Method for ai agent and active threat hunting and tracing based on honeypot technology

Abstract

This invention relates to the field of network security technology and discloses a proactive threat hunting and attribution method for AI agents and honeypot-based technology. The method deploys a threat-aware agent at the network boundary to continuously capture inbound and outbound data packets, performs protocol parsing and payload feature extraction on the packets, generates network behavior fingerprints, and matches them in real-time with a known attack signature database. When the matching degree exceeds a dynamic threshold, a high-interaction honeypot environment is activated to simulate real business services, inducing attack traffic to enter and perform isolation operations. The entire operation sequence of the attack traffic within the honeypot environment is recorded, generating an attack behavior graph based on this. The attribution analysis agent extracts persistent connection points and timestamps from the graph, reconstructs the attack path, and performs correlation analysis with a threat intelligence database, outputting an attribution report. This method effectively improves network security protection capabilities and can better cope with complex and ever-changing network attack environments.

Description

Technical Field

[0001] This invention relates to the field of cybersecurity technology, specifically to a proactive threat hunting and tracing method for AI agents and honeypot-based technologies. Background Technology

[0002] Network perimeter security primarily relies on passive defenses such as Intrusion Detection Systems (IDS) and firewalls. These technologies match network traffic using predefined static rule bases, offering some interception effectiveness against known attack patterns. However, when facing unknown or disguised attacks such as zero-day exploits and Advanced Persistent Threats (APTs), the lag in updating static rule bases significantly reduces their detection capabilities, making them ill-equipped to handle constantly evolving threats. Existing AI-driven defense solutions often focus on identifying single traffic characteristics, lacking deep contextual analysis of attack behavior, making them vulnerable to attackers using feature-based adversarial techniques to evade detection.

[0003] To compensate for the shortcomings of passive defense, existing solutions often deploy low-interaction honeypots as bait in the network. These honeypots simulate limited service responses, are inexpensive to manufacture but lack sufficient interaction depth, making them easily detectable and evaded by experienced attackers using fingerprinting techniques, thus failing to effectively trap advanced attacks. Furthermore, the triggering mechanisms of honeypots often rely on fixed thresholds or rules, unable to dynamically adjust based on the real-time risk situation of network traffic. Existing AI triggering strategies do not fully integrate real-time network risk levels, still exhibiting an imbalance between false positives and false negatives. This static triggering mode is poorly adaptable to complex and ever-changing network environments, easily generating numerous false positives due to excessively low threshold settings, consuming analysis resources; or missing covert probing attacks due to excessively high threshold settings, resulting in a difficulty in balancing threat identification accuracy and system resource consumption.

[0004] In the post-attack attribution analysis phase, existing technologies typically rely on correlating scattered system logs, network flow records, and security device alerts. This approach faces challenges such as heterogeneous data sources, outdated timestamps, and log erasure, resulting in a cumbersome and inefficient analysis process. The analysis results often present as a discrete list of events, making it difficult to clearly and coherently depict the complete path of the attacker from breaching boundaries, establishing persistent presence, and lateral movement to achieving the attack target. In particular, there is a lack of effective extraction and visualization methods for persistent connection points used by attackers to maintain access privileges, such as backdoors and scheduled tasks, as well as the temporal logical relationships between various attack steps. This leads to incomplete reconstructed attack paths, unconvincing attribution conclusions, and an inability to support effective incident response and countermeasures.

[0005] The purpose of this invention is to solve the problem of insufficient threat detection adaptability caused by static defense and static triggering mechanisms in existing technologies, as well as the problem of incomplete attack path reconstruction caused by fragmented analysis methods. Summary of the Invention

[0006] The purpose of this invention is to provide a method for proactive threat hunting and tracing using AI agents and honeypot technology, in order to solve the problems mentioned in the background art.

[0007] To achieve the above objectives, the present invention provides a method for proactive threat hunting and tracing using AI agents and honeypot technology, the method comprising: Continuously capture inbound and outbound data packets by deploying threat-aware agents at the network boundary; The captured data packets are parsed for protocols and their payload features are extracted to generate network behavior fingerprints; Real-time matching of network behavior fingerprints with a known attack signature database; When the matching degree exceeds the dynamic threshold, the high-interaction honeypot environment is activated to simulate real business services. Inducing attack traffic to enter a highly interactive honeypot environment to perform isolation operations; Record the complete operation sequence of attack traffic in a highly interactive honeypot environment; Generate attack behavior graphs based on operation sequences; Persistent connection points and timestamp markers in the attack behavior graph are extracted by source tracing analysis of the proxy; Reconstruct the attack path based on persistent join points and timestamps; The reconstructed attack paths are correlated with the threat intelligence database for analysis, and an attribution report is generated.

[0008] Preferably, the protocol parsing and payload feature extraction of the captured data packets includes: performing layered parsing on the captured data packets, sequentially decapsulating the network layer, transport layer, and application layer header information; identifying command strings and parameter sequences from the application layer payload; performing syntactic analysis on the command strings to construct an abstract syntax tree; extracting key operators and operands from the abstract syntax tree as feature elements; and combining the feature elements with the header information to form a standardized feature vector.

[0009] Preferably, the update process of the known attack feature database includes: receiving network behavior fingerprints periodically uploaded by a distributed threat awareness agent; grouping the network behavior fingerprints in real time using a streaming clustering algorithm; calculating the similarity score between each group and existing attack features; when the similarity score exceeds a dynamically adjusted threshold, merging the new group into the known attack feature database; and periodically cleaning up expired features in the known attack feature database.

[0010] Preferably, the construction process of the high-interaction honeypot environment includes: selecting the type of business service to be simulated based on the current network threat situation; deploying dynamically configurable virtual machine instances in the isolated network segment; installing an operating system and middleware consistent with the real environment in the virtual machine instances; embedding a lightweight monitoring agent to capture system kernel events and network interaction data; and adjusting the configuration parameters of the virtual machine instances in real time according to the behavioral characteristics of the attack traffic.

[0011] Preferably, the recording of all operation sequences of attack traffic in the high-interaction honeypot environment includes: monitoring process creation and termination events triggered by attack traffic in the honeypot environment; recording the system call parameters and return values ​​corresponding to each event; associating all system calls within the same session to form an event stream; sorting and deduplicating the event stream in chronological order; and generating an operation sequence log containing timestamps and dependencies.

[0012] Preferably, the step of generating an attack behavior graph based on the operation sequence includes: parsing resource access patterns in the operation sequence, including file read / write, registry modification, and network connection; identifying causal relationships and temporal relationships between resources; constructing a directed graph structure with resource entities as nodes and access operations as edges; performing community detection on the graph structure to identify potential attack modules; and adding attribute tags to each node to enhance readability.

[0013] Preferably, the extraction of persistent connection points includes: scanning frequently occurring node sequences in the attack behavior graph; analyzing whether the system configuration items corresponding to the nodes have auto-start attributes; detecting scheduled tasks and service registration items in the auto-start attributes; mapping the detected auto-start items to network sessions; and marking persistent connection points in the mapping results.

[0014] Preferably, the reconstruction of the attack path based on persistent connection points and timestamps includes: starting from the persistent connection point, querying historical connection records in the network device logs; extracting the source address, target address, and timestamp from the connection records; aligning the timestamp with the event times in the honeypot operation sequence; constructing a complete path from the initial intrusion point to the persistent point based on the alignment result; and verifying the continuity and rationality of each node in the path.

[0015] Preferably, the step of performing correlation analysis between the reconstructed attack path and the threat intelligence database includes: submitting the source address in the reconstructed attack path to multiple external threat intelligence sources; obtaining the threat indicators and confidence levels returned by each threat intelligence source; integrating all threat indicators for consistency verification; calculating the comprehensive threat score of the source address based on the consistency verification results; and matching the comprehensive threat score with historical attack patterns.

[0016] Preferably, the output source tracing report includes: integrating attack paths, persistent connection points, and threat intelligence correlation results into a structured dataset; converting the structured dataset into a readable format according to a predefined template; generating a detailed report containing an attack timeline, resource relationship diagram, and threat rating; and outputting the report to a security operations platform for further processing.

[0017] Compared with the prior art, the beneficial effects of the present invention are: The dynamic threshold matching mechanism continuously evaluates the real-time matching degree between network behavior fingerprints and threat characteristics, and dynamically adjusts the activation threshold based on the overall risk level of the network environment, enabling on-demand allocation of high-value honeypot resources. This technology effectively overcomes the rigidity of fixed threshold strategies. In network environments with high background traffic noise, it reduces the probability of misjudging benign anomalies or scanning probes as substantial attacks and activating high-interaction environments, thus avoiding unnecessary resource consumption. This mechanism can accurately identify slow, disguised attacks launched in stages. When the cumulative behavioral characteristics of these attacks exceed the dynamically calculated threshold, the system can be reliably activated, preventing the failure to detect advanced threats and improving the detection system's adaptability and response accuracy to complex threats.

[0018] Attack behavior graphs constructed based on complete operation sequences transform discrete events such as system calls, file operations, and network connections during an attack into a context-dependent graph model. This representation allows for a clear visual representation of the logical order and dependencies between each link in the attack chain. Source tracing analysis precisely locates persistent connection points in the graph and, combined with high-precision timestamps, ensures the analysis follows a clear timeline. The attack paths reconstructed by this method are no longer a collection of isolated events, but clearly demonstrate the complete technical chain by which attackers achieve their goals of initial intrusion, privilege escalation, lateral movement, and data collection. This enhances the coherence of forensic analysis and the reliability of conclusions, providing a basis for accurately identifying the attack source and understanding the full picture of the attack.

[0019] Automated correlation analysis of the reconstructed attack paths with a multi-dimensional threat intelligence database allows for the comparison of the tactics, techniques, and processes (TTPs) used in this attack campaign with known threat organization behavior patterns. This process not only validates the results of the attribution analysis but may also uncover broader connections behind the attack campaign. Automated correlation outputs structured attribution reports, reducing the workload of security analysts in handling massive amounts of data and improving the overall efficiency from attack detection to intelligence output, enabling response decisions to be based on a more comprehensive and in-depth understanding of threats. Attached Figure Description

[0020] Figure 1This is a schematic diagram illustrating the working principle of the active threat hunting and tracing method for AI agents and honeypot-based technology described in this invention. Figure 2 A flowchart for packet protocol parsing and payload feature extraction; Figure 3 A flowchart for building a highly interactive honeypot environment. Detailed Implementation

[0021] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0022] Please see Figure 1 This invention provides a proactive threat hunting and tracing method for AI agents and honeypot-based technology. The method continuously captures inbound and outbound data packets through a threat-aware agent deployed at the network boundary. The threat-aware agent uses deep packet inspection technology to monitor network traffic in real time. The data packet capture process is implemented based on mirrored ports or network splitters to ensure full traffic coverage. The captured data packets undergo protocol parsing and payload feature extraction to generate network behavior fingerprints. Protocol parsing involves identifying common network protocols such as TCP, UDP, HTTP, and FTP, while payload feature extraction focuses on application layer data content. The network behavior fingerprint is matched in real time with a known attack signature database. The matching algorithm uses cosine similarity calculation, and a dynamic threshold is automatically adjusted according to network traffic patterns. When the matching degree exceeds the dynamic threshold, the system activates a high-interaction honeypot environment to simulate real business services. The high-interaction honeypot environment is deployed in an isolated network segment, and the simulated services include web servers, database services, or file sharing services. Attack traffic is induced into the high-interaction honeypot environment to perform isolation operations; the induction mechanism is based on DNS redirection or IP spoofing technology. The entire operation sequence of the attack traffic in the high-interaction honeypot environment is recorded, covering process activity, file access, and network connections. An attack behavior graph is generated based on the operation sequence, visualizing the attack steps and resource relationships. Persistent connection points and timestamps are extracted from the attack behavior graph through source tracing analysis; persistent connection points refer to persistent access points established by the attacker. The attack path is reconstructed based on persistent connection points and timestamps, with network device logs and system audit records queried during the reconstruction process. The reconstructed attack path is correlated with a threat intelligence database, which integrates external sources such as CVE databases and malicious IP lists. A source tracing report is output, including an attack timeline and threat rating, in a format that supports both machine and human reading.

[0023] Example 1: See Figure 2 The protocol parsing and payload feature extraction process for network packets employs a strict layered processing mechanism built upon a mature network protocol stack model. Layered parsing of captured packets involves sequentially decapsulating the network layer, transport layer, and application layer headers. Network layer parsing focuses on identifying the source and destination address fields and protocol type fields of IPv4 or IPv6 packets. Transport layer parsing targets the sequence number and acknowledgment flag of TCP packets, and the length and checksum fields of UDP packets. Application layer parsing distinguishes common application protocols such as HTTP, FTP, and SMTP based on port numbers or protocol characteristics and extracts their header fields. Identifying command strings and parameter sequences from application layer payloads relies on a predefined regular expression pattern library. These libraries cover various attack payload features, including system command injection strings, database query statements, and scripting language code snippets. The identification process uses a multi-pattern matching algorithm to scan the payload content and mark matching positions. Syntactic analysis of command strings requires constructing an abstract syntax tree. The parser converts linear character sequences into a tree structure based on the grammatical rules of the command language, with tree nodes representing syntactic units such as operators, operands, and separators. Key operators and operands are extracted as feature elements from the abstract syntax tree. Operators include file system operators, network communication operators, and process management operators, while operands involve specific entities such as file paths, domain names, IP addresses, and port numbers. These feature elements are combined with header information to form a standardized feature vector. The combination process performs min-maximum normalization on numerical features and one-hot encoding on categorical features, ultimately generating a fixed-dimensional numerical vector for subsequent matching.

[0024] The update process of the known attack signature database is a continuous machine learning process. It receives network behavior fingerprints periodically uploaded by a distributed threat-aware agent. The upload mechanism uses a compressed and encrypted digital signature format to ensure the integrity and confidentiality of data transmission, and the upload frequency is dynamically adjusted based on network bandwidth utilization. A streaming clustering algorithm is used to group the network behavior fingerprints in real time. This streaming clustering algorithm employs a density-based DBSCAN variant that adaptively adjusts the neighborhood radius parameter. The grouping results form preliminary threat behavior categories. Specifically, for the implementation of the streaming clustering algorithm, network behavior fingerprints are input as a continuous data stream to the clustering engine. The streaming clustering algorithm uses a density-based DBSCAN variant to process high-speed arriving data points. This variant introduces a sliding window model to maintain data samples within a recent period. The neighborhood radius parameter is dynamically calculated based on the distribution density of data points within the window. The density calculation uses a kernel density estimation method to assess the concentration of data around each point. When concept drift occurs in the data stream, the neighborhood radius is automatically shrunk or expanded to maintain cluster stability. The grouping process merges data points falling into the same density region into the same cluster. The cluster center vector represents the typical behavior pattern of that category, and the grouping results form preliminary threat behavior category labels. Calculate the similarity score between each group and existing attack features. The similarity calculation uses a modified Jaccard similarity coefficient, considering both feature frequency and co-occurrence. The score ranges from zero to one. When the similarity score exceeds a dynamically adjusted threshold, the new group is merged into the known attack feature library. The fusion operation uses a weighted average method of feature vectors to update the values ​​of the original feature vectors. The weights are determined based on the number of samples in the new group and the confidence level of historical features. Periodically clean up expired features in the known attack feature library. The cleanup strategy is based on the last access timestamp of the feature vector and the number of recent successful matches. Feature vectors that exceed a certain time window and have a matching frequency below a threshold are removed from the feature library.

[0025] The depth of protocol parsing relies on a precise understanding of network protocol standards. Network layer parsing needs to handle IP fragmentation and reassembly, transport layer parsing needs to handle TCP stream reassembly and out-of-order packet reordering, and application layer parsing needs to handle the challenges of HTTP chunked transport encoding and decrypting SSL / TLS encrypted traffic. The accuracy of payload feature extraction depends on the completeness of the regular expression pattern library, which needs continuous updates to address new attack methods. Pattern matching algorithms need optimization to avoid false and missed matches. The quality of the abstract syntax tree construction directly affects the feature extraction effect. The parser needs to have a certain degree of fault tolerance to handle malformed commands deliberately constructed by attackers, and the tree structure can clearly express the nesting relationships and execution order of commands. Feature vector standardization eliminates biases caused by differences in feature units and value ranges, normalization prevents features with large values ​​from dominating similarity calculations, and one-hot encoding converts discrete features into numerical forms for easier processing by machine learning algorithms.

[0026] The upload behavior of the distributed threat awareness agent needs to consider network load balancing. Uploads are scheduled during periods of low network traffic to minimize the impact on business performance. The data compression algorithm uses the LZ77 algorithm to reduce the amount of data transmitted, and the digital signature algorithm uses the RSA algorithm to verify the authenticity of the data source. Specifically, the LZ77 algorithm reduces the amount of data transmitted. It uses a sliding window mechanism to find repeating sequences in the input data. The compressor maintains a search buffer and a look-ahead buffer, generating a length-distance pair encoding by matching the longest repeating string in the look-ahead buffer with the longest repeating string in the search buffer. The RSA algorithm verifies the authenticity of the data source. It uses an asymmetric key pair for signing and verification. The sender uses its private key to encrypt the data hash value to generate a digital signature, and the receiver uses its public key to decrypt the signature and compare it with the recalculated hash value to verify integrity. The real-time requirement of streaming clustering algorithms necessitates a single-pass data scan capability. The DBSCAN variant algorithm can discover clusters of arbitrary shapes and effectively handle noise points. The neighborhood radius parameter is automatically adjusted according to the data distribution density to maintain cluster stability. The dynamic threshold adjustment mechanism for similarity scores is based on the statistical characteristics of historical matching records. The threshold size is positively correlated with the threat level of the network environment; a lower threshold is used in high-risk environments to improve detection sensitivity. The weight allocation during feature fusion needs to balance the importance of new and old features. The weight of new features decays over time, while the weight of old features increases with the number of matches. This design allows the feature library to quickly adapt to new attacks while retaining the detection capabilities of mature features. A periodic cleanup mechanism prevents the feature library from expanding indefinitely and causing a decrease in matching efficiency. The cleanup operation is triggered when the system load is low, and the feature library data needs to be backed up before and after cleanup to deal with accidental cleanup.

[0027] The entire process constitutes an adaptive network threat detection system. Protocol parsing and feature extraction modules transform raw network data into structured features, while the feature library update module continuously optimizes the detection model through online learning. Layered parsing ensures comprehensive monitoring of all layers of network communication, and payload feature extraction captures the essential content of attack behavior. Abstract syntax tree analysis enhances the semantic level of feature extraction, and standardized feature vectors ensure the comparability of data from different sources. Streaming clustering enables unsupervised classification of massive amounts of network behavior, and dynamic threshold adjustment balances detection accuracy and timeliness. The feature fusion mechanism enables the accumulation and evolution of detection knowledge, and regular cleanup and maintenance ensure the long-term operational efficiency of the system. This technical solution can effectively cope with the ever-changing network threat environment, providing a reliable data foundation for proactive threat hunting.

[0028] Example 2: See Figure 3 The construction of a highly interactive honeypot environment begins with an in-depth analysis of the current network threat landscape. This analysis continuously consumes data streams from multiple threat intelligence sources and evaluates them based on predefined strategy models. The type of business service to be simulated is selected based on the current network threat landscape. The threat landscape analysis engine aggregates metrics released by external threat intelligence platforms, internal historical attack event records, and abnormal traffic patterns captured by network boundary sensors. The selection logic of the business service type is mapped to recent high-frequency attack targets, such as web application programming interfaces (APIs), database services, or industrial control systems. Dynamically configurable virtual machine instances are deployed in isolated network segments. These segments employ physical isolation or VLAN technology to achieve logical separation at the network layer. The virtual machine instances are orchestrated through a cloud management platform or virtualization infrastructure, and their computing, storage, and network resource configuration parameters can be dynamically adjusted via API interfaces. Operating systems and middleware consistent with the real environment are installed in the virtual machine instances. The operating system version number, patch level, and system component versions are strictly consistent with the production environment. Middleware includes common business support software such as Apache Tomcat servers, MySQL databases, or Nginx reverse proxies. A lightweight monitoring agent is embedded to capture system kernel events and network interaction data. The monitoring agent runs as a kernel module or system service, and its data collection scope covers system call events such as process creation and termination, file system operations, registry modifications, and network connection establishment and destruction. Based on the behavioral characteristics of attack traffic, the configuration parameters of virtual machine instances are adjusted in real time. The behavioral characteristic analysis module identifies the protocol type, payload mode, and interaction frequency of attack traffic. Configuration parameter adjustments include dynamically opening or closing service ports, adjusting system resource quotas, and modifying specific parameter values ​​in service configuration files.

[0029] Recording the entire operational sequence of attack traffic in a high-interaction honeypot environment requires the monitoring agent to have full data collection capabilities. This involves monitoring process creation and termination events triggered by attack traffic within the honeypot environment. Process creation events record the process identifier, parent process identifier, process image path, and command-line arguments. Process termination events capture the process exit code, exit time, and resource usage statistics. The system call parameters and return values ​​for each event are also recorded. System call parameters include pathname and access mode in file operations, IP address and port number in network operations, and signal type and priority in process operations. Return values ​​include the operation result status code and affected resource handles. All system calls within the same session are associated to form an event stream. Session identifiers are constructed based on network 5-tuple information or the initial process identifier. The event stream maintenance mechanism uses a session state table to track the activity sequence throughout the entire attack lifecycle. The event stream is sorted and deduplicated chronologically. The sorting algorithm uses high-precision timestamps to ensure the global order of events, and the deduplication operation filters duplicate log entries caused by system retries or network jitter. The system generates operation sequence logs containing timestamps and dependencies. Timestamp synchronization uses a network time protocol to ensure time consistency among distributed nodes. Dependency analysis constructs causal chains between events by tracing process derivation relationships and resource access sequences.

[0030] The simulation of business service types in a high-interaction honeypot environment requires a high degree of realism. Web service simulation not only deploys static pages but also includes dynamic applications with database interaction capabilities. Database service simulation constructs a structured query environment containing simulated data tables. Industrial control system simulation implements standard industrial control protocol stacks and operational logic. The dynamic configuration capability of virtual machine instances is reflected in the elastic scaling of resource allocation; the number of CPU cores and memory size can be linearly expanded according to the attack intensity. Network bandwidth limitations simulate the network conditions of a real environment. The lightweight nature of the monitoring agent is manifested in low resource consumption and high-performance data acquisition. Kernel event capture is implemented by hooking the system call table or using the tracepoint mechanism. Specifically, when kernel event capture is implemented by hooking the system call table, the entry address of the system call handling function is modified, redirecting the original system call address to a custom monitoring function. The monitoring function records the call parameters and context information and then jumps to the original call execution. When implemented using the tracepoint mechanism, static tracepoints are inserted at specific locations in the kernel source code. When a tracepoint is triggered, stack register values ​​and function parameters are collected into a circular buffer. The lightweight monitoring agent reads event data from the buffer and filters out irrelevant noise. Network packet capture uses zero-copy technology to reduce data transfer overhead between kernel space and user space. The event association logic in the operation sequence record needs to handle the complexity of concurrent access. A single attack session may spawn multiple child processes executing in parallel, and the event stream construction algorithm needs to maintain the process tree structure and correctly merge branch events. The timestamp synchronization mechanism relies on a high-precision clock source. The operating system clock is periodically calibrated with a BeiDou or GPS time source via an NTP server, and the time deviation between distributed nodes is controlled within milliseconds. Dependency analysis employs dynamic taint tracking technology, constructing a complete chain of evidence from network input to system resource access by marking the propagation path of attacker-controlled data within the system.

[0031] The honeypot environment and threat landscape work together to form an adaptive defense system. Threat landscape analysis results directly drive the dynamic switching of honeypot service types. When an attack wave targeting a specific service is detected, the system automatically expands the corresponding type of virtual machine instances. The configuration parameters of virtual machine instances are adjusted in real time to create interactive feedback with the attack flow. For example, when a brute-force attack is identified, the authentication service response frequency is automatically reduced; when scanning behavior is detected, more service ports are dynamically opened to enhance the deception effect. The accuracy of data collection by the monitoring agent directly affects the effectiveness of subsequent source tracing analysis. Kernel-level event monitoring can capture rootkit activities that bypass application-layer logs, and network interaction data records restore complete application-layer session content. The structured storage of operation sequence logs uses a time-series database to optimize time range queries, and log entries establish cross-event index relationships to support fast source tracing queries. The event deduplication algorithm needs to distinguish between truly duplicated events and similar independent events, judging event uniqueness based on the comparison of event content hash values ​​combined with contextual information. Dependency relationship construction introduces machine learning algorithms to identify implicit associations, discovering sets of events with no direct resource dependencies but highly correlated behaviors by analyzing event sequence patterns.

[0032] The entire high-interaction honeypot environment operates as a closed-loop learning system. The behavioral characteristics of attack traffic continuously optimize the honeypot's simulation strategy, and monitoring data is consistently fed back to the threat situation analysis module. The isolation of the honeypot environment is enforced through network access control lists and packet filtering rules; any outbound connection attempts originating from the honeypot environment are blocked by security policies. Virtual machine instance lifecycle management includes automated deployment and destruction processes. When an attack activity ends, the system automatically snapshots the virtual machine state and releases resources; the snapshot data is archived for subsequent attack pattern analysis. Data transmission through the monitoring agent uses encrypted channels to prevent attackers from sniffing, and the agent program has self-protection mechanisms to prevent identification and termination by attackers. The generation frequency of operation sequence logs is dynamically balanced with system load. Under high load, the log verbosity level is automatically reduced to maintain system stability, and log files undergo cyclic overwriting and compression storage strategies to optimize disk space usage. Precise timestamp synchronization provides the foundation for attack correlation analysis across multiple honeypot nodes, and a distributed transaction clock algorithm coordinates the event sequence of different physical nodes. Dependency analysis results are visualized to show the logical flow of attack steps, and a graphical interface helps security analysts quickly understand the attack chain.

[0033] Example 3: The process of generating an attack behavior graph based on operation sequences begins with deep analysis of structured operation logs, which originate from complete attack activity sequences recorded in a high-interaction honeypot environment. Analyzing resource access patterns in the operation sequences requires identifying three core operations: file read / write operations focus on file creation, modification, and deletion actions and their path characteristics; registry modification operations track the addition, deletion, and modification of Windows registry keys; and network connection operations record the establishment and termination states of TCP / UDP sessions. Identifying causal relationships and temporal connections between resources employs dynamic taint analysis technology. By marking the propagation path of the attacker's initial input data in the system, a complete dependency chain from network reception to resource access is established. Temporal relationship analysis reconstructs the chronological order of events based on high-precision timestamps. When constructing a directed graph structure with resource entities as nodes and access operations as edges, node attributes include resource hash values, type markers, and security labels, while edge attributes carry operation type, timestamps, and success status flags. Community detection is performed on the graph structure to identify potential attack modules. The community detection algorithm, based on the principle of modularity optimization, divides the graph into several internally tightly connected subgraphs. To enhance readability, attribute tags are added to each node. These attribute tags extract key semantic information from system paths and registry key names using natural language processing techniques.

[0034] Persistent join point extraction employs a methodology based on frequent subgraph mining. Scanning frequently occurring node sequences in the attack behavior graph utilizes an improved PrefixSpan algorithm, capable of handling sequence pattern mining in weighted directed graphs. Specifically, the improved PrefixSpan algorithm extends traditional sequence pattern mining to support weighted directed graph structures. The algorithm uses the weights of node sequences as support calculation factors. The mining process starts with frequent patterns of length 1 and expands through pattern growth, considering edge direction constraints and only allowing node expansion along edge directions. Support calculation combines node weights and frequency of occurrence, outputting frequent node sequences that meet the minimum support threshold. Analyzing whether the system configuration items corresponding to nodes have auto-start attributes requires checking the Run key, Service Manager, and Scheduled Task library in Windows systems, and the rc.d directory and crontab configuration in Linux systems. Detecting scheduled tasks and service registration items in auto-start attributes involves parsing the task scheduler's XML definition file and the service control manager's database. Mapping detected auto-start items to network sessions requires establishing a five-tuple correspondence between process IDs and network connections. Marking persistent join points in the mapping results uses threshold criteria based on connection duration and interaction frequency.

[0035] In constructing attack behavior maps, the accuracy of resource access pattern parsing directly impacts map quality. Parsing file read / write operations requires distinguishing between normal system operations and malicious activities, annotating them by comparing file operation patterns with known malware behavior characteristics. Tracking registry modification operations focuses particularly on system startup items and extension points, locations often used by malware for persistence. Network connection operation records contain complete protocol-layer interaction information, used to reconstruct the attacker's command and control channels. Causal correlation analysis employs data flow tracing techniques to mark the transmission paths of attacker-controlled data between processes, establishing cross-process causal relationships. Temporal relationship analysis considers not only absolute time sequence but also introduces the concept of relative time windows to identify densely occurring related events within specific time periods.

[0036] The construction of the directed graph structure utilizes graph theory principles, identifying key resource nodes using degree centrality and representing operation frequency using edge weights. The community detection process incorporates the principle of maximizing modularity, iteratively optimizing the graph into densely connected subnetworks. Node attribute label generation combines a rule engine and a machine learning classifier to automatically label node functional attributes and risk levels. Frequent node sequence mining employs a pattern growth strategy, gradually expanding the size of frequent subgraphs until support falls below a threshold. Self-starting attribute detection covers various persistence mechanisms, including file system hidden attributes, registry key-value hooks, and memory-resident techniques. Scheduled task parsing handles various trigger types, including login triggers, time triggers, and event triggers. Service registration item analysis examines service types, startup modes, and dependencies. The mapping between self-starting items and network sessions establishes evidence of the association between the system and network layers, verifying mapping accuracy by comparing timestamps and process tree information. The labeling of persistent connection points uses a multi-dimensional scoring mechanism, comprehensively rating connections based on persistence, data traffic, and protocol anomalies.

[0037] The mathematical representation of the attack behavior graph can be calculated using the following formula to determine the importance score of a node: in Represents a node. This represents the set of all nodes in the attack behavior graph. It is the degree of the node. It is the edge weight. It's a timestamp. and These are weighting coefficients. It is a time decay function. This formula takes into account both the structural importance of a node in the graph and its temporal freshness.

[0038] During graph analysis, the community detection algorithm, based on the principle of maximizing modularity, iteratively optimizes the attack behavior graph into multiple functional modules. Node importance calculation combines degree centrality and eigenvector centrality to identify key attack nodes in the graph. Frequent subgraph mining employs a pattern growth algorithm to discover recurring attack patterns. Self-starting item detection combines static analysis and dynamic monitoring to improve the coverage of persistence mechanism identification. Scheduled task parsing deeply analyzes task triggering conditions and execution actions to identify hidden malicious tasks. Service registration item inspection covers service binary paths, dependencies, and permission settings to discover tampered system services. Network session mapping establishes an end-to-end attack chain, reconstructing attacker intent through protocol analysis and payload parsing. Persistent connection point marking employs a multi-evidence fusion strategy, comprehensively considering system logs, network traffic, and memory analysis results for judgment.

[0039] The entire attack behavior graph generation process forms a closed-loop analysis system, and the quality of graph construction directly affects the effectiveness of attack attribution. The completeness of resource access pattern parsing depends on the data collection granularity of the monitoring agent, and the accuracy of causal correlation analysis depends on the coverage of taint tracing. The accuracy of temporal relationship reconstruction requires the support of a high-synchronization clock, and the rationality of the directed graph structure is reflected in its ability to express complex attack chains. The effectiveness of community detection algorithms affects the accuracy of attack phase division, and the quality of node attribute labeling determines the interpretability of the graph. The identification effect of deep relationship attack techniques and tactics through frequent pattern mining, and the breadth of self-starting attribute detection affect the ability to discover persistence mechanisms. The accuracy of scheduled task parsing determines the detection rate of timed-triggered attacks, and the depth of service registration item analysis affects the probability of discovering hidden backdoors. The accuracy of network session mapping is related to the completeness of attack chain reconstruction, and the reliability of persistent connection point marking determines the credibility of attribution conclusions.

[0040] The visualization of the attack behavior graph employs a force-directed graph algorithm, clearly displaying attack paths and relationships through a node layout. Graph analysis results are correlated with threat intelligence, enriching the graph's semantic information by comparing it with known attack patterns. Tracing persistent connection points, combined with multi-source log data, reconstructs the attacker's complete lifecycle from intrusion to persistence. This entire technical solution elevates the understanding from low-level system events to advanced attack intentions, providing security analysts with intuitive attack situation awareness. Structured storage of graph data supports complex queries and analysis, enabling efficient multi-hop queries and path analysis through graph database technology. Persistence mechanism identification results directly drive incident response measures, helping security teams quickly eliminate persistent strongholds established by attackers. Network session mapping evidence supports attack attribution, and analyzing command and control server characteristics assists in threat intelligence production. The continuous updating mechanism of the attack behavior graph adapts to the evolution of multi-stage attacks, discovering new attack activities through real-time graph comparison.

[0041] Example 4: The process of reconstructing the attack path based on persistent connection points and timestamps begins with the collaborative analysis of multi-dimensional data sources. Persistent connection points serve as a stable foothold established by the attacker in the system, while timestamps provide a temporal framework for events. Starting from the persistent connection points, historical connection records in network device logs are queried. These logs originate from network infrastructure such as firewalls, intrusion detection systems, and routers, and contain complete session metadata. The source address, destination address, and timestamp fields are extracted from the connection records. The source address field contains IPv4, IPv6, or MAC address information; the destination address field indicates the accessed honeypot system or production system resource; and the timestamp field records the connection start and end times. The timestamps are aligned with the event times in the honeypot operation sequence. The time alignment algorithm uses dynamic time warping to compensate for clock drift between different systems. The event times are derived from system call logs collected by the honeypot monitoring agent. Based on the alignment results, a complete path from the initial intrusion point to the persistent connection point is constructed. The path construction algorithm applies the shortest path algorithm from graph theory combined with time constraints. Specifically, a complete path from the initial intrusion point to the persistence point is constructed based on the alignment results. The path construction algorithm uses Dijkstra's algorithm from graph theory to find the shortest path. In the graph, nodes represent network connection events, and edges represent the temporal sequence of events. Time constraints are transformed into edge weight functions, which penalize edges with excessively long time intervals. The path search is limited to the set of event nodes within a time window. The constructed path ensures temporal continuity between nodes and minimizes the total time span. The continuity and rationality of each node in the path are verified. Continuity verification checks whether the time interval between adjacent nodes is within a reasonable range, and rationality verification is based on network protocol specifications and system architecture constraints.

[0042] Correlation analysis of the reconstructed attack paths with the threat intelligence database requires the integration of internal and external intelligence resources. The source addresses in the reconstructed attack paths are submitted to multiple external threat intelligence sources, including commercial threat intelligence platforms, open-source intelligence communities, and industry information-sharing organizations. Threat indicators and confidence levels are obtained from each source. Threat indicators describe malware families, attack group affiliations, and tactical procedures, while confidence levels reflect the credibility of the intelligence. The threat indicators from all sources are integrated for consistency testing, employing a multi-source voting mechanism combined with a weighted scoring algorithm. A comprehensive threat score is calculated for each source address based on the consistency test results, taking into account the freshness, relevance, and severity of the threat indicators. The comprehensive threat score is then matched against historical attack patterns, with a database storing the characteristics of previously successfully identified attack cases.

[0043] The characteristic analysis of threat intelligence sources has a significant impact on the reliability of correlation results. Different threat intelligence sources vary significantly in terms of data coverage, update frequency, and accuracy. See Table 1 for a comparative view of typical threat intelligence sources.

[0044] Table 1: Comparison of Threat Intelligence Source Characteristics Querying network device logs requires handling massive data storage and rapid retrieval. Distributed log management systems utilize technologies like Elasticsearch to index and query petabyte-scale log data. Specifically, the Elasticsearch architecture distributes index data across multiple nodes based on a sharding mechanism. Each shard creates an inverted index to support full-text search. The query process routes requests to relevant shards through distributed coordination nodes, and the results are aggregated and returned to the client. Index optimization employs batch writing and near real-time refresh strategies to balance performance and consistency. The source address extraction process handles network address translation, reconstructing the true source address information by associating firewall session tables and network flow records. The timestamp alignment algorithm considers time zone conversion and leap second adjustments, using International Atomic Time as the standard time reference. The path construction algorithm introduces time window constraints, considering only connection events occurring within a specific time range to constitute a valid path. Continuity verification sets a maximum allowed time interval threshold; node intervals exceeding the threshold are considered path breaks. Reasonableness verification checks whether network connections conform to the TCP / IP protocol state machine specification; abnormal state transition sequences are marked as suspicious paths.

[0045] Threat intelligence queries employ an asynchronous parallel processing model, sending query requests to multiple intelligence sources simultaneously and implementing a timeout mechanism. Threat indicator integration establishes a unified indicator formatting standard, converting indicator expressions from different intelligence sources into a standardized data model. A consistency check algorithm handles intelligence conflicts, making a weighted decision based on confidence level and historical accuracy when different intelligence sources return contradictory conclusions. The comprehensive threat scoring model uses a multi-factor weighted formula, with factor weights dynamically adjusted through machine learning training. Historical attack pattern matching utilizes a similarity calculation algorithm to find the historical cases most similar to the current attack in the feature space.

[0046] The completeness of network device logs directly impacts the accuracy of path reconstruction. The log collection system must ensure clock synchronization and reliable log transmission for network devices. Source address authenticity verification uses reverse DNS queries and WHOIS information supplementation to identify attacks using spoofed source addresses. Timestamp alignment accuracy must be at the millisecond level, employing a precise time protocol to achieve microsecond-level synchronization between network devices. During path construction, log association with network address translation devices is handled, and the translated address is restored to its original address through session table mapping. Continuity verification considers network latency and log recording delays, setting a dynamic time tolerance window. Reasonableness verification incorporates network topology data to check whether the connection path conforms to routing planning and access control policies.

[0047] Threat intelligence queries need to balance query latency and intelligence completeness in terms of coverage, and an intelligence caching mechanism should be established to improve query response speed. Threat indicator standardization addresses data format differences between intelligence sources, establishing a unified malware classification system and attack organization naming conventions. Consistency checks handle dependencies between intelligence sources, avoiding the illusion of consistency caused by data from the same source. The comprehensive threat scoring model needs to be recalibrated regularly to adapt to changes in the threat environment and the emergence of new attack methods. Historical attack pattern matching employs case-based reasoning techniques, matching not only surface features but also attack behavior patterns.

[0048] The visualization of reconstructed attack paths uses a timeline chart to clearly present the temporal relationships and causal connections of attack activities. Threat intelligence correlation results enrich the contextual information of the attack paths, helping analysts understand attack intent and background. Comprehensive threat scoring supports security event prioritization, guiding the rational allocation of emergency response resources. Historical attack pattern matching enables the classification and grouping of attack activities, uncovering potential attack activity patterns. The entire technical solution forms a complete chain from raw logs to intelligent analysis, improving the efficiency and accuracy of threat hunting. The path reconstruction results are cross-validated with the operation sequences recorded in the honeypot environment, enhancing the credibility of the attribution conclusions. Threat intelligence correlation establishes a connection between individual security events and the global threat environment, achieving a comprehensive security situation awareness. Comprehensive threat scoring quantitatively assesses the severity of attacks, providing data support for security decisions. Historical attack pattern matching promotes the accumulation and reuse of security knowledge, building the organization's own attack pattern library. Visualization lowers the technical threshold for security analysis, enabling personnel with different professional backgrounds to understand the attack chain.

[0049] The timestamp accuracy of network device logs is guaranteed by deploying a network time protocol server, and core network devices use hardware clock sources to improve time recording accuracy. The path reconstruction algorithm handles massive connection data in large-scale network environments, employing a distributed graph computing framework to improve processing performance. The threat intelligence query interface is standardized and encapsulated, supporting standard protocols such as RESTful API and STIX / TAXII. The credibility assessment of consistency verification results incorporates grey system theory to handle uncertain reasoning in small sample situations. The application of the comprehensive threat scoring model needs to consider the differences in security policies among different organizations, providing a customizable scoring rule engine. The similarity threshold for historical attack pattern matching is dynamically adjusted based on the balance between false positive and false negative rates to adapt to the detection needs of different security levels.

[0050] The completeness of attack path reconstruction depends on the coverage of log collection, requiring all critical network nodes to have logging enabled. Real-time threat intelligence correlation necessitates efficient data pipelines to achieve low-latency processing from intelligence reception to analysis results. The comparability of comprehensive threat scores requires standardization to eliminate scale differences between intelligence sources. The historical attack pattern database needs regular updates to include new attack cases, maintaining its timeliness. The entire technical solution must balance performance and cost in practical deployment, employing a layered storage strategy to manage the ever-increasing log and intelligence data. The interpretability of path reconstruction results is ensured by generating detailed reasoning chains, with clear evidence supporting the addition of each path node. The transparency of threat intelligence correlation requires recording the contribution of each intelligence source, facilitating analysts' assessment of the reliability of conclusions. The dynamic nature of the comprehensive threat score reflects changes in the threat environment, necessitating a regular score update mechanism. The accuracy of historical attack pattern matching is improved through continuous feedback loops, feeding verification results back into the pattern matching algorithm to optimize parameters.

[0051] Example 5: The process of outputting the source tracing report begins with the structured integration of multi-source analysis data. This process unifies the formatting of path node data generated by the attack path reconstruction module, dwell point information output by the persistent join point identification module, and indicator data generated by the threat intelligence association module. When integrating attack paths, persistent join points, and threat intelligence association results into a structured dataset, the structured dataset uses JSON-LD format for semantic annotation. The attack path data includes node sequences, edge attributes, and time span information; the persistent join point data records the self-starting mechanism type and activation conditions; and the threat intelligence association results save indicator values, confidence levels, and intelligence source identifiers. The structured dataset is converted into a readable format according to a predefined template. The predefined template uses the Jinja2 template engine for dynamic rendering, and the readable format includes a hierarchical chapter structure, tabular data display, and embedded vector graphics. A detailed report is generated, including an attack timeline, resource relationship diagram, and threat rating. The attack timeline uses a Gantt chart to display the time distribution of attack phases. The resource relationship diagram uses the Cytoscape.js library for interactive visualization. The threat rating classifies attacks into four levels: severe, high-risk, medium-risk, and low-risk, based on a comprehensive score. The report is then output to the security operations platform for further processing. The security operations platform receives the report data through a RESTful API interface for further processing, including alarm generation, work order creation, and response process triggering.

[0052] The attack path data records the attacker's lateral movement path from the initial intrusion point 192.0.2.100 to the internal network server 10.1.1.50, including four intermediate jumper nodes and three attack stages. Persistent connection point data revealed malicious entries in Windows scheduled tasks and the registry's Run key. The scheduled task is configured to execute a malicious payload at system startup, and the registry key points to a malicious executable file in a hidden directory. Threat intelligence correlation results mark the source address as a known ransomware-as-a-service infrastructure, and the associated threat indicators include file hash values ​​and C2 domain information. The structured dataset achieves semantic interoperability through JSON-LD context definitions. Attack path nodes are annotated using tactical numbers from the MITREATT&CK framework, and persistent connection points are labeled with technology numbers according to the persistence technology classification method.

[0053] The predefined template design includes eight standard sections: the Execution Summary section condenses key findings and impact assessments; the Attack Timeline section lists major events chronologically; the Attack Chain Analysis section breaks down the technical details of each stage of the attack; the Impact Assessment section quantifies the scope of asset losses and data breaches; the Threat Intelligence Correlation section displays the mapping between internal metrics and external intelligence; the Recommended Measures section provides technical mitigation and process improvement solutions; and the appendix includes original log samples and a complete list of metrics. The template rendering engine populates structured data into corresponding fields, automatically generating trend charts for numeric data and highlighting keywords for textual data. The Gantt chart of the attack timeline shows the temporal overlap between the four stages: initial intrusion, lateral movement, data theft, and encryption breach; and the resource relationship diagram, laid out using a force-directed algorithm, clearly displays the connections between compromised hosts and malicious domains.

[0054] The threat rating model considers three dimensions: attack complexity, impact scope, and business loss. Each dimension has a weighted coefficient and scoring details. Attack complexity assesses the technical sophistication of the attack chain, its ability to evade detection, and its persistence depth. Impact scope calculates the number of infected systems, network area span, and data asset types. Business loss estimates downtime, recovery costs, and compliance penalties. Rating results are presented intuitively using color coding, with severity levels marked in red and triggering an emergency response process. After the report is output to the security operations platform, the platform parses the report metadata and automatically assigns it to a processing team. Response timeliness requirements are set according to the threat level; severity reports require confirmation of receipt within 15 minutes and containment measures implemented within 2 hours.

[0055] The generation of structured datasets requires addressing the pattern conflicts between multi-source data. Attack path data employs a directed graph data model, persistent join point data uses a relational data model, and threat intelligence data uses an indicator-based data model. The JSON-LD format achieves heterogeneous data fusion by defining a unified semantic context, using the `@graph` keyword to encapsulate graph data, and the `@type` field to distinguish entity types. The predefined template's chapter order follows the logical flow of security incident analysis, from phenomenon description to underlying analysis and response recommendations. Each chapter sets data population validation rules to ensure completeness. The attack timeline visualization adopts a responsive design, automatically converting to a vertical timeline display on mobile devices, and the resource relationship graph supports expanding detailed information views by clicking on nodes.

[0056] Threat rating calculations employ a weighted scoring card mechanism, with each of the nine scoring items having a quantitative standard ranging from 0 to 10 points. Weighting coefficients are determined using the analytic hierarchy process (AHP). The report output interface supports multiple transmission protocols; message queues ensure reliable delivery in on-premises environments, while digital signatures ensure report integrity in cloud environments. The security operations platform's parsing module identifies key entities in the report, automatically compares them with the configuration management database to determine asset ownership, and correlates them with the risk register to calculate business impact. Response process triggers are tied to threat ratings; severity-level reports automatically activate the incident response plan and convene an emergency meeting with the crisis management team.

[0057] The ransomware attack report showcases standardized output: The execution summary section uses three paragraphs to describe the attack overview, including the intrusion time, affected systems, and preliminary attribution conclusions. The attack timeline section lists twenty key event points, each including a timestamp accurate to the second, source IP address, target IP address, and action description. The attack chain analysis section corresponds to the seven tactical phases of the MITREATT&CK matrix, listing the technology numbers used and detection recommendations for each phase. The impact assessment section statistics on the number of encrypted files, affected business systems, and data leakage volume, using a table to compare normal baseline values ​​with abnormal peaks. The threat intelligence correlation section presents a consistency comparison of ten external intelligence sources, using a heatmap to show the degree of overlap in indicators. The recommended actions section provides immediate mitigation measures and long-term hardening solutions. Immediate measures include isolating network segments, resetting credentials, and patching vulnerabilities, while long-term solutions involve architectural improvements and enhanced security controls.

[0058] Data consistency checks during report generation ensure correct citation relationships between different chapters, and bidirectional hyperlinks are established between events on the attack timeline and nodes in the resource relationship diagram. Template rendering optimizes the display performance of large-scale data; attack paths with over a hundred nodes employ a paginated loading mechanism, and complex relationship diagrams provide zoom and pan controls. Multi-dimensional visualization of threat rating results uses radar charts to show the distribution of strengths and weaknesses, helping decision-makers quickly understand the risk composition. The security operations platform's integration interface supports bidirectional data interaction, receiving both generated reports and providing feedback on handling status updates and source tracing conclusions.

[0059] The structured dataset is stored using a version control mechanism, retaining historical versions for easy auditing and tracing with each report update. Predefined templates are maintained through a template library, with specialized template variants corresponding to different attack types. Ransomware attack templates focus on data recovery and decryption probability assessment, while advanced persistent threat (APS) attack templates focus on covert channel detection and attacker attribution analysis. Attack timelines support multi-timezone conversion, meeting the collaborative analysis needs of multinational organizations. The resource relationship graph layout algorithm optimizes node arrangement, reducing cross-connections and improving the readability of visualizations. Threat rating model parameters can be dynamically adjusted, allowing for customized scoring weights based on organizational risk preferences.

[0060] The post-report quality inspection process verifies data accuracy and logical consistency, with an automatic verifier detecting issues such as inconsistent time sequences, incorrect address formats, and invalid references. The security operations platform's processing status tracking enables report lifecycle management, providing full-process visualization from generation and distribution to processing and closure. Response action trigger conditions support complex rule definitions and can be configured to trigger multi-stage response processes through multiple condition combinations. The entire report generation system forms a closed-loop management system, with output results used to optimize detection rules and strengthen defense systems, achieving a continuously improving security operations model.

[0061] It should be noted that, in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus.

[0062] Although embodiments of the invention have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the appended claims and their equivalents.

Claims

1. A method for proactive threat hunting and tracing using AI agents and honeypot technology, characterized in that, The method performs the following steps: continuously capturing inbound and outbound data packets through a threat-aware agent deployed at the network boundary; The captured data packets are parsed for protocols and their payload features are extracted to generate network behavior fingerprints; Real-time matching of network behavior fingerprints with a known attack signature database; When the matching degree exceeds the dynamic threshold, the high-interaction honeypot environment is activated to simulate real business services. Inducing attack traffic to enter a highly interactive honeypot environment to perform isolation operations; Record the complete operation sequence of attack traffic in a highly interactive honeypot environment; Generate attack behavior graphs based on operation sequences; Persistent connection points and timestamp markers in the attack behavior graph are extracted by source tracing analysis of the proxy; Reconstruct the attack path based on persistent join points and timestamps; The reconstructed attack paths are correlated with the threat intelligence database for analysis, and an attribution report is generated.

2. The method for active threat hunting and tracing using AI agents and honeypot technology according to claim 1, characterized in that, The protocol parsing and payload feature extraction of the captured data packets include: performing layered parsing on the captured data packets, sequentially decapsulating the network layer, transport layer, and application layer header information; identifying command strings and parameter sequences from the application layer payload; performing syntactic analysis on the command strings to construct an abstract syntax tree; extracting key operators and operands from the abstract syntax tree as feature elements; and combining the feature elements with the header information to form a standardized feature vector.

3. The method for proactive threat hunting and tracing using AI agents and honeypot-based technology according to claim 1, characterized in that, The update process of the known attack signature database includes: receiving network behavior fingerprints periodically uploaded by a distributed threat awareness agent; grouping the network behavior fingerprints in real time using a streaming clustering algorithm; calculating the similarity score between each group and existing attack signatures; when the similarity score exceeds a dynamically adjusted threshold, merging the new group into the known attack signature database; and periodically cleaning up expired signatures in the known attack signature database.

4. The method for proactive threat hunting and tracing using AI agents and honeypot-based technology as described in claim 1, characterized in that, The construction process of the high-interaction honeypot environment includes: selecting the type of business service to be simulated based on the current network threat situation; deploying dynamically configurable virtual machine instances in isolated network segments; installing operating systems and middleware consistent with the real environment in the virtual machine instances; embedding a lightweight monitoring agent to capture system kernel events and network interaction data; and adjusting the configuration parameters of the virtual machine instances in real time according to the behavioral characteristics of attack traffic.

5. The method for proactive threat hunting and tracing using AI agents and honeypot-based technology according to claim 1, characterized in that, The complete operation sequence of the attack traffic in the high-interaction honeypot environment includes: monitoring the process creation and termination events triggered by the attack traffic in the honeypot environment; recording the system call parameters and return values ​​corresponding to each event; associating all system calls within the same session to form an event stream; sorting and deduplicating the event stream in chronological order; and generating an operation sequence log containing timestamps and dependencies.

6. The method for proactive threat hunting and tracing using AI agents and honeypot-based technology according to claim 1, characterized in that, The method of generating an attack behavior graph based on operation sequences includes: parsing resource access patterns in the operation sequences, including file read / write, registry modification, and network connection; identifying causal relationships and temporal relationships between resources; constructing a directed graph structure with resource entities as nodes and access operations as edges; performing community detection on the graph structure to identify potential attack modules; and adding attribute tags to each node to enhance readability.

7. The method for proactive threat hunting and tracing using AI agents and honeypot-based technology according to claim 1, characterized in that, The extraction of persistent connection points includes: scanning the frequently occurring node sequences in the attack behavior graph; analyzing whether the system configuration items corresponding to the nodes have auto-start attributes; detecting scheduled tasks and service registration items in the auto-start attributes; mapping the detected auto-start items to network sessions; and marking persistent connection points in the mapping results.

8. The method for proactive threat hunting and tracing using AI agents and honeypot-based technology according to claim 1, characterized in that, The reconstruction of the attack path based on persistent connection points and timestamps includes: starting from the persistent connection point, querying historical connection records in the network device logs; extracting the source address, target address, and timestamp from the connection records; aligning the timestamp with the event times in the honeypot operation sequence; constructing a complete path from the initial intrusion point to the persistent point based on the alignment result; and verifying the continuity and rationality of each node in the path.

9. The method for proactive threat hunting and tracing using AI agents and honeypot-based technology according to claim 1, characterized in that, The process of correlating the reconstructed attack path with the threat intelligence database includes: submitting the source addresses in the reconstructed attack path to multiple external threat intelligence sources; obtaining the threat indicators and confidence levels returned by each threat intelligence source; integrating all threat indicators for consistency verification; calculating the comprehensive threat score of the source address based on the consistency verification results; and matching the comprehensive threat score with historical attack patterns.

10. The method for proactive threat hunting and tracing using AI agents and honeypot-based technology according to claim 1, characterized in that, The output source tracing report includes: integrating attack paths, persistent connection points, and threat intelligence correlation results into a structured dataset; converting the structured dataset into a readable format according to a predefined template; generating a detailed report containing an attack timeline, resource relationship diagram, and threat rating; and outputting the report to the security operations platform for further processing.

Images