Abstract:
With the deep integration of 5G, artificial intelligence, and the Internet of Things, network infrastructure is facing the dual challenges of an expanding dynamic attack surface and increasing threat stealthiness. Traditional static defense mechanisms are no longer capable of effectively countering the evolving attack strategies. Although the existing active deception defense systems have enhanced threat detection capabilities through honey point technology, they still have significant shortcomings, particularly the lack of dynamic effectiveness evaluation and resource optimization mechanisms, which leads to a severe imbalance between defense costs and security benefits. Current research primarily focuses on the initial deployment strategies and architectural improvements of honey points; however, these studies have not effectively addressed the periodic attenuation of defense effectiveness in dynamic confrontation scenarios. There are also obvious deficiencies in the quantitative modeling of multidimensional security indicators and closed-loop optimization mechanisms. To address this research gap, this paper proposes a multi-dimensional effectiveness representation mechanism for honey point cluster defense systems. The mechanism constructs a comprehensive effectiveness evaluation system with three core indicators: redundancy risk index, cross-honey point IP repetition rate, and threat entrapment effectiveness score. Specifically, the method first uses deep embedded clustering technology to obtain the prior labels of honey point effectiveness, providing basic data for subsequent effectiveness evaluation. It then introduces a weight adaptive optimization mechanism driven by genetic evolutionary strategies to dynamically adjust the weights of the core indicators according to the actual threat environment and defense requirements, thereby achieving precise and efficient effectiveness evaluation. On this basis, a closed-loop defense system of “evaluation-feedback-optimization” is further established, enabling the defense system to adjust defense strategies and resource allocation promptly based on real-time effectiveness evaluation results, thereby significantly enhancing the intelligence level of active deception defense systems. This closed-loop defense system provides a feasible theoretical paradigm for promoting the intelligent development of active deception defense systems and is expected to play an important role in the field of future network security defense.