Information processing methods, devices, systems, media and programs for responding to network attacks

Abstract

The present disclosure provides an information processing method for dealing with network attacks. The method includes: after capturing attack data, identifying the attack category of the attack behavior in the attack data; obtaining preset atomic response data corresponding to the attack category; combining the atomic response data with the information of the asset to be accessed by the attack data to construct response data corresponding to the attack data; and feeding back the response data to the attacker who sent the attack data to lure and analyze the attacker's further attack behavior. The present disclosure also provides an information processing device, system, medium and program for dealing with network attacks.

Description

Technical Field

[0001] The present disclosure relates to the field of Internet information security technology, and more specifically, to an information processing method, device, system, medium and program for coping with network attacks. Background Art

[0002] With the continuous development and application of the Internet and industrial control networks, governments and enterprises pay more attention to the construction of information security. At present, the industry mainly uses honeypot technology to capture, lure and analyze network attacks. The existing honeypot deception technology is either a passive static response or an active defense deception based on preset data. The former has no active deception characteristics for attack behaviors and cannot actively lure attack behaviors; although the latter can actively deceive, the data used for deception is too rigid, generally built-in template data, with low simulation, unable to attract the attention of attackers, poor deception and temptation, and therefore a low success rate. Summary of the invention

[0003] In view of this, the embodiments of the present disclosure provide an information processing method, device, system, medium and program for responding to network attacks, which can feed back highly realistic decoy data to the attacker.

[0004] One aspect of the embodiments of the present disclosure provides an information processing method for dealing with network attacks. The method includes: after capturing attack data, identifying the attack category of the attack behavior in the attack data; obtaining preset atomic response data corresponding to the attack category; combining the atomic response data with information about the asset to be accessed by the attack data to construct response data corresponding to the attack data; and feeding back the response data to the attacker who sent the attack data to lure and analyze the attacker's further attack behavior.

[0005] According to the disclosed embodiment, the atomic response data is combined with the information of the assets to be accessed by the attack data to construct response data corresponding to the attack data, including: according to the destination IP and destination port in the attack data, obtaining the first page in the service provided by the destination IP and destination port, wherein the first page is one of one or more pages in the service; and merging the atomic response data and the first page to obtain the response data.

[0006] According to an embodiment of the present disclosure, obtaining the information of the first page in the service provided by the destination IP and the destination port includes: querying the log data of M pages corresponding to the service from the log system according to the destination IP and the destination port, where M is an integer greater than 1; and selecting the first page from the M pages according to a predetermined rule.

[0007] According to an embodiment of the present disclosure, selecting the first page from M pages according to a predetermined rule includes: evaluating the response simulation degree of each of the M pages based on the complexity of the page, the number of external resources referenced by the page, and the size of the page; and selecting the page with the highest response simulation degree as the first page.

[0008] According to an embodiment of the present disclosure, merging the atomic response data and the first page to obtain the response data includes: selecting a stationary position in the first page, wherein the stationary position includes the beginning position, paragraph position or end position of the page; and setting the atomic response data at the stationary position in the first page.

[0009] According to an embodiment of the present disclosure, the atomic response data is combined with the information of the assets to be accessed by the attack data to construct response data corresponding to the attack data, including: obtaining data characteristics of data in the service provided by the destination IP and the destination port according to the destination IP and the destination port in the attack data; and adjusting the atomic response data to data that is compatible with the data characteristics.

[0010] According to an embodiment of the present disclosure, the attack category includes SQL injection attacks. The acquiring of data features of data in the service provided by the destination IP and the destination port according to the destination IP and the destination port includes querying the data structure of a data table in the database to be accessed by the attack data from a log system according to the destination IP and the destination port. The adjusting of the atomic response data to data adapted to the data features includes setting each field in the atomic response data according to the data structure of the data table to adjust the atomic response data.

[0011] Another aspect of the embodiments of the present disclosure provides an information processing device for responding to network attacks. The device includes an identification module, an acquisition module, a construction module, and a sending module. The identification module is used to identify the attack category of the attack behavior in the attack data after the attack data is captured. The acquisition module is used to obtain preset atomic response data corresponding to the attack category. The construction module is used to combine the atomic response data with the information of the assets to be accessed by the attack data to construct response data corresponding to the attack data. The sending module is used to feed back the response data to the attacker who sent the attack data to lure and analyze the attacker's further attack behavior.

[0012] According to the disclosed embodiment, the construction module includes a page acquisition submodule and a merging submodule. The page acquisition submodule is used to acquire the first page in the service provided by the destination IP and the destination port according to the destination IP and the destination port in the attack data, wherein the first page is one of the one or more pages in the service. The merging submodule is used to merge the atomic response data and the first page to obtain the response data.

[0013] According to an embodiment of the present disclosure, the page acquisition submodule is also used to query the log data of M pages corresponding to the service from the log system according to the destination IP and the destination port, where M is an integer greater than 1, and the first page is selected from the M pages according to a predetermined rule.

[0014] According to an embodiment of the present disclosure, the merging submodule is also used to select a stationary position in the first page, wherein the stationary position includes the beginning position, paragraph position or end position of the page, and to set the atomic response data at the stationary position in the first page.

[0015] According to an embodiment of the present disclosure, the construction module further includes an atomic response data adjustment submodule. The atomic response data adjustment submodule is used to obtain data features of data in the service provided by the destination IP and the destination port according to the destination IP and the destination port in the attack data, and adjust the atomic response data to data adapted to the data features.

[0016] According to an embodiment of the present disclosure, the attack category includes SQL injection attack. The atomic response data adjustment submodule is also used to query the data structure of the data table in the database to be accessed by the attack data from the log system according to the destination IP and the destination port, and to set each field in the atomic response data according to the data structure of the data table to adjust the atomic response data.

[0017] Another aspect of the embodiment of the present disclosure provides an information processing system for dealing with network attacks. The system includes one or more memories and one or more processors. The memories store executable instructions. The processor executes the executable instructions to implement the method described above.

[0018] Another aspect of the embodiments of the present disclosure provides a computer-readable storage medium having executable instructions stored thereon, which, when executed by a processor, causes the processor to execute the method as described above.

[0019] According to another aspect of the embodiments of the present disclosure, a computer program is provided, wherein the computer program includes computer executable instructions, and the instructions are used to implement the above method when executed.

[0020] One or more of the above-mentioned embodiments have the following advantages or beneficial effects: it can at least partially solve the problem in existing honeypots or attack deception technologies that effective deception cannot be achieved due to the rigidity and lack of flexibility of the deception data, and therefore, it can construct highly simulated response data for deception in combination with the information of the assets that the attacker wants to access, thereby achieving highly flexible and highly simulated attack deception to achieve the purpose of deceiving the attacker. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] The above and other objects, features and advantages of the present disclosure will become more apparent through the following description of the embodiments of the present disclosure with reference to the accompanying drawings, in which:

[0022] Figure 1 The application scenario of the information processing method and device for dealing with network attacks according to the embodiments of the present disclosure is schematically shown;

[0023] Figure 2 A flowchart schematically shows an information processing method for coping with network attacks according to an embodiment of the present disclosure;

[0024] Figure 3 A flowchart schematically shows an information processing method for coping with network attacks according to another embodiment of the present disclosure;

[0025] Figure 4 A flowchart of obtaining a first page according to an embodiment of the present disclosure is schematically shown;

[0026] Figure 5 Schematically shows a flow chart of merging atomic response data and a first page according to an embodiment of the present disclosure;

[0027] Figure 6 A flowchart schematically shows an information processing method for coping with network attacks according to another embodiment of the present disclosure;

[0028] Figure 7 A block diagram schematically shows an information processing device for dealing with network attacks according to an embodiment of the present disclosure;

[0029] Figure 8 A block diagram schematically shows an information processing system for responding to network attacks according to an embodiment of the present disclosure; and

[0030] Fig. 9 A block diagram of a computer system suitable for implementing the information processing method for coping with network attacks according to an embodiment of the present disclosure is schematically shown. DETAILED DESCRIPTION

[0031] Hereinafter, embodiments of the present disclosure will be described with reference to the accompanying drawings. However, it should be understood that these descriptions are exemplary only and are not intended to limit the scope of the present disclosure. In the following detailed description, for ease of explanation, many specific details are set forth to provide a comprehensive understanding of the embodiments of the present disclosure. However, it is apparent that one or more embodiments may also be implemented without these specific details. In addition, in the following description, descriptions of known structures and technologies are omitted to avoid unnecessary confusion of the concepts of the present disclosure.

[0032] The terms used herein are only for describing specific embodiments and are not intended to limit the present disclosure. The terms "comprise", "include", etc. used herein indicate the existence of the features, steps, operations and / or components, but do not exclude the existence or addition of one or more other features, steps, operations or components.

[0033] All terms (including technical and scientific terms) used herein have the meanings commonly understood by those skilled in the art, unless otherwise defined. It should be noted that the terms used herein should be interpreted as having a meaning consistent with the context of this specification, and should not be interpreted in an idealized or overly rigid manner.

[0034] In the case of using expressions such as "at least one of A, B, and C, etc.", it should generally be interpreted in accordance with the meaning of the expression generally understood by those skilled in the art (for example, "a system having at least one of A, B, and C" should include but is not limited to a system having A alone, B alone, C alone, A and B, A and C, B and C, and / or A, B, C, etc.). In the case of using expressions such as "at least one of A, B, or C, etc.", it should generally be interpreted in accordance with the meaning of the expression generally understood by those skilled in the art (for example, "a system having at least one of A, B, or C" should include but is not limited to a system having A alone, B alone, C alone, A and B, A and C, B and C, and / or A, B, C, etc.).

[0035] The embodiments of the present disclosure provide an information processing method, device, system, medium and program for responding to network attacks, which can construct highly simulated response data for deception in combination with information about assets that the attacker wants to access, thereby achieving highly flexible and highly simulated attack deception. The method includes: after capturing the attack data, identifying the attack category of the attack behavior in the attack data; obtaining preset atomic response data corresponding to the attack category; combining the atomic response data with information about the assets that the attack data wants to access, constructing response data corresponding to the attack data; and feeding back the response data to the attacker who sent the attack data, so as to deceive and analyze the attacker's further attack behavior.

[0036] The embodiments of the present disclosure construct highly simulated response data for deception and feed the response data back to the attacker, which can more likely induce the attacker to mistakenly believe that the attack is successful. This increases the probability that the attacker will further attack. Therefore, when the attacker further attacks, it is possible to deeply analyze the characteristics of the attacker's various attack behaviors, or to counter or track the attacker with appropriate means, etc., so as to improve the ability to deal with network attacks.

[0037] Figure 1 The application scenario 100 of the information processing method and device for dealing with network attacks according to an embodiment of the present disclosure is schematically shown. It should be noted that: Figure 1 What is shown is merely an example of a system architecture to which the embodiments of the present disclosure can be applied, in order to help those skilled in the art understand the technical content of the present disclosure, but it does not mean that the embodiments of the present disclosure cannot be used in other devices, systems, environments or scenarios.

[0038] like Figure 1 As shown, the application scenario 100 according to this embodiment may include terminal devices 101, 102, 103, a network 104 and a server 105. The network 104 is used to provide a medium for a communication link between the terminal devices 101, 102, 103 and the server 105. The network 104 may include various connection types, such as wired, wireless communication links or optical fiber cables, etc.

[0039] The user can use the terminal devices 101, 102, 103 to access the server 105 through the network 104. The server 105 may be a gateway server, which is provided with a honeypot.

[0040] When a malicious user uses terminal devices 101, 102, 103 to access server 105, server 105 can execute the method provided in the embodiment of the present disclosure, construct response data corresponding to the attack behavior category and with a highly simulated effect and feed it back to the corresponding terminal devices 101, 102, 103 to trick the malicious user into further attack behavior.

[0041] It should be understood that Figure 1 The number of terminal devices, networks and servers in the embodiment is only for illustration. Any number of terminal devices, networks and servers may be provided according to implementation requirements.

[0042] Figure 2 The flowchart of the information processing method for coping with network attacks according to an embodiment of the present disclosure is schematically shown.

[0043] like Figure 2 As shown, according to the embodiment of the present disclosure, the information processing method for coping with network attacks may include operations S210 to S240.

[0044] First, in operation S210, after the attack data is trapped, the attack category of the attack behavior in the attack data is identified. For example, the attack behavior in the attack data is identified as SQL injection, cross-site scripting (XSS), arbitrary file reading, command execution, or others.

[0045] Then in operation S220, the preset atomic response data corresponding to the attack category is obtained. For example, a vulnerability response template library can be preset. The vulnerability response template library can set corresponding atomic response data for each attack category. The atomic response data can be, for example, a page set according to the format of the data to be read by the attack category. For example, the purpose of arbitrary file reading is to read the password file on the server, then a page with a password file format (for example, linux / etc / passwd format) can be set as the atomic response data. For another example, the purpose of SQL injection is to read a table in a database, then a page with a certain table data structure can be set as the atomic response data.

[0046] The atomic response data lacks authenticity and does not meet the conditions for being returned to the attacker. If the atomic response data is directly fed back to the attacker, the page the attacker obtains is too simple, which may cause the attacker to think that the target of the attack is just a test website or a honeypot, etc., so the attacker will give up further action, thus failing to achieve the purpose of deception.

[0047] Next, in operation S230, the atomic response data is combined with the information of the asset to be accessed by the attack data to construct response data corresponding to the attack data.

[0048] Thereafter, in operation S240, the response data is fed back to the attacker who sent the attack data, so as to trick and analyze the attacker's further attack behavior. The attacker may be, for example, a machine or user that sent the attack data.

[0049] The information of the asset to be accessed by the attack data may be, for example, a web page, a database, or a confidential file on a server. In one embodiment, a page with a similar format, content, or layout display effect may be obtained based on the information of the asset to be accessed by the attack data, and then the page may be combined with the atomic response data to obtain the response data. Alternatively, in another embodiment, the data features in the information of the asset to be accessed by the attack data may be obtained, and then the atomic response data may be adjusted according to the data features. In yet another embodiment, the adjusted atomic response data may also be combined with the information (e.g., a page) of the asset to be accessed by the attack data. Thus, a highly simulated response data for deception combined with the information of the asset to be accessed by the attack data is formed, so as to deceive the attacker's further simulation behavior and improve the success rate of deception.

[0050] Figure 3 The flowchart of the information processing method for coping with network attacks according to another embodiment of the present disclosure is schematically shown.

[0051] like Figure 3 As shown, according to the embodiment of the present disclosure, the information processing method for coping with network attacks may include operation S210, operation S220, operation S331 to operation S332, and operation S240. Among them, operation S210, operation S220 and operation S240 are consistent with the above.

[0052] Specifically, firstly, atomic response data is acquired through operations S210 and S220.

[0053] Next, in operation S331, according to the destination IP and destination port in the attack data, the first page in the service provided by the destination IP and destination port is obtained, wherein the first page is one of the one or more pages in the service.

[0054] For example, since the attack data is intercepted and trapped by the honeypot machine before reaching the real assets it is going to access, the service that the attack behavior is going to access can be determined in the honeypot machine based on the destination IP and destination port in the attack data. Then the honeypot machine can use a certain method to select a page, simulation page, or history page in the service as the first page.

[0055] Then in operation S332, the atomic response data and the first page are merged to obtain response data.

[0056] Thereafter, in operation S240, the response data is fed back to the attacker who sent the attack data.

[0057] In this embodiment, operation S331 and operation S332 are a specific embodiment of the aforementioned operation S230.

[0058] Figure 4 The flowchart of acquiring the first page in operation S331 according to an embodiment of the present disclosure is schematically shown.

[0059] like Figure 4 As shown, the process of acquiring the first page in operation S331 may include operation S401 and operation S402.

[0060] First, in operation S401, log data of M pages corresponding to the service are queried from the log system according to the destination IP and the destination port, where M is an integer greater than 1.

[0061] The log system may be any log system for recording access to the destination IP and destination port through the network, such as a traffic network log, an alarm network log system, etc. For example, if the attack data is accessed through the HTTP protocol, the HTTP response body in the response message of accessing the destination IP and destination port may be obtained from the log system, thereby obtaining multiple pages (i.e., M pages). This embodiment avoids the impact on real assets by linking with the log system to obtain the M pages from the log system.

[0062] Then in operation S402, a first page is selected from the M pages according to a predetermined rule.

[0063] According to an embodiment of the present disclosure, the response simulation degree of each of the M pages may be evaluated based on the complexity of the page, the number of external resources referenced by the page, and the size of the page, and then the page with the highest response simulation degree may be selected as the first page.

[0064] For example, an optimal response data extraction algorithm may be set, and the response simulation degree of each page may be calculated by the optimal response data extraction algorithm. For example, the optimal response data extraction algorithm may be a comprehensive evaluation of parameters such as page complexity, the number of referenced external resources, and page size to calculate the response simulation degree of the page. In one embodiment, through the optimal response data extraction algorithm, a page with moderate page complexity, as few referenced external resources as possible, and moderate page size may be selected from M pages as the first page.

[0065] The page complexity can be evaluated, for example, by parameters such as the number of different types of tags, the number of color types, the number of links, the number of texts, etc. The number of referenced external resources can be evaluated, for example, by parameters such as the number of external data used for dynamic rendering in the page, or the number of external data referenced when the Cascading Style Sheet CSS is used for page color design. The page size can be evaluated by the length of the string in the page, or the storage space occupied by the page.

[0066] In one embodiment, the following logic can be followed when evaluating the response simulation degree of each page: if the page complexity is too simple, the page will appear unreal, so a page with moderate page complexity should be selected; the external resources referenced by the page mean that the attacker needs to obtain the external resources when opening the page, and due to the interception of the honeypot machine, when the attacker accesses non-real resources and cannot obtain external resources, the page is prone to rendering failure and confusion, so a page with as few external resources referenced as possible should be selected; in addition, the smaller the page, the more unreal it will appear, so a page with moderate page size should be selected.

[0067] Through evaluation, the page with the highest response simulation degree is selected from M pages as the first page, and then the first page is merged with the atomic response data to obtain the response data and fed back to the attacker. In this way, the page displayed to the attacker is more real and has relatively rich content, which makes it easier for the attacker to believe that his attack behavior is successful, thereby achieving the purpose of attack deception. Moreover, these pages are obtained from log data and will not bring risks to real assets.

[0068] Figure 5 The flowchart of merging the atomic response data and the first page in operation S332 according to an embodiment of the present disclosure is schematically shown.

[0069] like Figure 5 As shown, according to an embodiment of the present disclosure, the process of merging the atomic response data and the first page in operation S332 may include operation S501 and operation S502 .

[0070] First, in operation S501, a station position is selected in the first page, wherein the station position includes the beginning position, paragraph position or end position of the page. The station position can be randomly set or randomly changed.

[0071] Then, in operation S502, the atomic response data is set at the stationary position in the first page. For example, the character information in the atomic response data is extracted and placed at the stationary position to complete the construction of the response data. In this way, a high degree of simulation of the attack response is completed, thereby achieving the purpose of deception.

[0072] Figure 6 The flowchart of the information processing method for coping with network attacks according to another embodiment of the present disclosure is schematically shown.

[0073] like Figure 6As shown, according to the embodiment of the present disclosure, the information processing method for responding to network attacks may include operation S210, operation S220, operation S631-operation S632, and operation S240. Among them, operation S210, operation S220 and operation S240 are consistent with the above. Operation S631-operation S632 may be a specific embodiment of operation S230.

[0074] Specifically, in this embodiment, atomic response data is first acquired through operations S210 and S220.

[0075] Next, in operation S631, data features of data in the service provided by the destination IP and the destination port are obtained according to the destination IP and the destination port in the attack data. The data features, for example, may be the format or display effect of the page data, or the organizational structure of the table, the content of the table field, etc., or the code type of the character data, etc., for the character data.

[0076] Then in operation S632, the atomic response data is adjusted to data adapted to the data features.

[0077] Specifically, for example, data features of data in services provided by the destination IP and destination port may be obtained based on the destination IP and destination port in the attack data, and the atomic response data may be adjusted to data that is compatible with the data features.

[0078] In one embodiment, the attack category includes SQL injection attack, and in operation S631, the data structure of the data table in the database to be accessed by the attack data can be queried from the log system according to the destination IP and the destination port. Then, in operation S632, each field in the atomic response data is set according to the data structure of the data table to adjust the atomic response data.

[0079] For example, if the SQL injection attack is to query the employee information in the database, the field data in the employee information table can be obtained from the database log and filled into the atomic response data, for example, the fields in the atomic impact data can be filled with the employee name, work number, ID information, occupation, position, salary information, etc. Or for example, if the SQL injection query is the student score table in the database, the content filled into the fields in the atomic response data can be the student name, student number, and scores in various subjects.

[0080] Correspondingly, for other attack behaviors, such as the attack behavior of reading any file, the corresponding data content can be added or changed in the corresponding atomic response data according to the characteristics of the read file format. In this way, the atomic response data can be combined with the asset attributes to achieve high imitation and high authenticity.

[0081] Next, in some embodiments, the atomic response data adjusted in operation S632 may be used as response data and fed back to the attacker who sent the attack data in operation S240 to trick and analyze further attack behaviors of the attacker.

[0082] Alternatively, in some other embodiments, the atomic response data adjusted in operation S632 may be merged with the first page in the service accessed by the attack data through operations S331 and S332 to obtain response data, which is then fed back to the attacker who sent the attack data in operation S240 to trick and analyze the attacker's further attack behavior.

[0083] Figure 7 The block diagram schematically shows an information processing device 700 for coping with network attacks according to an embodiment of the present disclosure.

[0084] like Figure 7 As shown, according to an embodiment of the present disclosure, the apparatus 700 may include an identification module 710, an acquisition module 720, a construction module 730, and a sending module 740. The apparatus 700 may be used to implement a reference Figure 2 to Figure 6 The method described.

[0085] The identification module 710 is used to identify the attack category of the attack behavior in the attack data after the attack data is captured.

[0086] The acquisition module 720 is used to acquire preset atomic response data corresponding to the attack category.

[0087] The construction module 730 is used to combine the atomic response data with the information of the asset to be accessed by the attack data, and construct the response data corresponding to the attack data.

[0088] The sending module 740 is used to feed back the response data to the attacker who sent the attack data, so as to trick and analyze the attacker's further attack behavior.

[0089] According to the disclosed embodiment, the construction module 730 may include a page acquisition submodule 731 and a merging submodule 732 .

[0090] The page acquisition submodule 731 is used to acquire the first page in the service provided by the destination IP and the destination port according to the destination IP and the destination port in the attack data, wherein the first page is one of one or more pages in the service. According to one embodiment of the present disclosure, the page acquisition submodule 731 can query the log data of M pages corresponding to the service from the log system according to the destination IP and the destination port, wherein M is an integer greater than 1, and select the first page from the M pages according to a predetermined rule.

[0091] The merging submodule 732 is used to merge the atomic response data and the first page to obtain the response data. According to one embodiment of the present disclosure, the merging submodule 732 is also used to select a stationary position in the first page, wherein the stationary position includes the beginning position, paragraph position or end position of the page, and to set the atomic response data at the stationary position in the first page.

[0092] According to an embodiment of the present disclosure, the construction module 730 may further include an atomic response data adjustment submodule 733 .

[0093] The atomic response data adjustment submodule 733 is used to obtain data characteristics of data in the service provided by the destination IP and destination port according to the destination IP and destination port in the attack data, and adjust the atomic response data to data suitable for the data characteristics.

[0094] According to an embodiment of the present disclosure, the attack category includes SQL injection attack. The atomic response data adjustment submodule 733 is also used to query the data structure of the data table in the database to be accessed by the attack data from the log system according to the destination IP and destination port, and set each field in the atomic response data according to the data structure of the data table to adjust the atomic response data.

[0095] Figure 8 The block diagram schematically shows an information processing system 800 for coping with network attacks according to an embodiment of the present disclosure.

[0096] like Figure 8 As shown, according to an embodiment of the present disclosure, the system 800 may include an attack trapping system 810 and a log system 820. The attack trapping system 810 may include an attack detection module 811, an attack deception module 812, and a log analysis module 813. The log system includes a log extraction module 821.

[0097] The attack detection module 811 in the attack trapping system 810 can detect the attack category to which the specific attack behavior belongs, such as SQL injection, XSS, arbitrary file reading, command execution, etc., based on threat detection of attack data.

[0098] The attack deception module 812 can perform corresponding attack deception according to the identified attack category. When performing attack deception, the attack deception module 812 needs to construct deception data by analyzing the log data in the log system 820 with the help of the log analysis module 813.

[0099] The log analysis module 813 obtains log data from the log system 820 and selects a page with the highest response simulation degree to provide to the attack deception module 812 to construct response data.

[0100] The log extraction module 821 in the log system 820 extracts corresponding log data and gives it to the log analysis module 813 based on the asset information (such as the destination IP and destination port) provided by the log analysis module 813 in the deception trapping system 810 .

[0101] The system 800 can construct highly simulated response data for attack deception through the attack trapping platform 810 by linking with the log system 820, combining asset attributes and page integrity, and provides an effective and flexible attack deception method that can effectively confuse attackers.

[0102] According to the embodiments of the present invention, any one or more of the modules, submodules, units, and subunits, or at least part of the functions of any one of them can be implemented in one module. According to the embodiments of the present invention, any one or more of the modules, submodules, units, and subunits can be split into multiple modules for implementation. According to the embodiments of the present invention, any one or more of the modules, submodules, units, and subunits can be at least partially implemented as hardware circuits, such as field programmable gate arrays (FPGAs), programmable logic arrays (PLAs), systems on chips, systems on substrates, systems on packages, application specific integrated circuits (ASICs), or can be implemented by hardware or firmware in any other reasonable way of integrating or packaging the circuit, or implemented in any one of the three implementation methods of software, hardware, and firmware, or in any appropriate combination of any of them. Alternatively, according to the embodiments of the present invention, one or more of the modules, submodules, units, and subunits can be at least partially implemented as computer program modules, and when the computer program modules are run, the corresponding functions can be performed.

[0103] For example, any multiple of the identification module 710, the acquisition module 720, the construction module 730, the sending module 740, the page acquisition submodule 731, the merging submodule 732, the atomic response data adjustment submodule 733, the attack detection module 811, the attack deception module 812, the log analysis module 813, and the log extraction module 821 can be combined into one module for implementation, or any one of the modules can be split into multiple modules. Alternatively, at least part of the functions of one or more of these modules can be combined with at least part of the functions of other modules and implemented in one module. According to an embodiment of the present disclosure, at least one of the identification module 710, the acquisition module 720, the construction module 730, the sending module 740, the page acquisition sub-module 731, the merging sub-module 732, the atomic response data adjustment sub-module 733, the attack detection module 811, the attack deception module 812, the log analysis module 813, and the log extraction module 821 can be at least partially implemented as a hardware circuit, such as a field programmable gate array (FPGA), a programmable logic array (PLA), a system on a chip, a system on a substrate, a system on a package, an application-specific integrated circuit (ASIC), or can be implemented by hardware or firmware such as any other reasonable way of integrating or packaging the circuit, or can be implemented in any one of the three implementation methods of software, hardware and firmware or in an appropriate combination of any of them. Alternatively, at least one of the identification module 710, the acquisition module 720, the construction module 730, the sending module 740, the page acquisition sub-module 731, the merging sub-module 732, the atomic response data adjustment sub-module 733, the attack detection module 811, the attack deception module 812, the log analysis module 813, and the log extraction module 821 can be at least partially implemented as a computer program module, which can perform corresponding functions when the computer program module is executed.

[0104] Fig. 9 A block diagram of a computer system 900 suitable for implementing the information processing method for coping with network attacks according to an embodiment of the present disclosure is schematically shown. Fig. 9 The computer system 900 shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present disclosure.

[0105] like Fig. 9As shown, the computer system 900 according to the embodiment of the present disclosure includes a processor 901, which can perform various appropriate actions and processes according to the program stored in the read-only memory (ROM) 902 or the program loaded from the storage part 908 to the random access memory (RAM) 903. The processor 901 may include, for example, a general-purpose microprocessor (such as a CPU), an instruction set processor and / or a related chipset and / or a special-purpose microprocessor (for example, an application-specific integrated circuit (ASIC)), etc. The processor 901 may also include an onboard memory for caching purposes. The processor 901 may include a single processing unit or multiple processing units for performing different actions of the method flow according to the embodiment of the present disclosure.

[0106] In RAM 903, various programs and data required for the operation of computer system 900 are stored. Processor 901, ROM 902 and RAM 903 are connected to each other through bus 904. Processor 901 performs various operations of the method flow according to the embodiment of the present disclosure by executing the program in ROM 902 and / or RAM 903. It should be noted that the program can also be stored in one or more memories other than ROM 902 and RAM 903. Processor 901 can also perform various operations of the method flow according to the embodiment of the present disclosure by executing the program stored in the one or more memories.

[0107] According to an embodiment of the present disclosure, the computer system 900 may further include an input / output (I / O) interface 905, which is also connected to the bus 904. The computer system 900 may further include one or more of the following components connected to the I / O interface 905: an input section 906 including a keyboard, a mouse, etc.; an output section 907 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage section 908 including a hard disk, etc.; and a communication section 909 including a network interface card such as a LAN card, a modem, etc. The communication section 909 performs communication processing via a network such as the Internet. A drive 910 is also connected to the I / O interface 905 as needed. A removable medium 911, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 910 as needed, so that a computer program read therefrom is installed into the storage section 908 as needed.

[0108] According to an embodiment of the present disclosure, the method flow according to an embodiment of the present disclosure can be implemented as a computer software program. For example, an embodiment of the present disclosure includes a computer program product, which includes a computer program carried on a computer-readable storage medium, and the computer program contains a program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from the network through the communication part 909, and / or installed from the removable medium 911. When the computer program is executed by the processor 901, the above-mentioned functions defined in the system of the embodiment of the present disclosure are executed. According to an embodiment of the present disclosure, the system, equipment, device, module, unit, etc. described above can be implemented by a computer program module.

[0109] The present disclosure also provides a computer-readable storage medium, which may be included in the device / apparatus / system described in the above embodiments; or may exist independently without being assembled into the device / apparatus / system. The above computer-readable storage medium carries one or more programs, and when the above one or more programs are executed, the method according to the embodiment of the present disclosure is implemented.

[0110] According to an embodiment of the present disclosure, a computer-readable storage medium may be a non-volatile computer-readable storage medium, for example, may include but is not limited to: a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof. In the present disclosure, a computer-readable storage medium may be any tangible medium containing or storing a program, which may be used by or in combination with an instruction execution system, an apparatus, or a device. For example, according to an embodiment of the present disclosure, a computer-readable storage medium may include the ROM 902 and / or RAM 903 described above and / or one or more memories other than ROM 902 and RAM 903.

[0111] The flow charts and block diagrams in the accompanying drawings illustrate the possible architecture, functions and operations of the systems, methods and computer program products according to various embodiments of the present disclosure. In this regard, each box in the flow chart or block diagram can represent a module, a program segment, or a part of a code, and the above-mentioned module, program segment, or a part of a code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flow chart, and the combination of the boxes in the block diagram or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0112] It will be appreciated by those skilled in the art that the features described in the various embodiments and / or claims of the present disclosure may be combined and / or combined in a variety of ways, even if such combinations and / or combinations are not explicitly described in the present disclosure. In particular, the features described in the various embodiments and / or claims of the present disclosure may be combined and / or combined in a variety of ways without departing from the spirit and teachings of the present disclosure. All of these combinations and / or combinations fall within the scope of the present disclosure.

[0113] The embodiments of the present disclosure are described above. However, these embodiments are only for illustrative purposes and are not intended to limit the scope of the present disclosure. Although the embodiments are described above separately, this does not mean that the measures in the various embodiments cannot be used in combination to advantage. The scope of the present disclosure is defined by the attached claims and their equivalents. Without departing from the scope of the present disclosure, those skilled in the art may make a variety of substitutions and modifications, which should all fall within the scope of the present disclosure.

Claims

1. An information processing method for responding to network attacks, comprising: After the attack data is captured, the attack category of the attack behavior in the attack data is identified; Acquire preset atomic response data corresponding to the attack category; Combining the atomic response data with information about the asset to be accessed by the attack data to construct response data corresponding to the attack data; as well as Feeding back the response data to the attacker who sent the attack data, so as to trick and analyze the attacker's further attack behavior; The step of combining the atomic response data with the information of the asset to be accessed by the attack data to construct the response data corresponding to the attack data includes: According to the destination IP and destination port in the attack data, obtaining a first page in a service provided by the destination IP and destination port, wherein the first page is one of M pages in the service, wherein M is an integer greater than 1; and Merging the atomic response data and the first page to obtain the response data, The step of obtaining information of the first page of services provided by the destination IP and the destination port includes: According to the destination IP and the destination port, query the log data of M pages corresponding to the service from the log system; and Selecting the first page from the M pages according to a predetermined rule, The selecting the first page from the M pages according to a predetermined rule includes: Evaluating the responsiveness of each of the M pages based on the complexity of the page, the number of external resources referenced by the page, and the size of the page; and The page with the highest response simulation degree is selected as the first page.

2. The method according to claim 1, wherein: The merging of the atomic response data and the first page to obtain the response data includes: Selecting a station position in the first page, wherein the station position includes a beginning position, a paragraph position or an end position of the page; and The atomic response data is set at the stationary point position in the first page.

3. The method according to claim 1, wherein: The step of combining the atomic response data with the information of the asset to be accessed by the attack data to construct response data corresponding to the attack data includes: According to the destination IP and destination port in the attack data, obtaining data characteristics of data in the service provided by the destination IP and destination port; and The atomic response data is adjusted to data suitable for the data features.

4. The method according to claim 3, wherein: The attack categories include SQL injection attacks; in According to the destination IP and destination port in the attack data, data features of data in the service provided by the destination IP and destination port are obtained, including: According to the destination IP and destination port, query the data structure of the data table in the database to be accessed by the attack data from the log system; Adjusting the atomic response data to data adapted to the data characteristics includes: The various fields in the atomic response data are set according to the data structure of the data table to adjust the atomic response data.

5. An information processing device for responding to network attacks, comprising: An identification module, used to identify the attack category of the attack behavior in the attack data after the attack data is captured; An acquisition module, used for acquiring preset atomic response data corresponding to the attack category; A construction module, used to combine the atomic response data with information about the asset to be accessed by the attack data, and construct response data corresponding to the attack data; as well as A sending module, used for feeding back the response data to the attacker who sent the attack data, so as to trick and analyze the attacker's further attack behavior; The step of combining the atomic response data with the information of the asset to be accessed by the attack data to construct the response data corresponding to the attack data includes: According to the destination IP and destination port in the attack data, obtaining a first page in a service provided by the destination IP and destination port, wherein the first page is one of M pages in the service, wherein M is an integer greater than 1; and Merging the atomic response data and the first page to obtain the response data, The step of obtaining information of the first page of services provided by the destination IP and the destination port includes: According to the destination IP and the destination port, query the log data of M pages corresponding to the service from the log system; and Selecting the first page from the M pages according to a predetermined rule, The selecting the first page from the M pages according to a predetermined rule includes: Evaluating the responsiveness of each of the M pages based on the complexity of the page, the number of external resources referenced by the page, and the size of the page; and The page with the highest response simulation degree is selected as the first page.

6. An information processing system for responding to network attacks, comprising: One or more memories storing executable instructions; as well as One or more processors execute the executable instructions to implement the method according to any one of claims 1 to 4.

7. A computer-readable storage medium having executable instructions stored thereon, which, when executed by a processor, causes the processor to execute the method according to any one of claims 1 to 4.

8. A computer program, comprising computer executable instructions, wherein the instructions are used to implement the method according to any one of claims 1 to 4 when executed.

Images