A delay type security disposal method based on attack stage cost value game

Abstract

The application provides a delay type security disposal method based on attack stage cost value game, comprising the following steps: S1, capturing and identifying attacks; S2, multi-dimensional quantitative calculation of attack cost AIC; S3, monitoring of controlled asset exposure value DEV and DEV security threshold, and delimitation of security margin; S4, modeling of optimal break time OBP: finding a time threshold value at which the attack cost ratio is the lowest and the amount of information obtained by the defense side is the largest, judging attack value and processing method; S5, execution of delay type security disposal and solidification of attack characteristics; and S6, generation of attack portrait and updating of global linkage defense strategy. The application solves the problem of the traditional defense early exposure strategy by quantifying the attack cost to guide the disposal time; in combination with a virtual shadow system and delay blocking logic, the integrity of the traceability is greatly enhanced, the behavior characteristics of the attack side are solidified, a global defense characteristic library is reversely generated, and active immunity of the whole network is realized.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a delayed security handling method based on cost-value game theory during the attack phase. Background Technology

[0002] Existing network defense methods mostly adopt an "instantaneous trigger" model. While this ensures a fast response time, it also has some drawbacks: First, attackers can easily use low-cost probe packets (such as scanning scripts) to uncover the defense's defenses' limits. Second, premature interruption prevents defenders from obtaining the attacker's follow-up tools and real IP addresses, making countermeasures difficult. Especially when facing AI-generated phishing copy, deepfake phishing materials, automated batch generation of malicious code, and the normalization of dynamic variant attacks, traditional fixed-rule defenses cannot cope with AI-driven dynamic and personalized attacks, resulting in wasted resources and even defense failure. Summary of the Invention

[0003] To solve the above problems, the present invention adopts the following technical solution: A delayed security approach based on cost-value game theory during the attack phase includes the following steps: S1: Capture attack behavior and identify attack phases: Capture attack behavior and use traffic fingerprinting and state machine to map external attack traffic in real time into the detection phase, penetration phase, control phase and harvest phase.

[0004] Furthermore, step S1 includes the following sub-steps: S101: Capture attack behavior, extract packet payload features using deep group detection, identify whether it contains specific fingerprint information, and if so, map external attack traffic to a probe period.

[0005] Furthermore, the specific fingerprint information includes fingerprint information from detection tools such as Nmap and Masscan.

[0006] S102: For external attack traffic mapped to the probing phase, the behavior modeling of the TCP / IP protocol stack is used to identify the state transition logic from one-way probing to three-way handshake establishment and then to data interaction, and to monitor attack behavior in real time.

[0007] S103: Introducing a time series analysis algorithm to monitor the changing patterns of attack request frequency. If the attack changes from automated scanning to manual penetration, it is determined that the attacker has moved from the detection phase to the penetration phase.

[0008] S104: Establish an attack phase marker bit. When an attempt to execute a terminal command or upload a script is detected, the mapping state automatically transitions to the penetration phase.

[0009] S105: Insert a dynamic tracking token at the application layer via a reverse proxy to track the depth of the attacker's traversal of the business logic.

[0010] S106: When the attacker successfully executes remote code or establishes a stable return connection channel, the mapping state transitions to the control phase.

[0011] Furthermore, the specific criteria for determining the control period are: receiving outbound requests at the same interval multiple times consecutively, and the payload containing encrypted instruction features.

[0012] S107: During the control phase, when the attacker begins to deliver ransomware payloads, lateral movement scripts, or sensitive data downlink, the mapping state transitions to the harvest phase.

[0013] Furthermore, the specific criteria for determining the harvesting period include: detecting large file downloads, new process creation, or access to sensitive directories.

[0014] By combining traffic fingerprinting with state machines to identify the temporal state transition of attack behavior, the complete lifecycle of the attack can be reconstructed, the business stage of the attack can be distinguished, and the false alarms and missed judgments caused by isolated traffic can be avoided. It provides temporal context input for subsequent AIC cost calculation and DEV risk assessment, so that subsequent quantitative calculations are not based on instantaneous traffic, but on the attack evolution state, thereby improving the accuracy of quantitative indicators.

[0015] S2: Real-time multidimensional quantitative calculation of attacker's input cost. AIC: Calculates the cost consumed by the attacker in the current link.

[0016] Furthermore, the costs include explicit and implicit costs such as infrastructure, tool code, and time; the infrastructure includes IP addresses and servers.

[0017] Furthermore, step S2 includes the following sub-steps: S201: Identify the IP attributes of the attack source. If it is a high-cost IP, assign it a higher IP cost component.

[0018] Furthermore, the high-cost IPs include residential dial-up proxy IPs, mobile base station IPs, etc.

[0019] Furthermore, the IP cost component, IP_cost, is obtained based on the measured attributes and duration of the attack source IP. The specific calculation formula for the IP cost component, IP_cost, is as follows: IP_cost=Σ(IP_type×Duration_hours); in: Duration_hours represents the duration of the attack source IP; IP_type is the score corresponding to the IP attribute type, which is derived by regression analysis of the measured acquisition cost and abuse rate statistics of each type of IP in the threat intelligence database; If the attack source IP attribute is a residential proxy, it corresponds to IP_type=0.9; if the attack source IP attribute is a relocated IP, it corresponds to IP_type=0.7; if the attack source IP attribute is a data center, it corresponds to IP_type=0.3; and if the attack source IP attribute is a Tor exit, it corresponds to IP_type=0.5. Residential proxies have the highest actual acquisition cost and abuse rate, so they have the highest weight and are periodically refreshed as the threat intelligence database is updated.

[0020] S202: Analyze the complexity of the payload and use code entropy to determine whether the attacker has used obfuscated proprietary exploit code. If so, assign a higher code cost weight.

[0021] Furthermore, the code cost component Tool_cost is calculated based on measured information entropy of the message payload byte distribution. The specific calculation formula for the code cost component Tool_cost is as follows: Tool_cost=Payload_entropy / 8.0×Log(Payload_size+1); in: Payload_entropy is the code entropy value, ranging from 0 to 8. Pure randomness is 8.0, while unique obfuscation tools tend to have an entropy value of 7.5 or higher. Payload_size is the number of bytes of the actual payload in the data packet.

[0022] S203: Monitor the concurrency and duration of the attack link, and calculate the infrastructure resources consumed by the attacker to maintain the attack channel. The longer the concurrency and duration, the greater the time cost.

[0023] Furthermore, the time cost component, Time_cost, is calculated based on the difference in session timestamps. The specific formula for calculating the time cost component, Time_cost, is as follows: Time_cost=Elapsed_minutes / T_baseline; in: Elapsed_minutes is the duration of the attack chain; T_baseline represents the average duration of similar attacks; The longer the attack chain lasts compared to the average duration of similar attacks, the greater the investment required.

[0024] S204: Evaluate the number of attempts by the attacker to bypass WAF / IPS rules, incorporate the attacker's algorithm iteration cost into the quantization model, and quantify the algorithm iteration cost component.

[0025] Furthermore, the algorithm iteration cost component AlgoIter_cost is calculated based on the measured counts of WAF / IPS interception logs. The specific calculation formula for the algorithm iteration cost component AlgoIter_cost is as follows: AlgoIter_cost=WAF_bypass_attempts×k; Where: WAF_bypass_attempts represents the number of attempts by the attacker to bypass WAF / IPS rules; k represents the average computational cost score for each bypass attempt, which is derived from the measured statistical analysis of the average resource consumption of each WAF bypass attempt in historical attack samples, and ranges from 0.1 to 0.3.

[0026] S205: By combining the threat intelligence database, verify whether the attack signature belongs to a known family, determine the construction cost of the attacker's infrastructure, and quantify the infrastructure cost component.

[0027] Furthermore, the specific calculation formula for the infrastructure cost component Infra_cost is as follows: Infra_cost=Concurrent_channels×Bandwidth_equivalent_MBps×Persistence_hours.

[0028] in: Concurrent_channels is the number of concurrent channels in the attack chain, referring to the number of independent communication or processing channels that can work in parallel or simultaneously at the same time. Bandwidth_equivalent_MBps is the equivalent bandwidth; Persistence_hours is the retention period, used to describe the validity period of temporary resources.

[0029] S206: Summarizes the cost components of IP, code, time, algorithm iteration, and infrastructure to quantify the attacker's investment cost (AIC) in multiple dimensions.

[0030] Furthermore, the specific formula for calculating the cost of AIC (Attack Capabilities) for multidimensional quantification attacks is as follows: AIC=w1·IP_cost+w2·Tool_cost+w3·Time_cost+w4·Infra_cost+w5·AlgoIter_cost; Where w1, w2, w3, w4, and w5 are the weight coefficients corresponding to each cost component, which are obtained through regression of historical attack data. They are calibrated by regression of the correspondence between each component in the historical attack sample library and the actual attack resource consumption, and are automatically updated according to the subsequent S605 mechanism as the sample accumulates, and w1+w2+w3+w4+w5=1.

[0031] This allows for quantifiable measurement of the attacker's adversarial costs, moving beyond relying solely on attack manifestations to determine threat levels. By considering three dimensions—infrastructure, tool code, and time—it objectively reflects the amount of resources the attacker invests, indirectly revealing their strength and intent. Script-based attacks have low AIC values, while advanced custom attacks have high AIC values, providing attacker-side input variables for subsequent OBP game theory models. This supports the differentiation between high- and low-value attacks and avoids significant waste of defense resources due to low-value attacks.

[0032] S3: Real-time monitoring of controlled asset exposure value (DEV): Assess the sensitivity level of assets reached by attack paths, and calculate DEV and DEV security thresholds in conjunction with the virtual isolation environment to define the security margin in the current inducement process.

[0033] Furthermore, step S3 includes the following sub-steps: S301: Classify target assets based on the configuration management database and calculate asset sensitivity.

[0034] Furthermore, the hierarchy is divided into 1 to 5 levels, with the core database being Level 5 and the public static pages being Level 1.

[0035] Furthermore, the asset sensitivity (Asset_sensitivity) is automatically calculated by the system from the asset tier configuration in the CMDB. The specific formula for calculating asset sensitivity (Asset_sensitivity) is as follows: Asset_sensitivity=Σ(Level_i×Asset_value_i) / ΣAsset_value_i; in: i takes a positive integer, corresponding to the grade level, and ranges from 1 to 5; Level_i represents the asset level of the configuration management database, ranging from 1 to 5; Asset_value_i represents the corresponding asset value.

[0036] S302: Calculates in real time the lateral movement range that the attacker's current privileges can reach, restricts the attacker to operate only in the isolated shadow system, and determines the exposure factor in the shadow system.

[0037] Furthermore, the specific formula for calculating the exposure factor (Exposure_factor) is as follows: Exposure_factor=Reachable_assets_in_shadow / Total_target_assets; Among them: Reachable_assets_in_shadow refers to the reachable assets in the shadow system; Total_target_assets represents the total target assets.

[0038] The Exposure_factor is the proportion of accessible assets in the shadow system to the total target assets; the smaller this value, the better.

[0039] S303: Monitor whether the downlink transmission of sensitive fields is carried in the attack traffic, calculate the tolerance margin, and set the traffic red line for immediate blocking based on the tolerance margin.

[0040] The sensitive fields include ID card number, key characteristics, etc.

[0041] The specific formula for calculating the tolerance margin (Containment_margin) is as follows: Containment_margin=1-(Attacked_duration_minutes / Max_tolerable_duration); Where: Attacked_duration_minutes is the exposure duration; Max_tolerable_duration is the maximum tolerable exposure duration, typically set to 20-30 hours.

[0042] S304: Utilize virtualization technology to dynamically mount fake sensitive files for the attacker, assessing the attacker's interest in specific information.

[0043] Furthermore, the specific information refers to various decoy information in fake sensitive documents, including business asset information, operation and maintenance facility information, classified configuration information, and high-value internal documents.

[0044] S305: The computational defense system consumes computing and storage resources to maintain delayed processing, ensuring that the defense premium is not lower than the potential risk of the asset. When the defense premium is lower than the potential risk of the asset, the delayed processing is stopped and an immediate block is performed.

[0045] The defense premium is not included in the DEV calculation, but is only used as an independent feasibility constraint on whether to continue the delayed treatment.

[0046] S306: Summarize asset sensitivity, exposure factor, and tolerance margin to calculate the controlled asset exposure value (DEV) and DEV safety threshold, and immediately trigger immediate blocking when DEV exceeds the DEV safety threshold.

[0047] Furthermore, the specific formula for calculating the controlled asset exposure value (DEV) is as follows: DEV=Asset_sensitivity×Exposure_factor×Containment_margin.

[0048] The specific calculation method for the DEV safety threshold is as follows: DEV_max=Asset_sensitivity×Max_exposure_tolerance; Among them: Max_exposure_tolerance is the risk exposure tolerance threshold.

[0049] When DEV > DEV_max, immediate blocking is triggered.

[0050] By combining potential asset risks and DEV security thresholds as constraints, a risk ceiling is set during the process of delayed trapping and deceptive response to ensure that the trapping process does not affect real business assets and safeguard the bottom line of security. The risk increment brought about by the deepening of the attack path is intuitively quantified, providing defensive risk constraints for the OBP model.

[0051] S4: Optimal Interruption Timing (OBP) Modeling: Using a dynamic programming algorithm, find the time threshold where the attacker's benefit-cost ratio is lowest and the defender obtains the most information. This threshold is denoted as the Optimal Interruption Timing (OBP) point. The attack value is determined based on the Optimal Interruption Timing (OBP) point, and the handling method is determined accordingly. If it is a low-value attack, it is directly blocked; if it is a high-value attack, subsequent actions are taken. S5: Delayed Security Measures and Solidification of Attack Characteristics.

[0052] Furthermore, step S4 includes the following sub-steps: S401: Define the performance function U=f(T), where T is the delay time. Under the premise that DEV is within the safety threshold, find the time point at which the performance function U(T) reaches its maximum value, and denote it as the optimal interruption timing OBP point.

[0053] The specific formula for the efficiency function U=f(T) is as follows: U(T)=α×AIC(T)-β×DEV(T)+γ×Info_gain(T); Where: T is the delay time; α, β, and γ are the corresponding weights, α + β + γ = 1, and the initial values ​​are: α = 0.4, β = 0.4, γ = 0.2; Info_gain(T) represents the amount of information collected.

[0054] The specific calculation formula for Info_gain(T) is as follows: Info_gain(T)=k1·Behav_classes(T) / N_behav+k2·Tool_fp(T) / N_tool+ k3·Chan_confirmed(T) / N_chan+k4·IP_attrib(T); Where: Behav_classes(T) is the number of behavior classes captured up to T (TTP coverage); N_behav is the average total number of similar attack categories in the historical database; Tool_fp(T) represents the number of tool fingerprints extracted up to T; N_tool represents the average total number of tool fingerprints for similar attacks in the historical database; Chan_confirmed(T) represents the number of confirmed backlinks / C2 channels up to T; N_chan is the average number of back connections / total number of C2 channels for similar attacks in the historical database; IP_attrib(T) is the true source IP attribution confirmation score, which takes a value of 0 to 1. For proxy / Tor layers, confirmation = 1. k1~k4 are weights, and k1+k2+k3+k4=1. The regression calibration is the same as in S206 and can be updated in subsequent S605.

[0055] Provided that DEV is within a safe threshold, we seek the time point T* that maximizes the performance function U(T), i.e., we seek T* such that dU / dT = 0 and T* satisfies DEV(T*). <DEV_max。

[0056] The specific formula for calculating T* is: T*=argmaxU(T) subject to DEV(T) <DEV_max。

[0057] S402: Set a dynamic window period. If the attacker stops advancing during the penetration phase, it will be judged as a low-value attack in advance and converted to an immediate ban.

[0058] S403: Based on the average duration of similar attacks in the historical database, predict the critical point at which an attack enters the control phase.

[0059] S404: Introduces an interference factor to moderately reduce the response speed during the delay period, testing the attacker's willingness to add resources when faced with a low-quality link.

[0060] S405: Output the specific blocking command trigger threshold, which includes time span, traffic threshold and sensitive behavior counter.

[0061] Implement differentiated attack handling based on attack level: For low-AIC batch scanning and simple brute-force low-value attacks, direct and rapid blocking is implemented to reduce system computing power consumption and quickly eliminate threats; for high-value advanced attacks, they are not blocked immediately but are transferred to a delayed handling process to maximize the collection of attack samples; no manual real-time monitoring of the attack process is required, the algorithm automatically outputs the optimal handling time, which is suitable for scenarios with multiple attack sessions and concurrent processing under high traffic.

[0062] S5: Perform delayed security measures and solidify attack characteristics: Implement a simulated deception response within the security threshold, and instantly shut down the link after reaching the threshold, and fully extract and solidify the attacker's high-value tool fingerprints.

[0063] Furthermore, step S5 includes the following sub-steps: S501: Employ a simulated response during the delay period, wherein the simulated response is a logically consistent fake success message returned in response to an attacker's exploit attempt.

[0064] S502: At the moment the OBP threshold is reached, a Reset message is triggered to forcibly cut off the TCP connection, and an interception policy is simultaneously issued at the network boundary.

[0065] S503: Encapsulates all traffic data, interaction messages, and environment variable snapshots generated during the delay period into an immutable forensic file.

[0066] S504: Utilizes bypass countermeasures to attempt reverse fingerprinting of the browser or toolkit used by the attacker.

[0067] S505: Through traffic hijacking technology, it guides the attacker's subsequent retry behavior into a fully virtual honeycomb environment.

[0068] Within the DEV security threshold, output realistic deception responses, continuously interact with attackers, induce attackers to release complete tools, payloads, and exploit commands, fully stimulate the attacker's complete set of behavioral characteristics, and obtain more complete attack samples; once the risk reaches the red line, immediately terminate the session to prevent risk overflow caused by excessive trapping and ensure defense security; upon session termination, collect and solidify tool fingerprints, payload characteristics, and interactive behaviors to obtain high-value adversarial samples that cannot be obtained in ordinary interception mode, providing high-quality raw materials for subsequent attack profiling and global strategy updates.

[0069] S6: Generate attack profiles and update global coordinated defense strategies: Transform the captured complete attack features into global defense features, and achieve proactive immunity across the entire network by linking with network security gateway devices.

[0070] Furthermore, the network security gateway device includes devices such as firewalls and WAFs.

[0071] Furthermore, step S6 includes the following sub-steps: S601: Extract the unique behavioral sequences exhibited by the attacker during the penetration and control phases, and generate the unique behavioral entropy value of the attacker.

[0072] The specific calculation method for the entropy value of the unique behavior is: H = -Σp_j × log2(p_j); in: p_j represents the frequency of occurrence of the j-th type of behavior; Type j behaviors include port scanning, command execution, and file access.

[0073] Furthermore, the upper limit of H is log2 (number of behavior categories), with a maximum score of 4. When H=2.0, it is half of the maximum score, indicating that the attacker only reuses about 1 / 4 of the behavior categories (concentrated in a few categories), which is judged as machine characteristics; H=3.5 is close to the maximum score, indicating that the attacker uses almost all categories evenly, which is judged as human characteristics; H<2.0 is judged as automated tool attack, 2.0≤H≤3.5 is judged as human-machine hybrid attack, and H>3.5 is judged as human penetration.

[0074] Where p_i is obtained by statistically counting the attacker’s various behaviors during the penetration and control phases; Shannon entropy is an objective measurement formula in information theory; the judgment thresholds of 2.0 and 3.5 are determined by the measured distribution of historical attack samples.

[0075] S602: Automatically converts captured 0-day vulnerability features or novel bypass techniques into custom interception rules for the local WAF.

[0076] S603: Based on the attacker's IP associations, locate the attacking organization or botnet node to which it belongs in the global threat intelligence network.

[0077] S604: Calculate the increased attack costs resulting from this delayed security action and quantitatively assess the effectiveness of this delayed security action in improving the overall security posture.

[0078] S605: Automatically optimizes the weight coefficients of the OBP model to enable adaptive learning and evolution of the defense system.

[0079] Furthermore, S605 includes the following sub-steps: S6051: Effect Feedback Collection: After each delayed handling event ends, read S604 to collect the measured effect indicators of the event.

[0080] Furthermore, the measured performance indicators include: increased attack cost, completeness of evidence collection, actual asset exposure duration, and misjudgment markers confirmed by manual review afterward.

[0081] The increase in attack cost is the difference between the final AIC value of this attack and the average value of similar historical attacks; the completeness of evidence collection is the number of captured behavioral categories and the number of tool fingerprints.

[0082] S6052: Incremental update calculation: The deviation between the measured index and the expected target is used as a feedback signal. Incremental updates are performed on each weight according to a fixed learning rate η. After the update, the weights are renormalized so that the sum of each weight remains 1.

[0083] Furthermore, the update direction of DEV-related parameters is subject to a one-way constraint: only tightening of safety constraints is allowed, and relaxation is not permitted.

[0084] Furthermore, the specific calculation formula for incremental update is: w_new=w_old+η×∇L.

[0085] Where: w_new is the updated parameter; w_old represents the weights that need to be updated, including w1~w5, k, α, β, γ, and k1~k4; η is the update step size, which determines the magnitude of each correction, and ranges from 0.01 to 0.1; ∇L is the deviation correction term, which is the correction direction and magnitude obtained based on the deviation between the actual effect of this treatment and the expected target. The expected target is obtained from the statistics of historical treatment samples.

[0086] The specific calculation method for the deviation correction term ∇L is as follows: ∇L_n=Σ( m_n×Dev_n); Where: n represents the parameters that need to be incrementally updated; m_n is a sensitivity matrix pre-calibrated using historical attack samples; Dev_n is the deviation vector, Dev_n = (Measured index_n - Target_n) / Target_n.

[0087] The expected target, i.e., target_n, is derived from the cost distribution statistics of similar attacks in the historical sample library. The default value is taken during cold start and updated as samples accumulate, using the same mechanism as weight calibration.

[0088] S6053: Shadow Verification and Version Management: In S6052, the updated weights are first verified on the mirror traffic. Only when the processing effect is not worse than the current version will the update be officially implemented and take effect; otherwise, the update will be discarded.

[0089] Furthermore, the weights of each version are persistently stored and incremented according to the version number, supporting rollback to historical versions.

[0090] The weight setting and updating are connected with the method of weights being determined by regression from historical attack samples in S206: the initial weights determined by regression are used in the cold start phase, and continuous correction is performed by step S605 in the running phase.

[0091] The deviation correction term is updated incrementally, and the adjustment range is controlled by the learning rate to prevent drastic weight jumps and model mutations caused by a single abnormal attack sample. After the update, weight normalization is performed to ensure that the sum of all weights is always equal to 1, maintaining the mathematical form of the performance function and ensuring that the model calculation logic is not disrupted. This guarantees the compatibility of the entire AIC-DEV-OBP quantization calculation system. One-way update constraints are set for DEV-related weights: only tightening of security constraints is allowed, and relaxing of security constraints is not allowed. This prevents the algorithm from becoming aggressive after self-learning and eliminates the risk of security drift and increased exposure of real assets due to self-learning. At the same time, all weight versions are persistently stored and the version number is incremented. When model anomalies or sudden changes in the adversarial environment occur, it is possible to roll back to a historical stable version with one click, which greatly improves the robustness of the system and facilitates emergency response for operation and maintenance.

[0092] Compared with the prior art, the beneficial effects of the present invention are as follows: 1. By constructing a two-dimensional dynamic evaluation model of attacker input cost (AIC) and controlled asset exposure value (DEV), delayed handling is carried out; breaking the static defense logic of detection and blocking in the past, the timing of handling is guided by quantifying attack cost (OBP), which solves the problem of premature exposure strategy in traditional defense.

[0093] 2. By simulating responses to induce attackers to continuously increase their resource investment until they reach the "optimal breakpoint" where their technology stack is most fully exposed, a sudden block is implemented. Combined with a virtual shadow system, deep threat extraction is achieved under the premise of zero asset risk, which greatly enhances the completeness of source tracing, realizes accurate profiling of attackers, deep countermeasures, and maximizes defense effectiveness, thereby solidifying the attacker's behavioral characteristics, generating a global defense feature library in reverse, and achieving proactive immunity across the entire network. Attached Figure Description

[0094] Figure 1 This is a flowchart of Embodiment 1 of the present invention. Detailed Implementation

[0095] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings: A delayed security approach based on cost-value game theory during the attack phase includes the following steps: S1: Capture attack behavior and identify attack phases: Capture attack behavior and use traffic fingerprinting and state machine to map external attack traffic in real time into the detection phase, penetration phase, control phase and harvest phase.

[0096] Furthermore, step S1 includes the following sub-steps: S101: Capture attack behavior, extract packet payload features using deep group detection, identify whether it contains specific fingerprint information, and if so, map external attack traffic to a probe period.

[0097] Furthermore, the specific fingerprint information includes fingerprint information from detection tools such as Nmap and Masscan.

[0098] S102: For external attack traffic mapped to the probing phase, the behavior modeling of the TCP / IP protocol stack is used to identify the state transition logic from one-way probing to three-way handshake establishment and then to data interaction, and to monitor attack behavior in real time.

[0099] S103: Introducing a time series analysis algorithm to monitor the changing patterns of attack request frequency. If the attack changes from automated scanning to manual penetration, it is determined that the attacker has moved from the detection phase to the penetration phase.

[0100] S104: Establish an attack phase marker bit. When an attempt to execute a terminal command or upload a script is detected, the mapping state automatically transitions to the penetration phase.

[0101] The execution commands, such as whoami and ls.

[0102] S105: Insert a dynamic tracking token at the application layer via a reverse proxy to track the depth of the attacker's traversal of the business logic.

[0103] S106: When the attacker successfully executes remote code or establishes a stable return connection channel (such as triggering a C2 heartbeat), the mapping state transitions to the control phase.

[0104] Furthermore, the specific criteria for determining the control period are: receiving outbound requests at the same interval multiple times consecutively, and the payload containing encrypted instruction features; For example: receiving three consecutive outbound requests at the same interval (typical C2 heartbeat interval, such as 30s / 60s / 120s), and the payload contains encrypted instruction features.

[0105] S107: During the control phase, when the attacker begins to deliver ransomware payloads, lateral movement scripts, or sensitive data downlink, the mapping state transitions to the harvest phase.

[0106] Furthermore, the criteria for determining the harvesting period include: detecting large file downloads (>1MB), new process creation (execve system call), or access to sensitive directories (such as / etc / shadow).

[0107] S2: Real-time multidimensional quantitative calculation of attacker's input cost. AIC: Calculates the cost consumed by the attacker in the current link.

[0108] Furthermore, the costs include explicit and implicit costs such as infrastructure, tool code, and time; the infrastructure includes IP addresses and servers.

[0109] Furthermore, step S2 includes the following sub-steps: S201: Identify the IP attributes of the attack source. If it is a high-cost IP, assign it a higher IP cost component.

[0110] Furthermore, the high-cost IPs include residential dial-up proxy IPs, mobile base station IPs, etc.

[0111] Furthermore, the IP cost component, IP_cost, is obtained based on the measured attributes and duration of the attack source IP. The specific calculation formula for the IP cost component, IP_cost, is as follows: IP_cost=Σ(IP_type×Duration_hours); in: Duration_hours represents the duration of the attack source IP; IP_type is the score corresponding to the IP attribute type, which is derived by regression analysis of the measured acquisition cost and abuse rate statistics of each type of IP in the threat intelligence database; If the attack source IP attribute is a residential proxy, it corresponds to IP_type=0.9; if the attack source IP attribute is a relocated IP, it corresponds to IP_type=0.7; if the attack source IP attribute is a data center, it corresponds to IP_type=0.3; and if the attack source IP attribute is a Tor exit, it corresponds to IP_type=0.5. Residential proxies have the highest actual acquisition cost and abuse rate, so they have the highest weight and are periodically refreshed as the threat intelligence database is updated.

[0112] S202: Analyze the complexity of the payload and use code entropy to determine whether the attacker has used obfuscated proprietary exploit code. If so, assign a higher code cost weight.

[0113] Furthermore, the code cost component Tool_cost is calculated based on measured information entropy of the message payload byte distribution. The specific calculation formula for the code cost component Tool_cost is as follows: Tool_cost=Payload_entropy / 8.0×Log(Payload_size+1); in: Payload_entropy is the code entropy value, ranging from 0 to 8. Pure randomness is 8.0, while unique obfuscation tools tend to have an entropy value of 7.5 or higher. Payload_size is the number of bytes of the actual payload in the data packet.

[0114] S203: Monitor the concurrency and duration of the attack link, and calculate the infrastructure resources consumed by the attacker to maintain the attack channel. The longer the concurrency and duration, the greater the time cost.

[0115] Furthermore, the time cost component, Time_cost, is calculated based on the difference in session timestamps. The specific formula for calculating the time cost component, Time_cost, is as follows: Time_cost=Elapsed_minutes / T_baseline; in: Elapsed_minutes is the duration of the attack chain; T_baseline represents the average duration of similar attacks; The longer the attack chain lasts compared to the average duration of similar attacks, the greater the investment required.

[0116] S204: Evaluate the number of attempts by the attacker to bypass WAF / IPS rules, incorporate the attacker's algorithm iteration cost into the quantization model, and quantify the algorithm iteration cost component.

[0117] Furthermore, the algorithm iteration cost component AlgoIter_cost is calculated based on the measured counts of WAF / IPS interception logs. The specific calculation formula for the algorithm iteration cost component AlgoIter_cost is as follows: AlgoIter_cost=WAF_bypass_attempts×k; Where: WAF_bypass_attempts represents the number of attempts by the attacker to bypass WAF / IPS rules; k represents the average computational cost score for each bypass attempt, which is derived from the measured statistical analysis of the average resource consumption of each WAF bypass attempt in historical attack samples, and ranges from 0.1 to 0.3.

[0118] S205: By combining the threat intelligence database, verify whether the attack signature belongs to a known family, determine the construction cost of the attacker's infrastructure, and quantify the infrastructure cost component.

[0119] Furthermore, the specific calculation formula for the infrastructure cost component Infra_cost is as follows: Infra_cost=Concurrent_channels×Bandwidth_equivalent_MBps×Persistence_hours.

[0120] in: Concurrent_channels is the number of concurrent channels in the attack chain, referring to the number of independent communication or processing channels that can work in parallel or simultaneously at the same time. Bandwidth_equivalent_MBps is the equivalent bandwidth; Persistence_hours is the retention period, used to describe the validity period of temporary resources.

[0121] S206: Summarizes the cost components of IP, code, time, algorithm iteration, and infrastructure to quantify the attacker's investment cost (AIC) in multiple dimensions.

[0122] Furthermore, the specific formula for calculating the cost of AIC (Attack Capabilities) for multidimensional quantification attacks is as follows: AIC=w1·IP_cost+w2·Tool_cost+w3·Time_cost+w4·Infra_cost+w5·AlgoIter_cost; Where w1, w2, w3, w4, and w5 are the weight coefficients corresponding to each cost component, which are obtained through regression of historical attack data. They are calibrated by regression of the correspondence between each component in the historical attack sample library and the actual attack resource consumption, and are automatically updated according to the subsequent S605 mechanism as the sample accumulates, and w1+w2+w3+w4+w5=1.

[0123] S3: Real-time monitoring of controlled asset exposure value (DEV): Assess the sensitivity level of assets reached by attack paths, and calculate DEV and DEV security thresholds in conjunction with the virtual isolation environment to define the security margin in the current inducement process.

[0124] Furthermore, step S3 includes the following sub-steps: S301: Classify target assets based on the configuration management database and calculate asset sensitivity.

[0125] Furthermore, the hierarchy is divided into 1 to 5 levels, with the core database being Level 5 and the public static pages being Level 1.

[0126] Furthermore, the asset sensitivity (Asset_sensitivity) is automatically calculated by the system from the asset tier configuration in the CMDB. The specific formula for calculating asset sensitivity (Asset_sensitivity) is as follows: Asset_sensitivity=Σ(Level_i×Asset_value_i) / ΣAsset_value_i; in: i takes a positive integer, corresponding to the grade level, and ranges from 1 to 5; Level_i represents the asset level of the configuration management database, ranging from 1 to 5; Asset_value_i represents the corresponding asset value.

[0127] S302: Calculates in real time the lateral movement range that the attacker's current privileges can reach, restricts the attacker to operate only in the isolated shadow system, and determines the exposure factor in the shadow system.

[0128] Furthermore, the specific formula for calculating the exposure factor (Exposure_factor) is as follows: Exposure_factor=Reachable_assets_in_shadow / Total_target_assets; Among them: Reachable_assets_in_shadow refers to the reachable assets in the shadow system; Total_target_assets represents the total target assets.

[0129] The Exposure_factor is the proportion of reachable assets in the shadow system to the total target assets, and Exposure_factor ≤ 1.0 (the more complete the isolation, the lower the exposure), the better.

[0130] S303: Monitor whether the downlink transmission of sensitive fields is carried in the attack traffic, calculate the tolerance margin, and set the traffic red line for immediate blocking based on the tolerance margin.

[0131] The sensitive fields include ID card number, key characteristics, etc.

[0132] The specific formula for calculating the tolerance margin (Containment_margin) is as follows: Containment_margin=1-(Attacked_duration_minutes / Max_tolerable_duration); Where: Attacked_duration_minutes is the exposure duration; Max_tolerable_duration is the maximum tolerable exposure duration, typically set to 20-30 hours, such as 24 hours.

[0133] S304: Utilize virtualization technology to dynamically mount fake sensitive files for the attacker, assessing the attacker's interest in specific information.

[0134] Furthermore, the specific information refers to various decoy information within fake sensitive files, including business asset information, operation and maintenance facility information, classified configuration information, and high-value internal documents. Examples include: passwordbook.txt, operation and maintenance records, pay slips, etc.

[0135] S305: The computational defense system consumes computing and storage resources to maintain delayed processing, ensuring that the defense premium is not lower than the potential risk of the asset. When the defense premium is lower than the potential risk of the asset, the delayed processing is stopped and an immediate block is performed.

[0136] The defense premium is not included in the DEV calculation, but is only used as an independent feasibility constraint on whether to continue the delayed treatment.

[0137] S306: Summarize asset sensitivity, exposure factor, and tolerance margin to calculate the controlled asset exposure value (DEV) and DEV safety threshold, and immediately trigger immediate blocking when DEV exceeds the DEV safety threshold.

[0138] Furthermore, the specific formula for calculating the controlled asset exposure value (DEV) is as follows: DEV=Asset_sensitivity×Exposure_factor×Containment_margin.

[0139] The specific calculation method for the DEV safety threshold is as follows: DEV_max=Asset_sensitivity×Max_exposure_tolerance; Among them: Max_exposure_tolerance is the risk exposure tolerance threshold.

[0140] When DEV > DEV_max, immediate blocking is triggered.

[0141] S4: Optimal Interruption Timing (OBP) Modeling: Using a dynamic programming algorithm, find the time threshold where the attacker's benefit-cost ratio is lowest and the defender obtains the most information. This threshold is denoted as the Optimal Interruption Timing (OBP) point. The attack value is determined based on the Optimal Interruption Timing (OBP) point, and the handling method is determined accordingly. If it is a low-value attack, it is directly blocked; if it is a high-value attack, subsequent actions are taken. S5: Delayed Security Measures and Solidification of Attack Characteristics.

[0142] Furthermore, step S4 includes the following sub-steps: S401: Define the performance function U=f(T), where T is the delay time. Under the premise that DEV is within the safety threshold, find the time point at which the performance function U(T) reaches its maximum value, and denote it as the optimal interruption timing OBP point.

[0143] The specific formula for the efficiency function U=f(T) is as follows: U(T)=α×AIC(T)-β×DEV(T)+γ×Info_gain(T); Where: T is the delay time; α, β, and γ are the corresponding weights, and satisfy α + β + γ = 1. The initial values ​​are: α = 0.4, β = 0.4, and γ = 0.2. Info_gain(T) represents the amount of information collected.

[0144] The specific calculation formula for Info_gain(T) is as follows: Info_gain(T)=k1·Behav_classes(T) / N_behav+k2·Tool_fp(T) / N_tool+ k3·Chan_confirmed(T) / N_chan+k4·IP_attrib(T); Where: Behav_classes(T) is the number of behavior classes captured up to T (TTP coverage); N_behav is the average total number of similar attack categories in the historical database; Tool_fp(T) represents the number of tool fingerprints extracted up to T; N_tool represents the average total number of tool fingerprints for similar attacks in the historical database; Chan_confirmed(T) represents the number of confirmed backlinks / C2 channels up to T; N_chan is the average number of back connections / total number of C2 channels for similar attacks in the historical database; IP_attrib(T) is the true source IP attribution confirmation score, which takes a value of 0 to 1. For proxy / Tor layers, confirmation = 1. k1~k4 are weights, and k1+k2+k3+k4=1. The regression calibration is the same as in S206 and can be updated in subsequent S605.

[0145] Provided that DEV is within a safe threshold, we seek the time point at which the performance function U(T) reaches its maximum value, i.e., we seek T* such that dU / dT=0 and T* satisfies DEV(T*). <DEV_max。

[0146] The specific formula for calculating T* is: T*=argmaxU(T) subject to DEV(T) <DEV_max。

[0147] Furthermore, the AIC, DEV, and performance function U=f(T) calculations in this method utilize the collected data and physical quantities of both the attacker and defender. However, the AIC, DEV, and performance function U=f(T) are primarily for constructing the scoring model, and this part only uses the numerical values ​​of the data for dimensionless calculations.

[0148] S402: Set a dynamic window period. If the attacker stops advancing during the penetration phase, it will be judged as a low-value attack in advance and converted to an immediate ban.

[0149] S403: Based on the average duration of similar attacks in the historical database, predict the critical point at which an attack enters the control phase.

[0150] S404: Introduces an interference factor to moderately reduce the response speed during the delay period, testing the attacker's willingness to add resources when faced with a low-quality link.

[0151] S405: Output the specific blocking command trigger threshold, which includes time span, traffic threshold and sensitive behavior counter.

[0152] S5: Perform delayed security measures and solidify attack characteristics: Implement a simulated deception response within the security threshold, and instantly shut down the link after reaching the threshold, and fully extract and solidify the attacker's high-value tool fingerprints.

[0153] Furthermore, step S5 includes the following sub-steps: S501: Employ a simulated response during the delay period, wherein the simulated response is a logically consistent fake success message returned in response to an attacker's exploit attempt.

[0154] S502: At the moment the OBP threshold is reached, a Reset message is triggered to forcibly cut off the TCP connection, and an interception policy is simultaneously issued at the network boundary.

[0155] S503: Encapsulates all traffic data, interaction messages, and environment variable snapshots generated during the delay period into an immutable forensic file.

[0156] S504: Utilizes bypass countermeasures to attempt reverse fingerprinting of the browser or toolkit used by the attacker.

[0157] S505: Through traffic hijacking technology, it guides the attacker's subsequent retry behavior into a fully virtual honeycomb environment.

[0158] For example: if an attacker is detected accessing the "customer database" in the Shadow System; the Shadow file contains 1,000 randomly generated fake ID numbers (in the correct format but all are test data). If the attacker executes SELECT *FROM customers WHERE name LIKE '%', it is determined to be a high-value probe. The system will immediately switch to the harvesting phase, triggering blocking in advance, and performing S6: attack profiling and updating the global linkage defense strategy.

[0159] S6: Generate attack profiles and update global coordinated defense strategies: Transform the captured complete attack features into global defense features, and achieve proactive immunity across the entire network by linking with network security gateway devices.

[0160] Furthermore, the network security gateway device includes devices such as firewalls and WAFs.

[0161] Furthermore, step S6 includes the following sub-steps: S601: Extract the unique behavioral sequences exhibited by the attacker during the penetration and control phases, and generate the unique behavioral entropy value of the attacker.

[0162] The specific calculation method for the entropy value of the unique behavior is: H = -Σp_j × log2(p_j); in: p_j represents the frequency of occurrence of the j-th type of behavior; Type j behaviors include port scanning, command execution, and file access.

[0163] Furthermore, the upper limit of H is log2 (number of behavior categories), with a maximum score of 4. When H=2.0, it is half of the maximum score, indicating that the attacker only reuses about 1 / 4 of the behavior categories (concentrated in a few categories), which is judged as machine characteristics; H=3.5 is close to the maximum score, indicating that the attacker uses almost all categories evenly, which is judged as human characteristics; H<2.0 is judged as automated tool attack, 2.0≤H≤3.5 is judged as human-machine hybrid attack, and H>3.5 is judged as human penetration.

[0164] Where p_i is obtained by statistically counting the attacker’s various behaviors during the penetration and control phases; Shannon entropy is an objective measurement formula in information theory; the judgment thresholds of 2.0 and 3.5 are determined by the measured distribution of historical attack samples.

[0165] S602: Automatically converts captured 0-day vulnerability features or novel bypass techniques into custom interception rules for the local WAF.

[0166] S603: Based on the attacker's IP associations, locate the attacking organization or botnet node to which it belongs in the global threat intelligence network.

[0167] S604: Calculate the increased attack costs resulting from this delayed security action and quantitatively assess the effectiveness of this delayed security action in improving the overall security posture.

[0168] S605: Automatically optimizes the weight coefficients of the OBP model to enable adaptive learning and evolution of the defense system.

[0169] Furthermore, S605 includes the following sub-steps: S6051: Effect Feedback Collection: After each delayed handling event ends, read S604 to collect the measured effect indicators of the event.

[0170] Furthermore, the measured performance indicators include: increased attack cost, completeness of evidence collection, actual asset exposure duration, and misjudgment markers confirmed by manual review afterward.

[0171] The increase in attack cost is the difference between the final AIC value of this attack and the average value of similar historical attacks; the completeness of evidence collection is the number of captured behavioral categories and the number of tool fingerprints.

[0172] S6052: Incremental update calculation: The deviation between the measured index and the expected target is used as a feedback signal. Incremental updates are performed on each weight according to a fixed learning rate η. After the update, the weights are renormalized so that the sum of each weight remains 1.

[0173] Furthermore, the update direction of DEV-related parameters is subject to a one-way constraint: only tightening of safety constraints is allowed, and relaxation is not permitted.

[0174] Furthermore, the specific calculation formula for incremental update is: w_new=w_old+η×∇L.

[0175] Where: w_new is the updated parameter; w_old represents the weights that need to be updated, including w1~w5, k, α, β, γ, and k1~k4; η is the update step size, which determines the magnitude of each correction, and ranges from 0.01 to 0.1; ∇L is the deviation correction term, which is the correction direction and magnitude obtained based on the deviation between the actual effect of this treatment and the expected target. The expected target is obtained from the statistics of historical treatment samples.

[0176] The specific calculation method for the deviation correction term ∇L is as follows: ∇L_n=Σ( m_n×Dev_n); Where: n represents the parameters that need to be incrementally updated; m_n is a sensitivity matrix pre-calibrated using historical attack samples; Dev_n is the deviation vector, Dev_n = (Measured index_n - Target_n) / Target_n.

[0177] For example, performing an incremental update on w1: The default value is m_w1 = (−1.0, +0.5, +0.3, 0).

[0178] The deviation vector is calculated by comparing each of the four measured indicators with the corresponding expected target to obtain the dimensionless relative deviation: the target attack cost increases by 5000, and the measured value is 3500, so Dev_w1_1 = (3500−5000) / 5000 = −0.30. Similarly, the other terms are obtained, and the results are summarized as: Dev_w1 = (−0.30, −0.20, +0.25, 0).

[0179] Calculate the deviation correction term corresponding to w1: ∇L_w1=(−1.0)(−0.30)+(0.5)(−0.20)+(0.3)(0.25)=0.30−0.10+0.075= +0.275.

[0180] The expected target, i.e., target_n, is derived from the cost distribution statistics of similar attacks in the historical sample library. The default value is taken during cold start and updated as samples accumulate, using the same mechanism as weight calibration.

[0181] The bias correction term ∇L is a relative amplitude, which is large when the bias is large and small when the bias is small. It is the original signal calculated from a single sample, which is noisy and unbounded. The update step size η is a confidence coefficient that determines how much the global model should be modified for a single sample. It prevents overfitting of samples and limits the amplitude of abnormal events. For example, if an extreme attack causes the bias correction term ∇L to be huge, η is set to 0.01~0.1 to ensure that the weights do not jump out of control in one step.

[0182] S6053: Shadow Verification and Version Management: In S6052, the updated weights are first verified on the mirror traffic. Only when the processing effect is not worse than the current version will the update be officially implemented and take effect; otherwise, the update will be discarded.

[0183] Furthermore, the weights of each version are persistently stored and incremented according to the version number, supporting rollback to historical versions.

[0184] The weight setting and updating are connected with the method of weights being determined by regression from historical attack samples in S206: the initial weights determined by regression are used in the cold start phase, and continuous correction is performed by step S605 in the running phase.

[0185] The above description is merely a preferred embodiment of this application and is not intended to limit this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the protection scope of this application.

Claims

1. A delayed security handling method based on cost-value game theory during the attack phase, characterized in that: Includes the following steps: S1: Capture attack behavior and identify attack phases: Capture attack behavior and use traffic fingerprinting and state machine to map external attack traffic in real time into the detection phase, penetration phase, control phase and harvest phase; S2: Multidimensional quantitative calculation of attacker's input cost. AIC: Real-time calculation of the cost incurred by the attacker in the current link; the cost includes infrastructure, tool code, and time. S3: Real-time monitoring of the exposure value (DEV) of controlled assets: assessing the sensitivity level of assets reached by the attack path, and calculating the DEV and DEV security threshold in combination with the virtual isolation environment to define the security margin in the current inducement process; S4: Optimal Interruption Timing (OBP) Modeling: Using a dynamic programming algorithm, find the time threshold where the attacker's cost-benefit ratio is lowest and the defender's information acquisition is maximum. This threshold is denoted as the Optimal Interruption Timing (OBP) point. The attack value is determined based on the Optimal Interruption Timing (OBP) point, and the appropriate handling method is determined. If it is a low-value attack, it is directly blocked; if it is a high-value attack, subsequent actions are taken. S5: Delayed Security Measures and Solidification of Attack Characteristics. S5: Perform delayed security measures and solidify attack characteristics: Implement a simulated deception response within the security threshold, and instantly shut down the link after the threshold is reached, and fully extract and solidify the attacker's high-value tool fingerprints. S6: Generate attack profiles and update global coordinated defense strategies: Transform the captured complete attack features into global defense features, and achieve proactive immunity across the entire network by linking with network security gateway devices.

2. The delayed security handling method based on cost-value game theory during the attack phase as described in claim 1, characterized in that: S1: The attack behavior capture and attack identification phase includes the following sub-steps: S101: Capture attack behavior, extract packet payload features using deep group detection, identify whether it contains probe tool fingerprint information, and if so, map external attack traffic to the probe period. S102: For external attack traffic mapped to the probing phase, the behavior modeling of the TCP / IP protocol stack is used to identify the state transition logic from one-way probing to three-way handshake establishment and then to data interaction, and to monitor attack behavior in real time. S103: Introducing a time series analysis algorithm to monitor the changing patterns of attack request frequency. If the attack changes from automated scanning to manual penetration, it is determined that the attacker has moved from the detection phase to the penetration phase. S104: Establish an attack phase marker bit. When an attempt to execute a terminal command or upload a script is detected, the mapping state will automatically transition to the penetration phase. S105: Insert dynamic tokens through a reverse proxy at the application layer to track the depth of the attacker's traversal of business logic; S106: When the attacker successfully executes remote code or establishes a stable return connection channel, the mapping state transitions to the control phase.

3. The delayed security handling method based on cost-value game theory during the attack phase as described in claim 1, characterized in that: S2: Multidimensional quantization calculation of the attacker's investment cost (AIC) includes the following sub-steps: S201: Identify the IP attributes of the attack source. If it is a high-cost IP, assign it a higher IP cost component. The high-cost IPs include residential dial-up proxy IPs and mobile base station IPs. S202: Analyze the complexity of the payload and determine whether the attacker has used obfuscated proprietary exploit code through code entropy detection. If so, assign a higher code cost component. S203: Monitor the concurrency and duration of the attack chain, calculate the infrastructure resources consumed by the attacker to maintain the attack channel. The longer the concurrency and duration, the greater the time cost. S204: Evaluate the number of attempts by the attacker to bypass WAF / IPS rules, incorporate the attacker's algorithm iteration cost into the quantization model, and quantify the algorithm iteration cost component; S205: By combining the threat intelligence database, verify whether the attack signature belongs to a known family, determine the construction cost of the attacker's infrastructure, and quantify the infrastructure cost components. S206: Summarizes the cost components of IP, code, time, algorithm iteration, and infrastructure to quantify the attacker's investment cost (AIC) in multiple dimensions.

4. The delayed security handling method based on cost-value game theory during the attack phase as described in claim 1, characterized in that: S3: Real-time monitoring of controlled asset exposure value (DEV) includes the following sub-steps: S301: Classify target assets based on the configuration management database and calculate asset sensitivity; S302: Real-time calculation of the lateral movement range that the attacker can reach with their current privileges, restricting the attacker to operate only in the isolated shadow system, and determining the exposure factor in the shadow system. S303: Monitor whether the downlink transmission of sensitive fields is carried in the attack traffic, calculate the tolerance margin, and set the traffic red line for immediate blocking based on the tolerance margin; S304: Utilize virtualization technology to dynamically mount fake sensitive files for the attacker, and assess the attacker's interest in specific information; the specific information is various decoy information in the fake sensitive files; including business asset information, operation and maintenance facility information, classified configuration information, and high-value internal documents; S305: The computational defense system consumes computing and storage resources to maintain delayed processing, ensuring that the defense premium is not lower than the potential risk of the asset. When the defense premium is lower than the potential risk of the asset, the delayed processing is stopped and an immediate block is performed. S306: Summarize asset sensitivity, exposure factor, and tolerance margin to calculate the controlled asset exposure value (DEV) and DEV safety threshold, and immediately trigger immediate blocking when DEV exceeds the DEV safety threshold.

5. The delayed security handling method based on cost-value game theory during the attack phase as described in claim 1, characterized in that: S4: Optimal Interruption Timing OBP Game Decision Modeling includes the following sub-steps: S401: Define the performance function U=f(T), where T is the delay time. Under the premise that DEV is within the safety threshold, find the time point at which the performance function U(T) reaches its maximum value, and denote it as the optimal interruption timing OBP point. S402: Set a dynamic window period. If the attacker stops during the penetration phase, it will be judged as a low-value attack in advance and switched to the instant blocking mode. S403: Based on the average duration of similar attacks in the historical database, predict the critical point at which an attack enters the control period. S404: Introduces an interference factor to moderately reduce the response speed during the delay period, testing the attacker's willingness to add resources when faced with a low-quality link; S405: Output the specific blocking command trigger threshold, which includes time span, traffic threshold and sensitive behavior counter.

6. The delayed security handling method based on cost-value game theory during the attack phase as described in claim 1, characterized in that: The S5 step, which involves performing delayed security measures and solidifying attack characteristics, includes the following sub-steps: S501: During the delay period, a simulated response is used, wherein the simulated response is a logically consistent fake success message returned in response to an attacker's exploit attempt; S502: At the moment the OBP threshold is reached, a Reset message is triggered to forcibly cut off the TCP connection, and an interception policy is simultaneously issued at the network boundary; S503: Automatically encapsulates all traffic data, interactive messages, and environment variable snapshots generated during the delay period into an immutable forensic file; S504: Using bypass countermeasures, attempt to perform reverse fingerprinting of the browser or toolkit used by the attacker. S505: Through traffic hijacking technology, it guides the attacker's subsequent retry behavior into a fully virtual honeycomb environment.

7. The delayed security handling method based on cost-value game theory during the attack phase as described in claim 1, characterized in that: S6: Generating attack profiles and updating global coordinated defense strategies includes the following sub-steps: S601: Extract the unique behavioral sequences exhibited by the attacker during the penetration and control phases, and generate the unique behavioral entropy value of the attacker; S602: Automatically converts captured 0-day vulnerability features or new bypass methods into custom interception rules for the local WAF; S603: Based on the attacker's IP associations, locate the attacking organization or botnet node to which it belongs in the global threat intelligence network; S604: Calculate the increased attack costs resulting from this delayed security action and quantitatively evaluate the effectiveness of this delayed security action in improving the overall security posture; S605: Automatically optimizes the weight coefficients of the OBP model to enable adaptive learning and evolution of the defense system.

8. The delayed security handling method based on cost-value game theory during the attack phase as described in claim 3, characterized in that: The specific calculation formula for the IP cost component mentioned in S201 is as follows: IP_cost=Σ(IP_type×Duration_hours); in: IP_type is the score corresponding to the IP attribute type; Duration_hours is the duration of the attack source IP; The specific calculation formula for the code cost component mentioned in S202 is as follows: Tool_cost=Payload_entropy / 8.0×Log(Payload_size+1); in: Payload_entropy is the code entropy value, ranging from 0 to 8; Payload_size is the number of bytes of the actual payload in the data packet; The specific calculation formula for the time cost component mentioned in S203 is as follows: Time_cost=Elapsed_minutes / T_baseline; in: Elapsed_minutes is the duration of the attack chain; T_baseline represents the average duration of similar attacks; The specific calculation formula for the algorithm iteration cost component described in S204 is as follows: AlgoIter_cost=WAF_bypass_attempts×k; Where: k is the average computational cost score for each bypass, ranging from 0.1 to 0.3; WAF_bypass_attempts represents the number of attempts an attacker makes to bypass WAF / IPS rules; The specific calculation formula for the algorithm iteration cost component described in S205 is as follows: Infra_cost=Concurrent_channels×Bandwidth_equivalent_MBps×Persistence_hours; in: Concurrent_channels is the number of concurrent channels in the attack chain, referring to the number of independent communication or processing channels that can work in parallel or simultaneously at the same time. Bandwidth_equivalent_MBps is the equivalent bandwidth; Persistence_hours is the retention period, used to describe the validity period of temporary resources; The specific formula for calculating the AIC (Attack Cost) of the multidimensional quantization attacker as described in S206 is as follows: AIC=w1·IP_cost+w2·Tool_cost+w3·Time_cost+w4·Infra_cost+w5·AlgoIter_cost; Where w1, w2, w3, w4, and w5 are the weight coefficients corresponding to each cost component, which are obtained through regression of historical attack data, and w1+w2+w3+w4+w5=1.

9. The delayed security handling method based on cost-value game theory during the attack phase as described in claim 4, characterized in that: The asset sensitivity calculation formula described in S301 is as follows: Asset_sensitivity=Σ(Level_i×Asset_value_i) / ΣAsset_value_i; in: i takes a positive integer, corresponding to the grade level, and ranges from 1 to 5; Level_i represents the asset level of the configuration management database, ranging from 1 to 5; Asset_value_i represents the corresponding asset value; The formula for calculating the exposure factor as described in S302 is: Exposure_factor=Reachable_assets_in_shadow / Total_target_assets; in: Reachable_assets_in_shadow refers to the reachable assets in the shadow system; Total_target_assets represents the total target assets; The formula for calculating the margin of tolerance as described in S303 is: Containment_margin=1-(Attacked_duration_minutes / Max_tolerable_duration); in: Attacked_duration_minutes is the duration of exposure; Max_tolerable_duration is the maximum tolerable exposure duration defined; The DEV calculation formula described in S306 is as follows: DEV=Asset_sensitivity×Exposure_factor×Containment_margin; The specific calculation method for the DEV safety threshold is as follows: DEV_max=Asset_sensitivity×Max_exposure_tolerance; Where: Max_exposure_tolerance is the risk exposure tolerance threshold; When DEV > DEV_max, immediate blocking is triggered.

10. The delayed security handling method based on cost-value game theory during the attack phase as described in claim 5, characterized in that: The specific calculation formula for the performance function U=f(T) mentioned in S401 is as follows: U(T)=α×AIC(T)-β×DEV(T)+γ×Info_gain(T); Where: T is the delay time; α, β, and γ are the corresponding weights, α + β + γ = 1, initially set as: α = 0.4, β = 0.4, γ = 0.2; Info_gain(T) is the amount of information collected; The specific calculation formula for Info_gain(T) is as follows: Info_gain(T)=k1·Behav_classes(T) / N_behav+k2·Tool_fp(T) / N_tool+ k3·Chan_confirmed(T) / N_chan+k4·IP_attrib(T); Where: Behav_classes(T) is the number of behavior classes captured up to T (TTP coverage); N_behav is the average total number of similar attack categories in the historical database; Tool_fp(T) represents the number of tool fingerprints extracted up to T; N_tool represents the average total number of tool fingerprints for similar attacks in the historical database; Chan_confirmed(T) represents the number of confirmed backlinks / C2 channels up to T; N_chan is the average number of back connections / total number of C2 channels for similar attacks in the historical database; IP_attrib(T) is the true source IP attribution confirmation score, which takes a value of 0 to 1. For proxy / Tor layers, confirmation = 1. k1~k4 are weights, and k1+k2+k3+k4=1; Provided that DEV is within a safe threshold, we seek the time point T* that maximizes the performance function U(T), i.e., we seek T* such that dU / dT = 0 and T* satisfies DEV(T*). <DEV_max; The specific formula for calculating T* is: T*=argmaxU(T) subject to DEV(T) <DEV_max。

Images