Prison network attack and defense exercise system based on digital twinning

Abstract

This invention relates to the field of prison network drill technology and discloses a prison network attack and defense drill method based on digital twins, including the following steps: Step 1: State synchronization step: Non-intrusive collection of network topology, device configuration, and traffic metadata from a real prison network, and updating the state of the digital twin model based on an incremental synchronization mechanism; Step 2: Twin construction step: Based on the network topology and device configuration, a digital twin network environment is constructed on a virtualization platform. For proprietary hardware devices that cannot be virtualized, a corresponding device behavior agent model is created. This prison network attack and defense drill system based on digital twins has the verification capability of virtual and real linkage: By linking with real security devices, it can directly verify the actual defense effectiveness of newly deployed security policies or newly purchased security equipment, reducing the possibility of introducing production environment risks due to improper policy configuration.

Description

Technical Field

[0001] This invention relates to the field of prison network drill technology, specifically a prison network attack and defense drill system based on digital twins. Background Technology

[0002] With the increasing sophistication of cyberattacks, especially the frequent occurrence of Advanced Persistent Threats (APTs) targeting critical information infrastructure, severe challenges have been posed to cybersecurity protection capabilities. Traditional cybersecurity drills, such as using virtual machines to build simple test ranges or conduct penetration tests, have the following limitations: Low environment simulation: Static, scaled-down environments cannot simulate the complex topology, business logic, and dynamic traffic of real networks, leading to a disconnect between drills and real-world scenarios; High cost and poor flexibility: Building a 1:1 physical simulation environment that matches the real environment is costly and time-consuming, and it is difficult to flexibly adjust it to simulate diverse attack scenarios; High subjectivity in evaluation: The evaluation of drill effectiveness relies heavily on expert scoring, lacking a multi-dimensional quantitative evaluation system based on objective data, making it difficult to accurately identify defense weaknesses; Isolation from production systems: Purely virtual environments cannot test the defensive effectiveness of real security devices (such as firewalls and intrusion detection / prevention systems) under real attacks, nor can they assess the impact of security policy changes on real network services. Therefore, we propose a digital twin-based prison network attack and defense drill system. Summary of the Invention

[0003] To address the shortcomings of existing digital twin-based prison network attack and defense drill systems, this invention provides a digital twin-based prison network attack and defense drill system. This system features real-time synchronization of real network conditions with a digital twin model, automatic generation of multi-stage attack scenarios based on attack knowledge graphs, and the introduction of APT attack simulation and honeypot deception technologies to establish a complete closed loop for attack and defense drills and evaluation. The goal is to significantly improve the realism and effectiveness of the drills, and through automated scoring and replay mechanisms, provide reliable support for training and defense strategy optimization, thus solving the problems mentioned in the background section.

[0004] This invention provides the following technical solution: a method for conducting attack and defense drills on prison networks based on digital twins, comprising the following steps:

[0005] Step 1: State synchronization step: Non-intrusive collection of network topology, device configuration and traffic metadata from the real prison network, including network traffic data, device operation data and security log data, and updating the state of the digital twin model based on an incremental synchronization mechanism;

[0006] Step 2: Digital Twin Construction Steps: Based on the network topology and device configuration, construct a digital twin network model on the virtualization platform. For proprietary hardware devices that cannot be virtualized, create corresponding device behavior agent models; this includes:

[0007] Generate a virtual network topology based on network topology data;

[0008] Establish virtual device nodes based on device configuration data;

[0009] The virtual device node is updated based on the traffic metadata to achieve dynamic synchronization with the real network environment.

[0010] Step 3: Scenario Generation Step: Based on the pre-built cybersecurity knowledge graph, combined with the asset information and vulnerability information in the digital twin model, a multi-stage attack scenario is generated through attack path reasoning; based on the preset or automatically generated attack script, the attack process is determined, wherein the attack script contains at least one multi-stage attack path;

[0011] Step 4: Countermeasure Execution Steps: Execute the attack script in the digital twin network environment to simulate a red team attack and drive the blue team defense module to respond. During the exercise, honeypots are dynamically deployed on critical network paths to lure and monitor attack behavior.

[0012] Step 5: Quantitative Evaluation Step: After the exercise, based on the attack data and defense response data collected during the exercise, the exercise effect is quantitatively calculated according to the preset multi-dimensional evaluation index system, and a visual report is generated; the objective weight of each evaluation index is calculated using the entropy weight method, and the subjective weight of each evaluation index is determined using the analytic hierarchy process; the objective weight and subjective weight are combined and weighted to obtain the comprehensive weight of each evaluation index; the comprehensive weight is used to perform weighted calculation on each evaluation index to obtain the evaluation result of the prison network security protection capability.

[0013] Preferably, in step 1, the collected traffic metadata includes traffic statistical feature information, and the synchronization frequency can be dynamically adjusted according to the importance of the network area.

[0014] Preferably, in step 2, the device behavior proxy model simulates the network interaction behavior of the device based on its historical traffic characteristics and communication protocol specifications.

[0015] Preferably, in step 3, the attack script is generated based on a security knowledge graph. This knowledge graph uses vulnerabilities, assets, and attack techniques as entities. It identifies feasible attack paths from the initial intrusion point to the core target asset through graph reasoning. The attack techniques refer to the attack technique classification in the ATT&CK framework. The attack path includes at least three stages: initial intrusion, lateral movement, privilege escalation, and data leakage.

[0016] Preferably, in step 4, the blue team defense module can be linked with the management interface of the real physical security device to send the defense strategy verified in the exercise to the real physical security device after confirmation. The honeypot simulates a vulnerable version of the real service and is configured with decoy data to attract attackers to access it.

[0017] Preferably, in step 4, the multi-dimensional evaluation index system includes at least four primary indicators: protection effectiveness, detection timeliness, response appropriateness, and system availability. The protection effectiveness indicator includes the access rate of critical assets and the attack success rate. The detection timeliness indicator includes the average detection time. The response appropriateness indicator includes the response success rate. In the quantitative evaluation, a combined weighting method combining entropy weighting and analytic hierarchy process is used to determine the weight of each evaluation index.

[0018] Preferably, it also includes a drill replay step: visually replaying all network events, state changes and operation logs recorded in the adversarial execution steps in a timeline to support attack path review and analysis.

[0019] The digital twin-based prison network attack and defense drill system includes:

[0020] S1: Data acquisition and synchronization module, used to non-intrusively acquire network topology, device configuration and traffic metadata from real prison networks;

[0021] S2: Digital Twin Modeling Module, used to build a digital twin network environment on a virtualization platform based on the collected data, and to create device behavior agent models for proprietary hardware devices that cannot be virtualized;

[0022] S3: Scene generation module, used to generate attack scripts based on preset scripts or security knowledge graphs;

[0023] S4: Attack and defense exercise execution engine, used to execute attack scripts in the digital twin network environment to simulate red team attacks and schedule blue team defense responses. The attack and defense exercise execution engine supports linkage with the management interface of real physical security devices to realize the policy verification of virtual and real linkage.

[0024] S5: Honeypot Deception Module, used to dynamically deploy honeypots during the exercise to deceive and monitor attack behavior;

[0025] S6: Multi-dimensional quantitative scoring module, used to quantitatively score the exercise effect based on a preset multi-dimensional evaluation index system;

[0026] S7: The exercise replay and audit module is used to record and replay the entire exercise process along a timeline.

[0027] Preferably, the data acquisition and synchronization module adopts an incremental synchronization mechanism, and the synchronization frequency can be dynamically adjusted according to the importance of the network area.

[0028] Preferably, the digital twin modeling module includes a device behavior proxy model generation unit, used to simulate the network interaction behavior of the device based on its historical traffic characteristics and communication protocol specifications.

[0029] Compared with existing digital twin-based prison network attack and defense drill systems, this invention has the following advantages:

[0030] 1. This digital twin-based prison network attack and defense exercise system features high simulation accuracy and low invasiveness: by incrementally synchronizing metadata and using device behavior proxy technology, it constructs an exercise sandbox that is highly synchronized with the actual environment without affecting real business operations, making the exercise results more valuable for reference.

[0031] 2. This digital twin-based prison network attack and defense exercise system features intelligent and diverse attack scenarios: Utilizing a knowledge graph-driven scenario generation mechanism, it can automatically discover and combine potential attack paths, simulating more covert and complex multi-stage attack chains, effectively training the blue team's ability to respond to unknown threats.

[0032] 3. The digital twin-based prison network attack and defense exercise system achieves objectivity and accuracy in evaluation: by adopting multi-dimensional quantitative indicators and combined weighted evaluation models, the exercise effect is transformed from vague qualitative descriptions to clear quantitative data, providing clear decision support for investment and improvement in security construction.

[0033] 4. This digital twin-based prison network attack and defense exercise system has the capability of verifying both virtual and real security systems: by linking with real security equipment, it can directly verify the actual defense effectiveness of newly deployed security strategies or newly purchased security equipment, reducing the possibility of introducing risks to the production environment due to improper strategy configuration.

[0034] 5. This digital twin-based prison network attack and defense exercise system has cost and efficiency advantages: it replaces the expensive physical simulation environment with a software-defined approach, supports parallel exercises in multiple scenarios, significantly shortens the exercise cycle, and reduces human and material costs.

[0035] 6. This digital twin-based prison network attack and defense exercise system enhances security: it can detect network security risks in advance in sensitive environments such as prisons, optimize defense plans, and significantly improve network security protection capabilities. Attached Figure Description

[0036] Figure 1 This is a schematic diagram of the overall system architecture of the present invention;

[0037] Figure 2 This is a schematic diagram of the overall process of the demonstration method of the present invention. Detailed Implementation

[0038] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the scope of protection of the present invention.

[0039] refer to Figure 1 and Figure 2 The functions of each core module of the system are as follows:

[0040] S1: Data Acquisition and Synchronization Module, used to non-intrusively collect network topology, device configuration, and traffic metadata from the real prison network; located in the data synchronization and processing layer, it non-intrusively collects information such as network topology, device configuration, real-time traffic characteristics, and service fingerprints through lightweight probes (supporting NetFlow, sFlow, SNMP, and Agent) deployed in the real prison network; to ensure that the performance of the production network is not affected, this module adopts an incremental synchronization mechanism, synchronizing only network configuration and traffic metadata, rather than the complete raw traffic; the synchronization frequency can be dynamically adjusted according to the importance of the network area.

[0041] S2: The digital twin modeling module is used to construct a digital twin network environment on a virtualization platform based on collected data, and to create device behavior proxy models for proprietary hardware devices that cannot be virtualized. Located in the digital twin simulation layer, it uses virtualization technologies (such as KVM and Docker containers) to automatically orchestrate and generate virtual instances that are equivalent to the real network logic, including virtual switches, virtual routers, virtual servers, and virtual terminals, based on collected data, and continuously updates their status. The digital twin network realizes real-time visualization and simulation verification of network status by constructing a virtual mapping of the physical network. For proprietary hardware devices in the prison network that cannot be virtualized (such as access controllers and industrial control PLCs), this module creates device behavior proxy models for them, simulating their behavioral responses under specific network interactions based on the device's historical traffic characteristics and communication protocol specifications.

[0042] S3: Scenario Generation Module, used to generate attack scripts based on preset scripts or security knowledge graphs; Graph-Driven Scenario Generation Module: Located in the application service layer, it constructs a prison network security knowledge graph; this knowledge graph uses "Vulnerability (CVE) - Asset (Device / Service) - Attack Technique (ATT&CK) - Threat Intelligence (IOC)" as its core entities and relationships. During scenario generation, the user specifies the exercise target (e.g., "Breaching the internal network data server"), and the module infers multiple possible attack paths in the graph based on the asset list and vulnerability information in the current digital twin environment, and automatically arranges them into attack scripts containing stages such as "Initial Intrusion," "Lateral Movement," "Privilege Escalation," and "Data Infiltration"; Currently, there are attack flow modeling methods based on the MITRE ATT&CK framework in the industry, which can describe and visualize attacker behavior sequences and support the modeling of the complete attack chain from initial access to final impact.

[0043] S4: The attack and defense exercise execution engine is used to execute attack scripts in a digital twin network environment to simulate red team attacks and schedule blue team defense responses. The attack and defense exercise execution engine supports linkage with the management interface of real physical security devices to realize policy verification of virtual-real linkage. As the scheduling hub of the exercise, it is responsible for executing attack scenarios in parallel or sequentially. It controls the red team attack simulation module to launch attacks according to the script and schedules the blue team defense response module to defend. Attack simulation supports the automated execution of known vulnerability exploitation and multi-stage attacks. Blue team defense can be linked with the management API of real security devices for policy linkage, or it can be manually operated by a human blue team. During the exercise, honeypots are dynamically deployed on the critical path of the digital twin environment to induce attack traffic to enter in order to capture attack payloads and record behavioral characteristics.

[0044] S5: Honeypot Deception Module, used to dynamically deploy honeypots during the exercise to deceive and monitor attack behavior.

[0045] S6: Multi-dimensional quantitative scoring module, used to quantitatively score the exercise effect based on a preset multi-dimensional evaluation index system; after the exercise, logs and event data from various modules are comprehensively processed for quantitative evaluation; a multi-level evaluation index system is established, with first-level indicators including protection effectiveness, detection timeliness, response appropriateness, and system availability; a combined weighting method is used to determine the weight of each indicator, and finally a comprehensive score and a visualization report are generated; existing technologies already have network security evaluation methods for attack and defense exercises, which obtain parameter weights and type weights by collecting dynamic network data in real time, calculate evaluation scores, and can dynamically update evaluation results according to the exercise.

[0046] S7: The exercise replay and audit module is used to record and replay the entire exercise process on a timeline. It records all state changes, network packet interactions, and operation logs within the digital twin environment during the exercise. It provides a visual replay function based on the timeline and topology diagram, and supports pause, step-by-step, and key event location, making it easy for the security team to review and analyze attack paths and defense weaknesses.

[0047] The method for conducting cyber attack and defense drills in prisons based on digital twins includes the following steps;

[0048] Step 1: Network Data Acquisition; Deploy acquisition probes in the actual prison network to periodically acquire network topology, device configuration, and real-time traffic metadata; acquisition methods include reading the routing tables, ACL policies, and service fingerprints of network nodes via standard SNMP protocol and SSH credentials, avoiding business interference to sensitive private networks; using mirrored ports and NetFlow or sFlow technology to extract four-layer characteristic statistics of traffic (source IP, destination IP, protocol type, port, packet length, timestamp, etc.), without touching sensitive data payloads at the business layer; the collected data is cleaned and stored uniformly in a structured format (such as JSON) as a static and dynamic benchmark for building the digital twin environment; example data format is as follows:

[0049] {

[0050] "Topology": {"Node": [{"ID":"node1","IP":"10.10.10.1","Type":"Router"}], "Link": [...]},

[0051] "Device Configuration": [{"ID":"server01","IP":"10.10.10.50","OS":"Linux","Open Ports":[22,3306]}],

[0052] Traffic statistics: [{"Time":"2026-04-10T10:00:00Z","Source IP":"10.10.10.10","Destination IP":"10.10.10.50","Protocol":"TCP","Port":3306,"Bytes":1024}]

[0053] }

[0054] Step 2: Building a digital twin environment; Import the collected topology and configuration information into the virtualization platform to automatically create virtual machines or containers and map the digital prison network environment; The virtualization platform uses mainstream solutions such as KVM / Docker and achieves automated deployment through orchestration tools (such as Ansible and Terraform); For dedicated hardware devices that cannot be virtualized, establish a behavioral agent model based on their historical traffic data.

[0055] Mathematical formal definition of the device behavior agent model;

[0056] The device behavior agent model, based on the device's historical traffic characteristics and communication protocol specifications, is abstracted into a 5-tuple finite state machine (FSM) based on state stimuli.

[0057]

[0058] in:

[0059] It is a finite set of internal states of a device (such as the access control system: {Closed, Open, Emergency_Locked, Alarm}).

[0060] It is a set of input network command message events (such as parsed industrial control messages and control codes);

[0061] It is a state transition function that satisfies That is, the evolution of the current state to the next state under the excitation of a specific instruction.

[0062] This is the initial state of the equipment;

[0063] It is a high-fidelity controlled response output set (including high-fidelity network response packets, latency characteristics, syslog audit logs, etc.).

[0064] Behavioral agent model response matrix model

[0065] Internally, a rule mapping matrix is ​​maintained. When an interaction occurs within the digital twin network targeting this specific hardware asset, the agent engine dynamically calculates the transition state and assembles a high-fidelity response packet based on the following matrix logic:

[0066]

[0067] Combining the FSM and matrix registration mechanism described above, the pseudocode for the construction process is as follows:

[0068] # [Component Definition] BehaviorProxy model class, used for high-fidelity simulation of hardware assets that cannot be virtualized.

[0069] class BehaviorProxy:

[0070] def __init__(self, traffic_history, protocol_spec):

[0071] self.traffic_history = traffic_history

[0072] self.protocol_spec = protocol_spec

[0073] self.states = []

[0074] self.current_state = None

[0075] self.rule_matrix = None

[0076] # Initialize the quintuple state machine

[0077] def set_fsm_states(self, states, initial):

[0078] self.states = states

[0079] self.current_state = initial

[0080] # Binding Protocol Rule Mapping Matrix

[0081] def bind_rule_mapping_matrix(self, matrix_rules):

[0082] self.rule_matrix = matrix_rules

[0083] # Core Response Interface: Receives command messages from the digital twin network and executes controlled responses.

[0084] def packet_in(self, packet_payload):

[0085] # 1. Protocol parsing, extracting input commands Σ

[0086] command = self.parse_protocol_command(packet_payload)

[0087] # 2. Retrieval rule mapping matrix R(S, Σ)

[0088] matched_rule = self.rule_matrix.lookup(self.current_state,command)

[0089] if matched_rule:

[0090] # Execute state transition: S -> S'

[0091] self.current_state = matched_rule.next_state

[0092] # Assemble and return a high-fidelity controlled response message Y (containing a message header and payload consistent with the actual firmware).

[0093] simulated_response = generate_high_fidelity_packet(matched_rule.response_template)

[0094] return simulated_response

[0095] else:

[0096] # Suffering an attack from unknown malformed packets, simulating latency, packet loss, or crash characteristics of real firmware.

[0097] return simulate_firmware_timeout()

[0098] # Algorithm: Construct a virtual environment and initialize the behavioral agent model for registered proprietary devices

[0099] topology = getNetworkTopology()

[0100] for each device in topology.devices:

[0101] if device.virtualizable:

[0102] # Standard virtualization deployment can be directly implemented for common business assets (such as servers).

[0103] vm = createVirtualMachine(device.spec)

[0104] configureNetwork(vm, device.networkConfig)

[0105] else:

[0106] # For dedicated hardware, instantiate the BehaviorProxy model defined in step 2.

[0107] proxy = BehaviorProxy(device.trafficHistory,device.protocolSpec)

[0108] # Initialize the quintuple state machine and response rule matrix of the proxy model

[0109] proxy.set_fsm_states(states=['Closed', 'Open', 'Emergency_Locked', 'Alarm'], initial='Closed')

[0110] proxy.bind_rule_mapping_matrix(device.protocolSpec.matrix_rules)

[0111] # Register and bind the corresponding virtual IP / MAC address in the digital twin emulation layer to take over network I / O.

[0112] registerProxy(proxy, device)

[0113] Step 3: Attack Scenario Generation; Depending on the exercise requirements, a preset attack script can be selected or it can be automatically generated by the system; When automatically generated, the scenario generation module uses the prison network security knowledge graph to infer and generate the attack script based on the exercise objectives; The attack script includes the attack phase sequence, the attack techniques used in each phase, target nodes, and expected effects; The construction of the knowledge graph can refer to the attack techniques and attack phase mapping relationship in the ATT&CK framework, as well as the attack patterns in the Universal Attack Pattern Enumeration and Classification (CAPEC);

[0114] Step 4: Attack drill execution; Deploy the attack script generated in Step 3 to the red team's attack simulator and execute it in the digital twin environment; The red team launches a progressive attack according to the script, and the blue team's defense module monitors and dynamically blocks it in real time through strategies such as the virtual intrusion detection system (IDS) and virtual firewall;

[0115] Controlled response mapping mechanism of behavioral agent model:

[0116] When the Red Team performs an attack or scan, the BehaviorProxy deployed in step 2 intercepts all packets sent to the virtual mapping of the physical hardware. Internally, it executes a high-fidelity controlled response algorithm, which matches the input stream and timing rules by calling its packet_in() interface in real time, and generates protocol packet header features, service payloads and fingerprint behavior features (such as microsecond-level latency response of specific industrial control protocols) that are exactly the same as those of the physical hardware.

[0117] The pseudocode for the exercise execution process is as follows;

[0118] # Algorithm: Main Adversarial Loop and Behavioral State Deduction of the Execution Engine

[0119] For scenario in scenarios:

[0120] deployScenarioToTwin(scenario)

[0121] time = 0

[0122] while time < scenario.duration:

[0123] # The Red Team Attack Simulator makes its next decision evolution based on the current twin state.

[0124] redAction = attacker.decideAction(twinState)

[0125] # Execute the attack steps. If the target of the red team's redAction is the behavior proxy model registered in step 2,

[0126] # Here, the model's response interface is implicitly called to perform state transition and obtain a high-fidelity controlled response:

[0127] if is_target_proxy(redAction.target_ip):

[0128] target_proxy = get_proxy_by_ip(redAction.target_ip)

[0129] # Call the packet_in core response engine defined in step 2

[0130] fidelity_response = target_proxy.packet_in(redAction.payload)

[0131] send_to_twin_network(fidelity_response)

[0132] # Deducing the global state of a twin network

[0133] twinState = simulateAttackStep(twinState, redAction)

[0134] logEvent(time, "attack", redAction)

[0135] # Triggering Blue Team Defense Judgment and Linkage

[0136] if detectDefenseTrigger(redAction):

[0137] blueAction = defender.decideAction(twinState, redAction)

[0138] twinState = simulateDefenseStep(twinState, blueAction)

[0139] logEvent(time, "defense", blueAction)

[0140] time += stepInterval

[0141] Step 5: Honeypot Decoy Deployment; During the exercise, the honeypot decoy module dynamically and elastically deploys highly realistic virtual honeypots on critical network paths in the digital twin environment; the honeypot actively simulates vulnerable versions of real high-value services (such as unauthorized access to the prison video stream interface, SSH management console with weak passwords), and configures highly realistic fake business decoy data; when the attack traffic of the red team is redirected or misled to the honeypot, the honeypot will completely and isolatedly capture and record the attacker's interactive command sequence, malicious payload, and tactical intent, achieving a harmless and in-depth dissection of the attack behavior;

[0142] Step 6: Multidimensional quantitative scoring; After the attack and defense exercise, the multidimensional evaluation module fully reads all the log data generated during the exercise and uses a combined weighted decision model (combining subjective hierarchical analysis method (AHP) and objective entropy weight method) to conduct a multidimensional digital comprehensive score of the security protection capability of this exercise.

[0143] The indicator system and mathematical calculation methods are as follows;

[0144]

[0145] The combined weighted mathematical method scoring algorithm uses a combined weight synthesized by multiplying the objective entropy weight method and the subjective analytic hierarchy process (AHP). The calculation steps are as follows:

[0146] Indicator matrix normalization: Assume One sample of exercises (historical exercise records). There are two secondary indicators; the indicator values ​​are normalized by scaling up (or down to their reciprocals) to obtain a probability matrix. ,in ;

[0147] Calculating objective weights (entropy weight method): Calculating the first... Entropy value of each indicator Define its information redundancy. ; Obtain the objective weight vector ,in ;

[0148] Determining Subjective Weights (Analytic Hierarchy Process - AHP): Security experts, based on the security requirements of the prison's private network, conduct pairwise importance comparisons of the six secondary indicators to construct a pairwise comparison matrix. Solving eigenvalue problems Passed the consistency test ( After that, the subjective weight vector is obtained. ;

[0149] Calculate the combined weights The final weights are calculated using a multiplicative formula to balance expert experience with objective data distribution.

[0150]

[0151] Using this combined weight, the scores of the secondary indicators in this exercise are weighted and summed, with the output range being [range missing]. Final quantitative security capability score .

[0152] Mathematical parameters, matrices, and symbols involved in the model: Explanation and explanation:

[0153] Basic data and normalization stage parameters

[0154] (Sample Size / Number of Historical Drills): This represents the total number of control samples introduced into the evaluation model; in practical applications, it can be the number of past drills conducted by the prison. Records of this historical exercise, or Different sets of exercise and test data;

[0155] (Number of Indicators): Represents the total number of secondary indicators in the evaluation system;

[0156] (Original index value): The original observation data in the matrix, representing the first... The first training sample in the The actual measured values ​​of each secondary indicator;

[0157] (Standard probability matrix / normalized matrix): The normalized weight matrix of the original data after being processed by miniaturization or maximization; parameters Indicates the first Under the first indicator, the first The contribution or proportion of each training sample is calculated using the following formula: Through this dimensionless processing, all The values ​​are all compressed into Between, and satisfying any index .

[0158] Objective weighting stage parameters (Entropy Weight Method)

[0159] (Information entropy value / Measure of information uncertainty): The first Information entropy of an evaluation indicator; mathematically used to measure the degree of disorder or dispersion of the indicator's data; formula. middle, Acting as an adjustment coefficient (benchmarking constant), ensuring that regardless of sample size How large is the calculated entropy value? Strictly fall into Within the range; if a certain indicator (such as service interruption duration) is in each exercise The scores of the two indicators are extremely close, indicating that the indicator has almost no difference, and their information entropy is very close. It will approach 1;

[0160] (Information redundancy / difference coefficient): The first The information utility value coefficient of each indicator;

[0161] Mathematical meaning: The calculation formula is as follows Information entropy The smaller the value, the greater the variability of the indicator among the samples, the more information it provides, and the lower its information redundancy. The higher the value, the greater its weight in the objective weighting should be;

[0162] (Objective weight vector): A set of weights determined purely by the distribution characteristics of the exercise log data;

[0163] parameter Meaning: The The objective weights of each secondary indicator are calculated using normalized redundancy. It eliminates any expert subjective bias and is entirely determined by the "discernibility" of the data itself.

[0164] Subjective weighting stage parameters (Analytic Hierarchy Process, AHP)

[0165] (Pairwise Comparison Matrix / Judgment Matrix): Constructed by security experts based on the relative importance of each pair of indicators. phalanx;

[0166] parameter : Indicates indicators relative to indicators Importance scales (typically using a 1-9 scale); for example, if experts consider "critical asset access rate (protection effectiveness)" significantly more important than "average detection time," then the corresponding scale would be... ; at the same time, the matrix has reciprocity, that is ;

[0167] (Maximum eigenvalue): Judgment matrix The maximum true eigenvalue; in mathematics, it is a core intermediate parameter used to measure whether there is a serious self-contradiction in the logical reasoning of an expert's previous and subsequent judgments.

[0168] (Eigenvector / Initial Subjective Weights): Satisfies the eigenvalue equation The non-zero solution vector, after normalization, becomes the mathematical expression of the expert's subjective intention;

[0169] (Random Consistency Ratio): The final criterion for verifying whether the judgment matrix constructed by experts passes the logical consistency audit;

[0170] Related parameter description: Its calculation formula is as follows .

[0171] (Consistency Index): The calculation formula is as follows This measures the degree of deviation from perfect consistency.

[0172] (Random Index): This is a fixed lookup constant (for...) ,standard );

[0173] Judgment criteria: When If the logical conflict of the subjective judgment matrix is ​​within an acceptable range, the subjective weights are valid; otherwise, the matrix is ​​invalid and the experts need to re-compare it.

[0174] (Subjective weight vector): The subjective weight vector of secondary indicators that ultimately passes the consistency test and represents the experience preferences of prison safety management experts.

[0175] Multiplication composition and final scoring parameters

[0176] (Combined Weights / Composite Weights): The first Each evaluation indicator incorporates the final comprehensive weighting of "expert experience (subjective)" and "data distribution (objective)".

[0177] Mathematical meaning: formula The normalized multiplicative synthesis mechanism is adopted; the numerator is the product of the subjective and objective weights of the indicator, and the denominator is used to normalize and sum the products of all indicators; this mechanism has a "synergistic enhancement" effect, if an indicator is highly valued by experts ( Large), and also showed extremely high discrete differences in the exercise ( (Large), its final allocated comprehensive weight It will be significantly magnified;

[0178] (Digital Comprehensive Score): The final output value of this invention represents a digital quantitative evaluation of the system's overall security defense capability of the prison network during this attack and defense exercise; numerical range The higher the value, the stronger the blue team's comprehensive protection and emergency response capabilities; the lower the value, the higher the vulnerability of the real network.

[0179] Step 7: Exercise Replay and Auditing; The entire exercise event log includes timestamps, event types, sources, details, etc.; An example of an exercise log is shown below:

[0180]

[0181] Based on log data, the replay module visualizes and reproduces the attack path and defense response process on the topology map according to the timeline, supporting frame-by-frame stepping and key event location.

[0182] The typical deployment environment for this system is as follows:

[0183] Hardware environment: x86 architecture server, recommended configuration of at least 32 CPU cores, 128GB memory, and 2TB SSD storage to support the digital twin simulation environment and various functional modules;

[0184] Software environment: Operating system is Linux (CentOS 7+ / Ubuntu 20.04+); virtualization platform is KVM+Docker; network simulation tool is Open vSwitch; data storage uses MySQL+Elasticsearch; front-end display uses Web technologies;

[0185] Network environment: The system connects to the prison's private network through secure isolation. The data collection probes are deployed on mirrored ports or collected via Agent, without modifying the real network configuration.

[0186] Example 1: APT attack and defense exercise targeting prison intranet data servers

[0187] This case study describes the process of simulating an APT attack aimed at stealing core data of inmates using the system of this invention, and verifying the effectiveness of existing defense systems.

[0188] Background and Objectives: A prison network adopts a three-layer architecture. The core layer has dual-core switches for redundancy backup, the aggregation layer connects various prison areas, and the access layer connects terminal devices and security equipment. The core business servers include the prison administration management system server (IP: 10.10.10.50), the all-in-one card system server (IP: 10.10.10.51), and the video surveillance management server (IP: 10.10.10.52). The objective of the exercise is to "verify the protection capability of the core prison administration database server (10.10.10.50) against unknown APT attacks."

[0189] Digital twin environment construction; data acquisition probes are deployed on the mirror port of the core switch to collect NetFlow traffic data and device SNMP information of each network segment; the digital twin modeling module builds a mirror environment consisting of 3 virtual switches, 5 virtual servers and several virtual terminals on the cloud platform; for devices that cannot be virtualized, such as access control controllers, a device behavior proxy model is created based on their historical communication behavior.

[0190] Attack scenario generation: The graph-driven scenario generation module queries the knowledge graph and infers from asset information in the twin environment (such as the presence of the CVE-2021-44228 Log4j vulnerability in the web server) to automatically generate the following attack script:

[0191] Phase 1 (Initial Intrusion): Exploiting the Log4j vulnerability, a reverse shell is established on the web server via JNDI injection;

[0192] Phase Two (Persistence and Information Gathering): Upload a WebShell to maintain access, perform port scanning and LDAP queries on the intranet, and discover the domain controller and database server;

[0193] Phase 3 (Lateral Movement): Retrieve domain user credentials from the web server and log in to the operations and maintenance terminal via a pass-the-hash attack;

[0194] Phase Four (Privilege Escalation and Data Leakage): The database connection configuration file is discovered on the operations and maintenance terminal. The core database server is logged in using credentials, and the data export command is simulated to shard the data and disguise it as HTTP traffic for external transmission.

[0195] The attack and defense exercise execution engine starts the script; the red team simulates the execution of each stage of the attack, and after the blue team's next-generation firewall detects abnormal SMB traffic from the web server, it automatically issues a temporary policy to block its access to port 445 of the operation and maintenance terminal; as a countermeasure, the red team module automatically adjusts its policy and attempts to use the RDP protocol for lateral movement; at the same time, a honeypot (simulating a fake MySQL service with port 3306 open) deployed on the same network segment as the database server attracts the red team's erroneous connection attempts, and the information collection commands executed by the red team in the honeypot are fully recorded.

[0196] Evaluation and debriefing; after the exercise, the scoring module comprehensively calculates various indicators:

[0197] Protection effectiveness: The red team ultimately succeeded in accessing the core database, and the access rate of critical assets was 100%, which is a low score;

[0198] Timeliness of detection: The Blue Team firewall alerted and blocked the SMB scan within 5 seconds of it occurring, with an MTTD of 5 seconds, which is a high score.

[0199] Appropriateness of the response: Blocking the SMB forced the attacker to change paths, gaining time to respond, but failed to prevent the eventual data access;

[0200] Honeypot deception effect: If the Red team stays in the honeypot for more than 2 minutes, it provides the Blue team with early warning and attack behavior samples, which is a bonus point;

[0201] The system generates a comprehensive score report and points out that "lateral movement detection and blocking" is a weak link in the current defense system, and recommends strengthening the monitoring of abnormal behavior of the RDP protocol.

[0202] Example 2: Pre-verification Testing of the New Security Strategy

[0203] This case study describes the process of using the system of this invention to conduct "shadow testing" to verify the effectiveness of a new strategy and assess its potential impact before deploying it on a real security device.

[0204] Background and Objectives: The prison network administrator plans to deploy a new Access Control List (ACL) on the core switch to restrict direct access from the office network segment (192.168.1.0 / 24) to the security video private network (10.10.20.0 / 24). The objective is to verify the effectiveness of the policy before it goes live and to ensure that it does not affect normal cross-network segment services.

[0205] Policy import and scenario setting; the administrator imports the ACL policy into the Blue Team Defense Response module; selects the preset "malicious internal employee attempts to steal surveillance video" attack scenario, which simulates the behavior of an office terminal accessing the video storage server and downloading video files through the RTSP protocol.

[0206] The exercise was executed in accordance with the rules. The attack and defense exercise execution engine first executed the scenario in the current digital twin environment without deploying the new strategy. The red team simulator accessed the video storage server (10.10.20.10) from the office terminal via the RTSP protocol and successfully downloaded the recording file. The system recorded the attack path and the successful result.

[0207] Subsequently, the new ACL policy was applied to the virtual switch configuration in the digital twin environment in shadow mode (the real network configuration remained unchanged), and the exact same attack scenario was executed again.

Claims

1. A method for conducting network attack and defense drills in prisons based on digital twins, characterized in that, Includes the following steps: Step 1: State synchronization step: Non-intrusive collection of network topology, device configuration and traffic metadata from the real prison network, including network traffic data, device operation data and security log data, and updating the state of the digital twin model based on an incremental synchronization mechanism; Step 2: Twin construction steps: Based on the network topology and device configuration, construct a digital twin network model on the virtualization platform. For proprietary hardware devices that cannot be virtualized, create corresponding device behavior agent models. These include: Generate a virtual network topology based on network topology data; Establish virtual device nodes based on device configuration data; The virtual device node is updated based on the traffic metadata to achieve dynamic synchronization with the real network environment. Step 3: Scenario Generation Step: Based on the pre-built cybersecurity knowledge graph, combined with the asset information and vulnerability information in the digital twin model, a multi-stage attack scenario is generated through attack path reasoning; based on the preset or automatically generated attack script, the attack process is determined, wherein the attack script contains at least one multi-stage attack path; Step 4: Countermeasure Execution Steps: Execute the attack script in the digital twin network environment to simulate a red team attack and drive the blue team defense module to respond. During the exercise, honeypots are dynamically deployed on critical network paths to lure and monitor attack behavior. Step 5: Quantitative Evaluation Step: After the exercise, based on the attack data and defense response data collected during the exercise, the exercise effect is quantitatively calculated according to the preset multi-dimensional evaluation index system, and a visual report is generated; the objective weight of each evaluation index is calculated using the entropy weight method, and the subjective weight of each evaluation index is determined using the analytic hierarchy process; the objective weight and subjective weight are combined and weighted to obtain the comprehensive weight of each evaluation index; the comprehensive weight is used to perform a weighted calculation on each evaluation index to obtain the evaluation result of the prison network security protection capability.

2. The method for prison network attack and defense drills based on digital twins according to claim 1, characterized in that: In step 1, the collected traffic metadata includes traffic statistical feature information, and the synchronization frequency can be dynamically adjusted according to the importance of the network area.

3. The method for prison network attack and defense drills based on digital twins according to claim 1, characterized in that: In step 2, the device behavior proxy model simulates the network interaction behavior of the device based on its historical traffic characteristics and communication protocol specifications.

4. The method for prison network attack and defense drills based on digital twins according to claim 1, characterized in that: In step 3, the attack script is generated based on a security knowledge graph. This knowledge graph uses vulnerabilities, assets, and attack techniques as entities. It identifies feasible attack paths from the initial intrusion point to the core target asset through graph reasoning. The attack techniques refer to the attack technique classification in the ATT&CK framework. The attack path includes at least three stages: initial intrusion, lateral movement, privilege escalation, and data leakage.

5. The method for prison network attack and defense drills based on digital twins according to claim 1, characterized in that: In step 4, the blue team defense module can be linked with the management interface of the real physical security device to send the effective defense strategy verified in the exercise to the real physical security device after confirmation. The honeypot simulates a vulnerable version of the real service and is configured with decoy data to attract attackers to access it.

6. The method for prison network attack and defense drills based on digital twins according to claim 1, characterized in that: In step 4, the multi-dimensional evaluation index system includes at least four primary indicators: protection effectiveness, detection timeliness, response appropriateness, and system availability. The protection effectiveness indicator includes the access rate of critical assets and the attack success rate. The detection timeliness indicator includes the average detection time. The response appropriateness indicator includes the response success rate. In the quantitative evaluation, a combined weighting method combining entropy weighting and analytic hierarchy process is used to determine the weight of each evaluation indicator.

7. The method for prison network attack and defense drills based on digital twins according to claims 1 to 6, characterized in that: It also includes a drill replay step: visually replaying all network events, state changes, and operation logs recorded during the adversarial execution steps in a timeline to support attack path review and analysis.

8. A prison network attack and defense exercise system based on digital twins, characterized in that: include: S1: Data acquisition and synchronization module, used to non-intrusively acquire network topology, device configuration and traffic metadata from real prison networks; S2: Digital Twin Modeling Module, used to build a digital twin network environment on a virtualization platform based on the collected data, and to create device behavior agent models for proprietary hardware devices that cannot be virtualized; S3: Scene generation module, used to generate attack scripts based on preset scripts or security knowledge graphs; S4: Attack and defense exercise execution engine, used to execute attack scripts in the digital twin network environment to simulate red team attacks and schedule blue team defense responses. The attack and defense exercise execution engine supports linkage with the management interface of real physical security devices to realize the policy verification of virtual and real linkage. S5: Honeypot decoy module, used to dynamically deploy honeypots during the exercise to decoy and monitor attack behavior; S6: Multi-dimensional quantitative scoring module, used to quantitatively score the exercise effect based on a preset multi-dimensional evaluation index system; S7: The exercise replay and audit module is used to record and replay the entire exercise process along a timeline.

9. The prison network attack and defense exercise system based on digital twins according to claim 8, characterized in that: The data acquisition and synchronization module adopts an incremental synchronization mechanism, and the synchronization frequency can be dynamically adjusted according to the importance of the network area.

10. The prison network attack and defense exercise system based on digital twins according to claim 8, characterized in that: The digital twin modeling module includes a device behavior proxy model generation unit, which is used to simulate the network interaction behavior of the device based on its historical traffic characteristics and communication protocol specifications.

Images