Methods, devices, electronic equipment, and storage media for attack transfer

Abstract

This application proposes a method, apparatus, electronic device, and storage medium for attack transfer. By monitoring the network information of the target device, it determines whether there is a vulnerability attack in the network information. If a vulnerability attack is found, this application can reverse-connect to the sending end of the vulnerability attack based on the vulnerability attack, and then determine the vulnerability verification environment of the target honeypot. The attack content corresponding to the vulnerability verification environment is executed in the target honeypot to induce the sending end to believe that the attack target has been achieved. This method effectively improves the deceptiveness of the honeypot, making it difficult for attackers to detect the honeypot, thereby improving the protection effect of the honeypot.

Description

Technical Field

[0001] This application relates to the field of Internet technology, and in particular to a method, apparatus, electronic device, and storage medium for attack transfer. Background Technology

[0002] Honeypot systems are security services based on deception and camouflage techniques. They lure attackers into the honeypot by deploying traps along the critical paths of the attack, allowing them to launch attacks on the honeynet. Because the honeynet and the real internal network environment are independent of each other, it can effectively protect real assets.

[0003] However, current honeypot systems primarily rely on deploying numerous honeypot entry points along the critical paths of attacker intrusion. The number of honeypots deployed, along with the accompanying decoys, increases the probability of the honeypots being discovered by the attacker. However, this deployment method is easily detected by attackers, resulting in poor actual protection. Summary of the Invention

[0004] Based on the above requirements, this application proposes a method, apparatus, electronic device, and storage medium for attack transfer, in order to solve the problem of poor protection effect of honeypot systems in the prior art.

[0005] The technical solution proposed in this application is as follows:

[0006] On the one hand, this application provides a method for attack transfer, including:

[0007] By monitoring the network information of the target device, it is determined whether there are any vulnerabilities or attacks in the network information; the network information includes at least network traffic information and / or network log information.

[0008] If a vulnerability attack exists in the network information, a reverse link is established in the target honeypot to the sending end of the vulnerability attack, and the vulnerability verification environment of the sending end is detected based on the reverse link; the target honeypot is a honeypot whose vulnerability environment matches the vulnerability attack.

[0009] The attack content corresponding to the vulnerability verification environment is executed in the target honeypot.

[0010] Furthermore, in the methods described above, if the vulnerability verification environment is detected to be a probing environment, the attack content corresponding to the vulnerability verification environment is executed in the target honeypot, including:

[0011] Based on the reverse link, vulnerability information is fed back to the sending end. The vulnerability information is used to characterize the target device as having a specific vulnerability corresponding to the vulnerability attack.

[0012] Furthermore, in the methods described above, if the vulnerability verification environment is detected to be an attack environment, the attack content corresponding to the vulnerability verification environment is executed in the target honeypot, including:

[0013] If the first attack content is detected in the attack environment of the sending end, the first attack content is executed in the target honeypot to indicate that the attack target of the sending end has been achieved.

[0014] Furthermore, in the method described above, establishing a reverse link in the target honeypot to the sending end of the attack targeting the vulnerability includes:

[0015] The second attack content corresponding to the vulnerability attack is executed in the target honeypot so that after the second attack content is executed in the target honeypot, a back connection is made to the sending end of the vulnerability attack.

[0016] Furthermore, in the method described above, before executing the second attack content corresponding to the vulnerability attack in the target honeypot, it further includes:

[0017] The API interface of the target honeypot is invoked, and the vulnerability attack is transmitted to the target honeypot by passing parameters.

[0018] Furthermore, in the above-described method, monitoring the network information of the target device to determine whether there are vulnerability attacks in the network information includes:

[0019] The network information of the target device is matched with the set vulnerability attacks using regular expressions;

[0020] If the network information successfully matches the target vulnerability attack regular expression in the set vulnerability attack, then it is determined that the network information contains a vulnerability attack.

[0021] Furthermore, in the methods described above, the vulnerability attack includes JNDI injection type vulnerability attacks.

[0022] On the other hand, this application also provides an attack transfer device, comprising:

[0023] The determination module is used to determine whether there are vulnerability attacks in the network information by monitoring the network information of the target device; the network information includes at least network traffic information and / or network log information;

[0024] The reverse link module is used to establish a reverse link in the target honeypot targeting the sender of the vulnerability attack if a vulnerability attack exists in the network information, and to detect the vulnerability verification environment of the sender based on the reverse link; the target honeypot is a honeypot whose vulnerability environment matches the vulnerability attack.

[0025] The execution module is used to execute the attack content corresponding to the vulnerability verification environment in the target honeypot.

[0026] On the other hand, this application also provides an electronic device, including:

[0027] Memory and processor;

[0028] The memory is used to store programs;

[0029] The processor is configured to implement any of the above-described attack transfer methods by running a program in the memory.

[0030] On the other hand, this application also provides a storage medium storing a computer program, which, when executed by a processor, implements the various steps of the attack transfer method described in any of the above claims.

[0031] The attack transfer method proposed in this application monitors the network information of the target device to determine whether there is a vulnerability attack in the network information. If a vulnerability attack is found, this application can reverse-connect to the sending end of the vulnerability attack based on the vulnerability attack, and then determine the vulnerability verification environment of the target honeypot. The attack content corresponding to the vulnerability verification environment is executed in the target honeypot to induce the sending end to believe that the attack target has been achieved. This method effectively improves the deceptiveness of the honeypot, making it difficult for attackers to detect the honeypot, thereby improving the protection effect of the honeypot. Attached Figure Description

[0032] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of this application. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0033] Figure 1 This is a flowchart illustrating an attack transfer method provided in an embodiment of this application;

[0034] Figure 2 This is a schematic diagram of the process for monitoring network information provided in an embodiment of this application;

[0035] Figure 3 This is a signaling diagram of an attack transfer method provided in an embodiment of this application;

[0036] Figure 4 This is a schematic diagram of an attack transfer device provided in an embodiment of this application;

[0037] Figure 5 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0038] The technical solution of this application embodiment is applicable to application scenarios where network attacks are transferred to honeypots. By adopting the technical solution of this application embodiment, the deceptiveness of the honeypot can be improved, making it difficult for attackers to easily identify the honeypot, thereby improving the protection effect of the honeypot.

[0039] For example, the technical solutions of this application can be applied to hardware devices such as hardware processors, or packaged as software programs and run. When the hardware processor executes the processing procedure of the technical solutions of this application, or when the aforementioned software program is run, network attacks can be transferred to honeypots. This application only provides illustrative descriptions of the specific processing procedure of the technical solutions of this application, and does not limit the specific execution form of the technical solutions of this application. Any technical implementation form that can execute the processing procedure of the technical solutions of this application can be adopted by this application.

[0040] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0041] This embodiment proposes a method for attack redirection; see [link to relevant documentation]. Figure 1 As shown, the method includes:

[0042] S101. Monitor the network information of the target device.

[0043] The aforementioned target device refers to a device protected using honeypot technology. Those skilled in the art can set any device or system as the target device according to actual circumstances; this embodiment is not limited to this. Honeypot technology is a technique used to lure and deceive attackers. To obtain attack information from hackers and other attackers and to ensure the security of one's own system information, honeypots are typically deployed to lure attackers into the honeypot, thereby launching attacks against the honeynet. The honeynet and the real internal network environment are independent of each other, thus effectively protecting real business assets.

[0044] In the embodiments of this application, the network information of the target device can be monitored. The network information of the target device includes at least network traffic information and / or network log information.

[0045] Network traffic information mainly includes HTTP and HTTPS data. This HTTP and HTTPS data is parsed, and the parsed data primarily includes domain names or IP addresses. Then, feature detection is performed on the parsed data to determine if specific types of vulnerability attacks exist. Mirroring or reverse proxy modes can be used to monitor network traffic; this embodiment does not limit the specific methods.

[0046] Network log information mainly includes log files generated by the target device and other devices that interact with the target device in the network environment. It can also be used to detect the characteristics of network log information to determine whether there are specific types of vulnerability attacks.

[0047] Network traffic information can be monitored separately as network information of the target device; network log information can be monitored separately as network information of the target device; or both network traffic information and network log information can be monitored simultaneously as network information of the target device.

[0048] In addition, the network information of the target device may also include any other content that can record attack data, and this embodiment does not limit it.

[0049] S102. Determine whether there is a vulnerability attack in the network information; if there is a vulnerability attack in the network information, proceed to step S103; if there is no vulnerability attack in the network information, proceed to step S101.

[0050] In this embodiment, a vulnerability attack feature database is pre-set, containing attack features corresponding to various types of vulnerability attacks. After obtaining network information, the network information can be matched with the attack features of various vulnerability attacks in the vulnerability attack feature database. If it is determined that the attack features of a specific type of vulnerability attack in the vulnerability attack feature database match the network information, then it is determined that a vulnerability attack exists in the network information; if it is determined that the attack features of a specific type of vulnerability attack in the vulnerability attack feature database do not match the network information, then it is determined that no vulnerability attack exists in the network information. Furthermore, if it is determined that a vulnerability attack exists in the network information, the attack features of the vulnerability attack can be extracted from the network information.

[0051] Furthermore, a vulnerability attack detection model can be pre-set. After acquiring network information, the network information can be fed into this vulnerability attack detection model. The model then determines whether a vulnerability attack exists in the network information. If a vulnerability attack exists in the target device's network information, the attack characteristics of the vulnerability attack output by the vulnerability attack detection model can be further obtained. It should be noted that the vulnerability attack detection model can use the attack characteristics of various vulnerability attacks as training samples, and the types of various vulnerability attacks as training labels. The specific training process of the vulnerability attack detection model is the same as the model training method in the prior art, and those skilled in the art can refer to the prior art; it will not be elaborated here.

[0052] In the embodiments of this application, the vulnerability attack mainly refers to the JNDI injection type vulnerability attack.

[0053] Specifically, in this step, if a vulnerability attack is detected in the network information, step S103 is executed; if no vulnerability attack is detected in the network information, step S101 is executed to continuously monitor the network information of the target device.

[0054] It should also be noted that steps S101 and S102 can be executed in a network traffic monitoring system. Specifically, a network intrusion detection system or a proxy server can be used as the network traffic monitoring system.

[0055] S103. Establish a reverse link in the target honeypot to the sending end of the vulnerability attack, and detect the vulnerability verification environment of the sending end based on the reverse link.

[0056] In this embodiment, a large number of honeypots are pre-configured, including various types of vulnerable environments, to trigger attackers' exploit payloads, enabling attackers to gain access to the honeypots. The target honeypot refers to a honeypot whose vulnerable environment matches the vulnerability attack; that is, the target honeypot's vulnerable environment can trigger the aforementioned vulnerability attack payload.

[0057] If a vulnerability exists in the network information, the vulnerability attack can be sent to the target honeypot. A reverse link can be established in the target honeypot to target the sender of the vulnerability attack, so that the vulnerability verification environment of the sender can be detected based on the reverse link.

[0058] Sending a vulnerability attack to the target honeypot triggers the attack payload, which is then successfully executed within the honeypot. The target honeypot can then obtain a remote object via JNDI and reverse-connect to the vulnerability verification environment of the attacker's sending end, which is essentially the attacker's vulnerability verification environment.

[0059] In addition, a Trojan program for source tracing can be set up in the honeypot. After the vulnerability attack payload is successfully executed in the target honeypot, the Trojan program is used to establish a reverse connection to the sending end of the vulnerability attack and detect the vulnerability verification environment of the sending end of the vulnerability attack.

[0060] A vulnerability verification environment is an environment capable of characterizing an attacker's intent. The vulnerability verification environment described in this application includes at least two types: a probing environment and an attack environment.

[0061] If the vulnerability verification environment is a probing environment, such as a DNSLOG probing environment, it means that the attacker's purpose is to detect whether the target device has a specific vulnerability corresponding to the vulnerability attack, without any further network attack behavior. If the vulnerability verification environment is an attack environment, such as a real remote object environment, it means that the attacker's purpose is to launch a network attack on the target device based on the specific vulnerability corresponding to the vulnerability attack, such as obtaining server privileges of the target device.

[0062] S104. Execute the attack content corresponding to the vulnerability verification environment in the target honeypot.

[0063] In the embodiments of this application, after determining the vulnerability verification environment of the sending end, the attack content corresponding to the vulnerability verification environment can be executed in the target honeypot to induce the sending end to believe that the attack target has been achieved.

[0064] Specifically, if the vulnerability verification environment is a probe environment, and the target honeypot reverses its connection to the vulnerability verification environment of the sending end, the sending end will mistakenly believe that the target device has the specific vulnerability. In fact, the vulnerability attack is triggered and executed in the honeypot environment.

[0065] If the vulnerability verification environment is an attack environment, it is necessary to further obtain the payload corresponding to the network attack in the attack environment, and execute the payload corresponding to the network attack in the attack environment in the target honeypot. At this time, the sending end will mistakenly believe that the network attack target has been achieved.

[0066] It should also be noted that steps S103 and S104 can be executed in the target honeypot.

[0067] In the above embodiments, by monitoring the network information of the target device, it is determined whether there is a vulnerability attack in the network information. If it is determined that there is a vulnerability attack in the network information, this application can reverse-connect to the sending end of the vulnerability attack based on the vulnerability attack, and then determine the vulnerability verification environment of the target honeypot. The attack content corresponding to the vulnerability verification environment is executed in the target honeypot to induce the sending end to believe that the attack target has been achieved. This method effectively improves the deceptiveness of the honeypot, and attackers cannot easily identify the honeypot, thereby improving the protection effect of the honeypot.

[0068] As an optional implementation, another embodiment of this application discloses that if the vulnerability verification environment is detected to be a probe environment, the steps of the above embodiments, which involve executing the attack content corresponding to the vulnerability verification environment in the target honeypot, may specifically include the following steps:

[0069] Based on the reverse link, vulnerability information is fed back to the sending end. The vulnerability information is used to characterize the specific vulnerability corresponding to the vulnerability attack on the target device.

[0070] If the vulnerability verification environment of the sending end is detected to be a probe environment, it can be determined that the attacker's purpose is to probe whether the target device has a specific vulnerability corresponding to the vulnerability attack.

[0071] In this embodiment, after sending the vulnerability attack to the target honeypot, the attack payload is triggered and successfully executed within the honeypot. The target honeypot then obtains a remote object via JNDI and reverse-connects to the vulnerability verification environment of the attack sender. Based on this reverse connection, the target honeypot sends vulnerability information back to the sender, indicating that the target device possesses a specific vulnerability corresponding to the attack.

[0072] Specifically, the honeypot system uses protocols such as LDAP, RMI, and DNS to reverse-connect to the vulnerability verification environment of the sending end. At this time, the sending end mistakenly believes that the target business system has a specific vulnerability corresponding to the vulnerability attack. In fact, the vulnerability attack is triggered and executed in the honeypot environment, and the honeypot environment has a specific vulnerability corresponding to the attack characteristics.

[0073] In the above embodiments, by establishing a reverse link with the sending end, the sending end can be misled into believing that a specific vulnerability corresponding to a vulnerability attack exists in the target device, thus achieving the vulnerability attack. This setup enhances the deceptiveness of the honeypot, making it difficult for attackers to easily detect and thereby improving its protective effect.

[0074] As an optional implementation, another embodiment of this application discloses that if the vulnerability verification environment is detected to be an attack environment, the steps of the above embodiments execute the attack content corresponding to the vulnerability verification environment in the target honeypot, which may specifically include the following steps:

[0075] If the first attack content is detected in the attack environment of the sending end, the first attack content is executed in the target honeypot to indicate that the attack target of the sending end has been achieved.

[0076] If the vulnerability verification environment is detected to be an attack environment, then it is necessary to further detect the first attack content from the attack environment of the sending end. The first attack content includes the payload corresponding to the network attack in the attack environment, and trigger the target honeypot to execute the above first attack content, triggering the payload of the network attack. At this time, the sending end will mistakenly believe that the attack target of the network attack has been achieved.

[0077] For example, if the initial attack is to gain server privileges, a successful reverse connection to the target honeypot will trigger a network attack payload. The sending end can obtain shell privileges on the target honeypot and mistakenly believe it has obtained shell privileges on the target device. In reality, the sending end has obtained shell privileges on the target honeypot, thus entering the honeynet. Subsequent lateral movement attacks within the internal network are all executed within the honeynet, greatly increasing the deception for attackers and effectively protecting the real business system.

[0078] In the above embodiments, if the first attack content is detected in the attack environment of the sending end, the first attack content is executed in the target honeypot to induce the sending end to believe that the attack target has been achieved. This setting can improve the deceptiveness of the honeypot, making it difficult for attackers to detect, thereby improving the protection effect of the honeypot.

[0079] As an optional implementation, another embodiment of this application discloses that the steps of the above embodiments establish a reverse link in the target honeypot to the sending end of the vulnerability attack, which may specifically include the following steps:

[0080] The second attack content corresponding to the vulnerability attack is executed in the target honeypot, so that after the second attack content is executed in the target honeypot, a connection is made back to the sending end of the vulnerability attack.

[0081] In the embodiments of this application, after the vulnerability attack is sent to the target honeypot, the target honeypot can be triggered to execute the second attack content corresponding to the vulnerability attack, and the second attack content includes the payload of the vulnerability attack.

[0082] After the second attack is successfully executed in the target honeypot, the target honeypot can obtain the remote object via JNDI, thus accessing the vulnerability verification environment of the sender of the reverse connection attack—that is, the vulnerability verification environment of the reverse connection attacker. Since the vulnerability attack in this embodiment is a JNDI injection type attack, the reverse connection protocol in the attack characteristics is generally LDAP, RMI, DNS, or similar protocols.

[0083] In the above embodiments, the second attack content corresponding to the vulnerability attack is executed in the target honeypot, so that after the target honeypot executes the second attack content, it can connect back to the sending end of the vulnerability attack to achieve the purpose of detecting the vulnerability verification environment of the sending end.

[0084] As an optional implementation, another embodiment of this application discloses that, before executing the attack content corresponding to the vulnerability attack in the target honeypot in the steps of the above embodiments, the following steps may be included:

[0085] Call the target honeypot's API interface and pass the vulnerability attack to the target honeypot by passing parameters.

[0086] Specifically, in this embodiment, the vulnerability in the honeypot is triggered by an API call. After the vulnerability attack is extracted, the honeypot vulnerability environment API interface is called, and the vulnerability attack is passed to the target honeypot environment for execution by passing parameters.

[0087] In the above embodiments, the API interface of the target honeypot is called, and the vulnerability attack is transmitted to the target honeypot by passing parameters, so as to transmit the vulnerability attack to the target honeypot quickly and with high quality.

[0088] As an optional implementation method, such as Figure 2 As shown in another embodiment of this application, the steps of the above embodiments, by monitoring the network information of the target device to determine whether there is a vulnerability attack in the network information, may specifically include the following steps:

[0089] S201. Perform regular expression matching between the target device's network information and the set vulnerability attacks.

[0090] After obtaining network information, regular expression matching can be performed between the network information and the attack characteristics of various vulnerability attacks in the vulnerability attack feature database of the above embodiments to determine whether there are vulnerability attacks in the network information. Regular expression matching is a very mature existing technology, and those skilled in the art can refer to the existing technology for details. This embodiment will not elaborate on the specific content of regular expression matching.

[0091] S202. Determine whether the regular expression matching is successful; if the regular expression matching is successful, proceed to step S203; if the regular expression matching fails, repeat step S201.

[0092] If the regular expression match is successful, it can be confirmed that there is a vulnerability attack in the network information; if the regular expression match fails, it can be confirmed that there is no vulnerability attack in the network information. S201 can be executed again to continue to perform regular expression matching on the network information subsequently generated by the target device with the set vulnerability attack.

[0093] S203. Determine that the network information contains vulnerability attacks.

[0094] If the regular expression matches successfully, it confirms that there is a vulnerability attack in the network information.

[0095] It is also possible to extract the attack characteristics and targets of vulnerability attacks through regular expression matching.

[0096] In the above embodiments, regular expression matching can be used to quickly determine whether there are vulnerability attacks in network information, thereby improving the monitoring efficiency of network information.

[0097] This application also provides an application scenario in which the above-described attack transfer method is applied. Specifically, in conjunction with Figure 3 The application process of the network access method for this target device in this application scenario is as follows:

[0098] The network protection system includes a network traffic monitoring system and a honeypot system. The network traffic monitoring system acquires network information from the target device and performs regular expression matching between this information and the attack characteristics of various vulnerability attacks in a vulnerability attack signature database to determine if any vulnerability attacks exist within the network information.

[0099] If the network traffic monitoring system determines, through regular expression matching, that a vulnerability exists in the target device's network information, it calls the target honeypot's API interface to transmit the vulnerability attack to the target honeypot via parameters. The target honeypot is the honeypot within the honeypot system whose vulnerability environment matches the vulnerability attack.

[0100] After the target honeypot obtains the vulnerability attack, it is triggered to execute the vulnerability attack payload. Then, the target honeypot can obtain the remote object through JNDI and establish a reverse link to the sender of the vulnerability attack in the target honeypot. In turn, it reverse links to the vulnerability verification environment of the sender of the vulnerability attack to determine the specific type of vulnerability verification environment of the sender of the vulnerability attack.

[0101] If the vulnerability verification environment of the sending end of the vulnerability attack is a probing environment, when the honeypot system reverse-connects to the vulnerability verification environment of the sending end, it can send back vulnerability information to the sending end. This vulnerability information indicates that the target device has a specific vulnerability corresponding to the vulnerability attack. At this time, the sending end mistakenly believes that the target business system has a specific vulnerability corresponding to the vulnerability attack. In fact, the vulnerability attack is triggered and executed in the honeypot environment, and it is the honeypot environment that has a specific vulnerability corresponding to the attack characteristics.

[0102] If the vulnerability verification environment of the sending end of the vulnerability attack is an attack environment, it can obtain the payload in the vulnerability verification environment and further trigger the target honeypot to execute the payload in the vulnerability verification environment. The sending end then considers the attack on the target device to be successful. The sending end has actually entered the honeynet, and subsequent lateral movement attacks on the internal network are all executed within the honeynet, greatly increasing the deception for attackers and effectively protecting the real business system.

[0103] Corresponding to the attack transfer method described above, this application also discloses an attack transfer apparatus, see [link to relevant documentation]. Figure 4 As shown, the device includes:

[0104] The determination module 100 is used to determine whether there are vulnerability attacks in the network information by monitoring the network information of the target device; the network information includes at least network traffic information and / or network log information;

[0105] The reverse link module 110 is used to establish a reverse link to the sending end of the vulnerability attack in the target honeypot if there is a vulnerability attack in the network information, and to detect the vulnerability verification environment of the sending end based on the reverse link; the target honeypot is a honeypot that matches the vulnerability environment and the vulnerability attack.

[0106] Execution module 120 is used to execute the attack content corresponding to the vulnerability verification environment in the target honeypot.

[0107] In the attack transfer device of the above embodiments, the determining module 100 monitors the network information of the target device to determine whether there is a vulnerability attack in the network information. If a vulnerability attack is determined to exist in the network information, the reverse linking module 110 can reverse link to the sending end of the vulnerability attack based on the vulnerability attack, and then determine the vulnerability verification environment of the target honeypot. The execution module 120 executes the attack content corresponding to the vulnerability verification environment in the target honeypot to induce the sending end to believe that the attack target has been achieved. This method effectively improves the deceptiveness of the honeypot, and attackers cannot easily identify the honeypot, thereby improving the protection effect of the honeypot.

[0108] As an optional implementation, another embodiment of this application discloses that the execution module 120 includes:

[0109] The first execution unit is used to, if the vulnerability verification environment is detected to be a probe environment, send vulnerability information back to the sending end based on a reverse link. The vulnerability information is used to characterize the specific vulnerability corresponding to the vulnerability attack on the target device.

[0110] As an optional implementation, another embodiment of this application discloses that the execution module 120 includes:

[0111] The second execution unit is used to execute the first attack content in the target honeypot if the vulnerability verification environment is detected to be an attack environment and the first attack content is detected from the attack environment of the sending end, so as to indicate that the attack target of the sending end has been achieved.

[0112] As an optional implementation, another embodiment of this application discloses that the reverse link module 110 includes:

[0113] The execution unit is used to execute the second attack content corresponding to the vulnerability attack in the target honeypot, so that after the second attack content is executed in the target honeypot, it can return to the sending end of the vulnerability attack.

[0114] As an optional implementation, another embodiment of this application discloses that the reverse link module 110 includes:

[0115] The sending unit is used to call the API interface of the target honeypot and transmit the vulnerability attack to the target honeypot by passing parameters.

[0116] As an optional implementation, another embodiment of this application discloses a determining module 100, comprising:

[0117] The matching unit is used to perform regular expression matching between the network information of the target device and the set vulnerability attacks;

[0118] The determining unit is used to determine that the network information contains a vulnerability attack if the network information successfully matches the target vulnerability attack regular expression in the set vulnerability attack.

[0119] As an optional implementation, another embodiment of this application discloses that the vulnerability attack includes a JNDI injection type vulnerability attack.

[0120] For details on the specific operation of each unit of the aforementioned attack transfer device, please refer to the above method embodiments; they will not be repeated here.

[0121] Corresponding to the above-described attack diversion method, this application also discloses an electronic device, see [link to relevant documentation]. Figure 5 As shown, the electronic device includes:

[0122] Memory 200 and processor 210;

[0123] The memory 200 is connected to the processor 210 and is used to store programs;

[0124] Processor 210 is configured to implement the attack transfer method disclosed in any of the above embodiments by running a program stored in memory 200.

[0125] Specifically, the aforementioned electronic device may also include: a bus, a communication interface 220, an input device 230, and an output device 240.

[0126] The processor 210, memory 200, communication interface 220, input device 230, and output device 240 are interconnected via a bus. Among them:

[0127] A bus can include a pathway for transmitting information between various components of a computer system.

[0128] The processor 210 can be a general-purpose processor, such as a general-purpose central processing unit (CPU), a microprocessor, etc., or an application-specific integrated circuit (ASIC), or one or more integrated circuits used to control the execution of the program of the present application. It can also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), an off-the-shelf programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components.

[0129] Processor 210 may include a main processor, as well as a baseband chip, modem, etc.

[0130] The memory 200 stores a program for executing the technical solution of this application, and may also store an operating system and other critical business functions. Specifically, the program may include program code, which includes computer operation instructions. More specifically, the memory 200 may include read-only memory (ROM), other types of static storage devices capable of storing static information and instructions, random access memory (RAM), other types of dynamic storage devices capable of storing information and instructions, disk storage, flash memory, etc.

[0131] Input device 230 may include a device for receiving user input data and information, such as a keyboard, mouse, camera, scanner, light pen, voice input device, touch screen, pedometer, or gravity sensor.

[0132] Output device 240 may include devices that allow information to be output to a user, such as a display screen, printer, speaker, etc.

[0133] The communication interface 220 may include a device that uses any transceiver to communicate with other devices or communication networks, such as Ethernet, Radio Access Network (RAN), Wireless Local Area Network (WLAN), etc.

[0134] The processor 210 executes the program stored in the memory 200 and calls other devices, which can be used to implement the various steps of the attack transfer method provided in the above embodiments of this application.

[0135] In addition to the methods and devices described above, embodiments of this application may also be computer program products, which include computer program instructions that, when executed by processor 210, cause processor 210 to perform the various steps of the attack transfer method provided in the above embodiments.

[0136] Computer program products can be written in any combination of one or more programming languages ​​to perform the operations of the embodiments of this application. The programming languages ​​include object-oriented programming languages ​​such as Java and C++, as well as conventional procedural programming languages ​​such as C or similar languages. The program code can be executed entirely on the user's computing device, partially on the user's computing device, as a standalone software package, partially on the user's computing device and partially on a remote computing device, or entirely on a remote computing device or server.

[0137] Furthermore, embodiments of this application may also be computer-readable storage media storing computer program instructions thereon, which, when executed by a processor, cause the processor 210 to perform the various steps of the attack transfer method provided in the above embodiments.

[0138] The computer-readable storage medium may be any combination of one or more readable media. A readable medium may be a readable signal medium or a readable storage medium. A readable storage medium may, for example, include, but is not limited to, electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatuses, or devices, or any combination thereof. More specific examples of readable storage media (a non-exhaustive list) include: electrical connections having one or more wires, portable disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fibers, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof.

[0139] For the foregoing method embodiments, in order to simplify the description, they are all described as a series of actions. However, those skilled in the art should understand that this application is not limited to the described order of actions, because according to this application, some steps can be performed in other orders or simultaneously. Furthermore, those skilled in the art should also understand that the embodiments described in the specification are all preferred embodiments, and the actions and modules involved are not necessarily essential to this application.

[0140] It should be noted that the various embodiments in this specification are described in a progressive manner, with each embodiment focusing on the differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For apparatus embodiments, since they are basically similar to method embodiments, the description is relatively simple; relevant parts can be referred to the descriptions in the method embodiments.

[0141] The steps in the methods of the various embodiments of this application can be adjusted, merged, or deleted in order according to actual needs, and the technical features described in each embodiment can be replaced or combined.

[0142] The modules and sub-modules in the various embodiments of the present application's devices and terminals can be merged, divided, and deleted according to actual needs.

[0143] It should be understood that the disclosed terminals, devices, and methods can be implemented in other ways, given the several embodiments provided in this application. For example, the terminal embodiments described above are merely illustrative. For instance, the division of modules or sub-modules is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple sub-modules or modules may be combined or integrated into another module, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be indirect coupling or communication connection through some interfaces, devices, or modules, and may be electrical, mechanical, or other forms.

[0144] The modules or submodules described as separate components may or may not be physically separate. The components that constitute a module or submodule may or may not be physical modules or submodules; that is, they may be located in one place or distributed across multiple network modules or submodules. Some or all of the modules or submodules can be selected to achieve the purpose of this embodiment's solution, depending on actual needs.

[0145] Furthermore, the functional modules or sub-modules in the various embodiments of this application can be integrated into one processing module, or each module or sub-module can exist physically separately, or two or more modules or sub-modules can be integrated into one module. The integrated modules or sub-modules described above can be implemented in hardware or in the form of software functional modules or sub-modules.

[0146] Those skilled in the art will further recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0147] The steps of the methods or algorithms described in conjunction with the embodiments disclosed herein can be implemented directly by hardware, a software unit executed by a processor, or a combination of both. The software unit can be located in random access memory (RAM), main memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disk, removable disk, CD-ROM, or any other form of storage medium known in the art.

[0148] Finally, it should be noted that in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0149] The above description of the disclosed embodiments enables those skilled in the art to make or use this application. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of this application. Therefore, this application is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A method for attack transfer, characterized in that, include: By monitoring the network information of the target device, it can be determined whether there are any vulnerability attacks in the network information; The network information includes at least network traffic information and / or network log information; If a vulnerability attack exists in the network information, the second attack content corresponding to the vulnerability attack is executed in the target honeypot. After the target honeypot executes the second attack content, it obtains a remote object via JNDI, reverse-connects to the sending end of the vulnerability attack, obtains a reverse link to the sending end of the vulnerability attack, and detects the vulnerability verification environment of the sending end based on the reverse link. The target honeypot is a honeypot whose vulnerability environment matches the vulnerability attack. The vulnerability verification environment is an environment that characterizes the attacker's attack intent, including at least a probing environment and an attack environment. The attack content corresponding to the vulnerability verification environment is executed in the target honeypot.

2. The method according to claim 1, characterized in that, If the vulnerability verification environment is detected to be a probe environment, the attack content corresponding to the vulnerability verification environment is executed in the target honeypot, including: Based on the reverse link, vulnerability information is fed back to the sending end. The vulnerability information is used to characterize the target device as having a specific vulnerability corresponding to the vulnerability attack.

3. The method according to claim 1, characterized in that, If the vulnerability verification environment is detected to be an attack environment, the attack content corresponding to the vulnerability verification environment is executed in the target honeypot, including: If the first attack content is detected in the attack environment of the sending end, the first attack content is executed in the target honeypot to indicate that the attack target of the sending end has been achieved.

4. The method according to claim 1, characterized in that, Before executing the second attack content corresponding to the vulnerability attack in the target honeypot, the method further includes: The API interface of the target honeypot is invoked, and the vulnerability attack is transmitted to the target honeypot by passing parameters.

5. The method according to claim 1, characterized in that, By monitoring the network information of the target device, it is determined whether there are any vulnerabilities in the network information, including: The network information of the target device is matched with the set vulnerability attacks using regular expressions; If the network information successfully matches the target vulnerability attack regular expression in the set vulnerability attack, then it is determined that the network information contains a vulnerability attack.

6. The method according to claim 1, characterized in that, The vulnerability attacks include JNDI injection type attacks.

7. An attack transfer device, characterized in that, include: The determination module is used to determine whether there are vulnerability attacks in the network information by monitoring the network information of the target device; The network information includes at least network traffic information and / or network log information; The reverse link module is used to execute the second attack content corresponding to the vulnerability attack in the target honeypot if a vulnerability attack exists in the network information. After the target honeypot executes the second attack content, it obtains a remote object via JNDI, reverse links to the sending end of the vulnerability attack, obtains a reverse link to the sending end of the vulnerability attack, and detects the vulnerability verification environment of the sending end based on the reverse link. The target honeypot is a honeypot whose vulnerability environment matches the vulnerability attack. The vulnerability verification environment is an environment that characterizes the attacker's attack intent, including at least a probing environment and an attack environment. The execution module is used to execute the attack content corresponding to the vulnerability verification environment in the target honeypot.

8. An electronic device, characterized in that, include: Memory and processor; The memory is used to store programs; The processor is configured to implement the attack transfer method as described in any one of claims 1 to 6 by running a program in the memory.

9. A storage medium, characterized in that, include: The storage medium stores a computer program, which, when executed by a processor, implements the steps of the attack transfer method as described in any one of claims 1 to 6.

Images