Network defense system and method based on search enhancement generated multi-protocol spoofing

Abstract

The application discloses a network defense system and method for multi-protocol deception based on search enhancement generation, and belongs to the technical field of communication network security. The application extracts the structured semantic description of the interactive data under different protocols, and performs vectorization coding and cross-protocol search based on the semantic description, so that the interactive data between different protocols can be associated under unified representation, thereby realizing state sharing and consistency utilization between multiple protocols. In the candidate historical record screening process, the application comprehensively considers factors such as semantic similarity, protocol association, time sequence relationship and operation importance, and comprehensively scores and sorts the historical records. After each round of interaction is completed, the application writes the attack request, attack request response and related information of the current interaction into a cross-protocol semantic knowledge base in real time, so that different protocols can directly search and utilize the current interaction information in the subsequent interaction process, thereby realizing state sharing between multiple protocols.

Description

Technical Field

[0001] This invention belongs to the field of communication network security technology, specifically relating to a network defense system and method for multi-protocol deception based on retrieval enhancement generation. Background Technology

[0002] A deception system is a cybersecurity tool designed to attract attackers and detect their activities. It simulates a real system or service to lure hackers into attacks or malicious activities, thereby exposing their techniques, motives, and tools. Deception systems can proactively monitor attacker behavior, providing valuable intelligence to security experts and helping to improve defenses. In the field of cybersecurity, deception technology has evolved from low-interaction to high-interaction. Low-interaction deception systems, due to their fixed response content and simple interaction logic, are easily detected by attackers through fingerprinting or behavioral analysis, limiting their deceptive effectiveness and defensive value. High-interaction deception systems, while providing an interactive experience close to that of a real system, typically rely on a complete real-world service environment, resulting in high resource consumption and maintenance costs, making large-scale deployment in real-world network environments difficult. In existing network environments, attackers typically analyze system response characteristics to identify whether a target system is a deception system, and then terminate further attacks upon identification, thereby reducing the risk of being identified and tracked.

[0003] In recent years, large language models have made significant progress in natural language processing, code generation, and intelligent dialogue, and are gradually being applied to cybersecurity scenarios. In deception systems, as attackers continuously improve their ability to identify traditional honeypots, they often judge the authenticity of the target system by analyzing the logic and consistency of the response content. Large language models possess powerful natural language processing and contextual understanding capabilities, which theoretically can effectively improve the interactivity and intelligence of deception systems, thereby enhancing their ability to resist attacker evasion. However, existing multi-protocol large language model deception systems typically respond independently to a single protocol, lacking information sharing between different protocol modules, and thus failing to simulate continuous and consistent system behavior when facing multi-protocol attacks.

[0004] Existing technologies lack unified processing capabilities for multi-protocol attack scenarios and struggle to support the correlation of cross-protocol interaction behaviors. Current multi-protocol spoofing systems are typically designed to handle a single protocol, with each protocol module operating independently. Their interaction processes primarily revolve around requests within the current protocol, lacking a correlation mechanism. In this situation, the interaction information between different protocols is fragmented, and the system cannot establish cross-protocol behavioral correlations. For example, when an attacker first obtains system information via HTTP and then verifies it via SSH, existing systems cannot correlate these two interactions, potentially leading to inconsistent system states returned by different protocols, thus reducing the spoofing effectiveness.

[0005] To achieve information sharing and state continuity between different protocols, a retrieval-enhanced generation technique based on historical interaction data is needed. Before response generation, relevant interaction records are retrieved from historical data based on the current attack request and incorporated into the generation process, enabling the system to construct responses using cross-protocol historical information. Compared to directly concatenating the entire interaction history, this approach prioritizes key information relevant to the current request, even with limited input length for large language models, thus supporting continuous information utilization in multi-turn, multi-protocol interactions. However, traditional retrieval-enhanced generation systems are primarily designed for single-text scenarios, and their application in multi-protocol spoofing systems still has the following shortcomings: First, existing retrieval enhancement generation systems struggle to adapt to multi-protocol interaction scenarios and cannot effectively establish connections between different protocols. Existing retrieval methods typically perform vectorization processing directly on raw interaction data. However, in multi-protocol scenarios, data from different protocols differ significantly in expression and structure. For example, the SSH protocol primarily manifests as command-line text, the HTTP protocol includes message structure and parameter information, and the MySQL protocol contains structured query statements and result sets. In this situation, semantically identical or functionally consistent operations are difficult to effectively associate in the vector space due to their different expression forms, making it difficult to correctly recall relevant historical records. Simultaneously, some data that is similar in text form but functionally unrelated may be introduced through erroneous retrieval, affecting the accuracy of search results. In this case, the system may be unable to utilize historical information related to the current operation when generating responses, or may introduce irrelevant information, leading to inconsistencies between the generated results and previous interactions, thus reducing the effectiveness of deceiving the system.

[0006] Second, existing sorting mechanisms are difficult to apply to multi-protocol interaction scenarios and lack targeted enhancement capabilities. Current technologies typically use the similarity of retrieved vectors as the primary sorting criterion. While some methods introduce other features for re-sorting, they lack optimization for the characteristics of multi-protocol interactions. During multi-protocol attacks, data from different protocols differ significantly in expression, interaction context, and function. Simply relying on similarity cannot reflect the actual reference value of historical records for the current interaction. For example, the impact of system state modification operations and information query operations on subsequent interactions differs significantly, but existing methods struggle to effectively distinguish between them, easily leading to mismatches between the returned response data and the current state, thus affecting the overall response quality and deception effectiveness.

[0007] Third, existing technologies lack effective management and dynamic updating mechanisms for historical interaction data, leading to redundancy or loss of historical information and making it difficult to guarantee the deception effect during multi-round, multi-protocol interactions. Existing retrieval-enhanced generation systems typically rely on pre-built static knowledge bases for queries, lacking the ability to update newly generated interaction data in real time. They also lack a unified data management mechanism, making it difficult to effectively organize and utilize historical data. In actual interactions, on the one hand, the lack of deduplication mechanisms easily leads to duplicate information being introduced; on the other hand, when the input length of a large model is limited, historical information is truncated and discarded. If this historical information is not written to the knowledge base in a timely manner, the discarded data cannot be retrieved in subsequent interactions, making it difficult for the system to continuously utilize historical interaction information. In multi-protocol, multi-round attacks, inconsistencies in responses are likely to occur. Summary of the Invention

[0008] To address the aforementioned problems in the existing technology, this invention provides a network defense system and method for multi-protocol spoofing based on retrieval enhancement generation. The technical problem to be solved by this invention is achieved through the following technical solution: In a first aspect, the present invention provides a network defense system for multi-protocol spoofing based on retrieval enhancement generation, comprising: The cross-protocol semantic retrieval module is used to parse the current attack request, extract the protocol type, request content and time information, and convert the attack request into a unified semantic description; based on the semantic description, a query vector is generated, and similarity retrieval is performed in the cross-protocol semantic knowledge base to obtain candidate historical records related to the current interaction; The multidimensional scoring and ranking module is used to filter and deduplicate candidate historical records, calculate the multidimensional scores of the filtered candidate historical records, calculate a comprehensive score based on the multidimensional scores, sort the candidate historical records according to the comprehensive scores, and select the top-scoring candidate historical records as the final query results. The result feedback enhancement module is used to construct prompt words required to call the large language model using the final query results, determine the length of the prompt words, call the large language model to generate attack request response and importance score, generate record identifier for this interaction, and write the protocol type, time information, attack request, attack request response, importance score and record identifier of this interaction into the cross-protocol semantic knowledge base to realize the dynamic updating and continuous accumulation of historical data. The cross-protocol semantic retrieval module is also used to return attack request responses to attackers.

[0009] Secondly, the present invention provides a network defense method for multi-protocol spoofing based on retrieval enhancement generation, comprising: Receive attack requests sent by attackers through different protocols, parse the current attack request, extract the protocol type, request content and time information, and convert the attack request into a unified semantic description; Query vectors are generated based on semantic descriptions, and similarity retrieval is performed in a cross-protocol semantic knowledge base to obtain candidate historical records related to the current interaction. The candidate historical records are filtered and deduplicated, and the multidimensional scores of the filtered candidate historical records are calculated respectively. A comprehensive score is calculated based on multidimensional scoring. Candidate historical records are sorted according to the comprehensive score, and the top-scoring candidate historical records are selected as the final query results. The final query results are used to construct prompt words required to call the large language model. The length of the prompt words is judged, and the large language model is called to generate an attack request response and importance score. A record identifier is generated for this interaction, and the protocol type, time information, attack request, attack request response, importance score and record identifier of this interaction are written into the cross-protocol semantic knowledge base to realize the dynamic updating and continuous accumulation of historical data. The attack request response is returned to the attacker.

[0010] The beneficial effects of this invention are: The solution provided by this invention extracts structured semantic descriptions from interaction data under different protocols, and performs vectorized encoding and cross-protocol retrieval based on these semantic descriptions. This enables interaction data between different protocols to establish relationships under a unified representation, thereby achieving state sharing and consistent utilization across multiple protocols. Compared to existing single-protocol response mechanisms based on rule matching and template libraries, and methods that construct prompts solely based on the current interaction history, this invention enables cross-protocol information linkage, effectively improving the system's continuous modeling capability for complex attack behaviors. This invention utilizes a multi-dimensional scoring and ranking module to comprehensively consider factors such as semantic similarity, protocol relevance, temporal sequence, and operational importance during the candidate historical record screening process, comprehensively scoring and ranking historical records. Compared to existing methods that rely solely on rule matching or single importance assessment for screening, this invention effectively reduces the introduction of irrelevant or low-value information, making the screening results more consistent with the current interaction state, thereby improving the rationality and consistency of generated responses. This invention utilizes a result feedback enhancement module to write the attack request, attack request response, and related information of the current interaction into a cross-protocol semantic knowledge base in real time after each round of interaction. This allows different protocols to directly retrieve and utilize the current interaction information in subsequent interactions, thereby achieving state sharing among multiple protocols. Simultaneously, given the limited input length of the large language model, this invention employs a priority truncation mechanism based on time and importance scoring to filter the interaction history, prioritizing the retention of key records and truncating low-priority records. This ensures that the interaction data can be shared across protocols and reused after truncation, significantly improving the system's ability to continuously model attack behaviors. Attached Figure Description

[0011] Figure 1 This is a schematic diagram of the system architecture of a network defense system based on retrieval enhancement generation for multi-protocol deception, provided in an embodiment of the present invention. Figure 2 This is a flowchart illustrating a network defense system for multi-protocol deception based on retrieval enhancement generation, provided in an embodiment of the present invention. Figure 3 This is a schematic diagram illustrating the principle of a cross-protocol semantic retrieval module in a network defense system based on retrieval enhancement generation for multi-protocol deception, as provided in an embodiment of the present invention. Figure 4 A schematic diagram illustrating the principle of a multi-dimensional scoring re-ranking module in a network defense system based on retrieval enhancement generation for multi-protocol deception, provided in an embodiment of the present invention; Figure 5 This is a schematic diagram illustrating the principle of a result feedback enhancement module in a network defense system based on retrieval enhancement generation for multi-protocol deception, as provided in an embodiment of the present invention. Figure 6This is a schematic diagram illustrating the steps of a network defense method for multi-protocol deception based on retrieval enhancement generation provided in an embodiment of the present invention. Detailed Implementation

[0012] The present invention will be further described in detail below with reference to specific embodiments, but the implementation of the present invention is not limited thereto.

[0013] Existing multi-protocol large language model deception system protocols operate in isolation during interaction, with no information sharing between different protocols. Current solutions typically employ independent deception responses for a single protocol, lacking information sharing between different protocol modules and failing to simulate continuous and consistent system behavior in the face of multi-protocol attacks.

[0014] To address the issue of isolated protocols during interaction, a mechanism for information sharing based on historical interaction data needs to be established between different protocols. This would allow the system to utilize cross-protocol historical information when generating responses, thereby maintaining consistency in system behavior. While directly concatenating all historical interaction information into the prompt words can achieve information sharing, as the number of interaction rounds increases, historical records accumulate rapidly during multi-protocol interactions, exceeding the input limits of the large language model. This results in the large language model being unable to generate effective responses, reducing its deception capability.

[0015] Therefore, a mechanism is needed to sift through a large amount of historical data for key information. Retrieval-Augmented Generation (RAG) is a technique that introduces external data into the generation process. Its core function is to retrieve information related to the current request from external data before model generation and incorporate it as part of the input, thus solving the problem that large language models cannot directly utilize a large amount of external information due to length limitations. Based on this, this paper applies RAG to multi-protocol interaction scenarios: by structuring and indexing multi-protocol interaction data, relevant information is retrieved from the historical records based on the current request and introduced into the model when generating the response, instead of directly concatenating the entire interaction history into the input. Compared to directly concatenating history, the RAG system can prioritize the use of key interaction records related to the current request under limited input conditions, achieving effective utilization of historical information between different protocols. However, existing RAG systems are mainly geared towards single-text scenarios, and still have the following shortcomings in multi-protocol deception systems: Inconsistent data formats across multiple protocols can lead to inaccurate search results. In multi-protocol interaction scenarios, the data formats and expression methods of different protocols differ significantly. Directly vectorizing the raw data can lead to large differences in vector distribution between different protocols, thereby affecting the accuracy of search results and causing irrelevant information to be retrieved.

[0016] Specifically, the SSH protocol primarily manifests as command-line text, the MySQL protocol includes structured query statements and result sets, and the HTTP protocol may contain HTML tags and message structures. If the raw data is directly vectorized, the data from different protocols will be mapped to inconsistent vector spaces, affecting the accuracy of the search results. In this situation, the system may fail to retrieve historical records related to the current operation when generating a response, or may introduce irrelevant historical information, leading to inconsistencies between the generated results and previous interactions, thus being identified as abnormal by attackers. Therefore, existing search methods struggle to obtain accurate search results in multi-protocol environments, preventing the system from utilizing historical information related to the current operation or introducing irrelevant information when generating responses, thereby reducing the effectiveness of deceiving the system.

[0017] The sorting mechanism's lack of multi-dimensional correlation capabilities resulted in key information not being selected. Existing retrieval enhancement generation systems typically use the similarity of retrieved vectors as the primary ranking criterion, which is suitable for single-text scenarios. However, in multi-protocol interaction environments, relying solely on text similarity makes it difficult to reflect the actual impact of historical records on the current interaction, resulting in key information not being selected during ranking.

[0018] Specifically, in actual attacks, the importance of historical records depends not only on semantic similarity but also on protocol type, temporal sequence, and the impact of the operation on the system state. Different protocols are correlated; for example, TELNET and SSH protocols are functionally similar, and their corresponding interaction records should have higher correlation weight during retrieval. Historical records closer to the current interaction usually have higher reference value. Different types of operations have significantly different impacts on subsequent interactions. For example, operations such as file writing and downloading change the system state and have a strong impact on subsequent attacks, while system information query operations have a smaller impact on the overall state. Therefore, relying solely on semantic similarity is insufficient to accurately filter out key historical information, leading to key information being unselected or irrelevant information being selected. This affects the rationality of the response generated by the large language model, ultimately allowing attackers to identify the current system as a deceptive system.

[0019] The lack of a data management mechanism for dynamic multi-protocol interactions leads to redundancy or loss of historical information: Existing retrieval-enhanced generation systems typically rely on pre-built knowledge bases for queries. The data in these knowledge bases is determined before the system runs. While these methods perform well in scenarios with single text or static data, they struggle to handle continuously generated dynamic data during multi-protocol interactions. In this model, the system cannot promptly reflect new information generated during the current interaction, thus limiting its deception capabilities in multi-round, multi-protocol attack scenarios.

[0020] Specifically, during multi-round interactions, the system continuously generates new request and response data. However, existing technologies often lack a unified data management mechanism to continuously organize and effectively utilize this data. On the one hand, during continuous writing and retrieval, the lack of deduplication and filtering mechanisms can easily lead to information in the current interaction history being retrieved and repeatedly introduced, resulting in information redundancy and affecting the large language model's judgment of key information. On the other hand, given the limited input length of the large language model, existing deception systems typically discard some historical interaction information directly through truncation. If this historical record is not written to the knowledge base in a timely manner, the discarded data cannot be retrieved and utilized again in subsequent interactions, resulting in the permanent loss of key historical information once it is removed, reducing the system's deception capability in multi-round, multi-protocol attack scenarios.

[0021] Based on the above findings, embodiments of the present invention provide a network defense system and method for multi-protocol spoofing based on retrieval enhancement generation.

[0022] Below, we will first introduce a network defense system for multi-protocol deception based on retrieval enhancement generation provided by an embodiment of the present invention.

[0023] like Figure 1 and Figure 2 As shown in the figure, a network defense system for multi-protocol spoofing based on retrieval enhancement generation provided by an embodiment of the present invention may include: The cross-protocol semantic retrieval module is used to parse the current attack request, extract the protocol type, request content and time information, and convert the attack request into a unified semantic description; based on the semantic description, a query vector is generated, and similarity retrieval is performed in the cross-protocol semantic knowledge base to obtain candidate historical records related to the current interaction; The multidimensional scoring and ranking module is used to filter and deduplicate candidate historical records, calculate the multidimensional scores of the filtered candidate historical records, calculate a comprehensive score based on the multidimensional scores, sort the candidate historical records according to the comprehensive scores, and select the top-scoring candidate historical records as the final query results. The result feedback enhancement module is used to construct prompt words required to call the large language model using the final query results, determine the length of the prompt words, call the large language model to generate attack request response and importance score, generate record identifier for this interaction, and write the protocol type, time information, attack request, attack request response, importance score and record identifier of this interaction into the cross-protocol semantic knowledge base to realize the dynamic updating and continuous accumulation of historical data. The cross-protocol semantic retrieval module is also used to return attack request responses to attackers.

[0024] To address the shortcomings of existing technologies, the present invention aims to provide a network defense system based on retrieval enhancement generation for multi-protocol deception, thereby solving the problems of data interaction between different protocols being unable to be correlated, low efficiency in utilizing historical data, and insufficient consistency in response results, thus improving the deception network defense system's ability to deceive complex attack behaviors.

[0025] Cross-protocol semantic retrieval modules, such as Figure 3 As shown, it may include: The protocol front-end submodule is used to implement network access and basic service support for different protocols, send attack requests under different protocols to the input processing submodule, and return the attack request response to the attacker. The input processing submodule is used to perform structured parsing on the received attack requests and extract the protocol type, request content, and time information. The semantic extraction submodule is used to convert attack requests under different protocols into a unified semantic description based on protocol type, request content, and time information. The vectorization submodule is used to encode semantic descriptions and generate corresponding query vectors; A cross-protocol semantic knowledge base is used to uniformly manage interaction records from different protocols. It associates and stores protocol type, request content, time information, response result, importance score, record identifier and corresponding query vector. An index structure is built based on the query vector. After receiving the query vector, similarity retrieval is performed to obtain candidate historical records related to the current interaction.

[0026] Specifically, the protocol front-end submodule is used to implement network access and basic service support for different protocols. The protocol front-end submodule provides functions including protocol monitoring, connection establishment, authentication, request reception, and response sending, sending attack requests under different protocols to the input processing submodule. After receiving the attack request response generated by the system, the attack request response is returned to the attacker according to the corresponding protocol specification.

[0027] The input processing submodule is used to parse and preprocess the received attack requests. This module performs structured parsing on attack request data from different protocols, extracting key fields such as protocol type, request content, and time information, thereby generating structured data in a unified format for use by subsequent modules.

[0028] The semantic extraction submodule converts attack request data from different protocols into a unified semantic description. This module abstracts and processes attack requests from different forms such as SSH commands, HTTP requests, and database queries, transforming the attack request information into a semantic description, thereby achieving a consistent representation of cross-protocol data.

[0029] The semantic description is a structured semantic representation, including fields such as operation type, operation object, and behavioral characteristics. Operation type describes the category of the current interaction behavior, such as information probing, resource access, file reading, file writing, or trace cleanup. Operation object describes the target entity affected by the interaction behavior, such as an operating system, database service, web resource, or file system. Behavioral characteristics describe the specific operation performed, such as obtaining system version information, accessing a management page, or querying database environment information. Attack phase reflects the stage of the interaction during the attack process, such as information gathering, external penetration, and command control.

[0030] The vectorization submodule converts semantic descriptions into vectors. This module encodes the semantic descriptions based on a preset embedding model to generate corresponding query vectors.

[0031] The cross-protocol semantic knowledge base stores historical interaction data and its corresponding vectors, and provides cross-protocol data retrieval services. This module manages interaction records from different protocols in a unified manner, associating and storing request content, response results, protocol type, time information, importance score, record identifier, and corresponding semantic vector. It also builds an index structure based on query vectors, performs similarity calculations upon receiving query vectors, and returns candidate historical records most relevant to the current interaction.

[0032] Semantic descriptions are generated by extracting semantics from attack request data from different protocols using a large language model. The large language model, based on preset prompt word templates, transforms the original attack requests into structured semantic descriptions. Lightweight models can be selected, such as instruction fine-tuning models with parameter sizes between 7B and 14B, to reduce inference latency while maintaining semantic understanding capabilities, thereby meeting the real-time requirements of multi-protocol interaction scenarios.

[0033] Understandably, in terms of semantic extraction methods, in this embodiment of the invention, a large language model is preferably used to perform structured semantic extraction on interactive data under different protocols. However, in other possible implementations, rule-based matching or classification models can also be used to perform structured processing on the original input. For example, common commands can be parsed and mapped to corresponding structured fields through a preset rule base, or operation types and behavioral features can be predicted through a lightweight classification model, thereby achieving a unified representation of data from different protocols.

[0034] After obtaining the semantic description of the structured semantic representation, it is converted into a serializable text form and input into the embedding model, through an encoding function. Generate the corresponding query vector. The expression for the query vector is as follows: ; in, This represents the semantic description text corresponding to the current interaction. This represents the corresponding query vector. The embedding model can be a multilingual vectorization-supporting model, such as the multilingual-e5-large-instruct model.

[0035] Optionally, in terms of the embedding model, the embodiments of the present invention preferably adopt a text embedding model that supports multilingual semantic alignment. However, in other embodiments, other types of vectorization methods may also be selected, such as BGE series models, Sentence-Transformers models, or a combination of word vectors and statistical features, to achieve semantic information vectorization encoding and similarity retrieval.

[0036] In this embodiment of the invention, cosine similarity is used to measure the semantic similarity between the query vector and the historical record vector when performing similarity retrieval. The calculation method is as follows: ; in, Indicates the current query vector. This represents a candidate vector in the candidate history. Representing vectors The i One element, Representing vectors The i One element, This indicates the modulo operation. Representing vectors The total number of elements in the vector, which is related to the total number of elements in the vector. The total number of elements in each record is the same. By calculating similarity scores, several historical records with the highest scores are selected as a candidate set, thus completing the cross-protocol semantic retrieval process.

[0037] Regarding the retrieval and similarity calculation methods, this embodiment of the invention selects cosine similarity for vector similarity calculation. However, in other embodiments, Euclidean distance, inner product similarity, or similarity calculation methods based on learning ranking can also be used to achieve preliminary screening of candidate records.

[0038] Multidimensional scoring reordering module, such as Figure 4 As shown, it may include: The candidate filtering submodule is used to compare the retrieved candidate historical records with the record identifier set of the current interaction history, remove duplicate records that already exist in the current interaction history, and obtain the filtered candidate historical records. The reordering submodule is used to calculate the multidimensional scores of the filtered candidate historical records; it performs weighted calculations on the multidimensional scores based on preset weights to obtain the comprehensive score of the filtered candidate historical records; it sorts the filtered candidate historical records according to the comprehensive score and selects the top-scoring candidate historical records as the final query results.

[0039] The candidate filtering submodule filters candidate historical records. Based on the record identifier set of the current interaction history, this module compares the retrieved candidate historical records and removes duplicate records that already exist in the current interaction history, thereby avoiding the repeated introduction of the same information and improving the effectiveness of subsequent processing.

[0040] Before calculating the score, this embodiment of the invention performs deduplication on the candidate historical records. Specifically, it obtains the set of record identifiers in the current interaction history, determines the records that exist in the current interaction history, compares the candidate historical records, and removes the records that already exist in the current interaction history, thereby avoiding the influence of duplicate data on the scoring results.

[0041] The reordering submodule scores and sorts the candidate historical records. This module calculates multi-dimensional scores for each of the filtered candidate records, including the degree of correlation between protocol types, interaction time interval, vector similarity, and the degree of impact of operation behavior on system state. It also calculates a comprehensive score based on a weighted method, sorts the candidate records according to the score results, and selects the historical records with higher scores for subsequent processing.

[0042] Multidimensional scoring can include: Agreement score, similarity score, time score, and importance score.

[0043] In this embodiment of the invention, for each filtered candidate historical record, semantic similarity, protocol relevance, time decay factor, and operational importance are calculated, and a comprehensive score is obtained based on preset weights. The expression for the comprehensive score is as follows: ; in, This represents the overall score. Represents the current query vector Candidate vectors in candidate history Cosine similarity between them Represents the current query vector Corresponding interaction protocol With candidate vectors Corresponding candidate record protocol The protocol association weight between them Represents the current query vector The timestamp corresponding to the attack request Represents candidate vectors The timestamp of the corresponding candidate record Let be the time decay function. Indicates the time decay coefficient. Represents candidate vectors The operational importance score corresponding to the candidate record 、 、 、 The preset weights for each scoring item in the overall score, .

[0044] By calculating multidimensional scores, the comprehensive value of candidate historical records in terms of semantic relevance, protocol relevance, temporal proximity, and operational impact can be reflected. This allows for the ranking of candidate historical records and the selection of the top-scoring records as the final query results.

[0045] Optionally, in terms of multidimensional score re-ranking, this embodiment of the invention selects to use factors such as semantic similarity, protocol relevance, time decay and operational importance for weighted scoring. However, in other embodiments, other evaluation dimensions can be introduced according to specific application scenarios, or machine learning methods can be used to adaptively adjust the weights of each dimension, thereby achieving optimization of the ranking of candidate records.

[0046] Result feedback enhancement module, such as Figure 5 As shown, it may include: The large model calls a submodule to construct prompt words using the final query results, detect and control the length of the prompt words, and generate attack request responses and importance scores. The output processing submodule is used to parse and process the model response results to obtain the attack request response and importance score, send the attack request response to the cross-protocol semantic retrieval module, and send the attack request response and importance score to the feedback submodule. The feedback submodule is used to generate a record identifier for this interaction. It stores the protocol type, time information, attack request, attack request response, importance score, and record identifier of this interaction into the cross-protocol semantic knowledge base using the query vector as an index.

[0047] The large model invocation submodule invokes the large language model to obtain the model response results. This module constructs the prompt words required for invoking the large language model. These prompt words can include: system prompt words, historical records after reordering selections, interaction history, and the current attack request. The length of the prompt words is detected and controlled to ensure it meets the input limit. Then, the large language model is invoked to generate the model response, which mainly includes the attack request response and an importance score. The attack request response is returned to the attacker through the protocol front-end submodule, and a record identifier is generated for this interaction. Finally, the protocol type, importance score, time, attack request, attack request response, and record identifier of this interaction are stored in the cross-protocol semantic knowledge base using the query vector generated by the cross-protocol semantic retrieval method as an index.

[0048] Furthermore, during the length determination process, the interaction history is filtered and truncated. Specifically, for the first [interaction history segment]... k Each record is used to calculate its priority score. This is used to measure the importance of the record in the current interaction, and it is calculated as follows: ; in, Indicates the current time. Indicates the first k The timestamp of each interaction record Let be the time decay function. The time decay coefficient, No. k The importance score corresponding to each interaction record Indicates the preset time decay weight. This indicates the preset importance weight. The system sorts the interaction history according to priority scores. When the length of the prompt message exceeds a preset threshold, it prioritizes and retains records with higher scores while truncating records with lower scores. This ensures that key information is preserved while meeting the model input length limit. The truncated historical records are written into the cross-protocol semantic knowledge base during the interaction process and can be retrieved in subsequent related interactions through the retrieval mechanism, thus avoiding the complete loss of historical information.

[0049] After length determination, the large language model is invoked to generate the attack request response and scoring information. Based on the final query results, prompt words are constructed, including system prompt words, reordered historical records, current interaction history, and the current attack request. These are input into the large language model for inference and generation. The prompt words constrain the model's output format, ensuring that while generating the response content, it also outputs the attack request response and its corresponding importance score according to a preset format. The importance score characterizes the degree of influence of the current action on subsequent interactions. This approach achieves unified processing of response generation and interaction evaluation.

[0050] The output processing submodule parses and distributes the model response results. This module parses and processes the model response generated by the large language model to obtain the attack request response and importance score. It then sends the attack request response to the protocol front-end submodule to return it to the attacker, and simultaneously passes the attack request response and importance score to the feedback submodule.

[0051] The feedback submodule enables the dynamic writing and continuous accumulation of interactive data. After each round of interaction, this module uses the query vector as an index to write the protocol type, time information, attack request, attack request response, importance score and record identifier into the cross-protocol semantic knowledge base. The query vector is the vector generated in the aforementioned vectorization stage and will not be recalculated.

[0052] The multi-protocol spoofing network defense system proposed in this invention extracts structured semantic descriptions of interaction data under different protocols, and performs vectorized encoding and cross-protocol retrieval based on these semantic descriptions. This enables the interaction data between different protocols to establish associations under a unified representation, thereby achieving state sharing and consistent utilization among multiple protocols. Compared to the single-protocol response mechanism based on rule matching and template libraries in existing technologies, and the method of constructing prompt words based solely on the current interaction history, this invention can achieve cross-protocol information linkage, effectively improving the system's continuous modeling capability for complex attack behaviors. This invention utilizes a multi-dimensional scoring and re-ranking module to comprehensively consider factors such as semantic similarity, protocol relevance, temporal sequence, and operational importance during the candidate historical record screening process, comprehensively scoring and ranking the historical records. Compared to the existing technology that relies solely on rule matching or single importance assessment for screening, this invention can effectively reduce the introduction of irrelevant or low-value information, making the screening results more consistent with the current interaction state, thereby improving the rationality and consistency of the generated response. This invention improves the knowledge base construction and update mechanism of the retrieval enhancement generation system, enabling it to adapt to multi-protocol interaction scenarios, thereby achieving real-time updates and cross-protocol sharing of interaction data. In traditional retrieval-enhanced generation systems, knowledge bases are typically built based on offline data, resulting in low update frequencies and difficulty in reflecting continuously generated new data during interactions. To address this issue, this invention utilizes a result feedback enhancement module. After each round of interaction, the attack request, attack request response, and related information are written in real-time to a cross-protocol semantic knowledge base. This allows different protocols to directly retrieve and utilize the current interaction information in subsequent interactions, thereby achieving state sharing among multiple protocols. Simultaneously, given the limited input length of the large language model, this invention employs a priority truncation mechanism based on time and importance scoring to filter the interaction history, prioritizing the retention of key records and truncating low-priority records. This ensures that interaction data can be shared across protocols and reused after truncation, significantly improving the system's ability to continuously model attack behaviors.

[0053] Secondly, corresponding to the above system embodiments, this invention also provides a network defense method for multi-protocol spoofing based on retrieval enhancement generation, such as... Figure 6 As shown, it may include: S1 receives attack requests sent by attackers through different protocols, parses the current attack request, extracts the protocol type, request content and time information, and converts the attack request into a unified semantic description. S2 generates query vectors based on semantic descriptions, performs similarity retrieval in a cross-protocol semantic knowledge base, and obtains candidate historical records related to the current interaction; S3, filter and deduplicate the candidate historical records, and calculate the multidimensional scores of the filtered candidate historical records respectively; S4. Calculate the comprehensive score based on the multidimensional scoring, sort the candidate historical records according to the comprehensive score, and select the top-scoring candidate historical records as the final query results. S5: Construct prompt words required to call the large language model using the final query results, determine the length of the prompt words, and call the large language model to generate an attack request response and importance score; S6 generates a record identifier for this interaction and writes the protocol type, time information, attack request, attack request response, importance score and record identifier of this interaction into the cross-protocol semantic knowledge base to achieve dynamic updating and continuous accumulation of historical data. S7 returns the attack request response to the attacker.

[0054] Understandably, in this embodiment of the invention, steps S1-S2 provide a cross-protocol semantic retrieval method, which enables the association and reuse of interactive data generated under different protocols, thereby achieving continuous sharing of attack status in a multi-protocol environment and avoiding inconsistent response problems caused by protocol fragmentation.

[0055] Converting attack requests into a unified semantic description can include: It abstracts and processes different forms of attack requests from SSH commands, HTTP requests, and database queries, transforming attack request information into a unified semantic description.

[0056] This cross-protocol semantic retrieval method extracts structured semantics from interaction data under different protocols, transforming the original requests and query statements into structured semantic representations containing fields such as operation type, operation object, and behavioral characteristics. Based on the structured semantics, it performs vectorized encoding and retrieval, enabling historical interaction data between different protocols to establish a semantic connection. This breaks the problem of isolated data between different protocols in traditional systems, realizes the sharing and consistent utilization of attack states in a multi-protocol environment, and reduces the risk of being identified by attackers.

[0057] Steps S3-S4 provide a multi-dimensional scoring re-ranking method that comprehensively evaluates historical interaction data from multiple aspects such as relevance, time characteristics, and the degree of operational impact, in order to improve the accuracy of historical data screening and enable the system to prioritize the use of information that is most valuable for the current interaction, thereby improving the rationality and consistency of the response results.

[0058] This multidimensional scoring and ranking method considers not only the degree of matching between data during the candidate historical record screening process, but also the correlation between protocol types, the chronological order, and the impact of operational behavior on the system state. It performs multidimensional scoring and ranking on candidate records, thereby selecting the historical data that is most valuable for the current interaction, improving the accuracy and effectiveness of data utilization, making the generated response more consistent with the contextual logic of the attack process, and avoiding inconsistencies or unreasonable situations.

[0059] Steps S5-S7 provide a result feedback enhancement method, which writes request and response data in real time during the interaction process and combines deduplication and filtering strategies to avoid duplicate data from interfering with the system. At the same time, even when the input length is limited, historical information can still be reused through retrieval, thereby realizing the continuous evolution and effective use of historical data and enhancing the system's adaptability to long-term attacks.

[0060] This includes determining the length of the prompt words and using a large language model to generate an attack request response and importance score, which may include: The prompt words are judged and controlled for length. Under the premise of meeting the input length limit, the large language model is called to generate the model response result. The model response results are evaluated for importance and formatted to obtain an importance score and an attack request response.

[0061] This feedback enhancement method processes and writes the interaction requests, responses, and related information to the knowledge base in real time after each round of interaction, achieving dynamic updates of historical data. Simultaneously, in subsequent retrieval processes, it combines the current interaction records to deduplicate and filter candidate data, preventing duplicate data from being reintroduced. In embodiments of this invention, when the input length of the large language model is limited, historical data can be selectively retained based on a scoring strategy, truncating unselected data. However, since this data has already been stored in the knowledge base during the writing process, it can still be retrieved and utilized again in subsequent related interactions, thus avoiding information loss due to truncation. This allows the system to continuously utilize historical interaction data to respond continuously to attacks, improving the stability and reliability of deception network defense.

[0062] It should be noted that, in the description of this invention, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of indicated technical features. Therefore, a feature defined as "first" or "second" may explicitly or implicitly include one or more of that feature. In the description of this invention, "a plurality of" means two or more, unless otherwise explicitly specified.

[0063] The above description is merely a preferred embodiment of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention are included within the scope of protection of the present invention.

Claims

1. A network defense system for multi-protocol spoofing based on retrieval enhancement generation, characterized in that, include: The cross-protocol semantic retrieval module is used to parse the current attack request, extract the protocol type, request content and time information, and convert the attack request into a unified semantic description; based on the semantic description, a query vector is generated, and similarity retrieval is performed in the cross-protocol semantic knowledge base to obtain candidate historical records related to the current interaction; The multidimensional score reordering module is used to filter and deduplicate candidate historical records, and calculate the multidimensional scores of the filtered candidate historical records respectively. A comprehensive score is calculated based on multidimensional scoring. Candidate historical records are sorted according to the comprehensive score, and the top-scoring candidate historical records are selected as the final query results. The result feedback enhancement module is used to construct prompt words required to call the large language model using the final query results, determine the length of the prompt words, and call the large language model to generate an attack request response and importance score. A record identifier is generated for this interaction, and the protocol type, time information, attack request, attack request response, importance score and record identifier of this interaction are written into the cross-protocol semantic knowledge base to realize the dynamic updating and continuous accumulation of historical data. The cross-protocol semantic retrieval module is also used to return attack request responses to attackers.

2. The network defense system for multi-protocol spoofing based on retrieval enhancement generation according to claim 1, characterized in that, The cross-protocol semantic retrieval module includes: The protocol front-end submodule is used to implement network access and basic service support for different protocols, send attack requests under different protocols to the input processing submodule, and return the attack request response to the attacker. The input processing submodule is used to perform structured parsing on the received attack requests and extract the protocol type, request content, and time information. The semantic extraction submodule is used to convert attack requests under different protocols into a unified semantic description based on protocol type, request content, and time information. The vectorization submodule is used to encode semantic descriptions and generate corresponding query vectors; A cross-protocol semantic knowledge base is used to uniformly manage interaction records from different protocols. It associates and stores protocol type, request content, time information, response result, importance score, record identifier and corresponding query vector. An index structure is built based on the query vector. After receiving the query vector, similarity retrieval is performed to obtain candidate historical records related to the current interaction.

3. A network defense system for multi-protocol spoofing based on retrieval enhancement generation according to claim 1, characterized in that, The multidimensional scoring rearrangement module includes: The candidate filtering submodule is used to compare the retrieved candidate historical records with the record identifier set of the current interaction history, remove duplicate records that already exist in the current interaction history, and obtain the filtered candidate historical records. The reordering submodule is used to calculate the multidimensional scores of the filtered candidate historical records; it performs weighted calculations on the multidimensional scores based on preset weights to obtain the comprehensive score of the filtered candidate historical records; it sorts the filtered candidate historical records according to the comprehensive score and selects the top-scoring candidate historical records as the final query results.

4. A network defense system for multi-protocol deception based on retrieval enhancement generation according to claim 1, characterized in that, Multidimensional scoring, including: Agreement score, similarity score, time score, and importance score.

5. A network defense system for multi-protocol spoofing based on retrieval enhancement generation according to claim 1, characterized in that, The expression for the overall score is as follows: ； in, This represents the overall score. Represents the current query vector Candidate vectors in candidate history Cosine similarity between them Represents the current query vector Corresponding interaction protocol With candidate vectors Corresponding candidate record protocol The protocol association weight between them Represents the current query vector The timestamp corresponding to the attack request Represents candidate vectors The timestamp of the corresponding candidate record Let be the time decay function. Indicates the time decay coefficient. Represents candidate vectors The operational importance score corresponding to the candidate record 、 、 、 The preset weights for each scoring item in the overall score, .

6. A network defense system for multi-protocol spoofing based on retrieval enhancement generation according to claim 1, characterized in that, The result feedback enhancement module includes: The large model calls a submodule, which is used to construct suggestion words using the final query results, detect and control the length of the suggestion words, and generate model response results; The output processing submodule is used to parse and process the model response results to obtain the attack request response and importance score, send the attack request response to the cross-protocol semantic retrieval module, and send the attack request response and importance score to the feedback submodule. The feedback submodule is used to generate a record identifier for this interaction. It stores the protocol type, time information, attack request, attack request response, importance score, and record identifier of this interaction into the cross-protocol semantic knowledge base using the query vector as an index.

7. A network defense system for multi-protocol spoofing based on retrieval enhancement generation according to claim 1, characterized in that, The prompt words include: System prompts, history of reordered selections, interaction history, and current attack requests.

8. A network defense method for multi-protocol spoofing based on retrieval enhancement generation, characterized in that, include: Receive attack requests sent by attackers through different protocols, parse the current attack request, extract the protocol type, request content and time information, and convert the attack request into a unified semantic description; Query vectors are generated based on semantic descriptions, and similarity retrieval is performed in a cross-protocol semantic knowledge base to obtain candidate historical records related to the current interaction. The candidate historical records are filtered and deduplicated, and the multidimensional scores of the filtered candidate historical records are calculated respectively. A comprehensive score is calculated based on multidimensional scoring. Candidate historical records are sorted according to the comprehensive score, and the top-scoring candidate historical records are selected as the final query results. The final query results are used to construct prompt words required to call the large language model. The length of the prompt words is judged, and the large language model is called to generate an attack request response and importance score. A record identifier is generated for this interaction, and the protocol type, time information, attack request, attack request response, importance score and record identifier of this interaction are written into the cross-protocol semantic knowledge base to realize the dynamic updating and continuous accumulation of historical data. The attack request response is returned to the attacker.

9. A network defense method for multi-protocol spoofing based on retrieval enhancement generation according to claim 8, characterized in that, Transform attack requests into a unified semantic description, including: It abstracts and processes different forms of attack requests from SSH commands, HTTP requests, and database queries, transforming attack request information into a unified semantic description.

10. A network defense method for multi-protocol spoofing based on retrieval enhancement generation according to claim 8, characterized in that, The length of the prompt words is determined, and a large language model is invoked to generate an attack request response and importance score, including: The prompt words are judged and controlled for length. Under the premise of meeting the input length limit, the large language model is called to generate the model response result. The importance of the model response results is evaluated and formatted to obtain the attack request response and importance score.

Images