A honeypot traffic traction device, method, computer equipment and storage medium

Abstract

The present invention relates to a honeypot traffic traction device, method, computer equipment and storage medium, and to the field of Internet technology. The device includes a honeypot management platform, a honeypot node, a honeypot traffic traction server, and a honeypot traffic traction terminal; the honeypot traffic traction server and the honeypot management platform are deployed on the same machine node, and the honeypot traffic traction terminal is deployed in an isolation network different from the honeypot management platform; one honeypot traffic traction server is deployed, and multiple honeypot traffic traction terminals are deployed in each isolation network. In a complex isolation network, the isolation networks of the present invention are connected through a single port opened by a firewall, so that an encrypted tunnel is established between the honeypot traffic traction server and the honeypot traffic traction terminal. According to the routing table and related collection strategies sent by the honeypot traffic traction server to the honeypot traffic traction terminal, the required traffic of different isolation network segments is pulled into the honeypot system.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a honeypot traffic traction device, method, computer equipment and storage medium. Background Art

[0002] Due to the deployment method and business characteristics of the honeypot, it is necessary to selectively pull the traffic in the network environment, such as between different DMZ areas and between high-sensitivity businesses, which will result in some traffic in different isolated networks not being pulled.

[0003] There are three main types of common drainage technology solutions:

[0004] The first type is to use third-party security products to divert traffic, such as setting and releasing each access behavior of the honeypot one by one through the firewall's ACL. When the attacker launches an attack, the traffic is directed to the honeypot system through this solution according to the existing ACL rules on the firewall.

[0005] The second type is to pull traffic through reverse proxy, that is, to build a reverse proxy server between the protection device and the honeypot. When the attacker triggers the attack to reach the protection device, the specific traffic will be pulled to the honeypot system through reverse proxy.

[0006] The third type is to attract traffic through UDP tunnels. By deploying a collection plug-in in the target virtual machine, when the client is started in the virtual machine, the honeypot will send the port information to be collected to the client and establish a UDP tunnel with it. When the attacker launches an attack, the client will attract the required network card traffic to the honeypot system through UDP according to the received policy information.

[0007] However, the first type uses third-party security products such as firewalls to attract traffic. This solution requires frequent changes to the configuration of firewalls or other security products, and honeypot products usually do not have the authority to control third-party security products. Therefore, this method of attracting traffic is less easy to use in actual use.

[0008] The second type is to pull traffic through reverse proxy. This method usually cannot respond to arp and tcp requests, and can only pull traffic data of specific ports, so it cannot fully cover the honeypot access configuration.

[0009] The third type is to pull traffic by establishing a UDP tunnel. This technical solution requires encapsulating the target's identification information in the UDP message, and then pulling the traffic through the configuration of the identification. After receiving the information, the other party needs to decapsulate the data. This solution requires secondary encapsulation of the original traffic, which increases the volume of the traffic, affects the pulling efficiency, and has poor reliability.

[0010] To sum up, it is necessary to design a new traffic traction method to achieve efficient, safe and reliable traffic diversion and solve the above problems. Summary of the invention

[0011] The purpose of the present invention is to provide a honeypot traffic traction device, method, computer equipment and storage medium to solve the above-mentioned technical problems.

[0012] To achieve the above object, the present invention provides the following technical solutions:

[0013] In a first aspect, an embodiment of the present invention provides a honeypot traffic traction device, including: a honeypot management platform, a honeypot node, a honeypot traffic traction server, and a honeypot traffic traction terminal;

[0014] The honeypot traffic traction service end and the honeypot management platform are deployed on the same machine node, and the honeypot traffic traction terminal is deployed in an isolated network different from the honeypot management platform;

[0015] The honeypot traffic traction service end is deployed with one, and each isolation network is deployed with a plurality of the honeypot traffic traction terminals.

[0016] As a further solution of the present invention, the honeypot traffic traction server is in isolation network A, the honeypot traffic traction terminal is in isolation network B, and a firewall is deployed between isolation network A and isolation network B. The firewall is used to control access authorization between isolation network A and isolation network B.

[0017] As a further solution of the present invention, the traction traffic between the honeypot traffic traction terminal and the honeypot traffic traction server is bidirectionally interconnected, the honeypot traffic traction server is used to receive the traffic sent by the honeypot traffic traction terminal, and the honeypot traffic traction terminal is used to receive the traffic sent by the honeypot traffic traction server.

[0018] As a further solution of the present invention, an encrypted tunnel is set between the honeypot traffic traction terminal and the honeypot traffic traction server, and all protocol types of traffic are sent and received through the tunnel.

[0019] As a further solution of the present invention, when an attacker's access traffic reaches the network card of the honeypot traffic traction terminal, and the destination address accessed by the attacker hits a pre-configured rule, the honeypot traffic traction device is used to perform DNAT conversion on the destination address, without rewriting the source address, and retaining the original source IP in the message.

[0020] As a further solution of the present invention, when the honeypot traffic traction device performs DNAT conversion, the following steps are included:

[0021] The destination address is rewritten to the virtual subnet IP address of the virtual network card on the honeypot traffic traction terminal machine. At this time, according to the system routing table setting of the machine where the honeypot traffic traction terminal is located, the traffic to the honeypot traffic traction server passes through the local virtual network card, is read by the honeypot traffic traction terminal, and is sent to the honeypot traffic traction server through the established tunnel;

[0022] The honeypot traffic traction server receives traffic through the virtual network card. At this time, according to the routing table strategy, the traffic is sent to the corresponding honeypot node. The address monitored by the honeypot node is the IP address of the virtual subnet.

[0023] The honeypot node receives the attack traffic, obtains the real attacker's IP address and responds;

[0024] The honeypot node responds to the specified traffic through the tunnel between the honeypot traffic traction server and the honeypot traffic traction terminal, and flows back to the honeypot traffic traction terminal node, and the honeypot traffic traction terminal node returns the response traffic to the request initiator.

[0025] As a further solution of the present invention, the destination address attacked by the attacker is the address of the network card in the machine where the honeypot traffic traction terminal is located.

[0026] As a further solution of the present invention, when the address monitored by the honeypot node is the IP address of the virtual subnet, the traffic triggers the ebpf from-tun ingress hook, writes the <traffic quintuple, virtual device ID> mapping to / sys / fs / bpf / tc / globals, and then releases the traffic.

[0027] As a further solution of the present invention, after the honeypot node receives the attack traffic, obtains the real attacker IP and responds, since the attacker IP is an arbitrary IP, the default routing rule is written into the default network card (eth0), and the return traffic source device is obtained by querying the / sys / fs / bpf / tc / globals table. Then, bpf_perf_event_output is used to redirect the traffic to the virtual device and write it back to the traffic traction terminal for SNAT conversion, thereby completing the complete traffic routing link.

[0028] In a second aspect, an embodiment of the present invention provides a honeypot traffic traction method, comprising the following steps:

[0029] The honeypot traffic traction server obtains the IP address of the honeypot node service from the honeypot management platform and records it;

[0030] Start the honeypot traffic traction terminal and create a virtual network card. Establish a connection with the honeypot traffic traction server through the ports that communicate with the isolated network A and isolated network B configured in the firewall.

[0031] After receiving the first request from the honeypot traffic traction terminal, the honeypot traffic traction server creates a virtual network card on the local machine for tunnel communication with the honeypot traffic traction terminal;

[0032] The honeypot traffic traction server sends the IP address and routing table policy of the virtual network card of the honeypot traffic traction terminal to the honeypot traffic traction terminal;

[0033] The honeypot traffic traction terminal sets the IP address of the virtual network card to the IP address sent by the honeypot traffic traction server, and configures the corresponding routing table strategy;

[0034] The honeypot traffic traction server and the honeypot traffic traction terminal established an encrypted tunnel and successfully formed a virtual subnet;

[0035] In isolated network A and isolated network B, communication is performed through the encrypted tunnel;

[0036] The traffic accessing the network card of the machine where the honeypot traffic traction terminal is located will be converted to the destination address according to the established routing table strategy through the above-mentioned DNAT conversion method, and the specified traffic will be pulled to the virtual network card created by the honeypot traffic traction terminal;

[0037] After reading the traffic received by the virtual network card, the honeypot traffic traction terminal tractions the traffic to the peer virtual network card of the machine where the honeypot traffic traction server is located through the tunnel;

[0038] After receiving the traffic through the virtual network card, the honeypot traffic traction server will traction the traffic to the specified target honeypot node according to the configuration items;

[0039] After receiving the traffic, the honeypot node responds and sends the generated response traffic to the honeypot traffic server, and sends the response traffic to the honeypot traffic terminal through the tunnel; after receiving the traffic, the honeypot traffic traction terminal writes the response traffic back to the virtual network card, converts the source address through the SNAT conversion method, and then sends it to the traffic initiator;

[0040] Record the five-tuple and the corresponding virtual network card device during server ingress;

[0041] When the server egresses, the virtual network card device is written by querying the mapping table mentioned above.

[0042] As a further solution of the present invention, a honeypot management platform is installed in isolation network A, and a honeypot traffic traction service end is installed on the machine where the honeypot management platform is located; the honeypot management platform deploys the honeypot node service; and a honeypot traffic traction terminal is installed in isolation network B.

[0043] In a third aspect, an embodiment of the present invention provides a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of the above-mentioned honeypot traffic traction method when executing the program.

[0044] In a fourth aspect, an embodiment of the present invention further provides a computer-readable storage medium having a computer program stored thereon, which implements the steps of the above-mentioned honeypot traffic traction method when executed by a processor.

[0045] The technical solution provided by the embodiment of the present invention may have the following beneficial effects:

[0046] The honeypot traffic traction device, method, computer equipment and storage medium provided by the present invention enable a honeypot traffic traction service end and a honeypot traffic traction terminal to establish an encrypted tunnel in a complex isolated network through a single port opened by a firewall between isolated networks. According to the routing table and related collection strategies sent by the honeypot traffic traction service end to the honeypot traffic traction terminal, the required traffic of different isolated network segments is pulled into the honeypot system.

[0047] These and other aspects of the present application will be more concise and understandable in the following description of the embodiments. It should be understood that the above general description and the following detailed description are only exemplary and explanatory and cannot limit the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the following briefly introduces the drawings required for use in the embodiments or the prior art description. Obviously, the drawings described below are only some embodiments of the present application. In the drawings:

[0049] Figure 1 It is a structural schematic diagram of a honeypot traffic traction device in an exemplary embodiment of the present invention;

[0050] Figure 2 The figure is a hardware architecture diagram of a computer device in one embodiment of the present invention.

[0051] The purpose, features and advantages of this application will be further described in conjunction with the embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION

[0052] Below, the present application is further described in conjunction with the accompanying drawings and specific implementation methods. It should be noted that, under the premise of no conflict, the various embodiments or technical features described below can be arbitrarily combined to form a new embodiment.

[0053] Since the first type uses third-party security products to pull traffic, the second type uses reverse proxy to pull traffic, and the third type uses UDP tunnel to pull traffic, the first type uses third-party security products such as firewalls to pull traffic. This solution requires frequent changes to the configuration of firewalls or other security products, and honeypot products usually do not have the authority to control third-party security products, so this method of diversion is less easy to use in actual use. The second type is to pull traffic through reverse proxy. This method usually cannot respond to arp and tcp requests, and can only pull traffic data of specific ports, so it is impossible to fully cover the configuration for honeypot access. The third type is to pull traffic by establishing a UDP tunnel. This technical solution requires encapsulating the target's identification information in the UDP message, and then pulling the traffic through the configuration of the identification. After receiving the information, the other party needs to decapsulate the data. This solution requires secondary encapsulation of the original traffic, which increases the volume of the traffic, affects the pulling efficiency, and has poor reliability.

[0054] Therefore, the honeypot traffic traction device, method, computer equipment and storage medium of the present invention realize efficient, safe and reliable diversion.

[0055] Please refer to Figure 1 In one embodiment of the present application, a honeypot traffic traction device is provided, including a honeypot management platform, a honeypot node, a honeypot traffic traction server, and a honeypot traffic traction terminal.

[0056] When the honeypot traffic traction device is deployed, the honeypot traffic traction service end and the honeypot management platform are deployed on the same machine node, and the honeypot traffic traction terminal is deployed in an isolation network different from the honeypot management platform.

[0057] The honeypot traffic traction service end is deployed with one, and multiple honeypot traffic traction terminals are deployed in each isolated network. That is, one honeypot traffic traction service end is deployed, and multiple honeypot traffic traction terminals can be deployed in each isolated network. The honeypot traffic traction service end and the honeypot management platform are deployed on the same machine node, and the honeypot traffic traction terminal is deployed in an isolated network different from the honeypot management platform.

[0058] In the embodiment of the present invention, the honeypot traffic traction service end is in the isolated network A, and the honeypot traffic traction terminal is in the isolated network B. A firewall is deployed between the isolated network A and the isolated network B to control access authorization between the isolated networks.

[0059] In an embodiment of the present invention, the traction traffic between the honeypot traffic traction terminal and the honeypot traffic traction server is bidirectionally interconnected, the honeypot traffic traction server is used to receive the traffic sent by the honeypot traffic traction terminal, and the honeypot traffic traction terminal is used to receive the traffic sent by the honeypot traffic traction server.

[0060] In an embodiment of the present invention, an encrypted tunnel is set between the honeypot traffic traction terminal and the honeypot traffic traction server, and all protocol types of traffic are sent and received through the tunnel.

[0061] The traffic flow direction is described as follows:

[0062] When an attacker's access traffic reaches the network card of the honeypot traction terminal, and the destination address accessed by the attacker hits the pre-configured rule, the destination address will be DNAT converted, and the source address will not be rewritten (MASQURADE) at this time, retaining the original source IP in the message.

[0063] The following is a detailed description of the DNAT conversion process of the attacker's attack traffic:

[0064] First, the destination address attacked by the attacker is the address of the network card in the machine where the honeypot traffic traction terminal is located. In order to achieve traffic traction across the isolated network, the destination address needs to be rewritten, that is, the destination address needs to be rewritten to the virtual subnet IP address of the virtual network card on the honeypot traffic traction terminal machine. At this time, according to the system routing table settings of the machine where the honeypot traffic traction terminal is located, the traffic to the honeypot traffic server will pass through the local virtual network card, and then be read by the honeypot traffic traction terminal and sent to the honeypot traffic traction server through the previously established tunnel.

[0065] The honeypot traffic traction server receives the traffic through the virtual network card. At this time, according to the routing table strategy, the traffic is sent to the corresponding honeypot node. The address monitored by the honeypot node is the IP address of the virtual subnet (virtual network card device).

[0066] At this point, the traffic starts from the ebpf from-tun ingress hook, which writes the mapping of <traffic quintuple, virtual device ID> to / sys / fs / bpf / tc / globals and then releases the traffic.

[0067] The honeypot node receives the attack traffic, obtains the real attacker IP and responds. Since the attacker IP is any IP, the default routing rule is written to the default network card (eth0). After querying the / sys / fs / bpf / tc / globals table to obtain the source device of the return traffic, bpf_perf_event_output is used to redirect the traffic to the virtual device and write it back to the traffic traction terminal for SNAT conversion, thereby completing the complete traffic routing link.

[0068] That is, the honeypot traction terminal will access the traffic of the specified honeypot node target, and divert it to the honeypot traction server through the tunnel between the honeypot traffic traction server and the honeypot traffic traction terminal. The honeypot traction server will send the traffic to the final target honeypot node according to the pre-configured traffic traction configuration.

[0069] At the same time, the honeypot node's response to the specified traffic is also returned to the honeypot traffic traction terminal node through the tunnel between the honeypot traffic traction server and the honeypot traffic traction terminal, and the honeypot traffic traction terminal node returns the response traffic to the request initiator.

[0070] In some embodiments of the present application, Figure 1 As shown, a honeypot traffic traction method of this embodiment is shown. The traction process of the honeypot traffic traction method includes the following steps:

[0071] Step 1: Install the honeypot management platform on the isolated network A, and install the honeypot traffic traction server on the machine where the honeypot management platform is located;

[0072] Step 2: The honeypot management platform deploys the honeypot node service;

[0073] Step 3: The honeypot traffic traction server obtains the IP address of the honeypot node service from the honeypot management platform and records it;

[0074] Step 4: Install the honeypot traffic traction terminal on the isolation network B;

[0075] Step 5. Next, enter the tunnel establishment process;

[0076] Step 6: Start the honeypot traffic traction terminal and create a virtual network card. Establish a connection with the honeypot traffic traction server through the ports that communicate with the isolated network A and the isolated network B configured in the firewall;

[0077] Step 7: After receiving the first request from the honeypot traffic traction terminal, the honeypot traffic traction server creates a virtual network card on the local machine for tunnel communication with the honeypot traffic traction terminal;

[0078] Step 8: The honeypot traffic traction server sends the IP address of the virtual network card of the honeypot traffic traction terminal and the routing table policy;

[0079] Step 9: The honeypot traffic traction terminal sets the IP address of the virtual network card to the IP address sent by the honeypot traffic traction server, and configures the corresponding routing table policy;

[0080] Step 10: At this point, the honeypot traffic traction server and the honeypot traffic traction terminal have established an encrypted tunnel and successfully formed a virtual subnet;

[0081] Step 11: In isolated network A and isolated network B, communication can be carried out through this tunnel;

[0082] Step 12: Access the traffic of the machine network card where the honeypot traffic traction terminal is located. According to the established routing table strategy, the destination address is converted through the above DNAT conversion method, and the specified traffic is pulled to the virtual network card created by the honeypot traffic traction terminal;

[0083] Step 13: After reading the traffic received by the virtual network card, the honeypot traffic traction terminal tractions the traffic to the peer virtual network card of the machine where the honeypot traffic traction server is located through the tunnel;

[0084] Step 14: After receiving the traffic through the virtual network card, the honeypot traffic traction server will traction the traffic to the designated target honeypot node according to the configuration items;

[0085] Step 15: After receiving the traffic, the honeypot node responds and sends the generated response traffic to the honeypot traffic server, and sends the response traffic to the honeypot traffic terminal through the tunnel; after receiving the traffic, the honeypot traffic traction terminal writes the response traffic back to the virtual network card, and after performing source address conversion using the above-mentioned SNAT conversion method, sends it to the traffic initiator;

[0086] Step 16: Record the five-tuple and the corresponding virtual network card device during server ingress;

[0087] Step 17: When the server egresses, query the mapping table above and write it to the virtual network card device to ensure that the traffic goes back and forth from which port.

[0088] It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0089] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0090] The flowcharts shown in the accompanying drawings are only examples and do not necessarily include all the contents and operations / steps, nor must they be executed in the order described. For example, some operations / steps may also be decomposed, combined or partially merged, so the actual execution order may change according to actual conditions.

[0091] In conjunction with the accompanying drawings, some embodiments of the present application are described in detail below. In the absence of conflict, the following embodiments and features in the embodiments can be combined with each other.

[0092] Reference Figure 1 As shown, in the embodiment of the present invention, the honeypot traffic traction device has three network areas: Internet area, office network area, and private network area, which are isolated from each other by firewalls and the networks are not interconnected.

[0093] In the embodiment of the present application, the honeypot management platform, honeypot node and honeypot traffic traction service are deployed in the private network area. In the Internet area and the office network area, a honeypot traffic traction device is deployed respectively, and a honeypot traffic traction terminal is installed. The honeypot traffic traction terminals in the Internet area and the office network area respectively create virtual network cards A and virtual network cards B on their respective machines.

[0094] The honeypot traffic traction terminal A in the Internet zone is released by firewall A, core switch and firewall B, and only passes through a single port. It establishes a connection with the honeypot traffic traction server in the private network zone through encrypted negotiation via the TCP protocol.

[0095] At the same time, the honeypot traffic traction terminal B deployed in the office network area established a connection with the honeypot traffic traction server in the private network area through encrypted negotiation via the TCP protocol through the designated single port opened by firewall B.

[0096] After the honeypot traffic traction service receives the networking request from the honeypot traffic traction terminal A in the Internet zone and the honeypot traffic traction terminal B in the office network zone, it allocates the designated virtual subnet IP address to the honeypot traffic traction terminal A in the Internet zone and the honeypot traffic traction terminal B in the office network zone respectively, and issues the routing policy that needs to be forwarded to the honeypot node.

[0097] In the embodiment of the present application, the traffic from the Internet zone to a specific honeypot passes through the virtual network card A, the honeypot traffic traction terminal A, and is pulled to the honeypot node in the private network zone through the subnet tunnel. After the honeypot node processes, analyzes, and records the specified traffic, it responds to the specific honeypot traffic, passes through the tunnel in the reverse direction, returns to the honeypot traffic traction terminal A in the Internet zone, and finally sends it to the traffic initiator, completing a honeypot request, processing, and response.

[0098] In an embodiment of the present application, the traffic from the office network area accessing a specific honeypot passes through the virtual network card B, the honeypot traffic traction terminal B, and is pulled to the honeypot node in the private network area through the subnet tunnel. After the honeypot node processes, parses, and records the specified traffic, it responds to the specific honeypot traffic, passes through the tunnel in the reverse direction, returns to the honeypot traffic traction terminal A in the Internet area, and finally sends it to the traffic initiator, completing a honeypot request, processing, and response.

[0099] This embodiment also provides a computer device, such as Figure 2As shown, the computer device includes multiple computer devices 1000. In the embodiment, the components of the honeypot traffic traction device can be dispersed in different computer devices 1000. The computer device 1000 can be a smart phone, tablet computer, laptop computer, desktop computer, rack server, blade server, tower server or cabinet server (including an independent server, or a server cluster composed of multiple servers) that executes a program. The computer device 1000 of this embodiment includes at least but is not limited to: a memory 1001 and a processor 1002 that can be interconnected through a system bus. However, it should be understood that it is not required to implement all the components shown, and more or fewer components can be implemented instead.

[0100] In this embodiment, the memory 1001 (i.e., readable storage medium) includes flash memory, hard disk, multimedia card, card-type memory (e.g., SD or DX memory, etc.), random access memory (RAM), static random access memory (SRAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), programmable read-only memory (PROM), magnetic memory, magnetic disk, optical disk, etc. In some embodiments, the memory 1001 may be an internal storage unit of the computer device 1000, such as a hard disk or memory of the computer device 1000. In other embodiments, the memory 1001 may also be an external storage device of the computer device 1000, such as a plug-in hard disk, a smart memory card (SmartMediaCard, SMC), a secure digital (SecureDigital, SD) card, a flash card (FlashCard), etc. equipped on the computer device 1000. Of course, the memory 1001 may also include both the internal storage unit of the computer device 1000 and its external storage device. In this embodiment, the memory 1001 is generally used to store the operating system and various application software installed on the computer device, such as the honeypot traffic traction device of the embodiment. In addition, the memory 1001 can also be used to temporarily store various types of data that have been output or are to be output.

[0101] In some embodiments, the processor 1002 may be a central processing unit (CPU), a controller, a microcontroller, a microprocessor, or other data processing chip. The processor 1002 is generally used to control the overall operation of the computer device 1000. In this embodiment, the processor 1002 is used to run the program code stored in the memory 1001 or process data. When the processors 1002 of multiple computer devices 1000 of the computer device of this embodiment jointly execute the computer program, the honeypot traffic traction method of the embodiment is implemented, including the following steps:

[0102] Step 1: Install the honeypot management platform on the isolated network A, and install the honeypot traffic traction server on the machine where the honeypot management platform is located;

[0103] Step 2: The honeypot management platform deploys the honeypot node service;

[0104] Step 3: The honeypot traffic traction server obtains the IP address of the honeypot node service from the honeypot management platform and records it;

[0105] Step 4: Install the honeypot traffic traction terminal on the isolation network B;

[0106] Step 5. Next, enter the tunnel establishment process;

[0107] Step 6: Start the honeypot traffic traction terminal and create a virtual network card. Establish a connection with the honeypot traffic traction server through the ports that communicate with the isolated network A and the isolated network B configured in the firewall;

[0108] Step 7: After receiving the first request from the honeypot traffic traction terminal, the honeypot traffic traction server creates a virtual network card on the local machine for tunnel communication with the honeypot traffic traction terminal;

[0109] Step 8: The honeypot traffic traction server sends the IP address of the virtual network card of the honeypot traffic traction terminal and the routing table policy;

[0110] Step 9: The honeypot traffic traction terminal sets the IP address of the virtual network card to the IP address sent by the honeypot traffic traction server, and configures the corresponding routing table policy;

[0111] Step 10: At this point, the honeypot traffic traction server and the honeypot traffic traction terminal have established an encrypted tunnel and successfully formed a virtual subnet;

[0112] Step 11: In isolated network A and isolated network B, communication can be carried out through this tunnel;

[0113] Step 12: Access the traffic of the machine network card where the honeypot traffic traction terminal is located. According to the established routing table strategy, the destination address is converted through the above DNAT conversion method, and the specified traffic is pulled to the virtual network card created by the honeypot traffic traction terminal;

[0114] Step 13: After reading the traffic received by the virtual network card, the honeypot traffic traction terminal tractions the traffic to the peer virtual network card of the machine where the honeypot traffic traction server is located through the tunnel;

[0115] Step 14: After receiving the traffic through the virtual network card, the honeypot traffic traction server will traction the traffic to the designated target honeypot node according to the configuration items;

[0116] Step 15: After receiving the traffic, the honeypot node responds and sends the generated response traffic to the honeypot traffic server, and sends the response traffic to the honeypot traffic terminal through the tunnel; after receiving the traffic, the honeypot traffic traction terminal writes the response traffic back to the virtual network card, and after performing source address conversion using the above-mentioned SNAT conversion method, sends it to the traffic initiator;

[0117] Step 16: Record the five-tuple and the corresponding virtual network card device during server ingress;

[0118] Step 17: When the server egresses, query the mapping table above and write it to the virtual network card device to ensure that the traffic goes back and forth from which port.

[0119] Through the description of the above embodiments, ordinary technicians in this field can clearly understand that each embodiment can be implemented by software plus a general hardware platform, and of course, it can also be implemented by hardware. Ordinary technicians in this field can understand that all or part of the processes in the above embodiment methods can be completed by instructing related hardware through a computer program, and the program can be stored in a computer-matchable storage medium. When the program is executed, it can include the processes of the embodiments of the above methods.

[0120] The embodiment of the present application also provides a computer-readable storage medium, such as a flash memory, a hard disk, a multimedia card, a card-type memory (for example, an SD or DX memory, etc.), a random access memory (RAM), a static random access memory (SRAM), a read-only memory (ROM), an electrically erasable programmable read-only memory (EEPROM), a programmable read-only memory (PROM), a magnetic memory, a disk, an optical disk, a server, an App application store, etc., on which a computer program is stored, and the program implements the corresponding function when executed by the processor. The computer-readable storage medium of this embodiment stores the honeypot traffic traction device 10 of the embodiment, and when executed by the processor, implements the honeypot traffic traction method of the embodiment, including the following steps:

[0121] Step 1: Install the honeypot management platform on the isolated network A, and install the honeypot traffic traction server on the machine where the honeypot management platform is located;

[0122] Step 2: The honeypot management platform deploys the honeypot node service;

[0123] Step 3: The honeypot traffic traction server obtains the IP address of the honeypot node service from the honeypot management platform and records it;

[0124] Step 4: Install the honeypot traffic traction terminal on the isolation network B;

[0125] Step 5. Next, enter the tunnel establishment process;

[0126] Step 6: Start the honeypot traffic traction terminal and create a virtual network card. Establish a connection with the honeypot traffic traction server through the ports that communicate with the isolated network A and the isolated network B configured in the firewall;

[0127] Step 7: After receiving the first request from the honeypot traffic traction terminal, the honeypot traffic traction server creates a virtual network card on the local machine for tunnel communication with the honeypot traffic traction terminal;

[0128] Step 8: The honeypot traffic traction server sends the IP address of the virtual network card of the honeypot traffic traction terminal and the routing table policy;

[0129] Step 9: The honeypot traffic traction terminal sets the IP address of the virtual network card to the IP address sent by the honeypot traffic traction server, and configures the corresponding routing table policy;

[0130] Step 10: At this point, the honeypot traffic traction server and the honeypot traffic traction terminal have established an encrypted tunnel and successfully formed a virtual subnet;

[0131] Step 11: In isolated network A and isolated network B, communication can be carried out through this tunnel;

[0132] Step 12: Access the traffic of the machine network card where the honeypot traffic traction terminal is located. According to the established routing table strategy, the destination address is converted through the above DNAT conversion method, and the specified traffic is pulled to the virtual network card created by the honeypot traffic traction terminal;

[0133] Step 13: After reading the traffic received by the virtual network card, the honeypot traffic traction terminal tractions the traffic to the peer virtual network card of the machine where the honeypot traffic traction server is located through the tunnel;

[0134] Step 14: After receiving the traffic through the virtual network card, the honeypot traffic traction server will traction the traffic to the designated target honeypot node according to the configuration items;

[0135] Step 15: After receiving the traffic, the honeypot node responds and sends the generated response traffic to the honeypot traffic server, and sends the response traffic to the honeypot traffic terminal through the tunnel; after receiving the traffic, the honeypot traffic traction terminal writes the response traffic back to the virtual network card, and after performing source address conversion using the above-mentioned SNAT conversion method, sends it to the traffic initiator;

[0136] Step 16: Record the five-tuple and the corresponding virtual network card device during server ingress;

[0137] Step 17: When the server egresses, query the mapping table above and write it to the virtual network card device to ensure that the traffic goes back and forth from which port.

[0138] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method.

[0139] The honeypot traffic traction device, method, computer equipment and storage medium provided by the present invention enable a honeypot traffic traction service end and a honeypot traffic traction terminal to establish an encrypted tunnel in a complex isolated network through a single port opened by a firewall between isolated networks. According to the routing table and related collection strategies sent by the honeypot traffic traction service end to the honeypot traffic traction terminal, the required traffic of different isolated network segments is pulled into the honeypot system.

[0140] The above are only preferred embodiments of the present application, and are not intended to limit the patent scope of the present application. Any equivalent structure or equivalent process transformation made using the contents of the present application specification and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present application.

Claims

1. A honeypot traffic traction device, characterized in that: Used for efficient, safe and reliable traffic diversion, including: honeypot management platform, honeypot node, honeypot traffic traction server, honeypot traffic traction terminal; The honeypot traffic traction service end and the honeypot management platform are deployed on the same machine node, and the honeypot traffic traction terminal is deployed in an isolated network different from the honeypot management platform; The honeypot traffic traction service end is deployed with one, and each isolation network is deployed with multiple honeypot traffic traction terminals; Among them, an encrypted tunnel is set between the honeypot traffic traction terminal and the honeypot traffic traction server, and all protocol types of traffic are sent and received through the tunnel; When the access traffic of an attacker reaches the network card of the honeypot traffic traction terminal, and the destination address accessed by the attacker hits the pre-configured rule, the honeypot traffic traction device is used to perform DNAT conversion on the destination address without rewriting the source address and retaining the original source IP in the message; Among them, when the honeypot traffic traction device performs DNAT conversion, the following steps are included: The destination address is rewritten to the virtual subnet IP address of the virtual network card on the honeypot traffic traction terminal machine. At this time, according to the system routing table setting of the machine where the honeypot traffic traction terminal is located, the traffic to the honeypot traffic traction server passes through the local virtual network card, is read by the honeypot traffic traction terminal, and is sent to the honeypot traffic traction server through the established tunnel; The honeypot traffic traction server receives traffic through the virtual network card. At this time, according to the routing table strategy, the traffic is sent to the corresponding honeypot node. The address monitored by the honeypot node is the IP address of the virtual subnet. The honeypot node receives the attack traffic, obtains the real attacker's IP address and responds; The honeypot node responds to the specified traffic through the tunnel between the honeypot traffic traction server and the honeypot traffic traction terminal, and flows back to the honeypot traffic traction terminal node, and the honeypot traffic traction terminal node returns the response traffic to the request initiator.

2. The honeypot flow traction device according to claim 1, characterized in that: The honeypot traffic traction service end is in isolation network A, the honeypot traffic traction terminal is in isolation network B, and a firewall is deployed between isolation network A and isolation network B. The firewall is used to control the access authorization between isolation network A and isolation network B.

3. The honeypot flow traction device according to claim 1, characterized in that: The traction traffic between the honeypot traffic traction terminal and the honeypot traffic traction service end is bidirectionally interconnected. The honeypot traffic traction service end is used to receive the traffic sent by the honeypot traffic traction terminal, and the honeypot traffic traction terminal is used to receive the traffic sent by the honeypot traffic traction service end.

4. The honeypot flow traction device according to claim 1, characterized in that: The destination address of the attacker's attack is the address of the network card in the machine where the honeypot traffic is pulled by the terminal.

5. A honeypot traffic traction method, characterized in that: The following steps are involved: The honeypot traffic traction server obtains the IP address of the honeypot node service from the honeypot management platform and records it; Start the honeypot traffic traction terminal and create a virtual network card. Establish a connection with the honeypot traffic traction server through the ports that communicate with the isolated network A and isolated network B configured in the firewall. After receiving the first request from the honeypot traffic traction terminal, the honeypot traffic traction server creates a virtual network card on the local machine for tunnel communication with the honeypot traffic traction terminal; The honeypot traffic traction server sends the IP address and routing table policy of the virtual network card of the honeypot traffic traction terminal to the honeypot traffic traction terminal; The honeypot traffic traction terminal sets the IP address of the virtual network card to the IP address sent by the honeypot traffic traction server, and configures the corresponding routing table strategy; The honeypot traffic traction server and the honeypot traffic traction terminal established an encrypted tunnel and successfully formed a virtual subnet; In isolated network A and isolated network B, communication is performed through the encrypted tunnel; The traffic accessing the network card of the machine where the honeypot traffic traction terminal is located will be converted to the destination address through the DNAT conversion method according to the established routing table strategy, and the specified traffic will be pulled to the virtual network card created by the honeypot traffic traction terminal; After reading the traffic received by the virtual network card, the honeypot traffic traction terminal tractions the traffic to the peer virtual network card of the machine where the honeypot traffic traction server is located through the tunnel; After receiving the traffic through the virtual network card, the honeypot traffic traction server will traction the traffic to the specified target honeypot node according to the configuration items; After receiving the traffic, the honeypot node responds and sends the generated response traffic to the honeypot traffic server, and sends the response traffic to the honeypot traffic terminal through the tunnel; After receiving the traffic, the honeypot traffic traction terminal writes the response traffic back to the virtual network card, and after the source address is converted by the SNAT conversion method, it is sent to the traffic initiator; Record the five-tuple and the corresponding virtual network card device during server ingress; When the server egresses, the virtual network card device is written by querying the mapping table mentioned above.

6. A computer device, characterized in that: The computer device includes multiple computer devices, each of which includes a memory, a processor, and a computer program stored in the memory and executable on the processor. It is characterized in that the processors of the multiple computer devices jointly implement the steps of the honeypot traffic traction method described in claim 5 when executing the computer program.

7. A computer-readable storage medium having a computer program stored thereon, characterized in that: The computer program stored in the storage medium implements the steps of the honeypot traffic traction method according to claim 5 when executed by the processor.

Images