Threat intelligence detection method, device, equipment and medium based on honeypot trapping

Abstract

The present disclosure provides a threat intelligence detection method, device, equipment and medium based on honeypot trapping, which relates to the field of network security technology and aims to improve the threat detection and response capabilities of network security. The method includes: obtaining network topology data of an IPv6 network; generating an undirected graph based on the network topology data, wherein the nodes of the undirected graph represent devices in the IPv6 network, and the edges of the undirected graph represent the connection relationship between the devices; based on the undirected graph, determining the target node based on the first parameter and the second parameter of each node, wherein the first parameter represents the importance characteristics of the node, and the second parameter represents the vulnerability characteristics of the node; based on the target node, deploying a honeypot trapping strategy, wherein the honeypot trapping strategy is used to simulate the vulnerabilities of the real system to attract attackers to actively attack; detecting threat intelligence according to the honeypot trapping strategy.

Description

Technical Field

[0001] The present disclosure relates to the field of network security technology, and more specifically, to a threat intelligence detection method, device, equipment and medium based on honeypot trapping. Background Art

[0002] With the deep integration of industrialization and informatization, more and more industrial control systems (ICS) are connected to the Internet, forming networked industrial control systems. Although this trend has greatly improved production efficiency, automation level and data processing capabilities, it has also brought increasingly severe security threats. Networked industrial control systems not only face problems such as traditional industrial control equipment failures and misoperation, but are also exposed to complex and changing network attacks, such as malware, ransomware, denial of service (DoS) attacks, data leaks and advanced persistent threats (APTs).

[0003] In the process of realizing the concept of the present disclosure, the inventors found that there are at least the following defects in the relevant technology: traditional security defense means mainly rely on network isolation, static firewall rules and signature-based intrusion detection, but these means gradually become ineffective in the face of modern complex network attacks. On the one hand, attackers can take advantage of the networking characteristics of the system and launch precision strikes on industrial control systems through remote attack means. On the other hand, with the increasing diversification and concealment of attack technologies, network attacks have become more targeted and continuous, and conventional security protection measures are difficult to detect these high-level threats. It can be seen that traditional security defense means have been difficult to cope with increasingly complex network attacks. Therefore, the development of a threat intelligence security situation awareness system that can improve the efficiency and success rate of network security defense is of great significance to improving the security of industrial control systems. Summary of the invention

[0004] In view of the above problems, the present disclosure provides a threat intelligence detection method, apparatus, device and medium based on honeypot trapping, aiming to improve the threat detection and response capabilities of network security.

[0005] One aspect of the present disclosure provides a threat intelligence detection method based on honeypot trapping, comprising: acquiring network topology data of an IPv6 network; generating an undirected graph according to the network topology data, wherein the nodes of the undirected graph represent devices in the IPv6 network, and the edges of the undirected graph represent connection relationships between the devices; based on the undirected graph, determining a target node according to a first parameter and a second parameter of each node, wherein the first parameter represents an importance characteristic of the node, and the second parameter represents a vulnerability characteristic of the node; based on the target node, deploying a honeypot trapping strategy, wherein the honeypot trapping strategy is used to simulate vulnerabilities of a real system to attract attackers to actively attack; and detecting threat intelligence according to the honeypot trapping strategy.

[0006] According to an embodiment of the present disclosure, based on an undirected graph, determining a target node according to a first parameter and a second parameter of each node includes: based on the undirected graph, determining the first parameter of each node using a PageRank algorithm; based on the undirected graph, determining the second parameter of each node using a K-Shell decomposition algorithm; determining the target node according to the first parameter and the second parameter.

[0007] According to an embodiment of the present disclosure, based on an undirected graph, the first parameter of each node is determined using the PageRank algorithm, including: assigning the same initial weight to each node; using the PageRank algorithm, iteratively calculating the final weight of each node based on the initial weight and the number of connections of each node, wherein the more the number of connections, the greater the final weight, and the more important the corresponding node; according to the final weight, determining the importance characteristics of each node to obtain the first parameter.

[0008] According to an embodiment of the present disclosure, based on an undirected graph, determining the second parameter of each node using a K-Shell decomposition algorithm includes: performing hierarchical decomposition processing on the undirected graph using the K-Shell decomposition algorithm to determine the K-Shell value of each node, wherein the K-Shell value characterizes the centrality characteristics and connection density characteristics of each node, and the higher the K-Shell value, the more the corresponding node is located in the center of the network and the more connection points it has; determining the vulnerability characteristics of each node according to the K-Shell value to obtain the second parameter.

[0009] According to an embodiment of the present disclosure, based on the honeypot trapping strategy, detecting threat intelligence includes: in response to a honeypot being attacked by an attacker, monitoring and recording attack data, wherein the attack data includes attack behavior and traffic; and generating threat intelligence about the attacker based on the attack data.

[0010] According to an embodiment of the present disclosure, the method also includes: generating a data set based on the attack data and threat intelligence; predicting threat trends based on the data set using a machine learning model, wherein the machine learning model is pre-trained based on historical attack data and historical threat intelligence; and adjusting the honeypot trapping strategy and security defense mechanism based on the threat trend to improve the system's defense capabilities.

[0011] According to an embodiment of the present disclosure, based on a data set and using a machine learning model, predicting threat trends includes: identifying the attack tools and attack methods used by attackers; determining the attacker's attack targets; and predicting threat trends based on the attack tools, attack methods, and attack targets.

[0012] Another aspect of the present disclosure provides a threat intelligence detection device based on honeypot trapping, the device comprising: an acquisition module, used to acquire network topology data of an IPv6 network; a generation module, used to generate an undirected graph according to the network topology data, wherein the nodes of the undirected graph represent devices in the IPv6 network, and the edges of the undirected graph represent connection relationships between the devices; a determination module, used to determine a target node based on the undirected graph according to a first parameter and a second parameter of each node, wherein the first parameter represents an importance feature of the node, and the second parameter represents a vulnerability feature of the node; a deployment module, used to deploy a honeypot trapping strategy based on the target node, wherein the honeypot trapping strategy is used to simulate vulnerabilities of a real system to attract attackers to actively attack; and a detection module, used to detect threat intelligence according to the honeypot trapping strategy.

[0013] Another aspect of the present disclosure provides an electronic device, including: one or more processors; and a memory for storing one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors implement the above method.

[0014] Another aspect of the present disclosure provides a computer-readable storage medium storing computer-executable instructions, which are used to implement the above method when executed.

[0015] Another aspect of the present disclosure provides a computer program product, which includes computer executable instructions, and the instructions are used to implement the above method when executed.

[0016] Compared with the prior art, the threat intelligence detection method, device, equipment and medium based on honeypot trapping provided by the present disclosure have at least the following beneficial effects:

[0017] (1) The threat intelligence detection method, apparatus, device and medium based on honeypot trapping provided by the present disclosure deploy honeypot trapping strategies at key nodes in the IPv6 network topology. Since honeypot trapping technology can simulate the vulnerabilities of real devices, services or systems and attract potential attackers to launch active attacks, it can monitor attack behaviors in real time and generate threat intelligence, thereby ensuring the security of industrial control systems and improving the threat detection and response capabilities of network security.

[0018] (2) The threat intelligence detection method, apparatus, device and medium based on honeypot trapping provided by the present invention creatively combines the PageRank algorithm with the K-Shell decomposition algorithm and applies it to the in-depth analysis of IPv6 network topology. This innovation not only improves the assessment accuracy of node importance and vulnerability, but also realizes for the first time the precise positioning of the optimal location for honeypot deployment in the complexity and dynamics of the network structure.

[0019] (3) The threat intelligence detection method, apparatus, device and medium based on honeypot trapping provided by the present disclosure have a built-in powerful adaptive learning mechanism that can continuously analyze the behavior patterns of attackers and dynamically adjust the configuration and deployment strategy of the honeypot accordingly. At the same time, the system can also automatically update the security defense mechanism based on the latest threat intelligence to ensure that it can always respond to new network attack methods. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] The above and other objects, features and advantages of the present disclosure will become more apparent through the following description of the embodiments of the present disclosure with reference to the accompanying drawings, in which:

[0021] Figure 1 The flowchart of the threat intelligence detection method based on honeypot trapping according to the embodiment of the present disclosure is schematically shown;

[0022] Figure 2 The schematic diagram shows a threat intelligence detection method based on honeypot trapping according to an embodiment of the present disclosure;

[0023] Figure 3 The structure block diagram of the threat intelligence detection device based on honeypot trapping according to the embodiment of the present disclosure is schematically shown; and

[0024] Figure 4 The structural block diagram of an electronic device suitable for implementing a threat intelligence detection method based on honeypot trapping according to an embodiment of the present disclosure is schematically shown. DETAILED DESCRIPTION

[0025] Hereinafter, embodiments of the present disclosure will be described with reference to the accompanying drawings. However, it should be understood that these descriptions are exemplary only and are not intended to limit the scope of the present disclosure. In the following detailed description, for ease of explanation, many specific details are set forth to provide a comprehensive understanding of the embodiments of the present disclosure. However, it is apparent that one or more embodiments may also be implemented without these specific details. In addition, in the following description, descriptions of known structures and technologies are omitted to avoid unnecessary confusion of the concepts of the present disclosure.

[0026] The terms used herein are only for describing specific embodiments and are not intended to limit the present disclosure. The terms "comprise", "include", etc. used herein indicate the existence of the features, steps, operations and / or components, but do not exclude the existence or addition of one or more other features, steps, operations or components.

[0027] All terms (including technical and scientific terms) used herein have the meanings commonly understood by those skilled in the art unless otherwise defined. It should be noted that the terms used herein should be interpreted as having a meaning consistent with the context of this specification and should not be interpreted in an idealized or overly rigid manner.

[0028] When using expressions such as "at least one of A, B, and C, etc.", they should generally be interpreted according to the meaning of the expression commonly understood by those skilled in the art (for example, "a system having at least one of A, B, and C" should include but is not limited to a system having A alone, B alone, C alone, A and B, A and C, B and C, and / or A, B, C, etc.).

[0029] In the embodiments of the present disclosure, the collection, updating, analysis, processing, use, transmission, provision, disclosure, storage, etc. of the data involved (for example, including but not limited to user personal information) are in compliance with the provisions of relevant laws and regulations, are used for legitimate purposes, and do not violate public order and good morals. In particular, necessary measures are taken for user personal information to prevent illegal access to user personal information data and maintain the security of user personal information, network security, and national security.

[0030] With the deep integration of industrialization and informatization, more and more industrial control systems (ICS) are connected to the Internet, forming networked industrial control systems. Although this trend has greatly improved production efficiency, automation level and data processing capabilities, it has also brought increasingly severe security threats. Networked industrial control systems not only face problems such as traditional industrial control equipment failures and misoperation, but are also exposed to complex and changing network attacks, such as malware, ransomware, denial of service (DoS) attacks, data leaks and advanced persistent threats (APTs).

[0031] In the process of realizing the concept of the present disclosure, the inventors found that there are at least the following defects in the relevant technology: traditional security defense means mainly rely on network isolation, static firewall rules and signature-based intrusion detection, but these means gradually become ineffective in the face of modern complex network attacks. On the one hand, attackers can take advantage of the networking characteristics of the system and launch precision strikes on industrial control systems through remote attack means. On the other hand, with the increasing diversification and concealment of attack technologies, network attacks have become more targeted and continuous, and conventional security protection measures are difficult to detect these high-level threats. It can be seen that traditional security defense means have been difficult to cope with increasingly complex network attacks. Therefore, the development of a threat intelligence security situation awareness system that can improve the efficiency and success rate of network security defense is of great significance to improving the security of industrial control systems.

[0032] Based on this, the embodiment of the present disclosure provides a threat intelligence detection method based on honeypot trapping, which aims to improve the threat detection and response capabilities of network security. The method includes: obtaining network topology data of the IPv6 network; generating an undirected graph based on the network topology data, wherein the nodes of the undirected graph represent the devices in the IPv6 network, and the edges of the undirected graph represent the connection relationship between the devices; based on the undirected graph, according to the first parameter and the second parameter of each node, determining the target node, wherein the first parameter represents the importance characteristics of the node, and the second parameter represents the vulnerability characteristics of the node; based on the target node, deploying a honeypot trapping strategy, wherein the honeypot trapping strategy is used to simulate the vulnerabilities of the real system to attract attackers to actively attack; detecting threat intelligence according to the honeypot trapping strategy.

[0033] The threat intelligence detection method based on honeypot trapping provided by the embodiment of the present disclosure deploys honeypot trapping strategies at key nodes in the IPv6 network topology. Since the honeypot trapping technology can simulate the vulnerabilities of real devices, services or systems and attract potential attackers to launch active attacks, it can monitor attack behaviors in real time and generate threat intelligence, thereby ensuring the security of industrial control systems and improving the threat detection and response capabilities of network security.

[0034] In order to make the objectives, technical solutions and advantages of the present disclosure more clearly understood, the present disclosure is further described in detail below in conjunction with specific embodiments and with reference to the accompanying drawings.

[0035] Figure 1 The flowchart of the threat intelligence detection method based on honeypot trapping according to an embodiment of the present disclosure is schematically shown.

[0036] like Figure 1 As shown, the threat intelligence detection method based on honeypot trapping of this embodiment may include operations S1 to S5, for example.

[0037] In operation S1, network topology data of an IPv6 network is acquired.

[0038] In operation S2, an undirected graph is generated according to the network topology data, wherein nodes of the undirected graph represent devices in the IPv6 network, and edges of the undirected graph represent connection relationships between the devices.

[0039] In operation S3, based on the undirected graph, a target node is determined according to a first parameter and a second parameter of each node, wherein the first parameter represents an importance feature of the node, and the second parameter represents a vulnerability feature of the node.

[0040] In operation S4, a honeypot trapping strategy is deployed based on the target node, wherein the honeypot trapping strategy is used to simulate the vulnerabilities of the real system to attract attackers to actively attack.

[0041] In operation S5, threat intelligence is detected according to the honeypot trapping strategy.

[0042] In this embodiment, first, network topology data of the IPv6 network is collected and prepared, wherein the collected network topology data includes nodes, links, and connection relationships, etc. The collected data is processed and organized to construct an undirected graph to represent the network topology structure.

[0043] Node devices include: computers, routers, switches, firewalls, intrusion detection systems (IDS) and intrusion prevention systems (IPS), etc. Connection types include: wired connections (Ethernet), wireless connections (Wi-Fi), point-to-point connections (VPN), etc. Network relationships include: relationships between servers and clients, relationships between devices, relationships between subnets, etc. The collected information is classified and organized according to different standards (such as device type, connection type, subnet, etc.).

[0044] Then, based on the undirected graph, according to the importance characteristics and vulnerability characteristics of each node, the key nodes are determined as target nodes, and the honeypot technology is used to deploy the honeypot trapping strategy.

[0045] Honeypot Technology: Honeypot Technology is essentially a technology that deceives attackers. By placing some hosts, network services or information as bait, the attackers are lured to attack them, so that the attack behavior can be captured and analyzed, the tools and methods used by the attackers can be understood, and the attack intentions and motives can be inferred. This allows the defenders to clearly understand the security threats they face, and enhance the security protection capabilities of the actual system through technical and management means. Honeypots are like intelligence collection systems. They are deliberately set targets to lure hackers to attack. So after the attackers invade, you can know how they succeeded and keep abreast of the latest attacks and vulnerabilities launched against the server. You can also collect the various tools used by hackers and master their social networks by eavesdropping on the connections between hackers.

[0046] Finally, threat intelligence is detected based on the honeypot trapping strategy. When an attacker triggers the honeypot, the system will record the attack behavior and collect relevant data, such as the attack source IP, attack method, attack payload, etc. By analyzing these data, the system can identify potential threats and respond in a timely manner to ensure the security of the industrial control system.

[0047] The threat intelligence detection method based on honeypot trapping provided by the embodiment of the present disclosure deploys honeypot trapping strategies at key nodes in the IPv6 network topology. Since the honeypot trapping technology can simulate the vulnerabilities of real devices, services or systems and attract potential attackers to launch active attacks, it can monitor attack behaviors in real time and generate threat intelligence, thereby ensuring the security of industrial control systems and improving the threat detection and response capabilities of network security.

[0048] According to an embodiment of the present disclosure, operation S3 determines the target node based on the undirected graph according to the first parameter and the second parameter of each node, including:

[0049] Based on the undirected graph, the PageRank algorithm is used to determine the first parameter of each node.

[0050] Based on the undirected graph, the second parameter of each node is determined using the K-Shell decomposition algorithm.

[0051] A target node is determined according to the first parameter and the second parameter.

[0052] In this embodiment, based on Python's networkx library, a PageRank algorithm and a K-Shell decomposition algorithm are constructed, and the PageRank algorithm is combined with the K-Shell decomposition algorithm to accurately locate the best location for honeypot deployment in the complexity and dynamics of the network topology.

[0053] The PageRank algorithm is an algorithm used to evaluate the importance of web pages and is widely used in search engines. It analyzes the link structure in the network and assigns a weight value to each web page to measure the importance of the web page. The core idea of ​​the PageRank algorithm is that the importance of a web page depends on the number and quality of links to it by other important web pages. The function of the PageRank algorithm is to assign a weight value to each web page based on the link relationship of the web page, which is used for search engine ranking and sorting. By using the PageRank algorithm, search engines can sort search results according to the importance of web pages, making it easier for users to find relevant and high-quality web pages.

[0054] K-Shel Decomposifion Algorithm is an algorithm for community discovery in graphs. The algorithm gradually removes nodes with smaller degrees in the graph until the degrees of all nodes in the graph are no less than a certain threshold k. Each group of nodes formed in this process is called a K-Shell subgraph.

[0055] According to an embodiment of the present disclosure, based on an undirected graph, determining the first parameter of each node using the PageRank algorithm includes:

[0056] Assign the same initial weight to each node.

[0057] Using the PageRank algorithm, the final weight of each node is iteratively calculated based on the initial weight and number of connections of each node. The more connections there are, the greater the final weight is, and the more important the corresponding node is.

[0058] According to the final weight, the importance characteristic of each node is determined to obtain the first parameter.

[0059] In this embodiment, the PageRank algorithm is used to calculate the weight of each node. The weight can be calculated based on the out-degree and in-degree of the node. The higher the PageRank value, the more important the web page is considered, and key nodes with high weight are selected as potential attack targets.

[0060] Specifically, the PageRank algorithm is used to calculate the weight of each node based on the initial weight and connection relationship between nodes. The weight reflects the importance of the node in the network. A node with a high weight means that it plays a key role in the network. Nodes with higher weights are selected as potential attack targets because attacking these nodes may have a greater impact on the network.

[0061] According to an embodiment of the present disclosure, based on an undirected graph, determining the second parameter of each node using a K-Shell decomposition algorithm includes:

[0062] The K-Shell decomposition algorithm is used to perform hierarchical decomposition on the undirected graph to determine the K-Shell value of each node. The K-Shell value represents the centrality and connection density characteristics of each node. The higher the K-Shell value, the closer the corresponding node is to the center of the network and the more connection points it has.

[0063] The vulnerability characteristics of each node are determined according to the K-Shell value to obtain the second parameter.

[0064] In this embodiment, the K-Shell decomposition algorithm is used to perform hierarchical decomposition on the undirected graph, and the importance level of the nodes and the strongly connected nodes are determined. The K-Shell value is calculated for the nodes in each shell to determine its vulnerability.

[0065] Specifically, the K-Shell decomposition algorithm is used to decompose the undirected graph into a series of hierarchical shells. The K-Shell decomposition algorithm will continuously remove nodes whose node degree (number of connections) is less than a certain value and record their K-Shell values. Through this process, the nodes in the network are divided into different levels. Nodes with higher K-Shell values ​​usually have more connections and are located in the center of the network.

[0066] The decomposition of the shell is based on the connection relationship of the nodes, and the network topology is divided into multiple levels. For each node in the shell, the importance level and strong connection node are determined according to its position and connection in the network topology. For each node in the shell, its K-Shell value is calculated to assess the vulnerability of the node. The higher the K-Shell value of the node, the stronger its centrality in the network and the more vulnerable it is to attack or influence.

[0067] Threats are ranked according to the importance of the nodes, and the top-ranked nodes in the shell are selected as the deployment locations of the honeypot. This can maximize the attraction of potential attackers and improve the trapping effect of the honeypot.

[0068] The threat intelligence detection method based on honeypot trapping provided by the disclosed embodiment creatively combines the PageRank algorithm with the K-Shell decomposition algorithm and applies it to the in-depth analysis of IPv6 network topology. This innovation not only improves the assessment accuracy of node importance and vulnerability, but also realizes for the first time the precise positioning of the optimal location for honeypot deployment in the complexity and dynamics of the network structure.

[0069] According to an embodiment of the present disclosure, based on the honeypot trapping strategy, detecting threat intelligence includes:

[0070] In response to the honeypot being attacked by an attacker, the attack data is monitored and recorded, wherein the attack data includes attack behavior and traffic.

[0071] Generate threat intelligence about attackers based on attack data.

[0072] In this embodiment, according to the selected honeypot deployment location, a fake system or network service is deployed to simulate a vulnerable target. The attack behavior and traffic inside the honeypot are monitored, and the attacker's data is recorded. Threat intelligence is generated based on the attack data, and a report is further generated for the network security team to respond in real time and optimize the defense strategy. In this way, the network security team can use the intelligence generated by the honeypot to improve network security measures and better protect real systems and network resources.

[0073] According to an embodiment of the present disclosure, the threat intelligence detection method based on honeypot trapping also includes: generating a data set based on attack data and threat intelligence.

[0074] Based on the data set, a machine learning model is used to predict threat trends, where the machine learning model is pre-trained based on historical attack data and historical threat intelligence.

[0075] According to threat trends, adjust honeypot trapping strategies and security defense mechanisms to improve the system's defense capabilities.

[0076] According to an embodiment of the present disclosure, predicting threat trends based on a data set using a machine learning model includes:

[0077] Identify the attack tools and attack methods used by attackers.

[0078] Determine the attacker's attack targets; predict threat trends based on attack tools, attack methods, and attack targets.

[0079] In this embodiment, a machine learning-based attack trend prediction method is also provided to predict threat trends and make intelligent decisions. The system monitors the network traffic and log data in the honeypot in real time to capture the behavior and attack methods of potential attackers. After preprocessing and analysis, the attack data is extracted to extract key threat information, such as the attacker's IP address, attack type, target system, etc. The attack data is analyzed through machine learning and data mining technology to identify new attack trends and patterns. The attack trend database is continuously updated to keep aware of the latest threats and update the honeypot deployment strategy in a timely manner.

[0080] The machine learning algorithm uses an improved KNN algorithm to learn and analyze the attacker's behavior patterns. Based on the data set of historical attack behaviors and threat intelligence, the machine learning algorithm is trained to identify the attack tools and methods used by attackers, determine the attacker's attack targets, and predict threat trends based on the attack tools, attack methods, and attack targets.

[0081] The full name of the KNN algorithm is the K Nearest Neighbors algorithm, which means K nearest neighbors. In this embodiment, the machine learning algorithm classifies the traffic features based on the dynamic attack model, including: calculating the distance between the traffic features and the preset classification samples; fusing the attack labels of the K component samples closest to the traffic features to obtain the unknown attack type of the traffic features.

[0082] The dynamic attack model uses the KNN algorithm for classification and regression prediction analysis. Among them, the KNN algorithm uses a multivariate linear regression model for training, and uses cross-validation technology to evaluate the performance of the model. The prediction model is trained with the collected traffic data and network attack traffic, wherein the collected traffic data is divided into a training set and a test set, with an allocation ratio of 70% and 30%. After evaluating the accuracy of the model, if the accuracy does not reach the preset value, the parameters of the prediction model can be adjusted. The parameters of the prediction model may specifically include prediction parameters, learning rate, number of training steps, batch size, etc., so as to achieve re-training and re-evaluation of the prediction model so that the accuracy of the prediction model reaches the preset value and obtains the optimized prediction model. The network attack traffic is predicted by the optimized prediction model. Among them, for the preset value that the accuracy of the prediction model meets, technicians in this field can make adjustments according to actual conditions to meet the prediction requirements for traffic data.

[0083] By analyzing known attack traffic and unknown attack traffic, the attack trend database is continuously updated. By analyzing the attacker's behavior pattern, the system can identify the tools and attack methods used by the attacker, and then adjust and optimize the deployment strategy of the honeypot to improve the success rate of threat trapping.

[0084] The threat intelligence detection method based on honeypot trapping provided by the disclosed embodiment has a built-in powerful adaptive learning mechanism, which can continuously analyze the behavior patterns of attackers and dynamically adjust the configuration and deployment strategy of the honeypot accordingly. At the same time, the system can also automatically update the security defense mechanism according to the latest threat intelligence to ensure that it can always cope with new network attack methods.

[0085] Figure 2 The schematic diagram shows a principle diagram of a threat intelligence detection method based on honeypot trapping according to an embodiment of the present disclosure.

[0086] like Figure 2 As shown, the principle of the threat intelligence detection method based on honeypot trapping in the embodiment of the present disclosure is as follows:

[0087] First, the first analysis platform performs network topology analysis and deploys a honeypot trapping strategy by selecting a suitable honeypot type, such as a simulated server, network device, or application, and setting appropriate vulnerabilities, weaknesses, or baits to attract attackers, such as making it easy for worms, viruses, or malicious codes to invade through unauthorized access restrictions, operating system vulnerabilities, and application vulnerabilities.

[0088] Then, the second analysis platform is used to track attack behaviors, analyze attack methods, attack targets, vulnerabilities, behavior patterns, and attack trends to dynamically adjust the configuration and deployment strategy of the honeypot and automatically update the security defense mechanism to ensure that it can always respond to new types of network attacks.

[0089] Figure 3 The structural block diagram of a threat intelligence detection device based on honeypot trapping according to an embodiment of the present disclosure is schematically shown.

[0090] like Figure 3 As shown, the threat intelligence detection device 300 based on honeypot trapping of the embodiment of the present disclosure includes: an acquisition module 310, a generation module 320, a determination module 330, a deployment module 340 and a detection module 350.

[0091] The acquisition module 310 is used to acquire network topology data of the IPv6 network.

[0092] The generation module 320 is used to generate an undirected graph according to the network topology data, wherein the nodes of the undirected graph represent devices in the IPv6 network, and the edges of the undirected graph represent connection relationships between the devices.

[0093] The determination module 330 is used to determine the target node based on the undirected graph according to the first parameter and the second parameter of each node, wherein the first parameter represents the importance characteristic of the node, and the second parameter represents the vulnerability characteristic of the node.

[0094] The deployment module 340 is used to deploy a honeypot trapping strategy based on a target node, wherein the honeypot trapping strategy is used to simulate the vulnerabilities of a real system to attract attackers to actively attack.

[0095] The detection module 350 is used to detect threat intelligence according to the honeypot trapping strategy.

[0096] According to the embodiments of the present invention, any one or more of the modules, submodules, units, and subunits, or at least part of the functions of any one of them can be implemented in one module. According to the embodiments of the present invention, any one or more of the modules, submodules, units, and subunits can be split into multiple modules for implementation. According to the embodiments of the present invention, any one or more of the modules, submodules, units, and subunits can be at least partially implemented as hardware circuits, such as field programmable gate arrays (FPGAs), programmable logic arrays (PLAs), systems on chips, systems on substrates, systems on packages, application specific integrated circuits (ASICs), or can be implemented by hardware or firmware in any other reasonable way of integrating or packaging circuits, or can be implemented in any one of the three implementation methods of software, hardware, and firmware, or in any appropriate combination of any of them. Alternatively, according to the embodiments of the present invention, one or more of the modules, submodules, units, and subunits can be at least partially implemented as computer program modules, and when the computer program modules are run, the corresponding functions can be performed.

[0097] For example, any multiple of the acquisition module 310, the generation module 320, the determination module 330, the deployment module 340, and the detection module 350 can be combined in one module / unit / sub-unit for implementation, or any one of the modules / units / sub-units can be split into multiple modules / units / sub-units. Alternatively, at least part of the functions of one or more of these modules / units / sub-units can be combined with at least part of the functions of other modules / units / sub-units and implemented in one module / unit / sub-unit. According to an embodiment of the present disclosure, at least one of the acquisition module 310, the generation module 320, the determination module 330, the deployment module 340, and the detection module 350 can be at least partially implemented as a hardware circuit, such as a field programmable gate array (FPGA), a programmable logic array (PLA), a system on a chip, a system on a substrate, a system on a package, an application specific integrated circuit (ASIC), or can be implemented by hardware or firmware such as any other reasonable way of integrating or packaging the circuit, or implemented in any one of the three implementation methods of software, hardware, and firmware or in a suitable combination of any of them. Alternatively, at least one of the acquisition module 310 , the generation module 320 , the determination module 330 , the deployment module 340 , and the detection module 350 may be at least partially implemented as a computer program module, and when the computer program module is executed, a corresponding function may be performed.

[0098] It should be noted that the threat intelligence detection device part based on honeypot trapping in the embodiments of the present disclosure corresponds to the threat intelligence detection method part based on honeypot trapping in the embodiments of the present disclosure. The description of the threat intelligence detection device part based on honeypot trapping specifically refers to the threat intelligence detection method part based on honeypot trapping, which will not be repeated here.

[0099] Figure 4 The structural block diagram of an electronic device suitable for implementing a threat intelligence detection method based on honeypot trapping according to an embodiment of the present disclosure is schematically shown. Figure 4 The electronic device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present disclosure.

[0100] like Figure 4 As shown, the electronic device 400 according to an embodiment of the present disclosure includes a processor 401, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 402 or a program loaded from a storage part 408 to a random access memory (RAM) 403. The processor 401 may include, for example, a general-purpose microprocessor (e.g., a CPU), an instruction set processor and / or a related chipset and / or a dedicated microprocessor (e.g., an application-specific integrated circuit (ASIC)), etc. The processor 401 may also include an onboard memory for caching purposes. The processor 401 may include a single processing unit or multiple processing units for performing different actions of the method flow according to an embodiment of the present disclosure.

[0101] In RAM 403, various programs and data required for the operation of electronic device 400 are stored. Processor 401, ROM 402 and RAM 403 are connected to each other via bus 404. Processor 401 performs various operations of the method flow according to the embodiment of the present disclosure by executing the program in ROM 402 and / or RAM 403. It should be noted that the program can also be stored in one or more memories other than ROM 402 and RAM 403. Processor 401 can also perform various operations of the method flow according to the embodiment of the present disclosure by executing the program stored in the one or more memories.

[0102] According to an embodiment of the present disclosure, the electronic device 400 may further include an input / output (I / O) interface 405, which is also connected to the bus 404. The electronic device 400 may further include one or more of the following components connected to the input / output (I / O) interface 405: an input portion 406 including a keyboard, a mouse, etc.; an output portion 407 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage portion 408 including a hard disk, etc.; and a communication portion 409 including a network interface card such as a LAN card, a modem, etc. The communication portion 409 performs communication processing via a network such as the Internet. A drive 410 is also connected to the input / output (I / O) interface 405 as needed. A removable medium 411, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 410 as needed, so that a computer program read therefrom is installed into the storage portion 408 as needed.

[0103] According to an embodiment of the present disclosure, the method flow according to an embodiment of the present disclosure can be implemented as a computer software program. For example, an embodiment of the present disclosure includes a computer program product, which includes a computer program carried on a computer-readable storage medium, and the computer program contains a program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from the network through the communication part 409, and / or installed from the removable medium 411. When the computer program is executed by the processor 401, the above-mentioned functions defined in the system of the embodiment of the present disclosure are executed. According to an embodiment of the present disclosure, the system, equipment, device, module, unit, etc. described above can be implemented by a computer program module.

[0104] The present disclosure also provides a computer-readable storage medium, which may be included in the device / apparatus / system described in the above embodiments; or may exist independently without being assembled into the device / apparatus / system. The above computer-readable storage medium carries one or more programs, and when the above one or more programs are executed, the method according to the embodiment of the present disclosure is implemented.

[0105] According to an embodiment of the present disclosure, the computer-readable storage medium may be a non-volatile computer-readable storage medium. For example, it may include, but is not limited to: a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof. In the present disclosure, a computer-readable storage medium may be any tangible medium containing or storing a program that may be used by or in combination with an instruction execution system, apparatus, or device.

[0106] For example, according to an embodiment of the present disclosure, the computer-readable storage medium may include the ROM 402 and / or the RAM 403 described above and / or one or more memories other than the ROM 402 and the RAM 403 .

[0107] The embodiments of the present disclosure also include a computer program product, which includes a computer program, and the computer program contains program code for executing the method provided by the embodiments of the present disclosure. When the computer program product runs on an electronic device, the program code is used to enable the electronic device to implement the method provided by the embodiments of the present disclosure.

[0108] When the computer program is executed by the processor 401, the above functions defined in the system / device of the embodiment of the present disclosure are executed. According to the embodiment of the present disclosure, the system, device, module, unit, etc. described above can be implemented by a computer program module.

[0109] In one embodiment, the computer program may rely on tangible storage media such as optical storage devices, magnetic storage devices, etc. In another embodiment, the computer program may also be transmitted and distributed in the form of signals on a network medium, and downloaded and installed through the communication part 409, and / or installed from the removable medium 411. The program code contained in the computer program may be transmitted using any appropriate network medium, including but not limited to: wireless, wired, etc., or any suitable combination of the above.

[0110] According to an embodiment of the present disclosure, the program code for executing the computer program provided by the embodiment of the present disclosure can be written in any combination of one or more programming languages. Specifically, these computing programs can be implemented using high-level process and / or object-oriented programming languages, and / or assembly / machine languages. Programming languages ​​include, but are not limited to, Java, C++, python, "C" language or similar programming languages. The program code can be executed entirely on the user computing device, partially on the user device, partially on the remote computing device, or entirely on the remote computing device or server. In the case of a remote computing device, the remote computing device can be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computing device (for example, using an Internet service provider to connect through the Internet).

[0111] The flowcharts and block diagrams in the accompanying drawings illustrate the possible implementation architecture, functions and operations of the systems, methods and computer program products according to various embodiments of the present disclosure. In this regard, each box in the flowchart or block diagram may represent a module, a program segment, or a part of a code, and the above-mentioned module, program segment, or a part of the code contains one or more executable instructions for implementing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box may also occur in an order different from that marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flowchart, and the combination of boxes in the block diagram or flowchart, can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions. It can be understood by those skilled in the art that the features recorded in the various embodiments of the present disclosure can be combined and / or combined in a variety of ways, even if such a combination or combination is not explicitly recorded in the present disclosure. In particular, without departing from the spirit and teaching of the present disclosure, the features described in the various embodiments of the present disclosure may be combined and / or combined in a variety of ways. All of these combinations and / or combinations fall within the scope of the present disclosure.

[0112] The embodiments of the present disclosure are described above. However, these embodiments are only for illustrative purposes and are not intended to limit the scope of the present disclosure. Although the embodiments are described above separately, this does not mean that the measures in the various embodiments cannot be used in combination to advantage. Without departing from the scope of the present disclosure, those skilled in the art may make a variety of substitutions and modifications, which should all fall within the scope of the present disclosure.

Claims

1. A threat intelligence detection method based on honeypot trapping, characterized in that: The method comprises: Get network topology data of IPv6 network; Generate an undirected graph according to the network topology data, wherein the nodes of the undirected graph represent devices in the IPv6 network, and the edges of the undirected graph represent connection relationships between the devices; Based on the undirected graph, determining a target node according to a first parameter and a second parameter of each node, wherein the first parameter represents an importance characteristic of the node, and the second parameter represents a vulnerability characteristic of the node; Based on the target node, deploy a honeypot trapping strategy, wherein the honeypot trapping strategy is used to simulate the vulnerability of the real system to attract attackers to actively attack; According to the honeypot trapping strategy, threat intelligence is detected.

2. The method according to claim 1, characterized in that The determining the target node based on the undirected graph and according to the first parameter and the second parameter of each node comprises: Based on the undirected graph, determine the first parameter of each node using the PageRank algorithm; Based on the undirected graph, determining a second parameter of each node using a K-Shell decomposition algorithm; A target node is determined according to the first parameter and the second parameter.

3. The method according to claim 2, characterized in that Determining the first parameter of each node by using the PageRank algorithm based on the undirected graph includes: Assign the same initial weight to each node; Using the PageRank algorithm, the final weight of each node is iteratively calculated according to the initial weight and the number of connections of each node, wherein the more the number of connections, the greater the final weight, and the more important the corresponding node; According to the final weight, the importance feature of each node is determined to obtain a first parameter.

4. The method according to claim 2, characterized in that: Determining the second parameter of each node based on the undirected graph using the K-Shell decomposition algorithm includes: Performing hierarchical decomposition processing on the undirected graph using a K-Shell decomposition algorithm to determine the K-Shell value of each node, wherein the K-Shell value represents the centrality and connection density characteristics of each node. The higher the K-Shell value, the closer the corresponding node is to the center of the network and the more connection points it has; The vulnerability characteristics of each node are determined according to the K-Shell value to obtain a second parameter.

5. The method according to claim 1, characterized in that: According to the honeypot trapping strategy, detecting threat intelligence includes: In response to the honeypot being attacked by an attacker, monitoring and recording attack data, wherein the attack data includes attack behavior and traffic; Threat intelligence about the attacker is generated based on the attack data.

6. The method according to any one of claims 1 to 5, characterized in that: Also includes: Generate a data set based on the attack data and the threat intelligence; Predicting threat trends using a machine learning model based on the data set, wherein the machine learning model is pre-trained based on historical attack data and historical threat intelligence; According to the threat trend, the honeypot trapping strategy and security defense mechanism are adjusted to improve the defense capability of the system.

7. The method according to claim 6, characterized in that The method of predicting threat trends based on the data set and using a machine learning model includes: Identify the attack tools and attack methods used by attackers; Determine the attacker's target; Predict threat trends based on the attack tool, the attack method, and the attack target.

8. A threat intelligence detection device based on honeypot trapping, characterized in that: The device comprises: An acquisition module is used to acquire network topology data of an IPv6 network; A generating module, configured to generate an undirected graph according to the network topology data, wherein the nodes of the undirected graph represent devices in the IPv6 network, and the edges of the undirected graph represent connection relationships between the devices; A determination module, configured to determine a target node based on the undirected graph and according to a first parameter and a second parameter of each node, wherein the first parameter represents an importance characteristic of the node, and the second parameter represents a vulnerability characteristic of the node; A deployment module, used to deploy a honeypot trapping strategy based on the target node, wherein the honeypot trapping strategy is used to simulate the vulnerability of a real system to attract attackers to actively attack; The detection module is used to detect threat intelligence according to the honeypot trapping strategy.

9. An electronic device, characterized in that: include: one or more processors; a storage device for storing one or more programs, When the one or more programs are executed by the one or more processors, the one or more processors execute the method according to any one of claims 1 to 7.

10. A computer-readable storage medium having executable instructions stored thereon, characterized in that: When the instruction is executed by a processor, the processor executes the method according to any one of claims 1 to 7.

Images