An active defense method and system

Abstract

This invention provides a proactive defense method and system, comprising: determining whether the attacker is a historical attacker; for historical attackers, responding to the attacker's request using a corresponding honeypot; for non-historical attackers, forwarding attack traffic to a honeypot cluster to obtain a honeypot response; determining whether the honeypot response is within a denial domain; using the honeypot corresponding to the honeypot response not within the denial domain as the honeypot responding to the attacker's request; if multiple honeypot responses are all within the denial domain, adopting a random response strategy to confuse the attacker; recording the response message generated by the honeypot responding to the attacker and the attacker's characteristics in the log; the log also includes a mapping list; to improve the overall robustness and deception of the system.

Description

Technical Field

[0001] This invention relates to the field of network attack technology, and more specifically, to a proactive defense method and system. Background Technology

[0002] With the widespread adoption of the internet and the rapid development of various computer technologies, cyberspace, as the "fifth domain" after land, sea, air, and space, has received significant attention. Existing traditional defense technologies such as firewalls and intrusion detection systems, due to their static, passive, and lagging limitations, are unable to withstand increasingly automated, diversified, and intelligent attack methods. Therefore, honeypots, as a proactive defense technology, have returned to the attention of security experts. Honeypots protect the security of normal production systems by deceiving and luring attackers, capturing attack data and production threat intelligence. Existing honeypots rely on identifying attack traffic and redirecting attack traffic targeting different services to corresponding honeypots in the hope of intelligently capturing different types of attack behaviors. Although existing honeypots use Docker to build highly interactive honeypots that can be more closely integrated with business systems, honeypots are still not real business systems. Furthermore, most existing honeypot and honeynet systems adopt static deployment methods, making it difficult to dynamically respond to changes in attack methods and easily identified by experienced attackers.

[0003] In view of this, the present invention provides an active defense method and system. In response to the problems that existing technologies cannot cope with attackers with ever-changing attack methods and that honeypots are easily identified by attackers, resulting in reduced honeypot availability, the present invention proposes to use a CF model with credibility reasoning to reduce the probability of attacker identification, and to combine Q-learning to optimize the request order of honeypots to improve the overall robustness and deception of the system. Summary of the Invention

[0004] The purpose of this invention is to provide a proactive defense method, comprising: receiving an attacker's request and generating attack traffic; determining whether the attacker is a historical attacker based on the attack traffic and a mapping list; if the attacker is a historical attacker, responding to the attacker's request using a corresponding honeypot; if the attacker is not a historical attacker, forwarding the attack traffic to a honeypot cluster, obtaining honeypot responses from multiple honeypots within the honeypot cluster; determining whether the honeypot response is within a rejection domain based on the honeypot request order; using the honeypot corresponding to the response not within the rejection domain as the honeypot responding to the attacker's request; if multiple honeypot responses are within the rejection domain, adopting a random response strategy to confuse the attacker; recording the response message generated by the honeypot responding to the attacker and the attacker's characteristics in a log; the log also includes a mapping list, which includes the correspondence between historical attackers and the honeypots responding to those historical attackers.

[0005] Furthermore, determining whether the honeypot response is within the denial domain includes: forwarding the attack traffic to the honeypot according to the honeypot request order, whereby the honeypot generates a honeypot response; determining whether the honeypot response is within the denial domain; if the honeypot response is within the denial domain, sending the honeypot's response message to the attacker and updating the mapping list; if the honeypot response is not within the denial domain, forwarding the attack traffic to the next honeypot and repeating the determination process.

[0006] Furthermore, the honeypot request order is obtained through reinforcement learning, including: inputting the logs into a reinforcement learning model, and the reinforcement learning model adjusting the initial honeypot request order using the Q-learning algorithm based on historical access data.

[0007] Furthermore, the initial honeypot request order is obtained by scoring the corresponding attack vector and personalized configuration level in the honeypot.

[0008] Furthermore, determining whether the attacker is a historical attacker includes: obtaining the attacker's IP address and determining whether the IP address has been accessed before based on the mapping list; if the IP address has been accessed before, the attacker is determined to be a historical attacker; if the IP address has not been accessed before, it is determined whether the attacker accessed the site through a search engine; if the attacker accessed the site through a search engine, the attacker is determined not to be a historical attacker; if the attacker did not access the site through a search engine, attack information is obtained; the attack information is compared with the attacker characteristics in the logs, and an attack similarity is obtained based on credibility reasoning; if the attack similarity is greater than a similarity threshold, the attacker is considered a historical attacker; otherwise, the attacker is considered not to be a historical attacker.

[0009] Furthermore, the random response strategy includes randomly sending a rejection response, no response, or a default response.

[0010] The purpose of this invention is to provide a proactive defense system, including a redirection module, a collaborative control module, a honeypot cluster, and a log recording module. The redirection module receives attack traffic and forwards it to the collaborative control module. The collaborative control module is responsible for the collaborative functions of the honeypot cluster. These collaborative functions include determining whether the attacker is a historical attacker and responding to the attacker based on the determination result. The honeypot cluster attracts attackers and monitors their behavior. The log recording module records logs and generates a mapping list. The recorded logs include response messages generated by the honeypots in response to the attackers and attacker characteristics.

[0011] Furthermore, it also includes a reinforcement learning module; the reinforcement learning module is used to adjust the request data of the honeypot in the collaborative control module based on the recorded logs, and update the honeypot request order.

[0012] Furthermore, the collaborative control module includes a historical attacker determination module, a traffic forwarding module, a honeypot determination module, and a random response module. The historical attacker determination module is used to determine whether the attacker is a historical attacker based on the attack traffic and the mapping list. The traffic forwarding module is used to respond to the attacker's request using the corresponding honeypot when the attacker is a historical attacker. When the attacker is not a historical attacker, the attack traffic is forwarded to the honeypot cluster, and honeypot responses from multiple honeypots within the honeypot cluster are obtained respectively. The honeypot determination module is used to determine whether the honeypot response is within the rejection domain based on the honeypot request order. The honeypot corresponding to the honeypot response that is not within the rejection domain is used as the honeypot to respond to the attacker's request. The random response module is used to adopt a random response strategy to confuse the attacker when multiple honeypot responses are within the rejection domain.

[0013] Furthermore, determining whether the honeypot response is within the denial domain includes: forwarding the attack traffic to the honeypot according to the honeypot request order, whereby the honeypot generates a honeypot response; determining whether the honeypot response is within the denial domain; if the honeypot response is within the denial domain, sending the honeypot's response message to the attacker and updating the mapping list; if the honeypot response is not within the denial domain, forwarding the attack traffic to the next honeypot and repeating the determination process.

[0014] The technical solutions of the embodiments of the present invention have at least the following advantages and beneficial effects:

[0015] The proactive defense method and system proposed in this invention prevent attackers from identifying the system as a honeypot system by first determining whether the attacker is a historical attacker who has previously accessed the system, thereby enhancing the system's availability and robustness.

[0016] The proactive defense method and system proposed in this invention can also modify the request order of Web honeypots using Q-learning based on past access and attack data. By modifying the default honeypot, the system's ability to capture attacks is greatly improved. The change in the honeypot request order improves the system's response efficiency and makes it more intelligent, enabling it to better cope with attackers with ever-changing attack methods. For Web honeypots that are accessed less frequently, the corresponding container can be started only after a relevant attack request is detected, further reducing resource consumption. Attached Figure Description

[0017] Figure 1 This is an overall framework diagram of the active defense system in an embodiment of the present invention;

[0018] Figure 2 This is a flowchart of the collaborative control module in the active defense system of this invention.

[0019] Figure 3 This is a diagram showing the working relationship of the reinforcement learning module in the active defense system of this invention. Detailed Implementation

[0020] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. The components of the embodiments of the present invention described and shown in the accompanying drawings can generally be arranged and designed in various different configurations.

[0021] The present invention provides an active defense method, characterized in that it includes:

[0022] It receives requests from attackers and generates attack traffic.

[0023] Based on the attack traffic and mapping list, it is determined whether the attacker is a historical attacker.

[0024] The step of determining whether the attacker is a historical attacker includes: obtaining the attacker's IP address and determining whether the IP address has been accessed before based on the mapping list; if the IP address has been accessed before, the attacker is determined to be a historical attacker; if the IP address has not been accessed before, it is determined whether the attacker accessed the site through a search engine; if the attacker accessed the site through a search engine, the attacker is determined not to be a historical attacker; if the attacker did not access the site through a search engine, attack information is obtained; the attack information is compared with the attacker characteristics in the logs, and an attack similarity is obtained based on credibility reasoning; if the attack similarity is greater than a similarity threshold, the attacker is considered a historical attacker; otherwise, the attacker is considered not to be a historical attacker.

[0025] Attack information includes the attacker's IP address, port, and request messages. The similarity threshold refers to a set threshold at which two attackers can be considered to be the same person; if the similarity exceeds this threshold, the two attackers can be considered to be the same person.

[0026] The random response strategy includes randomly sending a rejection response, no response, or a default response.

[0027] If the attacker is a historical attacker, then the corresponding honeypot is used to respond to the attacker's request.

[0028] If the attacker is not a historical attacker, the attack traffic is forwarded to the honeypot cluster, and honeypot responses from multiple honeypots within the honeypot cluster are obtained respectively.

[0029] Based on the honeypot request order, determine whether the honeypot response is within the rejection domain.

[0030] The honeypot request order is obtained through reinforcement learning, including: inputting the logs into a reinforcement learning model, which then uses the Q-learning algorithm to adjust the initial honeypot request order based on historical access data. The initial honeypot request order is obtained through the attack vectors and personalized configuration level scores corresponding to the honeypots.

[0031] The step of determining whether the honeypot response is within the denial domain includes: forwarding the attack traffic to the honeypot according to the honeypot request order, whereby the honeypot generates a honeypot response; determining whether the honeypot response is within the denial domain; if the honeypot response is within the denial domain, sending the honeypot's response message to the attacker and updating the mapping list; if the honeypot response is not within the denial domain, forwarding the attack traffic to the next honeypot and repeating the determination process.

[0032] The honeypot whose response is not in the denial domain is used as the honeypot that responds to the attacker's request.

[0033] If multiple honeypot responses are within the rejection domain, a random response strategy is adopted to confuse the attacker.

[0034] The response message generated by the honeypot in response to the attacker and the attacker's characteristics are recorded in the log.

[0035] The logs also include a mapping list, which includes the correspondence between historical attackers and honeypots that responded to those historical attackers.

[0036] The active defense system provided by this invention, such as Figure 1 As shown, it includes a redirection module, a collaborative control module, a honeypot cluster, and a log recording module.

[0037] The redirection module receives attack traffic and forwards it to the collaborative control module. The proactive defense system of this invention provides a web honeypot, therefore all forwarded traffic is HTTP. Using the redirection module allows the honeypot cluster to operate without being limited by the deployment environment; attackers only need access to the redirection module to perform subsequent deception operations.

[0038] The coordination control module is responsible for the coordination functions of the honeypot cluster. These functions include determining whether an attacker is a historical attacker and responding to the attacker based on the determination result. For a given attack, the coordination control module first performs some preliminary preprocessing on the request, then selects the most suitable response from the received honeypot responses to interact with the attacker, and finally records traffic and logs. This module is implemented by modifying the source code of the open-source man-in-the-middle packet capture tool Mitmproxy.

[0039] The collaborative control module includes a historical attacker determination module, a traffic forwarding module, a honeypot determination module, and a random response module. The historical attacker determination module determines whether the attacker is a historical attacker based on the attack traffic and the mapping list. The traffic forwarding module responds to the attacker's request using the corresponding honeypot when the attacker is a historical attacker; when the attacker is not a historical attacker, the attack traffic is forwarded to the honeypot cluster, obtaining honeypot responses from multiple honeypots within the cluster. The honeypot determination module determines whether the honeypot response is within a rejection domain based on the honeypot request order; the honeypot corresponding to the response not within the rejection domain is used as the honeypot responding to the attacker's request. The random response module uses a random response strategy to confuse the attacker when multiple honeypot responses are within the rejection domain.

[0040] Honeypot clusters are used to attract attackers and monitor their behavior. By combining container technology with Docker to build honeypot clusters, they become more lightweight and possess excellent portability, high customizability, and scalability. Typical virtual machines occupy gigabytes of disk space, while Docker occupies only megabytes, allowing for the configuration of more honeypots in the backend.

[0041] The logging module is used to record logs and generate a mapping list; the recorded logs include response messages generated in response to the attacker's honeypot and attacker characteristics. It is mainly divided into three parts: Nginx logging in the redirection module, Mitmproxy's traffic recording, and the recording of the behavior of the compromised honeypot.

[0042] The proactive defense method of this invention further includes a reinforcement learning module. This module adjusts the request data of honeypots in the collaborative control module based on the recorded logs and updates the honeypot request order to optimize the honeypot order. By processing and analyzing the logs in the log recording module, attack trends in the attack flow are identified, and honeypots favored by attackers are placed in more prominent positions, thus exposing these honeypots to the attacker's view more frequently.

[0043] In a typical penetration test, an attacker first sends probe packets to the target site. The attacker might directly request the corresponding domain name or IP address and examine the response to determine the type of website. Alternatively, they might add a specific path to the target site to the URL (Uniform Resource Locator), such as wp-login.php in WordPress. Only if the target site matches the desired website type will the attack proceed; otherwise, the attacker will continue searching for the next site to try.

[0044] The system described in this invention stores a large number of different types of web honeypots at the backend, exposes an access interface to the outside world through only one domain name, and intelligently selects the most suitable web honeypot for response after processing by the collaborative control module. The specific access process is as follows:

[0045] The attacker first accesses a redirection module on the public internet. This module uses tunneling technology to forward traffic to the network where the coordination control module resides. The coordination control module then processes and forwards the traffic to a honeypot cluster. Multiple honeypots return responses, and the coordination control module selects which one to ultimately respond to the attacker. Thus, from the attacker's perspective, they appear to be interacting with a server deployed on the public internet, unaware of the existence of the coordination control module.

[0046] The workflow of the collaborative control module is as follows: Figure 2 As shown.

[0047] For a specific attack, the collaborative control module will use the mapping table to determine whether the IP has been accessed before. If it has been accessed, the corresponding honeypot will be used to respond directly. If it has not been accessed, further judgment will be made.

[0048] Next, it will use threat intelligence, User-Agent headers and other methods to determine whether it is a search engine. If it is not a search engine, it will compare the fingerprint information in the database with the IP reputation, region, tags, carrier, C segment, domain, whether it is a compromised host, operating system, open ports and other dimensions. It will also use the CF model in the credibility reasoning to infer a similarity. When the similarity exceeds a certain threshold, it is considered to be the same attacker and the same honeypot will be used to respond.

[0049] If the visitor is determined to be a search engine or an attacker who has not visited before, a collaborative strategy is used to respond: The collaborative control module forwards the request to the first honeypot in the honeypot pool. The response from the first honeypot is processed and judged. If the response is not in the rejection domain, the response message can be directly sent to the attacker and the mapping list is updated. If the response is in the rejection domain, that is, the response is not accepted. At this time, it is judged whether all honeypots in the honeypot pool have been visited. If there are still honeypots in the honeypot pool that have not been visited, the URL of the next honeypot is obtained and the above process of forwarding the request and judging whether it is in the rejection domain is repeated. If all honeypots in the honeypot pool have been visited, a random response strategy is adopted to confuse the attacker.

[0050] The random response strategy involves randomly sending a rejection response (server error), a no response (client error), or a default response. Finally, successfully forwarded response packets, along with the attacker's IP address, port, and request packets, are logged.

[0051] The relationship between the reinforcement learning module and other components in the system is as follows: Figure 3 As shown.

[0052] First, the defender inputs the corresponding attack vector from the honeypot, and then inputs the personalized configuration level score into the system. Then, an initial honeypot request sequence list is obtained, and the collaborative control unit will request the backend honeypot cluster from the list in sequence.

[0053] After the system is deployed and launched, log data is continuously collected, processed by the log collection and processing section, and input into the reinforcement learning module. Based on past access data, the Q-learning algorithm is used to optimize the honeypot list.

[0054] Specifically, whenever a honeypot is attacked, it will be requested with higher priority the next time. Honeypots that are rarely or never accessed can be placed in a lower position, or even stopped most of the time to reduce resource consumption.

[0055] The above are merely preferred embodiments of the present invention and are not intended to limit the present invention. Various modifications and variations can be made to the present invention by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. An active defense method, characterized by, include: Receive requests from attackers and generate attack traffic; Based on the attack traffic and mapping list, it is determined whether the attacker is a historical attacker; If the attacker is a historical attacker, then the corresponding honeypot is used to respond to the attacker's request; If the attacker is not a historical attacker, the attack traffic is forwarded to the honeypot cluster, and honeypot responses from multiple honeypots within the honeypot cluster are obtained respectively. Based on the honeypot request order, determine whether the honeypot response is within the rejection domain; The honeypot request order is obtained through reinforcement learning, including: inputting logs into a reinforcement learning model, which uses the Q-learning algorithm to adjust the initial honeypot request order based on historical access data; the initial honeypot request order is obtained through the attack vectors and personalized configuration scores corresponding to the honeypots; whenever a honeypot is attacked, the priority of that honeypot being requested next time is increased. The honeypot whose response is not in the denial domain is used as the honeypot that responded to the attacker's request; If multiple honeypot responses are within the rejection domain, a random response strategy is adopted to confuse the attacker. The response message generated by the honeypot in response to the attacker and the attacker's characteristics are recorded in the log; the log also includes a mapping list, which includes the correspondence between historical attackers and the honeypots that responded to those historical attackers.

2. The method of active defense according to claim 1, wherein, The step of determining whether the honeypot response is within the rejection domain includes: The attack traffic is forwarded to the honeypot in the order of the honeypot requests, and the honeypot generates a honeypot response; Determine whether the honeypot response is within the rejection domain; If the honeypot response is not within the denial domain, then the honeypot response message is sent to the attacker and the mapping list is updated; If the honeypot response is within the denial domain, the attack traffic is forwarded to the next honeypot, and the judgment process is repeated.

3. The active defense method according to claim 1, characterized in that, The determination of whether the attacker is a historical attacker includes: Obtain the attacker's IP address and determine whether the IP address has already been accessed based on the mapping list; If the IP address has already been accessed, the attacker is determined to be a historical attacker. If the IP address has not been accessed, determine whether the attacker accessed the site through a search engine. If the access is made through a search engine, then the attacker is determined not to be a previous attacker. If the information is not accessed through a search engine, then attack information is obtained; The attack information is compared with the attacker characteristics in the log, and the attack similarity is obtained based on credibility reasoning. If the attack similarity is greater than the similarity threshold, the attacker is considered to be a historical attacker; otherwise, the attacker is considered not to be a historical attacker.

4. The active defense method according to claim 1, characterized in that, The random response strategy includes randomly sending a rejection response, no response, or a default response.

5. The active defense system according to any one of claims 1-4, characterized in that, It includes a redirection module, a collaborative control module, a honeypot cluster, and a logging module; The redirection module is used to receive attack traffic and forward the attack traffic to the collaborative control module; The collaborative control module is responsible for the collaborative functions of the honeypot cluster; the collaborative functions include determining whether the attacker is a historical attacker and responding to the attacker based on the determination result; The honeypot cluster is used to attract attackers and monitor their behavior; The logging module is used to record logs and generate a mapping list; the recorded logs include response messages generated in response to the attacker's honeypot and attacker characteristics.

6. The active defense method according to claim 5, characterized in that, It also includes a reinforcement learning module; the reinforcement learning module is used to adjust the request data of the honeypot in the collaborative control module based on the recorded logs, and update the honeypot request order.

7. The active defense method according to claim 5, characterized in that, The collaborative control module includes a historical attacker judgment module, a traffic forwarding module, a honeypot judgment module, and a random response module; The historical attacker determination module is used to determine whether the attacker is a historical attacker based on the attack traffic and the mapping list; The traffic forwarding module is used to respond to the attacker's request using the corresponding honeypot when the attacker is a historical attacker; When the attacker is not a historical attacker, the attack traffic is forwarded to the honeypot cluster, and honeypot responses from multiple honeypots within the honeypot cluster are obtained respectively. The honeypot determination module is used to determine whether the honeypot response is within the rejection domain based on the honeypot request order; The honeypot whose response is not in the denial domain is used as the honeypot that responded to the attacker's request; The random response module is used to confuse the attacker by adopting a random response strategy when multiple honeypot responses are within the rejection domain.

8. The active defense method according to claim 7, characterized in that, The step of determining whether the honeypot response is within the rejection domain includes: The attack traffic is forwarded to the honeypot in the order of the honeypot requests, and the honeypot generates a honeypot response; Determine whether the honeypot response is within the rejection domain; If the honeypot response is not within the denial domain, then the honeypot response message is sent to the attacker and the mapping list is updated; If the honeypot response is within the denial domain, the attack traffic is forwarded to the next honeypot, and the judgment process is repeated.

Images