Adversarial defense method and system based on generative adversarial network and code semantic confusion

Abstract

The present application relates to the technical field of computer security and network security active defense, and discloses a deception honeypot defense method and system based on generative adversarial network and code semantic obfuscation, which comprises the following steps: constructing a semantic and behavior dependency graph and training a semantic anchor point vector set, executing a generation process to synchronously output a decoy file and a disturbed behavior causal graph, executing an obfuscation process to generate obfuscated monitoring code driven by the disturbed behavior causal graph, extracting expected and actual behavior trajectory causal structures to perform counterfactual causal consistency verification and output a discrimination score, adjusting each processing parameter according to the discrimination score until Nash equilibrium, and then deploying the generation process and the obfuscation process to a honeypot environment. The present application solves the problem of separation of static decoy and dynamic behavior semantics in the prior art, realizes causal self-consistency and active reverse perception of file behavior and code behavior, and enhances deception fidelity and anti-detection ability.

Description

Technical Field

[0001] This invention relates to the field of computer security and network security proactive defense technology, specifically to a deceptive honeypot defense method and system based on generative adversarial networks and code semantic obfuscation. Background Technology

[0002] Honeypot technology is an important tool in proactive cybersecurity defense systems. By simulating the behavior and data characteristics of real business systems in a controlled environment, it lures attackers into and keeps them there, thereby consuming attack resources, capturing attack behavior, and providing early threat warnings. As attackers' skills continue to improve, advanced attackers commonly employ multi-stage environmental awareness methods to identify and evade honeypots. The realism of honeypot deception has become a core indicator for measuring its defensive effectiveness.

[0003] Currently, the technical means to improve the realism of honeypot deception can be mainly divided into two categories:

[0004] Static decoy data generation technology based on generative models uses generative adversarial networks or variational autoencoders to forge decoy data such as static files, database records, and log texts that are similar to the real business environment, so that the honeypot file system presents similar appearance characteristics to the real system.

[0005] The monitoring probe protection technology based on code obfuscation performs obfuscation processing on the monitoring code inside the honeypot used to record attack behavior, such as control flow flattening, opaque predicate insertion, and instruction replacement, to prevent attackers from discovering the monitoring logic through reverse analysis.

[0006] The aforementioned existing technical solutions have the following drawbacks: There is a significant semantic and logical disconnect between static decoy data and dynamic program behavior. The decoy files generated by the generator and the monitoring code protected by the obfuscator lack inherent connection at both the design and operational levels. Attackers can easily discover inconsistencies between file operation behavior and the business logic claimed by the file format through sandbox execution or lightweight dynamic analysis, thereby exposing the honeypot.

[0007] Code obfuscation strategies lack semantic specificity. Existing obfuscation engines adopt general and indiscriminate transformation strategies, without considering the semantic relationship between the protected code and the runtime environment. Attackers can gradually deconstruct the obfuscation logic through static analysis methods such as symbolic execution.

[0008] Honeypots adopt a purely passive defensive stance against attackers' reverse analysis behavior, failing to incorporate the attackers' detection and analysis activities themselves into the deception framework for reverse exploitation.

[0009] Therefore, this application provides a deceptive honeypot defense method based on generative adversarial networks and code semantic obfuscation to solve the above-mentioned technical problems. Summary of the Invention

[0010] The purpose of this invention is to provide a deceptive honeypot defense method and system based on generative adversarial networks and code semantic obfuscation, in order to solve the technical problem in the prior art that there is a semantic and logical disconnect between the content of the static decoy file of the honeypot and the behavior of the dynamic monitoring program, and that it is easy for attackers to detect through behavioral consistency analysis.

[0011] To address the aforementioned technical problems, this invention provides a deceptive honeypot defense method based on generative adversarial networks and code semantic obfuscation, comprising: We collect system call sequences from real business environments, extract causal dependencies between application programming interface calls, construct semantic and behavioral dependency graphs, and train a set of semantic anchor vectors for global sharing. The generation process is performed, receiving random noise and semantic tags of business scenarios, and simultaneously generating decoy file content, anchor point association mask, and perturbed behavior causal graph obtained by applying topological perturbation to the basic causal graph. Obfuscation processing is performed, driven by the perturbed behavior causal graph. Semantically related code fragments are selected in the semantic space composed of the set of semantic anchor vectors by searching through the confusion interval, and then incorporated into the monitoring code control flow to generate obfuscated monitoring code. Extract the causal structure of the expected behavior trajectory corresponding to the perturbed behavior causal graph and the causal structure of the actual behavior trajectory generated by the execution of the obfuscated monitoring code. Apply the same deletion intervention to the expected behavior trajectory causal structure and the actual behavior trajectory causal structure. Compare the consistency of the direction and magnitude of the change in causal in-degree before and after the intervention and output a discrimination score. Based on the discrimination score, adjust the parameters involved in the generation process, the obfuscation process, and the output of the discrimination score until Nash equilibrium is reached, and configure the honeypot environment to perform the generation process and the obfuscation process.

[0012] In some specific embodiments, constructing a semantic and behavioral dependency graph and training a set of semantic anchor vectors for global sharing further includes: The collected system call sequences are segmented into sessions according to process lifecycle and the application programming interface names are standardized. Fixed-length call fragments are extracted using a sliding window. Based on the convergent cross-mapping method, for each pair of co-occurring application programming interfaces, the state space is reconstructed with the lag coordinates of one side and the value of the other side is predicted. By comparing the correlation coefficient between the predicted value and the actual value with the degree of difference in the reverse causal strength, the existence of the directed causal edge and the causal strength of the directed causal edge are determined. Nodes in the semantic and behavioral dependency graph that are connected by directed edges and whose causal strength meets a preset condition are taken as neighbors. The embedding vectors of each application programming interface node are trained by aggregating multi-hop neighbor information through a graph neural network to obtain the semantic anchor vector set.

[0013] In some specific embodiments, performing the generation process further includes: Based on the semantic tags of the business scenarios, a matching basic causal graph is retrieved from the semantic and behavioral dependency graph. The semantic tags of the business scenarios are represented by file type and business scenario encoding. The basic causal graph is a subgraph composed of nodes and edges in the semantic and behavioral dependency graph that correspond to the semantic tags of the business scenarios. Perform topological perturbation on the basic causal graph, including reversing the direction of non-necessary causal edges with causal strength below the median in the basic causal graph, selecting application programming interfaces from the set of semantic anchor vectors whose distance from the semantic vector of the node in the basic causal graph is within a preset confusion interval as ghost nodes to insert into the causal chain, and splitting causal chains in the basic causal graph with a length exceeding a threshold from the midpoint into parallel segments and inserting synchronization barrier nodes. The total loss of the generation process is composed of a weighted sum of adversarial loss, bulldozer distance loss, and causal graph rationality constraint loss. The bulldozer distance loss is the optimal transmission distance that measures the distribution difference between the feature vectors of each block of the generated file and the semantic anchor vectors of the application programming interface bound to the anchor point association mask. The causal graph rationality constraint loss is a penalty term applied to edges in the causal graph of the perturbed behavior where the causal strength is lower than a preset minimum threshold.

[0014] In some specific embodiments, performing obfuscation processing further includes: A set of semantically related code snippets is pre-constructed. Each code snippet is labeled with a list of application programming interfaces (APIs) it contains and a semantic vector is calculated. The semantically related code snippet is a code snippet whose list of APIs it contains has an inclusion relationship or functional overlap with the corresponding node's API. The semantic vector is the result of averaging the semantic anchor vectors of each API contained in the code snippet. The nodes of the perturbed behavior causal graph are mapped to basic blocks of the control flow graph, and the directed edges of the perturbed behavior causal graph are mapped to jumps between basic blocks. The structural correspondence is verified by graph isomorphism. For each basic block, using the semantic anchor vector of the node corresponding to the basic block as the query anchor, candidate segments whose semantic vector cosine distance falls into the confusion interval are retrieved from the set of semantically associated code segments and incorporated into the basic block; An opaque predicate is set for the basic block corresponding to the ghost node. The opaque predicate is executed along a preset path during normal execution and is presented as a branch structure with two reachable paths during static analysis.

[0015] In some specific embodiments, the output of the discrimination score further includes: The byte entropy distribution and structural features of the decoy file are extracted by convolution operation and compared with the corresponding features of the real file sample to obtain a static byte-level fidelity score. Causal adjacency matrices are extracted from the expected behavior trajectory and the actual behavior trajectory using temporal causal convolutional coding, respectively. The causal in-degree refers to the overall metric obtained by aggregating the causal dependency strength of each node in the causal adjacency matrix other than the target node to the target node. After excluding the ghost nodes from the node set of the expected behavioral trajectory, the intervention target is selected. The deletion intervention of setting the corresponding row and column of the intervention target node to zero is applied to the expected causal adjacency matrix and the actual causal adjacency matrix respectively. The change in causal in-degree of each node before and after the intervention is calculated to form the influence vector. The weighted average of the cosine similarity and response amplitude ratio of the influence vector pairs obtained under multiple different intervention objectives is taken as the causal consistency score; The content realism score and causal consistency score are fused together using learnable weights and then subjected to nonlinear mapping to obtain the final discriminant score.

[0016] In some specific embodiments, the Nash equilibrium condition is that the output of the discrimination score for both positive and negative samples is stable at the random guess level and the total loss fluctuation is lower than a preset range; When adjusting parameters, the file content, system call trajectory, and cause-effect graph of the system call trajectory collected in the real environment are used as positive samples, and the decoy file, expected behavior trajectory, and actual execution trajectory of the obfuscated monitoring code generated by the generation process and the obfuscation process are used as negative samples. In each iteration, the parameters of the generation process and the confusion process are fixed, and the parameters of the output discrimination score are updated with an adversarial loss including gradient penalty. The parameters of the output discrimination score are fixed, and the parameters of the generation process and the confusion process are updated with the bulldozer distance loss and the causal graph rationality constraint loss as the objective of maximizing the discrimination score.

[0017] In some specific embodiments, it also includes: The anti-reverse perception logic is embedded in the obfuscated monitoring code. The anti-reverse perception logic detects the symbol execution environment by using opaque predicates based on cryptographic hashes, detects non-real processor execution environments by using timestamp counter differential detection, and detects whether it is in a debugged state by using environment fingerprint. The detection result is encoded into a perceptual flag bit vector, which is then mapped and injected as an extension condition into both the generation process and the obfuscation process. When the perception flag indicates the presence of reverse analysis behavior, the decoy exposure mode is triggered.

[0018] In some specific embodiments, triggering the decoy exposure mode further includes: The generation process switches the causal graph generation strategy, inserts decoy weakness nodes corresponding to network behaviors into the perturbation behavior causal graph, and places the decoy weakness nodes at the convergence position of multiple causal chains and marks them with high causal strength. The obfuscation process reduces the semantic folding strength of the basic block corresponding to the decoy weakness node, replaces it with a code segment whose cosine distance to the semantic vector of the original application programming interface is less than a preset adjacent threshold, and reduces the insertion of opaque predicates. The decoy's weakness node points to a preset highly interactive decoy environment. When an attacker performs an operation based on the decoy's weakness node, it triggers deep monitoring and tracing.

[0019] In some specific embodiments, the generation process provides the perturbed behavioral causal graph as an output to the obfuscation process, and the obfuscation process uses the nodes and edges of the perturbed behavioral causal graph as the basis for constructing a control flow graph. The behavioral causal structure output by the generation process and the execution path structure of the code generated by the obfuscation process are based on the same graph structure. In the process of outputting the discrimination score, the counterfactual causal consistency loss between the expected behavior trajectory and the actual behavior trajectory is calculated. The counterfactual causal consistency loss is then passed to the generation process through the shared embedding space of the semantic anchor vector set. This is used to adjust the optimal transmission distance between the application programming interface bound to the anchor association mask and the feature vectors of each block of the file. The loss is also passed to the obfuscation process to adjust the selection preference of the confusion interval retrieval.

[0020] Based on the same concept, this invention also provides a deception-based honeypot defense system based on generative adversarial networks and code semantic obfuscation, including: The semantic and behavioral graph construction module is configured to collect system call sequences from real business environments, extract causal dependencies between application programming interface calls, construct semantic and behavioral dependency graphs, and train a set of semantic anchor vectors for global sharing. The file and cause-effect graph joint generation module is configured to perform generation processing, receive random noise and business scenario semantic tags, and simultaneously generate decoy file content, anchor point association mask, and perturbed behavior cause-effect graph obtained by applying topological perturbation to the basic cause-effect graph. The semantic folding obfuscation compilation module is configured to perform obfuscation processing. Driven by the perturbed behavior causal graph, it selects semantically related code fragments in the semantic space composed of the set of semantic anchor vectors by searching through the perplexity interval, compiles them into the monitoring code control flow, and compiles them to generate obfuscated monitoring code. The counterfactual causal consistency discrimination module is configured to extract the expected behavioral trajectory causal structure corresponding to the perturbed behavioral causal graph and the actual behavioral trajectory causal structure generated by the execution of the obfuscated monitoring code, apply the same deletion intervention to the expected behavioral trajectory causal structure and the actual behavioral trajectory causal structure, compare the consistency of the direction and magnitude of the causal in-degree change before and after the intervention, and output a discrimination score. The adversarial training and deployment control module is configured to adjust the parameters involved in the generation process, the obfuscation process, and the output of the discrimination score according to the discrimination score until a Nash equilibrium is reached, and configure the honeypot environment to execute the generation process and the obfuscation process.

[0021] Compared with existing technologies, its advantages are as follows: This invention discloses a deceptive honeypot defense method and system based on generative adversarial networks and code semantic obfuscation, which improves behavioral consistency: through a causal embedded adversarial compilation closed-loop mechanism, the perturbed behavioral causal graph output by the generator serves as the driving seed and directly determines the semantic folding strategy of the obfuscation engine. The system call trajectory generated by the monitoring code generated by the obfuscation engine during actual execution is highly consistent with the business logic claimed in the decoy file in the deep causal structure, effectively resisting anti-honeypot detection methods based on behavioral consistency analysis.

[0022] Enhanced ability to counter static reverse analysis: By embedding anti-reverse analysis awareness logic in obfuscated monitoring code, the attacker's static analysis behavior is transformed from a passive defensive threat into an exploitable resource for active deception. After triggering the decoy exposure mode, the attacker is guided to trace to the preset high-interaction decoy environment, achieving in-depth monitoring and source tracing.

[0023] The deception capability has the characteristic of continuous evolution: the adversarial training framework enables the generation process, confusion process and discrimination scoring output to form a closed-loop game optimization. After deployment, the system can continuously evolve through incremental learning without the need for manual rule updates.

[0024] The processing steps generate a deep synergistic effect: the generation process provides the perturbed behavior causal graph as an output to the obfuscation process, the obfuscation process uses the nodes and edges of the perturbed behavior causal graph as the basis for constructing the control flow graph, and the output discrimination score processing feeds back the counterfactual causal consistency loss to the generation process and the obfuscation process respectively through the shared embedding space of the semantic anchor vector set, forming a closed-loop optimization. The overall deception capability exceeds the simple sum of the capabilities of each step. Attached Figure Description

[0025] Other features, objects, and advantages of this application will become more apparent from the following detailed description of non-limiting embodiments with reference to the accompanying drawings: Figure 1 This is a flowchart illustrating some specific embodiments of the deceptive honeypot defense method based on generative adversarial networks and code semantic obfuscation of the present invention; Figure 2 This is a schematic diagram of the structure of the deceptive honeypot defense system based on generative adversarial networks and code semantic obfuscation in some specific embodiments of the present invention. Detailed Implementation

[0026] To make the objectives, technical solutions, and advantages of this application clearer, the application will be further described in detail below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments in this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0027] The terminology used in the embodiments of this application is for the purpose of describing particular embodiments only and is not intended to limit the application. The singular forms "a," "the," and "the" as used in the embodiments of this application are also intended to include the plural forms, unless the context clearly indicates otherwise, and "multiple" generally includes at least two.

[0028] It should be understood that the term "and / or" used in this article is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, and B existing alone. Additionally, the character " / " in this article generally indicates that the preceding and following related objects have an "or" relationship.

[0029] It should be understood that although the terms first, second, third, etc., may be used in the embodiments of this application, these descriptions should not be limited to these terms. These terms are only used to distinguish the descriptions. For example, first may also be referred to as second without departing from the scope of the embodiments of this application, and similarly, second may also be referred to as first.

[0030] Depending on the context, the words “if” or “suppose” as used here can be interpreted as “when” or “in response to determination” or “in response to detection.” Similarly, depending on the context, the phrases “if determination” or “if detection (of the stated condition or event)” can be interpreted as “when determination” or “in response to determination” or “when detection (of the stated condition or event)” or “in response to detection (of the stated condition or event).”

[0031] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that an article or device that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such an article or device. Without further limitation, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the article or device that includes said element.

[0032] It should be noted that any symbols and / or numbers present in the specification that are not marked in the accompanying drawings are not reference numerals.

[0033] Reference Figure 1 Deceptive honeypot defense methods based on generative adversarial networks and code semantic obfuscation include: S101 collects system call sequences from real business environments, extracts causal dependencies between application programming interface calls, constructs semantic and behavioral dependency graphs, and trains a set of semantic anchor vectors for global sharing. S102, perform generation processing, receive random noise and business scenario semantic tags, and synchronously generate decoy file content, anchor point association mask, and perturbation behavior causal graph obtained by applying topological perturbation to the basic causal graph; S103, perform obfuscation processing, driven by the perturbed behavior causal graph, select semantically related code fragments in the semantic space composed of the set of semantic anchor vectors through confusion interval retrieval, compile them into the monitoring code control flow, and compile to generate obfuscated monitoring code; S104, extract the expected behavior trajectory causal structure corresponding to the perturbed behavior causal graph and the actual behavior trajectory causal structure generated by the execution of the obfuscated monitoring code, apply the same deletion intervention to the expected behavior trajectory causal structure and the actual behavior trajectory causal structure, compare the consistency of the direction and magnitude of the causal in-degree change before and after the intervention, and output a discrimination score; S105, based on the discrimination score, adjust the parameters involved in the generation process, the obfuscation process, and the output of the discrimination score until Nash equilibrium is reached, and configure the honeypot environment to perform the generation process and the obfuscation process.

[0034] To illustrate this more clearly, the steps are explained in detail below: S101 collects system call sequences from real business environments, extracts causal dependencies between application programming interface calls, constructs semantic and behavioral dependency graphs, and trains a set of semantic anchor vectors for global sharing. S101 further includes: The collected system call sequences are segmented into sessions according to process lifecycle and the application programming interface names are standardized. Fixed-length call fragments are extracted using a sliding window. Based on the convergent cross-mapping method, for each pair of co-occurring application programming interfaces, the state space is reconstructed with the lag coordinates of one side and the value of the other side is predicted. By comparing the correlation coefficient between the predicted value and the actual value with the degree of difference in the reverse causal strength, the existence of the directed causal edge and the causal strength of the directed causal edge are determined. Nodes in the semantic and behavioral dependency graph that are connected by directed edges and whose causal strength meets a preset condition are taken as neighbors. The embedding vectors of each application programming interface node are trained by aggregating multi-hop neighbor information through a graph neural network to obtain the semantic anchor vector set.

[0035] Specifically, in this embodiment of the invention, system call sequences are collected from a high-interaction business simulation host deployed in a real business environment. A system call capture tool is installed on each host and configured to run in process name whitelist filtering mode to capture system calls of the target application process. Recorded fields include timestamp, process identifier, thread identifier, system call name, key parameter values, return value, and return address of the upper layer of the call stack. The continuous collection time covers multiple complete working days and non-working periods.

[0036] The collected system call sequences are segmented into independent sessions according to the process lifecycle from creation to destruction, with system calls within the same session having complete contextual relationships. Functionally equivalent system calls in different operating system versions are mapped to standard names to eliminate the impact of version differences on subsequent analysis. Fixed-length call fragments are extracted from each session using a sliding window, serving as the basic unit for subsequent causal analysis.

[0037] For each pair of co-occurring API call types, a convergent cross-mapping method is used to extract causal relationships. Time series data for each API call type are constructed, with call frequencies counted within fixed time windows to form evenly spaced time series data. For each pair of API call types whose causal relationship is to be analyzed, the system state space is reconstructed using the lag coordinates of one of the call types. An embedding manifold is constructed using the embedding dimension determined by the pseudo nearest neighbor algorithm. Several nearest neighbor points to the current state are found on the embedding manifold. The current value of the other call type is predicted using a weighted average of the values ​​corresponding to these neighbor points, with weights determined based on the Euclidean distance between the current state and the neighbor points. The Pearson correlation coefficient between the predicted and actual values ​​is calculated as the causal strength. The difference between positive and negative causal strengths is compared. When the positive causal strength exceeds the negative causal strength by a preset discrimination threshold, and the causal strength is higher than the global strength threshold, a directed causal edge is determined to exist. A semantic and behavioral dependency graph is output, with API call types as nodes, connected by directed causal edges, and each edge labeled with its causal strength.

[0038] Using the constructed semantic and behavioral dependency graph as the input graph structure, a graph neural network is employed to train the embedding vector of each application programming interface (API) call type node. Mean aggregation is selected as the aggregator type, and the neighbor sampling depth is two layers, aggregating two-hop neighbor information. An unsupervised loss function based on random walks is used as the loss function. After training, each API call type obtains a fixed-dimensional semantic anchor vector. Nodes with close causal relationships are located close to each other in the vector space. This set of semantic anchor vectors is stored in key-value pairs for global sharing and retrieval during generation and obfuscation processing.

[0039] The following example illustrates this: Five highly interactive business simulation hosts were deployed on a Linux operating system, with LibreOffice office suite, MySQL client, PostgreSQL client, Firefox browser, and Thunderbird email client installed. The sysdig tool was used to capture system calls, with filtering parameters set to only capture system calls from the processes corresponding to the aforementioned applications. Timestamps were recorded to the microsecond level, and data was collected continuously for seven days.

[0040] After data collection is complete, the session is split, with each process from startup to exit constituting a complete session. Simultaneously, the functionally equivalent open, openat, and openat2 methods in the Linux system are uniformly mapped to... Categories that uniformly map socket, connect, sendto, and recvfrom to Category. Window length is used for each session. For 50 system calls, step size To extract short sequences from a sliding window of 10 system calls, for a sequence of length... The number of short sequences that can be extracted from the conversation sequence is: ; in: This represents the total number of short sequences extracted. This represents the total number of system calls made in the original session. The length of the sliding window; This is the sliding step size.

[0041] For frequent co-occurrence and Two application programming interface (API) call types are analyzed, and their call frequencies are recorded within a fixed 1-second time window to form their respective call frequency time series. This is done using the embedding dimension. 3. Lag step size Build for a time window Given an embedded manifold, find the nearest neighbor on the manifold that is the current state. That is, using the weighted average prediction of 4 neighboring points. The value of and the weight calculation formula are as follows: ; in: For the first The weight of each neighboring point; For the current state and the first Euclidean distance between neighboring points; It is the minimum distance among all neighboring points.

[0042] The Pearson correlation coefficient between the predicted and actual values ​​was obtained by calculating the predicted values. right causal strength It is 0.89, calculated in reverse. right causal strength The value is 0.32, the difference between the two exceeds the distinction threshold of 0.1, and the positive causal strength of 0.89 is higher than the global strength threshold of 0.6. Therefore, it is determined that there is a positive causal relationship. arrive The directed causal edges are labeled with a causal strength of 0.89. By traversing all frequently co-occurring API call type pairs in this manner, a semantic and behavioral dependency graph containing multiple nodes and edges is finally constructed.

[0043] Using the constructed semantic and behavioral dependency graph as input, the GraphSAGE graph neural network framework is employed to train node embedding vectors. Embedding vector dimension... Set to 128 dimensions, neighbor sampling depth Set to 2 layers, the aggregation method is to take the average of the embedding vectors of neighboring nodes. Layer nodes The embedding vector update method is to update the node In the The embedding vector of a layer and all its neighbor nodes at the 1st layer The embedding vectors of the layers are concatenated and multiplied by the mean of the first layer. The layer's weight matrix undergoes non-linear activation processing, resulting in a weight matrix dimension of 128×256, and a neighbor node set. Defined as all nodes pointed to by directed edges in the semantic and behavioral dependency graph. Or by node The node it points to. The loss function for unsupervised training is, for the node in the random walk that is closest to the anchor node. Co-occurring positive sample neighbor nodes Number of negative samples Set to 10, negative sample nodes are sampled through noise distribution. The optimization objective is to maximize the similarity of the embedding vectors of the anchor node and the positive sample node, and minimize the similarity of the embedding vectors of the anchor node and the negative sample node.

[0044] After training, the causal relationships are closely related. , , Semantic anchor vectors of application programming interface (API) call types are relatively close in distance within the vector space, while those with weaker correlations are more closely related. and The semantic anchor vectors are far apart, and this set of semantic anchor vectors is stored in NumPy binary file format.

[0045] S102, perform generation processing, receive random noise and business scenario semantic tags, and synchronously generate decoy file content, anchor point association mask, and perturbation behavior causal graph obtained by applying topological perturbation to the basic causal graph; S102 further includes: Based on the semantic tags of the business scenarios, a matching basic causal graph is retrieved from the semantic and behavioral dependency graph. The semantic tags of the business scenarios are represented by file type and business scenario encoding. The basic causal graph is a subgraph composed of nodes and edges in the semantic and behavioral dependency graph that correspond to the semantic tags of the business scenarios. Perform topological perturbation on the basic causal graph, including reversing the direction of non-necessary causal edges with causal strength below the median in the basic causal graph, selecting application programming interfaces from the set of semantic anchor vectors whose distance from the semantic vector of the node in the basic causal graph is within a preset confusion interval as ghost nodes to insert into the causal chain, and splitting causal chains in the basic causal graph with a length exceeding a threshold from the midpoint into parallel segments and inserting synchronization barrier nodes. The total loss of the generation process is composed of a weighted sum of adversarial loss, bulldozer distance loss, and causal graph rationality constraint loss. The bulldozer distance loss is the optimal transmission distance that measures the distribution difference between the feature vectors of each block of the generated file and the semantic anchor vectors of the application programming interface bound to the anchor point association mask. The causal graph rationality constraint loss is a penalty term applied to edges in the causal graph of the perturbed behavior where the causal strength is lower than a preset minimum threshold.

[0046] Specifically, in this embodiment of the invention, random noise and business scenario semantic tags are received. The random noise is sampled from a standard normal distribution, and the business scenario semantic tags are represented by file type and business scenario encoding. The random noise and business scenario semantic tags are mapped to latent feature vectors and conditional embedding vectors respectively, and then concatenated and fused to map to a high-dimensional shared representation. The decoy file binary content tensor is output through the file content generation branch, and the anchor point association mask of the semantic binding relationship between each region of the specified file and the application programming interface is output through the anchor point mask generation branch. The perturbed behavioral causal graph is output through the behavioral causal graph perturbation head.

[0047] Based on the semantic tags of the business scenario, a matching basic causal graph is retrieved from the semantic and behavioral dependency graph. The basic causal graph is a subgraph composed of nodes and edges in the semantic and behavioral dependency graph that correspond to the semantic tags of the business scenario. Topological perturbation is performed on the basic causal graph. Non-necessary causal edges with causal strength below the median are reversed. Application programming interface call types selected from the semantic anchor vector set whose distance to the semantic vector of a node in the basic causal graph is within a preset perplexity interval are inserted as ghost nodes into the causal chain. Causal chains in the basic causal graph whose length exceeds a threshold are split into parallel segments at their midpoints and synchronization barrier nodes are inserted. The perturbed behavioral causal graph is output in structured data form, including a list of nodes, a list of edges, and topological metadata.

[0048] The total loss of the generation process is a weighted average of three components: adversarial loss, bulldozer distance loss, and causal graph rationality constraint loss. The bulldozer distance loss measures the distribution difference between the feature vectors of each block of the generated file and the semantic anchor vectors of the application programming interface (API) bound to the anchor point association mask. Specifically, after dividing the generated file into fixed-length blocks, feature vectors are extracted from each block through convolution operations, and the optimal transmission distance between the feature vectors of each block and the semantic anchor vectors of the API is calculated. The causal graph rationality constraint loss penalizes edges in the causal graph whose causal strength is below a preset minimum threshold after perturbation, preventing excessive perturbation from causing the causal graph to lose its physical realizability.

[0049] The following example illustrates this: Random noise is sampled from a standard normal distribution with a dimension of 100. Semantic labels for business scenarios are represented using one-hot encoding, with the dimension depending on the number of business scenarios. Taking office document scenarios as an example, the encoding is done as a corresponding label vector. The noise mapping network maps noise to a 256-dimensional latent feature vector through fully connected layers. The conditional encoder maps semantic labels to 128-dimensional conditional embedding vectors. These are concatenated into a 384-dimensional vector and then mapped to a 1024-dimensional shared representation through two fully connected layers. The file content generation branch outputs a binary content tensor of the target file size through five layers of transposed convolutions. The convolution kernel size is 4, the stride is 2, the padding is 1, and the number of channels varies layer by layer. The anchor mask generation branch calculates the API binding weights for each byte range of the file using a self-attention mechanism. The behavioral causal graph perturbation head takes the shared representation and conditional labels as input and performs causal graph retrieval and perturbation operations.

[0050] When the semantic tags of a business scenario correspond to an office document scenario, the basic causal graph retrieved from the semantic and behavioral dependency graph includes... , , , The basic causal graph has 5 to 20 nodes and 6 to 40 directed edges. Three types of topological perturbations are performed on the basic causal graph.

[0051] The first type is edge reversal. Traverse each directed edge in the basic causal graph, obtain its causal strength, calculate the median of all edge causal strengths, and reverse the direction of edges with a probability of 0.3 for those edges whose causal strength is below the median. For example, The causal strength is below the median, and is reversed. .

[0052] The second category is ghost node insertion. Nodes not present in the underlying causal graph but existing in the global dependency graph are randomly selected from the semantic anchor vector set as candidates. The cosine distance between the candidate node and the randomly selected node in the underlying causal graph is calculated. The formula for calculating the cosine distance is: ; in: For the target node With candidate ghost nodes The cosine distance; For the target node semantic anchor vector; Candidate ghost nodes semantic anchor vector; It is the dot product of vectors; Representing vectors Norm.

[0053] If the cosine distance is within the preset perplexity interval If it is within the range, then insertion is performed. For example, in... and Insert between As a ghost node, it forms The insertion chain inserts 1 to 3 ghost nodes into each graph.

[0054] The third type is causal chain fission. It identifies continuous causal chains of length 3 or greater in the basic causal graph and splits them into two parallel chains with a probability of 0.5 at the midpoint, inserting synchronization barrier nodes to complete the convergence. For example, a causal chain... Fission into two parallel chains and Converging to the synchronization barrier node .

[0055] The formula for calculating the total loss of the generation process is: ; in: To generate the total loss value for the processing; To counteract the loss term, a generator standard adversarial loss from a conditional generative adversarial network is employed. This is the bulldozer distance loss item; The loss term is a rationality constraint term for the cause-effect graph; This is the weighting coefficient for bulldozer distance loss; The weighting coefficients are used to calculate the loss due to the rationality constraints of the causal graph.

[0056] When calculating bulldozer distance loss, the generated file is divided into 256-byte blocks, totaling... Each block is processed by a small convolutional network to extract feature vectors. The target API embedding vector for each bound block is determined by the anchor point association mask. The bulldozer distance loss solution minimizes the transportation cost from each feature vector block to the API embedding vector at each anchor point. ; The constraints are that the sum of each row in the transport matrix equals the reciprocal of the total number of blocks, and the sum of each column equals the reciprocal of the total number of anchor points. The parameters are defined as follows: The total number of file blocks; The total number of anchor APIs; For from the first The file block to the The transport volume of each anchor API is a non-negative real number. For the first Feature vectors of each file block; For the first A 128-dimensional semantic anchor vector for each anchor API.

[0057] The causal graph rationality constraint loss penalizes edges in the causal graph of perturbed behavior where the causal strength is below a minimum threshold: ; in: Let be the set of edges in the causal graph of the perturbed behavior; Let be the total number of edges; It is a single edge; For the edge The causal strength; The minimum threshold for causal strength; This is an indicator function that takes the value 1 if the condition is true, and 0 otherwise.

[0058] For example, in the causal graph of the perturbed behavior, if the causal strength of an edge is 0.62, which is not lower than the threshold of 0.5, the contribution of this edge to the loss term is 0.62, which is negative after multiplying by the negative sign; if the causal strength of an edge is 0.38, which is lower than the threshold of 0.5, the indicator function is 0, and this term does not contribute any penalty. The smaller the loss of the causal graph rationality constraint, the more rational the causal graph is after perturbing.

[0059] S103, perform obfuscation processing, driven by the perturbed behavior causal graph, select semantically related code fragments in the semantic space composed of the set of semantic anchor vectors through confusion interval retrieval, compile them into the monitoring code control flow, and compile to generate obfuscated monitoring code; S103 further includes: A set of semantically related code snippets is pre-constructed. Each code snippet is labeled with a list of application programming interfaces (APIs) it contains and a semantic vector is calculated. The semantically related code snippet is a code snippet whose list of APIs it contains has an inclusion relationship or functional overlap with the corresponding node's API. The semantic vector is the result of averaging the semantic anchor vectors of each API contained in the code snippet. The nodes of the perturbed behavior causal graph are mapped to basic blocks of the control flow graph, and the directed edges of the perturbed behavior causal graph are mapped to jumps between basic blocks. The structural correspondence is verified by graph isomorphism. For each basic block, using the semantic anchor vector of the node corresponding to the basic block as the query anchor, candidate segments whose semantic vector cosine distance falls into the confusion interval are retrieved from the set of semantically associated code segments and incorporated into the basic block; An opaque predicate is set for the basic block corresponding to the ghost node. The opaque predicate is executed along a preset path during normal execution and is presented as a branch structure with two reachable paths during static analysis.

[0060] Specifically, in this embodiment of the invention, a set of semantically related code snippets is pre-constructed. The sources of these semantically related code snippets include various implementation variants of application programming interface (API) call wrapper functions extracted from system library source code, functionally equivalent but differently implemented code snippets extracted from different versions of open-source projects, and code variants automatically generated by the compiler's super optimizer. Each code snippet is labeled with a list of API call types it contains, and a semantic vector is calculated. The semantic vector is the result of averaging the semantic anchor vectors of each API call type contained in the code snippet. The list of APIs contained in the semantically related code snippets has an inclusion relationship or functional overlap with the corresponding node's API. This set of semantically related code snippets is indexed inverted by API category, supporting efficient retrieval based on semantic vector distance.

[0061] Nodes in the perturbed causal graph are mapped to basic blocks of the control flow graph, and directed edges in the perturbed causal graph are mapped to jump instructions between basic blocks. The causal direction between nodes determines the source and destination of the jump. If a node has multiple successor nodes, a conditional jump instruction is inserted at the end of the corresponding basic block, with the jump condition determined by a randomly generated opaque predicate. After mapping, a graph isomorphism algorithm is used to verify that the control flow graph skeleton structure maintains structural correspondence with the perturbed causal graph. If structural differences exist, a no-operation basic block is inserted in the control flow graph as a placeholder to maintain the integrity of the correspondence.

[0062] For each basic block, using the semantic anchor vector of the corresponding node as the query anchor, candidate segments whose semantic vector cosine distance falls within a preset perplexity interval are retrieved from the set of semantically related code segments and incorporated into the basic block. The lower bound of the perplexity interval ensures that the selected segment has a certain semantic relationship with the original application programming interface, preventing completely unrelated system calls. The upper bound ensures that the selected segment is not completely equivalent to the original application programming interface, producing a semantic ambiguity effect in static analysis. An opaque predicate is set for the basic block corresponding to the ghost node. This opaque predicate executes along a preset path during normal execution and presents as a branch structure with two reachable paths during static analysis. For parallel structures generated by the fission of causal chains in the perturbation behavior causal graph, thread creation or asynchronous scheduling logic is inserted into the control flow graph to ensure that the parallel structure actually exists at runtime. The woven control flow graph is compiled into executable obfuscated monitoring code for the target platform via the compilation optimization pipeline.

[0063] The following example illustrates this: The semantically associated code snippet set extracts various implementation variants of system call wrapper functions such as open, read, write, and close from the GNU C Library source code, including versions with different error handling logic and different buffering strategies. Candidate snippets are also selected from functionally equivalent code variants generated by the LLVM super optimizer. The typical size is 1000 to 5000 code snippets. Each code snippet is labeled with a list of application programming interface (API) call types it contains, and a semantic vector is calculated. The semantic vector is the average of the semantic anchor vectors of all APIs contained in the snippet. The criterion for determining a semantically associated code snippet is that the list of APIs contained in the snippet has an inclusion relationship or functional overlap with the APIs of the corresponding node.

[0064] The perturbation behavior causal graph contains nodes Ghost nodes , , And the corresponding directed edges, for example. Let the nodes... Mapping to basic blocks ,node Mapping to basic blocks ,node Mapping to basic blocks ,node Mapping to basic blocks Directed edge Mapping to basic blocks arrive Unconditional jump, directed edge Mapping to basic blocks arrive The conditional jumps are generated by opaque predicates. After mapping, the VF2 graph isomorphism algorithm is used to verify the structural correspondence between the control flow graph skeleton and the perturbed behavior causal graph.

[0065] Perform semantic retrieval of perplexity intervals for each basic block. Based on the basic blocks... Corresponding node 128-dimensional semantic anchor vector To serve as the query anchor, calculate the semantic vectors of each candidate fragment from the set of semantically related code fragments. The cosine distance. The formula for calculating the cosine distance is: ; in: The cosine distance between the semantic anchor vector of the node and the semantic vector of the candidate segment; This is the semantic anchor vector of the node corresponding to the basic block; This is the semantic vector of the candidate code snippet.

[0066] Preset lower bound of the confusion interval It is 0.45, upper bound. A score of 0.70 corresponds to a semantic overlap of approximately 30% to 55%. The cosine distance falls within... One or two candidate segments from the interval are randomly selected and incorporated into basic blocks. For example, basic blocks... Two candidate segments with cosine distances of 0.52 and 0.63 were retrieved. File open operations with different error handling logic were implemented for each segment. The segment with a distance of 0.63 was selected and incorporated into the basic block. As the main code.

[0067] ghost nodes Corresponding basic blocks This sets an opaque predicate based on SHA-256 hashing. At compile time, the SHA-256 hash of a secret value is pre-computed, and a fixed number of bits are truncated as the pre-computed value. At runtime, a hash value based on the current instruction address and stack content is dynamically calculated and compared with the pre-computed value. During normal execution, if the comparison result is true, the code enters the basic block along the preset path. The probability of this path being executed is approximately 1% to 5%; the static analysis tool presents two reachable paths due to its inability to effectively solve the SHA-256 constraints, one of which points to the basic block. Another line points to the basic block. For parallel structures generated by causal chain fission, thread creation calls are inserted into the control flow graph to ensure that the two parallel code segments actually exist at runtime.

[0068] After semantic folding and weaving, the LLVM intermediate representation control flow graph is compiled into executable obfuscated monitoring code for the target platform via the compiler optimization pipeline. The compilation optimization level is O2, but function inlining optimization is disabled to preserve the control flow structure characteristics. Stack protection is enabled, position-independent code is generated, debug symbols are removed, and the output is an executable file that can be directly deployed to a honeypot environment.

[0069] S104, extract the expected behavior trajectory causal structure corresponding to the perturbed behavior causal graph and the actual behavior trajectory causal structure generated by the execution of the obfuscated monitoring code, apply the same deletion intervention to the expected behavior trajectory causal structure and the actual behavior trajectory causal structure, compare the consistency of the direction and magnitude of the causal in-degree change before and after the intervention, and output a discrimination score; S104 further includes: The byte entropy distribution and structural features of the decoy file are extracted by convolution operation and compared with the corresponding features of the real file sample to obtain a static byte-level fidelity score. Causal adjacency matrices are extracted from the expected behavior trajectory and the actual behavior trajectory using temporal causal convolutional coding, respectively. The causal in-degree refers to the overall metric obtained by aggregating the causal dependency strength of each node in the causal adjacency matrix other than the target node to the target node. After excluding the ghost nodes from the node set of the expected behavioral trajectory, the intervention target is selected. The deletion intervention of setting the corresponding row and column of the intervention target node to zero is applied to the expected causal adjacency matrix and the actual causal adjacency matrix respectively. The change in causal in-degree of each node before and after the intervention is calculated to form the influence vector. The weighted average of the cosine similarity and response amplitude ratio of the influence vector pairs obtained under multiple different intervention objectives is taken as the causal consistency score; The content realism score and causal consistency score are fused together using learnable weights and then subjected to nonlinear mapping to obtain the final discriminant score.

[0070] Further: The cosine similarity refers to the directional consistency of two influence vectors, and is measured by the dot product of the influence vectors after normalization of their magnitudes. The response amplitude ratio is the ratio of the smaller magnitude of the influence vectors to the larger magnitude of the influence vectors. In the overall consistency score, the weight of cosine similarity is greater than the weight of response amplitude ratio.

[0071] Specifically, in this embodiment of the invention, the causal structure of the expected behavior trajectory corresponding to the perturbation behavior causal graph and the causal structure of the actual behavior trajectory generated by the execution of obfuscated monitoring code are extracted. A content fidelity evaluation process is performed, using convolutional operations to extract the byte entropy distribution features and structural features of the decoy file, which are compared with the corresponding features of the real file sample to obtain a static byte-level fidelity score. A counterfactual causal consistency verification process is performed, using temporal causal convolutional encoding to extract causal adjacency matrices from the expected and actual behavior trajectories respectively. Causal in-degree refers to the overall measure obtained by aggregating the causal dependency strength of all nodes in the causal adjacency matrix (excluding the target node) to the target node. After excluding ghost nodes from the node set of the expected behavior trajectory, intervention targets are selected. Deletion interventions are applied to both the expected and actual causal adjacency matrices, setting the corresponding rows and columns of the intervention target node to zero. The change in causal in-degree of each node before and after the intervention is calculated to form an influence vector. The weighted average of the cosine similarity and response amplitude ratio of the influence vector pairs obtained under multiple different intervention targets is taken as the causal consistency score. Cosine similarity refers to the directional consistency between two influence vectors, measured by the dot product of the influence vectors after normalization of their magnitudes. The response amplitude ratio is the ratio of the smaller to the larger magnitude of the influence vectors. In the overall consistency score, cosine similarity has a greater weight than the response amplitude ratio. The content fidelity score and causal consistency score are fused using learnable weights and then subjected to a nonlinear mapping to obtain the final judgment score.

[0072] The following example illustrates this: The expected behavioral trajectory is obtained by expanding the perturbed behavior causal graph through topological sorting, containing five application programming interface call type nodes, which are arranged in the following order: , , , , ,in This is a ghost node. The actual behavior trajectory is generated by obfuscated monitoring code executing in a sandbox environment, containing five application programming interface (API) call type nodes, listed in the order of call: , , , , ,in This is the call that replaces the ghost node in actual execution.

[0073] The content fidelity assessment uses a five-layer convolutional neural network with a kernel size of 4, a stride of 2, padding of 1, and channel numbers of 1, 64, 128, 256, and 512 respectively. A fully connected layer is then used to output the content fidelity score. The byte entropy distribution features and file header structure features of the decoy file are extracted and compared with the feature distribution of real file samples to obtain a static byte-level fidelity score. It is 0.82.

[0074] Counterfactual causality consistency testing extracts the causal adjacency matrix using temporal causal convolutional coding. The encoder employs a four-layer dilated convolutional structure with dilation rates of 1, 2, 4, and 8, and a kernel size of 3. Each layer is followed by ReLU activation and weight normalization, and the output layer is a fully connected layer mapped to the causal adjacency matrix space. For the input trajectory, the encoder outputs the causal adjacency matrix. , dimension ,in The number of unique application programming interface call types in the trajectory. Matrix elements. The value of is between 0 and 1, indicating that the is the . The application programming interface call type is related to the first Estimated causal dependency strength of each application programming interface call type.

[0075] remember This is the causal adjacency matrix extracted from the expected behavioral trajectory. This is the causal adjacency matrix extracted from actual behavioral trajectories. For example, the expected causal adjacency matrix and the actual causal adjacency matrix They are respectively: ; ; The causal in-degree is the overall metric obtained by aggregating the causal dependencies of all nodes in the causal adjacency matrix, excluding the target node, on the target node. For the target node... Its cause and effect enter into the degree The calculation method is to take the first element in the causal adjacency matrix. The sum of all elements except the diagonal elements: ; in: For the target node The causal inference; The causal adjacency matrix is ​​the th Line number The elements of a column represent nodes. For nodes The strength of causal dependence; Summation range Indicates the exclusion of nodes Dependence on oneself.

[0076] After excluding ghost nodes from the set of nodes representing the expected behavioral trajectory, select nodes. As the intervention target. Deleting the intervention sets all rows and columns corresponding to the intervention target node to zero in the causal adjacency matrix. Intervention impact vector Each component corresponds to a node's change in causal in-degree before and after the intervention: ; in: The intervention impact vector at the th Components on each node; The set of all nodes; For nodes in the original causal adjacency matrix For nodes The causal strength; For nodes in the causal adjacency matrix after intervention For nodes The causal strength.

[0077] Multiple interventions targeting different objectives, ultimately achieving the desired outcome. sequence The cosine similarity of the intervention measures the directional consistency between the two influence vectors: ; in: For the first Cosine similarity of the second intervention; For the first The impact vector of the expected behavioral trajectory under the intervention; For the first The influence vector of actual behavioral trajectory under each intervention.

[0078] No. The magnitude of the response to the intervention measures the consistency of the magnitudes of the two influence vectors: ; in: For the first The response magnitude of each intervention.

[0079] No. The overall consistency score for the intervention was: ; in As a balancing factor, cosine similarity is given a higher weight.

[0080] right The causal consistency score was obtained by averaging the results of the interventions. : ; The final discrimination score is obtained through learnable weighted fusion and nonlinear mapping: ; in: For the final score, the values ​​are mapped to a range of 0 to 1 using the sigmoid function; It is the sigmoid activation function; Learnable fusion weights for content channels; Learnable fusion weights for causal consistency channels; This is a learnable bias term.

[0081] The final score is determined through fusion calculation. The value of 0.71 indicates that the output of the current generation and obfuscation processes is considered to be close to the real environment.

[0082] S105, based on the discrimination score, adjust the parameters involved in the generation process, the obfuscation process, and the output of the discrimination score until Nash equilibrium is reached, and configure the honeypot environment to perform the generation process and the obfuscation process.

[0083] S105 further includes: The Nash equilibrium condition is that the output of the discrimination score for both positive and negative samples is stable at the level of random guessing and the fluctuation of the total loss is lower than a preset range. When adjusting parameters, the file content, system call trajectory, and cause-effect graph of the system call trajectory collected in the real environment are used as positive samples, and the decoy file, expected behavior trajectory, and actual execution trajectory of the obfuscated monitoring code generated by the generation process and the obfuscation process are used as negative samples. In each iteration, the parameters of the generation process and the confusion process are fixed, and the parameters of the output discrimination score are updated with an adversarial loss including gradient penalty. The parameters of the output discrimination score are fixed, and the parameters of the generation process and the confusion process are updated with the bulldozer distance loss and the causal graph rationality constraint loss as the objective of maximizing the discrimination score.

[0084] Specifically, in this embodiment of the invention, file content, system call trajectories, and causal graphs of system call trajectories collected from a real business environment are used as positive samples, while decoy files, expected behavior trajectories, and actual execution trajectories of obfuscated monitoring code generated jointly by generation and obfuscation processes are used as negative samples. The parameters involved in generation, obfuscation, and output discrimination scores are adjusted based on the discrimination score. In each iteration, the parameters of generation and obfuscation processes are fixed, and the parameters of the output discrimination score are updated with an adversarial loss including gradient penalty. The parameters of the output discrimination score are also fixed, and the parameters of generation and obfuscation processes are updated with the goal of maximizing the discrimination score, combined with bulldozer distance loss and causal graph rationality constraint loss. The Nash equilibrium condition is that the output of the discrimination score for both positive and negative samples is stable at the level of random guessing, and the total loss fluctuation is lower than a preset range. After reaching Nash equilibrium, the honeypot environment is configured to execute generation and obfuscation processes.

[0085] The following example illustrates this: Positive samples are randomly sampled from file content, system call trajectories, and corresponding cause-effect graphs collected from the real business environment, with 32 samples per batch. Negative samples are jointly generated by the current parameter generation and obfuscation processes, including the generated decoy file, the expected behavior trajectory expanded by the perturbation behavior cause-effect graph, and the trajectory generated by the obfuscated monitoring code actually executing in the sandbox, with 32 samples per batch as well.

[0086] Training uses the WGAN-GP framework, and the loss function for the discrimination score output is: ; in: To determine the loss function value of the scoring output; Indicates the distribution of the true sample Expectations; Indicates the distribution of generated samples Expectations; To determine the output value of the scoring output relative to the real sample; To determine the output value of the scoring output to the generated sample; This is the gradient penalty coefficient; These are interpolation points randomly sampled from the line connecting the real and generated samples. For the interpolated sample distribution; To determine the gradient of the score output with respect to the interpolated samples.

[0087] In each iteration, the training steps for the discriminant score output are as follows: sample a batch from the positive sample pool, run the generation process to generate a batch of negative samples, input the positive and negative samples into the discriminant score output, and calculate the discriminant loss and gradient penalty term. The parameters of the discriminant score output are updated using the Adam optimizer with a learning rate of 0.0001, a first-order moment decay rate of 0.5, and a second-order moment decay rate of 0.9.

[0088] The training steps for generation and obfuscation are as follows: A batch of random noise and semantic labels from the business scenario are sampled; generation processing generates triples; obfuscation processing compiles the semantically folded code into monitoring code and executes it in a sandbox to collect actual behavioral trajectories. The generated samples are input into the discriminant score output. The adversarial loss is calculated with the goal of maximizing the discriminant score. Combining the bulldozer distance loss and the causal graph rationality constraint loss, the total loss is weighted and summed to update the parameters of generation and obfuscation processing. The learning rate is 0.0001.

[0089] The training frequency is configured such that the parameters of the discrimination score output are updated every five times, and the parameters of the generation and confusion processing are updated once.

[0090] In the Nash equilibrium condition, the random guess level is defined as the discriminant score output value stabilizing around 0.5, and the total loss fluctuation being below a preset range, meaning the change in the total loss of the generation process is less than 5% over multiple consecutive iterations. Nash equilibrium is determined to be reached when the discriminant score output values ​​for both positive and negative samples fluctuate around 0.5 and the fluctuation range of the total loss of the generation process is less than 5% for 500 consecutive iterations. After reaching Nash equilibrium, the model parameters for the generation process, the compilation plugin for the obfuscation process, and the semantic anchor vector set are saved. The honeypot environment is then configured to execute the generation and obfuscation processes after loading these parameters. The generation process is triggered periodically according to a preset strategy or when a new attacker is detected, continuously generating new decoy files to update the honeypot file system. The obfuscation monitoring code is loaded upon honeypot startup to capture attacker actions.

[0091] This also includes: The anti-reverse perception logic is embedded in the obfuscated monitoring code. The anti-reverse perception logic detects the symbol execution environment by using opaque predicates based on cryptographic hashes, detects non-real processor execution environments by using timestamp counter differential detection, and detects whether it is in a debugged state by using environment fingerprint. The detection result is encoded into a perceptual flag bit vector, which is then mapped and injected as an extension condition into both the generation process and the obfuscation process. When the perception flag indicates the presence of reverse analysis behavior, the decoy exposure mode is triggered.

[0092] Further: Triggering the decoy exposure mode includes: The generation process switches the causal graph generation strategy, inserts decoy weakness nodes corresponding to network behaviors into the perturbation behavior causal graph, and places the decoy weakness nodes at the convergence position of multiple causal chains and marks them with high causal strength. The obfuscation process reduces the semantic folding strength of the basic block corresponding to the decoy weakness node, replaces it with a code segment whose cosine distance to the semantic vector of the original application programming interface is less than a preset adjacent threshold, and reduces the insertion of opaque predicates. The decoy's weakness node points to a preset highly interactive decoy environment. When an attacker performs an operation based on the decoy's weakness node, it triggers deep monitoring and tracing.

[0093] Specifically, in this embodiment of the invention, anti-reverse engineering logic is embedded in the obfuscated monitoring code. This anti-reverse engineering logic includes three detection mechanisms. The first detection mechanism is based on the opaque predicate of cryptographic hashes. It leverages the characteristic that symbolic execution engines struggle to effectively solve cryptographic hash function constraints. During compilation, the hash result of the secret value is pre-calculated, and a fixed portion is truncated as the pre-calculated value. At runtime, the hash value based on the current instruction address and stack content is dynamically calculated and compared with the pre-calculated value. During normal execution, if the comparison result is true, the code executes along a preset path. The symbolic execution engine, unable to solve the hash constraints, branches and explores two paths. The symbolic execution environment is determined by detecting whether branches outside the preset path are abnormally triggered. The second detection mechanism is based on timestamp counter differential detection. Timestamp reading instructions are embedded in two consecutive basic blocks of the monitoring code. The number of processor cycles elapsed between the two basic blocks is collected and compared with the minimum expected number of cycles determined by offline pre-calibration. If the actual number of cycles is lower than a preset proportion of the minimum expected number of cycles, the current execution environment is determined to be a non-real processor execution environment. The third detection mechanism is based on environmental fingerprint detection. It checks whether the value of the debug register is non-zero and reads the process status file to track whether the process identifier field is non-zero, thereby determining whether it is in a debugged state.

[0094] The outputs of the three detection logics are aggregated into a perception flag vector, which is then mapped by the encoder to a condition vector of the same dimension as the condition embedding in the generation process. This condition vector is then injected as an extended condition into both the generation and obfuscation processes. When the perception flag indicates the presence of reverse analysis behavior, the decoy exposure mode is triggered.

[0095] The generation process switches the causal graph generation strategy, inserting decoy vulnerability nodes corresponding to network behaviors into the perturbation behavior causal graph. These decoy vulnerability nodes are placed at the convergence points of multiple causal chains and marked with high causal strength. Obfuscation reduces the semantic folding strength of the basic blocks corresponding to the decoy vulnerability nodes, replacing them with code snippets whose cosine distance to the semantic vector of the original application programming interface is less than a preset adjacent threshold, and reducing the insertion of opaque predicates. The decoy vulnerability nodes point to a preset high-interaction decoy environment; when an attacker performs operations based on the decoy vulnerability nodes, deep monitoring and attribution are triggered.

[0096] The following example illustrates this: Anti-reverse engineering logic is embedded in three key locations within the obfuscated monitoring code.

[0097] An opaque predicate based on SHA-256 is embedded at the entry point of a basic block. At compile time, the SHA-256 hash of the secret value "internal_salt_xxx" is pre-computed, and the first 32 bits are truncated and stored in an array as the pre-computed value. At runtime, the SHA-256 hash value is dynamically calculated using the current instruction return address and local variables on the stack as input, and compared byte-by-byte with the pre-computed value. During normal processor execution, the dynamic hash value matches the pre-computed value perfectly, and the code executes along the preset normal monitoring path. When an attacker uses a symbolic execution engine such as angr for static analysis, the symbolic execution engine encounters the SHA-256 hash function and attempts to solve the constraints of two branch paths. Due to the avalanche effect of cryptographic hashing, the complexity of constraint solving increases exponentially, forcing the symbolic execution engine to fork and explore two paths, triggering path explosion. Branches outside the preset path are abnormally entered, indicating a symbolic execution environment.

[0098] Differential detection using timestamp counters is embedded between two consecutive basic blocks. The timestamp counters are read at the end of the basic block to obtain... Read the timestamp counter at the beginning of the next basic block to get Calculate the time difference: ; in: The number of processor cycles between the two basic blocks; This is the timestamp counter value at the end of the previous basic block; This is the timestamp counter value at the beginning of the next basic block.

[0099] The minimum expected number of cycles for this code to execute correctly on a real processor. The number of cycles was determined to be 2000 through offline pre-calibration. When Less than 0.3 multiplied by That is, after 600 cycles, the current execution environment is determined to be a non-real processor. The simulation execution engine of static analysis tools does not simulate real processor cycles, and the execution time between basic blocks is extremely short or zero. For example, the simulation execution of IDA Pro consumes almost no cycles when jumping between basic blocks.

[0100] Environmental fingerprinting is performed by reading the debug register. During normal operation, the debug register value is zero; it is non-zero when the process is being debugged. In a Linux environment, the TracerPid field in the process status file is read; a non-zero value indicates that the process is being debugged by ptrace. Additionally, the presence of the PTRACE flag in the / proc / self / status file is checked as an auxiliary criterion.

[0101] The three detection results are summarized into an 8-bit perceptual flag vector. The 0th bit represents the symbolic execution detection result, the 1st bit represents the timestamp detection result, the 2nd bit represents the debugger detection result, and bits 3 through 7 are reserved. This flag bit is mapped by a small encoder network to a condition vector of the same dimension as the generative processing condition embedding. The condition vector is added to the embedding vector of the original business scenario semantic tag and then injected into the generation process. The flag directly triggers the mode switching logic of the obfuscation process.

[0102] When an attacker uses IDA Pro for additional debugging and in conjunction with angr for symbolic execution, bits 0 and 2 are both set. After triggering the decoy exposure mode, the generation process inserts a decoy weakness node into the perturbation behavior causality graph. This corresponds to port 8080 of the node pointing to the preset decoy address 192.168.100.50. This node is placed in the causal chain. and The intersection point is labeled with a causal strength of 0.95.

[0103] Obfuscation reduces the semantic folding strength of the basic blocks corresponding to decoy weakness nodes. The upper bound of the perplexity interval retrieval is adjusted from 0.70 to the adjacent threshold of 0.20. The cosine distance between the semantic vector of the retrieved candidate code fragment and the semantic vector of the original application programming interface is 0.15. The code logic is clear and readable, containing obvious socket connections and send calls. The number of opaque predicate insertions is reduced from three to five per basic block in normal mode to zero.

[0104] The attacker traced the network connection operation through static analysis, identifying it as the target system's command and control communication channel, and initiated a connection request accordingly. This connection triggered a pre-set highly interactive decoy environment, recording complete toolchain information such as the attacker's command and control framework type, encryption algorithm, and data theft format. Simultaneously, it triggered source tracing operations on the attacker's infrastructure, blocking the same attack vectors in a real production environment.

[0105] The generation process provides the perturbed behavioral causal graph as an output to the obfuscation process. The obfuscation process uses the nodes and edges of the perturbed behavioral causal graph as the basis for constructing the control flow graph. The behavioral causal structure output by the generation process and the execution path structure of the code generated by the obfuscation process are based on the same graph structure. In the process of outputting the discrimination score, the counterfactual causal consistency loss between the expected behavior trajectory and the actual behavior trajectory is calculated. The counterfactual causal consistency loss is then passed to the generation process through the shared embedding space of the semantic anchor vector set. This is used to adjust the optimal transmission distance between the application programming interface bound to the anchor association mask and the feature vectors of each block of the file. The loss is also passed to the obfuscation process to adjust the selection preference of the confusion interval retrieval.

[0106] Specifically, in this embodiment of the invention, the generation process provides the perturbed behavioral causal graph as an output to the obfuscation process. The obfuscation process uses the nodes and edges of the perturbed behavioral causal graph as the basis for constructing the control flow graph. The behavioral causal structure output by the generation process and the execution path structure of the code generated by the obfuscation process are based on the same graph structure. In the process of outputting the discrimination score, the counterfactual causal consistency loss between the expected behavioral trajectory and the actual behavioral trajectory is calculated. The counterfactual causal consistency loss is then passed to both the generation process and the obfuscation process through the shared embedding space of the semantic anchor vector set. When passed to the generation process, it is used to adjust the optimal transmission distance between the application programming interface bound to the anchor association mask and the feature vectors of each block of the file. When passed to the obfuscation process, it is used to adjust the selection preference for the confusion interval retrieval. The three processes achieve cross-modal transmission of gradient information through the shared embedding space of the semantic anchor vector set. The perturbation behavior causal graph serves as both the output constraint of the generation process and the driving seed of the obfuscation process, ensuring that the semantic assertions of the generation process on file behavior and the implementation of the obfuscation process on code behavior maintain structural correspondence. The discriminant process performs a deep causal structure consistency check on the expected behavior trajectory and the actual behavior trajectory. The check results are fed back to the generation and obfuscation processes to complete parameter adjustments.

[0107] The following example illustrates this: The perturbated behavioral cause-effect graph output by the generation process contains five nodes and corresponding directed edges. This perturbated behavioral cause-effect graph is passed to the obfuscation process in structured data form. The obfuscation process constructs basic blocks of the control flow graph based on the nodes of the graph, and constructs the jump relationships between the basic blocks based on the directed edges of the graph. In the behavioral cause-effect structure output by the generation process, the nodes... To the node The causal edges represent the preconditions for a file open operation to be a file read operation. Obfuscation is used to establish basic blocks in the control flow graph based on this. To basic blocks The unconditional jump ensures that the behavioral logic declared by the generation process and the execution logic implemented by the obfuscation process are consistent at the causal structure level.

[0108] The output discrimination score processing calculates the counterfactual causal consistency loss between the expected and actual behavioral trajectories. The counterfactual causal consistency loss is the complementary value obtained by weighting the cosine similarity and response amplitude ratio between the influence vectors of the expected and actual behavioral trajectories. This loss is passed to the generation and obfuscation processes respectively through the shared embedding space of the semantic anchor vector set.

[0109] When passed to the generation process, the counterfactual causal consistency loss affects the adjustment direction of the optimal transmission distance between the application programming interface (API) bound to the anchor association mask in the bulldozer distance loss and the feature vectors of each block of the file. When there is a directional deviation between the causal in-degree change of a certain API call type in the actual behavior trajectory and the causal in-degree change of the corresponding API call type in the expected behavior trajectory, the position of the semantic anchor vector corresponding to that API call type in the shared embedding space is finely adjusted in the direction of reducing the deviation, so that the generation process assigns an embedding vector binding relationship that is more consistent with the semantics of the file content to that API call type in subsequent iterations. For example, when When the deviation between the causal in-degree change direction in the actual behavior trajectory and the expected behavior trajectory exceeds the cosine similarity threshold, the semantic anchor vector set... The embedding vector is adjusted in the direction of reducing bias. In the subsequent generated files, the region containing the read operation is bound to the updated embedding vector, thereby reducing the semantic deviation between the file content and the runtime behavior.

[0110] When propagated to obfuscation processing, the counterfactual causal consistency loss affects the selection preference of the perplexity interval retrieval. When the causal in-degree change of the code segment corresponding to a basic block deviates significantly from the expected change during actual execution, the upper and lower bounds of the perplexity interval shrink towards a direction semantically closer to the original application programming interface (API) call type. This increases the semantic overlap between the retrieved candidate segments and the original API call type, reducing behavioral deviations caused by excessive semantic folding. For example, basic blocks... correspond If the average change in causal in-degree of the code snippet in multiple executions is 0.45, while the expected value is 0.68, the difference exceeds 0.2, and the confusion interval is from... Narrowed to The retrieved candidate fragment semantic vector has a smaller cosine distance from the original application programming interface call type semantic vector, and the runtime behavior of the code fragment is closer to the expected behavior trajectory.

[0111] The collaborative parameter updates among the three processes are all based on a shared embedding space of semantic anchor vector sets. The 128-dimensional embedding vectors of the semantic anchor vector set simultaneously carry three types of semantic information during training: the causal dependencies between application programming interface (API) call types are derived from the original dependency graph training; the semantic binding relationships between file content regions and API call types are derived from the optimization of bulldozer distance loss; and the semantic equivalence of code snippets is derived from the similarity measure of confusion interval retrieval. Counterfactual causal consistency loss adjusts the positions of the embedding vectors to make the three types of semantic information more self-consistent within the shared embedding space, achieving end-to-end collaborative optimization among generation, confusion, and discriminative scoring processes.

[0112] For the purpose of simplicity, the method steps disclosed in the above embodiments are described as a series of actions. However, those skilled in the art should understand that the embodiments of the present invention are not limited to the described order of actions, because according to the embodiments of the present invention, some steps can be performed in other orders or simultaneously. Furthermore, those skilled in the art should also understand that the embodiments described in the specification are all preferred embodiments, and the actions involved are not necessarily essential to the embodiments of the present invention.

[0113] like Figure 2 As shown, this invention also provides a deception-based honeypot defense system based on generative adversarial networks and code semantic obfuscation, comprising: The semantic and behavioral graph construction module 201 is configured to collect system call sequences from real business environments, extract causal dependencies between application programming interface calls, construct a semantic and behavioral dependency graph, and train a set of semantic anchor vectors for global sharing. The file and causal graph joint generation module 202 is configured to perform generation processing, receive random noise and business scenario semantic tags, and simultaneously generate decoy file content, anchor point association mask, and perturbed behavior causal graph obtained by applying topological perturbation to the basic causal graph. The semantic folding obfuscation compilation module 203 is configured to perform obfuscation processing. Driven by the perturbed behavior causal graph, it selects semantically related code fragments in the semantic space composed of the set of semantic anchor vectors by searching through the confusion interval, compiles them into the monitoring code control flow, and compiles them to generate obfuscated monitoring code. The counterfactual causal consistency discrimination module 204 is configured to extract the expected behavioral trajectory causal structure corresponding to the perturbed behavioral causal graph and the actual behavioral trajectory causal structure generated by the execution of the obfuscated monitoring code, apply the same deletion intervention to the expected behavioral trajectory causal structure and the actual behavioral trajectory causal structure, compare the consistency of the direction and magnitude of the causal in-degree change before and after the intervention, and output a discrimination score. The adversarial training and deployment control module 205 is configured to adjust the parameters involved in the generation process, the obfuscation process, and the output of the discrimination score according to the discrimination score until a Nash equilibrium is reached, and configure the honeypot environment to execute the generation process and the obfuscation process.

[0114] It is worth noting that although only some basic functional modules are disclosed in the embodiments of this invention, it does not mean that the composition of this system is limited to the above-mentioned basic functional modules. On the contrary, based on the above-mentioned basic functional modules, those skilled in the art can arbitrarily add one or more functional modules in combination with existing technology to form an infinite number of embodiments or technical solutions. That is to say, this system is open rather than closed. The fact that this embodiment only discloses a few basic functional modules should not be considered as the scope of protection of this invention being limited to the disclosed basic functional modules. At the same time, for the convenience of description, the above devices are described separately according to their functions as various units and modules. Of course, in implementing this invention, the functions of each unit and module can be implemented in one or more software and / or hardware.

[0115] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention.

Claims

1. A deceptive honeypot defense method based on generative adversarial networks and code semantic obfuscation, characterized in that, include: We collect system call sequences from real business environments, extract causal dependencies between application programming interface calls, construct semantic and behavioral dependency graphs, and train a set of semantic anchor vectors for global sharing. The generation process is performed, receiving random noise and semantic tags of business scenarios, and simultaneously generating decoy file content, anchor point association mask, and perturbed behavior causal graph obtained by applying topological perturbation to the basic causal graph. Obfuscation processing is performed, driven by the perturbed behavior causal graph. Semantically related code fragments are selected in the semantic space composed of the set of semantic anchor vectors by searching through the confusion interval, and then incorporated into the monitoring code control flow to generate obfuscated monitoring code. Extract the causal structure of the expected behavior trajectory corresponding to the perturbed behavior causal graph and the causal structure of the actual behavior trajectory generated by the execution of the obfuscated monitoring code. Apply the same deletion intervention to the expected behavior trajectory causal structure and the actual behavior trajectory causal structure. Compare the consistency of the direction and magnitude of the change in causal in-degree before and after the intervention and output a discrimination score. Based on the discrimination score, adjust the parameters involved in the generation process, the obfuscation process, and the output of the discrimination score until Nash equilibrium is reached, and configure the honeypot environment to perform the generation process and the obfuscation process.

2. The deceptive honeypot defense method based on generative adversarial networks and code semantic obfuscation as described in claim 1, characterized in that, Construct a semantic and behavioral dependency graph and train a set of semantic anchor vectors for global sharing, further including: The collected system call sequences are segmented into sessions according to process lifecycle and the application programming interface names are standardized. Fixed-length call fragments are extracted using a sliding window. Based on the convergent cross-mapping method, for each pair of co-occurring application programming interfaces, the state space is reconstructed with the lag coordinates of one side and the value of the other side is predicted. By comparing the correlation coefficient between the predicted value and the actual value with the degree of difference in the reverse causal strength, the existence of the directed causal edge and the causal strength of the directed causal edge are determined. Nodes in the semantic and behavioral dependency graph that are connected by directed edges and whose causal strength meets a preset condition are taken as neighbors. The embedding vectors of each application programming interface node are trained by aggregating multi-hop neighbor information through a graph neural network to obtain the semantic anchor vector set.

3. The deceptive honeypot defense method based on generative adversarial networks and code semantic obfuscation as described in claim 1, characterized in that, Performing the generation process further includes: Based on the semantic tags of the business scenarios, a matching basic causal graph is retrieved from the semantic and behavioral dependency graph. The semantic tags of the business scenarios are represented by file type and business scenario encoding. The basic causal graph is a subgraph composed of nodes and edges in the semantic and behavioral dependency graph that correspond to the semantic tags of the business scenarios. Perform topological perturbation on the basic causal graph, including reversing the direction of non-necessary causal edges with causal strength below the median in the basic causal graph, selecting application programming interfaces from the set of semantic anchor vectors whose distance from the semantic vectors of nodes in the basic causal graph is within a preset confusion interval as ghost nodes to insert into the causal chain, and splitting causal chains in the basic causal graph whose length exceeds a threshold from the midpoint into parallel segments and inserting synchronization barrier nodes. The total loss of the generation process is composed of a weighted sum of adversarial loss, bulldozer distance loss, and causal graph rationality constraint loss. The bulldozer distance loss is the optimal transmission distance that measures the distribution difference between the feature vectors of each block of the generated file and the semantic anchor vectors of the application programming interface bound to the anchor point association mask. The causal graph rationality constraint loss is a penalty term applied to edges in the causal graph of the perturbed behavior where the causal strength is lower than a preset minimum threshold.

4. The deceptive honeypot defense method based on generative adversarial networks and code semantic obfuscation as described in claim 3, characterized in that, Performing obfuscation further includes: A set of semantically related code snippets is pre-constructed. Each code snippet is labeled with a list of application programming interfaces (APIs) it contains and a semantic vector is calculated. The semantically related code snippet is a code snippet whose list of APIs it contains has an inclusion relationship or functional overlap with the corresponding node's API. The semantic vector is the result of averaging the semantic anchor vectors of each API contained in the code snippet. The nodes of the perturbed behavior causal graph are mapped to basic blocks of the control flow graph, and the directed edges of the perturbed behavior causal graph are mapped to jumps between basic blocks. The structural correspondence is verified by graph isomorphism. For each basic block, using the semantic anchor vector of the node corresponding to the basic block as the query anchor, candidate segments whose semantic vector cosine distance falls into the confusion interval are retrieved from the set of semantically associated code segments and incorporated into the basic block; An opaque predicate is set for the basic block corresponding to the ghost node. The opaque predicate is executed along a preset path during normal execution and is presented as a branch structure with two reachable paths during static analysis.

5. The deceptive honeypot defense method based on generative adversarial networks and code semantic obfuscation according to claim 3, characterized in that, The output discrimination score further includes: The byte entropy distribution and structural features of the decoy file are extracted by convolution operation and compared with the corresponding features of the real file sample to obtain a static byte-level fidelity score. Causal adjacency matrices are extracted from the expected behavior trajectory and the actual behavior trajectory using temporal causal convolutional coding, respectively. The causal in-degree refers to the overall metric obtained by aggregating the causal dependency strength of each node in the causal adjacency matrix other than the target node to the target node. After excluding the ghost nodes from the node set of the expected behavioral trajectory, the intervention target is selected. The deletion intervention of setting the corresponding row and column of the intervention target node to zero is applied to the expected causal adjacency matrix and the actual causal adjacency matrix respectively. The change in causal in-degree of each node before and after the intervention is calculated to form the influence vector. The weighted average of the cosine similarity and response amplitude ratio of the influence vector pairs obtained under multiple different intervention objectives is taken as the causal consistency score; The content realism score and causal consistency score are fused together using learnable weights and then subjected to nonlinear mapping to obtain the final discriminant score.

6. The deceptive honeypot defense method based on generative adversarial networks and code semantic obfuscation according to claim 3, characterized in that, The Nash equilibrium condition is that the output of the discrimination score for both positive and negative samples is stable at the level of random guessing and the fluctuation of the total loss is lower than a preset range. When adjusting parameters, the file content, system call trajectory, and cause-effect graph of the system call trajectory collected in the real environment are used as positive samples, and the decoy file, expected behavior trajectory, and actual execution trajectory of the obfuscated monitoring code generated by the generation process and the obfuscation process are used as negative samples. In each iteration, the parameters of the generation process and the confusion process are fixed, and the parameters of the output discrimination score are updated with an adversarial loss including gradient penalty. The parameters of the output discrimination score are fixed, and the parameters of the generation process and the confusion process are updated with the bulldozer distance loss and the causal graph rationality constraint loss as the objective of maximizing the discrimination score.

7. The deceptive honeypot defense method based on generative adversarial networks and code semantic obfuscation as described in claim 1, characterized in that, Also includes: The anti-reverse perception logic is embedded in the obfuscated monitoring code. The anti-reverse perception logic detects the symbol execution environment by using opaque predicates based on cryptographic hashes, detects non-real processor execution environments by using timestamp counter differential detection, and detects whether it is in a debugged state by using environment fingerprint. The detection result is encoded into a perceptual flag bit vector, which is then mapped and injected as an extension condition into both the generation process and the obfuscation process. When the perception flag indicates the presence of reverse analysis behavior, the decoy exposure mode is triggered.

8. The deceptive honeypot defense method based on generative adversarial networks and code semantic obfuscation according to claim 7, characterized in that, Triggering the decoy exposure mode further includes: The generation process switches the causal graph generation strategy, inserts decoy weakness nodes corresponding to network behaviors into the perturbation behavior causal graph, and places the decoy weakness nodes at the convergence position of multiple causal chains and marks them with high causal strength. The obfuscation process reduces the semantic folding strength of the basic block corresponding to the decoy weakness node, replaces it with a code segment whose cosine distance to the semantic vector of the original application programming interface is less than a preset adjacent threshold, and reduces the insertion of opaque predicates. The decoy's weakness node points to a preset highly interactive decoy environment. When an attacker performs an operation based on the decoy's weakness node, it triggers deep monitoring and tracing.

9. The deceptive honeypot defense method based on generative adversarial networks and code semantic obfuscation according to claim 1, characterized in that, The generation process provides the perturbed behavioral causal graph as an output to the obfuscation process. The obfuscation process uses the nodes and edges of the perturbed behavioral causal graph as the basis for constructing the control flow graph. The behavioral causal structure output by the generation process and the execution path structure of the code generated by the obfuscation process are based on the same graph structure. In the process of outputting the discrimination score, the counterfactual causal consistency loss between the expected behavior trajectory and the actual behavior trajectory is calculated. The counterfactual causal consistency loss is then passed to the generation process through the shared embedding space of the semantic anchor vector set. This is used to adjust the optimal transmission distance between the application programming interface bound to the anchor association mask and the feature vectors of each block of the file. The loss is also passed to the obfuscation process to adjust the selection preference of the confusion interval retrieval.

10. A deception-based honeypot defense system based on generative adversarial networks and code semantic obfuscation, characterized in that, include: The semantic and behavioral graph construction module is configured to collect system call sequences from real business environments, extract causal dependencies between application programming interface calls, construct semantic and behavioral dependency graphs, and train a set of semantic anchor vectors for global sharing. The file and cause-effect graph joint generation module is configured to perform generation processing, receive random noise and business scenario semantic tags, and simultaneously generate decoy file content, anchor point association mask, and perturbed behavior cause-effect graph obtained by applying topological perturbation to the basic cause-effect graph. The semantic folding obfuscation compilation module is configured to perform obfuscation processing. Driven by the perturbed behavior causal graph, it selects semantically related code fragments in the semantic space composed of the set of semantic anchor vectors by searching through the perplexity interval, compiles them into the monitoring code control flow, and compiles them to generate obfuscated monitoring code. The counterfactual causal consistency discrimination module is configured to extract the expected behavioral trajectory causal structure corresponding to the perturbed behavioral causal graph and the actual behavioral trajectory causal structure generated by the execution of the obfuscated monitoring code, apply the same deletion intervention to the expected behavioral trajectory causal structure and the actual behavioral trajectory causal structure, compare the consistency of the direction and magnitude of the causal in-degree change before and after the intervention, and output a discrimination score. The adversarial training and deployment control module is configured to adjust the parameters involved in the generation process, the obfuscation process, and the output of the discrimination score according to the discrimination score until a Nash equilibrium is reached, and configure the honeypot environment to execute the generation process and the obfuscation process.

Images