Intelligent threat tracing method and device based on honey mark trapping and blockchain storage

Abstract

The application discloses an intelligent threat tracing method and device based on a honey mark trap and a blockchain storage, and relates to the field of network security.The method comprises the following steps: when it is monitored that an attacker interacts with any honey mark node, behavior feature data is formed by a behavior collector arranged in the local honey mark node, and the behavior feature data is encrypted and transmitted to a server behavior analysis engine; an attack behavior mode is extracted from the behavior feature data by the behavior analysis engine, and a behavior fingerprint is generated; a dynamic behavior fingerprint chain is formed based on subsequent interaction behaviors of the same attacker; information in the behavior fingerprint chain is written into a blockchain account book; in response to a tracing instruction, an attack event graph is constructed, an attack path, an attack source and associated attack events of the attacker are identified, and a multi-dimensional portrait of the attacker is generated; and a tracing analysis report is generated based on the multi-dimensional portrait of the attacker and a verification interface pointing to corresponding storage information in the blockchain account book. The above technical scheme can accurately trace the attacker.

Description

Technical Field

[0001] This application relates to the field of cybersecurity, and in particular to an intelligent threat tracing method and device based on honey tag trapping and blockchain evidence storage. Background Technology

[0002] In the field of cybersecurity, with the rapid development of information technology, cyberattacks are becoming increasingly complex and diverse. Cyberattacks not only cause privacy breaches and financial losses for individual users, but for businesses and institutions, they can also lead to the loss of critical data, business disruptions, and even impact national economic security and social stability. Therefore, effectively monitoring and tracing cyberattacks has become a research hotspot and crucial task in the field of cybersecurity.

[0003] Traditional methods for network attack monitoring and attribution mainly include the following: One is based on intrusion detection systems (IDS), which monitor network traffic in real time, analyze abnormal behavior patterns, and issue alerts when attack behavior matching preset rules is detected. Another is based on firewall technology, which sets access control rules to block unauthorized network access and intercept known attack sources and patterns. However, these traditional passive protection methods are difficult to effectively detect unknown threats, and even if attack behavior is detected, there is often a lack of credible evidence chains to support attribution analysis. Existing threat attribution technologies have the following limitations: they rely on post-event log analysis, which attackers can easily delete or tamper with; they lack proactive discovery capabilities, making it difficult to capture early attacker behavior; and their evidence preservation mechanisms are imperfect, resulting in low credibility of attribution results. Summary of the Invention

[0004] This application provides an intelligent threat tracing method and device based on honey tag trapping and blockchain evidence storage, which can effectively trap attack behavior and accurately trace the attacker, and can also use blockchain to ensure the security and reliability of the evidence storage information.

[0005] Firstly, this application provides an intelligent threat tracing method based on honey tag trapping and blockchain evidence storage, the method comprising: Deploy distributed honeybee nodes in the target network environment, the honeybee nodes being configured to simulate a real business environment to lure and capture attack behaviors; When an attacker is detected to be interacting with any honeybee node, a behavior collector deployed locally on the honeybee node collects multi-dimensional behavior data in real time. After adding a timestamp and honeybee node identifier to the behavior data, the behavior feature data is encrypted and transmitted to the server as a behavior analysis engine. The behavior analysis engine extracts attack behavior patterns from the behavior feature data and generates behavior fingerprints. When subsequent interaction behaviors of the same attacker are identified, the behavior fingerprints are iteratively updated to form a dynamic behavior fingerprint chain that characterizes the evolution of attack behavior. The hash value, timestamp, and honeymark node identifier of each honeymark node in the behavioral fingerprint chain are written into the blockchain ledger as evidence storage information. In response to the source tracing command, based on the evidence information associated with the target attack event obtained from the blockchain ledger, an attack event graph is constructed. The graph neural network is used to learn node representations and reason about relationships in the attack event graph to identify the attacker's attack path, attack source and associated attack events, and a multi-dimensional profile of the attacker is generated by combining the threat intelligence database. A source tracing analysis report is generated based on the attacker's multi-dimensional profile and the verification interface pointing to the corresponding evidence storage information in the blockchain ledger.

[0006] By employing the aforementioned technical solution, highly realistic distributed honeybee nodes are deployed to actively attract attackers. Multi-dimensional behavioral data is collected in real-time at the interaction source and transmitted encrypted, ensuring that attack evidence possesses a complete timestamp and source identifier from the outset, effectively preventing evidence loss or tampering. For continuous interactions by the same attacker, a semantic feature vector is generated through iterative updates, forming a hash-associative behavioral fingerprint chain. This not only fully reflects the evolution of the attack method but also solidifies and preserves key information of the fingerprint chain through the blockchain, ensuring the non-repudiation and traceability of behavioral evidence. Using blockchain-preserved evidence as a trusted data source, an attack event graph is constructed. Deep relational reasoning is performed using graph neural networks to accurately reconstruct the attack path and source, and threat intelligence is combined to generate a multi-dimensional attacker profile. The final tracing report embeds a cryptographic verification interface pointing to the on-chain evidence, making the report's conclusions independently verifiable and significantly improving its credibility.

[0007] In some embodiments, the step of extracting attack behavior patterns from the behavioral feature data and generating behavioral fingerprints through the behavior analysis engine, and iteratively updating the behavioral fingerprints when subsequent interactions of the same attacker are identified to form a dynamic behavioral fingerprint chain characterizing the evolution of attack behavior, specifically includes: Semantic parsing is performed on the behavioral feature data to extract operation intent tags, attack method features, and attack tool features; The operation intent label, the attack method feature, and the attack tool feature are input into a pre-trained behavior encoder to generate a fixed-dimensional semantic feature vector, and a hash operation is performed on the semantic feature vector to obtain the hash value corresponding to the current interaction behavior. The similarity between the semantic feature vector and the historical semantic feature vectors corresponding to each existing attacker session is calculated to obtain the behavior pattern similarity. Based on the attacker's source IP address and the behavior pattern similarity, it is determined whether the current interaction behavior is associated with an existing attacker session. If associated, the hash value corresponding to the current interaction behavior is linked to the existing behavioral fingerprint of the attacker, and the comprehensive behavioral feature representation of the existing attacker is updated based on the semantic feature vector. If not associated, a new behavioral fingerprint chain is created for the attacker of the current interaction behavior starting from the hash value, and the semantic feature vector is used as the initial comprehensive behavioral feature representation of the attacker of the current interaction behavior.

[0008] The above technical solution extracts operational intent, attack methods, and tool features from behavioral data through semantic parsing. A pre-trained encoder generates fixed-dimensional semantic feature vectors, ensuring significant differentiation between different attack behaviors in the feature space. Simultaneously, hash operations generate unique hash values, providing an immutable identification basis for subsequent evidence preservation and correlation analysis. A dual correlation judgment mechanism based on source IP address and behavioral pattern similarity accurately identifies discontinuous interaction behaviors belonging to the same attacker. Newly generated behavioral fingerprints are iteratively linked to the end of existing fingerprint chains, forming a dynamic behavioral fingerprint chain that fully reflects the evolution of attack behavior, effectively avoiding attacker identity fragmentation due to IP hopping or session interruptions. When a related session is identified, the newly extracted semantic feature vectors are used to incrementally update the attacker's comprehensive behavioral feature representation, continuously enriching and improving the attacker profile as the interaction deepens. When a new attacker is identified, an independent fingerprint chain starting point is created, ensuring that each attacker has independent and continuously optimized feature expressions, providing high-quality feature input for subsequent graph neural network correlation analysis and accurate source tracing.

[0009] In some embodiments, the behavior encoder is trained through the following steps: Construct a training sample set, which includes multiple sets of attack behavior sequence samples extracted from historical honeybee interaction data. Each set of attack behavior sequence samples includes operation intent labels, attack method labels, and attack tool labels. Two sets of attack behavior sequence samples belonging to the same attack method are used as positive sample pairs, and two sets of attack behavior sequence samples belonging to different attack methods are used as negative sample pairs to construct comparative learning training data. The positive sample pairs and the negative sample pairs are input into the behavior encoder network to be trained. The network parameters of the behavior encoder network are optimized by maximizing the similarity of the positive sample pairs in the feature space and minimizing the similarity of the negative sample pairs in the feature space. When the loss function converges to a preset threshold, a pre-trained behavior encoder is obtained. The behavior encoder is used to map the input attack behavior features into a fixed-dimensional semantic feature vector with discriminative power.

[0010] By employing the aforementioned technical solution and a contrastive learning strategy, the trained behavior encoder maximizes the similarity of samples using the same attack method and minimizes the similarity of samples using different attack methods. This allows the encoder to map behavioral sequences from different attack methods to distinct regions in the semantic feature space, ensuring high aggregation of identical attack methods and significant differentiation between different methods. This provides a high-quality feature foundation for the unique identification and association matching of subsequent behavior fingerprints. The training sample set originates from multiple sets of attack behavior sequences collected from real historical honeypot interactions, covering diverse operational intentions, attack methods, and tool combinations. This enables the pre-trained behavior encoder to stably encode unseen attack behavior variants, preventing feature vector failure due to attackers simply changing tools or fine-tuning the operation order. The fixed-dimensional semantic feature vector output by the behavior encoder ensures that behavioral data from different attackers and different sessions can be mapped to the same vector space for similarity calculation. This supports subsequent association judgments based on source IP and behavioral pattern similarity, as well as iterative updates of the attacker's comprehensive behavioral feature representation, guaranteeing the consistency and computability of the dynamic behavior fingerprint chain construction process.

[0011] In some embodiments, the step of calculating the similarity between the semantic feature vector and the historical semantic feature vectors corresponding to existing attacker sessions to obtain behavioral pattern similarity, and determining whether the current interaction behavior is associated with an existing attacker session based on the attacker's source IP address and the behavioral pattern similarity, specifically includes: Extract the attacker's source IP address corresponding to the current interaction behavior, and match it with the source IP addresses of existing attacker sessions to obtain the source IP address matching results; Calculate the cosine similarity between the semantic feature vector corresponding to the current interaction behavior and the comprehensive behavioral feature representation corresponding to each existing attacker session, and use it as the behavioral pattern similarity score. The source IP address matching result and the behavior pattern similarity score are weighted and fused to obtain a comprehensive association confidence score. The source IP address matching result is represented by a Boolean value, and the behavior pattern similarity score is a continuous value. Determine whether the comprehensive association confidence score exceeds a preset association threshold. If it does, determine that the current interaction behavior is associated with the corresponding attacker session; otherwise, determine that it is not associated.

[0012] By adopting the above technical solution, the dual judgment factors of source IP address matching and behavioral pattern similarity are introduced. This overcomes the shortcomings of relying solely on IP addresses, which are susceptible to misjudgments due to proxies, jump servers, and dynamic IPs. It also avoids the problem of false associations arising from accidental behavioral similarities when relying solely on behavioral similarity. The complementary effect of the two factors significantly improves the reliability of association judgment. The source IP matching results are represented as Boolean values ​​to indicate qualitative evidence, while the cosine similarity of behavioral patterns is represented as a continuous numerical value to indicate quantitative features. A weighted fusion mechanism unifies the two into a comprehensive association confidence score, allowing rigid identity clues and flexible behavioral features to work synergistically in the decision-making process, balancing certainty and flexibility in judgment. The judgment mechanism with preset association thresholds allows for adjustment of association sensitivity according to actual defense strategies. At high thresholds, high-confidence associations can be ensured to support judicial evidence collection, while at low thresholds, broad-coverage associations can be achieved, providing a technical foundation for the flexible deployment of the system in different application scenarios.

[0013] In some embodiments, the step of learning node representations and reasoning about relationships in the attack event graph using a graph neural network to identify the attacker's attack path, attack source, and associated attack events specifically includes: The honeybeacon nodes, attacker IP nodes, attack tool nodes, and attack behavior nodes in the attack event graph are initialized as graph nodes, and each node is embedded and initialized based on the semantic feature vector in the behavior fingerprint. A graph attention network is used to perform multi-layer convolution on the attack event graph to learn the hidden layer representation of each node, and the feature information of neighboring nodes is aggregated through an attention mechanism. Based on the hidden layer representation, a link prediction model is used to calculate the probability that there is an attack association between any two nodes, and an attack path candidate set is constructed based on the probability score. A Bayesian inference algorithm is used to calculate the probability of each path in the candidate attack path set, and the path with the highest probability is selected as the final attack path. The attack source is then identified by tracing back along the path.

[0014] By employing the aforementioned technical solution, heterogeneous attack elements such as honey tags, IP addresses, tools, and behaviors are uniformly initialized as graph nodes. Semantic feature vectors from behavioral fingerprints are then used for embedding and initialization, enabling comparable and computable attack traces from different sources and of different types within the same vector space, laying the foundation for subsequent deep correlation analysis. A graph attention network is used to perform multi-layer convolution on the attack event graph, adaptively assigning differentiated attention weights to different neighboring nodes. This highlights core nodes in the attack path, filters out noise interference, and effectively uncovers hidden attack relationships that appear weakly correlated but are actually strongly causal, improving the depth and accuracy of source tracing analysis. First, a candidate set of attack paths is constructed using a link prediction model. Then, a Bayesian inference algorithm is introduced to calculate and rank the probabilities of each candidate path, upgrading path selection from deterministic rules to uncertain inference. This not only outputs the most probable attack path but also provides confidence metrics for each path, making the source tracing conclusions both interpretable and verifiable.

[0015] In some embodiments, generating a source tracing analysis report based on the attacker's multi-dimensional profile and the verification interface pointing to the corresponding evidence storage information in the blockchain ledger includes: Extract all hash values ​​referenced during the source tracing analysis, and obtain the corresponding notarized transaction hash and block height of each hash value in the blockchain ledger; For each evidence-stored transaction, a corresponding proof path is requested from the blockchain node based on the evidence-stored transaction hash and the block height. The proof path is used to verify that the evidence-stored information corresponding to the evidence-stored transaction is indeed included in the block identified by the block height. The attacker's multidimensional profile, attack path visualization map, evidence timeline, and proof path are integrated to generate a source tracing analysis report; One or more verification interfaces are embedded in the traceability analysis report. The verification interface is configured to receive an external verification request, call the blockchain node application interface to query the authenticity of the corresponding evidence information, and return the verification result.

[0016] By employing the aforementioned technical solution, all hash values ​​referenced during the analysis process are extracted, and the corresponding notarized transaction hashes, block heights, and proof paths are obtained. This establishes a cryptographic anchoring relationship between each conclusion in the tracing report and the original notarized records on the blockchain, freeing the report from reliance on centralized authority endorsement. Any third party can independently verify the authenticity and integrity of the evidence through cryptographic means. The multi-dimensional attacker profile, attack path visualization, evidence timeline, and on-chain proof paths are structurally integrated, ensuring the tracing report simultaneously covers analytical conclusions, behavioral deduction processes, and original evidence vouchers. This forms a logically coherent and clearly structured evidence system, meeting the stringent requirements of judicial evidence collection and internal auditing for the completeness of the evidence chain. A directly callable blockchain verification interface is embedded in the report. Upon receiving external verification requests, it automatically queries the authenticity of on-chain notarized evidence and returns the verification results. Verifying parties do not need to understand the underlying technical details of the blockchain to complete the verification operation, significantly reducing the technical complexity and operational costs of evidence verification and improving the usability and acceptability of the tracing report in practical application scenarios.

[0017] In some embodiments, generating a multi-dimensional attacker profile by combining a threat intelligence database includes: The identified attack tool characteristics, attack method characteristics, and attack time patterns are matched with the characteristics of known attack organizations stored in the threat intelligence database to determine the suspected organization affiliation of the attacker and the corresponding confidence level. Based on the vulnerability exploitation methods, lateral movement techniques, and privilege escalation paths used by the attackers, assess the attackers' skill level. Based on the types of honeybeacon nodes accessed by the attacker, the keywords searched, and the types of decoy files downloaded, the attacker's attack motives can be inferred. The suspected organization affiliation, the technical level, and the attack motive category are combined to generate a comprehensive attacker profile, with confidence scores for each dimension added.

[0018] By employing the aforementioned technical solution, the identified attack tool characteristics, methodological characteristics, and temporal patterns are matched with known attack organization characteristics in the threat intelligence database. This transforms isolated technical traces into attribution conclusions with organizational significance, outputting corresponding confidence levels. This provides security teams with direct reference for assessing attacker backgrounds and threat levels. The solution integrates three aspects: evaluating technical skill level based on vulnerability exploitation and lateral movement complexity, inferring attack motives from access targets and stolen content, and matching suspected organizational affiliation based on tool and methodological characteristics. This creates a comprehensive attacker profile, avoiding biased judgments that may result from single-dimensional assessments and fully characterizing the attacker's capabilities, objectives, and identity. Confidence scores are added to suspected organizational affiliation, technical skill level, and attack motive category, upgrading the profile conclusions from qualitative descriptions to quantifiable probabilistic judgments. Security operations personnel can determine response priorities and intensity based on the confidence levels of each dimension, achieving precise and controllable defense decisions.

[0019] In a second aspect, embodiments of this application provide a computer system including a memory, a processor, and a computer program stored in the memory; the processor executes the computer program to implement the steps of the method described in any possible implementation of the first aspect.

[0020] Thirdly, embodiments of this application provide a computer-readable storage medium having a computer program / instructions stored thereon, which, when executed by a processor, implement the steps of the method described in any possible implementation of the first aspect.

[0021] Fourthly, embodiments of this application provide a computer program product, including a computer program / instructions, which, when executed by a processor, implement the steps of the method described in any possible implementation of the first aspect.

[0022] It is understood that the computer system provided in the second aspect, the storage medium provided in the third aspect, and the computer program product provided in the fourth aspect are all used to execute the method provided in this application. Therefore, the beneficial effects they can achieve can be referred to the beneficial effects in the corresponding methods, and will not be repeated here.

[0023] One or more technical solutions provided in the embodiments of this application have at least the following technical effects or advantages: 1. By deploying highly realistic distributed honeybee nodes in the target network, attack behaviors are actively captured, overcoming the shortcomings of traditional passive defenses in detecting unknown threats. Each honeybee node has a built-in behavior collector that gathers multi-dimensional behavioral data on the network, system, and applications the moment an attack interaction occurs. This data is then timestamped and encrypted before transmission, ensuring the integrity and tamper-proof nature of the evidence from the source. 2. The collected data is semantically parsed and features extracted using a behavior analysis engine to generate a unique behavioral fingerprint that identifies the attack pattern. When the same attacker interacts again, the behavioral fingerprint is iteratively updated and linked to form a dynamic behavioral fingerprint chain, completely recording the evolution of the attack method. Key information in this fingerprint chain (hash value, timestamp, node identifier) ​​is written into the blockchain ledger for evidence storage, leveraging the immutability of the blockchain to ensure the authenticity and verifiability of the evidence. 3. In the attribution phase, an attack event graph is constructed using on-chain evidence as a trusted data source. Graph neural networks are employed for node representation learning and relational reasoning to accurately reconstruct attack paths, locate attack sources, and discover related events. Simultaneously, a multi-dimensional attacker profile is generated, encompassing organizational affiliation, technical capabilities, and attack motives, in conjunction with a threat intelligence database. The final attribution analysis report embeds a verification interface pointing to on-chain evidence, allowing any third party to independently verify the authenticity of the evidence cited in the report via cryptographic methods. This significantly improves the credibility of attribution conclusions and the efficiency of collaborative defense. Attached Figure Description

[0024] Figure 1 This is a flowchart illustrating the intelligent threat tracing method based on honey tag trapping and blockchain evidence storage in the embodiments of this application. Figure 2 This is a schematic diagram of the overall process of the intelligent threat tracing method based on honey tag trapping and blockchain evidence storage in the embodiments of this application; Figure 3 This is a schematic diagram of the honeybee environment construction and deployment architecture in the embodiments of this application; Figure 4 This is a schematic diagram of the blockchain evidence storage process in the embodiments of this application; Figure 5 This is a flowchart of threat attribution and attack graph construction in the embodiments of this application; Figure 6 This is a block diagram of the traceability system in the embodiments of this application; Figure 7 This is a schematic diagram of an exemplary hardware structure of a computer system in an embodiment of this application. Detailed Implementation

[0025] The terminology used in the following embodiments of this application is for the purpose of describing particular embodiments only and is not intended to be limiting of this application. As used in the specification of this application, the singular expressions “a,” “an,” “the,” “the,” “the,” and “this” are intended to include the plural expressions as well, unless the context clearly indicates otherwise. It should also be understood that the term “and / or” as used in this application refers to any or all possible combinations that include one or more of the listed items.

[0026] Hereinafter, the terms "first" and "second" are used for descriptive purposes only and should not be construed as implying or suggesting relative importance or implicitly indicating the number of indicated technical features. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of that feature, and in the description of the embodiments of this application, unless otherwise stated, "multiple" means two or more.

[0027] The following is combined Figure 1 The method of the embodiments of this application will be described below.

[0028] Please see Figure 1 This is a flowchart illustrating the intelligent threat tracing method based on honeybee trapping and blockchain evidence storage in this embodiment of the application. Figure 1 As shown, the method includes the following steps: S101. Deploy distributed honeybea nodes in the target network environment, wherein the honeybea nodes are configured to simulate a real business environment to lure and capture attack behaviors. S102. When an attacker is detected to be interacting with any honeybea node, a behavior collector deployed locally on the honeybea node collects multi-dimensional behavior data in real time. After adding a timestamp and honeybea node identifier to the behavior data, the behavior feature data is encrypted and transmitted to the server as a behavior analysis engine. S103. The attack behavior pattern is extracted from the behavior feature data and a behavior fingerprint is generated by the behavior analysis engine. When the subsequent interaction behavior of the same attacker is identified, the behavior fingerprint is iteratively updated to form a dynamic behavior fingerprint chain that characterizes the evolution of the attack behavior. S104. Write the hash value, timestamp and honeymark node identifier corresponding to each honeymark node in the behavior fingerprint chain into the blockchain ledger as evidence storage information. S105. In response to the tracing instruction, based on the evidence information associated with the target attack event obtained from the blockchain ledger, an attack event graph is constructed. The attack event graph is then subjected to node representation learning and relation reasoning through a graph neural network to identify the attacker's attack path, attack source, and associated attack events. Finally, a multi-dimensional profile of the attacker is generated by combining the threat intelligence database. S106. Generate a source tracing analysis report based on the attacker's multi-dimensional profile and the verification interface pointing to the corresponding evidence storage information in the blockchain ledger.

[0029] Based on the target network architecture and business characteristics, highly realistic honeypot nodes are designed and deployed. The type of honeypot node can be flexibly selected according to actual protection needs, including but not limited to: virtual machine honeypots built using virtualization technologies such as VMware and KVM to simulate real enterprise server environments; lightweight container honeypots deployed using Docker and Kubernetes container technologies to simulate web services, database services, etc.; file honeypots deployed in the file system containing decoy files (such as Office documents with hidden tags); network service honeypots exposing fake SSH, FTP, RDP, and other service ports; and database honeypots that implant fake sensitive data tables in database instances. To achieve multi-layered trapping, each honeypot node adopts a distributed random deployment strategy, deployed in different network segments of the production network. Simultaneously, dynamic topology obfuscation technology can be used to randomize the network configuration of the honeypot nodes (such as IP address, MAC address, hostname, etc.) to increase the difficulty for attackers to identify the honeypot environment, thereby improving the stealth of the honeypot network and the success rate of trapping.

[0030] When an attacker establishes a connection with any honeypot node and interacts with it through scanning, exploitation, remote login, or other means, the behavior collector deployed locally on that honeypot node is triggered. This behavior collector can be a data collection component implemented through system hooks, kernel drivers, or lightweight proxies, used to capture various behaviors of the attacker on the honeypot node in real time. The specific multi-dimensional behavior data collected includes: (1) network layer data, which uses deep packet inspection technology to capture network traffic packets and extract source IP, destination IP, protocol type, port number, and payload characteristics; (2) system layer data, which monitors system call sequences and records events such as process creation, file operations, registry modification, and network connection; (3) application layer data, which records the command sequence entered by the attacker, the executed SQL statements, and the content of the running scripts; and (4) file system data, which monitors file creation, modification, deletion, and download operations and records the hash value of the corresponding file. The behavior collector adds a nanosecond-precision timestamp and the unique identifier of the honeypot node to each of the above behavior data to form behavior feature data. To ensure the security of data transmission, a symmetric encryption algorithm is used to encrypt the behavioral feature data, and the data is transmitted to the behavioral analysis engine deployed on the secure server through a management channel independent of the production network.

[0031] After receiving behavioral feature data, the behavior analysis engine performs semantic parsing and feature extraction. Specifically, it extracts operation intent tags (such as lateral movement, privilege escalation, and data theft), attack method features (such as vulnerability exploitation methods and persistence mechanisms), and attack tool features (such as fingerprint information from Metasploit, Cobalt Strike, or custom tools). These extracted features are then input into a pre-trained behavior encoder model. This behavior encoder can be a deep neural network trained through contrastive learning, used to map discrete behavioral features into a fixed-dimensional (e.g., 256-dimensional) semantic feature vector. Simultaneously, a hash operation is performed on this semantic feature vector to obtain a unique hash value. This hash value, together with the semantic feature vector, constitutes the behavioral fingerprint corresponding to the current interaction. To achieve continuous tracking of the same attacker across sessions and time periods, the behavior analysis engine also performs session association judgment. This forms a dynamic behavioral fingerprint chain that fully reflects the evolution of attack behavior. For each behavioral fingerprint in the chain, its corresponding hash value, timestamp, and honeymark node identifier are extracted as key evidence. The aforementioned evidence information is standardized and encapsulated using JSON format, and the encapsulated data undergoes double SHA256 hash calculation to generate an evidence digest. By calling the smart contract's evidence storage function deployed on the blockchain network, the evidence digest, timestamp, and honeybee node identifier are written into the blockchain ledger. Upon successful execution of the smart contract, a evidence storage certificate containing the block height, transaction hash, and on-chain time is generated. This certificate serves as reliable proof that the evidence has been solidified on the blockchain and has not been tampered with.

[0032] When security analysts initiate a source tracing command for a specific attack event, the source tracing analysis module queries and retrieves relevant evidence from the blockchain ledger based on command conditions (such as a specific time range, a specific honeypot node, or a specific hash value). Based on the retrieved trusted evidence, an attack event graph is constructed, abstracting entities such as honeypot nodes, attacker IPs, attack tools, and attack behaviors into graph nodes, and constructing edges between nodes according to the temporal sequence and logical relationships of the behaviors. Building upon the constructed graph, a Graph Attention Network (GAT) is used to perform multi-layer graph convolution operations, learning the hidden layer representations of nodes to capture deep relationships between attack entities. Further, based on the learned node representations, a link prediction model is used to calculate the probability of attack associations between nodes, and a candidate set of attack paths is constructed. A Bayesian inference algorithm is used to calculate and rank the probabilities of each candidate path, selecting the path with the highest probability as the final attack path, and tracing back along this path to locate the attack source. Meanwhile, the source tracing analysis module compares the identified attack tool characteristics and attack method characteristics with the known attack organization characteristics stored in the threat intelligence database to assess the attacker's suspected organization affiliation, technical level, and attack motives. Finally, it integrates these to generate a multi-dimensional attacker profile that includes the above dimensions and corresponding confidence scores.

[0033] After completing the attribution analysis, a structured attribution analysis report is generated. This report integrates a multi-dimensional attacker profile, a visual map of the attack path, and a timeline of evidence arranged chronologically. To support the independent verifiability of the attribution conclusions, the report also embeds verification interfaces or cryptographic proof paths (such as Merkle proof paths) pointing to the corresponding evidence stored in the blockchain ledger. Any third party can use the interfaces or paths provided in the report to initiate queries to blockchain nodes to independently verify the authenticity and completeness of the evidence cited in the report, thereby enhancing the credibility of the attribution report.

[0034] Figure 2 This is a schematic diagram of the overall process of the intelligent threat tracing method based on honey tag trapping and blockchain evidence storage in the embodiments of this application, as follows: Figure 2As shown, the method includes several parts: honeypot environment construction, attack behavior collection, behavioral feature extraction and fingerprint generation, blockchain evidence storage, threat tracing and profiling, and generation of credible tracing analysis reports. Honeypot environment construction includes designing honeypot node types, dynamic topology obfuscation, and multi-layered decoy deployment. Honeypot node types include virtual machine honeypots, container honeypots, database honeypots, file honeypots, and web service honeypots. Dynamic topology obfuscation includes randomized deployment locations, dynamic network configuration, and topology obfuscation. Multi-layered decoy deployment includes file system decoy files, network layer port spoofing, and fake database data. The attack... Behavioral data collection includes network traffic data, system call data, command sequence data, and file operation data. Network traffic data includes source / destination IP, protocol type, payload content, and session characteristics. System call data includes process creation, file operations, registry modifications, and network connections. Command sequence data includes terminal commands, SQL statements, and script execution. File operation data includes file creation, file modification, file deletion, and file download. Each data entry is appended with a precise timestamp and the data collection node identifier. Behavioral feature extraction and fingerprint generation include semantic parsing and feature extraction, temporal pattern mining, and a behavioral encoder. Semantic parsing and feature extraction include identifying attack methods, attack tools, and operational intent. Temporal pattern mining includes analyzing behavioral sequences, extracting temporal features, and pattern recognition. The behavioral encoder includes deep learning models, mapping to high-dimensional feature vectors, generating unique behavioral fingerprints, and SHA256 hash encryption. Blockchain evidence storage includes standardized evidence encapsulation, double SHA256 hashing, and smart contract on-chain storage. Standardized evidence encapsulation includes original behavioral data, feature vectors, behavioral fingerprints, metadata information, timestamps, source IP, and honeymark nodes. Double SHA256 hashing includes calculating evidence digests and ensuring... To ensure data integrity and immutability, smart contract on-chain data processing includes writing evidence summaries, timestamps, data collection node IDs, automatically generating evidence certificates, block height, transaction hashes, and on-chain time. Threat tracing and profiling include attack graph construction, graph backtracking analysis, and threat intelligence database profiling. Attack graph construction includes graph nodes (attack events, attacker IPs, attack tools, and attack targets) and edge connections (establishing relationships). Graph backtracking analysis includes identifying attack paths, locating attack sources, and associating attack events. Threat intelligence database profiling includes technical level, organizational affiliation, attack motives, and tool characteristics.

[0035] Figure 3 This is a schematic diagram of the honeybee environment construction and deployment architecture in the embodiments of this application, such as... Figure 3As shown, the construction and deployment of the honeypot environment includes five steps: business architecture analysis, honeypot node type design, distributed deployment strategy, environment configuration and initialization, and deployment verification and testing. The distributed deployment strategy includes two types: randomized deployment and dynamic topology obfuscation. In randomized deployment, the deployment locations are different network segments of the production network, and multiple honeypot nodes are distributed and randomly distributed to increase the difficulty of identification. Dynamic topology obfuscation includes randomization of IP addresses, randomization of MAC addresses, randomization of hostnames, and dynamic changes in network configuration.

[0036] Figure 4 This is a schematic diagram of the blockchain evidence storage process in an embodiment of this application, such as... Figure 4 As shown, the blockchain evidence preservation process includes five steps: evidence standardization and encapsulation, double SHA256 hash calculation, consortium blockchain architecture, on-chain certificate, and generation of evidence preservation certificate. Evidence standardization and encapsulation includes raw behavioral data (network traffic packets, system call records, and command sequences), feature vectors (256-dimensional feature vectors), behavioral fingerprints (SHA256 hash values), and metadata information (timestamp, source IP, honeybee node ID, attack type, and attack tools). JSON serialization converts the encapsulated evidence data into JSON format. The first layer of SHA256 performs the first hash calculation on the JSON data to generate an intermediate hash value. The second layer of SHA256 performs a second hash calculation on the intermediate hash value. The hash calculation generates the final evidence digest; the consortium blockchain consists of security vendor nodes, regulatory department nodes, enterprise user nodes, and other authorized nodes; the consensus mechanism includes PBFT (Practical Byzantine Fault Tolerance), efficient consensus, and node verification; the smart contract includes evidence storage functions and query functions, which are executed automatically; the data written to the blockchain ledger includes the evidence digest (double SHA256), timestamp, collection node ID, and other key information; the evidence storage certificate information includes block height (the block height where the evidence is located), transaction hash (the unique identifier of the evidence storage transaction), on-chain time (the timestamp recorded on the blockchain), and node signature (the digital signature of the collection node); the certificate output formats include PDF, JSON, and QR code, supporting on-chain verification.

[0037] Figure 5 This is a flowchart of the threat attribution and attack graph construction process in the embodiments of this application, such as... Figure 5 As shown, the blockchain-stored evidence data is input, and evidence chain backtracking analysis is performed to retrieve evidence and reconstruct the attack timeline. If the attack data is complete, an attack graph is constructed, graph nodes are created, and related edges are established. Source tracing and reasoning analysis is performed to identify the attack source and path, and a threat profile is constructed, including technical capability assessment, organizational affiliation identification, attack motive analysis, and geographical location analysis. A source tracing analysis report is generated, and it is visualized and exported.

[0038] Figure 6This is a block diagram of the traceability system in the embodiments of this application, such as... Figure 6 As shown, the system includes a honeypot environment construction and deployment module, an attack behavior collection and monitoring module, a behavior feature extraction and anomaly identification module, a blockchain evidence storage and processing module, and a threat tracing and profiling module.

[0039] In some embodiments, the step of extracting attack behavior patterns from the behavioral feature data and generating behavioral fingerprints through the behavior analysis engine, and iteratively updating the behavioral fingerprints when subsequent interactions of the same attacker are identified to form a dynamic behavioral fingerprint chain characterizing the evolution of attack behavior, specifically includes: Semantic parsing is performed on the behavioral feature data to extract operation intent tags, attack method features, and attack tool features; The operation intent label, the attack method feature, and the attack tool feature are input into a pre-trained behavior encoder to generate a fixed-dimensional semantic feature vector, and a hash operation is performed on the semantic feature vector to obtain the hash value corresponding to the current interaction behavior. The similarity between the semantic feature vector and the historical semantic feature vectors corresponding to each existing attacker session is calculated to obtain the behavior pattern similarity. Based on the attacker's source IP address and the behavior pattern similarity, it is determined whether the current interaction behavior is associated with an existing attacker session. If associated, the hash value corresponding to the current interaction behavior is linked to the existing behavioral fingerprint of the attacker, and the comprehensive behavioral feature representation of the existing attacker is updated based on the semantic feature vector. If not associated, a new behavioral fingerprint chain is created for the attacker of the current interaction behavior starting from the hash value, and the semantic feature vector is used as the initial comprehensive behavioral feature representation of the attacker of the current interaction behavior.

[0040] Natural language processing (NLP) techniques are used to semantically analyze the command sequences, SQL statements, and script content input by attackers to identify their operational intentions. For example, analyzing whether the command sequence contains system information collection commands such as `whoami` and `systeminfo` determines that the attacker is in the "environment probing" phase. By analyzing the temporal patterns of behavioral sequences, the attack methods employed by the attacker can be identified. Temporal pattern recognition techniques can be used to analyze the temporal characteristics of behavioral sequences and extract attack method features. For example, by analyzing how the attacker establishes persistence mechanisms (such as creating scheduled tasks, modifying registry startup items, and implanting webshells), corresponding persistence method features can be extracted. Behavioral pattern comparison identifies the types of attack tools used by the attacker. Collected behavioral data can be matched with a database of known attack tool behavior patterns to identify whether the attacker used the Metasploit framework, Cobalt Strike tool, Mimikatz credential stealing tool, or custom malware, and extract corresponding tool feature identifiers.

[0041] After feature extraction, the discrete feature information needs to be transformed into a computable numerical representation. This embodiment employs a deep learning model to construct a behavior encoder, mapping behavior sequences to high-dimensional feature vectors. The specific process is as follows: the extracted operational intent labels, attack method features, and attack tool features are vectorized and encoded, serving as input to the behavior encoder; the behavior encoder performs deep encoding on the input features, outputting a fixed-dimensional semantic feature vector. The semantic feature vector can be a 256-dimensional continuous numerical vector with the following characteristics: similar or identical attack methods are close in the vector space, while different attack methods are far apart. This characteristic is achieved through contrastive learning training. By constructing a behavior sequence encoder and using contrastive learning to train the fingerprint extraction network, it is ensured that fingerprints with the same attack method have high similarity, and fingerprints with different attack methods have strong discriminative power; the generated semantic feature vector is subjected to SHA256 hashing to obtain a fixed-length hash value. The behavior fingerprint is generated using the SHA256 hash algorithm to ensure the immutability of the evidence.

[0042] In real-world attack scenarios, the same attacker may launch attacks through different IP addresses (e.g., using proxies or jump servers) or interact with different honeybee nodes at different time periods. To achieve continuous tracking of the same attacker across sessions and time periods, this application establishes a session association judgment mechanism. Specifically: the similarity between the semantic feature vector corresponding to the current interaction behavior and the comprehensive behavioral feature representation corresponding to each existing attacker session is calculated. This comprehensive behavioral feature representation is the fusion result of multiple semantic feature vectors generated by the attacker's historical interaction behavior, reflecting the attacker's overall behavioral pattern. The similarity calculation can use a cosine similarity algorithm, outputting a similarity score between 0 and 1, with a higher score indicating a closer similarity in behavioral patterns. The source IP address of the current interaction behavior is extracted and matched with the source IP addresses of each existing attacker session. The behavioral pattern similarity score and the source IP address matching results are comprehensively evaluated to determine whether the current interaction behavior is associated with an existing attacker session. By setting a reasonable association threshold, a balance can be achieved between accuracy and recall.

[0043] Based on the association determination results, the following processes are performed: If the current interaction behavior is determined to be associated with an existing attacker session, the following operations are performed: Link the hash value corresponding to the current interaction behavior to the end of the attacker's existing behavioral fingerprint chain, continuously extending the behavioral fingerprint chain. Through time series analysis of the evidence chain, the attack timeline can be reconstructed. This behavioral fingerprint chain constitutes a chronologically ordered, immutable miniature evidence chain. The semantic feature vector generated by the current interaction behavior is used to incrementally update the attacker's comprehensive behavioral feature representation. The update method can be weighted average, exponential moving average, or other fusion algorithms, enabling the comprehensive behavioral feature representation to dynamically reflect the evolution of the attacker's behavioral patterns. If the current interaction behavior is determined not to be associated with any existing attacker session, it is determined that the current interaction behavior originates from a new attacker, and the following operations are performed: Starting with the hash value corresponding to the current interaction behavior, create a new behavioral fingerprint chain for the attacker. Use the semantic feature vector corresponding to the current interaction behavior as the initial comprehensive behavioral feature representation of the attacker, serving as the benchmark for subsequent behavioral association determinations.

[0044] In some embodiments, the behavior encoder is trained through the following steps: Construct a training sample set, which includes multiple sets of attack behavior sequence samples extracted from historical honeybee interaction data. Each set of attack behavior sequence samples includes operation intent labels, attack method labels, and attack tool labels. Two sets of attack behavior sequence samples belonging to the same attack method are used as positive sample pairs, and two sets of attack behavior sequence samples belonging to different attack methods are used as negative sample pairs to construct comparative learning training data. The positive sample pairs and the negative sample pairs are input into the behavior encoder network to be trained. The network parameters of the behavior encoder network are optimized by maximizing the similarity of the positive sample pairs in the feature space and minimizing the similarity of the negative sample pairs in the feature space. When the loss function converges to a preset threshold, a pre-trained behavior encoder is obtained. The behavior encoder is used to map the input attack behavior features into a fixed-dimensional semantic feature vector with discriminative power.

[0045] Multiple attack behavior sequence samples were extracted from the historical honeybee interaction database. Each attack behavior sequence sample corresponds to a complete attack interaction session or a continuous behavior segment with independent meaning. For each sample, it was labeled by an automated labeling tool. The labeling information included: (1) Operation intent label: identifying the core intent of the attacker reflected in the behavior sequence, such as "information gathering", "vulnerability exploitation", etc. (2) Attack method label: identifying the specific attack techniques or methods used by the attacker, such as "SQL injection", "weak password brute force", etc. (3) Attack tool label: identifying the known attack tools or malware families used by the attacker, such as "Metasploit", "Cobalt Strike", etc. Two attack behavior sequence samples were randomly selected from the training sample set. If the attack method labels of the two samples were the same (i.e., they belonged to the same attack method category), then the two samples would be considered as a positive sample pair. For example, two attack behavior sequence samples both labeled as "SQL injection" would be considered as a positive sample pair. Two sets of attack behavior sequence samples are randomly selected from the training sample set. These two sets of samples have different attack method labels (i.e., belong to different attack method categories), and are then considered a negative sample pair. For example, a sample labeled "SQL injection" and a sample labeled "weak password brute-force" constitute a negative sample pair. The constructed positive and negative sample pairs are then input into the behavior encoder network to be trained iteratively. The behavior encoder network can adopt a Transformer-based sequence encoder, a convolutional neural network-based temporal encoder, or a recurrent neural network-based structure. Its input is vectorized attack behavior sequence features, and its output is a fixed-dimensional semantic feature vector. During training, for each input sample pair (including positive and negative sample pairs), the behavior encoder encodes both samples separately, outputting the corresponding semantic feature vector. The similarity between the two semantic feature vectors is calculated, typically using cosine similarity as the similarity metric. Based on the calculated similarity, a contrastive loss function is constructed. The optimization objective is: for positive sample pairs, maximize the similarity between the two feature vectors; for negative sample pairs, minimize the similarity between the two feature vectors. The parameters of the behavior encoder network are continuously updated using the backpropagation algorithm and gradient descent optimizer, gradually reducing the loss function value. During training, the performance of the loss function on the validation set is continuously monitored and compared. Training stops when the loss function value drops to a preset convergence threshold, or no longer significantly decreases over multiple consecutive training epochs, resulting in a pre-trained behavior encoder model. The pre-trained behavior encoder possesses the following capability: it can map any input attack behavior features, composed of operation intent labels, attack method features, and attack tool features, into a fixed-dimensional semantic feature vector.

[0046] In some embodiments, the step of calculating the similarity between the semantic feature vector and the historical semantic feature vectors corresponding to existing attacker sessions to obtain behavioral pattern similarity, and determining whether the current interaction behavior is associated with an existing attacker session based on the attacker's source IP address and the behavioral pattern similarity, specifically includes: Extract the attacker's source IP address corresponding to the current interaction behavior, and match it with the source IP addresses of existing attacker sessions to obtain the source IP address matching results; Calculate the cosine similarity between the semantic feature vector corresponding to the current interaction behavior and the comprehensive behavioral feature representation corresponding to each existing attacker session, and use it as the behavioral pattern similarity score. The source IP address matching result and the behavior pattern similarity score are weighted and fused to obtain a comprehensive association confidence score. The source IP address matching result is represented by a Boolean value, and the behavior pattern similarity score is a continuous value. Determine whether the comprehensive association confidence score exceeds a preset association threshold. If it does, determine that the current interaction behavior is associated with the corresponding attacker session; otherwise, determine that it is not associated.

[0047] When the behavior analysis engine receives the behavior feature data corresponding to the current interaction, it extracts the attacker's source IP address from the data. This source IP address is then compared one by one with the source IP addresses recorded in existing attacker sessions within the system. Existing attacker sessions refer to the set of attacker interaction records that have been identified and have had their behavior fingerprint chains created by the behavior analysis engine. Each session record stores the source IP address of the attacker's first or most recent appearance. The source IP address matching result is represented by a Boolean value: if the current source IP address is exactly the same as the source IP address of an existing session, the matching result is "true" (quantized to 1); if the current source IP address is different from the source IP address of an existing session, the matching result is "false" (quantized to 0). Each attacker interaction generates a fixed-dimensional semantic feature vector through a pre-trained behavior encoder. For existing attacker sessions, the system stores a comprehensive behavior feature representation corresponding to that session. This comprehensive behavior feature representation is the fusion result of multiple semantic feature vectors generated from the attacker's various interactions, reflecting the attacker's overall behavioral pattern characteristics. For each existing attacker session, the cosine similarity between the semantic feature vector corresponding to the current interaction behavior and the comprehensive behavioral feature representation corresponding to that session is calculated. The formula for calculating the cosine similarity is as follows: Cosine Similarity = (A·B) / (||A||×||B||). Where A represents the semantic feature vector corresponding to the current interaction behavior, B represents the comprehensive behavioral feature representation corresponding to the existing session, "·" represents the dot product operation of the vectors, and ||A|| and ||B|| represent the magnitudes of the vectors, respectively. The cosine similarity ranges from [-1, 1], where a value of 1 indicates that the two vectors are completely aligned in direction and have identical behavioral patterns; a value of 0 indicates that the two vectors are orthogonal and have no correlation in behavioral patterns; and a value of -1 indicates that the two vectors are completely opposite in direction. The calculated cosine similarity is used as the behavioral pattern similarity score corresponding to the existing session. The comprehensive association confidence score = α × source IP address matching result + β × behavioral pattern similarity score, where α is the source IP address matching weight coefficient, β is the behavioral pattern similarity weight coefficient, and α + β = 1. The specific values ​​of the weighting coefficients can be configured according to the actual application scenario: in intranet environments or scenarios with relatively fixed IP addresses, the α value can be appropriately increased; in internet egress environments or scenarios where attackers commonly use proxies, the β value can be appropriately increased. For example, in one embodiment, α=0.3 and β=0.7 are set. If the current interaction behavior matches the source IP address of an existing session with a result of "true" (value 1), and the behavior pattern similarity score is 0.85, then the comprehensive association confidence score = 0.3×1 + 0.7×0.85 = 0.895.Through the aforementioned weighted fusion mechanism, a combination of qualitative evidence (whether the source IP matches) and quantitative features (behavioral similarity) is effectively achieved, ensuring that the association judgment considers both network layer identity information and fully reflects the pattern characteristics of the attack behavior itself. After calculating the comprehensive association confidence score between the current interaction behavior and each existing attacker session, the highest score is compared with a preset association threshold. The association threshold is a configurable parameter with a value range of [0, 1]. If the highest comprehensive association confidence score is greater than or equal to the preset association threshold, the current interaction behavior is determined to be associated with the existing attacker session corresponding to that score, and the association case processing flow is initiated; if the highest comprehensive association confidence score is less than the preset association threshold, or there are no existing attacker sessions in the system, the current interaction behavior is determined not to be associated with any existing session, and the non-association case processing flow is initiated.

[0048] In some embodiments, the step of learning node representations and reasoning about relationships in the attack event graph using a graph neural network to identify the attacker's attack path, attack source, and associated attack events specifically includes: The honeybeacon nodes, attacker IP nodes, attack tool nodes, and attack behavior nodes in the attack event graph are initialized as graph nodes, and each node is embedded and initialized based on the semantic feature vector in the behavior fingerprint. A graph attention network is used to perform multi-layer convolution on the attack event graph to learn the hidden layer representation of each node, and the feature information of neighboring nodes is aggregated through an attention mechanism. Based on the hidden layer representation, a link prediction model is used to calculate the probability that there is an attack association between any two nodes, and an attack path candidate set is constructed based on the probability score. A Bayesian inference algorithm is used to calculate the probability of each path in the candidate attack path set, and the path with the highest probability is selected as the final attack path. The attack source is then identified by tracing back along the path.

[0049] The attack graph uses attack events, attacker IPs, attack tools, and attack targets as graph nodes, and establishes relationships through edge connections. Specifically, the following node types are defined: (1) Honeypot node: represents a honeypot instance accessed or attacked by the attacker. Node attributes include honeypot node identifier, honeypot type (such as Web service honeypot, database honeypot, file honeypot, etc.), deployment location, etc. (2) Attacker IP node: Node attributes include IP address, geographical location information, operator information, threat intelligence markers, etc. (3) Attack tool node: represents the attack tools or malware used by the attacker during the interaction. Node attributes include tool name, tool type, known vulnerability exploitation characteristics, etc. (4) Attack behavior node: represents a specific interaction behavior between the attacker and the honeypot node. Node attributes include behavior occurrence time, behavior type (such as command execution, file download, port scanning, etc.), and corresponding behavior fingerprint information. The embodiments of this application use Graph Attention Network (GAT) to learn node embedding. In the initialization phase, the semantic feature vector in the behavior fingerprint is used to embed and initialize the relevant nodes. For example, for attack behavior nodes, the semantic feature vector corresponding to the behavior is directly used as the initial embedding representation of the node; for attacker IP nodes, the mean or weighted sum of the semantic feature vectors of all associated attack behaviors under that IP address can be used as the initial embedding representation; for attack tool nodes, initialization can be based on the known feature vectors or associated behavior features of the tool. After completing the graph construction and node initialization, a graph attention network is used to perform multi-layer graph convolution operations on the graph to learn the deep hidden layer representations of each node. The graph attention network is used to learn node embeddings, and the TransE model is used to learn the relationship representation between nodes. The core idea of ​​the graph attention network is to assign differentiated attention weights to different neighbor nodes when aggregating neighbor node information, thereby highlighting the neighbor information that is more important to the current node representation. For example, for any node i in the graph and its neighbor node j, the attention coefficient between them is calculated. Based on the calculated attention coefficient, the feature vectors of the neighbor nodes are weighted and summed as the aggregated neighbor information representation. The attention mechanism makes neighbor nodes closely related to the current node contribute more weight, while nodes with weaker relationships or noise have smaller weights. The node's own feature representation is fused with aggregated neighbor information, and a new hidden layer representation of the node is obtained through nonlinear transformation. By stacking multiple layers of graph attention networks, each node can gradually aggregate neighbor information from a wider range, so that the final hidden layer representation of the node can reflect its structural position and semantic role in the entire attack graph. After obtaining the hidden layer representation of each node, it is necessary to infer the potential relationships between nodes in the graph. The attack path is essentially a series of ordered node connection sequences, such as: attacker IP node → attack behavior node (vulnerability exploitation) → honeybeacon node A → attack behavior node (lateral movement) → honeybeacon node B.To discover potential attack paths, link prediction models can be used to assess the probability of attack associations between nodes. For example, for any two nodes in the graph, their hidden layer representations are extracted, and feature representations of the node pair are constructed through vector concatenation, dot product, or bilinear transformation. These feature representations are then input into a link prediction model (such as a multilayer perceptron or logistic regression classifier), which outputs a probability score indicating an attack association between the two nodes. This probability score reflects the likelihood of an attack step from one node to another in terms of the temporal and logical relationship of the attack events. Based on the calculated node pair association probability, a path search algorithm is used to start from a known attack origin (such as the IP node where the attacker first appears) and gradually expand along edges with higher probability scores, generating multiple possible attack paths and forming a candidate set of attack paths. This candidate set contains multiple possible attack paths, and the most reasonable one needs to be selected as the source tracing conclusion. In the source tracing inference stage, a Bayesian inference algorithm is used to calculate the probability of the attack path and identify the most likely attack source and attack path. Prior probability distributions can be set for each type of attack step based on historical attack data and threat intelligence, reflecting their statistical frequency in real attacks. Based on the observed node features and edge relationships in the attack event graph, the likelihood probability of observing current evidence data is calculated given a specific attack path. Evidence data includes timestamps of events, access sequences of honeybee nodes, and usage records of attack tools. Using Bayes' theorem, combined with prior and likelihood probabilities, the posterior probability of each candidate attack path is calculated. The posterior probability reflects the credibility of the attack path as a genuine attack path given all observed evidence. The posterior probabilities of each candidate path are compared, and the path with the highest probability is selected as the final attack path. After determining the final attack path, the starting node of the attack path is located by tracing back along the path. The attacker's IP address or attack entry point corresponding to this starting node is the source of the attack. Simultaneously, subgraph matching techniques can be used to identify related attack events similar to the current attack event, further expanding the breadth of the source tracing analysis.

[0050] In some embodiments, generating a source tracing analysis report based on the attacker's multi-dimensional profile and the verification interface pointing to the corresponding evidence storage information in the blockchain ledger includes: Extract all hash values ​​referenced during the source tracing analysis, and obtain the corresponding notarized transaction hash and block height of each hash value in the blockchain ledger; For each evidence-stored transaction, a corresponding proof path is requested from the blockchain node based on the evidence-stored transaction hash and the block height. The proof path is used to verify that the evidence-stored information corresponding to the evidence-stored transaction is indeed included in the block identified by the block height. The attacker's multidimensional profile, attack path visualization map, evidence timeline, and proof path are integrated to generate a source tracing analysis report; One or more verification interfaces are embedded in the traceability analysis report. The verification interface is configured to receive an external verification request, call the blockchain node application interface to query the authenticity of the corresponding evidence information, and return the verification result.

[0051] The system traverses all key nodes and edges involved in the source tracing analysis to identify all attack behavior records that support the source tracing conclusions. This includes attack behaviors corresponding to each step of the final attack path, attack behaviors corresponding to similar attack events used for correlation analysis, and key behavioral feature sources used to generate attacker profiles. For each attack behavior record, the system extracts the hash value contained in its generated behavioral fingerprint. After the smart contract is executed, a certificate of evidence is generated, containing information such as block height, transaction hash, and on-chain time. Based on the extracted hash values, the system initiates query requests to blockchain nodes to obtain the corresponding evidence transaction hash and block height in the blockchain ledger. The evidence transaction hash is the unique identifier of the evidence transaction on the blockchain, and the block height identifies the transaction's position in the block. After obtaining the evidence transaction hash and block height, the system further generates a cryptographic proof path for each evidence transaction. A consortium blockchain architecture is adopted, and the blockchain ledger organizes transactions within a block using a Merkle tree structure. A Merkle tree is a binary tree structure where leaf nodes are the hash values ​​of transaction data, internal nodes are the hash values ​​of combinations of their child node hash values, and the root node hash value is recorded in the block header. The system initiates a Merkle proof path generation request to the blockchain nodes based on the transaction hash and block height. The blockchain nodes, according to the request parameters, locate the block containing the transaction and, based on the block's Merkle tree structure, generate a proof path from the leaf node corresponding to the transaction to the Merkle root node. The proof path includes a series of sibling node hash values ​​required to traverse upwards from the target transaction's leaf node to the root node. The verifier only needs the target transaction's hash value and the proof path to recalculate the Merkle root hash value and compare it with the actual Merkle root hash value recorded in the block header. If they match, it proves that the target transaction does exist in the block and that its content has not been tampered with. The generation of the Merkle proof path does not require trust in any centralized institution; its correctness relies entirely on the cryptographic properties of the hash function. Any third party can independently complete the verification process without accessing the complete blockchain ledger data. After completing the above preparations, the system will structurally integrate the various analysis results and evidence materials to generate a complete source tracing analysis report. The report includes evidence chains, attack graphs, source tracing conclusions, threat profiles, and handling recommendations. The integrated content includes: (1) Multi-dimensional attacker profile: including comprehensive attacker profile information generated by combining threat intelligence database. This profile includes the attacker's technical level assessment (basic / intermediate / advanced), suspected organization affiliation (such as APT28, Lazarus, etc.), attack motive analysis (economic interests / theft / sabotage), and confidence scores for each dimension.(2) Attack Path Visualization Map: The complete attack path identified is displayed graphically, including the nodes (honeybean nodes, attack tools, attack behaviors, etc.) and their connections from the initial intrusion to the final attack target. (3) Evidence Timeline: The attack timeline is reconstructed based on the time series analysis of the evidence chain. The evidence timeline arranges the interaction behaviors between the attacker and each honeybean node in chronological order, and marks the occurrence time, behavior type, involved nodes and corresponding behavior fingerprint information of each behavior. (4) Proof Path Information: The proof path of each evidence transaction is embedded as a component of the report. The report can indicate the evidence transaction hash, block height and Merkle proof path data corresponding to each key piece of evidence. The embodiment of this application embeds a convenient verification interface in the source tracing analysis report. The verification interface can be presented in various forms. For example, it can be embedded in an electronic PDF report with a clickable Uniform Resource Locator (URL) link pointing to a publicly accessible blockchain explorer page displaying detailed information about the corresponding notarized transaction; it can be embedded in the report with a QR code, which, when scanned, directly redirects to the verification page; or it can provide sample code for API calls within the report for technical users to automate the verification process. The verification interface is configured to receive external verification requests. When a verifier (such as a regulatory agency or partner security vendor) clicks a link, scans a QR code, or calls the API, the verification interface automatically invokes a pre-defined blockchain node API to initiate a query request to the blockchain network, checking whether the notarized information pointed to by the hash of the corresponding notarized transaction truly exists in the blockchain ledger.

[0052] In some embodiments, generating a multi-dimensional attacker profile by combining a threat intelligence database includes: The identified attack tool characteristics, attack method characteristics, and attack time patterns are matched with the characteristics of known attack organizations stored in the threat intelligence database to determine the suspected organization affiliation of the attacker and the corresponding confidence level. Based on the vulnerability exploitation methods, lateral movement techniques, and privilege escalation paths used by the attackers, assess the attackers' skill level. Based on the types of honeybeacon nodes accessed by the attacker, the keywords searched, and the types of decoy files downloaded, the attacker's attack motives can be inferred. The suspected organization affiliation, the technical level, and the attack motive category are combined to generate a comprehensive attacker profile, with confidence scores for each dimension added.

[0053] Three key features are extracted from the identified attack behaviors: (1) Attack tool features: the attack tools or malware families used by the attacker during the interaction with the honeybeacon. (2) Attack method features: the attack techniques and methods adopted by the attacker. (3) Attack time pattern: the temporal pattern of the attacker's activities, including the time zone preference of the attack, the distribution of weekdays / non-weekdays, the duration of the attack activities, etc. The extracted features are compared with the features of known attack organizations stored in the threat intelligence database in multiple dimensions. The threat intelligence database supports intelligence collection and updating (obtained from public intelligence sources and community sharing channels) and intelligence association query (associated with the source tracing results). The matching process can use methods such as rule matching, similarity calculation or machine learning classifiers to calculate the comprehensive matching degree between the current attacker features and the features of each known attack organization. Based on the matching degree, the most likely suspected organization affiliation of the attacker is determined (such as known APT organizations such as APT28, Lazarus, Kimsuky, Winnti, etc.), and the corresponding confidence score is output. The confidence score is a value between 0 and 1, reflecting the credibility of the affiliation determination. When an attacker's characteristics partially match multiple known organizations, multiple candidate organizations and their corresponding confidence levels can be output. The attacker's technical skill level is assessed by analyzing the technical complexity displayed during the attack. Specific assessment dimensions include: analyzing the types and difficulty of vulnerabilities exploited by the attacker. For example, using publicly available exploit frameworks (such as the Metasploit module) to attack known vulnerabilities typically corresponds to a lower level of skill; using zero-day vulnerabilities, constructing customized exploit code, and bypassing modern operating system protection mechanisms (such as ASLR and DEP) indicate a higher level of skill. Analyzing the techniques used by the attacker for lateral movement within the honeypot network. For example, using only common network scanning and weak password brute-force corresponds to a beginner level; using credential theft and reuse techniques such as Pass-the-Hash and Pass-the-Ticket corresponds to an intermediate level; using domain controller persistence and advanced lateral movement techniques such as Golden Ticket and Skeleton Key corresponds to an advanced level. Analyzing the techniques used by the attacker to escalate from an initial low-privilege account to system-level privileges. For example, exploiting known local privilege escalation vulnerabilities corresponds to the beginner level; using operating system features such as token theft and process injection for privilege escalation corresponds to the intermediate level; and using low-level techniques such as kernel vulnerabilities and driver loading for privilege escalation corresponds to the advanced level. Based on the evaluation results of these dimensions, attackers' skill levels are divided into three levels: beginner, intermediate, and advanced, with the possibility of additional fine-grained quantitative scoring. Attack motivation is analyzed based on the attack target and characteristics of attack behavior. Specific inferences include analyzing the types of honeypot nodes that attackers actively access or heavily interact with.For example, attackers primarily accessing database and file server honeypots may have data theft motives; attackers primarily accessing domain controller and operations management honeypots may intend to gain system control or cause damage; attackers primarily accessing source code management and R&D environment honeypots may have intellectual property theft motives. Analyze the search commands or keywords executed or entered by attackers in the honeypot system. For example, searching for words like "password," "credential," and "secret" indicates an intent to steal credentials; searching for words like "customer," "userdata," and "financial" indicates an intent to steal commercial data. Analysis of decoy file downloads: Analyze the types and content of decoy files downloaded by attackers. Fake files containing sensitive information are deployed in the honeypot environment. If attackers primarily download customer information tables and financial statements, their motive is inferred to be commercial espionage; if they download system configuration files and network topology diagrams, their motive is inferred to be intelligence gathering or preparation for subsequent attacks. Based on the above analysis results, attackers' motives can be categorized into economic interests, espionage, and damage, and primary and secondary motives can be labeled. After completing the independent analysis of the three dimensions mentioned above, the results of each dimension are integrated to generate a structured comprehensive attacker profile. Suspected organization affiliation, technical skill level, and attack motive category are used as the three core dimensions of the attacker profile, organized according to a pre-defined data structure. A corresponding confidence score is attached to each profile dimension. The confidence score reflects the credibility of the analysis conclusions for that dimension, and its calculation method is related to the analysis process of the corresponding dimension. For example, the confidence score for the organization affiliation dimension comes from the similarity score of threat intelligence matching; the confidence score for the technical skill level dimension comes from the consistency and sufficiency of the evaluation indicators; and the confidence score for the attack motive dimension comes from the certainty of the behavioral target analysis. The above three dimensions and their confidence scores are integrated to generate a comprehensive attacker profile.

[0054] The above describes the intelligent threat tracing method based on honey tag trapping and blockchain evidence storage in the embodiments of this application. The computer system in the embodiments of this application will be described in detail below in conjunction with the above-mentioned intelligent threat tracing method based on honey tag trapping and blockchain evidence storage.

[0055] Please see Figure 7 This is a schematic diagram of an exemplary hardware structure of a computer system in an embodiment of this application.

[0056] In some embodiments, the computer system 700 includes a computer device, which may be a terminal device. The computer device includes a processor 701, a memory 702, a sensor module 703, a communication module 704, an input device 705, and an output device 706 connected via a system bus. The processor 701 of the computer device provides computing and control capabilities. The memory 702 of the computer device includes a non-volatile storage medium and internal memory. The non-volatile storage medium stores an operating system, computer programs, and a database. The internal memory provides an environment for the operation of the operating system and computer programs in the non-volatile storage medium. The database is used to store data.

[0057] Those skilled in the art will understand that Figure 7 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0058] In some embodiments of this application, a computer-readable storage medium is provided, including instructions that, when executed on the computer system 700, cause the computer system 700 to execute the intelligent threat tracing method based on honey tag trapping and blockchain evidence storage as described in this application.

[0059] In some embodiments of this application, a computer program product is also provided, which, when run on a computer system 700, causes the computer system 700 to execute the intelligent threat tracing method based on honey tag trapping and blockchain evidence storage as described in this application.

[0060] The above-described embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit it. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of this application.

Claims

1. A smart threat tracing method based on honey tag trapping and blockchain evidence storage, characterized in that, include: Deploy distributed honeybee nodes in the target network environment, the honeybee nodes being configured to simulate a real business environment to lure and capture attack behaviors; When an attacker is detected to be interacting with any honeybee node, a behavior collector deployed locally on the honeybee node collects multi-dimensional behavior data in real time. After adding a timestamp and honeybee node identifier to the behavior data, the behavior feature data is encrypted and transmitted to the server as a behavior analysis engine. The behavior analysis engine extracts attack behavior patterns from the behavior feature data and generates behavior fingerprints. When subsequent interaction behaviors of the same attacker are identified, the behavior fingerprints are iteratively updated to form a dynamic behavior fingerprint chain that characterizes the evolution of attack behavior. The hash value, timestamp, and honeymark node identifier of each honeymark node in the behavioral fingerprint chain are written into the blockchain ledger as evidence storage information. In response to the source tracing command, based on the evidence information associated with the target attack event obtained from the blockchain ledger, an attack event graph is constructed. The graph neural network is used to learn node representations and reason about relationships in the attack event graph to identify the attacker's attack path, attack source and associated attack events, and a multi-dimensional profile of the attacker is generated by combining the threat intelligence database. A source tracing analysis report is generated based on the attacker's multi-dimensional profile and the verification interface pointing to the corresponding evidence storage information in the blockchain ledger.

2. The method according to claim 1, characterized in that, The process involves extracting attack behavior patterns from the behavioral feature data using the behavior analysis engine and generating behavioral fingerprints. When subsequent interactions by the same attacker are identified, the behavioral fingerprints are iteratively updated to form a dynamic behavioral fingerprint chain characterizing the evolution of attack behavior. Specifically, this includes: Semantic parsing is performed on the behavioral feature data to extract operation intent tags, attack method features, and attack tool features; The operation intent label, the attack method feature, and the attack tool feature are input into a pre-trained behavior encoder to generate a fixed-dimensional semantic feature vector, and a hash operation is performed on the semantic feature vector to obtain the hash value corresponding to the current interaction behavior. The similarity between the semantic feature vector and the historical semantic feature vectors corresponding to each existing attacker session is calculated to obtain the behavior pattern similarity. Based on the attacker's source IP address and the behavior pattern similarity, it is determined whether the current interaction behavior is associated with an existing attacker session. If associated, the hash value corresponding to the current interaction behavior is linked to the existing behavioral fingerprint of the attacker, and the comprehensive behavioral feature representation of the existing attacker is updated based on the semantic feature vector. If not associated, a new behavioral fingerprint chain is created for the attacker of the current interaction behavior starting from the hash value, and the semantic feature vector is used as the initial comprehensive behavioral feature representation of the attacker of the current interaction behavior.

3. The method according to claim 2, characterized in that, The behavior encoder is trained through the following steps: Construct a training sample set, which includes multiple sets of attack behavior sequence samples extracted from historical honeybee interaction data. Each set of attack behavior sequence samples includes operation intent labels, attack method labels, and attack tool labels. Two sets of attack behavior sequence samples belonging to the same attack method are used as positive sample pairs, and two sets of attack behavior sequence samples belonging to different attack methods are used as negative sample pairs to construct comparative learning training data. The positive sample pairs and the negative sample pairs are input into the behavior encoder network to be trained. The network parameters of the behavior encoder network are optimized by maximizing the similarity of the positive sample pairs in the feature space and minimizing the similarity of the negative sample pairs in the feature space. When the loss function converges to a preset threshold, a pre-trained behavior encoder is obtained. The behavior encoder is used to map the input attack behavior features into a fixed-dimensional semantic feature vector with discriminative power.

4. The method according to claim 2, characterized in that, The step of calculating the similarity between the semantic feature vector and the historical semantic feature vectors corresponding to existing attacker sessions to obtain behavioral pattern similarity, and determining whether the current interaction behavior is associated with an existing attacker session based on the attacker's source IP address and the behavioral pattern similarity, specifically includes: Extract the attacker's source IP address corresponding to the current interaction behavior, and match it with the source IP addresses of existing attacker sessions to obtain the source IP address matching results; Calculate the cosine similarity between the semantic feature vector corresponding to the current interaction behavior and the comprehensive behavioral feature representation corresponding to each existing attacker session, and use it as the behavioral pattern similarity score. The source IP address matching result and the behavior pattern similarity score are weighted and fused to obtain a comprehensive association confidence score. The source IP address matching result is represented by a Boolean value, and the behavior pattern similarity score is a continuous value. Determine whether the comprehensive association confidence score exceeds a preset association threshold. If it does, determine that the current interaction behavior is associated with the corresponding attacker session; otherwise, determine that it is not associated.

5. The method according to claim 1, characterized in that, The step of learning node representations and reasoning about relationships in the attack event graph using a graph neural network to identify the attacker's attack path, attack source, and related attack events specifically includes: The honeybeacon nodes, attacker IP nodes, attack tool nodes, and attack behavior nodes in the attack event graph are initialized as graph nodes, and each node is embedded and initialized based on the semantic feature vector in the behavior fingerprint. A graph attention network is used to perform multi-layer convolution on the attack event graph to learn the hidden layer representation of each node, and the feature information of neighboring nodes is aggregated through an attention mechanism. Based on the hidden layer representation, a link prediction model is used to calculate the probability that there is an attack association between any two nodes, and an attack path candidate set is constructed based on the probability score. A Bayesian inference algorithm is used to calculate the probability of each path in the candidate attack path set, and the path with the highest probability is selected as the final attack path. The attack source is then identified by tracing back along the path.

6. The method according to claim 1, characterized in that, The process of generating a source tracing analysis report based on the attacker's multi-dimensional profile and the verification interface pointing to the corresponding evidence storage information in the blockchain ledger includes: Extract all hash values ​​referenced during the source tracing analysis, and obtain the corresponding notarized transaction hash and block height of each hash value in the blockchain ledger; For each evidence-stored transaction, a corresponding proof path is requested from the blockchain node based on the evidence-stored transaction hash and the block height. The proof path is used to verify that the evidence-stored information corresponding to the evidence-stored transaction is indeed included in the block identified by the block height. The attacker's multidimensional profile, attack path visualization map, evidence timeline, and proof path are integrated to generate a source tracing analysis report; One or more verification interfaces are embedded in the traceability analysis report. The verification interface is configured to receive an external verification request, call the blockchain node application interface to query the authenticity of the corresponding evidence information, and return the verification result.

7. The method according to claim 1, characterized in that, The generation of a multi-dimensional attacker profile by combining the threat intelligence database includes: The identified attack tool characteristics, attack method characteristics, and attack time patterns are matched with the characteristics of known attack organizations stored in the threat intelligence database to determine the suspected organization affiliation of the attacker and the corresponding confidence level. Based on the vulnerability exploitation methods, lateral movement techniques, and privilege escalation paths used by the attackers, assess the attackers' skill level. Based on the types of honeybeacon nodes accessed by the attacker, the keywords searched, and the types of decoy files downloaded, the attacker's attack motives can be inferred. The suspected organization affiliation, the technical level, and the attack motive category are combined to generate a comprehensive attacker profile, with confidence scores for each dimension added.

8. A computer system comprising a memory, a processor, and a computer program stored in the memory, characterized in that, The processor executes the computer program to implement the steps of the method according to any one of claims 1-7.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1-7.

10. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1-7.

Images