abstract

The invention provides an attack intention-driven cloud native honey point dynamic arrangement method and system, and relates to the technical field of network security. According to the system, a control plane log of a cloud environment is monitored in real time, a deep intention of an attacker is identified by using a deep reinforcement learning model, and an infrastructure, namely a code tool is driven to dynamically generate a high-simulation cloud native honey point, so that trapping, analysis and blocking of the attacker are realized.

Description

Technical Field

[0001] This invention relates to the field of network security technology, specifically to a method and system for analyzing attack intent using deep reinforcement learning and driving infrastructure-as-code tools for cloud-native dynamic honeypot orchestration. Background Technology

[0002] With the acceleration of enterprise digital transformation, cloud-native architecture has become the mainstream infrastructure. Unlike traditional data centers, cloud environments offer extremely rich API interfaces, elastic resource scheduling capabilities, and complex identity and permission systems. Attackers' tactics have also evolved accordingly, shifting from traditional exploitation of operating system vulnerabilities to API-level attacks targeting the cloud control plane, such as enumerating buckets using leaked credentials, probing unserviced functions, or stealing identity roles.

[0003] Currently, cloud security defense technologies mainly face the following pain points: ① Static honeypot resources, easily identifiable: Traditional honeypots are mostly deployed based on virtual machine images, possessing fixed IP addresses, hostnames, and fingerprint characteristics. Attackers can easily identify and bypass them through long-term reconnaissance or the use of automated tools, leading to the failure of deception. ② Lack of intent-awareness in defense methods: Existing defense systems are mostly based on rule matching, only able to identify known attack characteristics, unable to understand the deep tactical intent behind attackers' discrete API calls. The lack of intent analysis leads to rigid defense strategies, making targeted deception impossible. ③ Slow response and low automation: Existing proactive defense solutions often rely on manual configuration by administrators or are based on simple threshold triggers, resulting in slow response times and high maintenance costs, making it difficult to cope with automated attacks at machine speeds.

[0004] In conclusion, there is an urgent need for a cloud security defense technology to overcome the limitations of existing technologies. Summary of the Invention

[0005] This invention aims to solve the above-mentioned technical problems and provides a cloud-native honeypot dynamic orchestration method and system driven by attack intent.

[0006] This invention provides a cloud-native honeypot dynamic orchestration method and system driven by attack intent, comprising the following steps:

[0007] S1. Data Awareness and Intent Feature Extraction: Real-time collection of API call logs from the cloud environment control plane; parsing of the logs; extraction of API instruction sequences and contextual information to construct an intent feature vector representing the attacker's behavior; S2. Intelligent Decision-Making and Tactical Generation: Inputting the intent feature vector into a pre-trained deep reinforcement learning model; outputting honeypot orchestration instructions matching the current attack intent through model inference; S3. Dynamic Orchestration and Resource Instantiation: Responding to the honeypot orchestration instructions, calling the Infrastructure as Code (IaC) engine; parsing key information in the current attack intent context and converting it into configuration variables; dynamically injecting the configuration variables into a pre-set IaC template, thereby instantiating a cloud-native entity honeypot with dynamic attributes; S4. Closed-Loop Feedback and Model Optimization: Real-time monitoring of the interaction events between the cloud-native entity honeypot and the attacker; calculating the defense effect reward value and feeding it back to the deep reinforcement learning model to update the model parameters.

[0008] The beneficial effects of this invention are as follows:

[0009] A fine-grained intent-aware, parameterized dynamic orchestration linkage response mechanism was constructed. Unlike the static deployment of traditional honeypots, this invention innovatively uses attack intent characteristics as compilation parameters for Infrastructure as Code (IaC), enabling real-time resource construction capabilities.

[0010] It improves the API-level intent defense dimension for the cloud control plane. It solves the defense problems in the field of cloud-native API security and effectively resists identity theft and resource enumeration attacks.

[0011] It has achieved fully automated closed-loop operation. It has established a new cloud security operation model with rapid response and zero human intervention, which has significantly reduced the security operation costs for enterprises. Attached Figure Description

[0012] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in this invention. For those skilled in the art, other drawings can be obtained based on these drawings.

[0013] Figure 1 The present invention provides a flowchart of the steps of a cloud-native honeypot dynamic orchestration method and system driven by attack intent.

[0014] Figure 2 The present invention provides an overall functional module diagram of a cloud-native honeypot dynamic orchestration method and system driven by attack intent.

[0015] Figure 3The flowchart of the data perception and preprocessing module of a cloud-native honeypot dynamic orchestration method and system driven by attack intent provided by the present invention is shown.

[0016] Figure 4 The present invention provides a deep reinforcement learning decision brain module structure diagram for an attack intent-driven cloud-native honeypot dynamic orchestration method and system.

[0017] Figure 5 The present invention provides a flowchart of the dynamic orchestration execution module of a cloud-native honeypot dynamic orchestration method and system driven by attack intent.

[0018] Figure 6 The present invention provides a cloud environment feedback module flowchart for an attack intent-driven cloud-native honeypot dynamic orchestration method and system. Detailed Implementation

[0019] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0020] refer to Figure 1 The present invention provides a flowchart of the steps of a cloud-native honeypot dynamic orchestration method and system driven by attack intent.

[0021] S1: Data perception and intent feature extraction: Real-time collection of API call logs from the cloud environment control plane, parsing of the logs, and construction of intent feature vectors representing attacker behavior by extracting API instruction sequences and context information;

[0022] S2: Intelligent decision-making and tactical generation: Input the intent feature vector into a pre-trained deep reinforcement learning model, and output a honeypot arrangement signal that matches the current attack intent through model inference;

[0023] S3: Dynamic Orchestration and Resource Instantiation: In response to the honeypot orchestration signal, the Infrastructure as Code (IaC) engine is invoked to parse the key information in the current attack intent context and convert it into configuration variables. The configuration variables are then dynamically injected into a pre-set IaC template, thereby instantiating a cloud-native entity honeypot with dynamic attributes.

[0024] S4: Closed-loop feedback and model optimization: Real-time monitoring of the interaction events between the cloud-native entity honeypot and the attacker, calculation of the defense effect reward value and feedback to the deep reinforcement learning model to update the model parameters.

[0025] refer to Figure 2 This invention provides an attack intent-driven cloud-native honeypot dynamic orchestration method and system overall functional module diagram, which mainly includes four core modules: data perception and preprocessing module, deep reinforcement learning decision brain module, dynamic orchestration execution module, and cloud environment feedback module. The system forms a closed-loop control loop of perception-decision-execution-feedback.

[0026] Specifically, for the data perception and preprocessing module, refer to... Figure 3 This invention provides a cloud-native honeypot dynamic orchestration method driven by attack intent and a flowchart of the data awareness and preprocessing module of the system. The specific process includes:

[0027] This invention first performs multi-dimensional verification of the API caller's identity. The system maintains a dynamically updated whitelist, including root accounts, administrator roles, and trusted automated operation and maintenance roles. For each log entry, the system extracts its user identity information and calculates its similarity to the whitelist using a fuzzy matching algorithm. If a match is successful, the feature position is set to 1; otherwise, it is set to 0. This feature effectively reduces the false positive rate for normal operation and maintenance tasks.

[0028] Behavioral intent feature extraction is the most critical part of feature engineering. This invention, through in-depth analysis of attack patterns in cloud attack and defense frameworks such as StratusRed Team, constructs an intent mapping vocabulary containing 34 key APIs. The system employs one-hot encoding technology to transform discrete API names into computer-processable numerical vectors.

[0029] This thesaurus covers six major categories of attack intent. The first category is identity probing intent, indicating that the attacker is confirming their privileges. The second category is policy enumeration intent, indicating that the attacker is trying to find vulnerabilities in permission configuration. The third category is data asset discovery intent, indicating that the attacker is searching for sensitive data storage locations. The fourth category is database probing intent, indicating that the attacker's target is core business data. The fifth category is serverless architecture probing intent, indicating that the attacker is trying to steal code or exploit function vulnerabilities. The sixth category is sabotage and ransomware intent, indicating that the attacker has begun to carry out destructive actions.

[0030] To further improve recognition accuracy, the system also extracts error code status, read / write attributes, and tool fingerprint features. The system checks the error code field in the logs; if error codes such as "access denied" are present, it indicates that the operation may have been a failed attempt. The system determines whether the operation is read-oriented or write-oriented based on the event name; write-oriented operations typically have a higher risk level. In addition, the system performs keyword analysis on the user agent field to identify whether it contains characteristic strings of tools such as Kali and Terraform (open-source infrastructure i.e., code tools), and maps this information to numerical tool type features.

[0031] Finally, all the above features are concatenated into a floating-point vector of length 39, and combined into a temporal state matrix through a sliding time window, which serves as the environment state input for the reinforcement learning model.

[0032] Specifically, the deep reinforcement learning decision-making brain module, see reference. Figure 4 This invention provides an attack intent-driven cloud-native honeypot dynamic orchestration method and a deep reinforcement learning decision-making brain module structure diagram of the system. The specific process includes:

[0033] This invention designs an action space containing eight discrete actions. These eight actions correspond to different defensive tactics, and the agent needs to select the most suitable one based on the current state.

[0034] Action 0 represents allowing the operation. When the system determines that the current behavior belongs to normal business access or trusted operation and maintenance, this action is selected, and no intervention is performed to ensure business continuity.

[0035] Action 1 represents an identity decoy tactic. When the agent senses an intent to probe for identity, it instructs the execution module to deploy an identity-based honeypot. This is typically an IAM (Identity and Access Management) user with a tempting name but no actual permissions, along with their access key.

[0036] Action 2 represents a strategy-based trapping tactic. In response to the intent to enumerate permissions, the system generates fake IAM policy documents. These documents appear to grant high privileges but actually contain alarm triggers.

[0037] Action 3 represents a storage trap tactic. When an attacker scans the bucket, the agent selects this action, triggering a storage-based honeypot. This is a specially crafted S3 bucket (object storage service) containing fake sensitive files with digital watermarks.

[0038] Action 4 represents a database decoy tactic. In response to database probing, the system creates a honeypot containing records. This could be a fake managed relational database service instance record or a fully managed database service table entry, enticing the attacker to initiate a connection attempt.

[0039] Action 5 represents a computational decoy tactic. For probing serverless architectures, the system deploys a computational honeypot. This is a serverless computation service function containing fake code logic and hard-coded credentials, used to capture attackers' reverse engineering attempts.

[0040] Action 6 represents a network decoy tactic. While attackers conduct network reconnaissance, a honeypot is deployed on an EC2 (Elastically Scalable Virtual Server). This is an example of an instance where an SSH (Secure Shell) port is deliberately left open and contains fake command history logs to lure attackers into a highly interactive honeypot.

[0041] Action 7 represents a forceful blocking tactic. This action is selected immediately when the agent identifies clear sabotage intent or extortionate behavior. The system will then sever all access permissions of the attacker by modifying security group rules or IAM policies.

[0042] To train the agent to make correct decisions, this invention designs a sophisticated reward feedback mechanism. The reward function scores the agent's actions based on how well they match the actual attack intent.

[0043] If the agent accurately identifies the attack intent and selects the corresponding honeypot action, such as deploying a storage honeypot when an attacker scans an S3 bucket, the system will award a high positive reward. This encourages the agent to learn the mapping relationship between various attack behaviors and their best defense methods. If the agent misses an attack, i.e., chooses to allow the attack, the system will impose a severe negative penalty. This is to ensure system security, forcing the agent to take defensive measures rather than ignore uncertain risks. If the agent makes a false positive, i.e., takes defensive measures against normal traffic, the system will impose a slight negative penalty. This guides the agent to minimize interference with normal business and resource waste while ensuring security. In addition, this invention also introduces a policy consistency reward. If the agent identifies an attack but selects the wrong honeypot type, such as deploying a database honeypot during an S3 bucket scan, the system will impose a smaller penalty. This helps guide the agent not only to discover attacks but also to accurately classify attack intents, enabling targeted countermeasures.

[0044] By repeatedly training the PPO algorithm on simulated environments and real historical data, the neural network based on the Actor-Critic architecture continuously updates its parameters and ultimately learns the optimal defense strategy in various complex scenarios.

[0045] Specifically, for dynamically orchestrated execution modules, please refer to... Figure 5 This invention provides a cloud-native honeypot dynamic orchestration method and system dynamic orchestration execution module flowchart driven by attack intent. The specific process includes:

[0046] The abstract tactical intent output by the decision-making brain, combined with the attack context features extracted by the data awareness and preprocessing module, is transformed into specific IaC configuration parameters. The system pre-builds a Terraform template library containing various honeypot types. These templates only define the basic skeleton of the resources, while key attributes are designed as injectable variables.

[0047] Taking the storage-based honeypot module as an example, this template defines an S3 bucket resource. The template configures specific bucket policies, allowing objects to be publicly listed but preventing actual downloads, or allowing downloads but triggering CloudWatch (Amazon Web Services core observability service) alerts. The template also includes definitions of fake data objects; the system will automatically upload several related files when the bucket is created, based on contextual features extracted by the data awareness and preprocessing modules.

[0048] Taking the computational honeypot module as an example, the template defines a serverless computing service function resource and its execution role. Specific logic is embedded in the function's code package; when the function is called or the code is downloaded, it will proactively send alert information to the log server. Simultaneously, environment variables may contain fake database connection strings to lure attackers into subsequent lateral movement.

[0049] The system also dynamically generates association information to construct a honeypot chain. First, it creates an identity-based honeypot containing a fake access key, then injects this key as an environment variable into subsequently created EC2 honeypots. When an attacker compromises an EC2 instance, they will discover this key and attempt to use it, triggering the next stage of identity entrapment.

[0050] To control costs and prevent the abuse of honeypots, this module is also responsible for honeypot lifecycle management. Each dynamically generated honeypot resource is tagged with a specific tag, recording its creation time, associated attack event ID, and expiration date. The system runs a background cleanup process that periodically scans and destroys resources that have exceeded their expiration date or have completed their trapping mission. By executing destruction commands, this ensures that associated security groups, IAM roles, and network interfaces are completely removed, preventing honeypot resources from becoming springboards for hackers and ensuring an absolutely clean cloud environment.

[0051] Specifically, for the cloud environment feedback module, please refer to... Figure 6 This invention provides a cloud-native honeypot dynamic orchestration method driven by attack intent and a flowchart of the cloud environment feedback module of the system. The specific process includes:

[0052] This module constructs a feedback loop from cloud infrastructure to the intelligent decision-making brain. It is not only responsible for real-time monitoring of the survival status and interaction of honeypot resources, but more importantly, it undertakes the responsibility of quantifying the defense effect, transforming the complex results of attack and defense confrontations into mathematical reward signals that reinforcement learning algorithms can understand.

[0053] This module designs a real-time monitoring mechanism based on a cloud-native event bus, and deploys dedicated event listening rules for different types of honeypots.

[0054] Storage-based honeypot monitoring: When an S3 bucket honeypot is created, S3 bucket event notifications are configured simultaneously. Once an attacker performs file enumeration or file download operations on the honeypot, the S3 bucket service immediately generates a JSON-formatted event object and pushes it to a dedicated SQS (Simple Queuing Service) message queue. The feedback module subscribes to this queue to achieve rapid intrusion detection.

[0055] Computational Honeypot Monitoring: For serverless function honeypots, the system utilizes CloudWatch Logs (Amazon Web Services Log Management Core Service) subscription filters. When an attacker attempts to call the function, or when logic bomb code inside the function is executed, specific log patterns will be matched, triggering a serverless computing service trigger to send an alert to the feedback module.

[0056] Identity-based honeypot detection: For fake IAM users or AK / SK (access key / secret key), the system has configured audit rules for specific users in CloudTrail (Amazon Web Services Security Audit and Operations Tracking Service). Any API call initiated using this fake credential will be marked as a high-confidence intrusion event and broadcast to the feedback module via SNS (Simple Notification Service) topic.

[0057] After receiving the original interaction event, the feedback module will perform in-depth analysis and correlation analysis to distinguish between false alarms and real attacks, and determine the attack stage.

[0058] False alarm filtering: The module first checks the IP address and UserAgent of the triggering source. If the triggering source comes from an internal system health check probe or a known scanner whitelist, the event will be marked as an invalid interaction, no alarm will be triggered, and the decision-making brain will receive a slight negative reward.

[0059] Attack Phase Determination: The module categorizes events into three levels based on the depth of the interaction:

[0060] Level 1 Alert (Scanning / Touch): The attacker only performed a list query and did not download any content. This indicates that the honeypot has successfully attracted the attacker's attention, and the defense has achieved initial effectiveness.

[0061] Level 2 Alert (In-depth / Interactive): The attacker has downloaded the decoy file or attempted to log in to the EC2 honeypot. This indicates that the attacker has entered the trap, the system has recorded their IP fingerprint, and is preparing to trigger a block.

[0062] Level 3 Alert (Disruption / Exploitation): An attacker attempts to delete honeypot resources or exploit the honeypot for privilege escalation. This is the highest priority threat; the module immediately sends an emergency blocking signal to the execution module and sends an email notification to the administrator.

[0063] To enable the deep reinforcement learning model to learn from each attack and defense exercise, the feedback module designed a multi-dimensional reward function calculation engine, including rewards for successful trapping, penalties for failed defense, and penalties for resource depletion. Finally, the calculated reward value, along with the current state vector and the executed action, is packaged into an experience sample and written back to the experience replay buffer of the decision-making brain, completing a full closed-loop learning process.

[0064] In the description of this specification, references to terms such as "an embodiment," "example," "specific example," etc., indicate that a specific feature, structure, material, or characteristic described in connection with that embodiment or example is included in at least one embodiment or example of the invention. In this specification, illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples.

[0065] The preferred embodiments of the present invention disclosed above are merely illustrative of the invention. These preferred embodiments do not exhaustively describe all details, nor do they limit the invention to any specific implementation. Clearly, many modifications and variations can be made based on the content of this specification. This specification selects and specifically describes these embodiments to better explain the principles and practical applications of the invention, thereby enabling those skilled in the art to better understand and utilize the invention. The invention is limited only by the claims and their full scope and equivalents.

Claims

1. A cloud-native honeypot dynamic orchestration method driven by attack intent, characterized in that, Includes the following steps: S1: Data perception and intent feature extraction: Real-time collection of API call logs from the cloud environment control plane, parsing of the logs, and construction of intent feature vectors representing attacker behavior by extracting API instruction sequences and context information; S2: Intelligent decision-making and tactical generation: Input the intent feature vector into a pre-trained deep reinforcement learning model, and output a honeypot arrangement signal that matches the current attack intent through model inference; S3: Dynamic Orchestration and Resource Instantiation: In response to the honeypot orchestration signal, the Infrastructure as Code (IaC) engine is invoked to parse the key information in the current attack intent context and convert it into configuration variables. The configuration variables are dynamically injected into the pre-set templated IaC template, thereby instantiating a cloud-native entity honeypot with dynamic attributes. S4: Closed-loop feedback and model optimization: Real-time monitoring of the interaction events between the cloud-native entity honeypot and the attacker, calculation of the defense effect reward value and feedback to the deep reinforcement learning model to update the model parameters.

2. The method according to claim 1, characterized in that, The dimensional construction of the intent feature vector includes: based on a preset high-risk API mapping table, using one-hot encoding to map discrete API names to intent recognition features; the mapping table covers at least six types of attack intents: identity probe, permission enumeration, data discovery, database probe, serverless architecture probe, and ransomware attack; based on an identity whitelist library, extracting the identity confidence features of API callers; extracting contextual auxiliary features including error code status, read / write attributes, and tool fingerprints; and concatenating the above features and combining them with historical feature sequences within a sliding time window to form a high-dimensional temporal state vector.

3. The method according to claim 1, characterized in that, In step S2, the deep reinforcement learning model adopts an Actor-Critic architecture and is trained based on the Proximal Policy Optimization (PPO) algorithm. The honeypot orchestration instruction corresponds to one of the discrete action spaces, which includes at least: allow operation, deploy identity-based honeypot, deploy storage-based honeypot, deploy computation-based honeypot, deploy database honeypot, deploy network-based honeypot, and force block operation.

4. The method according to claim 1, characterized in that, In step S3, the specific process of dynamic injection includes: key information extraction, extracting the keywords retrieved by the attacker, the IP address of the attack source, or the fingerprint features of the tools used from the context of the attack intent; variable mapping and injection, mapping the keywords to name variables of honeypot resources, mapping the tool fingerprint to configuration variables of the honeypot runtime environment, and injecting them into the IaC template; honeypot chain construction, creating multiple honeypot resources with dependencies in sequence according to tactical needs, and injecting the access credentials of the preceding resources as environment variables into the subsequent resources to construct a deep trapping chain.

5. The method according to claim 1, characterized in that, The cloud-native entity honeypots include multimodal resource types: storage honeypots, which are object storage resources configured with specific access policies and decoy files; Computational honeypots are serviceless computational function resources with embedded alarm logic and fake environment variables; identity honeypots are identity and access management (IAM) credentials with enticing names but no actual management permissions.

6. The method according to claim 1, characterized in that, The process includes honeypoint lifecycle management steps: tagging each instantiated cloud-native entity honeypoint with a cloud tag containing the creation time and event ID; running a daemon process to periodically scan the tag; and calling the IaC engine's destruction command when the honeypoint's lifespan exceeds a preset threshold or a high-risk alarm is triggered to permanently clear the honeypoint resource and its associated configuration.

7. The method according to claim 1, characterized in that, In step S4, the calculation of the defense effect reward value includes: generating a first-level positive reward when it is detected that the attacker only performs a list query operation on the honeypot; generating a second-level high-value positive reward when it is detected that the attacker downloads the decoy file or attempts to use the credentials; generating a negative penalty when it is detected that the attacker successfully accesses real production resources; and constructing experience samples based on the reward values ​​and storing them in the experience replay buffer for model iteration.

Images