Attack trapping method and device for virtual power plant network, electronic equipment and storage medium

Abstract

The invention discloses an attack trapping method and device for a virtual power plant network, electronic equipment and a storage medium, and the method comprises the steps: judging that an abnormal attack behavior exists in terminal equipment corresponding to a probe when terminal abnormality alarm information sent by the probe is received; the method comprises the following steps: analyzing attack characteristics of an abnormal attack behavior according to terminal abnormity alarm information, and then generating a honeypot instance with the same functional characteristics as terminal equipment on a current idle honeypot node according to the equipment type of the terminal equipment and the attack characteristics; binding the generated honeypot instance with a probe, and then redirecting the attack traffic of the abnormal attack behavior in the terminal equipment to the bound honeypot instance; and when it is confirmed that the abnormal attack behavior in the honeypot instance is finished, unbinding the honeypot instance and the probe, and rebinding the probe to the corresponding terminal equipment. According to the invention, efficient and flexible network attack trapping can be realized.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to an attack trapping method, device, electronic equipment and storage medium for a virtual power plant network. Background Art

[0002] With the development of virtual power plant (VPP) technology, more and more distributed resources (such as energy storage equipment, electric vehicles, distributed power generation equipment, etc.) are connected to the power network, forming a new plug-and-play network model. This dynamic and highly distributed environment makes it difficult for traditional static network security measures to adapt. The traditional one-to-one static binding of honeypots and probes cannot adapt to the hot-swap requirements of a large number of plug-and-play devices in virtual power plants. If too many honeypot resources are statically deployed, it will cause excessive resource consumption. Summary of the invention

[0003] The present invention provides an attack trapping method, device, electronic device and storage medium for a virtual power plant network to solve the technical problem that the traditional one-to-one static binding of honeypots and probes cannot adapt to the hot-plugging requirements of a large number of plug-and-play devices in virtual power plants, and if too many honeypot resources are statically deployed, it will cause excessive resource consumption.

[0004] In order to solve the above technical problems, an embodiment of the present invention provides an attack trapping method for a virtual power plant network, comprising:

[0005] When receiving the terminal abnormality alarm information sent by the probe, it is determined that there is abnormal attack behavior in the terminal device corresponding to the probe; wherein the probe is deployed in the terminal device at the edge side of the virtual power plant, and detects whether there is abnormal attack behavior in the terminal device according to the network data packet of the corresponding terminal device;

[0006] According to the abnormal alarm information of the terminal, the attack characteristics of the abnormal attack behavior are analyzed, and then according to the device type of the terminal device and the attack characteristics, a honeypot instance with the same functional characteristics as the terminal device is generated on the currently idle honeypot node;

[0007] Binding the generated honeypot instance to the probe, and then redirecting the attack traffic of the abnormal attack behavior in the terminal device to the bound honeypot instance;

[0008] After confirming that the abnormal attack behavior in the honeypot instance has ended, the honeypot instance is unbound from the probe, and the probe is rebound to the corresponding terminal device.

[0009] As a preferred solution, generating a honeypot instance having the same functional characteristics as the terminal device on a currently idle honeypot node according to the device type of the terminal device and the attack characteristics includes:

[0010] Obtain the priority of the probe, sort the priorities of all probes that currently send terminal abnormality alarm information at the same time, and generate a honeypot instance with the same functional characteristics as the corresponding terminal device on the currently idle honeypot node according to the device type and the attack characteristics of the terminal device corresponding to the probe with the highest priority in order from high to low priority.

[0011] As a preferred solution, the priority of the probe is calculated by the following formula:

[0012]

[0013] Among them, Q i Probe P i Priority; Criticality (P i ) is the probe P i The more critical the device, the higher the priority; AttackRate (P i ) is the probe P i The frequency of attacks detected; α and β are adjustment coefficients.

[0014] As a preferred solution, after redirecting the attack traffic of the abnormal attack behavior in the terminal device to the bound honeypot instance, it also includes:

[0015] Acquire all operational behavior data of the abnormal attack behavior, and store the operational behavior data in a preset attack behavior database; wherein the operational behavior data includes: the instructions attempted to be executed by the abnormal attack behavior, the content of the sent data packets, the frequency of attack requests and the tools used.

[0016] As a preferred solution, when confirming that the abnormal attack behavior in the honeypot instance has ended, unbinding the honeypot instance from the probe includes:

[0017] The active connection ratio of the honeypot instance is calculated and compared with a preset threshold. When the active connection ratio is less than the preset threshold, it is confirmed that the abnormal attack behavior in the honeypot instance has ended, and the honeypot instance is unbound from the probe.

[0018] As a preferred solution, the active connection ratio of the honeypot instance is calculated by the following formula:

[0019]

[0020] Among them, ActiveConnections is the current number of active connections of the honeypot; TotalConnections is the maximum number of connections allowed by the honeypot during the attack trapping process.

[0021] As a preferred solution, after unbinding the honeypot instance from the probe and rebinding the probe to the corresponding terminal device, the method further includes:

[0022] Based on the instructions attempted to be executed by the abnormal attack behavior in the attack behavior database, the content of the sent data packets, the attack request frequency and the tools used, the attack path, attack tools and attack mode of the abnormal attack behavior are analyzed, and then an attack report of the abnormal attack behavior is generated based on the attack path, attack tools and attack mode.

[0023] Based on the above embodiment, another embodiment of the present invention provides an attack trapping device for a virtual power plant network, including: a terminal abnormal alarm information receiving module, a honeypot instance generating module, an attack traffic redirecting module, and a honeypot instance probe unbinding module;

[0024] The terminal abnormal alarm information receiving module is used to determine whether there is abnormal attack behavior in the terminal device corresponding to the probe when receiving the terminal abnormal alarm information sent by the probe; wherein the probe is deployed in the terminal device at the edge side of the virtual power plant, and detects whether there is abnormal attack behavior in the terminal device according to the network data packet of the corresponding terminal device;

[0025] The honeypot instance generation module is used to analyze and obtain the attack characteristics of the abnormal attack behavior according to the terminal abnormal alarm information, and then generate a honeypot instance with the same functional characteristics as the terminal device on a currently idle honeypot node according to the device type of the terminal device and the attack characteristics;

[0026] The attack traffic redirection module is used to bind the generated honeypot instance to the probe, and then redirect the attack traffic of the abnormal attack behavior in the terminal device to the bound honeypot instance;

[0027] The honeypot instance probe unbinding module is used to unbind the honeypot instance from the probe after confirming that the abnormal attack behavior in the honeypot instance has ended, and rebind the probe to the corresponding terminal device.

[0028] Based on the above embodiments, another embodiment of the present invention provides an electronic device, which includes a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, and when the processor executes the computer program, it implements the attack trapping method for the virtual power plant network described in the above invention embodiments.

[0029] Based on the above embodiments, another embodiment of the present invention provides a storage medium, which includes a stored computer program, wherein when the computer program is running, the device where the storage medium is located is controlled to execute the attack trapping method for the virtual power plant network described in the above invention embodiment.

[0030] Compared with the prior art, the embodiments of the present invention have the following beneficial effects:

[0031] The present invention provides an attack trapping method for a virtual power plant network, in which a probe is deployed in a terminal device at the edge side of the virtual power plant, and whether there is abnormal attack behavior in the terminal device is detected based on the network data packet of the corresponding terminal device. When the terminal abnormal alarm information sent by the probe is received, it is determined that there is abnormal attack behavior in the terminal device corresponding to the probe; according to the terminal abnormal alarm information, the attack characteristics of the abnormal attack behavior are analyzed and obtained, and then according to the device type of the terminal device and the attack characteristics, a honeypot instance with the same functional characteristics as the terminal device is generated on a currently idle honeypot node; the generated honeypot instance is bound to the probe, and then the attack traffic of the abnormal attack behavior in the terminal device is redirected to the bound honeypot instance; after confirming that the abnormal attack behavior in the honeypot instance has ended, the honeypot instance is unbound from the probe, and the probe is rebound to the corresponding terminal device.

[0032] Compared with the traditional one-to-one static binding of honeypots and probes, the present invention does not need to perform one-to-one static binding of honeypots and probes. Instead, when it is determined that there is an abnormal attack behavior in the terminal device corresponding to the probe and an attack trap is required, a honeypot instance with the same functional characteristics as the terminal device is generated on the currently idle honeypot node, and the generated honeypot instance is dynamically bound to the probe, and the attack traffic of the abnormal attack behavior in the terminal device is redirected to the bound honeypot instance. After confirming that the abnormal attack behavior in the honeypot instance has ended, the honeypot instance is unbound from the probe in time to release the honeypot resources. Through the present invention, the resource consumption problem caused by statically deploying more honeypots can be solved, and the hot-swap requirements of a large number of plug-and-play devices in virtual power plants can be better adapted to achieve efficient and flexible network attack trapping. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] Figure 1 It is a flow chart of an attack trapping method for a virtual power plant network provided by an embodiment of the present invention;

[0034] Figure 2 It is a structural diagram of an attack trapping device for a virtual power plant network provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0035] In order to make the purpose, technical solutions and advantages of this application clearer, the technical solutions in this application will be clearly and completely described below in conjunction with the drawings in the embodiments of this application. Obviously, the described embodiments are part of the embodiments of this application, not all of them. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0036] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by technicians in the technical field to which this application belongs; the terms used herein are only for the purpose of describing specific embodiments and are not intended to limit this application; the terms "including" and "having" in the specification and claims of this application and the above-mentioned figure descriptions and any variations thereof are intended to cover non-exclusive inclusions.

[0037] In the description of the embodiments of the present application, the technical terms "first", "second", etc. are only used to distinguish different objects, and cannot be understood as indicating or implying relative importance or implicitly indicating the number, specific order or primary and secondary relationship of the indicated technical features. In the description of the embodiments of the present application, the meaning of "multiple" is more than two, unless otherwise clearly and specifically defined.

[0038] Reference to "embodiments" herein means that a particular feature, structure, or characteristic described in conjunction with the embodiments may be included in at least one embodiment of the present application. The appearance of the phrase in various locations in the specification does not necessarily refer to the same embodiment, nor is it an independent or alternative embodiment that is mutually exclusive with other embodiments. It is explicitly and implicitly understood by those skilled in the art that the embodiments described herein may be combined with other embodiments.

[0039] In the description of the embodiments of the present application, the term "and / or" is only a description of the association relationship of the associated objects, indicating that there may be three relationships. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. In addition, the character " / " in this article generally indicates that the associated objects before and after are in an "or" relationship.

[0040] In the description of the embodiments of the present application, the term "multiple" refers to more than two (including two). Similarly, "multiple groups" refers to more than two groups (including two groups), and "multiple pieces" refers to more than two pieces (including two pieces).

[0041] In the description of the embodiments of the present application, unless otherwise clearly specified and limited, technical terms such as "installed", "connected", "connected", "fixed" and the like should be understood in a broad sense. For example, it can be a fixed connection, a detachable connection, or an integral connection; it can be a mechanical connection or an electrical connection; it can be a direct connection or an indirect connection through an intermediate medium, and it can be the internal connection of two elements or the interaction relationship between two elements. For those of ordinary skill in the art, the specific meanings of the above terms in the embodiments of the present application can be understood according to the specific circumstances.

[0042] Embodiment 1

[0043] Please refer to Figure 1 , is a flow chart of a method for attack trapping of a virtual power plant network provided by an embodiment of the present invention, comprising the following specific steps:

[0044] S1. When receiving the terminal abnormality alarm information sent by the probe, it is determined that there is abnormal attack behavior in the terminal device corresponding to the probe; wherein the probe is deployed in the terminal device at the edge side of the virtual power plant, and detects whether there is abnormal attack behavior in the terminal device according to the network data packet of the corresponding terminal device;

[0045] Specifically, the present invention discloses a method for attack trapping of a virtual power plant network, deploying probes on plug-and-play terminals (such as user-side energy storage devices, electric vehicles, distributed power generation devices, high-energy industrial loads, etc.) on the edge side of the virtual power plant, deploying high-simulation honeypot nodes on the dispatching master station system, power market trading platform, new power load management system and operator side, and setting up a honeypot and probe management and scheduling system in the network security operation center of the virtual power plant. After the plug-and-play terminal accesses the virtual power plant network, the probe will automatically register with the network security center and report status data. When the probe detects an abnormality or attack behavior, the network security center dynamically schedules a distributed honeypot cluster, generates a honeypot instance that meets the characteristics of the attack behavior, and dynamically binds the honeypot to the probe to transfer the attacker's traffic to the honeypot node. The present invention solves the problem that the static binding of traditional honeypots and probes cannot adapt to the hot-swap requirements of a large number of plug-and-play devices in virtual power plants, and the resource consumption problem caused by static deployment of more honeypots, by dynamically generating and scheduling honeypot instances. It can efficiently and flexibly perform network attack trapping and real-time monitoring.

[0046] The following modules are involved in the above attack trapping process:

[0047] Probe module: A plug-and-play terminal deployed at the edge of the virtual power plant (such as user-side energy storage, electric vehicles, etc.), which is responsible for automatically registering with the network security center after accessing the network and monitoring the device status and network traffic in real time.

[0048] Highly simulated honeypot node: deployed in the dispatching master station system, power market trading platform, new power load management system and operator side, with a dynamically generated and customized honeypot instance pool to simulate the characteristics of different power terminal equipment and trap attack behaviors.

[0049] Network Security Operation Center Scheduling System: Responsible for managing the scheduling of probes and honeypots, including receiving probe registration messages, receiving probe anomaly detection messages, generating and allocating instructions for honeypot instances, and monitoring attack data in honeypots.

[0050] The method is based on the virtual power plant environment, simulates the scenario of plug-and-play terminals (such as user-side energy storage devices, electric vehicle charging piles, distributed power generation devices, etc.) accessing the virtual power plant network, and demonstrates how to dynamically bind the probe to the honeypot system, automatically generate honeypot instances, and realize the trapping and analysis of attack behaviors. The specific workflow is as follows:

[0051] 1. Deployment and automatic registration of probes:

[0052] The edge devices of the virtual power plant include distributed photovoltaic power generation devices, user energy storage devices, and electric vehicle charging piles on the user side. These devices support plug-and-play and have dynamic access. To ensure the network security of these devices, the probe module of the present invention is deployed on each device to monitor the network traffic of the access device in real time.

[0053] When the user's energy storage device is connected to the virtual power plant network, the probe automatically registers with the virtual power plant network security operation center. The registration process includes the device information reporting and authentication process. The device information includes the device's network address, device type (such as energy storage equipment or photovoltaic power generation equipment), device unique identifier, geographic location and other information. After the probe module is successfully registered, it will begin to continuously monitor the device's network activities, collect traffic data in real time, and encrypt and transmit this data to the virtual power plant's network security center.

[0054] 2. Probe real-time monitoring and attack detection:

[0055] In the daily operation after the device is connected, the probe module is responsible for continuously monitoring the traffic of its device, collecting and analyzing the device's network data packets, and detecting whether there are abnormal access behaviors or attack behaviors. For example, the probe deployed in a user's electric vehicle charging pile device detected a series of abnormal requests, which contained the following characteristics:

[0056] Abnormal high-frequency access: the number of requests to the device port per unit time exceeds the set threshold;

[0057] From an unregistered, unknown IP address;

[0058] The request contains a specific sequence of commands that appear to be an attempt to bypass the device's authentication mechanism.

[0059] After detecting abnormal behavior, the probe immediately sends an attack warning data packet to the network security center, which contains information such as device identification, abnormal traffic data, request source information, and abnormal behavior characteristics. When the network security center receives the terminal abnormality alarm information sent by the probe, it determines that there is abnormal attack behavior in the terminal device corresponding to the probe.

[0060] S2. Analyze and obtain the attack characteristics of the abnormal attack behavior according to the abnormal terminal alarm information, and then generate a honeypot instance with the same functional characteristics as the terminal device on the currently idle honeypot node according to the device type of the terminal device and the attack characteristics;

[0061] Preferably, according to the device type of the terminal device and the attack characteristics, a honeypot instance with the same functional characteristics as the terminal device is generated on a currently idle honeypot node, including: obtaining the priority of the probe, sorting the priorities of all probes that currently send terminal abnormality alarm information simultaneously, and in descending order of priority, generating a honeypot instance with the same functional characteristics as the corresponding terminal device on the currently idle honeypot node according to the device type of the terminal device corresponding to the probe with the highest priority and the attack characteristics.

[0062] Preferably, the priority of the probe is calculated by the following formula:

[0063]

[0064] Among them, Q i Probe P i Priority; Criticality (P i ) is the probe P i The more critical the device, the higher the priority; AttackRate (P i ) is the probe P i The frequency of attacks detected; α and β are adjustment coefficients.

[0065] 3. Dynamically generate honeypot instances and bind probes:

[0066] After receiving the attack warning data from the probe, the Cyber ​​Security Center quickly analyzed the attack characteristics through the anomaly analysis module and determined that the attack was suspected to be an attack method that bypassed device authentication through high-frequency access and vulnerability exploitation. In order to protect the real data and normal operation of the device, the Cyber ​​Security Center will take honeypot trapping measures.

[0067] The network security center selects an idle honeypot node from the distributed honeypot resource pool, and dynamically generates a honeypot instance with the functional characteristics of an electric vehicle charging pile on the honeypot node according to the type of device (i.e., an electric vehicle charging pile). This instance simulates the functions and response logic of a real electric vehicle charging pile through high simulation technology, and has communication protocols, port settings, and authentication processes similar to those of actual devices. After the honeypot instance is generated, it is automatically dynamically bound to the probe, and the network routing is updated to redirect the attack traffic from the actual device to the honeypot instance, thereby effectively isolating the attack behavior.

[0068] During the binding process, the network security center returns the new honeypot node address and configuration information to the probe module. After updating the route, the probe module begins to redirect the attack traffic to the honeypot instance, making the attacker mistakenly believe that he has successfully invaded the device, but in fact he has entered the simulated honeypot.

[0069] 4. Dynamic resource allocation and priority control:

[0070] In the present invention, if multiple probes in the virtual power plant network detect abnormal behavior and request honeypot resources at the same time, the network security center dynamically allocates honeypot resources according to the priority of each probe and the urgency of the attack traffic. The priority is calculated as follows:

[0071]

[0072] Among them, Criticality (P i ) indicates probe P i The more critical the device, the higher the priority; AttackRate (P i ) is the probe P i The detected attack frequency; α and β are adjustment coefficients. The Network Security Center will assign honeypot instances to the probes according to the priority from high to low to ensure that important devices are protected first.

[0073] If the honeypot resources are insufficient, the probe requests with lower priority will be queued or the abnormal traffic will be directly recorded in the background for subsequent analysis. After the high-priority probe releases the honeypot, the resource pool will immediately schedule the honeypot instance to the queued probe to achieve the optimal configuration of resources.

[0074] S3, binding the generated honeypot instance to the probe, and then redirecting the attack traffic of the abnormal attack behavior in the terminal device to the bound honeypot instance;

[0075] Preferably, after redirecting the attack traffic of the abnormal attack behavior in the terminal device to the bound honeypot instance, it also includes: obtaining all operation behavior data of the abnormal attack behavior, and storing the operation behavior data in a preset attack behavior database; wherein the operation behavior data includes: the instructions attempted to be executed by the abnormal attack behavior, the content of the sent data packets, the frequency of attack requests and the tools used.

[0076] 5. Attack behavior trapping and analysis:

[0077] When the attack traffic is redirected to the honeypot instance, the honeypot begins to record all the attacker's operations, including the instructions attempted to be executed, the content of the sent data packets, the frequency of attack requests, and the tools used. In this example, the attacker's behavior gradually shows the following characteristics:

[0078] Brute force attack: Try different password combinations to bypass the authentication mechanism of the honeypot device. The honeypot instance records all the password combinations tried and forwards them to the network security center for analysis;

[0079] Malicious command injection: After successful authentication, the attacker attempts to send malicious commands to the device to obtain the device's status information and permission control. The honeypot responds to these commands in a disguised manner, making the attacker mistakenly believe that they have gained control of the device;

[0080] Packet scanning: Attackers attempt to scan the open ports of a device to find possible vulnerabilities. The honeypot instance generates fake device port information, simulates the port open status, and records the attacker's scanning activities.

[0081] During the entire trapping process, the behavior of the honeypot instance completely simulates the operation mode and response speed of the real device, confusing the attacker to continue the operation, so that the network security center can collect more comprehensive attack data. This data is encrypted and transmitted in real time to the attack behavior database of the network security center for subsequent security analysis and attack pattern mining.

[0082] S4. After confirming that the abnormal attack behavior in the honeypot instance has ended, the honeypot instance is unbound from the probe, and the probe is rebound to the corresponding terminal device.

[0083] Preferably, when it is confirmed that the abnormal attack behavior in the honeypot instance has ended, the honeypot instance is unbound from the probe, including: calculating the active connection ratio of the honeypot instance, and comparing the active connection ratio with a preset threshold, when the active connection ratio is less than the preset threshold, it is confirmed that the abnormal attack behavior in the honeypot instance has ended, and the honeypot instance is unbound from the probe.

[0084] Preferably, the active connection ratio of the honeypot instance is calculated by the following formula:

[0085]

[0086] Among them, ActiveConnections is the current number of active connections of the honeypot; TotalConnections is the maximum number of connections allowed by the honeypot during the attack trapping process.

[0087] 6. Unbinding and resource recovery of honeypots and probes:

[0088] After the network security center confirms that the attack behavior has ended, the control center will trigger the automatic unbinding mechanism between the honeypot and the probe, and rebind the probe to the actual device. In the resource recovery process of the present invention, the active connection ratio of the honeypot instance can be used to determine whether the honeypot instance needs to be maintained or released to achieve optimal resource utilization and automated management. The mechanism of resource recovery and release conditions is given below.

[0089] Resource recycling mechanism:

[0090] In the resource recovery process of the honeypot instance, the active connection ratio R of the honeypot instance is calculated. active To determine whether it needs to be released. The definition is as follows:

[0091]

[0092] Among them: ActiveConnections: represents the current number of active connections of the honeypot, that is, the number of connections that the honeypot is interacting with the attacker; TotalConnections: the maximum number of connections allowed by the honeypot during the attack trapping process, which is used to control the load of the honeypot instance.

[0093] Resource release judgment conditions:

[0094] The resource release condition is set as follows: when the active connection ratio R active If it is less than a preset threshold δ (usually between 0.1 and 0.3), the resource utilization of the honeypot instance is judged to be low, and resource release and recycling operations can be performed. The judgment conditions for resource release are:

[0095] R active <δ;

[0096] The specific steps are as follows:

[0097] Calculate the active connection ratio: The network security center detects the R of the honeypot instance at regular intervals (e.g., every 10 seconds). active , and compared with the threshold δ.

[0098] Resource release decision: If R active <δ, it is considered that the honeypot instance has less interaction and the attack may have ended. The network security center will trigger the resource release process and unbind the honeypot instance from the probe.

[0099] Resources are returned to the honeypot resource pool: After the unbinding is completed, the resources of the honeypot instance are returned to the honeypot resource pool for subsequent use. The cached data and attack records of the honeypot instance are cleared to ensure independence and data security when it is used next time.

[0100] Resource recovery mechanism extension:

[0101] For some scenarios with high frequency and repeated attacks in a short period of time, you can set the recovery delay time t delay , triggering recycling when the following conditions are met:

[0102] R active <δ and no new attack behavior is detected for more than t delay ;

[0103] This mechanism ensures the accuracy of resource release and avoids the accidental release of resources when there is a new attack after a short interval. delay Typically set within the range of 30 seconds to 1 minute.

[0104] Through the above formulas and conditions, the network security center can intelligently determine the timing of honeypot resource recovery, ensure the dynamic management of honeypot resources, and improve the resource utilization and security protection effect of the entire virtual power plant network.

[0105] After unbinding, the honeypot instance no longer maintains the attacker's connection, and the resource pool will release the honeypot instance and clear its cache for the next application. The probe also updates the route and redirects the traffic back to the actual device to ensure the normal operation of the device.

[0106] Preferably, after unbinding the honeypot instance from the probe and rebinding the probe to the corresponding terminal device, it also includes: analyzing the attack path, attack tools and attack mode of the abnormal attack behavior based on the instructions attempted to be executed by the abnormal attack behavior in the attack behavior database, the content of the sent data packets, the attack request frequency and the tools used, and then generating an attack report of the abnormal attack behavior based on the attack path, attack tools and attack mode.

[0107] 7. Attack data analysis and report generation:

[0108] The Cyber ​​Security Center will analyze the attack data in the database, conduct in-depth mining of the attacker's attack behavior, tools used, instruction sets and other information, and generate an attack report. The generated report contains the following:

[0109] Attack path: Record how attackers enter the system, the vulnerabilities used, and the attack paths;

[0110] Attack tools: Analyze the tools and instruction sequences used by attackers and identify common attack tools;

[0111] Attack mode: Identify the attacker's behavioral characteristics and provide a basis for subsequent protection strategies.

[0112] Embodiment 2

[0113] Please refer to Figure 2 , is a structural diagram of an attack trapping device for a virtual power plant network provided by an embodiment of the present invention, the device comprising: a terminal abnormal alarm information receiving module, a honeypot instance generating module, an attack traffic redirecting module and a honeypot instance probe unbinding module;

[0114] The terminal abnormal alarm information receiving module is used to determine whether there is abnormal attack behavior in the terminal device corresponding to the probe when receiving the terminal abnormal alarm information sent by the probe; wherein the probe is deployed in the terminal device at the edge side of the virtual power plant, and detects whether there is abnormal attack behavior in the terminal device according to the network data packet of the corresponding terminal device;

[0115] The honeypot instance generation module is used to analyze and obtain the attack characteristics of the abnormal attack behavior according to the terminal abnormal alarm information, and then generate a honeypot instance with the same functional characteristics as the terminal device on a currently idle honeypot node according to the device type of the terminal device and the attack characteristics;

[0116] The attack traffic redirection module is used to bind the generated honeypot instance to the probe, and then redirect the attack traffic of the abnormal attack behavior in the terminal device to the bound honeypot instance;

[0117] The honeypot instance probe unbinding module is used to unbind the honeypot instance from the probe after confirming that the abnormal attack behavior in the honeypot instance has ended, and rebind the probe to the corresponding terminal device.

[0118] It should be noted that the device embodiments described above are merely schematic, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. In addition, in the accompanying drawings of the device embodiments provided by the present invention, the connection relationship between the modules indicates that there is a communication connection between them, which may be specifically implemented as one or more communication buses or signal lines. A person of ordinary skill in the art may understand and implement it without paying any creative effort.

[0119] Those skilled in the art can clearly understand that, for the sake of convenience and brevity, the specific working process of the device described above can refer to the corresponding process in the aforementioned method embodiment, and will not be repeated here.

[0120] Embodiment 3

[0121] Accordingly, an embodiment of the present invention provides an electronic device, comprising a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, wherein the processor implements the attack trapping method for the virtual power plant network described in the above-mentioned embodiment of the invention when executing the computer program.

[0122] The electronic device may be a computing device such as a desktop computer, a notebook, a palm computer, a cloud server, etc. The device may include, but is not limited to, a processor and a memory.

[0123] The processor may be a central processing unit (CPU), other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or any conventional processor, etc. The processor is the control center of the device, and various interfaces and lines are used to connect various parts of the entire device.

[0124] Embodiment 4

[0125] Accordingly, an embodiment of the present invention provides a storage medium, which includes a stored computer program, wherein when the computer program is running, the device where the storage medium is located is controlled to execute the attack trapping method for the virtual power plant network described in the above-mentioned embodiment of the invention.

[0126] The memory can be used to store the computer program, and the processor realizes various functions of the device by running or executing the computer program stored in the memory and calling the data stored in the memory. The memory can mainly include a program storage area and a data storage area, wherein the program storage area can store an operating system, at least one application required for a function, etc.; the data storage area can store data created according to the use of the mobile phone, etc. In addition, the memory can include a high-speed random access memory, and can also include a non-volatile memory, such as a hard disk, a memory, a plug-in hard disk, a smart memory card (Smart Media Card, SMC), a secure digital (Secure Digital, SD) card, a flash card (FlashCard), at least one disk storage device, a flash memory device, or other volatile solid-state storage devices.

[0127] The storage medium is a computer-readable storage medium, and the computer program is stored in the computer-readable storage medium. When the computer program is executed by the processor, the steps of each method embodiment described above can be implemented. Among them, the computer program includes computer program code, and the computer program code can be in source code form, object code form, executable file or some intermediate form, etc. The computer-readable medium may include: any entity or device capable of carrying the computer program code, recording medium, USB flash drive, mobile hard disk, disk, optical disk, computer memory, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), electric carrier signal, telecommunication signal and software distribution medium, etc. It should be noted that the content contained in the computer-readable medium can be appropriately increased or decreased according to the requirements of legislation and patent practice in the jurisdiction. For example, in some jurisdictions, according to legislation and patent practice, computer-readable media do not include electric carrier signals and telecommunication signals.

[0128] The above is a preferred embodiment of the present invention. It should be pointed out that a person skilled in the art can make several improvements and modifications without departing from the principle of the present invention. These improvements and modifications are also considered to be within the scope of protection of the present invention.

Claims

1. A method for trapping attacks on a virtual power plant network, characterized in that: include: When receiving the terminal abnormality alarm information sent by the probe, it is determined that there is abnormal attack behavior in the terminal device corresponding to the probe; wherein the probe is deployed in the terminal device at the edge side of the virtual power plant, and detects whether there is abnormal attack behavior in the terminal device according to the network data packet of the corresponding terminal device; According to the abnormal alarm information of the terminal, the attack characteristics of the abnormal attack behavior are analyzed, and then according to the device type of the terminal device and the attack characteristics, a honeypot instance with the same functional characteristics as the terminal device is generated on the currently idle honeypot node; Binding the generated honeypot instance to the probe, and then redirecting the attack traffic of the abnormal attack behavior in the terminal device to the bound honeypot instance; After confirming that the abnormal attack behavior in the honeypot instance has ended, the honeypot instance is unbound from the probe, and the probe is rebound to the corresponding terminal device.

2. The attack trapping method for a virtual power plant network according to claim 1, characterized in that: The step of generating a honeypot instance having the same functional characteristics as the terminal device on a currently idle honeypot node according to the device type of the terminal device and the attack characteristics includes: Obtain the priority of the probe, sort the priorities of all probes that currently send terminal abnormality alarm information at the same time, and generate a honeypot instance with the same functional characteristics as the corresponding terminal device on the currently idle honeypot node according to the device type and the attack characteristics of the terminal device corresponding to the probe with the highest priority in order from high to low priority.

3. The attack trapping method for a virtual power plant network according to claim 2, characterized in that: The priority of a probe is calculated using the following formula: Among them, Q i Probe P i Priority; Criticality (P i ) is the probe P i The more critical the device, the higher the priority; AttackRate (P i ) is the probe P i The frequency of attacks detected; α and β are adjustment coefficients.

4. The attack trapping method for a virtual power plant network according to claim 1, characterized in that: After redirecting the attack traffic of the abnormal attack behavior in the terminal device to the bound honeypot instance, the method further includes: Acquire all operational behavior data of the abnormal attack behavior, and store the operational behavior data in a preset attack behavior database; wherein the operational behavior data includes: the instructions attempted to be executed by the abnormal attack behavior, the content of the sent data packets, the frequency of attack requests and the tools used.

5. The attack trapping method for a virtual power plant network according to claim 1, characterized in that: When it is confirmed that the abnormal attack behavior in the honeypot instance has ended, unbinding the honeypot instance from the probe includes: The active connection ratio of the honeypot instance is calculated and compared with a preset threshold. When the active connection ratio is less than the preset threshold, it is confirmed that the abnormal attack behavior in the honeypot instance has ended, and the honeypot instance is unbound from the probe.

6. The attack trapping method for a virtual power plant network according to claim 5, characterized in that: The active connection ratio of the honeypot instance is calculated by the following formula: Among them, ActiveConnections is the current number of active connections of the honeypot; TotalConnections is the maximum number of connections allowed by the honeypot during the attack trapping process.

7. The attack trapping method for a virtual power plant network according to claim 4, characterized in that: After unbinding the honeypot instance from the probe and rebinding the probe to the corresponding terminal device, the method further includes: Based on the instructions attempted to be executed by the abnormal attack behavior in the attack behavior database, the content of the sent data packets, the attack request frequency and the tools used, the attack path, attack tools and attack mode of the abnormal attack behavior are analyzed, and then an attack report of the abnormal attack behavior is generated based on the attack path, attack tools and attack mode.

8. An attack trapping device for a virtual power plant network, characterized in that: include: Terminal abnormal alarm information receiving module, honeypot instance generation module, attack traffic redirection module and honeypot instance probe unbinding module; The terminal abnormal alarm information receiving module is used to determine whether there is abnormal attack behavior in the terminal device corresponding to the probe when receiving the terminal abnormal alarm information sent by the probe; wherein the probe is deployed in the terminal device at the edge side of the virtual power plant, and detects whether there is abnormal attack behavior in the terminal device according to the network data packet of the corresponding terminal device; The honeypot instance generation module is used to analyze and obtain the attack characteristics of the abnormal attack behavior according to the terminal abnormal alarm information, and then generate a honeypot instance with the same functional characteristics as the terminal device on a currently idle honeypot node according to the device type of the terminal device and the attack characteristics; The attack traffic redirection module is used to bind the generated honeypot instance to the probe, and then redirect the attack traffic of the abnormal attack behavior in the terminal device to the bound honeypot instance; The honeypot instance probe unbinding module is used to unbind the honeypot instance from the probe after confirming that the abnormal attack behavior in the honeypot instance has ended, and rebind the probe to the corresponding terminal device.

9. An electronic device, characterized in that: It includes a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, and when the processor executes the computer program, it implements the attack trapping method for the virtual power plant network as described in any one of claims 1 to 7.

10. A storage medium, characterized in that: The storage medium includes a stored computer program, wherein when the computer program is running, the device where the storage medium is located is controlled to execute the attack trapping method for the virtual power plant network as described in any one of claims 1 to 7.

Images