Self-adaptive defense method and system, computer equipment and storage medium

Abstract

The invention provides a self-adaptive defense method and system, computer equipment and a storage medium, and belongs to the technical field of network and information security, and the method comprises the steps: collecting abnormal network state data when a target network is attacked, and automatically extracting attack feature elements from the abnormal network state data; and generating an accurate network detection rule in real time according to the elements, and dynamically loading the network detection rule to a flow detection engine through a hot update technology, thereby realizing rapid perception and alarm of unknown threats. Suspicious processes are positioned through port-process mapping, and remote blocking, termination or isolation and other treatment actions are automatically executed; and integrating a disposal record and a system log to construct an attack causal graph, forming a complete and visual attack evidence chain, and supporting influence range evaluation and defense strategy iterative optimization. According to the method, thorough defense from threat perception, rule generation, real-time blocking to traceability analysis is realized, and the autonomous response and dynamic adaptive capacity of the network in facing novel and complex attacks are effectively improved.

Description

Technical Field

[0001] This invention belongs to the field of network and information security technology, and specifically relates to an adaptive defense method, system, computer device and storage medium. Background Technology

[0002] As network infrastructure and business systems become increasingly complex, cyberattacks are exhibiting greater stealth and diversity. New threats such as Advanced Persistent Threats (APTs), zero-day vulnerabilities, supply chain intrusions, and adversarial examples are constantly evolving, making traditional defense systems that rely on manually maintained signature databases and static rule engines ineffective. These threats are often quite accurate in recognizing known patterns, but lack real-time response capabilities to unknown attacks, and lack global analysis and timely blocking methods in multi-stage attack chain scenarios.

[0003] To address these issues, researchers have begun exploring proactive defense methods based on artificial intelligence. In recent years, large-scale AI models have made breakthroughs in fields such as natural language processing, image recognition, and code generation, and their value in cybersecurity defense is increasingly evident. Research shows that large-scale AI models can capture nonlinear feature relationships from massive logs and traffic data, significantly improving the accuracy of situational awareness and threat prediction. Simultaneously, their global modeling capability for lateral threats helps to quickly identify attack chains across nodes and domains. For example, large-scale models can mine complex relationships from massive logs and traffic; using them to perform semantic analysis on attack "probe" sampling data can locate vulnerabilities and provide remediation suggestions within minutes, while traditional manual processing often takes 1-2 days.

[0004] Regarding the evolution of defense architectures, existing research has proposed combining deep learning algorithms (such as CNN and LSTM) with big data platforms to form intelligent defense systems with high concurrency processing capabilities. These systems can not only automatically extract the spatial-temporal features of traffic and logs, but also dynamically adjust response behavior through adaptive strategies, avoiding over-defense or delayed responses. Especially under high-load environments, deep learning-based detection engines can identify malicious requests and abnormal access in real time, realizing an analysis system from "detection-analysis-handling" to "feedback optimization."

[0005] Meanwhile, adversarial AI presents new challenges and opportunities for defense systems. Attackers use generative adversarial networks (GANs) or gradient attack methods to create malicious samples that can bypass detectors or deceive automated response systems by interfering with reward functions. Correspondingly, defenders are beginning to adopt techniques such as adversarial training and model validation to enhance the robustness of detectors, and are attempting to introduce reinforcement learning (RL) to achieve policy adaptation, enabling defense mechanisms to continuously evolve and thus improve their immunity to unknown attacks.

[0006] In engineering practice, multi-agent collaborative decision-making has become a key path to enhance the autonomy of network defense. By deploying attack and defense agents on different nodes of the network topology and optimizing their strategies based on reinforcement learning, the computational burden in complex environments can be significantly reduced, enabling rapid response to multi-step attacks. Such methods have been demonstrated in some patented solutions, such as automatically generating detection strategies by combining Sigma rules and threat intelligence, and then optimizing decisions through multi-agent game theory, thereby strengthening the initiative of the defense system in dynamic game theory.

[0007] Furthermore, existing domestic methods indicate that AI-based security prediction and adaptive defense have become an important frontier direction in cybersecurity. For example, some methods collect network-wide data using distributed probes, construct predictive models using bidirectional LSTM and attention mechanisms, and recursively extract multi-dimensional threat characteristics such as abnormal connections, malicious code, Structured Query Language (SQL) injection, and Distributed Denial of Service (DDoS) attacks. These characteristics are then combined with topology information for attack touchpoint analysis and risk classification, ultimately outputting differentiated defense strategies. Other methods leverage deep learning to extract features from historical data and real-time interaction information, adjusting defense strength based on risk coefficients to enhance the resilience and adaptability of the defense system.

[0008] In summary, cybersecurity is moving from "static defense" to "intelligent, adaptive proactive defense." Future defense systems should be able to integrate the semantic understanding capabilities of large AI models, the feature representation capabilities of deep learning, and the strategy optimization advantages of reinforcement learning. Simultaneously, they should combine causal analysis and knowledge graphs to accurately reconstruct attack chains, providing technical support for high-intensity, low-latency dynamic defense.

[0009] However, the aforementioned technologies still have shortcomings. First, most existing systems emphasize "detection" and "prediction," but pay less attention to the automated generation and real-time distribution of rules. Once the model identifies a new threat, there is a lack of a mechanism to directly convert it into detection rules, resulting in a lag in policy updates. Second, research on attack paths and causal relationships is limited, usually remaining at the log-level backtracking, lacking the ability to trace the entire chain of attacks by combining topology and process information. This makes it difficult for defense measures to accurately target the source of the attack or key nodes. Furthermore, the handling of abnormal processes often relies on manual intervention, with insufficient automation, making it difficult to meet the need for immediate response to high-frequency attacks. To address the problems of lagging rule updates, coarse-grained tracing, and insufficient automation in the handling of existing defense systems... Summary of the Invention

[0010] To address the problems of lagging rule updates, coarse granularity of source tracing, and insufficient automation in existing defense systems, this invention provides an adaptive defense method, system, computer equipment, and storage medium.

[0011] To achieve the above objectives, the present invention provides an adaptive defense method, comprising: Collect abnormal network state data when the target network system is under attack, and extract attack detection elements including IP address, port range, network protocol, payload characteristics and behavior sequence from the abnormal network state data.

[0012] Based on the attack detection elements, network detection rules are generated; and the network detection rules are loaded into the detection engine of the target network system. The detection engine is used to detect the network traffic of the target network system in real time. If an attack matching the network detection rules is found, an alarm event and system log are recorded. Based on the alarm event, a mapping relationship between network ports and network processes is established. The mapping relationship is used to locate suspicious processes and automatically issue remote handling actions.

[0013] Based on the remote handling actions, alarm events, and system logs, an attack evidence chain is constructed, and the target network system performs adaptive defense based on the attack evidence chain.

[0014] Preferably, generating network detection rules based on the attack detection elements specifically includes: The threat characteristics are analyzed from the attack detection elements, including protocol type, IP address, port range, payload mode, key calls, and behavioral tags. The attack patterns and triggering conditions of the threat features are identified through protocol semantic analysis, regular expression pattern mining, and statistical modeling algorithms. Select a rule template according to the syntax specification of the target network system detection engine, and fill the rule template with the attack mode and triggering conditions to form candidate rules; The candidate rules are simulated offline in a sandbox environment to test and select effective rules that meet the preset detection rate, false alarm rate and performance requirements. The effective rules are then used to form network detection rules.

[0015] Preferably, the network detection rule is in the Suricata rule format; the Suricata rule format includes matching direction, port range, network protocol and payload characteristic fields; a hot update mechanism is used to load the network detection rule into the detection engine of the target network system, so that the network detection rule takes effect without interrupting the operation of the detection engine.

[0016] Preferably, a mapping relationship between network ports and network processes is established based on the alarm event. The mapping relationship is used to locate suspicious processes and automatically issue remote handling actions. Specifically, this includes: obtaining historical data of network ports and network processes; obtaining the mapping relationship between network ports and network processes in real time through the system interface; locating suspicious processes after comparing the mapping relationship with the historical data; and then issuing remote handling actions to the suspicious processes through a security agent.

[0017] Preferably, before issuing the remote handling action to the suspicious process through the security agent, the method further includes: the target network system performing a host-level preset whitelist verification and setting a rollback plan; after issuing the remote handling action to the suspicious process through the security agent, the method further includes: transmitting back the execution result of the remote handling action and the hash signature of the network process for auditing and tracing; the remote handling action includes terminating the network process, blocking the network connection, and isolating the host network.

[0018] Preferably, based on the remote handling actions, alarm events, and system logs, an attack evidence chain is constructed. The target network system performs adaptive defense based on the attack evidence chain. Specifically, this includes: constructing an attack causal graph using the alarm events, handling actions, and system logs as inputs. The attack causal graph uses the target network system's hosts, network processes, port ranges, network detection rules, and timestamps as nodes, and attack event triggering relationships as edges. The attack causal graph is transformed into an attack evidence chain by deriving the attack sequence and dependency chain through a causal reasoning algorithm; and adaptive defense is performed based on the attack evidence chain.

[0019] Preferably, the method further includes generating a defense report based on the attack evidence chain, which includes a list of detection rules, attack hit paths, details of handling actions, and the evidence chain; simultaneously extracting a feature summary that can be reproduced by the attacker from the attack evidence chain; and using an online multi-armed slot machine or Bayesian optimization algorithm, under resource constraints, iteratively optimizing the network detection rules and remote handling actions based on the feature summary to strengthen the adaptive defense method of the target network system.

[0020] The present invention also provides an adaptive defense system, comprising: The element extraction module is used to collect abnormal network state data when the target network system is attacked, and extract attack detection elements including IP address, port range, network protocol, payload characteristics and behavior sequence from the abnormal network state data.

[0021] The action generation module is used to generate network detection rules based on the attack detection elements; load the network detection rules into the detection engine of the target network system, use the detection engine to perform real-time detection of network traffic of the target network system, and record alarm events and system logs when an attack matching the network detection rules is found; establish a mapping relationship between network ports and network processes based on the alarm events, use the mapping relationship to locate suspicious processes, and automatically issue remote action.

[0022] The prevention module is used to construct an attack evidence chain based on the remote handling actions, alarm events, and system logs, and the target network system performs adaptive defense based on the attack evidence chain.

[0023] The present invention also provides a computer device, including a memory, a processor, and a computer program stored in the memory, wherein the processor executes the computer program to implement the steps of any one of the adaptive defense methods.

[0024] The present invention also provides a computer-readable storage medium storing a computer program that, when loaded by a processor, can execute any of the steps in the adaptive defense method.

[0025] The adaptive defense method provided by this invention has the following beneficial effects: Its core advantage lies in upgrading network defense from a delayed manual response to instantaneous automated defense. The target network system can automatically extract features from any attack and instantly generate detection rules, rendering the same attacker's methods immediately ineffective across the entire network, greatly increasing the cost of attacks and completely blocking the reusability of attacks. Once an alarm is triggered, the system can accurately locate malicious processes through port-process mapping and automatically execute termination, blocking, and other actions, no longer giving attackers a time window for lateral movement and concealment. The attack causal graph automatically constructed by the system can connect fragmented attack evidence into a complete attack route map, clearly revealing the attack source, path, and intent, providing a solid basis for accurate tracing and countermeasures, completely depriving attackers of their concealment, and effectively solving the problems of lagging rule updates, coarse granularity of tracing, and insufficient automation in existing technical defense systems. Attached Figure Description

[0026] To more clearly illustrate the embodiments and design schemes of the present invention, the accompanying drawings required for this embodiment will be briefly described below. The drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0027] Figure 1 This is a flowchart of an adaptive defense method according to an embodiment of the present invention; Figure 2 This is a schematic diagram of the structure of an adaptive defense method according to an embodiment of the present invention; Figure 3 This is an example of rule generation and automatic distribution in an embodiment of the present invention; Figure 4 The diagram shown in this embodiment of the invention is a flow monitoring and alarm diagram; Figure 5 This is a flowchart illustrating the abnormal process analysis and handling process according to an embodiment of the present invention; Figure 6 This is a schematic diagram illustrating the cause-and-effect tracing of an attack, as described in an embodiment of the present invention. Detailed Implementation

[0028] To enable those skilled in the art to better understand and implement the technical solutions of the present invention, the present invention will be described in detail below with reference to the accompanying drawings and specific embodiments. The following embodiments are only used to more clearly illustrate the technical solutions of the present invention and should not be construed as limiting the scope of protection of the present invention.

[0029] In the practical application of dynamic attack and defense simulation platforms and security operations centers, background issues directly affect the effectiveness of defense. The "broken chain" phenomenon in detection and response often allows attacks to continue to spread even after they have been discovered; the lack of causal attribution makes attribution reports and strategy optimization lack a basis, and security personnel find it difficult to accurately assess the scope and root cause of attacks.

[0030] To address the aforementioned shortcomings, this invention proposes an adaptive defense method based on rule generation and causal attribution. This approach not only leverages the advantages of AI models in threat identification but also further integrates the entire process of identification, rule generation, detection, anomaly handling, causal attribution, and strategy optimization. This integrated mechanism of rule generation, attribution analysis, and automated handling overcomes the deficiencies of existing technologies in policy closure and attribution accuracy, making it particularly suitable for high-intensity attack and defense environments requiring rapid response and interpretable analysis. It is suitable not only for enterprise security operations centers but can also be integrated with platforms such as dynamic attack and defense simulation ranges to enhance the technical depth and automation level of drills and real-world defense.

[0031] Based on this, the present invention provides an adaptive defense method, specifically an adaptive defense method and system based on rule generation and causal attribution, such as...Figure 1 As shown, it includes the following steps: S1. Collect abnormal network state data when the target network system is attacked, and extract attack detection elements including IP address, port range, network protocol, payload characteristics and behavior sequence from the abnormal network state data.

[0032] Attack Information Collection and Preprocessing. The system utilizes collection modules deployed at the border, terminals, and business hosts. At the network layer, it primarily relies on the open-source network intrusion detection system Suricata, acquiring network traffic in real time by monitoring specified network interfaces (such as docker0). At the host layer, the osquery tool is used to collect abnormal network state data such as host logs and port-process mapping information. From the abnormal network state data, all network state data indicating system attacks are extracted, and detection elements including IP, port, protocol, payload characteristics, and behavioral sequences (i.e., contextual behavioral sequences) are extracted. The payload characteristics are defined as effective payload / attack payload (Payload mode). The collection modules clean, normalize, and time-series-encode the data, laying the foundation for subsequent analysis. First, the raw data received via FastAPI is formatted uniformly, including converting timestamps to the ISO8601 standard format; the IP address and port representation methods are standardized to ensure data structure consistency. Secondly, an integrity verification process is performed, including using regular expressions to validate IP address formats, checking port number ranges (1-65535), verifying timestamp compliance, ensuring JSON structure integrity, and checking the rationality of event time sequences and the logical connections between attack events. Finally, all preprocessed data is structured and stored in the DefenseState data model, which includes fields such as raw input logs, simplified attack logs, detection logs, attack attribution graphs, abnormal host information, and tool usage history. The entire process is managed by LangGraph's state machine to ensure orderly data transfer and quality control during preprocessing, providing a reliable data foundation for subsequent defense phases.

[0033] S2. Generate network detection rules based on the attack detection elements; load the network detection rules into the detection engine of the target network system, and use the detection engine to perform real-time detection on the network traffic of the target network system. If an attack matching the network detection rules is found, record the alarm event and system log; establish a mapping relationship between network ports and network processes based on the alarm event, use the mapping relationship to locate suspicious processes, and automatically issue remote handling actions.

[0034] The system automatically generates and distributes rules in real time. Based on collected abnormal samples or attack data, the system leverages the multi-turn dialogue capabilities of the DeepSeek-V3 large language model to intelligently generate Suricata detection rules using various specialized prompt word templates. For example, using a temporal causal analysis template, as shown in Table 1, the system guides the LLM to identify attack pattern characteristics and generate targeted detection rules. The specific rules we've saved include: "alert tcp any any ->192.168.1.9 22 (msg:"SSH loginattempt"; content:"SSH-"; flow:to_server; sid:1000003; rev:1;)" for Secure Shell (SSH) services, identifying SSH connection attempt characteristics; and "alert tcp any any ->192.168.1.1 80 (msg:"HTTP version scan detected"; content:"GET"; http_method; sid:1000002; rev:1;)" for Hypertext Transfer Protocol (HTTP) scanning, detecting HTTP GET request behavior, etc. Rules adapted to the detection engine are automatically generated and distributed to the detection module in real time via the LangGraph workflow, enabling dynamic updates to the detection strategy.

[0035] Table 1. Temporal Causal Analysis Hint Template

[0036] like Figure 3As shown, the process of generating network detection rules in the adaptive defense system is as follows: parsing attack summaries, matching rule templates, generating candidate rules, performing conflict detection and weight evaluation, simulating and verifying rule accuracy, and finally writing the rules into the rule base and hot-loading them into the detection engine. This forms a complete rule generation process from attack information parsing to rule generation, verification, and application loading, ensuring the accuracy and real-time performance of defense rules. Specifically, it extracts structured features such as protocol type, IP / port, payload / attack payload mode, key calls, and behavioral tags from samples or alarms for threat feature parsing. Using protocol semantic analysis, regular expression pattern mining, and statistical modeling, the features are classified to identify attack patterns and triggering conditions (i.e., contextual triggering conditions). Following the syntax of the target detection engine (Suricata, Snort, or a custom engine), rule templates are selected and parameters are filled to form candidate rules. The overlap and conflict between new rules and the existing rule base are detected, and the priority and triggering conditions are evaluated to avoid redundancy or false alarms. Offline simulation of candidate rules is performed in a sandbox environment to evaluate the detection rate, false alarm rate, and performance impact. Pre-configured detection rates, false positive rates, and performance requirements are set by the administrator based on business scenarios and stored in the policy configuration repository. Verified rules are packaged into a standard format and sent to the detection engine via message bus / API, achieving a load-free, restart-free process.

[0037] Real-time detection and alerting. Based on the obtained detection rules, Suricata is configured to monitor the docker0 network interface using a specified configuration file. The Suricata detection module performs high-speed comparison and anomaly analysis on network packets, sessions, and host behavior. When traffic or logs trigger a rule, the system generates an alarm message and passes the relevant context to the anomaly analysis module. In the alarm output stage, the security event information includes structured data such as timestamp, source and destination IP addresses, port numbers, protocol types, alarm messages, signature IDs, and severity levels. Specifically, it is presented in a format similar to "2023-10-27T08:45:32.123456+0000[] [1:1000001:1]OpenSSL Heartbleed attack attempt [] [Classification:Attempted Administrator Privilege Abuse][Priority: 1] {TCP} 192.168.1.100:54321 ->192.168.1.1:443". Traffic statistics include runtime metrics such as the number of packets captured, the number of packets processed, the number of packets dropped, and memory usage, presented as a statistical summary similar to "[INFO] 10 / 2023-08:45:32.123456[0]1 pkt captured, 1 pkt passed, 0 pkt dropped, 0 pkt replaced".

[0038] like Figure 4 As shown, the process of real-time detection in the adaptive defense system is demonstrated. First, network interface traffic is monitored, then deep packet inspection is performed to match rules, and then it is determined whether the rules are matched. If the rules are matched, an alarm event is generated and the context is recorded. If the rules are not matched, monitoring continues, providing technical support for timely detection of network attack behavior.

[0039] Abnormal Process Identification and Automatic Handling. Based on alarm information and port-process mapping relationships, the system uses LLM and probabilistic causal inference templates to identify abnormal IP and port patterns, locate potential malicious processes, and output a dictionary structure in the format {ip: [ports]}. The automatic handling mechanism uses the Paramiko library to establish an SSH connection and executes actions such as blocking, isolating, suspending, or closing (i.e., terminating) according to predefined policies. Before executing the predefined policies, the target network system performs a host-level pre-defined whitelist verification (this whitelist is pre-configured by the administrator with trusted process and port mapping relationships and stored in a local policy library). Processes that pass the whitelist are allowed to pass; processes that do not pass the whitelist are blocked, isolated, suspended, or closed, and rollback contingency plans are set. The handling results are fed back to the rule generation module and policy optimization module, achieving complete control.Figure 5 As shown, the process of identifying and automatically handling abnormal processes in the adaptive defense system is demonstrated. First, the abnormal host is remotely connected to, the process corresponding to the port is queried, and the risk of the process is judged. If blocking is required, the process is terminated / isolated and written to the handling log. If blocking is not required, the status is recorded and awaits manual analysis, thus realizing an effective combination of automated handling and manual analysis of abnormal processes.

[0040] S3. Based on the remote handling actions, alarm events, and system logs, construct an attack evidence chain, and the target network system performs adaptive defense based on the attack evidence chain.

[0041] Causal relationship modeling and attack attribution. Combining detection logs, network topology, host status, and handling records, an attack causal graph (i.e., attack event graph, or attack evidence chain) is constructed, and the chronological order and dependency chains of the attacks are deduced through causal inference algorithms. Specifically, a time-series of events (such as port scanning, vulnerability detection, and attack exploitation) is used as input, and LangChain's ConversationChain guides DeepSeek-V3 for causal inference. The system first identifies the chronological order of events, then analyzes whether each event is a necessary condition for its subsequent events, assesses the strength of dependencies between events, and finally constructs a complete causal chain. The attack chain reconstruction prompt template is shown in Table 2. The attribution module can recover the attack origin, propagation path, and key nodes, and uses Neo4j to generate graphical results, providing administrators with intuitive evidence.

[0042] Table 2 Attack Chain Reconstruction Hint Template

[0043] like Figure 6 As shown, the process of causal relationship modeling and attack attribution in the adaptive defense system of this invention is demonstrated. First, detection and handling records are collected, and then topology and time series are combined to construct an attack causal graph, generate an attribution graph, and finally output a defense report and summary, providing a visual and detailed basis for the attribution analysis of attack behavior and the optimization of defense strategies.

[0044] Defense Reporting and Strategy Optimization. Strategy optimization can be implemented using two algorithms: the online multi-armed slot machine algorithm and the Bayesian optimization algorithm.

[0045] The system automatically generates a summary of the defense process and dynamically adjusts the rule activation probability based on an online multi-armed slot machine algorithm framework. The strategy optimization mechanism treats each detection rule as an "arm," and the profit function is defined as: ; in, and These are the weights of true positives and false positives, respectively, and λ is the performance overhead coefficient used to adjust the proportion of performance overhead in the overall decision-making process. This represents the number of samples that were actually positive and were predicted to be positive, i.e., the number of times the system correctly identified the attack. This represents the number of samples that were actually positive but predicted to be negative, i.e., the number of false alarm attacks by the system. This refers to the performance overhead, which is the performance resources (such as computing resources, memory resources, etc.) consumed by the system in executing the detection rules.

[0046] Bayesian optimization implementation: A Gaussian process surrogate model is constructed using rule feature parameters (such as port range and load matching mode) as the input space and detection rate, false alarm rate, and performance overhead as optimization objectives. The next set of parameters to be evaluated is selected through a collection function (UpperConfidence Bound or Expected Improvement). Rule performance is rapidly evaluated in a sandbox environment, the posterior distribution is updated, and iterative convergence is achieved to the globally optimal rule configuration. This algorithm is suitable for scenarios with continuous rule parameter spaces and high evaluation costs, and can find an approximate optimal solution within a finite number of iterations.

[0047] Table 3 Root Cause Analysis Tips Template

[0048] The optimizer consumes and processes feedback data in real time, calculates the benefit index of each rule, and uses an ε-greedy strategy to balance exploration and utilization. Alternatively, a Bayesian optimization algorithm can be used, which models the mapping relationship between rule performance and feature space through a Gaussian process, collects observation data to update the prior distribution, selects the next set of rule parameters to be evaluated under the guidance of a collection function (such as UCB or EI), and quickly converges to the optimal rule configuration under resource constraints. Specific optimization strategies include: increasing the activation priority of rules with high TPR and low FPR; downgrading or reconstructing rules that are frequently triggered but have low processing success rates; and identifying changes in attack patterns based on causal tracing results and adjusting the content mode of detection rules accordingly. The root cause analysis prompt template is shown in Table 3. The optimized rules are automated for testing and deployment through the CI / CD pipeline, undergoing a complete quality assurance process of syntax checking, sandbox verification, canary release, and full deployment, forming an adaptive system of perception, decision-making, and feedback. The system summarizes information such as detection records, handling details, tracing paths, and rule hit rates to form a defense report. The defense report template is shown in Table 4. The report can be used to analyze the defense effect and iteratively optimize the rule generation model and handling strategy to achieve an adaptive cycle of perception, decision-making, and feedback.

[0049] Table 4 Defense Report Prompt Template

[0050] Figure 2 The interactive architecture of the adaptive defense system is demonstrated. The front-end (user interface) interacts with the back-end management system (which has data processing and management, user authentication and access control, and API interface functions). The front-end sends operation commands to the back-end management system, and the back-end management system returns data to the front-end. At the same time, the back-end management system calls two types of AI agents: one type is used for scenario construction, and the other type includes attack agents, defense agents, and agents for intelligent summarization. These AI agents send the results back to the back-end management system, thus forming a system interaction of "front-end interaction - back-end processing - AI agent empowerment - result feedback", which intuitively presents the collaborative relationship between the various modules of the system.

[0051] The system of this invention consists of a data acquisition layer, an intelligent rule generation layer, a real-time detection layer, an anomaly analysis layer, a causal tracing layer, and a user interaction layer. Each layer interacts via an HTTP / HTTPS interface, achieving a loosely coupled design. The data acquisition layer provides a unified abstraction of network traffic, host logs, and attack agent outputs; the rule generation layer, driven by a defense agent, uses natural language parsing and feature extraction algorithms to form detection rules; the detection layer compares traffic and events using a high-speed matching engine, triggering alarms and transmitting them to the anomaly analysis and tracing subsystem.

[0052] In a typical implementation, a user initiates an exercise on a dynamic attack and defense platform. The attack agent simulates an APT penetration and generates attack data. The defense agent monitors this data in real time, parses protocol characteristics and payload patterns, automatically generates detection rules, and sends them to the monitoring engine. Once the rules take effect, the system detects abnormal connection behavior, immediately generates an alarm, and invokes the anomaly analysis module. This module utilizes port-process mapping to locate malicious programs and issue termination commands, while simultaneously triggering source tracing analysis to visualize the attack path, triggering rules, and process relationships. The defense report ultimately displays the entire process of detection, handling, and source tracing of the incident, providing a reference for subsequent strategy optimization and experience accumulation.

[0053] After deploying this system in an enterprise intranet environment, when an SQL injection attack targeting the database occurs, the attack agent initiates a penetration request, the defense agent captures the abnormal SQL payload and automatically generates rules; the detection module immediately blocks the request, the anomaly analysis module identifies the database process executing the malicious query and terminates it; the source tracing module then plots the attack path, from the attack source IP to the target database, and then to the query statement that triggered the rule, all clearly displayed. Administrators can view the report and export the records on the interface.

[0054] The adaptive defense provided by this invention includes: adjusting the priority of detection rules based on the attack evidence chain, optimizing handling action strategies, and updating defense strategy configurations. This invention achieves full-process automation, from threat identification to rule generation, detection, handling, and attribution, all completed automatically by the system, significantly reducing manual intervention costs and improving protection efficiency. It offers real-time and dynamic capabilities; rules can be generated and loaded into the detection engine instantly, and defense strategies can be dynamically adjusted according to the attack chain status, adapting to rapidly changing threat environments. Accurate attribution is achieved through a causal attack event graph that fully reconstructs multi-stage attack chains, facilitating administrators to trace root causes, assess impact, and implement targeted defenses. It boasts strong interpretability; defense reports present detection logic, handling actions, and attribution paths in graphical form, providing transparent evidence for security audits and strategy optimization. It exhibits excellent scalability; employing a microservice architecture and modular design, it can seamlessly integrate with existing SOC platforms, situational awareness systems, or dynamic attack and defense simulation ranges, adapting to security scenarios of different scales, from enterprise to government levels.

[0055] In summary, this invention provides an innovative solution integrating rule generation, causal attribution, and adaptive defense, which can effectively improve the protection depth and response speed of network security systems when facing complex threats, providing technical support for building a proactive, intelligent, and explainable next-generation defense architecture. It is applicable to scenarios such as dynamic attack and defense training platforms, intrusion detection and response, threat hunting, and defense-in-depth.

[0056] Based on the same inventive concept, the present invention also provides an adaptive defense system, comprising: The element extraction module is used to collect abnormal network state data when the target network system is attacked, and extract attack detection elements including IP address, port range, network protocol, payload characteristics and behavior sequence from the abnormal network state data.

[0057] The action generation module is used to generate network detection rules based on the attack detection elements; load the network detection rules into the detection engine of the target network system, use the detection engine to perform real-time detection of network traffic of the target network system, and record alarm events and system logs when an attack matching the network detection rules is found; establish a mapping relationship between network ports and network processes based on the alarm events, use the mapping relationship to locate suspicious processes, and automatically issue remote action.

[0058] The prevention module is used to construct an attack evidence chain based on the remote handling actions, alarm events, and system logs, and the target network system performs adaptive defense based on the attack evidence chain.

[0059] This invention also provides a computer device, which, at the hardware level, includes a processor, an internal bus, a network interface, memory, and non-volatile memory, and may also include other hardware required for business operations. The processor reads the corresponding computer program from the non-volatile memory into the memory and then runs it to implement the adaptive defense method provided above.

[0060] The present invention also provides a computer-readable storage medium storing a computer program that can be used to execute the adaptive defense method provided above.

[0061] Specific limitations regarding the computational system for the adaptive defense method can be found in the limitations of the adaptive defense method described above, and will not be repeated here. Each module in the aforementioned adaptive defense system can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in or independent of the processor in the computer device in hardware form, or stored in the memory of the computer device in software form, so that the processor can call and execute the corresponding operations of each module.

[0062] The technical features of the above embodiments can be combined arbitrarily. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as the combination of these technical features does not contradict each other, it should be considered within the scope of this specification. Furthermore, the above embodiments only illustrate several implementation methods of this application, and their descriptions are relatively specific and detailed, but they should not be construed as limiting the scope of the invention patent. It should be noted that those skilled in the art can make several modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this patent application should be determined by the appended claims.

Claims

1. An adaptive defense method, characterized in that, include: Collect abnormal network state data when the target network system is under attack, and extract attack detection elements including IP address, port range, network protocol, payload characteristics and behavior sequence from the abnormal network state data; Based on the attack detection elements, network detection rules are generated; and the network detection rules are loaded into the detection engine of the target network system. The detection engine is used to detect the network traffic of the target network system in real time. If an attack matching the network detection rules is found, an alarm event and system log are recorded; a mapping relationship between network ports and network processes is established based on the alarm event. The mapping relationship is used to locate suspicious processes and automatically issue remote handling actions. Based on the remote handling actions, alarm events, and system logs, an attack evidence chain is constructed, and the target network system performs adaptive defense based on the attack evidence chain.

2. The adaptive defense method according to claim 1, characterized in that, The step of generating network detection rules based on the attack detection elements specifically includes: The threat characteristics are analyzed from the attack detection elements, including protocol type, IP address, port range, payload mode, key calls, and behavioral tags. The attack patterns and triggering conditions of the threat features are identified through protocol semantic analysis, regular expression pattern mining, and statistical modeling algorithms. Select a rule template according to the syntax specification of the target network system detection engine, and fill the rule template with the attack mode and triggering conditions to form candidate rules; The candidate rules are simulated offline in a sandbox environment to test and select effective rules that meet the preset detection rate, false alarm rate and performance requirements. The effective rules are then used to form network detection rules.

3. The adaptive defense method according to claim 1, characterized in that, The network detection rules are in the Suricata rule format; the Suricata rule format includes fields for matching direction, port range, network protocol, and payload characteristics. A hot update mechanism is used to load the network detection rules into the detection engine of the target network system, so that the network detection rules take effect without interrupting the operation of the detection engine.

4. The adaptive defense method according to claim 1, characterized in that, Based on the alarm events, a mapping relationship between network ports and network processes is established. The mapping relationship is used to locate suspicious processes and automatically issue remote handling actions. Specifically, this includes: obtaining historical data of network ports and network processes; obtaining the mapping relationship between network ports and network processes in real time through the system interface; locating suspicious processes by comparing the mapping relationship with the historical data; and then issuing remote handling actions to the suspicious processes through a security agent.

5. The adaptive defense method according to claim 4, characterized in that, Before issuing the remote handling action to the suspicious process through the security agent, the process also includes the target network system performing a host-level preset whitelist verification and setting a rollback plan. After issuing the remote handling action to the suspicious process through the security agent, the method further includes returning the execution result of the remote handling action and the hash signature of the network process for auditing and tracing; the remote handling action includes terminating the network process, blocking the network connection, and isolating the host network.

6. The adaptive defense method according to claim 1, characterized in that, Based on the remote handling actions, alarm events, and system logs, an attack evidence chain is constructed. The target network system performs adaptive defense based on the attack evidence chain. Specifically, this includes: constructing an attack causal graph using the alarm events, handling actions, and system logs as inputs. The attack causal graph uses the target network system's hosts, network processes, port ranges, network detection rules, and timestamps as nodes, and attack event triggering relationships as edges. The attack causal graph is transformed into an attack evidence chain by deriving the attack sequence and dependency chain through a causal reasoning algorithm; and adaptive defense is performed based on the attack evidence chain.

7. The adaptive defense method according to claim 6, characterized in that, It also includes generating a defense report based on the attack evidence chain, which contains a list of detection rules, attack hit paths, details of handling actions, and the evidence chain. At the same time, it extracts feature summaries that can be reproduced by the attacker from the attack evidence chain. Using an online multi-armed slot machine or Bayesian optimization algorithm, under resource constraints, iteratively optimizes the network detection rules and remote handling actions based on the feature summaries to strengthen the adaptive defense method of the target network system.

8. An adaptive defense system, characterized in that, include: The element extraction module is used to collect abnormal network state data when the target network system is attacked, and extract attack detection elements including IP address, port range, network protocol, payload characteristics and behavior sequence from the abnormal network state data. The action generation module is used to generate network detection rules based on the attack detection elements; load the network detection rules into the detection engine of the target network system, use the detection engine to perform real-time detection of network traffic of the target network system, and record alarm events and system logs when an attack matching the network detection rules is found; establish a mapping relationship between network ports and network processes based on the alarm events, use the mapping relationship to locate suspicious processes, and automatically issue remote action. The prevention module is used to construct an attack evidence chain based on the remote handling actions, alarm events, and system logs, and the target network system performs adaptive defense based on the attack evidence chain.

9. A computer device, comprising a memory, a processor, and a computer program stored in the memory, characterized in that, The processor executes the computer program to implement the steps of the method according to any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is loaded by the processor, it is able to perform the steps of the method according to any one of claims 1 to 7.

Images