A honeypot service system based on mimicry architecture and its processing method

Abstract

The present invention discloses a honeypot service system based on a mimic architecture and a processing method thereof, the system comprising: a traffic proxy module for receiving traffic from an attacker, distributing the traffic to various heterogeneous executors, and sending the result of the heterogeneous executors feedback to the attacker; the heterogeneous executors for responding to the traffic from the attacker and feeding back the result to the traffic arbitration module; a kernel monitoring module for real-time monitoring of the host machine of the virtualization platform, when traffic with dangerous instructions enters the heterogeneous executors and generates an escape on the virtual machine, the traffic information is sent to the traffic arbitration module for judgment; the traffic arbitration module is used to make an arbitration according to the feedback results of the kernel monitoring module and the heterogeneous executors, and send the arbitration result to the scheduling module; the scheduling module is used to send instructions to the heterogeneous executors and the traffic proxy module according to the feedback results of the traffic arbitration module. The present invention realizes the detection and defense of virtual machine escape.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a honeypot service system based on a mimicry architecture and a processing method thereof. Background Art

[0002] With the deepening of the informatization process and the rapid development of the Internet, people's work, study and lifestyle are undergoing tremendous changes, efficiency is greatly improved, and information resources are shared to the greatest extent. However, the network security problem that follows the development of informatization is becoming increasingly prominent. If this problem is not well solved, it will inevitably hinder the process of informatization development. Network security issues have become a common challenge faced by mankind in the information age, and domestic network security issues are also becoming increasingly prominent.

[0003] The essence of information security is continuous confrontation. For example, network penetration and system intrusion have to face firewalls, intrusion detection, and application security reinforcement. Firewalls, intrusion detection, and application security reinforcement each have their own application scenarios, and can solve the needs of network attack defense, early warning, mitigation, and reinforcement under certain conditions. However, due to the existence of zero-day vulnerabilities, security policy design defects, and improper configuration and implementation of security mechanisms, attackers can always find some gaps to break through protection. Therefore, the two parties that are continuously confronting each other on the actual network security battlefield are actually engaged in an asymmetric confrontation. Specifically, this asymmetry is mainly reflected in the following aspects:

[0004] (1) The workload is asymmetric. The attacker can choose to conserve energy during the day and on weekdays, and launch attacks at night and on holidays to catch the enemy off guard. In order to ensure the security of the network and system, the defender cannot slack off for a moment and must provide uninterrupted and comprehensive protection 24 hours a day, 7 days a week. Even so, he must always withstand the fatal breakthroughs brought by the wooden barrel principle.

[0005] (2) Information asymmetry. The attacker can obtain a comprehensive understanding of the target at any time through information collection, network scanning, detection, and reconnaissance. However, the defender, who is in the "light", knows nothing about the attacker in the "dark", including who the attacker is, what his attack intentions are, what attack methods he has, and his own information.

[0006] (3) The consequences are asymmetric. If the attacker fails in a mission, he will suffer very little loss. He can regroup and launch a second, third, or Nth attack at any time. Once the defender's security mechanism is breached, the assets will immediately face the risk of loss and may bring other adverse effects.

[0007] It is precisely because of the above-mentioned unfavorable factors and current situation for the defender that the emergence of honeypots and honeynets is to reverse this asymmetric confrontation situation. By setting up "false targets", the cost of attack is increased and the asymmetry of workload is reversed. By continuously observing the attacker's actions in the honeypot and honeynet, you can understand who the attacker is, what tools he uses, how he operates, and why he attacks you. The capture of honeypots and honeynets is a predictable and controllable result, and usually does not cause losses or adverse effects on real assets. On the contrary, the defender can have the opportunity to discover and locate the attacker's identity through computer forensics technology, analyze and extract the zero-day vulnerability exploit tools used by the attacker through computer forensics technology, so that these tools cannot be used to attack real networks and systems in the first place, but expose the latest attack technology, buy more time for the defender to develop and deploy updated security systems in a timely manner, and reduce the attacker's attack success rate. All of these can deter and restrict the attacker. However, in the existing honeypot technology, the security of the honeypot itself is not taken seriously enough, and its underlying virtualization platform has the problem of escape risk. Summary of the invention

[0008] In view of the problem that in the existing honeypot technology, the security of the honeypot itself is not given enough attention and its underlying virtualization platform has the risk of escape, the present invention discloses a honeypot service system based on a mimicry architecture and a processing method thereof. By utilizing the idea of ​​the mimicry architecture, the virtualization platform of the honeypot system is heterogeneous, the escape of the virtual machine is detected and defended, and attack threat identification and security protection are provided for the cyberspace.

[0009] In order to achieve the above object, the present invention adopts the following technical solutions:

[0010] On one hand, the present invention discloses a honeypot service system based on a mimicry architecture, including a traffic proxy module, a heterogeneous execution body, a kernel monitoring module, a traffic arbitration module and a scheduling module;

[0011] The traffic proxy module is used to receive traffic from the attacker, distribute the traffic from the attacker to each heterogeneous execution body, and send the result fed back by the heterogeneous execution body to the attacker;

[0012] The heterogeneous executor is a honeypot service with the same upper layer application, system service, and operating system but different underlying virtualization platforms; it is used to respond to traffic from attackers and feed back the results to the traffic arbitration module;

[0013] The kernel monitoring module is used to monitor the host machine of the virtualization platform in real time. When the traffic with dangerous instructions enters the heterogeneous execution body and escapes on the virtual machine, the traffic information is sent to the traffic arbitration module for judgment;

[0014] The traffic decision module is used to make a decision based on the feedback results of the kernel monitoring module and the heterogeneous executor, and send the decision result to the scheduling module;

[0015] The scheduling module is used to send instructions to the heterogeneous execution body and the traffic proxy module according to the feedback result of the traffic arbitration module.

[0016] Furthermore, the traffic proxy module embeds multiple protocol proxies and supports WEB, FTP, DNS, and SSH application layer services.

[0017] Furthermore, the traffic proxy module distributes traffic from attackers in the following ways:

[0018] The traffic proxy module adopts a voter mechanism to elect a heterogeneous executor as the default request return executor;

[0019] When an attacker launches an attack, the traffic proxy module calls the forwarding logic chain. For each HTTP request, the forwarding logic chain first updates each heterogeneous executor to detect whether a heterogeneous executor has been offline. If the default request returns that the executor has been offline, a new election is made. After the update is completed, the heterogeneous executors are traversed and the current HTTP request is forwarded to each heterogeneous executor.

[0020] After forwarding a single request, the forwarding logic chain waits for all heterogeneous executors to return responses. If responses from all heterogeneous executors are not received, the currently received response is cached and the attacker is not immediately responded to.

[0021] When the traffic proxy module receives the response packets of all heterogeneous executors, it returns the responses of the heterogeneous executors to the attacker. Before returning, the proxy module changes the response header information, removes the proxy information, and sends the complete response to the attacker.

[0022] Furthermore, the flow determination process of the system includes:

[0023] When a new process is generated by the host machine of the virtualization platform, the process starter is automatically tracked. When it is detected that the process is enabled locally on the host machine, the traffic arbitration module does not generate any alarm; when it is detected that the host machine process is enabled by the internal virtual machine, it is determined to be an escape behavior and the virtual machine is considered to have been compromised.

[0024] After detecting the virtual machine escape, the traffic decision module sends the decision result to the scheduling module. After receiving the notification information from the decision module, the scheduling module queries the basic information of the escaped container or virtual machine, deletes the heterogeneous execution body from the cache database, and notifies the traffic proxy module that the current virtual machine has escaped. At the same time, the scheduling module calls the virtualization program interface to execute offline for this virtual machine or container and schedule a new virtual machine or container.

[0025] After the scheduling module completes the scheduling, it re-updates the heterogeneous executor, writes the current heterogeneous executor information into the cache database, and notifies the traffic proxy module that the current heterogeneous executor has completed scheduling and can provide honeypot services normally. After receiving the message, the traffic proxy module continues to forward traffic to the heterogeneous executor.

[0026] Another aspect of the present invention provides a processing method for a honeypot service system based on a mimicry architecture, comprising:

[0027] The traffic proxy module receives traffic from the attacker and distributes the traffic from the attacker to various heterogeneous execution bodies;

[0028] The heterogeneous executor responds to the traffic from the attacker and feeds the result back to the traffic adjudication module;

[0029] The kernel monitoring module monitors the host machine of the virtualization platform in real time. When traffic with dangerous instructions enters the heterogeneous execution body and escapes on the virtual machine, the traffic information is sent to the traffic arbitration module for judgment;

[0030] The traffic decision module makes decisions based on the feedback from the kernel monitoring module and the heterogeneous executor, and sends the decision results to the scheduling module;

[0031] The scheduling module sends instructions to the heterogeneous executor and traffic proxy module based on the feedback from the traffic arbitration module. If a virtual machine escape occurs, the scheduling module sends instructions to shut down the abnormal heterogeneous executor and clean up the new heterogeneous executor. At the same time, the traffic proxy module is notified that the abnormal heterogeneous executor has been shut down and the traffic is stopped. When the new executor is online, the scheduling module notifies the traffic proxy module to start the traffic proxy service for the new heterogeneous executor.

[0032] The traffic proxy module receives instructions from the scheduling module. Once a heterogeneous executor escapes, it stops sending traffic to the attacked heterogeneous executor, selects one from the remaining heterogeneous executors that have not escaped, and returns its normal message result to the attacker.

[0033] Compared with the prior art, the present invention has the following beneficial effects:

[0034] According to the mimetic defense architecture, the present invention performs heterogeneous processing on the virtualization platform at the bottom of the honeypot, monitors and determines the inflow and outflow traffic in real time, promptly shuts down the escaped execution body, schedules traffic distribution and execution body renewal, realizes the detection and defense of virtual machine escape, and provides security guarantee for intranet protection. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] Figure 1 This is a schematic diagram of the architecture of the mimic architecture honeypot service system according to an embodiment of the present invention;

[0036] Figure 2 This is a schematic diagram of traffic distribution operation according to an embodiment of the present invention;

[0037] Figure 3 This is a schematic diagram of the flow determination operation according to an embodiment of the present invention;

[0038] Figure 4 This is a schematic diagram of the working process of the honeypot service system according to an embodiment of the present invention;

[0039] Figure 5 This is a data flow diagram of the honeypot service system according to an embodiment of the present invention. DETAILED DESCRIPTION

[0040] The present invention will be further explained below with reference to the accompanying drawings and specific embodiments:

[0041] The honeypot system is an active defense technology that traps attacks by deploying simulation systems that have no business use. A honeypot service system based on a mimicry architecture combines mimicry defense technology with the honeypot system in network deception, performs heterogeneous processing on the virtualization platform at the bottom of the honeypot, monitors and determines inbound and outbound traffic in real time, promptly shuts down heterogeneous executors that have escaped, schedules traffic distribution and heterogeneous executors, and implements detection and defense against virtual machine escapes. Figure 1 As shown, a honeypot service system based on a mimicry architecture includes a traffic proxy module, a heterogeneous executor, a kernel monitoring module, a traffic arbitration module and a scheduling module.

[0042] Traffic proxy module: The traffic proxy module has multiple protocol proxies embedded in it, supporting a series of application layer services such as WEB, FTP, DNS, SSH, etc. When an attacker attacks the honeypot system, the system will call different protocol distribution modules according to different protocols (for example, HTTP traffic will call the HTTP protocol distribution module, and SSH will call the SSH protocol distribution module). The protocol distribution module will copy multiple copies of this attack traffic and send them to different heterogeneous executors, and monitor the data packets returned by different heterogeneous executors. After receiving the return packet of the heterogeneous executor, modify its response header information, remove the proxy information, and send a complete response to the attacker.

[0043] Heterogeneous executors: Heterogeneous executors are honeypot services with the same upper-layer applications, system services, and operating systems, but different underlying virtualization platforms. Each heterogeneous executor receives attack traffic copied and distributed by the traffic proxy module and responds with a packet return.

[0044] Kernel monitoring module: Kernel monitoring is deployed on the host machine of each virtualization platform, monitors its process information in real time, and continuously sends the information to the adjudication module for judgment. Once the attacker executes a dangerous command, causing the virtual machine to escape, the adjudication module can quickly respond to the dangerous operation and execute a series of scheduling commands.

[0045] Traffic adjudication module: Receives feedback from multiple heterogeneous executors and kernel monitoring modules in real time, and judges attack traffic through the internal traffic adjudication module. If dangerous attack traffic is found, it immediately sends a command to the scheduling module to clean and roll back the heterogeneous executors to ensure the normal operation of the business.

[0046] Scheduling module: Receives instructions from the traffic arbitration module in real time, and promptly schedules heterogeneous executors and traffic proxy modules to perform corresponding operations to prevent virtual machines from escaping due to attack traffic.

[0047] Specifically, the honeypot service system of the present invention is integrated and deployed on an all-in-one server, which provides a system function for managing the entire honeypot network. When a honeypot service is created on the system, it will send commands to multiple heterogeneous virtualization platforms to start the same service (taking HTTP protocol as an example).

[0048] As an implementable method, there are three honeypot heterogeneous executors, and their construction environment is shown in the following table:

[0049]

[0050]

[0051] The traffic proxy module is also a separate server, whose IP is exposed to the attacker, and is mainly used to interact with the attacker. The attacker's access request will first reach the traffic proxy module, which will copy and forward the traffic to various heterogeneous execution bodies for request interaction, and select one of the return packets to send to the attacker.

[0052] As attached Figure 2 As shown in the figure, the traffic proxy module distributes traffic from attackers in the following ways:

[0053] Before starting the proxy service for the first time, the system will load the heterogeneous executor configuration into the cache database and establish a heterogeneous executor resource pool. After starting the proxy service, the traffic proxy module uses the elector mechanism to elect a heterogeneous executor from the heterogeneous executor resource pool as the default request return executor.

[0054] When an attacker launches an attack on the proxy, the traffic proxy module calls the forwarding logic chain. For each HTTP request, the forwarding logic chain first updates the heterogeneous executor resource pool to detect whether a heterogeneous executor has been offline. If the candidate has been offline, a new election will be held. After the update is completed, the heterogeneous executor resource pool will be traversed to forward the current HTTP request to each heterogeneous executor.

[0055] After the forwarding logic chain forwards a single request, the system needs to wait for all heterogeneous executors in the heterogeneous executor resource pool to return a response. When the responses of all heterogeneous executors are not received, the currently received response is cached and the attacker is not responded to immediately.

[0056] When the traffic proxy module receives the response packets of all heterogeneous executors (that is, the number of response packets is equal to the number of heterogeneous executors in the heterogeneous executor resource pool), the system selects the default request for the heterogeneous executor's response and returns it to the attacker. Before returning, the proxy module changes the response header information, removes the proxy information, and sends the complete response to the attacker. At this point, the processing of a single request is completed.

[0057] As attached Figure 3 As shown, the flow arbitration process of the present invention realizes the anti-escape of the virtual machine, which is specifically described as follows:

[0058] The host machines of each virtualization platform are embedded with a kernel monitoring module, which detects the process-related information of each virtualization platform host machine in real time and transmits the information to the traffic arbitration module. When a new process is generated by the host machine, the program will automatically track the starter of the process. When it is detected that the process is enabled locally on the host machine, the traffic arbitration module will not generate any alarm; when it is detected that the host machine process is enabled for an internal virtual machine, the traffic arbitration module will determine it as an escape behavior and believe that the virtual machine has been compromised.

[0059] After detecting a virtual machine escape, the decision module will send the decision result to the scheduling module. After receiving the notification information from the decision module, the scheduling module distributes it to each virtualization scheduler. Each virtualization scheduler queries the basic information of the escaped container or virtual machine, deletes the heterogeneous execution body from the cache database, and notifies the traffic proxy module that the current virtual machine has escaped. At the same time, the scheduling module calls the virtualization program interface to execute offline for this virtual machine or container, and schedules a new virtual machine or container.

[0060] After the scheduling module completes the scheduling, it will re-update the heterogeneous resource pool, write the current heterogeneous information into the cache database, and notify the traffic proxy module that the current heterogeneous executor has completed the scheduling and can provide the honeypot service normally. After receiving the message, the traffic proxy module will continue to forward the traffic to the heterogeneous executor.

[0061] Based on the above embodiments, as shown in the attached Figure 4 As shown, the present invention also proposes a processing method for a honeypot service system based on a mimic architecture, which is specifically described as follows:

[0062] The system uses a variety of virtualization technologies to achieve virtualization heterogeneity. As an implementable method, this embodiment uses DOCKER, KVM, and VBOX to achieve virtualization heterogeneity. Honeypot services, such as SSH, are installed and deployed on different virtualized heterogeneous executors. At the user interface, a traffic proxy method is used to connect with the user. After the traffic proxy module receives the user's request, it first opens three heterogeneous executor channels, then sends the request information to the three heterogeneous executors through the three channels for execution, and finally returns the processing results to the traffic proxy module through the channel.

[0063] By deploying relevant kernel monitoring modules on different host machines, the process status of the host machine is monitored in real time. When an abnormal new process is detected, the process will be analyzed to determine whether it is a process created by the virtualization program. If it is determined that the new process is a process created by virtualization, it is determined that the attacker is performing a virtualization escape operation. At this time, the heterogeneous executor that is attacked by the escape is taken offline through the scheduling module, and a message is sent to the traffic proxy module to inform the traffic proxy module that a heterogeneous executor has been attacked by the escape and has been taken offline, and request information should no longer be distributed to the heterogeneous executor.

[0064] At the same time, the traffic proxy module selects the execution results from the other two heterogeneous executors and feeds them back to the user. When a heterogeneous executor is offline, the scheduling module will automatically schedule a new heterogeneous executor from the resource pool to replace the offline heterogeneous executor. After the new heterogeneous executor is online, the scheduling module will send a message to the traffic proxy module again to inform that the new heterogeneous executor has been online and the request information can be distributed to the heterogeneous executor through the heterogeneous executor channel normally.

[0065] like Figure 5 As shown in the figure, the data flow diagram of the honeypot service system proposed in the present invention is described in detail as follows:

[0066] Taking the pseudo-SSH honeypot subsystem as an example, the data flow is as follows Figure 5 As shown, the hacker attack request message is sent to the three executors through the send method in the SSHHandler service. At the same time, the mimic agent sends the processing result to the mimic decision module. The decision module outputs the abnormal result according to the decision rule and records the relevant events in the database.

[0067] The above is only a preferred embodiment of the present invention. It should be pointed out that a person skilled in the art can make several improvements and modifications without departing from the principle of the present invention. These improvements and modifications should also be regarded as within the scope of protection of the present invention.

Claims

1. A honeypot service system based on mimicry architecture, characterized in that: It includes traffic proxy module, heterogeneous executor, kernel monitoring module, traffic decision module and scheduling module; The traffic proxy module is used to receive traffic from the attacker, distribute the traffic from the attacker to each heterogeneous execution body, and send the result fed back by the heterogeneous execution body to the attacker; The heterogeneous execution bodies are honeypot services with the same upper layer applications, system services, and operating systems but different underlying virtualization platforms; Used to respond to traffic from attackers and feed the results back to the traffic adjudication module; The kernel monitoring module is used to monitor the host machine of the virtualization platform in real time. When the traffic with dangerous instructions enters the heterogeneous execution body and escapes on the virtual machine, the traffic information is sent to the traffic arbitration module for judgment; The traffic decision module is used to make a decision based on the feedback results of the kernel monitoring module and the heterogeneous executor, and send the decision result to the scheduling module; The scheduling module is used to send instructions to the heterogeneous execution body and the traffic proxy module according to the feedback result of the traffic arbitration module; The process of distributing traffic from attackers by the traffic proxy module includes: The traffic proxy module adopts a voter mechanism to elect a heterogeneous executor as the default request return executor; When an attacker launches an attack, the traffic proxy module calls the forwarding logic chain. For each HTTP request, the forwarding logic chain first updates each heterogeneous executor to detect whether a heterogeneous executor has been offline. If the default request returns that the executor has been offline, a new election is made. After the update is completed, the heterogeneous executors are traversed and the current HTTP request is forwarded to each heterogeneous executor. After forwarding a single request, the forwarding logic chain waits for all heterogeneous executors to return responses. If responses from all heterogeneous executors are not received, the currently received response is cached and the attacker is not immediately responded to. When the traffic proxy module receives the response packets of all heterogeneous executors, it returns the responses of the heterogeneous executors to the attacker. Before returning, the proxy module changes the response header information, removes the proxy information, and sends the complete response to the attacker. The flow determination process of the system includes: When a new process is generated by the host machine of the virtualization platform, the process starter is automatically tracked. When it is detected that the process is enabled locally on the host machine, the traffic arbitration module does not generate any alarm; when it is detected that the host machine process is enabled by the internal virtual machine, it is determined to be an escape behavior and the virtual machine is considered to have been compromised. After detecting the virtual machine escape, the traffic decision module sends the decision result to the scheduling module. After receiving the notification information from the decision module, the scheduling module queries the basic information of the escaped container or virtual machine, deletes the heterogeneous execution body from the cache database, and notifies the traffic proxy module that the current virtual machine has escaped. At the same time, the scheduling module calls the virtualization program interface to execute offline for this virtual machine or container and schedule a new virtual machine or container. After the scheduling module completes the scheduling, it re-updates the heterogeneous executor, writes the current heterogeneous executor information into the cache database, and notifies the traffic proxy module that the current heterogeneous executor has completed the scheduling and provides the honeypot service normally. After receiving the message, the traffic proxy module continues to forward the traffic to the heterogeneous executor.

2. According to the honeypot service system based on mimicry architecture according to claim 1, it is characterized in that: The traffic proxy module embeds multiple protocol proxies and supports WEB, FTP, DNS, and SSH application layer services.

3. A processing method for a honeypot service system based on a mimicry architecture according to any one of claims 1-2, characterized in that: include: The traffic proxy module receives traffic from the attacker and distributes the traffic from the attacker to various heterogeneous execution bodies; The heterogeneous executor responds to the traffic from the attacker and feeds the result back to the traffic adjudication module; The kernel monitoring module monitors the host machine of the virtualization platform in real time. When traffic with dangerous instructions enters the heterogeneous execution body and escapes on the virtual machine, the traffic information is sent to the traffic arbitration module for judgment; The traffic decision module makes decisions based on the feedback from the kernel monitoring module and the heterogeneous executor, and sends the decision results to the scheduling module; The scheduling module sends instructions to the heterogeneous executor and traffic proxy module based on the feedback results of the traffic arbitration module. If a virtual machine escape occurs, the scheduling module sends instructions to shut down the abnormal heterogeneous executor and clean up the new heterogeneous executor. At the same time, the traffic proxy module is notified that the abnormal heterogeneous executor has been closed and the traffic delivery is terminated. When the new executor comes online, the scheduling module notifies the traffic proxy module to start the traffic proxy service for the new heterogeneous executor; The traffic proxy module receives instructions from the scheduling module. Once a heterogeneous executor escapes, it stops sending traffic to the attacked heterogeneous executor, selects one from the remaining heterogeneous executors that have not escaped, and returns its normal message result to the attacker.

Images