Intelligent learning type self-response industrial internet honeypot induction method and system

Abstract

The invention provides an intelligent learning type self-response industrial internet honeypot induction method and system. The method comprises the following steps: sample data processing: periodically acquiring a service request command of an industrial environment under a normal condition in a set time period, equipment for responding to the request command and response content, and processingto generate a request response sequence as a model training sample data set; responding to prediction model training; threat trapping is carried out, request data of a current attacker are obtained, anode where a request sub-sequence is located on a probability suffix tree is searched for according to a current response prediction model, feedback is given to the request data, data are recorded till attacks are ended, and then an obtained original attack request response sequence is added into a sample data set; repeating the above process. According to the method, through deep learning of data interaction of various industrial control systems, various industrial control systems and services are truly simulated, attackers can be cheated and cannot be exposed, and powerful guarantee is provided for industrial Internet safety.

Description

technical field [0001] The invention relates to the technical field of industrial Internet security business, in particular to an intelligent learning self-response industrial Internet honeypot induction method and system. Background technique [0002] Honeypot technology is essentially a technology to deceive the attacker. By arranging some hosts, network services or information as bait, the attacker is induced to attack them, so that the attack behavior can be captured and analyzed, and the attack behavior can be understood. The tools and methods used by the party, and the attack intention and motivation can be speculated, so that the defense party can clearly understand the security threats they face, and enhance the security protection capabilities of the actual system through technical and management means. [0003] Honeypot technology is generally divided into low-interaction honeypots and high-interaction honeypots according to the degree of interaction provided by th...

AI Technical Summary

Problems solved by technology

However, in this technology, there is no explicit self-learning method, and the self-learning process is only for the current access request, and there is no correlation between the previous access request and the response result. In addition, this technology only targets the attacker's IP, IP The corresponding geographical location, etc., these are the basic attributes of the attacker, and cannot capture the complete behavior of the attacker, as a bait for later entrapment

Images