A honeypot attack tracing method, device, equipment, and storage medium

Abstract

The present application discloses a honeypot attack source tracing method, device, equipment, and storage medium, which relates to the field of network security technology, including: when monitoring that a terminal with a pseudo-service installed receives attack traffic sent by an attacker, capturing the attacker's MAC information; judging whether the terminal has a honeypot service; if the terminal does not have a honeypot service, generating alarm data and disconnecting the connection with the attacker; if the terminal has a honeypot service, forwarding the attack traffic to the corresponding honeypot service port based on the correspondence between the honeypot service port and the local service port, so that the honeypot service port sends part of the attacker information including the attacker's IP information to the honeypot center platform, and integrates the MAC information with part of the attacker information to generate complete attacker information. Use terminal pseudo-service to trigger the honeypot alarm, thereby increasing the probability of honeypot alarm; capture the MAC address by packet capture matching, and match and trace it back to the real attacker.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a honeypot attack tracing method, device, equipment, and storage medium. Background Art

[0002] There are more and more attacks on the Internet. Honeypots can be used to collect attack methods and vulnerabilities and detect vulnerabilities in business systems. The use of honeypots is becoming more and more diverse. Honeypots play a very important role in understanding the attack tools and methods of attackers, and can effectively improve security protection capabilities. The induction conditions of honeypots are harsh. In common honeypot deployment schemes, the induction rate of honeypots is extremely low. The method of using terminal pseudo-service traffic proxy can proxy all TCP (Transmission Control Protocol) / UDP (User Datagram Protocol) traffic, but the attackers alarmed by the honeypot are all identified as terminals, which will lose the real attacker information. Some solutions will encapsulate the terminal traffic when forwarding it, so that the honeypot can obtain the attacker's IP and port information, but still cannot obtain the attacker's MAC address. In the prior art, the induction rate of honeypots is often extremely low. Based on the simple pseudo-service traffic forwarding method, the honeypot cannot trace the real attacker information, let alone obtain the attacker's MAC address. For some existing related solutions, terminal traffic is packaged with attacker information. This solution makes a lot of changes to the honeypot, requiring traffic forwarders and traffic receivers. The honeypot also needs to distinguish between forwarded traffic and real traffic. Alarm storage also needs to be distinguished.

[0003] In summary, how to improve the probability of honeypot induction, determine the attacker's detailed information without changing the underlying code of the honeypot, and determine the attacker's identity are technical problems that need to be solved in this field. Summary of the invention

[0004] In view of this, the purpose of the present invention is to provide a honeypot attack tracing method, device, equipment, and storage medium, which can improve the probability of honeypot induction, determine the attacker's detailed information and the attacker's identity without changing the honeypot's underlying code. The specific scheme is as follows:

[0005] In a first aspect, the present application discloses a method for tracing the source of a honeypot attack, comprising:

[0006] When the terminal with the fake service installed receives attack traffic sent by the attacker, the attacker's MAC information is captured;

[0007] Determine whether a honeypot service exists on the terminal;

[0008] If the terminal does not have a honeypot service, an alarm data is generated and the connection with the attacker is disconnected;

[0009] If a honeypot service exists on the terminal, the attack traffic will be forwarded to the corresponding honeypot service port based on the correspondence between the honeypot service port and the local service port, so that the honeypot service port will send part of the attacker information including the attacker's IP information to the honeypot center platform, and integrate the MAC information with the part of the attacker information to generate complete attacker information.

[0010] Optionally, when it is monitored that the terminal installing the fake service receives attack traffic sent by the attacker, before capturing the attacker's MAC information, the method further includes:

[0011] A fake service is pre-installed on the terminal, and the fake service is dynamically enabled to receive traffic attacks initiated by the attacker.

[0012] Optionally, when monitoring that the terminal installing the fake service receives attack traffic sent by the attacker, capturing the attacker's MAC information includes:

[0013] When it is detected that the terminal with the fake service installed receives the attack traffic sent by the attacker, the attacker's MAC information is captured through libpcap.

[0014] Optionally, when it is detected that the terminal installing the fake service receives attack traffic sent by the attacker, capturing the attacker's MAC information through libpcap includes:

[0015] When it is detected that the terminal with the fake service installed receives the attack traffic sent by the attacker, libpcap is used to perform handshake and wave packet capture operations on the local service port to capture the attacker's MAC information.

[0016] Optionally, if the terminal has a honeypot service, forwarding the attack traffic to the corresponding honeypot service port based on the correspondence between the honeypot service port and the local service port includes:

[0017] If the terminal has a honeypot service, determine the local service port attacked by the attack traffic, and determine the corresponding honeypot service port from the relationship list based on the corresponding relationship between the honeypot service port and the local service port;

[0018] The attack traffic is forwarded to the corresponding honeypot service port.

[0019] Optionally, before determining the local service port attacked by the attack traffic and determining the corresponding honeypot service port from the relationship list based on the correspondence between the honeypot service port and the local service port, the method further includes:

[0020] Pre-bind the local service port and the corresponding honeypot service port to generate a corresponding relationship list.

[0021] Optionally, integrating the MAC information with the partial attacker information to generate complete attacker information includes:

[0022] Upload the MAC information to the honeypot center platform;

[0023] When partial attacker information is received, the corresponding MAC information is integrated with the partial attacker information to generate complete attacker information.

[0024] In a second aspect, the present application discloses a honeypot attack source tracing device, comprising:

[0025] The information capture module is used to capture the attacker's MAC information when it is detected that the terminal with the fake service installed receives the attack traffic sent by the attacker;

[0026] A service determination module, used to determine whether the terminal has a honeypot service;

[0027] A connection disconnection module, used for generating alarm data and disconnecting the connection with the attacker if the honeypot service does not exist on the terminal;

[0028] An information generation module is used to forward the attack traffic to the corresponding honeypot service port based on the correspondence between the honeypot service port and the local service port if the terminal has a honeypot service, so that the honeypot service port can send part of the attacker information including the attacker's IP information to the honeypot center platform, and integrate the MAC information with the part of the attacker information to generate complete attacker information.

[0029] In a third aspect, the present application discloses an electronic device, comprising:

[0030] Memory, used to store computer programs;

[0031] The processor is used to execute the computer program to implement the steps of the aforementioned disclosed honeypot attack tracing method.

[0032] In a fourth aspect, the present application discloses a computer-readable storage medium for storing a computer program; wherein, when the computer program is executed by a processor, the steps of the aforementioned disclosed honeypot attack tracing method are implemented.

[0033] It can be seen that the present application discloses a honeypot attack tracing method, including: when it is monitored that the terminal with the pseudo service installed receives the attack traffic sent by the attacker, the attacker's MAC information is captured; it is determined whether the terminal has a honeypot service; if the terminal does not have a honeypot service, alarm data is generated and the connection with the attacker is disconnected; if the terminal has a honeypot service, the attack traffic is forwarded to the corresponding honeypot service port based on the corresponding relationship between the honeypot service port and the local service port, so that the honeypot service port sends part of the attacker information including the attacker's IP information to the honeypot center platform, and integrates the MAC information with the part of the attacker information to generate complete attacker information. It can be seen that by using the terminal pseudo service method, all nodes with pseudo services enabled can trigger the honeypot alarm and increase the honeypot alarm probability; by capturing the MAC address through packet matching, and receiving the alarm tracing information on the honeypot center platform, matching and adding the attack tracing information when the alarm is stored can trace the real attacker, and when there is no honeypot service, illegal port sniffing can also be found and disconnected in time. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying creative work.

[0035] Figure 1 A flow chart of a honeypot attack tracing method disclosed in this application;

[0036] Figure 2 A flow chart of an alarm storage method disclosed in this application;

[0037] Figure 3 A specific flow chart of the honeypot attack tracing method disclosed in this application;

[0038] Figure 4 This is a schematic diagram of the structure of a honeypot attack tracing device disclosed in this application;

[0039] Figure 5 This is a structural diagram of an electronic device disclosed in this application. DETAILED DESCRIPTION

[0040] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

[0041] There are more and more attacks on the Internet. Honeypots can be used to collect attack methods and vulnerabilities and detect vulnerabilities in business systems. The use of honeypots is becoming more and more diverse. Honeypots play a very important role in understanding the attack tools and methods of attackers, and can effectively improve security protection capabilities. The induction conditions of honeypots are harsh. In common honeypot deployment schemes, the induction rate of honeypots is extremely low. The method of using terminal pseudo-service traffic proxy can proxy all TCP (Transmission Control Protocol) / UDP (User Datagram Protocol) traffic, but the attackers alarmed by the honeypot are all identified as terminals, which will lose the real attacker information. Some solutions will encapsulate the terminal traffic when forwarding it, so that the honeypot can obtain the attacker's IP and port information, but still cannot obtain the attacker's MAC address. In the prior art, the induction rate of honeypots is often extremely low. Based on the simple pseudo-service traffic forwarding method, the honeypot cannot trace the real attacker information, let alone obtain the attacker's MAC address. For some existing related solutions, terminal traffic is packaged with attacker information. This solution makes a lot of changes to the honeypot, requiring traffic forwarders and traffic receivers. The honeypot also needs to distinguish between forwarded traffic and real traffic. Alarm storage also needs to be distinguished.

[0042] To this end, the present application provides a honeypot attack tracing solution, which can increase the probability of honeypot induction, determine the attacker's detailed information and identify the attacker without changing the underlying code of the honeypot.

[0043] Reference Figure 1 As shown, an embodiment of the present invention discloses a honeypot attack source tracing method, comprising:

[0044] Step S11: When it is detected that the terminal installing the fake service receives attack traffic sent by the attacker, the MAC information of the attacker is captured.

[0045] In this embodiment, it can be understood that the terminal with the pseudo service installed is monitored, wherein the terminal is specifically installed on the customer's business host, simulating a service port to forward traffic to the honeypot. The pseudo service is specifically a port developed by the terminal program, which does not provide services, but only provides alarm functions and traffic forwarding functions. If it is monitored that the terminal receives attack traffic sent by the attacker, the attacker's MAC address information is immediately captured.

[0046] In this embodiment, when it is detected that the terminal with the pseudo service installed receives the attack traffic sent by the attacker, the MAC information of the attacker is captured through libpcap. It can be understood that the MAC information of the attacker is captured through libpcapp (packet capture library), wherein the libpcap is a network packet capture library under the Unix / Linux platform. It is a packet capture API interface independent of the user layer of the system, which provides a portable framework for underlying network monitoring. libpcap mainly consists of two parts: a network tap and a data filter. The network tap collects data from the network device driver for copying, and the filter decides whether to receive the data packet. libpcap uses the BSD packet filter (BPF) algorithm to filter the link layer data packets received by the network card. The basic idea of ​​the BPF algorithm is that in a network with BPF monitoring, the network card driver copies a copy of the received data packet and gives it to the BPF filter. The filter decides whether to receive this data packet and what content of the data packet needs to be copied according to the rules defined by the user, and then gives the filtered data to the upper layer application associated with the filter. The packet capture mechanism of libpcap is to add a bypass process at the data link layer. When a data packet arrives at the network interface, libpcap first uses the created socket to obtain a copy of the data packet from the link layer driver, and then sends the data packet to the BPF filter through the Tap function. The BPF filter matches the data packets one by one according to the filter rules defined by the user. If the match is successful, it is placed in the kernel buffer and passed to the user buffer. If the match fails, it is directly discarded. If no filter rules are set, all data packets will be placed in the kernel buffer and passed to the user layer buffer.

[0047] In this embodiment, when it is detected that the terminal with the pseudo service installed receives the attack traffic sent by the attacker, the local service port is handshaked and waved by libpcap to capture the MAC information of the attacker. It can be understood that the interface (network card) to be sniffed is first defined. On the Linux platform, it may be eth0, etc., and on the BSD platform, it may be xl1, etc. You can also define the interface yourself with a string, or you can ask libpcap to provide the name of the interface; the next step is to initialize libpcap, which is also to tell libpcap which interface to sniff. Multiple interfaces can be sniffed and distinguished using handles. Just like opening a file for writing or reading, the "session" to be sniffed must be named to distinguish it from other similar sessions. If you want to sniff specific packets, such as TCP / IP packets, packets sent to port 23, etc., you need to create a filter. The process of creating a filter has a total of three steps. First, the rule set is placed in a string, then the string is compiled to obtain a readable form of libpcap, and finally this readable form is applied to filter to obtain the desired data packet. After the above three steps, libpcap can be told to execute the packet capture process. During this phase, libpcap keeps working until it has received all the packets it wants. After the sniffing is complete, the session is finally closed to end the process.

[0048] Step S12: Determine whether the terminal has a honeypot service.

[0049] In this embodiment, since the honeypot platform is relatively heavy and not all customers have honeypot services, it is necessary to determine whether the customer has honeypot services to obtain relevant determination results and select corresponding operations based on the determination results.

[0050] Step S13: If the terminal does not have a honeypot service, alarm data is generated and the connection with the attacker is disconnected.

[0051] In this embodiment, if the terminal does not have a honeypot service, that is, the judgment result is that the client is not equipped with a honeypot service, alarm data is generated and the connection with the attacker is disconnected. It is understandable that since the client terminal provides a pseudo-service function, but since the terminal does not have a honeypot service, it is impossible to forward the attack traffic, so the alarm function of the pseudo-service is directly used to generate alarm data and disconnect the connection with the attacker, that is, for the scenario without a honeypot platform, a microservice function is provided, which can solve illegal service sniffing, so that the attacker cannot find the real service and expose himself in advance.

[0052] Step S14: If the terminal has a honeypot service, the attack traffic is forwarded to the corresponding honeypot service port based on the correspondence between the honeypot service port and the local service port, so that the honeypot service port sends part of the attacker information including the attacker's IP information to the honeypot center platform, and integrates the MAC information with the part of the attacker information to generate complete attacker information.

[0053] In this embodiment, if the terminal has a honeypot service, that is, the judgment result is that the client is equipped with a honeypot service, then the attack traffic is forwarded to the corresponding honeypot service port based on the correspondence between the honeypot service port and the local service port. It can be understood that according to the correspondence between the local service port and the honeypot service port, all TCP / UDP traffic proxied by the terminal using the pseudo service traffic agent is forwarded to the corresponding honeypot service port. For example, when the attack traffic attacks the local service MySQL, the terminal pseudo service immediately forwards the attack traffic to the honeypot service MySQL port according to the correspondence between the local service MySQL port and the honeypot service MySQL port, so that the honeypot service MySQL port obtains part of the attacker information of the attack traffic, and sends part of the attacker information to the honeypot center platform, and integrates the MAC information with the part of the attacker information to generate complete attacker information. Among them, the part of the attacker information obtained by the honeypot service can specifically include but is not limited to the attacker's IP layer data information. It should be noted that the storage of alarms on the honeypot center platform is divided into two steps: after the honeypot triggers an alarm, the alarm information is sent to the honeypot center platform; the honeypot center platform compares the alarm information of the honeypot with the uploaded attack chain information, completes the entire attack chain, and obtains the relevant information of the attacker in order to use the relevant information to complete the attack tracing activities. It can be seen that the method of using the terminal service traffic proxy makes all nodes with installed terminals become honeypots. The method for terminal service traffic proxy can only obtain data information at the IP layer. This embodiment traces the attack by capturing packets, and can accurately obtain the MAC, IP, and port information of all attackers. Upload all attack chains to the honeypot center platform and combine them with the honeypot attack alarm to complete the attack tracing. Refer to Figure 2As shown, after the attacker sends a connection request to the terminal pseudo-service, that is, when the terminal pseudo-service receives the attack traffic, libpcap is used to capture packets in real time to obtain the attacker's MAC information, and it is determined whether the terminal has a honeypot service at this time. If there is no honeypot service, the corresponding alarm data is directly generated, the alarm function of the pseudo-service is directly used to issue an alarm, and the connection with the attacker is disconnected; if there is a honeypot service, the terminal pseudo-service directly sends the connection request to the corresponding honeypot service port, so that the honeypot service port responds to the connection request, and forwards the response information to the attacker through the terminal pseudo-service to entrap the attacker. At the same time, the honeypot service port also obtains part of the attacker's attack information, so as to integrate it with other information about the attacker uploaded by the terminal to determine the attacker's detailed information.

[0054] It can be seen that the present application discloses a honeypot attack tracing method, including: when it is monitored that the terminal with the pseudo service installed receives the attack traffic sent by the attacker, the attacker's MAC information is captured; it is determined whether the terminal has a honeypot service; if the terminal does not have a honeypot service, alarm data is generated and the connection with the attacker is disconnected; if the terminal has a honeypot service, the attack traffic is forwarded to the corresponding honeypot service port based on the corresponding relationship between the honeypot service port and the local service port, so that the honeypot service port sends part of the attacker information including the attacker's IP information to the honeypot center platform, and integrates the MAC information with the part of the attacker information to generate complete attacker information. It can be seen that by using the terminal pseudo service method, all nodes with pseudo services enabled can trigger the honeypot alarm and increase the honeypot alarm probability; by capturing the MAC address through packet matching, and receiving the alarm tracing information on the honeypot center platform, matching and adding the attack tracing information when the alarm is stored can trace the real attacker, and when there is no honeypot service, illegal port sniffing can also be found and disconnected in time.

[0055] Reference Figure 3 As shown, the embodiment of the present invention discloses a specific honeypot attack source tracing method. Compared with the previous embodiment, this embodiment further illustrates and optimizes the technical solution. Specifically:

[0056] Step S21: pre-bind the local service port and the corresponding honeypot service port to generate a corresponding relationship list.

[0057] In this embodiment, the local service port and the corresponding honeypot service port are pre-bound to generate a corresponding relationship list, for example: the local DNS service port and the corresponding honeypot DNS service port, the local HTTP service port and the honeypot HTTP service port, the local HTTPS service port and the honeypot HTTPS service port are pre-bound to generate a related relationship list.

[0058] Step S22: When it is detected that the terminal on which the fake service is installed receives attack traffic sent by the attacker, the MAC information of the attacker is captured.

[0059] In this embodiment, before detecting that the terminal with the pseudo service installed receives the attack traffic sent by the attacker, the address of the honeypot center platform is obtained, a list of relationships between the local service port and the honeypot service port is obtained, the terminal determines the open port of the local pseudo service, and uses libpcap to capture the handshake and wave information of the local pseudo service port, only capturing the handshake and wave information, and dynamically maintaining the connection information cache of the pseudo service. Then the terminal dynamically opens the pseudo service and waits for the attacker to attack.

[0060] Step S23: Determine whether the terminal has a honeypot service.

[0061] For a more detailed processing procedure in step S23, please refer to the aforementioned disclosed embodiment content, which will not be repeated here.

[0062] Step S24: If the terminal has a honeypot service, determine the local service port attacked by the attack traffic, and determine the corresponding honeypot service port from the relationship list based on the correspondence between the honeypot service port and the local service port; forward the attack traffic to the corresponding honeypot service port, so that the honeypot service port can send part of the attacker information including the attacker's IP information to the honeypot center platform.

[0063] In this embodiment, if a honeypot service exists on the terminal, the terminal first binds the local connection port with the honeypot to determine the local service port, and then determines the corresponding honeypot service port based on the local service port and the correspondence between all local service ports and the honeypot service port in the relationship list, and forwards the attack traffic to the honeypot service port so that the honeypot service port can send part of the attacker information including the attacker's IP information to the honeypot center platform.

[0064] Step S25: Upload the MAC information to the honeypot center platform; when receiving partial attacker information, integrate the corresponding MAC information with the partial attacker information to generate complete attacker information.

[0065] In this embodiment, the terminal uploads the attack tracing link information, including the attacker's MAC, IP, port, and the MAC, IP, and port of the terminal connected to the attacker to the honeypot center platform, where the attacker's MAC address information and other attack information are completed by libpcap packet capture; then the terminal forwards the traffic to the honeypot, including the MAC, IP, and port, and the MAC, IP, and port information of the corresponding service honeypot are uploaded again to the honeypot center platform, and the attacker's traffic and the honeypot traffic are forwarded by proxy. Finally, after completing the information upload and traffic forwarding, the connection is disconnected and the connection session disconnection information is sent. It can be seen that the real attacker can be traced back by packet capture matching.

[0066] It can be seen that compared with other attack tracing methods that require complex adjustments to traffic unpacking and component configuration, the terminal pseudo-service in this embodiment does not need to unpack or assemble traffic, nor does it require hardware or gateway configuration. It only requires a simple traffic proxy, which makes little change to the existing honeypot center platform function and achieves great value. In addition, all attack details, including MAC addresses, can be obtained through the attack information acquisition method of this embodiment. The honeypot center platform clearly obtains detailed attack links before the alarm is stored in the database. The implementation method is simple, and illegal port sniffing can also be found in the absence of a honeypot platform.

[0067] Reference Figure 4 As shown, the embodiment of the present invention discloses a specific honeypot attack source tracing device, including:

[0068] The information capture module 11 is used to capture the MAC information of the attacker when it is detected that the terminal installing the fake service receives the attack traffic sent by the attacker;

[0069] A service determination module 12 is used to determine whether the terminal has a honeypot service;

[0070] A connection disconnection module 13, configured to generate alarm data and disconnect the connection with the attacker if the honeypot service does not exist on the terminal;

[0071] The information generation module 14 is used to forward the attack traffic to the corresponding honeypot service port based on the correspondence between the honeypot service port and the local service port if the terminal has a honeypot service, so that the honeypot service port can send part of the attacker information including the attacker's IP information to the honeypot center platform, and integrate the MAC information with the part of the attacker information to generate complete attacker information.

[0072] It can be seen that the present application discloses a honeypot attack tracing method, including: when it is monitored that the terminal with the pseudo service installed receives the attack traffic sent by the attacker, the attacker's MAC information is captured; it is determined whether the terminal has a honeypot service; if the terminal does not have a honeypot service, alarm data is generated and the connection with the attacker is disconnected; if the terminal has a honeypot service, the attack traffic is forwarded to the corresponding honeypot service port based on the corresponding relationship between the honeypot service port and the local service port, so that the honeypot service port sends part of the attacker information including the attacker's IP information to the honeypot center platform, and integrates the MAC information with the part of the attacker information to generate complete attacker information. It can be seen that by using the terminal pseudo service method, all nodes with pseudo services enabled can trigger the honeypot alarm and increase the honeypot alarm probability; by capturing the MAC address through packet matching, and receiving the alarm tracing information on the honeypot center platform, matching and adding the attack tracing information when the alarm is stored can trace the real attacker, and when there is no honeypot service, illegal port sniffing can also be found and disconnected in time.

[0073] In some specific embodiments, the honeypot attack source tracing device may specifically include:

[0074] The pseudo service starting unit is used to pre-install the pseudo service on the terminal and dynamically start the pseudo service to receive the traffic attack initiated by the attacker.

[0075] In some specific embodiments, the information capture module 11 may specifically include:

[0076] The information capture submodule is used to capture the attacker's MAC information through libpcap when it is detected that the terminal installed with the fake service receives the attack traffic sent by the attacker.

[0077] In some specific embodiments, the information capture submodule may specifically include:

[0078] The information capture unit is used to capture the attacker's MAC information by performing handshake and wave packet capture operations on the local service port through libpcap when it is detected that the terminal installed with the fake service receives the attack traffic sent by the attacker.

[0079] In some specific embodiments, the information generating module 14 may specifically include:

[0080] The port determination unit is used to determine the local service port attacked by the attack traffic if the terminal has a honeypot service, and determine the corresponding honeypot service port from the relationship list based on the correspondence between the honeypot service port and the local service port; and forward the attack traffic to the corresponding honeypot service port.

[0081] In some specific embodiments, the honeypot attack source tracing device may specifically include:

[0082] The list generating unit is used to pre-bind the local service port with the corresponding honeypot service port to generate a corresponding relationship list.

[0083] In some specific embodiments, the information generating module 14 may specifically include:

[0084] The information generating unit is used to upload the MAC information to the honeypot center platform; when receiving part of the attacker information, the corresponding MAC information is integrated with the part of the attacker information to generate complete attacker information.

[0085] Furthermore, the present application also discloses an electronic device. Figure 5 This is a structural diagram of an electronic device 20 according to an exemplary embodiment. The content in the diagram cannot be regarded as any limitation on the scope of use of the present application.

[0086] Figure 5 A schematic diagram of the structure of an electronic device 20 provided in an embodiment of the present application. The electronic device 20 may specifically include: at least one processor 21, at least one memory 22, a power supply 23, a communication interface 24, an input / output interface 25, and a communication bus 26. The memory 22 is used to store a computer program, which is loaded and executed by the processor 21 to implement the relevant steps in the honeypot attack tracing method disclosed in any of the aforementioned embodiments. In addition, the electronic device 20 in this embodiment may specifically be an electronic computer.

[0087] In this embodiment, the power supply 23 is used to provide working voltage for each hardware device on the electronic device 20; the communication interface 24 can create a data transmission channel between the electronic device 20 and the external device, and the communication protocol it follows is any communication protocol that can be applied to the technical solution of the present application, and is not specifically limited here; the input and output interface 25 is used to obtain external input data or output data to the outside world, and its specific interface type can be selected according to specific application needs and is not specifically limited here.

[0088] Among them, the processor 21 may include one or more processing cores, such as a 4-core processor, an 8-core processor, etc. The processor 21 can be implemented in at least one hardware form of DSP (Digital Signal Processing), FPGA (Field-Programmable Gate Array), and PLA (Programmable Logic Array). The processor 21 may also include a main processor and a coprocessor. The main processor is a processor for processing data in the awake state, also known as a CPU (Central Processing Unit); the coprocessor is a low-power processor for processing data in the standby state. In some embodiments, the processor 21 may be integrated with a GPU (Graphics Processing Unit), which is responsible for rendering and drawing the content to be displayed on the display screen. In some embodiments, the processor 21 may also include an AI (Artificial Intelligence) processor, which is used to process computing operations related to machine learning.

[0089] In addition, the memory 22, as a carrier for storing resources, can be a read-only memory, a random access memory, a disk or an optical disk, etc. The resources stored thereon can include an operating system 221, a computer program 222, etc., and the storage method can be temporary storage or permanent storage.

[0090] Among them, the operating system 221 is used to manage and control the hardware devices and computer programs 222 on the electronic device 20, so as to realize the operation and processing of the massive data 223 in the memory 22 by the processor 21, which can be Windows Server, Netware, Unix, Linux, etc. In addition to including a computer program that can be used to complete the honeypot attack tracing method performed by the electronic device 20 disclosed in any of the aforementioned embodiments, the computer program 222 can further include a computer program that can be used to complete other specific tasks. In addition to data transmitted from an external device received by the electronic device, the data 223 can also include data collected by its own input and output interface 25, etc.

[0091] Furthermore, the present application also discloses a computer-readable storage medium for storing a computer program; wherein, when the computer program is executed by a processor, the aforementioned disclosed honeypot attack source tracing method is implemented. The specific steps of the method can refer to the corresponding contents disclosed in the aforementioned embodiments, and will not be repeated here.

[0092] In this specification, each embodiment is described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the embodiments can be referred to each other. For the device disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part.

[0093] Professionals may further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented with electronic hardware, computer software or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in the above description according to the function. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application. The steps of the method or algorithm described in conjunction with the embodiments disclosed herein can be directly implemented with a software module executed by a hardware or processor, or a combination of the two. The software module can be placed in a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the technical field.

[0094] Finally, it should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the presence of other identical elements in the process, method, article or device including the elements.

[0095] The above is a detailed introduction to the honeypot attack tracing method, device, equipment, and storage medium provided by the present invention. Specific examples are used in this article to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only used to help understand the method of the present invention and its core idea; at the same time, for those skilled in the art, according to the idea of ​​the present invention, there will be changes in the specific implementation method and application scope. In summary, the content of this specification should not be understood as a limitation on the present invention.

Claims

1. A honeypot attack tracing method, characterized in that: include: When the terminal with the fake service installed receives attack traffic sent by the attacker, the attacker's MAC information is captured; Determine whether a honeypot service exists on the terminal; If the terminal does not have a honeypot service, an alarm data is generated and the connection with the attacker is disconnected; If the terminal has a honeypot service, the attack traffic is forwarded to the corresponding honeypot service port based on the correspondence between the honeypot service port and the local service port, so that the honeypot service port sends part of the attacker information including the attacker's IP information to the honeypot center platform, and integrates the MAC information with the part of the attacker information to generate complete attacker information; The step of integrating the MAC information with the partial attacker information to generate complete attacker information includes: Upload the MAC information to the honeypot center platform; When partial attacker information is received, the corresponding MAC information is integrated with the partial attacker information to generate complete attacker information.

2. The honeypot attack source tracing method according to claim 1 is characterized in that: When it is detected that the terminal installing the fake service receives the attack traffic sent by the attacker, before capturing the MAC information of the attacker, the method further includes: A fake service is pre-installed on the terminal, and the fake service is dynamically enabled to receive traffic attacks initiated by the attacker.

3. The honeypot attack tracing method according to claim 1, characterized in that: When it is detected that the terminal installed with the fake service receives the attack traffic sent by the attacker, the attacker's MAC information is captured, including: When it is detected that the terminal with the fake service installed receives the attack traffic sent by the attacker, the attacker's MAC information is captured through libpcap.

4. The honeypot attack tracing method according to claim 3 is characterized in that: When it is detected that the terminal installed with the fake service receives the attack traffic sent by the attacker, the attacker's MAC information is captured through libpcap, including: When it is detected that the terminal with the fake service installed receives the attack traffic sent by the attacker, libpcap is used to perform handshake and wave packet capture operations on the local service port to capture the attacker's MAC information.

5. The honeypot attack source tracing method according to claim 1, characterized in that: If the terminal has a honeypot service, forwarding the attack traffic to the corresponding honeypot service port based on the correspondence between the honeypot service port and the local service port includes: If the terminal has a honeypot service, determine the local service port attacked by the attack traffic, and determine the corresponding honeypot service port from the relationship list based on the corresponding relationship between the honeypot service port and the local service port; The attack traffic is forwarded to the corresponding honeypot service port.

6. The method for tracing the source of a honeypot attack according to claim 5, characterized in that: Before determining the local service port attacked by the attack traffic and determining the corresponding honeypot service port from the relationship list based on the correspondence between the honeypot service port and the local service port, the method further includes: Pre-bind the local service port and the corresponding honeypot service port to generate a corresponding relationship list.

7. A honeypot attack tracing device, characterized in that: include: The information capture module is used to capture the attacker's MAC information when it is detected that the terminal with the fake service installed receives the attack traffic sent by the attacker; A service determination module, used to determine whether the terminal has a honeypot service; A connection disconnection module, used for generating alarm data and disconnecting the connection with the attacker if the honeypot service does not exist on the terminal; An information generation module, which is used to forward the attack traffic to the corresponding honeypot service port based on the correspondence between the honeypot service port and the local service port if the terminal has a honeypot service, so that the honeypot service port sends part of the attacker information including the attacker's IP information to the honeypot center platform, and integrates the MAC information with the part of the attacker information to generate complete attacker information; The information generation module is specifically used to upload the MAC information to the honeypot center platform; when receiving part of the attacker information, the corresponding MAC information is integrated with the part of the attacker information to generate complete attacker information.

8. An electronic device, characterized in that: include: Memory, used to store computer programs; A processor is used to execute the computer program to implement the steps of the honeypot attack tracing method according to any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that: Used to store computer programs; wherein, when the computer program is executed by a processor, the steps of the honeypot attack tracing method according to any one of claims 1 to 6 are implemented.

Images