A world model-based honeypot intelligent modeling and dynamic response method

Abstract

This invention discloses a honeypot intelligent modeling and dynamic response method based on a world model, comprising: constructing a multimodal attack state perception and fusion coding architecture to uniformly abstract heterogeneous attack observation data into a compact hidden state representation; explicitly learning attack state transition rules through a hidden state-action joint representation construction module to predict the multimodal distribution of the attacker's next behavior and implicitly discover the attack stage evolution; pre-training response strategies in a dream-like virtual environment constructed by a dynamic model to achieve efficient strategy optimization for virtual attacker interactions; finally, evaluating the realism of the dynamic response through a virtual-real discriminator for a security fallback switch, and outputting compliant response messages through a protocol encapsulation module. This invention achieves predictive modeling and proactive trapping response of the attack process, significantly improving the interaction depth, trapping efficiency, and intelligence gathering capabilities of the honeypot while ensuring response realism and protocol compliance.

Description

Technical Field

[0001] This invention belongs to the technical field of network security, specifically relating to a honeypot intelligent modeling and dynamic response method based on a world model. Background Technology

[0002] In the field of proactive deception defense in cybersecurity, honeypots, as a key technology that simulates real systems to lure attackers and collect attack intelligence, play a crucial role in delaying attack processes, revealing attack methods, and supporting threat analysis. With the increasing prevalence of Advanced Persistent Threats (APTs) and zero-day vulnerability attacks, modern honeypot systems face three core challenges: difficulty in fusing multimodal heterogeneous attack data, lack of attack situation prediction and process extrapolation capabilities, and rigid response strategies with high optimization costs. Attacker behavior has evolved from simple port scanning to multi-stage collaborative attacks encompassing reconnaissance, vulnerability exploitation, privilege escalation, lateral movement, and data theft. Attack characteristics exhibit new threat features such as strong interactivity (e.g., command injection and privilege maintenance), long cycles (e.g., multi-step APT penetration), and policy adaptability (e.g., adjusting attack paths based on honeypot responses). Especially in highly interactive honeypot scenarios, traditional response methods based on static rule bases or simple script matching struggle to effectively simulate the complex behavior of real systems. These methods are easily identified by attackers through multi-dimensional methods such as protocol fingerprints, response sequences, and behavioral patterns, leading to honeypot exposure and failure. Therefore, there is an urgent need to build an adaptive honeypot defense paradigm that integrates multimodal perception, attack dynamics modeling, and intelligent response decision-making, so as to realize the transformation from "passive trapping" to "active trapping" defense mode.

[0003] To address the aforementioned challenges, researchers both domestically and internationally have conducted extensive research across multiple dimensions, including honeypot deployment optimization, intelligent interactive response, large-scale model empowerment, and architectural innovation, achieving a series of preliminary results. In the field of honeypot deployment and resource allocation, researchers primarily utilize game theory to model the strategic interactions between attackers and defenders, enabling strategic honeypot deployment. Park et al. proposed an adaptive honeypot allocation framework based on Bayesian Stackelberg games, achieving continuous inference of attacker intent through multi-attack modeling and dynamic belief updates, optimizing honeypot deployment location and type in multi-node networks. Sayed et al. constructed a two-player dynamic game model, generating optimal honeypot allocation strategies for scenarios with dynamically changing tactical network topologies, balancing trapping probability and deployment cost through a Nash equilibrium iterative algorithm. Gao et al. proposed the HoneyVDep multi-stage stochastic game dynamic deployment mechanism, combining Q-Learning algorithms to enable honeypots to adaptively adjust deployment strategies based on attacker behavioral characteristics, and constructed a scalable prototype system based on software-defined networking (SDN) and virtualized container technology. However, the aforementioned game theory methods all model attackers as rational decision-making individuals, relying on prior assumptions about the attacker's payoff function. In real-world scenarios where attacker behavior is unpredictable or strategies are irrational, the model assumptions deviate significantly from actual attack behavior. Furthermore, they only focus on optimizing the honeypot deployment location and do not address the generation of interactive response strategies between the honeypot and the attacker.

[0004] To overcome the bottleneck of static response, researchers have turned to honeypot intelligent interaction methods based on reinforcement learning. Guan et al. developed the HoneyIoT adaptive high-interaction IoT honeypot, which dynamically adjusts the honeypot response content according to the attacker's behavior through reinforcement learning, significantly improving the trapping effect and response realism in heterogeneous IoT device scenarios. Wang et al. proposed the AARF autonomous attack response framework, which models the attack and defense interaction process based on multi-agent dynamic game theory. The attacking agent uses a hidden Markov model combined with the ATT&CK framework to generate a multi-step attack chain, and the defending agent iteratively learns the optimal response strategy through reinforcement learning. They also designed a dynamic value tag sampling method to improve the sample utilization efficiency in the experience replay stage. However, existing reinforcement learning-based honeypot response methods have fundamental limitations: policy learning is highly dependent on online interaction data with real attackers, the samples are sparse and the exploration risk is uncontrollable. High-interaction exploration may lead to the honeypot being compromised or exposed, while low-interaction exploration cannot obtain effective training signals. Furthermore, they lack the ability to model the attack process globally, and policy decisions are based only on the current observed state and cannot predict the attacker's subsequent behavior, resulting in a lack of foresight in the response.

[0005] In recent years, the rapid development of large language models has provided a new technical path for intelligent honeypot responses. Otal et al. proposed using large language models to build highly interactive honeypot systems. Through supervised fine-tuning on attacker command-response datasets, the honeypots can generate semantically reasonable and information-rich interactive responses, significantly improving the quality of adversarial dialogue with attackers. Li et al. designed the LLMHoney real-time SSH honeypot system, embedding large language models into the SSH service layer to achieve command-level real-time responses, demonstrating good interaction depth and trapping capabilities in real attack traffic deployments. However, large language model honeypots are essentially still response generation based on pattern matching, lacking a structured understanding of attacker intent and a systematic ability to predict attack progress. Furthermore, large language models suffer from the "illusion" problem; generated content may reveal the honeypot's identity or violate network protocol specifications, and there is a lack of systematic fidelity assessment and security fallback mechanisms. In addition, the high computational cost of large language models also limits their real-time deployment in resource-constrained environments.

[0006] In terms of honeypot architecture and deployment, researchers have made numerous innovations for different application scenarios. He et al. proposed a dynamic interactive web honeypot for industrial control systems, which flexibly simulates different industrial control protocols such as Modbus and S7 through configurable attack surfaces and response logic. Wagener et al. conducted a systematic comparative study of existing industrial control honeypots, revealing the shortcomings of existing solutions in terms of protocol simulation depth and attack behavior capture granularity. Shafiq et al. proposed a containerized cloud honeypot deception framework, using cloud-native technologies to achieve elastic deployment and dynamic scaling of honeypots, but the container-level isolation mechanism still cannot meet the system realism requirements of high-interaction scenarios. Vidal et al. studied reinforcement learning honeypot deployment strategies in multi-deception resource scenarios, optimizing the joint decision-making of honeypot type and location under limited resource constraints. Uzbek et al. explored honeypot strategic deployment methods in blockchain and IoT scenarios, using the immutability of blockchain to enhance the credibility of honeypot data. Volkov et al. built an LLM Agent honeypot monitoring system, specifically for capturing and analyzing the behavior of automated attack agents driven by large language models. The aforementioned work has made some progress in honeypot deployment architecture and attack surface management, but none of it has addressed the core issues of intelligent generation of honeypot response strategies and predictive modeling of attack situations. Honeypots are still in a "passive trapping" defense mode.

[0007] World models, as a type of generative forward dynamics model framework, enable agents to rehearse potential future events in an internal "dream" by explicitly modeling the state transition patterns of the environment, and optimize decision-making strategies based on the rehearsal results. A world model typically consists of three parts: a perceptual encoder (V module), a cyclic state prediction model (M module), and a controller (C module). The perceptual encoder is responsible for compressing high-dimensional raw observation data into low-dimensional hidden state representations; the cyclic state prediction model is responsible for predicting the hidden state distribution at the next moment based on the current hidden state and actions; and the controller optimizes decision-making strategies through reinforcement learning within the "dream" generated by the world model. Introducing world models into honeypot systems is expected to solve the problems of insufficient attack situation prediction capabilities and high policy optimization risks in existing technologies. By explicitly modeling the attack state transition patterns, the honeypot can rehearse possible attacker behaviors in an internal "dream" and generate predictive dynamic responses. However, the modeling of real attack dynamics by world models is essentially an approximate learning process, and the dynamic responses they generate may have distributional deviations from the behavior of real systems. Existing technologies lack effective mechanisms to determine whether such dynamic responses are sufficient to deceive experienced attackers.

[0008] Further analysis of existing technical solutions reveals several shortcomings. Regarding attack state representation, the reinforcement learning honeypot proposed by Yu Zhongyang et al. uses a single environment awareness module, simply concatenating attacker features, network environment features, and honeypot state features into a state vector before directly inputting it into the policy network. This lacks the ability to model semantic relationships between heterogeneous data sources. While the virtual-real hybrid honeypot proposed by Yin Lihua et al. introduces multi-source data input, its formatted input is merely a simple feature concatenation, lacking an intermodal attention mechanism. This results in the ineffective utilization of complementary information between different modalities. This simple feature fusion method is insufficient to comprehensively characterize complex attack behaviors and attacker intentions, limiting the accuracy of subsequent decisions. Regarding attack dynamics modeling, the reinforcement learning honeypots developed by Yu Zhongyang et al. only learn the implicit policy mapping from the current state to the response action, without explicit modeling of the attack state transition rules, and cannot predict the attacker's next action. The adversarial reinforcement learning honeypot deployment method developed by Zhao Chengcheng et al. uses a Markov decision model to model the interaction process, but this model is only used to define the state-action space framework and does not perform forward prediction of attack state transitions. Large language model honeypots developed by LLMHoney et al. generate responses based on token-by-token autoregression of the current input, lacking a systematic understanding of the historical process and future direction of the attack. The lack of attack dynamics modeling prevents the honeypot from predicting the attacker's intent and next action in advance, resulting in defense always lagging behind the attack process. In terms of policy optimization, the reinforcement learning honeypots developed by Yu Zhongyang et al. require extensive interaction with real attackers to converge to an effective policy, resulting in extremely low training sample efficiency and a high risk of the honeypot being compromised or exposed during the exploration process. The RUQL algorithm developed by Zhao Chengcheng et al. also relies on online interaction in an adversarial environment for policy optimization, failing to complete policy warm-up before deployment, leading to poor trapping effects in the early stages of deployment. In terms of response security control, Yin Lihua et al.'s virtual-real hybrid honeypot uses a capability boundary discriminator to switch between virtual and real modes. However, this discriminator is based on predefined static simulation capability boundary rules and cannot assess the realism and logical consistency of the generated content itself. Large language model honeypots such as LLMHoney rely on prompting engineering and post-processing to alleviate the illusion problem. They lack a systematic quality assessment and security fallback mechanism and cannot effectively prevent the generated content from revealing the honeypot's identity or violating protocol specifications.

[0009] In summary, current honeypot systems suffer from three major technical bottlenecks: First, the perception dimension is singular and lacks fusion. Traditional honeypots only collect single-dimensional data such as network traffic, lacking unified perception and deep fusion encoding of multimodal heterogeneous attack data such as network traffic, command sequences, system status, and historical behavior, making it difficult to comprehensively characterize the attacker's behavioral intentions. Second, the ability to predict attack trends and extrapolate processes is lacking. Existing honeypots only passively record and match rules for attacks that have already occurred, unable to predict the attacker's next move probabilistically, let alone implicitly discover the evolutionary patterns of attack stages, resulting in defense always lagging behind the attack process. Third, the response strategy is rigid and optimization is costly. Traditional honeypot responses are based on static rules, making low-interaction honeypots easy to identify and high-interaction honeypots risky and uncontrollable. In contrast, intelligent response strategies based on reinforcement learning require a large amount of online interaction data with real attackers, resulting in sparse samples and high exploration risks, making it difficult to complete strategy preheating and optimization before deployment. Summary of the Invention

[0010] The main objective of this invention is to overcome the shortcomings and deficiencies of existing technologies and provide a honeypot intelligent modeling and dynamic response method based on a world model. By constructing a world model honeypot architecture that integrates multimodal perception, dynamic prediction, dream pre-playing, and virtual-real discrimination, it achieves predictive modeling and proactive trapping response to attack processes. Under the premise of ensuring the realism of the response and protocol compliance, it significantly improves the interaction depth, trapping efficiency, and intelligence gathering capabilities of the honeypot.

[0011] To achieve the above objectives, the present invention adopts the following technical solution:

[0012] In a first aspect, the present invention provides a honeypot intelligent modeling and dynamic response method based on a world model, comprising the following steps:

[0013] A multimodal attack state awareness and fusion coding architecture is constructed to abstract the collected heterogeneous attack observation data into a compact attack hidden state vector; the multimodal attack state awareness and fusion coding architecture includes multiple feature coding modules and cross-modal attention modules;

[0014] Input the attack hidden state vector and the response action vector of the previous time step, and explicitly learn the attack state transition rules through the hidden state-action joint representation construction module to predict the multimodal distribution of the attacker's next behavior and implicitly discover the attack stage.

[0015] In the dream virtual environment constructed by the hidden state-action joint representation construction module, policy pre-training is performed to achieve efficient policy optimization of virtual attacker interaction and obtain the optimal response action at the current moment.

[0016] The attack concealed state vector and the optimal response action are jointly transmitted to the virtual-real discriminator module. The virtual-real discriminator is used to evaluate the fidelity. The response content is obtained according to the virtual-real discrimination and security response mechanism. The compliant response message is output through the protocol encapsulation module and delivered to the attacker through the honeypot network interface, thus completing this response cycle.

[0017] As a preferred technical solution, the feature encoding module includes a network traffic encoding module, a command sequence encoding module, a system status encoding module, and a historical behavior encoding module;

[0018] The network traffic encoding module includes a one-dimensional convolutional neural network, a LeakyReLU non-linear activation function, a BatchNorm layer to enhance features, and a self-attention module;

[0019] The command sequence encoding module employs a multi-layer Transformer Encoder, each layer of which includes a multi-head self-attention and feedforward network. The feedforward network includes two linear transformations and GELU activation.

[0020] The system state coding module includes a multilayer perceptron and a learnable step-level position encoder. The multilayer perceptron includes a fully connected layer and a ReLU activation function. The learnable step-level position encoder is used to distinguish information at different time steps.

[0021] The historical behavior encoding module employs a bidirectional long short-term memory network, including a multilayer perceptron and layer normalization operations.

[0022] As a preferred technical solution, the step of uniformly abstracting the collected heterogeneous attack observation data into a compact attack hidden state vector includes:

[0023] The heterogeneous raw data is unified into a structured feature matrix, which is then input into the feature encoding module for processing. The structured feature matrix includes a network traffic feature matrix, a command sequence feature matrix, a system status feature matrix, and a historical behavior feature matrix.

[0024] The network traffic encoding module extracts local temporal pattern features from the network traffic feature matrix along the time dimension using a one-dimensional convolutional neural network. After convolution, a network traffic feature map is obtained. The LeakyReLU nonlinear activation function and BatchNorm layer are used to enhance the features. The self-attention module is used to capture the long-range dependencies between time steps in the network traffic feature map. After self-attention weighting, average pooling is performed along the time dimension to compress multiple time steps into a single vector to obtain the network traffic feature vector.

[0025] The command sequence encoding module performs learnable position encoding on the command sequence feature matrix to obtain position-aware input, and uses Transformer Encoder to extract deep semantic features. Each layer sequentially performs multi-head self-attention and feedforward network calculations, and adds residual connections and layer normalization to obtain position-aware output. The sequence head [CLS] of the position-aware output is extracted as the global semantic representation of the command sequence, and the command sequence encoding vector is obtained by mapping through a linear projection layer.

[0026] The system state encoding module uses a multilayer perceptron to perform feature mapping on the system state feature matrix of each time step, and at the same time uses a learnable step-level position encoding to encode the system state feature matrix of each time step. The obtained encoding results are averaged and pooled along the time dimension to obtain the system state encoding vector.

[0027] The historical behavior encoding module inputs the historical behavior feature matrix into the bidirectional long short-term memory network along the time dimension. At each time step, the bidirectional long short-term memory network performs feature transformation on the historical behavior feature matrix, obtains the bidirectional hidden state, and extracts the bidirectional hidden state of the last time step and concatenates it as the historical behavior encoding vector.

[0028] The cross-modal attention module uses the command sequence encoding vector as the query matrix and concatenates the network traffic feature vector, system state encoding vector, and historical behavior encoding vector as the key matrix and value matrix. Using the command sequence encoding vector as the dominant modality, it calculates the cross-attention of the dominant modality and obtains the cross-attention output. After concatenating the cross-attention output and the command sequence encoding vector with residuals, it maps them to the final hidden state vector through a multilayer perceptron and layer normalization operations.

[0029] As a preferred technical solution, each layer sequentially performs multi-head self-attention and feedforward network calculations, and adds residual connections and layer normalization to obtain a position-aware output, as shown in the following formula:

[0030] ,

[0031] ,

[0032] in, This represents the input hidden state of the l-th layer Transformer Encoder. This represents the position-aware output of the l-th layer Transformer Encoder. This indicates multi-head self-attention calculation. This indicates feedforward network computation. Presentation layer normalization operation;

[0033] The multimodal attack state awareness and fusion coding architecture is trained using a self-supervised learning method, and its optimization objective is a weighted combination of reconstruction loss and KL divergence regularization, as shown in the following equation:

[0034] ,

[0035] in, This represents the original input data. This represents the reconstructed data. This represents the mean squared error loss, used to measure reconstruction quality. For KL divergence weights, This indicates KL divergence regularization. This represents the approximate posterior distribution of the encoder output. For the prior distribution, This represents the attack hidden state vector.

[0036] As a preferred technical solution, the hidden state-action joint representation construction module includes a fully connected layer, a cyclic dynamics forward prediction module, a hybrid density network, and an attack phase implicit discovery and uncertainty quantification module.

[0037] The forward prediction module of the cyclic dynamics includes two layers of gated cyclic units for predicting the sequence of cyclic hidden states. The input of the second layer of gated cyclic units is the hidden state output by the first layer of gated cyclic units.

[0038] The hybrid density network includes a shared fully connected layer and multiple parallel output layers, used to generate a multimodal probability distribution for attack state transitions;

[0039] The attack phase implicit discovery and uncertainty quantification module includes an uncertainty quantification module and an unsupervised clustering module. The uncertainty quantification module is used to quantify the uncertainty of the multimodal probability distribution, and the unsupervised clustering module is used to perform unsupervised clustering analysis on the cyclic hidden state sequence to implicitly discover the attack phase.

[0040] As a preferred technical solution, the step of performing policy pre-training in the dream virtual environment constructed by the hidden state-action joint representation construction module to achieve efficient policy optimization of virtual attacker interaction and obtain the optimal response action at the current moment specifically involves:

[0041] The attack hidden state vector and the previous time step response action vector are directly concatenated along the feature dimension to obtain a joint input vector. This joint input vector is then input into the hidden state-action joint representation construction module. A fully connected layer maps the joint input vector to the required input dimension, and the ReLU activation function is used to obtain the joint representation sequence. The previous time step response action vector is composed of action information, including service configuration actions, response strategy actions, vulnerability simulation actions, and environment migration actions.

[0042] The joint representation sequence is modeled using a forward prediction module of cyclic dynamics to obtain the cyclic hidden state sequence.

[0043] A hybrid density network is used to map the recurrent hidden state sequence to a hybrid density parameter space, outputting all parameters of multiple Gaussian components, including the mixing weights, mean vector, and diagonal covariance. Based on all parameters of the Gaussian components, a multimodal probability distribution for the attack state transition is generated, as shown in the following equation:

[0044] ,

[0045] in, This represents the probability that the attacker chooses the k-th attack path. This represents the average predicted attack state under this path. The range of uncertainty in the forecast. Let K represent the attack hidden state vector at time step t, and K represent the number of mixed components.

[0046] The uncertainty quantification module is used to quantify the uncertainty of the multimodal probability distribution and calculate the mixed weight entropy. As shown in the following formula:

[0047] ,

[0048] The dimensionality of the cyclic hidden state sequence is reduced by PCA using an unsupervised clustering module, and the dimensionality-reduced cyclic hidden state sequence is divided into multiple attack stage clusters using K-Means clustering.

[0049] As a preferred technical solution, the step of performing policy pre-training in the dream virtual environment constructed by the hidden state-action joint representation construction module to achieve efficient policy optimization of virtual attacker interaction and obtain the optimal response action at the current moment specifically involves:

[0050] Using the attack hidden state vector as the initial state, a dream virtual environment is constructed using the hidden state-action joint representation construction module. Policy pre-training is performed in the dream virtual environment to complete the initialization and optimization of the current response policy.

[0051] In the honeypot response controller, a parameterized strategy network is employed. Starting from the initial state, the dream rehearsal is executed cyclically, specifically by sampling actions based on the current response strategy. The current action is obtained, and the current state-action pair is used to construct a module that represents the input hidden state-action joint representation. The next state distribution is then obtained through forward prediction. Sample the next state from it And calculate instant rewards According to instant rewards Update response strategy;

[0052] The calculation of instant rewards Specifically, this involves: utilizing the state-action pairs at each step of the dream rehearsal for multi-objective optimization, and designing a four-dimensional composite reward function as the immediate reward. As shown in the following formula:

[0053] ,

[0054] in These are the weighting coefficients for each component. This indicates that the attack attracts rewards. This indicates a reward for information collection. This indicates a survival ability reward. Indicates the predicted calibration reward;

[0055] According to instant rewards Update the response strategy and use the PPO algorithm to update the parameterized policy network. Perform policy gradient updates to obtain the policy network parameters after the dream rehearsal is complete. ;

[0056] Based on the strategy network parameters after the dream rehearsal Online strategy fine-tuning is performed, and state-action-reward trajectory data is collected during online interactions with real attackers, including the hidden states of the real attackers. The attack data acquired in real time is encoded and generated by a multimodal attack state awareness and fusion encoding architecture. At the same time, KL divergence constraints are introduced to prevent the policy from deviating from the pre-trained policy, thus obtaining a fine-tuned policy network. ;

[0057] In response to real-time input from a real attacker, the policy network is fine-tuned based on the current hidden state input. After forward propagation, the action distribution parameters are output through the strategy head. The discrete action with the highest probability and the mean continuous action are selected from the action distribution parameters to form the final response action.

[0058] As a preferred technical solution, the near-end policy optimization algorithm is used to update the policy network parameters. Its truncation objective function is:

[0059] ,

[0060] ,

[0061] in, The probability ratio between the old and new strategies. The cutoff factor is , This is a generalized advantage estimate.

[0062] As a preferred technical solution, the attack concealment vector and the optimal response action are jointly transmitted to the virtual-real discriminator module. The virtual-real discriminator is used to evaluate the fidelity, and the response content is obtained according to the virtual-real discrimination and security response mechanism. Finally, a compliant response message is output through the protocol encapsulation module. Specifically:

[0063] The virtual / real discriminator employs a binary classification neural network architecture, and its input is a concatenated vector of the attack hidden state and the response action. The fidelity confidence score is output after calculation through a multi-layer fully connected network. The virtual / real discriminator is trained using binary cross-entropy loss;

[0064] The aforementioned virtual-to-real and security response mechanism specifically involves the virtual-to-real discriminator, during inference, determining the virtual-to-real score based on the confidence score. With preset threshold Execute the decision to switch between virtual and physical environments, that is:

[0065] when Output dynamic honeypot response ,when Automatically switch to static honeypot response ;

[0066] Input the response content and its corresponding target protocol type label into the protocol encapsulation module, and convert the response content into a bit-level communication message that conforms to the protocol specification according to the protocol type.

[0067] As a preferred technical solution, the step of converting the response content into a bit-level communication message conforming to the protocol specification according to the protocol type specifically includes:

[0068] For the SSH protocol, the response content is decoded from semantic vectors into raw text strings by a text encoder, and then encapsulated into an SSH_MSG_CHANNEL_DATA message according to the SSH2.0 protocol specification. The message is filled with the receive channel number, data length field, and encoded payload data, and the SSH session sequence number is maintained by incrementing the counter.

[0069] The format verification rules for each protocol encapsulation process are as follows:

[0070] ,

[0071] in, For the encapsulated complete protocol message, For the verification calculations required by the protocol, and The minimum and maximum message lengths are defined in the protocol specification. Indicates an indicator function, This represents the logical AND operator. Indicates calculation The length in bytes.

[0072] Compared with the prior art, the present invention has the following advantages and beneficial effects:

[0073] (1) The present invention has significant advantages in attack process prediction capability, strategy training efficiency and response security controllability. These advantages stem from the comprehensive application of a series of innovative technical means formed by creatively introducing the world model architecture into the honeypot field.

[0074] (2) In terms of predictive capability, this invention constructs the MDN-RNN architecture in the M module through the joint representation of attack hidden state and action. For the first time, it realizes explicit modeling and forward prediction of the attack state transition law in the honeypot system, overcoming the fundamental defect of existing technologies that only learn the implicit mapping from the current state to the response action and lack the ability to model the attack process. The K-component Gaussian mixture distribution output by the hybrid density network (MDN) can model the multimodality of the attacker's multi-path selection. Combined with multi-step prediction regularization, it ensures long-term prediction accuracy, enabling the honeypot not only to "understand" the current attack behavior, but also to "predict" the attacker's next action, thereby achieving predictive active trapping rather than passive response.

[0075] (3) Regarding training efficiency, this invention innovatively proposes a dream pre-playing mechanism. It utilizes a pre-trained attack hidden state-action joint representation construction module M to build a virtual interactive environment. The controller C performs PPO policy optimization within this virtual environment, virtually expanding limited real attack data into a near-infinite amount of training samples without interaction with real attackers. This technique overcomes the training bottleneck of existing reinforcement learning methods that rely on online interaction for convergence, enabling the honeypot to complete response policy pre-warming optimization before deployment, while avoiding the system security risks that may arise from exploring high-risk strategies in a real environment.

[0076] (4) Regarding response security, this invention designs a two-layer security mechanism consisting of a virtual / real discriminator and a multi-protocol encapsulation module. A neural network binary classification discriminator evaluates the realism of the dynamic response, and intelligently switches between dynamic and static responses through a confidence threshold, forming a "safety fallback" of two-layer protection. The multi-protocol encapsulation module performs format verification and checksum verification at the message level, and a timing control module introduces a response delay that matches the attacker's expectations, ensuring that the output dynamic response meets the requirements of protocol compliance and timing concealment. The above mechanism comprehensively solves the problems of illusion risk and uncontrollable response quality faced by existing large language model honeypots (such as LLM Honeyy), ensuring the security and reliability of the honeypot response. Attached Figure Description

[0077] To more clearly illustrate the technical solutions in the embodiments of this application, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0078] Figure 1 This is a flowchart of the honeypot intelligent modeling and dynamic response method based on a world model, as described in an embodiment of the present invention.

[0079] Figure 2 This is a schematic diagram of the multimodal attack state perception and fusion coding architecture according to an embodiment of the present invention;

[0080] Figure 3 This is a flowchart illustrating the steps of attack dynamics prediction and process deduction in an embodiment of the present invention.

[0081] Figure 4 This is a structural diagram of the hybrid density network according to an embodiment of the present invention;

[0082] Figure 5 This is a flowchart illustrating the steps of dream rehearsal strategy optimization and response control in an embodiment of the present invention.

[0083] Figure 6 This is a flowchart illustrating the steps of virtual-real discrimination and security response encapsulation in an embodiment of the present invention. Detailed Implementation

[0084] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are merely some embodiments of the present application, and not all embodiments. All other embodiments obtained by those skilled in the art based on the embodiments of the present application without creative effort are within the scope of protection of the present application.

[0085] In this application, the reference to "embodiment" means that a specific feature, structure, or characteristic described in connection with an embodiment may be included in at least one embodiment of this application. The appearance of this phrase in various places throughout the specification does not necessarily refer to the same embodiment, nor is it a mutually exclusive, independent, or alternative embodiment. It will be explicitly and implicitly understood by those skilled in the art that the embodiments described in this application can be combined with other embodiments.

[0086] Please see Figure 1 This embodiment provides a honeypot intelligent modeling and dynamic response method based on a world model, including the following steps:

[0087] S1. Construct a multimodal attack state awareness and fusion coding architecture to uniformly abstract the collected heterogeneous attack observation data into a compact attack hidden state vector; the multimodal attack state awareness and fusion coding architecture includes multiple feature coding modules and cross-modal attention modules.

[0088] In this embodiment, during the interaction between the honeypot and the attacker, the system collects four types of heterogeneous attack observation data in real time: network traffic data, command sequence data, system status data, and historical behavior data. For network traffic data, within each sampling time window... Inside, collect Each network data packet is extracted. The original features (including source / destination IP address, port number, protocol type, packet length, TCP flags, timestamp interval, etc.) form the original feature matrix of network traffic. .

[0089] For command sequence data, the attacker's input is recorded chronologically within a time window. Each shell command, after being mapped by a vocabulary, is encoded as follows: Word embedding vectors form the command sequence feature matrix. For system status data, collection A snapshot of the system state at each time step, each snapshot containing 3D features (CPU utilization, memory usage, number of active ports, number of running processes, number of network connections, etc.) form a system state feature matrix. For historical behavioral data, extract past... The attack behavior is recorded at each time step, and each step is encoded as follows: 3D feature vectors (attack type, target port, operation result, interaction duration, etc.) form a historical behavior feature matrix. Preprocessing operations are performed on the above four types of data respectively: network traffic characteristics are Z-score normalized and truncated or zero-padded to a fixed length according to the time window. Perform word segmentation, vocabulary mapping, and truncation and padding to a fixed length on the command sequence. The system state features are Min-Max normalized to the [0,1] interval; historical behavior features are categorically encoded and numerically normalized, thereby unifying the heterogeneous original data into a structured feature matrix, which is then transmitted to the subsequent dedicated coding sub-modules.

[0090] like Figure 2 As shown, in this embodiment, a multimodal attack state awareness and fusion coding architecture is adopted, which includes multiple feature coding modules and cross-modal attention modules.

[0091] Each feature encoding module is a dedicated encoder, equivalent to the V module in the world model. This embodiment improves upon this by using separate modules for processing network traffic, command sequences, system states, and historical behavior. Specifically, the feature encoding module includes a network traffic encoding module, a command sequence encoding module, a system state encoding module, and a historical behavior encoding module.

[0092] The network traffic encoding module includes a one-dimensional convolutional neural network (1D-CNN), a LeakyReLU non-linear activation function, a BatchNorm layer to enhance features, and a self-attention module;

[0093] The command sequence encoding module employs a multi-layer Transformer Encoder, each layer of which includes a multi-head self-attention and feedforward network. The feedforward network includes two linear transformations and GELU activation.

[0094] The system state coding module includes a multilayer perceptron and a learnable step-level position encoder. The multilayer perceptron includes a fully connected layer and a ReLU activation function. The learnable step-level position encoder is used to distinguish information at different time steps.

[0095] The historical behavior encoding module employs a bidirectional long short-term memory network, including a multilayer perceptron and layer normalization operations.

[0096] The feature encoding module performs the following steps:

[0097] The preprocessed network traffic feature matrix The data is then transmitted to the network traffic temporal feature encoding submodule. This encoding submodule first processes the data using a one-dimensional convolutional neural network (1D-CNN). Along the time dimension ( (Direction) Extract local temporal pattern features using c convolutional kernels, with kernel size of [missing information]. With a stride of 1, the feature map is output after convolution. ,in c is the number of convolutional kernels (typically c=128), and the feature dimension is... The transformation is then performed to c. Subsequently, the LeakyReLU non-linear activation function and BatchNorm layer are applied to enhance the discriminative power and training stability of the features. Finally, a self-attention mechanism is introduced. Capture long-range dependencies between time steps:

[0098] ,

[0099] in, For query, key, and value projection matrix, Let h be the dimension for each attention head, and h be the number of attention heads. The output after self-attention weighting is... The feature dimension c remains unchanged. Finally, average pooling is performed along the time dimension, and... Each time step is compressed into a single vector, resulting in the network traffic encoding vector. ,in Feature dimensions from It is convolved and mapped to a c=128-dimensional representation space.

[0100] The preprocessed command sequence feature matrix The input is then passed to the command sequence semantic feature encoding submodule. This submodule first applies learnable positional encodings to the input command word embedding sequence. By injecting the timing and location information of the command, a position-aware input is obtained. Feature Dimension Remain unchanged. Then... A Transformer Encoder with L=4 layers and h=8 heads is input for deep semantic feature extraction. Each layer sequentially performs multi-head self-attention and feedforward network (FFN) computation, and additional residual connections and layer normalization are applied.

[0101] ,

[0102] ,

[0103] The FFN consists of two linear transformations and GELU activation, with the hidden dimension expanded to [number missing]. The output is processed by 4 layers of Transformer Encoders. Feature Dimension This remains unchanged. Finally, the hidden vector at the first position ([CLS] position) is taken as the global semantic representation of the command sequence, and mapped through a linear projection layer to... Dimension, to obtain the command sequence encoding vector Feature dimensions from Transform to Dimensional semantic representation space.

[0104] The preprocessed system state feature matrix With historical behavior feature matrix The data are then transmitted to the corresponding feature encoding modules, as follows:

[0105] For system status data, firstly, the data for each time step... The 3D feature vector is passed through a multilayer perceptron (MLP), and then through fully connected layers to reduce the feature dimension from 1000 to 10000. Mapped to The intermediate dimension is represented by applying the ReLU activation function and then mapping to... A dimensional output space is generated; simultaneously, learnable step-level position codes are superimposed to distinguish information from different time steps. The encoding results at each time step are averaged and pooled along the time dimension to obtain the system state encoding vector. ,in Feature dimensions from It is compressed into a 64-dimensional compact representation through MLP mapping.

[0106] For historical behavioral data, The input is a bidirectional long short-term memory (BiLSTM) network along the time dimension, with both the forward and backward LSTM hidden layer dimensions set to 1. Each time step will 3D input feature transformation The two-way hidden state is used; the two-way hidden states at the last time step are concatenated as the historical behavior encoding vector. ,in Feature dimensions from The time-series modeling of BiLSTM is mapped to a 128-dimensional bidirectional semantic representation space.

[0107] The feature vectors output by each encoding submodule , , , The data is then transferred to the cross-modal attention fusion module. The vector is encoded as a command sequence. As the query, the remaining three modality encoding vectors are concatenated to form the key and value sources, and multi-head cross-attention computation is performed. Specifically, each modality vector is first uniformly mapped to a linear projection layer. Dimensional public space, to obtain the query matrix Key matrix Value matrix Cross-attention with command sequence as the dominant modality is calculated as follows:

[0108] ,

[0109] This attention mechanism enables the command sequence to adaptively retrieve and aggregate complementary information most relevant to the current attack intent from three modalities: network traffic, system state, and historical behavior. The cross-attention output is then used. Encoding with command sequence After residual concatenation, the vector is mapped to the final hidden state vector via MLP and LayerNorm:

[0110] ,

[0111] in, This represents vector concatenation. To output the projection matrix, is the dimension of the hidden state vector. The V module is trained using self-supervised learning, and its optimization objective is a weighted combination of reconstruction loss and KL divergence regularization.

[0112] ,

[0113] in, This represents the original input data. This represents the reconstructed data. This represents the mean squared error (MSE) loss, used to measure reconstruction quality. The KL divergence weights (typically 0.005) constrain the structuring of the hidden state space, preventing overfitting while ensuring the retention of information in the hidden states. This indicates KL divergence regularization. This represents the approximate posterior distribution of the encoder output. For the prior distribution, This represents the attack hidden state vector.

[0114] S2. Input the attack hidden state vector and the response action vector of the previous time step. Through the hidden state-action joint representation construction module, explicitly learn the attack state transition law, predict the multimodal distribution of the attacker's next behavior, and implicitly discover the attack stage.

[0115] like Figure 3 As shown, this embodiment attacks the hidden state vector. The response action vector performed by the honeypot at the previous moment Transmit to the hidden state-action joint representation construction module (M module for short). Honeypot response action vector It is composed of four types of action information: service configuration actions (discrete encoding), response strategy actions (one-hot encoding), vulnerability simulation actions (hybrid encoding), and environment migration actions (discrete encoding), totaling [number] action dimensions. (Typical values). This module will first... and By directly concatenating the features along their dimensions, a joint input vector is obtained. Feature dimensions expanded to The 320-dimensional joint vector is then mapped to the input dimension required by the cyclic dynamics model via a fully connected layer. Furthermore, the ReLU activation function is applied to enhance the nonlinear expressive power of the joint representation:

[0116] ,

[0117] in, The joint projection matrix is ​​used. The motivation for incorporating action information into dynamic modeling is that the attacker's next action depends not only on the current attack state but also on the direct influence of the honeypot's previous response strategy; therefore, conditional prediction... Compared to unconditional prediction It can more accurately characterize the attack state transition patterns. (Mapped joint representation) It is then transmitted to the subsequent forward prediction module for cyclic dynamics.

[0118] It should also be explained that the M module in this embodiment includes a fully connected layer, a cyclic dynamics forward prediction module, a hybrid density network, and an attack phase implicit discovery and uncertainty quantification module.

[0119] The forward prediction module of the cyclic dynamics includes two layers of gated cyclic units for predicting the sequence of cyclic hidden states. The input of the second layer of gated cyclic units is the hidden state output by the first layer of gated cyclic units.

[0120] The Mixture Density Network (MDN) includes a shared fully connected layer and three parallel output layers, used to generate a multimodal probability distribution for attack state transitions;

[0121] The attack phase implicit discovery and uncertainty quantification module includes an uncertainty quantification module and an unsupervised clustering module. The uncertainty quantification module is used to quantify the uncertainty of the multimodal probability distribution, and the unsupervised clustering module is used to perform unsupervised clustering analysis on the cyclic hidden state sequence to implicitly discover the attack phase.

[0122] Next, joint characterization The data is transmitted to the forward prediction module for cyclic dynamics. This forward prediction module for dynamics employs... A layer-gated recurrent unit (GRU) network is used to perform temporal dynamics modeling on the joint representation sequence, with the hidden state dimension of each GRU layer set to 1. In layer l, GRU updates the gates and resets the forgetting and updating of gate control information:

[0123] ,

[0124] ,

[0125] ,

[0126] ,

[0127] The first layer input Feature dimensions from Transformed by the first-level GRU to The hidden state is further refined into the top-level hidden state by the second layer of GRU. Dimensional preservation constant.

[0128] Subsequently, as Figure 4 The diagram shows the hidden state of the loop. The data is transmitted to the output layer of the Hybrid Density Network (MDN) to generate a multimodal probability distribution for attack state transitions. The shared fully connected layer in the MDN maps the 512-dimensional hidden state to the MDN parameter space (ReLU activation). The three parallel output layers include a mixed weight output layer, a mean output layer, and a covariance output layer. The mixed weight output layer outputs K mixed weights. Activated via softmax to ensure The mean output layer is used to output K mean vectors. Each Linear activation; the covariance output layer is used to output K pairs of covariances. Each After softplus activation to ensure positive values, the final output layer outputs all parameters of the K Gaussian components, including the mixing weights. Mean vector diagonal covariance The attack state transition distribution is represented by a weighted mixture of K Gaussian components:

[0129] ,

[0130] Where K=5 is the number of mixed components. This represents the probability that the attacker chooses the k-th attack path. This represents the average predicted attack state under this path. This represents the range of uncertainty in the forecast.

[0131] The training objective of Hybrid Density Networks (MDNs) is to minimize the negative log-likelihood loss and introduce multi-step prediction regularization, as shown below:

[0132] ,

[0133] Where H=3 is the multi-step prediction step size. For multi-step prediction weights, From The predicted value of the starting point is obtained by the autoregressive step j of the M module.

[0134] Mixed weights With cyclic hidden state The data is then transferred to the implicit discovery and uncertainty quantification module for the attack phase. This module analyzes the attack process from two dimensions: first, it performs uncertainty quantification on the mixed weight distribution of the MDN output and calculates the mixed weight entropy, as shown in the following formula:

[0135] ,

[0136] Here, the system classifies the prediction results into two modes: high uncertainty and low uncertainty, based on the mixed weight entropy U. When the U value is close to... When the maximum entropy is high, it indicates that the probabilities of each attack path are nearly uniformly distributed, and the model has high uncertainty in predicting the attacker's next move. When the U value is close to 0, it indicates that a certain attack path dominates the probability, and the attacker's behavior is highly predictable. Secondly, for the cyclic hidden state sequence... Perform unsupervised clustering analysis to implicitly discover attack phases: First, The hidden state is reduced to its dimensionality using PCA. The principal component space is used to eliminate redundancy, and then K-Means clustering is used to divide the dimensionality-reduced hidden state sequence into C attack stage clusters (typically C=5, corresponding to reconnaissance and detection → vulnerability exploitation → privilege escalation → lateral movement → data theft). The stage evolution pattern of the attack process can be automatically discovered without any manual annotation.

[0137] S3. Perform policy pre-training in the dream virtual environment constructed by the hidden state-action joint representation construction module to achieve efficient policy optimization of virtual attacker interaction and obtain the optimal response action at the current moment.

[0138] Please see Figure 5 Step S3 will attack the hidden state vector As the initial state By constructing a dream virtual environment using a hidden state-action joint representation construction module, policy pre-training is performed in the dream virtual environment to complete the initialization optimization of the current response policy, thereby achieving efficient policy optimization without the need for interaction with a real attacker.

[0139] The construction of the dream virtual environment specifically involves using a trained hidden state-action joint representation construction module (denoted as the M module) as a forward predictor to perform the following steps:

[0140] S301, Change the current hidden state and sampling actions Input module M;

[0141] S302. The next state distribution is obtained through forward prediction using MDN-RNN. ;

[0142] S303, obtained from sampling ;

[0143] S304. Repeat steps S301-S303 to construct a multi-step dream trajectory. .

[0144] The hidden state-action joint representation construction module adopts the MDN-RNN joint model. The K-component Gaussian mixture distribution output by the hybrid density network (MDN) can model the multimodal nature of the attacker's multi-path selection. Combined with the recurrent neural network (RNN) (i.e. the "recurrent dynamics forward prediction module"), multi-step prediction regularization ensures long-term prediction accuracy. This enables the honeypot to not only "understand" the current attack behavior, but also "predict" the attacker's next action, thereby achieving predictive active trapping rather than passive response.

[0145] The steps for pre-training the policy are as follows:

[0146] S305. Initialization. Set the attack hidden state vector... As the initial state ;

[0147] S306, Action Sampling. Based on the current policy. Sampling action ;

[0148] S307, State Prediction. Input the state-action pair into module M to obtain the next state distribution and sample it. ;

[0149] S308. Reward Calculation. Calculate the immediate reward based on the four-dimensional composite reward function. ;

[0150] S309, Policy Update. The PPO algorithm is used to update the policy network parameters. Update;

[0151] S310. Repeat steps S305-309 until the preset number of rehearsal steps is reached. .

[0152] Furthermore, in this embodiment, step S306 specifically employs a honeypot response controller to sample the actions of the current response strategy. The honeypot response controller C uses a parameterized strategy network. Implementation, the input is the current attack stealth state Through two fully connected layers (hidden dimension) GELU activation maps the feature dimension to The intermediate dimension is then mapped to the action space via the strategy head output layer.

[0153] like Figure 5 As shown, a parameterized strategy network is used in the honeypot response controller. Starting from the initial state, the dream rehearsal is executed cyclically, specifically by sampling actions based on the current response strategy. The current action is obtained, and the current state-action pair is input into module M. The next state distribution is obtained through forward prediction. Sample the next state from it And calculate instant rewards According to instant rewards Update the response strategy.

[0154] It's worth explaining that "Dreaming Pre-execution" is a common term in reinforcement learning, specifically referring to the process of simulating policy execution in a virtual environment built around the model. In this embodiment, "performing policy pre-execution in a dream virtual environment" emphasizes simulating attacker behavior in the "dream" constructed by the M module—this is a process description. Policy pre-training, on the other hand, refers to the initialization training performed before formal training. "Completing the initialization pre-training of the current response policy" emphasizes the initialization of the policy network parameters—this is a result description.

[0155] The core advantage of Dream Preview lies in its ability to virtually expand limited real attack interaction data into a near-infinite amount of training samples using the forward prediction capability of the M module. This allows for the free exploration of high-risk strategies in a secure and isolated virtual environment without affecting the operation of the real honeypot system, thus enabling the preheating and optimization of response strategies before deployment.

[0156] To achieve multi-objective optimization, this embodiment calculates the immediate reward. Specifically, this involves utilizing the state-action pairs from each step of a dream rehearsal. Multi-objective optimization is performed to obtain the scalar reward signal driving the optimization strategy. Honeypot response is a multi-objective optimization problem; this embodiment designs a four-dimensional composite reward function as the immediate reward. As shown in the following formula:

[0157] ,

[0158] in, The weighting coefficients for each component, and the attack attraction reward. Measuring whether a honeypot response successfully prolongs an attacker's willingness to interact, and information gathering rewards. Measuring whether a honeypot response induces an attacker to expose more attack information, and survivability rewards. Penalize the risk of honeypots being identified by attackers and predict calibration rewards. This encourages the dynamic model's predictions to remain consistent with the actual state. The scalar is obtained after weighted summation of the four-dimensional composite reward. Input policy network parameters The PPO algorithm is used to calculate advantage estimation and policy gradient update.

[0159] It is worth explaining that, This indicates a state-action pair (as a combined input), emphasizing that this is an input pair for the M module; This represents vector concatenation, which directly concatenates the attack hidden state vector and the action vector along the feature dimension to obtain a joint input vector. .

[0160] To compute the advantage estimate and policy gradient update, based on immediate rewards... Update the response strategy and use the PPO algorithm to update the parameterized policy network. Perform policy gradient updates to obtain the policy network parameters after the dream rehearsal is complete. .

[0161] Based on the policy network parameters Online policy fine-tuning is performed. During this phase, the pre-trained policy network is deployed to a real honeypot system. State-action-reward trajectory data is collected through online interactions with real attackers, including the hidden states of the real attackers. The attack data collected in real time is encoded and generated by a multimodal attack state awareness and fusion coding architecture (V module). Due to the sparse nature of real interaction data and its discrepancy with the dream environment, a low learning rate is used during the fine-tuning phase. The PPO algorithm performs policy updates in a small number of rounds, while introducing KL divergence constraints to prevent the policy from deviating too far from the pre-trained policy:

[0162] ,

[0163] in, is the penalty coefficient for the KL divergence constraint, representing the deviation between the fine-tuned policy and the pre-trained policy.

[0164] During the inference phase, in response to real-time input from a real attacker, the policy network is fine-tuned based on the current hidden state input. After forward propagation, the action distribution parameters are output through the strategy head. The discrete action with the highest probability is selected from the action distribution parameters and combined with the mean continuous action to form the final response action. Then, it is transferred to the subsequent step S4.

[0165] S4. The attack hidden state vector and the optimal response action are jointly transmitted to the virtual-real discriminator module. The virtual-real discriminator is used to evaluate the fidelity. The response content is obtained according to the virtual-real discrimination and security response mechanism. The compliant response message is output through the protocol encapsulation module and delivered to the attacker through the honeypot network interface to complete this response cycle.

[0166] Please see Figure 6 As shown, this embodiment will demonstrate the honeypot response action. With the current attack stealth state The data is then transmitted to a virtual / real discriminator module, which evaluates the realism of the dynamic response generated by the response action within the current attack context. The virtual / real discriminator employs a binary classification neural network architecture, and its input is a concatenated vector of the attack hidden state and the response action. The fidelity confidence score is output after calculation through a multi-layer fully connected network. .

[0167] During training, the virtual / real discriminator is trained using binary cross-entropy loss:

[0168] ,

[0169] in Corresponding to positive samples of real system response, This corresponds to the negative samples of the dynamic response generated by the world model. During inference, the system uses confidence scores... With preset threshold (Typical value 0.8) Execute virtual-to-real switching decision: when Output dynamic response ;when Automatically switch to static honeypot response This forms a two-tiered response mechanism that combines virtual and real elements and provides a safety net.

[0170] Next, the response content and its corresponding target protocol type tag The message is transmitted to the multi-protocol response message encapsulation and delivery module. This module converts the abstract response content into a bit-level communication message conforming to the protocol specification based on the protocol type. For the SSH protocol, the response content is decoded from the semantic vector into a raw text string by a text encoder, and then encapsulated into an SSH_MSG_CHANNEL_DATA message according to the SSH 2.0 protocol specification. The message is filled with the receive channel number (4 bytes uint32), the data length field (4 bytes uint32), and the encoded payload data, and maintains an incrementing SSH session sequence number counter. The format verification rules during the encapsulation process for each protocol are as follows:

[0171] ,

[0172] in, For the encapsulated complete protocol message, This is for the checksum calculation required by the protocol (MAC checksum for SSH, CRC checksum for Modbus). and The minimum and maximum message lengths are defined in the protocol specification. This indicates an indicator function that takes the value 1 when the condition within the parentheses is met, and 0 otherwise. This represents the logical AND operator. Indicates calculation The length in bytes. After the encapsulation verification passes, the message is processed by the timing control module, which introduces a response delay that matches the interval of the attacker's request. (Determined by the attacker's expected response time predicted by the M module), and finally the compliant message is delivered to the attacker through the honeypot's network interface, completing this response cycle.

[0173] See you again Figure 1 Based on steps S1 to S4, the system forms a continuous world model honeypot collaborative online response closed loop, as follows: Attacker interacts with honeypot to generate multimodal data → V module encodes it as a hidden state → M module predicts attack state transition → C module generates optimal response action → Virtual-real discriminator evaluates realism and switches → Protocol encapsulation module delivers response message → Attacker adjusts attack strategy according to honeypot response → Generates new interaction data → V module encodes → Repeats the cycle.

[0174] In this closed loop, the real data generated by each interaction synchronously updates the parameters of the V and M modules, the C module continuously fine-tunes the strategy online, and the virtual-real discriminator dynamically adjusts the discrimination threshold, so that the world model continues to evolve with the interaction. The more the attacker attacks the honeypot, the smarter it becomes, realizing an adaptive collaborative defense of predictive modeling and proactive trapping.

[0175] It should be noted that, for the sake of simplicity, the aforementioned method embodiments are all described as a series of actions. However, those skilled in the art should understand that the present invention is not limited to the described order of actions, because according to the present invention, some steps can be performed in other orders or simultaneously.

[0176] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0177] The above embodiments are preferred embodiments of the present invention, but the embodiments of the present invention are not limited to the above embodiments. Any changes, modifications, substitutions, combinations, or simplifications made without departing from the spirit and principle of the present invention shall be considered equivalent substitutions and shall be included within the protection scope of the present invention.

Claims

1. A honeypot intelligent modeling and dynamic response method based on a world model, characterized in that, Includes the following steps: A multimodal attack state awareness and fusion coding architecture is constructed to abstract the collected heterogeneous attack observation data into a compact attack hidden state vector; the multimodal attack state awareness and fusion coding architecture includes multiple feature coding modules and cross-modal attention modules; Input the attack hidden state vector and the response action vector of the previous time step, and explicitly learn the attack state transition rules through the hidden state-action joint representation construction module to predict the multimodal distribution of the attacker's next behavior and implicitly discover the attack stage. In the dream virtual environment constructed by the hidden state-action joint representation construction module, policy pre-training is performed to achieve efficient policy optimization of virtual attacker interaction and obtain the optimal response action at the current moment. The attack concealed state vector and the optimal response action are jointly transmitted to the virtual-real discriminator module. The virtual-real discriminator is used to evaluate the fidelity. The response content is obtained according to the virtual-real discrimination and security response mechanism. The compliant response message is output through the protocol encapsulation module and delivered to the attacker through the honeypot network interface, thus completing this response cycle.

2. The honeypot intelligent modeling and dynamic response method based on a world model according to claim 1, characterized in that, The feature encoding module includes a network traffic encoding module, a command sequence encoding module, a system status encoding module, and a historical behavior encoding module; The network traffic encoding module includes a one-dimensional convolutional neural network, a LeakyReLU non-linear activation function, a BatchNorm layer to enhance features, and a self-attention module; The command sequence encoding module employs a multi-layer Transformer Encoder, each layer of which includes a multi-head self-attention and feedforward network. The feedforward network includes two linear transformations and GELU activation. The system state coding module includes a multilayer perceptron and a learnable step-level position encoder. The multilayer perceptron includes a fully connected layer and a ReLU activation function. The learnable step-level position encoder is used to distinguish information at different time steps. The historical behavior encoding module employs a bidirectional long short-term memory network, including a multilayer perceptron and layer normalization operations.

3. The honeypot intelligent modeling and dynamic response method based on a world model according to claim 2, characterized in that, The process of abstracting the collected heterogeneous attack observation data into a compact attack hidden state vector includes: The heterogeneous raw data is unified into a structured feature matrix, which is then input into each feature encoding module for processing. The structured feature matrix includes a network traffic feature matrix, a command sequence feature matrix, a system status feature matrix, and a historical behavior feature matrix. The network traffic encoding module extracts local temporal pattern features from the network traffic feature matrix along the time dimension using a one-dimensional convolutional neural network. After convolution, a network traffic feature map is obtained. The LeakyReLU nonlinear activation function and BatchNorm layer are used to enhance the features. The self-attention module is used to capture the long-range dependencies between time steps in the network traffic feature map. After self-attention weighting, average pooling is performed along the time dimension to compress multiple time steps into a single vector to obtain the network traffic feature vector. The command sequence encoding module performs learnable position encoding on the command sequence feature matrix to obtain position-aware input, and uses Transformer Encoder to extract deep semantic features. Each layer sequentially performs multi-head self-attention and feedforward network calculations, and adds residual connections and layer normalization to obtain position-aware output. The sequence head [CLS] of the position-aware output is extracted as the global semantic representation of the command sequence, and the command sequence encoding vector is obtained by mapping through a linear projection layer. The system state encoding module uses a multilayer perceptron to perform feature mapping on the system state feature matrix of each time step, and at the same time uses a learnable step-level position encoding to encode the system state feature matrix of each time step. The obtained encoding results are averaged and pooled along the time dimension to obtain the system state encoding vector. The historical behavior encoding module inputs the historical behavior feature matrix into the bidirectional long short-term memory network along the time dimension. At each time step, the bidirectional long short-term memory network performs feature transformation on the historical behavior feature matrix, obtains the bidirectional hidden state, and extracts the bidirectional hidden state of the last time step and concatenates it as the historical behavior encoding vector. The cross-modal attention module uses the command sequence encoding vector as the query matrix and concatenates the network traffic feature vector, system state encoding vector, and historical behavior encoding vector as the key matrix and value matrix. Using the command sequence encoding vector as the dominant modality, it calculates the cross-attention of the dominant modality and obtains the cross-attention output. After concatenating the cross-attention output and the command sequence encoding vector with residuals, it maps them to the final hidden state vector through a multilayer perceptron and layer normalization operations.

4. The honeypot intelligent modeling and dynamic response method based on a world model according to claim 3, characterized in that, Each layer sequentially performs multi-head self-attention and feedforward network computation, and adds residual connections and layer normalization to obtain the position-aware output, as shown in the following formula: ， ， in, This represents the input hidden state of the l-th layer Transformer Encoder. This represents the position-aware output of the l-th layer Transformer Encoder. This indicates multi-head self-attention calculation. This indicates feedforward network computation. Presentation layer normalization operation; The multimodal attack state awareness and fusion coding architecture is trained using a self-supervised learning method, and its optimization objective is a weighted combination of reconstruction loss and KL divergence regularization, as shown in the following equation: ， in, This represents the original input data. This represents the reconstructed data. This represents the mean squared error loss, used to measure reconstruction quality. For KL divergence weights, This indicates KL divergence regularization. This represents the approximate posterior distribution of the encoder output. For the prior distribution, This represents the attack hidden state vector.

5. The honeypot intelligent modeling and dynamic response method based on a world model according to claim 1, characterized in that, The hidden state-action joint representation construction module includes a fully connected layer, a cyclic dynamics forward prediction module, a hybrid density network, and an attack phase implicit discovery and uncertainty quantification module. The forward prediction module of the cyclic dynamics includes two layers of gated cyclic units for predicting the sequence of cyclic hidden states. The input of the second layer of gated cyclic units is the hidden state output by the first layer of gated cyclic units. The hybrid density network includes a shared fully connected layer and multiple parallel output layers, used to generate a multimodal probability distribution for attack state transitions; The attack phase implicit discovery and uncertainty quantification module includes an uncertainty quantification module and an unsupervised clustering module. The uncertainty quantification module is used to quantify the uncertainty of the multimodal probability distribution, and the unsupervised clustering module is used to perform unsupervised clustering analysis on the cyclic hidden state sequence to implicitly discover the attack phase.

6. The honeypot intelligent modeling and dynamic response method based on a world model according to claim 5, characterized in that, The input attack hidden state vector and the response action vector from the previous time step are used to explicitly learn the attack state transition rules through the hidden state-action joint representation construction module, predict the multimodal distribution of the attacker's next behavior, and implicitly discover the attack stage. Specifically: The attack hidden state vector and the previous time step response action vector are directly concatenated along the feature dimension to obtain a joint input vector. This joint input vector is then input into the hidden state-action joint representation construction module. A fully connected layer maps the joint input vector to the required input dimension, and the ReLU activation function is used to obtain the joint representation sequence. The previous time step response action vector is composed of action information, including service configuration actions, response strategy actions, vulnerability simulation actions, and environment migration actions. The joint representation sequence is modeled using a forward prediction module of cyclic dynamics to obtain the cyclic hidden state sequence. A hybrid density network is used to map the recurrent hidden state sequence to a hybrid density parameter space, outputting all parameters of multiple Gaussian components, including the mixing weights, mean vector, and diagonal covariance. Based on all parameters of the Gaussian components, a multimodal probability distribution for the attack state transition is generated, as shown in the following equation: ， in, This represents the probability that the attacker chooses the k-th attack path. This represents the average predicted attack state under this path. The range of uncertainty in the forecast. Let K represent the attack hidden state vector at time step t, and K represent the number of mixed components. The uncertainty quantification module is used to quantify the uncertainty of the multimodal probability distribution and calculate the mixed weight entropy. As shown in the following formula: ； The dimensionality of the cyclic hidden state sequence is reduced by PCA using an unsupervised clustering module, and the dimensionality-reduced cyclic hidden state sequence is divided into multiple attack stage clusters using K-Means clustering.

7. The honeypot intelligent modeling and dynamic response method based on a world model according to claim 1, characterized in that, The process of performing policy pre-training in the dream virtual environment constructed by the hidden state-action joint representation construction module, to achieve efficient policy optimization for virtual attacker interaction and obtain the optimal response action at the current moment, specifically involves: Using the attack hidden state vector as the initial state, a dream virtual environment is constructed using the hidden state-action joint representation construction module. Policy pre-training is performed in the dream virtual environment to complete the initialization and optimization of the current response policy. In the honeypot response controller, a parameterized strategy network is employed. Starting from the initial state, the dream rehearsal is executed cyclically, specifically by sampling actions based on the current response strategy. The current action is obtained, and the current state-action pair is used to construct a module that represents the input hidden state-action joint representation. The next state distribution is then obtained through forward prediction. Sample the next state from it And calculate instant rewards According to instant rewards Update response strategy; The calculation of instant rewards Specifically, this involves: utilizing the state-action pairs at each step of the dream rehearsal for multi-objective optimization, and designing a four-dimensional composite reward function as the immediate reward. As shown in the following formula: ， in These are the weighting coefficients for each component. This indicates that the attack attracts rewards. This indicates a reward for information collection. This indicates a survival ability reward. Indicates the predicted calibration reward; According to instant rewards Update the response strategy and use the PPO algorithm to update the parameterized policy network. Perform policy gradient updates to obtain the policy network parameters after the dream rehearsal is complete. ; Based on the strategy network parameters after the dream rehearsal Online strategy fine-tuning is performed, and state-action-reward trajectory data is collected during online interactions with real attackers, including the hidden states of the real attackers. The attack data acquired in real time is encoded and generated by a multimodal attack state awareness and fusion encoding architecture. At the same time, KL divergence constraints are introduced to prevent the policy from deviating from the pre-trained policy, thus obtaining a fine-tuned policy network. ; In response to real-time input from a real attacker, the policy network is fine-tuned based on the current hidden state input. After forward propagation, the action distribution parameters are output through the strategy head. The discrete action with the highest probability and the mean continuous action are selected from the action distribution parameters to form the final response action.

8. The honeypot intelligent modeling and dynamic response method based on a world model according to claim 7, characterized in that, Update policy network parameters using a near-end policy optimization algorithm. Its truncation objective function is: ， ， in, The probability ratio between the old and new strategies. The cutoff factor is , This is a generalized advantage estimate.

9. The honeypot intelligent modeling and dynamic response method based on a world model according to claim 1, characterized in that, The attack stealth state vector and optimal response action are jointly transmitted to the virtual / real discriminator module. The virtual / real discriminator performs a fidelity assessment, obtains the response content based on the virtual / real discrimination and security response mechanism, and outputs a compliant response message through the protocol encapsulation module. Specifically: The virtual / real discriminator employs a binary classification neural network architecture, and its input is a concatenated vector of the attack hidden state and the response action. The fidelity confidence score is output after calculation through a multi-layer fully connected network. The virtual / real discriminator is trained using binary cross-entropy loss; The aforementioned virtual-to-real and security response mechanism specifically involves the virtual-to-real discriminator, during inference, determining the virtual-to-real score based on the confidence score. With preset threshold Execute the decision to switch between virtual and physical environments, that is: when Output dynamic honeypot response ,when Automatically switch to static honeypot response ; Input the response content and its corresponding target protocol type label into the protocol encapsulation module, and convert the response content into a bit-level communication message that conforms to the protocol specification according to the protocol type.

10. The honeypot intelligent modeling and dynamic response method based on a world model according to claim 9, characterized in that, The process of converting the response content into a bit-level communication message conforming to the protocol specification according to the protocol type is as follows: For the SSH protocol, the response content is decoded from semantic vectors into raw text strings by a text encoder, and then encapsulated into an SSH_MSG_CHANNEL_DATA message according to the SSH 2.0 protocol specification. The message is filled with the receive channel number, data length field and encoded payload data, and the SSH session sequence number is maintained by incrementing the counter. The format verification rules for each protocol encapsulation process are as follows: ， in, For the encapsulated complete protocol message, For the verification calculations required by the protocol, and The minimum and maximum message lengths are defined in the protocol specification. Indicates an indicator function, This represents the logical AND operator. Indicates calculation The length in bytes.

Images