Attack detection method for applying naive Bayes classifier to honeypot

Abstract

The invention provides an attack detection method using a naive Bayes classifier in a honeypot. The method comprises an active trapping honeypot and an active verification cloud sandbox. The active trapping honeypot is realized by an active trapping honeypot system; the active trapping honeypot system comprises a host layer, a service layer, an event layer, a data model layer and a detection layer. The active verification cloud sandbox is used for analyzing and discriminating 0DAY and NDAY vulnerabilities widely adopted in network attacks by using codes and special Trojan horses, and discovering intrusion behaviors. By applying the technical scheme, the attack detection capability of the naive Bayes classifier in a honeypot environment can be improved, so that a more effective protection means is provided for network security.

Description

Technical Field

[0001] The present invention relates to the technical field of attack detection, in particular to an attack detection method using a naive Bayes classifier in a honeypot. Background Art

[0002] Honeypot technology is an active defense method that attracts attackers by simulating real systems in order to collect their attack behavior data. This technology is widely used in the field of network security to study and analyze attack patterns. However, with the continuous evolution of network attack methods, how to efficiently and accurately detect and classify attack behaviors in honeypots has become an urgent problem to be solved.

[0003] At present, traditional attack detection methods mostly rely on rules or signatures, which are difficult to deal with new and complex attack methods. At the same time, the introduction of machine learning methods provides new ideas for attack detection, especially the naive Bayes classifier, which has become a potential solution because of its simplicity and ease of implementation and effectiveness in learning small samples. The technical problems of existing technologies include:

[0004] Data imbalance: In a honeypot environment, there is often a large imbalance between normal traffic and attack traffic, which makes it difficult to effectively learn attack features during model training. Methods need to be designed to balance the data set and improve the accuracy of the classifier.

[0005] Feature selection and extraction: Honeypots collect a large amount of data with many feature dimensions. How to extract effective features from them so that the naive Bayes classifier can classify quickly and accurately is an important issue.

[0006] Real-time and efficiency: Attack detection needs to be performed in real time, and traditional training and prediction processes may cause delays. Therefore, how to optimize the model training and prediction process to ensure real-time response is another technical challenge of this solution.

[0007] Diversity of attack types: Attackers use a variety of means to attack, and the attack behavior may change constantly. The naive Bayes classifier needs to have a certain degree of adaptability to cope with new attacks.

[0008] Assumption of independence problem: The assumption of feature independence of the naive Bayes classifier may not hold true in some cases, resulting in reduced classification accuracy. Therefore, how to alleviate this problem through model improvement or feature engineering is a technical difficulty that needs to be solved in this solution. Summary of the invention

[0009] In view of this, the purpose of the present invention is to provide a method for attack detection using a naive Bayes classifier in a honeypot, thereby improving the attack detection capability of the naive Bayes classifier in a honeypot environment, thereby providing a more effective protection means for network security.

[0010] To achieve the above-mentioned purpose, the present invention adopts the following technical scheme: a naive Bayes classifier is used in an attack detection method in a honeypot, including an active trapping honeypot and an active verification cloud sandbox; the active trapping honeypot is realized by an active trapping honeypot system; the active trapping honeypot system includes a host layer, a service layer, an event layer, a data model layer and a detection layer; the active verification cloud sandbox is used to analyze and identify 0DAY and NDAY vulnerability exploitation codes and special Trojans widely used in network attacks to discover intrusion behaviors.

[0011] In a preferred embodiment, the goal of the host layer is to establish a honeypot host; the host layer is composed of a virtual honeypot simulator and a honeypot manager; the role of the service layer is to provide real network services to interact with attackers; the role of the event layer is to collect information generated by the service layer and the host layer; by defining various events and event attributes, the event layer shields the impact of honeypot systems of different types and different implementation methods on upper-level data analysis; the data model layer receives notifications of various events from the event layer, and then extracts regularized data models from the attributes of various events, and finally hands them over to the detection layer for processing; the data model layer includes a monitoring data model; the role of the detection layer is to further detect attack behaviors or attackers based on the data model provided by the data model layer.

[0012] In a preferred embodiment, the detection layer includes a TFRPP detection model and a Bayesian detection model;

[0013] The TFRPP detection model globally behaves in the entire honeypot system to determine whether the host is an attacker. Through calculation, we assign a suspicious value to each visitor in the monitoring window. If the suspicious value exceeds the given threshold λ, the visitor is considered to be an attacker;

[0014]

[0015] Given a monitoring window w and a visitor h to the honeypot, by defining the set of access events Ehw generated by host h on the monitoring window w, we can get the set of access times Ehw generated by h on w. Then, we calculate the five attribute values ​​A1(Ehw), A2(Ehw), A3(Ehw), A4(Ehw) and A5(Ehw) of Ehw. For each attribute value Ai(Ehw), we calculate the corresponding abnormality value DSi(Ai(Ehw)). We take their weighted sum to get the suspiciousness DubietyScore(Ehw) on the monitoring window w. If DubietyScore(Ehw)>λ, it is considered that host h is attacking within the monitoring window w. The value range of DSi(Ehw) is a real number from 0 to 10, w i is the weight corresponding to DSi(Ai(Ehw));

[0016] The input instance of the Bayesian detection model is the access event generated by host h on monitoring window w combined with Ehw. According to the definition of DS4(A4(Ehw)), EhMw is also represented as the conjunction of a series of attributes.<a1,a2,a3,a4,a5,a6> , where ai is the value belonging to Ai(Ehw); the target set for classification is V = {vhs, vps, vpg, vbo, vbd, vnm}.

[0017] In a preferred embodiment, the active verification cloud sandbox is to build a virtual application computing environment through virtualization technology, and then equipped with corresponding probe plug-ins to form an application environment sandbox with sample analysis capabilities. When the file sample is opened or executed in the sandbox, the corresponding analysis work is performed; the analysis of the sample file is mainly divided into two stages: monitoring and intelligent judgment. First, it is necessary to monitor the usage and change process of the process thread, registry, network, system configuration computer resources generated after the application of the file sample in the sandbox is parsed, and then perform rule-based and machine learning technology-based intelligent judgment based on the analysis results; at the same time, a complete set of assembly line operation methods is constructed by batch control sandboxes for sample analysis; this workflow also needs to be able to dynamically adjust the sandbox built based on different templates according to the strategy to detect file samples of different formats, thereby realizing a sandbox analysis engine based on behavior detection.

[0018] In a preferred embodiment, the cloud sandbox includes a physical architecture, a system architecture, and a sandbox engine;

[0019] The physical architecture includes a physical machine, an underlying system, a sandbox analysis environment, a detection judgment, and an integrated interface; the underlying system uses the CentOS operating system to provide a stable computing environment; the sandbox analysis environment: a probe program is equipped in the Windows system virtualized by the VirtualBox virtual software to monitor the active behavior of the sample; the detection judgment uses rule-based monitoring log analysis and intelligent judgment based on machine learning; the integrated interface provides a visual presentation of the sample analysis results;

[0020] The system architecture includes the underlying system, sample source, sandbox engine and product interface; the underlying system uses the CentOS underlying operating system, and the sandbox is built based on the VirtualBox virtual software platform, which is software-hardware independent and highly portable; after the sample source captures the traffic, it identifies and restores the protocol in the traffic, and performs file restoration on the content transmitted by the specified protocol to obtain the file sample to be analyzed by the sandbox engine; the sandbox engine controls different virtual machine sandbox environments with different templates through sandbox scheduling, and analyzes and judges various computer resource monitoring logs monitored by the probe program through rule matching and machine learning; the product interface provides a good user operation interface to display the analysis results of the sandbox engine on the sample file;

[0021] In a preferred embodiment, the sandbox engine mainly includes a pre-processing service, an AV detection service module, a sandbox scheduling engine module, a sandbox probe module and an analysis and processing engine module.

[0022] In a preferred embodiment, the pre-processing service receives file detection requests from external systems, provides the function of adjusting detection task priorities, receives sandbox system command configuration requests, and allows external dynamic adjustment of system configuration items.

[0023] In a preferred embodiment, the AV detection service module integrates different antivirus engines through configuration files as needed to improve the detection rate of the sandbox engine for known samples; the AV detection service provides file detection request services through the TCP server, and it relies on the AV interface layer to isolate the calls of different AV engine SDKs; different AV engines will encapsulate functions according to the interface conventions of the AV interface layer, and provide detection functions in the form of dynamic libraries

[0024] In a preferred embodiment, the sandbox scheduling engine module is mainly responsible for sandbox initialization, sandbox scheduling, detection task dispatching, receiving behavior log information from the sandbox, and completing the storage of original log information.

[0025] In a preferred embodiment, the probe module in the sandbox receives the samples sent by the scheduler, starts the monitoring environment, starts executing the samples, and monitors and records the dynamic behavior of the samples from the driver layer and application layer API call level, and sends the behavior back to the log receiving end as a log record; the analysis and processing engine module provides static and dynamic analysis and processing of the samples, and generates a sample analysis result report.

[0026] Compared with the prior art, the present invention has the following beneficial effects: improving the attack detection capability of the naive Bayes classifier in a honeypot environment, thereby providing a more effective protection means for network security BRIEF DESCRIPTION OF THE DRAWINGS

[0027] Figure 1 A schematic diagram of a layered architecture of a honeypot system according to a preferred embodiment of the present invention;

[0028] Figure 2 A schematic diagram of a virtual host and a virtual network implemented by a virtual honeypot simulator in a preferred embodiment of the present invention;

[0029] Figure 3 A schematic diagram of a monitoring window in a preferred embodiment of the present invention;

[0030] Figure 4 A schematic diagram of the physical architecture of the cloud sandbox according to a preferred embodiment of the present invention;

[0031] Figure 5 A schematic diagram of the cloud sandbox system architecture of a preferred embodiment of the present invention;

[0032] Figure 6 This is a schematic diagram of the cloud sandbox engine functional modules of a preferred embodiment of the present invention;

[0033] Figure 7 This is a schematic diagram of cloud sandbox pre-processing in a preferred embodiment of the present invention;

[0034] Figure 8 This is a processing flow chart of the cloud sandbox AV detection service module according to a preferred embodiment of the present invention;

[0035] Fig. 9 A schematic diagram of the cloud sandbox scheduling engine processing flow of a preferred embodiment of the present invention;

[0036] Fig.10 This is a schematic diagram of the composition of the cloud sandbox probe module of a preferred embodiment of the present invention;

[0037] Fig.11 This is a schematic diagram of the processing flow of the cloud sandbox probe module in a preferred embodiment of the present invention;

[0038] Fig.12 This is a schematic diagram of the composition of the cloud sandbox analysis and processing engine of a preferred embodiment of the present invention. DETAILED DESCRIPTION

[0039] The present invention will be further described below in conjunction with the accompanying drawings and embodiments.

[0040] It should be noted that the following detailed descriptions are illustrative and are intended to provide further explanation of the present application. Unless otherwise specified, all technical and scientific terms used herein have the same meanings as those commonly understood by those skilled in the art to which the present application belongs.

[0041] It should be noted that the terms used herein are only for describing specific embodiments and are not intended to limit the exemplary embodiments according to the present application; as used herein, unless the context clearly indicates otherwise, the singular form is also intended to include the plural form. In addition, it should be understood that when the terms "comprise" and / or "include" are used in this specification, they indicate the presence of features, steps, operations, devices, components and / or their combinations.

[0042] refer to Figure 1-12 ,A naive Bayes classifier is used in attack detection method in honeypot.,In the power network, the active trapping and verification of unknown attacks are ,divided into two levels: active trapping (honeypot) and active verification (cloud sandbox).

[0043] 1. Active trapping honeypot implementation method

[0044] The active trapping honeypot system has the following two main features: The layered architecture separates the host, service, event and event model, detection model and other functions from bottom to top. By clarifying the interaction relationship and interface definition, the low-interaction honeypot and high-interaction honeypot of the layered architecture can coexist in a honeypot system and give full play to their respective advantages.

[0045] The system structure of distributed deployment and centralized control is adopted. By deploying honeypot hosts in different subnets, the honeypot system becomes flexible and scalable, and can detect attack behaviors in a larger network range.

[0046] In order to pursue flexibility and scalability, and also to simplify the design and implementation of the honeypot system through modularization, the honeypot adopts a five-layer logical structure. Figure 1 As shown in the layered architecture of the honeypot system, the five functional layers are the host layer, service layer, event layer, data model layer and detection layer.

[0047] The goal of the host layer is to establish honeypot hosts, which look no different from ordinary real hosts on the network, thereby deceiving attackers. The host layer mainly consists of a virtual honeypot simulator and a honeypot manager.

[0048] The role of the service layer is to provide as real network services as possible to interact with attackers, such as Web services and mail services. These network services can be virtual or simulated, or real services provided by network server programs.

[0049] The function of the event layer is to collect information generated by the service layer and the host layer. By defining various events and event attributes, the event layer shields the impact of honeypot systems of different types and implementation methods on upper-layer data analysis.

[0050] The data model layer receives notifications of various events from the event layer, then extracts regularized data models from the attributes of various events, and finally hands them over to the detection layer for processing.

[0051] The function of the detection layer is to further detect attack behaviors or attackers based on the data model provided by the data model layer.

[0052] 1) Host layer and service layer

[0053] The key components of the host layer include the virtual honeypot simulator and the honeypot manager, which can implement three types of honeypots: software honeypot (virtual host simulated by software), physical honeypot (running operating system and services on real hardware platform), and virtual honeypot (running operating system and services on virtualized platform).

[0054] The software honeypot is implemented through a virtual honeypot simulator. Its main function is to construct virtual hosts, networks and virtual services on the network that can be mistaken for real ones through honeypot software. The virtual honeypot simulator is deployed in a protected network, collects unused IP addresses, and binds software honeypots to some addresses. In this way, the real business host and the virtual honeypot and protected network are integrated to build a network environment that lures attackers, such as Figure 2 .

[0055] Integrate physical honeypots through the honeypot manager. Install an operating system on a real hardware platform and run network services to get a physical honeypot. A physical honeypot is not much different from an ordinary business host, except that it does not have any normal business use. Its only function is to attract attackers and capture attack-related information. The honeypot system is integrated and managed by installing a honeypot manager on the physical honeypot. The honeypot manager is a kernel module installed at the bottom of the operating system. Its function is to capture all attack-related information, such as connection status, remote commands, system log information, system call sequences, etc. The honeypot manager can send this information covertly to the analysis component at the upper layer of the honeypot system.

[0056] Integrate virtual honeypots through the honeypot manager. Virtual honeypots run on virtual platforms (such as VMware virtual machines) rather than real hardware platforms, and are integrated and managed through the honeypot manager, which captures data from them.

[0057] 2) Event layer

[0058] The event layer abstracts and standardizes the information from different types of honeypots to facilitate the analysis of this information. It mainly includes two types of events, namely access events and connection events. If B = {b1, b2, ..., bn} is the set of honeypots, H = {h1, h2, ..., hm} is the set of service hosts in the deployed network, the definitions of access events and connection events are as follows:

[0059] Definition of access event: When a honeypot receives a message, it is called an access event. Each access event e has the six attributes given in Table 1.

[0060] Table 1:

[0061]

[0062]

[0063] Definition of connection event: When a visitor completes a complete TCP session with a honeypot, a connection event occurs. A connection event c has some properties given in Table 2.

[0064] Table 2:

[0065] property describe Time(c) Time of the incident Source(c) Event Visitors Destination(c) Honeypot where the incident occurred DestPort(c) Access port Flow(c) Data flow from the visitor to the honeypot host EventSet(c) A collection of access events (i.e. messages) included in this session

[0066] 3) Data Model Layer

[0067] The data model layer mainly includes monitoring data models, such as Figure 3 As shown, a monitoring window MWi is a period of time on the time axis, and the monitoring window moves with a fixed time granularity △t.

[0068] Define the time granularity △t——△t is a fixed time interval in seconds. Given △t, we can get the set of time collection points T = {ti€time|i≥0,ti+1 = ti+△t}, and other t0 is the initial time of the system.

[0069] Define the monitoring window MWi - The monitoring window MWi is a period of time from ti to ti+8, defined as MWi = {t€time|ti≤t≤ti+8,t,ti+8€T}, where 8 is the length of the monitoring window. Once the set of time acquisition points T is determined, the set of monitoring windows MW = {MWi|ti€T} can be obtained.

[0070] Define the set of access events Ehw generated by host h in monitoring window w. If EVENT is the set of all access events, then the set of access events generated by host h in monitoring window w (w€MW) is defined as Ehw = {e|e€EVENT, Time(e)€w, Source(e) = h}. From Ehw, a series of attributes from A1(Ehw) to A6(Ehw) can be obtained. These attributes come from the statistical information of the event set in the monitoring window.

[0071] 4) Detection layer

[0072] ①TFRPP detection model

[0073] Suspicion-based anomaly detection is a commonly used intrusion detection method. Based on this method, this project proposes a detection model TFRPP (Times, Frequency, Host-Range, Average-Port-risk, Average-Payload-length) on top of the monitoring window data model. Strictly speaking, this is an "attacker detection model". Its basic idea is to determine whether a host is an attacker by analyzing the global behavior of a host in the entire honeypot system within a period of time (monitoring window). Through calculation, we assign a suspicion value to each visitor in the monitoring window. If the suspicion value exceeds the given threshold λ, the visitor is considered to be an attacker.

[0074]

[0075] Given a monitoring window w and a visitor h to the honeypot, by defining the set of access events Ehw generated by host h on the monitoring window w, we can get the set of access times Ehw generated by h on w. After that, we can calculate the five attribute values ​​A1(Ehw), A2(Ehw), A3(Ehw), A4(Ehw) and A5(Ehw) of Ehw. For each attribute value Ai(Ehw), we calculate the corresponding abnormality value DSi(Ai(Ehw)), and take their weighted sum to get the suspicion DubietyScore(Ehw) on the monitoring window w. If DubietyScore(Ehw)>λ, we believe that host h has attacked within the monitoring window w. The value range of DSi(Ehw) is a real number from 0 to 10, wi is the weight corresponding to DSi(Ai(Ehw)), The definition of DSi(Ai(Ehw)) is as follows:

[0076] a) DS1(A1(Ehw)): Suspicion value related to the number of accesses. The number of times a honeypot is accessed reflects the activity of suspicious host activities. Obviously, the more times a host accesses the honeypot, the more likely it is an attacker. Using the number of accesses is helpful for detecting network topology discovery, host detection, host scanning and port scanning, worm viruses and other attack behaviors.

[0077] b) DS2 (A2 (Ehw)): Suspicion value related to access frequency. Many attack behaviors tend to be concentrated in time (high frequency within a period of time), which is mapped to a large number of honeypot access behaviors in a short period of time in the honeypot system. In view of this feature, we use access frequency to evaluate the host's suspicion. The more frequently a host accesses the honeypot, the more likely it is an intruder.

[0078] c) DS3 (A3 (Ehw)): Suspicion value related to access scope. In a network where a honeypot system is deployed, real hosts and honeypots are integrated with each other. Because the attacker does not understand the network situation, the attacker's activities (such as network topology discovery, scanning, worm propagation, etc.) will access the honeypot with a certain probability.

[0079] d) DS4(A4(Ehw)): Suspicion value associated with average port risk.

[0080] e) DS5(A5(Ehw)): Suspicion value related to the average payload length. By learning the length of the message after the normal user mistakenly accesses the honeypot, we calculate the average and variance of the payload length of the normal message.

[0081] After the TFRPP model is trained, assume that at each time ti, there are m hosts (visitors) generating n events in the monitoring window MWi. Because the TFRPP model calculates the suspiciousness value for each visitor, the computational overhead of the TFRPP model at time ti is 0 (mn).

[0082] ② Bayesian detection model

[0083] Naive Bayes classifiers are an algorithm based on Bayesian theory in the classification algorithm set. If U = {A1, A2, A3, ..., An, V} is a finite set of discrete random variables, where A1, A2, A3, ..., An is a set of attributes, and V = {v1, v2, v3, ..., vn} is the target set of classification. Let ai represent the value of attribute Ai, and each training sample and instance to be classified are represented as the conjunction of a series of attribute values.<a1,a2,a3,…,an> The task of the naive Bayes classifier f(x) is to predict new instances given the training data D.<a1,a2,a3,…,an> The predicted category is also called the maximum a posteriori hypothesis vmap (maximum aposteriori hypothesis).

[0084] The present invention constructs a naive Bayes classifier for attack detection in honeypots. The input instance of the classifier is the access event generated by the host h on the monitoring window w combined with Ehw. According to the definition of DS4(A4(Ehw)), we also represent EhMw as the conjunction of a series of attributes:<a1,a2,a3,a4,a5,a6> , where ai is the value belonging to Ai(Ehw). The target set of classification is some attack types given in Table 3, that is, V = {vhs, vps, vpg, vbo, vbd, vnm}.

[0085] Table 3:

[0086] Target Type name Key Features vhs HostScan Wide range of host access vps Port Scan Wide range of access ports vpg Password Guess Password input frequency is high vbo Buffer Overflow Attack The length of the sent data is large vbd BackDoorExploit The access port is highly suspicious vnm Normal user mistaken access (Normal) The port range is small, the number of accesses is small, and the frequency is low

[0087] 2. Active Verification (Cloud Sandbox) System Implementation Solution

[0088] The cloud sandbox system is mainly used to analyze and identify 0DAY and NDAY vulnerability exploit codes, special Trojans, etc. that are widely used in network attacks, and to discover typical intrusion behaviors such as spear phishing attacks, watering hole attacks, and malicious file propagation.

[0089] 1) Cloud sandbox system composition

[0090] The core technology implementation idea of ​​the sandbox is to build a virtual application computing environment through virtualization technology, and then equip it with corresponding probe plug-ins to form an application environment sandbox with sample analysis capabilities. By opening or executing file samples in the sandbox, corresponding analysis work can be performed.

[0091] The analysis of sample files is mainly divided into two stages: monitoring and intelligent judgment. First, it is necessary to monitor the usage and change process of a series of computer resources such as process threads, registry, network, system configuration, etc. generated after the application of file samples in the sandbox is parsed, and then conduct intelligent judgment based on rules and machine learning technology according to the analysis results. At the same time, a complete set of assembly line operation methods is built through batch control sandboxes for sample analysis. This workflow also needs to be able to dynamically adjust the sandboxes built based on different templates according to the strategy to detect file samples of different formats, thereby realizing a sandbox analysis engine based on behavior detection.

[0092] The following will explain the system composition of the sandbox detection product from three aspects: physical architecture, system architecture, and sandbox engine modules. Figure 4 , Figure 5 .

[0093] ① Physical machines: Based on high-performance servers, they use powerful computing capabilities to support virtual machines;

[0094] ②Underlying system: Use CentOS operating system to provide a stable computing environment;

[0095] ③Sandbox analysis environment: A probe program is installed in the Windows system virtualized by VirtualBox to monitor the active behavior of the sample;

[0096] ④Detection and judgment: Use rule-based monitoring log analysis and intelligent judgment based on machine learning;

[0097] ⑤Integrated interface: provides visual presentation of sample analysis results.

[0098] ⑥Underlying system

[0099] Using CentOS underlying operating system, the sandbox is built based on VirtualBox virtual software platform, which is software and hardware independent and highly portable;

[0100] ⑦Sample source

[0101] After capturing the traffic, identify and restore the protocol in the traffic, and restore the file of the content transmitted by the specified protocol to obtain the file sample to be analyzed by the sandbox engine;

[0102] ⑧Sandbox Engine

[0103] The sandbox engine is a sandbox that schedules and controls different virtual machine sandbox environments with different templates, and analyzes and judges various computer resource monitoring logs monitored by the probe program through rule matching and machine learning.

[0104] ⑨Product interface

[0105] Provide a good user interface and display the analysis results of the sandbox engine on the sample files.

[0106] 2) Functional modules of the cloud sandbox engine, such as Figure 6 .

[0107] The cloud sandbox system mainly includes five modules: pre-processing service, AV detection service module, sandbox scheduling engine, sandbox probe module and analysis and processing engine.

[0108] ①Pre-processing service

[0109] This module mainly provides interface service functions for interaction between the sandbox system and the system using the sandbox.

[0110] a) Receive file detection requests from external systems.

[0111] iAccording to the system's policy configuration, use the file preprocessing manager to load the preprocessing plug-in to preprocess and filter files that do not meet the policy configuration. Only after passing the filter will the files enter the detection task queue and be provided to the subsequent scheduler for scheduling.

[0112] ii Provide retesting of old tasks.

[0113] b) Provide the function of adjusting the detection task priority.

[0114] c) Receive sandbox system command configuration requests and allow external dynamic adjustment of system configuration items.

[0115] TCP communication provides a service for receiving external request instructions. When a file detection request is received, it will be queued first, and then the preprocessing filter manager will perform preprocessing operations in sequence according to the various preprocessing modules of the family. Only the samples that pass the final pass will be stored in the file detection task database, waiting to be scheduled for reading and execution.

[0116] ②AV detection service module

[0117] This module mainly provides antivirus engine scanning of samples. This module can integrate different antivirus engines through configuration files as needed to improve the detection rate of known samples by the sandbox engine. The AV detection service provides file detection request services through the TCP server, and it relies on the AV interface layer to isolate the calls of different AV engine SDKs. Different AV engines will encapsulate functions according to the interface conventions of the AV interface layer, and provide detection functions in the form of dynamic libraries.

[0118] Figure 8 This is a processing flow chart of the AV detection service module.

[0119] ③Sandbox scheduling engine

[0120] This module is mainly responsible for sandbox initialization, sandbox scheduling, detection task dispatching, receiving behavior log information from the sandbox, and completing the storage of original log information.

[0121] Fig. 9 This is the main flow chart of task scheduling and task dispatching of the sandbox scheduling module. It can be seen that the scheduler also needs to interact with the probe main service module in the sandbox, send samples to the probe main service, and receive the returned behavior log messages.

[0122] ④Sandbox probe module

[0123] The module receives the samples sent by the scheduler, starts the monitoring environment, starts executing the samples, monitors and records the dynamic behavior of the samples from the driver layer and application layer API call level, and sends the behavior back to the log receiving end as a log for recording.

[0124] Fig.10 The following is a schematic diagram of the module composition:

[0125] a) Probe master control service i starts the driver component;

[0126] ii. Receive samples transmitted from the outside;

[0127] iii. Start the sample, inject sample-related processes, and perform HOOKAPI operations; iv. Receive the monitored behavior logs sent from the driver component and the application layer HOOK component;

[0128] vTransmit logs to external log receiving terminals in real time;

[0129] vi controls the maximum running time of the sample in the system;

[0130] vii When the sample ends within the maximum running time, the external scheduler will be notified to close the sandbox.

[0131] b) Drive components

[0132] The driver component is started by the probe master control service program, which monitors five aspects, namely process, network, registry, file and module, at the Windwos operating system level, and sends the monitored behavior log information to the probe master control service.

[0133] c) Application layer HOOK components

[0134] i Perform API-level HOOK operations on sample-related processes at the application layer, monitor the sample's behavior at the API level, record API call information, and send the monitored information log to the probe master control service for recording.

[0135] ii A module that monitors the windows created by the sample process, by enumerating all windows

[0136] iii Monitor program abnormal behavior, mainly checking whether the API call source address is in the module, in the non-data segment, and called through call.

[0137] iv In addition, the API level will provide a function to prevent samples from anti-sandbox operations. It mainly detects and bypasses malicious sample detection by using various fingerprint information of virtual machines and camouflage.

[0138] like Fig.11 This is the main flow chart of the probe main module:

[0139] ⑤Analysis and processing engine

[0140] like Fig.12 This module provides static and dynamic analysis and processing of samples and generates sample analysis result reports. It includes three aspects:

[0141] a) Dynamic behavior analysis rule engine i loads the custom behavior rule library.

[0142] ii Based on the customized behavior rule library, the dynamic behavior log of the sample is matched to identify the matched behavior features.

[0143] iii. Score the threat level of samples based on the dynamic behavior analysis results using a heuristic algorithm.

[0144] b) Static Analysis Plugin Engine

[0145] i Loads the static analysis plug-ins in the specified directory. Each plug-in indicates the file type that can be processed.

[0146] ii. When trying to perform static analysis on a sample, first search for the static analysis plug-in that processes the corresponding file type based on the sample type to perform the analysis and processing action.

[0147] c) Machine Learning Detection Engine

[0148] The machine learning model files and feature files corresponding to different models used by the machine learning judgment engine are stored in the system's models directory. The machine learning model is a judgment model generated after learning and training through a large number of samples, different machine learning algorithms, and different feature vectors.

[0149] ii There is also an idx file stored in the models directory, which can be used to control the loading of the specified machine learning model.

[0150] The iii engine initialization will load the machine learning judgment model in the directory specified by the idx configuration file from the models module. Different models will specify different file types, and one file type will be judged separately by more than one model.

[0151] iv Extract the features used by the machine model from the dynamic and static log data, and submit the entire set of feature data to the machine learning model of this type for judgment processing. If there are multiple machine learning models that can process this sample type, each model will be judged to obtain a set of judgment list data. Finally, the judgment results of different models will be weighted, summarized and judged, and finally a judgment result of the machine learning judgment engine will be given.

[0152] Finally, the analysis and processing engine will summarize the dynamic analysis results, static analysis results, and machine learning detection results of the sample to give the final threat level of the sample, and store all the information that needs to be presented in the report file for external analysis, processing, and presentation.

Claims

1. A method for attack detection in a honeypot using a naive Bayes classifier, characterized in that: It includes active trapping honeypot and active verification cloud sandbox; active trapping honeypot is realized by active trapping honeypot system; active trapping honeypot system includes host layer, service layer, event layer, data model layer and detection layer; The active verification cloud sandbox is used to analyze and identify 0DAY and NDAY vulnerability exploit codes and special Trojans widely used in network attacks to detect intrusion behaviors.

2. The method for attack detection in a honeypot using a naive Bayes classifier according to claim 1, characterized in that: The goal of the host layer is to establish a honeypot host; the host layer consists of a virtual honeypot simulator and a honeypot manager; the role of the service layer is to provide real network services to interact with attackers; the role of the event layer is to collect information generated by the service layer and the host layer; By defining various events and their attributes, the event layer shields the impact of honeypot systems of different types and implementation methods on upper-layer data analysis; the data model layer receives notifications of various events from the event layer, and then extracts regularized data models from the attributes of various events, and finally hands them over to the detection layer for processing; the data model layer includes a monitoring data model; the role of the detection layer is to further detect attack behaviors or attackers based on the data model provided by the data model layer.

3. The method for attack detection in a honeypot using a naive Bayes classifier according to claim 2, characterized in that: The detection layer includes TFRPP detection model and Bayesian detection model; The TFRPP detection model globally behaves in the entire honeypot system to determine whether the host is an attacker. Through calculation, we assign a suspicious value to each visitor in the monitoring window. If the suspicious value exceeds the given threshold λ, the visitor is considered to be an attacker; Given a monitoring window w and a visitor h to the honeypot, by defining the set of access events Ehw generated by host h on the monitoring window w, we can get the set of access times Ehw generated by h on w. Then, we calculate the five attribute values ​​A1(Ehw), A2(Ehw), A3(Ehw), A4(Ehw) and A5(Ehw) of Ehw. For each attribute value Ai(Ehw), we calculate the corresponding abnormality value DSi(Ai(Ehw)). We take their weighted sum to get the suspiciousness DubietyScore(Ehw) on the monitoring window w. If DubietyScore(Ehw)>λ, it is considered that host h is attacking within the monitoring window w. The value range of DSi(Ehw) is a real number from 0 to 10, w i is the weight corresponding to DSi(Ai(Ehw)); The input instance of the Bayesian detection model is the access event generated by host h on monitoring window w combined with Ehw. According to the definition of DS4(A4(Ehw)), EhMw is also represented as the conjunction of a series of attributes.<a1,a2,a3,a4,a5,a6> , where ai is the value belonging to Ai(Ehw); the target set for classification is V = {vhs, vps, vpg, vbo, vbd, vnm}.

4. The method for attack detection in a honeypot using a naive Bayes classifier according to claim 1, characterized in that: The active verification cloud sandbox uses virtualization technology to build a virtual application computing environment, and then equips it with corresponding probe plug-ins to form an application environment sandbox with sample analysis capabilities. When the file sample is opened or executed in the sandbox, the corresponding analysis work is performed; the analysis of the sample file is mainly divided into two stages: monitoring and intelligent judgment. First, it is necessary to monitor the usage and change process of the process threads, registry, network, system configuration computer resources generated after the application of the file sample in the sandbox is parsed, and then perform rule-based and machine learning technology-based intelligent judgment based on the analysis results; at the same time, a complete set of assembly line operation methods is built through batch control sandboxes for sample analysis; this workflow also needs to be able to dynamically adjust the sandboxes built based on different templates according to the strategy to detect file samples of different formats, thereby realizing a sandbox analysis engine based on behavior detection.

5. The method for attack detection in a honeypot using a naive Bayes classifier according to claim 4, characterized in that: The cloud sandbox includes the physical architecture, system architecture, and sandbox engine; The physical architecture includes a physical machine, an underlying system, a sandbox analysis environment, a detection judgment, and an integrated interface; the underlying system uses the CentOS operating system to provide a stable computing environment; the sandbox analysis environment: a probe program is equipped in the Windows system virtualized by the VirtualBox virtual software to monitor the active behavior of the sample; the detection judgment uses rule-based monitoring log analysis and intelligent judgment based on machine learning; The integrated interface provides a visual presentation of sample analysis results; The system architecture includes the underlying system, sample source, sandbox engine and product interface; the underlying system uses the CentOS underlying operating system, and the sandbox is built based on the VirtualBox virtual software platform, which is software-hardware independent and highly portable; after the sample source captures the traffic, it identifies and restores the protocol in the traffic, and performs file restoration on the content transmitted by the specified protocol to obtain file samples to be analyzed by the sandbox engine; the sandbox engine controls different virtual machine sandbox environments with different templates through sandbox scheduling, and analyzes and judges various computer resource monitoring logs monitored by the probe program through rule matching and machine learning; the product interface provides a good user operation interface to display the analysis results of the sandbox engine on the sample files.

6. The method for attack detection in a honeypot using a naive Bayes classifier according to claim 5, characterized in that: The sandbox engine mainly includes pre-processing service, AV detection service module, sandbox scheduling engine module, sandbox probe module and analysis and processing engine module.

7. The method for attack detection in a honeypot using a naive Bayes classifier according to claim 6, characterized in that: The pre-processing service receives file detection requests from external systems, provides the function of adjusting the detection task priority, receives sandbox system command configuration requests, and allows external dynamic adjustment of system configuration items.

8. The method for attack detection in a honeypot using a naive Bayes classifier according to claim 6, characterized in that: The AV detection service module integrates different antivirus engines through configuration files as needed to improve the sandbox engine's detection rate for known samples; the AV detection service provides file detection request services through the TCP server, and it relies on the AV interface layer to isolate the calls of different AV engine SDKs; for different AV engines, the functions will be encapsulated according to the interface conventions of the AV interface layer, and the detection function will be provided in the form of a dynamic library.

9. The method for attack detection in a honeypot using a naive Bayes classifier according to claim 6, characterized in that: The sandbox scheduling engine module is mainly responsible for sandbox initialization, sandbox scheduling, detection task dispatching, receiving behavior log information from the sandbox, and completing the storage of original log information.

10. The method for attack detection in a honeypot using a naive Bayes classifier according to claim 6, characterized in that: The probe module in the sandbox receives the samples sent by the scheduler, starts the monitoring environment, starts executing the samples, monitors and records the dynamic behaviors of the samples from the driver layer and the application layer API call level, and sends the behaviors back to the log receiving end as logs for recording; The analysis and processing engine module provides static and dynamic analysis and processing of samples and generates sample analysis result reports.

Images