Honeypot protection method and device

Abstract

The embodiments of this specification provide a honeypot protection method and device, wherein the honeypot protection method includes: receiving a data access request sent by a client based on a project domain name, wherein the project platform and the honeypot platform have the same project domain name, identifying whether the client is an abnormal access client based on the data access request, and if so, forwarding the data access request to the honeypot platform so that the client can access the honeypot platform. Setting the same project domain name for the project platform and the honeypot platform makes it impossible for the client to identify the honeypot platform, thereby improving the disguise of the honeypot platform and guiding deeper access. When the client is identified as an abnormal access client, the data access request is forwarded to the honeypot platform, avoiding attacks on the project platform by abnormal access clients and protecting the data security of the project platform.

Description

Technical Field

[0001] The embodiments of this specification relate to the field of network security technology, and in particular to a honeypot protection method. Background Art

[0002] With the development of Internet technology, more and more data are deployed on project platforms. Abnormal access clients may damage project platforms, obtain data, change data, and cause serious data security problems.

[0003] Currently, a vulnerable simulated project platform, also known as a honeypot platform, is set up. This platform is used to induce attacks from abnormal access clients, preventing the project platform from being attacked. Furthermore, by collecting attack behavior events from abnormal access clients on the honeypot platform, we can prevent and trace abnormal access clients, thus protecting the security of data on the project platform.

[0004] However, if the honeypot platform's camouflage is insufficient, abnormal access clients will identify the honeypot platform and avoid accessing data on the honeypot platform. This makes it impossible to collect attack behavior events from abnormal access clients on the honeypot platform, making it impossible to prevent and trace abnormal access clients, thus reducing the data security of the project platform. Therefore, a honeypot protection method with high camouflage and the ability to improve the data security of the project platform is urgently needed. Summary of the Invention

[0005] In view of this, embodiments of this specification provide a honeypot protection method. One or more embodiments of this specification also relate to a honeypot protection device, a computing device, a computer-readable storage medium, and a computer program to address technical deficiencies in the prior art.

[0006] According to a first aspect of an embodiment of this specification, a honeypot protection method is provided, which is applied to an access control component integrated on a project platform, including:

[0007] Receive a data access request sent by a client based on a project domain name, where the project platform and the honeypot platform have the same project domain name;

[0008] Identify whether the client is an abnormal access client based on the data access request;

[0009] If so, the data access request is forwarded to the honeypot platform so that the client can access the honeypot platform.

[0010] According to a second method of an embodiment of this specification, a honeypot protection method is provided, which is applied to a honeypot platform, including:

[0011] Receive data access requests forwarded by the project platform, where the data access requests are sent by the client to the project platform based on the project domain name. The project platform and the honeypot platform have the same project domain name;

[0012] According to the data access request, obtain the corresponding honey bait data;

[0013] Feedback the honey bait data to the project platform.

[0014] According to a third aspect of an embodiment of this specification, a honeypot protection system is provided, including a project platform and a honeypot platform. The project platform is integrated with an access control component, including:

[0015] The access control component is used to receive data access requests sent by the client based on the project domain name, where the project platform and the honeypot platform have the same project domain name; based on the data access request, identify whether the client is an abnormal access client; if so, forward the data access request to the honeypot platform to enable the client to access the honeypot platform;

[0016] The honeypot platform is used to receive data access requests forwarded by the project platform; obtain the corresponding honey bait data based on the data access request; and feed the honey bait data back to the project platform.

[0017] According to a fourth aspect of an embodiment of this specification, an access control component is provided. The access control component is integrated into a project platform and includes:

[0018] A first receiving module is configured to receive a data access request sent by a client according to a project domain name, wherein the project platform and the honeypot platform have the same project domain name;

[0019] an identification module configured to identify whether the client is an abnormal access client based on the data access request;

[0020] The forwarding module is configured to forward the data access request to the honeypot platform if yes, so that the client can access the honeypot platform.

[0021] According to a fifth aspect of the embodiments of this specification, a honeypot protection device is provided, which is applied to a honeypot platform, including:

[0022] A second receiving module is configured to receive a data access request forwarded by the project platform, wherein the data access request is sent by the client to the project platform according to the project domain name, and the project platform and the honeypot platform have the same project domain name;

[0023] An acquisition module is configured to acquire corresponding honey bait data according to a data access request;

[0024] The feedback module is configured to feed back the honey bait data to the project platform.

[0025] According to a sixth aspect of the embodiments of this specification, there is provided a computing device, including:

[0026] memory and processor;

[0027] The memory is used to store computer-executable instructions, and the processor is used to execute the computer-executable instructions. When the computer-executable instructions are executed by the processor, the steps of the above-mentioned honeypot protection method are implemented.

[0028] According to a seventh aspect of the embodiments of this specification, a computer-readable storage medium is provided, which stores computer-executable instructions, and when the instructions are executed by a processor, the steps of the above-mentioned honeypot protection method are implemented.

[0029] According to an eighth aspect of the embodiments of this specification, a computer program is provided, wherein when the computer program is executed in a computer, the computer is caused to execute the steps of the above-mentioned honeypot protection method.

[0030] In one or more embodiments of the present specification, a data access request sent by a client based on a project domain name is received, wherein the project platform and the honeypot platform have the same project domain name. Based on the data access request, it is identified whether the client is an abnormal access client. If so, the data access request is forwarded to the honeypot platform so that the client can access the honeypot platform. Setting the same project domain name for the project platform and the honeypot platform makes it impossible for the client to identify the honeypot platform, thereby improving the disguise of the honeypot platform and guiding deeper access. When the client is identified as an abnormal access client, the data access request is forwarded to the honeypot platform, thereby avoiding attacks on the project platform by abnormal access clients and protecting the data security of the project platform. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] Figure 1 This is a schematic diagram of the architecture of a honeypot protection system provided by an embodiment of this specification;

[0032] Figure 2 This is a flow chart of a honeypot protection method provided by one embodiment of this specification;

[0033] Figure 3 This is a flow chart of another honeypot protection method provided by an embodiment of this specification;

[0034] Figure 4 This is a process flow chart of a honeypot protection method for web application data provided by one embodiment of this specification;

[0035] Figure 5 This is a schematic diagram of the structure of a honeypot protection system provided by an embodiment of this specification;

[0036] Figure 6 This is a schematic diagram of the structure of an access control component provided by an embodiment of this specification;

[0037] Figure 7 This is a schematic diagram of the structure of a honeypot protection device provided by an embodiment of this specification;

[0038] Figure 8 This is a structural block diagram of a computing device provided by one embodiment of this specification. DETAILED DESCRIPTION

[0039] The following description sets forth many specific details to facilitate a thorough understanding of this specification. However, this specification can be implemented in many other ways than those described herein, and those skilled in the art can make similar generalizations without violating the scope of this specification. Therefore, this specification is not limited to the specific implementations disclosed below.

[0040] The terms used in one or more embodiments of this specification are for the purpose of describing specific embodiments only and are not intended to limit one or more embodiments of this specification. The singular forms "a," "the," and "the" used in one or more embodiments of this specification and the appended claims are also intended to include plural forms unless the context clearly indicates otherwise. It should also be understood that the term "and / or" used in one or more embodiments of this specification refers to and includes any or all possible combinations of one or more associated listed items.

[0041] It should be understood that although the terms first, second, etc. may be used to describe various information in one or more embodiments of this specification, such information should not be limited to these terms. These terms are only used to distinguish the same type of information from each other. For example, without departing from the scope of one or more embodiments of this specification, the first may also be referred to as the second, and similarly, the second may also be referred to as the first. Depending on the context, the word "if" as used herein may be interpreted as "at the time of" or "when" or "in response to determining".

[0042] First, the terms involved in one or more embodiments of this specification are explained.

[0043] Honeypot Platform: A technology that induces attacks against unauthorized clients. By deploying certain honey bait data, it tricks unauthorized clients into acquiring the bait data and launching attacks. During these attacks, the platform collects and analyzes these unauthorized clients' attack behaviors, improving prevention and response capabilities against unauthorized clients and protecting the data security of the actual project platform. The honeypot platform and the project platform are highly similar, meaning that when unauthorized clients access data on the honeypot platform, it is difficult to detect any differences between the two.

[0044] Domain name: A dot-separated string of names representing a terminal or group of terminals on the Internet. It is used to locate and identify the terminals during data transmission. Domain names correspond to the terminal's IP (Internet Protocol) address.

[0045] URL (Uniform Resource Locator): is a method of indicating the location of information on the World Wide Web service program on the Internet.

[0046] Interface: A class module that encapsulates data access methods during code development. Clients can access data from databases, function nodes, etc. through interfaces.

[0047] Currently, honeypot platforms can be categorized as low-interaction honeypot platforms, high-interaction honeypot platforms, and even pure honeypot platforms based on their interactivity. High-interaction honeypot platforms simulate the interaction between a real project platform and clients, interacting with anomalous clients in a manner that mimics the project platform's interaction. This makes it easier for anomalous clients to be tricked into performing deeper data access, thus enhancing the honeypot platform's camouflage. Because anomalous clients perform deeper data access within a high-interaction honeypot platform, the platform can collect more attack events and conduct deeper analysis of attack behavior and anomalous clients. Compared to low-interaction and pure honeypot platforms, this platform improves its ability to prevent and trace anomalous client access, effectively protecting the data security of the project platform.

[0048] Although the high-interaction honeypot platform has certain advantages over the low-interaction honeypot platform and the pure honeypot platform, since the high-interaction honeypot platform is still deployed separately, it receives data access requests by receiving data access requests sent by the client through a preset domain name or port. This makes the domain name or port have a one-to-one correspondence with the high-interaction honeypot platform. Abnormal access clients can take advantage of this one-to-one correspondence and use the domain name or port to mark the honeypot platform to avoid accessing the high-interaction honeypot platform corresponding to the marked domain name or marked port, making the high-interaction honeypot platform insufficiently disguised, and thus unable to collect attack behavior events of abnormal access clients in the high-interaction honeypot platform, unable to prevent and trace abnormal access clients, and reducing the data security of the project platform.

[0049] In response to the above problems, this specification provides a honeypot protection method. This specification also involves a honeypot protection system, a computing device, and a computer-readable storage medium, which are described in detail one by one in the following embodiments.

[0050] See also Figure 1 , Figure 1 A schematic diagram of the architecture of a honeypot protection system provided by an embodiment of this specification is shown.

[0051] like Figure 1 As shown, the honeypot protection system includes a project platform, a honeypot platform, and a cloud service end. The project platform integrates access control components, and the project data is deployed on the project platform. The project platform is equipped with multiple project ends, and the honeypot platform is equipped with multiple honeypot agent ends.

[0052] The client sends a data access request to the project platform. The access control component intercepts the data access request and, based on the data access request, determines whether the client is a normal access client or an abnormal access client. If the client is a normal access client, the project data is obtained based on the data access request. If the client is an abnormal access client, the data access request is forwarded to the honeypot platform. After forwarding the data access request to the honeypot platform, the honeypot platform collects the client's attack behavior events and sends them to the cloud server. The cloud server generates a detection strategy based on the attack behavior events and sends the detection strategy to the access control component, which then makes a judgment on the client based on the detection strategy.

[0053] See also Figure 2 , Figure 2 A flowchart of a honeypot protection method provided in one embodiment of this specification is shown. The method is applied to an access control component integrated on a project platform and specifically includes the following steps.

[0054] Step 202: Receive a data access request sent by the client according to the project domain name, wherein the project platform and the honeypot platform have the same project domain name.

[0055] The embodiments of this specification are applied to the access control component integrated on the project platform. Since the access control component is integrated on the project platform, that is, in order to access data, the client needs to send a data access request to the project platform. After identifying the client as an abnormal access client, the access control component forwards the data access request to the honeypot platform. This achieves deep integration of the honeypot platform and the real project in the data access part while decoupling the data. This avoids the abnormal access client from obtaining project data without being able to perceive the data access to the honeypot platform, thereby improving the disguise of the honeypot platform and protecting the data security of the project platform.

[0056] A project platform is a data service platform deployed within a network system and hosting project data. For example, it could be a project data server for an application or website, or an organization's project database. A project platform includes multiple project clients, each of which corresponds to a specific data access function. For example, if a client needs to access geographic data on the project platform, it can access the project client where the geographic data resides.

[0057] The access control component is an access traffic control component with functions such as traffic interception, traffic analysis and traffic forwarding. The access control component can be an integrated hardware with the above functions, or an integrated virtual function module with the above functions, for example, a traffic interceptor (Interceptor) set at the traffic entrance of the project platform. The access control component does not have the function of processing project data. The access control component is pre-set with multiple interfaces, each interface corresponds to the data type in the data access request, and forwards the data access request for traffic. The access control component intercepts and analyzes all data access requests sent to the project platform, and forwards them to the project platform or honeypot platform after the analysis is completed. Since the access control component is integrated on the project platform, for the client accessing the project platform, it can only confirm that the data access request is sent to the project platform, but cannot confirm whether it is sent to a specific port. It is impossible to distinguish whether the object of subsequent data access is the project platform or the honeypot platform.

[0058] The project domain name is the access domain name for the project data that the project platform opens to the public. For example, for website "ABC", the access domain names for its open project data are "www.ABC.com", "www.ABC.com / 80", "www.ABC.com / 21", etc. Among them, "80" is the HTTP (Hypertext Transfer Protocol) access port preset for website "ABC", and "21" is the FTP (File Transfer Protocol) access port preset for website "ABC". When the client accesses through the above domain names, the access control component will intercept and analyze the traffic. The project domain name of the project platform and the honeypot platform are the same. The client can only perceive that the data access request has been sent through the project domain name, that is, it cannot determine whether the data access request was sent to the project platform or the honeypot platform.

[0059] A data access request is network transmission data sent by a client to the project platform to request access to project data. The data access request includes access sub-information such as client information, project data information, data access method, and transmission network information. Client information refers to the client's identification information, including the client's IP address, MAC address, and geographic location. Project data information refers to the identification information of the project data, including its name, type, and storage address. Data access methods include GET() and POST(). Transmission network information refers to the identification information of the transmission network between the client and the project platform, including the network transmission protocol and path.

[0060] Exemplarily, the access control component receives a data access request sent by the client based on the project domain name "www.ABC.com", where the data access request includes client information (client IP address, client Mac address, client geographic location), project data information (project data naming, project data type, project data storage address), data access method, and transmission network information (network transmission protocol, network transmission path).

[0061] Receive data access requests sent by the client based on the project domain name. The project platform and the honeypot platform have the same project domain name, which provides a data basis for subsequent identification of whether the client is an abnormal access client. In addition, since the project platform and the honeypot platform have the same project domain name, the disguise of the honeypot platform is improved.

[0062] Step 204: Identify whether the client is an abnormal access client based on the data access request.

[0063] According to the data access request, whether the client is an abnormal access client is identified. Specifically, according to the access information in the data access request, whether the client is an abnormal access client is identified.

[0064] Continuing with the above embodiment, the access control component pre-records the client whose abnormal access reference IP address is an abnormal access client. The access information in the data access request, specifically the client IP address in the client information, is compared with the abnormal access reference IP address. If the client IP address hits the abnormal access reference IP address, the client is determined to be an abnormal access client.

[0065] Based on the data access request, it identifies whether the client is an abnormal access client, providing a reference for the subsequent forwarding of data access requests to the honeypot platform. While ensuring the data security of the project platform, it also improves the stability of the project platform.

[0066] Step 206: If yes, forward the data access request to the honeypot platform, so that the client can access the honeypot platform.

[0067] In the embodiments of this specification, a plurality of honeypot interfaces corresponding to the honeypot platform are provided on the project platform, and a plurality of honeypot proxy terminals are preset in the honeypot platform, and each honeypot interface corresponds to one or more preset honeypot proxy terminals. Each honeypot proxy terminal is a fake project terminal that is pre-set to correspond to the project terminal in the project platform and has a high similarity with the project terminal in the project platform. The honeypot platform is preset to be accessible only by the access control component. The provision of multiple honeypot proxy terminals ensures that after a honeypot proxy terminal is conquered by an abnormal access client, the honeypot platform is difficult to distinguish, and the honeypot platform can still induce the abnormal access client to continue to conduct in-depth access.

[0068] The data access request is forwarded to the honeypot platform so that the client can access the honeypot platform. Specifically, the data access request is forwarded to the corresponding honeypot platform through the honeypot interface so that the abnormal access client can access the honeypot platform.

[0069] Continuing with the above example, the data access request Request is forwarded to the honeypot platform through the honeypot interface 1, so that the abnormal access client can access the honeypot platform.

[0070] In an embodiment of the present specification, a data access request sent by a client based on a project domain name is received, wherein the project platform and the honeypot platform have the same project domain name. Based on the data access request, it is identified whether the client is an abnormal access client. If so, the data access request is forwarded to the honeypot platform so that the client can access the honeypot platform. Setting the same project domain name for the project platform and the honeypot platform makes it impossible for the client to identify the honeypot platform, thereby improving the disguise of the honeypot platform and guiding deeper access. When the client is identified as an abnormal access client, the data access request is forwarded to the honeypot platform, thereby avoiding attacks on the project platform by abnormal access clients and protecting the data security of the project platform.

[0071] Optionally, the project platform and the honeypot platform are deployed in different geographical locations.

[0072] Currently, some solutions deploy the honeypot platform and the project platform in the same geographic location, specifically in the same data center. Consequently, if the honeypot platform is compromised, an unauthorized access client could manipulate the traffic forwarding components and modify their forwarding logic, allowing the honeypot platform to be used as a springboard for attacks against the project platform. Furthermore, since the honeypot platform and the project platform are deployed in the same data center, its operation consumes limited data resources, increasing the performance burden on the data center hardware needed to handle normal project data access.

[0073] In the embodiments of this specification, the project platform and the honeypot platform are deployed in different geographical locations, that is, the project platform and the honeypot platform are deployed in different computer rooms.

[0074] For example, the project platform is deployed in a computer room at site A, and the honeypot platform is deployed in a computer room at site B. The project platform and the honeypot platform are physically isolated from each other.

[0075] Through isolation at the computer room level, the project platform and the honeypot platform are physically isolated. Combined with the execution logic of the access control component mentioned above, that is, abnormal access clients need to send data access requests through the project domain name, making it difficult for abnormal access clients to perceive the existence of the honeypot platform. Even if the honeypot platform is compromised, it is difficult for abnormal access clients to use the access control component to attack project platforms deployed in different geographical locations, thus preventing the honeypot platform from being used as a springboard to attack the project platform. This further improves the data security of the project platform. At the same time, because the honeypot platform and the project platform are deployed in different geographical locations, the operation of the honeypot platform does not consume the resources of the project platform, reducing the performance burden of hardware equipment in handling normal project data access and improving the data processing performance of the project platform.

[0076] Optionally, after step 204, the following specific steps are further included:

[0077] If not, the client is allowed to access the project data in the project platform.

[0078] If the access control component identifies that the client is not an abnormal access client, that is, a normal access client, the normal access client is allowed to access the project data in the project platform normally to ensure that the project platform can provide data access functions normally.

[0079] Allow clients to access project data in the project platform. The specific method is to allow normal access clients to access project data in the project platform through the project interface.

[0080] Exemplarily, a client whose specific network transmission path is pre-recorded in the access control component is an abnormal access client, and the access information in the data access request, specifically the network transmission path in the client's information, is compared with the specific network transmission path. If the network transmission path in the client's information does not have the specific network transmission path, the client is determined to be a normal access client, and the client is allowed to access the project data corresponding to project interface 1 in the project platform through project interface 1.

[0081] If it is identified that the client is not an abnormal access client, the client is allowed to access the project data in the project platform, ensuring that the project platform can provide data access functions normally and ensuring the stability of the project platform.

[0082] Optionally, the project platform includes a project terminal;

[0083] Correspondingly, allowing the client to access the project data in the project platform includes the following specific steps:

[0084] Send data access request to the target project end through the project interface;

[0085] Receive project data returned by the target project end based on the data access request;

[0086] Send project data to the client.

[0087] The project side of the project platform is a data access module configured based on project data. For example, if the project data is the project platform's log data, the project side is the data access module for that log data. A specific data access interface, known as the project interface, is pre-set for the project side. The target project side is the project side corresponding to the type of project data in the data access request sent by the client.

[0088] The data access request is sent to the target project end through the project interface. The specific method is to determine the corresponding project interface based on the project data information in the data access request, establish a data transmission connection with the target project end through the project interface, and send the data access request to the target project end.

[0089] Illustratively, based on the type of project data in the data access request Request: customer personal information, the corresponding project interface 23 is determined, a data transmission connection is established with the customer personal information project end through the project interface 23, and the data access request Request is sent to the customer personal information project end.

[0090] The project data returned by the target project side based on the data access request is received, specifically, the project data returned by the target project side based on the project data information in the data access request is received.

[0091] For example, the project data in the data access request is named "Customer_info", the customer personal information project end obtains the corresponding project data DATA according to the name of the project data, and the access control component receives the project data DATA returned by the customer personal information project end.

[0092] The project interface sends data access requests to the target project side, receives project data returned based on the data access request, and sends the project data to the client. By sending data access requests to the target project side through the project interface, normal access clients can accurately obtain project data, further ensuring that the project platform can provide normal data access functions and the stability of the project platform.

[0093] Optionally, the honeypot platform includes a honeypot agent;

[0094] Correspondingly, the data access request is forwarded to the honeypot platform in step 206, which includes the following specific steps:

[0095] Forward data access requests to the target honeypot agent through the honeypot interface;

[0096] Receive the honey bait data returned by the target honeypot agent based on the data access request;

[0097] Send the honey bait data to the client.

[0098] The honeypot agent in the honeypot platform is a data access function module built for the project data of the corresponding project side. Honey bait data is deployed in the honeypot agent. The honey bait data and the project data have a high similarity. The deployment method of the honey bait data by the honeypot agent is also highly similar to the deployment method of the project side. For example, corresponding to the log data project side, a log data honeypot agent is constructed, in which honey bait data is deployed to forge log data. The log data project side deploys log data in the following way: separate data units (for example, folders) are set according to the number of days. The time information in the log data is in the format of "year-month-day-hour-minute-second". The log data honeypot agent also sets separate data units (for example, folders) according to the number of days. The time information of the honey bait data is also in the format of "year-month-day-hour-minute-second". The target honeypot agent is the honeypot agent corresponding to the information of the project data in the data access request sent by the client. Since there is a high similarity between honey bait data and project data, the deployment method of honey bait data on the honeypot agent side is also highly similar to the deployment method of project data on the project side. When abnormal access clients make abnormal access, it is difficult to distinguish between honey bait data and project data, and it is impossible to distinguish whether the object of data access is the project platform or the honeypot platform, which induces abnormal access clients to perform deeper data access.

[0099] Honey bait data can be constructed by performing at least one of the following methods on the project data: addition, modification, deletion, or masking. It can also be processed using a pre-trained neural network model. Alternatively, honey bait data constructed using the previous two methods can be mixed with some of the project data to obtain the honey bait data. This honey bait data makes it more difficult for anomalous clients to distinguish between the honey bait data and the project data during their access, further inducing the client to conduct deeper data access.

[0100] The data access request is forwarded to the target honeypot agent through the honeypot interface. Specifically, the corresponding honeypot interface is determined based on the information of the project data in the data access request, a data transmission connection is established with the target honeypot agent through the honeypot interface, and the data access request is sent to the target honeypot agent.

[0101] For example, according to the storage address of the project data in the data access request Request being "Browser\UserData\Default" (customer personal information), the corresponding honeypot interface 35 is determined, a data transmission connection is established with the customer personal information honeypot agent through the honeypot interface 35, and the data access request Request is sent to the customer personal information honeypot agent.

[0102] The honey bait data returned by the target honeypot agent based on the data access request is received, specifically, the project data returned by the target project based on the project data information in the data access request is received.

[0103] For example, the storage address of the project data in the data access request is "Browser\User Data\Default", the customer personal information honeypot agent obtains the corresponding project data DATA according to the storage address of the project data, and the access control component receives the project data DATA returned by the customer personal information honeypot agent.

[0104] The data access request is forwarded to the target honeypot agent through the honeypot interface, the honey bait data returned by the target honeypot agent based on the data access request is received, and the honey bait data is sent to the client. By sending the data access request to the target honeypot agent through the honeypot interface, the abnormal access client can accurately obtain the honey bait data, making it more difficult to distinguish between honey bait data and project data, and more difficult to distinguish between the honeypot platform and the project platform, further improving the disguise of the honeypot platform and further ensuring the data security of the project platform.

[0105] Optionally, before step 204, the following specific steps are further included:

[0106] Receive the detection strategy sent by the cloud server, where the detection strategy is generated by the cloud server based on the attack behavior events of the client collected by the honeypot platform;

[0107] Correspondingly, step 204 includes the following specific steps:

[0108] Parse data access requests and obtain access information;

[0109] Use detection strategies to detect access information and identify whether the client is an abnormal access client.

[0110] The cloud service end is a service end that has attack behavior event collection and analysis functions, and can be a cloud server. A data transmission connection exists between the cloud service end and the access control component and the honeypot platform. The data transmission connection between the cloud service end and the access control component is a one-way data transmission connection from the cloud service end to the access control component, and the data transmission connection between the cloud service end and the honeypot platform is a one-way data transmission connection from the honeypot platform to the cloud service end. By setting up such a one-way transmission connection, it is ensured that after being attacked by an abnormal access client, the honeypot platform cannot use the data transmission connection to obtain the detection policy from the cloud service end, modify it, or send the modified detection policy to the access control component, thereby rendering the access control component's traffic analysis and traffic forwarding functions ineffective.

[0111] A detection policy is a client identification strategy generated by the cloud server based on attack behavior events collected by the honeypot platform. The detection policy implements traffic analysis functionality within the access control component. The specific generation process for the detection policy can be achieved by adjusting a manually set initial detection policy based on attack behavior events, or directly derived from analyzing attack behavior events. This is not limited here. Optionally, the detection policy has a corresponding version, and updated versions of the detection policy are generated according to pre-set version generation conditions.

[0112] Access information is reference information for determining the identity of the client, including access sub-information such as the client, project data, data access method and / or the transmission network between the client and the project platform. Access information can be used as a reference to identify whether the client is an abnormal access client. Access information includes client information, project data information, data access method, transmission network information, etc. The client information is the identification information of the client, including the client IP address, client Mac address, client geographic location, etc.; the project data information is the identification information of the project data, including the naming of the project data, the type of project data, the storage address of the project data, etc. The data access method includes GET(), POST() and other methods. The transmission network information is the identification information of the transmission network between the client and the project platform, including the network transmission protocol, network transmission path, etc.

[0113] Receiving a detection policy from a cloud server, specifically by receiving the detection policy from the cloud server via a one-way data transmission connection. Furthermore, the conditions for sending the detection policy can include sending the policy at a preset frequency, sending the policy upon completion of a detection policy update, or sending the policy based on the detection policy version, without limitation.

[0114] For example, the detection strategy sent by the receiving cloud server through a one-way data transmission connection at a preset frequency: once a day: abnormal access reference information: 192.168.6.0-192.168.6.255; XX region, YY region, ZZ region...

[0115] Parse the data access request and obtain access information by using an information recognition tool to identify the data access request and obtain the access information. Specifically, the information recognition tool is a tool with keyword recognition capabilities, such as a regular expression-based information recognition tool or a pre-trained information recognition neural network model.

[0116] Continuing with the above example, using a regular expression-based information identification tool, we can identify the message information of the data access request and obtain the access information: 192.168.6.7; YY region.

[0117] The detection strategy is used to detect the access information and identify whether the client is an abnormal access client. Specifically, the detection strategy is used to detect each access sub-information in the access information and identify whether the client is an abnormal access client. Furthermore, the corresponding abnormal confidence can be calculated based on each access sub-information, and whether the client is an abnormal access client can be determined based on the abnormal confidence corresponding to each access sub-information. The method for calculating the abnormal confidence corresponding to each access sub-information can be to use a pre-trained neural network model or a confidence calculation function, which is not limited here. In addition, each access sub-information can be compared with the abnormal access reference information in the detection strategy. If one or more abnormal access reference information is hit, the client is determined to be an abnormal access client. If one or more abnormal access reference information is not hit, the client is determined to be a normal access client.

[0118] Continuing with the above example, the detection policy records abnormal access reference information. Each access sub-information is compared with the abnormal access reference information in the detection policy, and two abnormal access reference information (192.168.6.7; YY region) are hit, and the client is determined to be an abnormal access client.

[0119] Receive detection strategies from the cloud server. These strategies are generated by the cloud server based on client attack behavior events collected by the honeypot platform. The cloud server then parses data access requests, obtains access information, and uses the detection strategies to detect access information and identify whether the client is an abnormal access client. This improves client identification accuracy and further protects the data security of the project platform.

[0120] See also Figure 3 , Figure 3 A flowchart of another honeypot protection method provided by an embodiment of this specification is shown. The method is applied to a honeypot platform and specifically includes the following steps.

[0121] Step 302: Receive a data access request forwarded by the project platform, wherein the data access request is sent by the client to the project platform according to the project domain name, and the project platform and the honeypot platform have the same project domain name.

[0122] The embodiments of this specification are applied to the honeypot platform. In order to access data, the client needs to send a data access request to the project platform. The project platform forwards the data access request to the honeypot platform, thereby achieving deep integration between the honeypot platform and the real project in the data access part while decoupling the data. After the abnormal access client sends a data access request to the project platform, it is necessary to provide corresponding honey bait data, so that the abnormal access client cannot perceive that it is not accessing data to the project platform, but to the honeypot platform, thereby improving the disguise of the honeypot platform and protecting the data security of the project platform.

[0123] The honeypot platform is preset to be accessible only by the access control component in the project platform.

[0124] The project platform is a data service platform deployed in a network system that records project data. For example, it can be a project data server for an application or website, or an organization's project database. Multiple honeypot interfaces corresponding to the honeypot platform are configured on the project platform.

[0125] Data access request is the network transmission data sent by the client to the project platform to request access to project data.

[0126] The project domain name is the domain name used by the project platform to access project data publicly available. The project domain name for the project platform and the honeypot platform are the same. Clients can only detect data access requests sent via the project domain name, but cannot determine whether the data access request was sent to the project platform or the honeypot platform.

[0127] Receive the data access request forwarded by the project platform, specifically, receive the data access request forwarded by the project platform through the honeypot interface.

[0128] Exemplarily, a data access request Request forwarded by the project platform through the honeypot interface 1 is received.

[0129] By receiving data access requests forwarded by the project platform, a data basis is provided for the subsequent acquisition of corresponding honey bait data. Since the project platform and the honeypot platform have the same project domain name, the client cannot identify the honeypot platform, which improves the camouflage of the honeypot platform.

[0130] Step 304: Obtain corresponding honey bait data according to the data access request.

[0131] Honey bait data is fake project data constructed based on the corresponding project data, and there is a high similarity between the honey bait data and the project data.

[0132] According to the data access request, the corresponding honey bait data is obtained. Specifically, the corresponding honey bait data is obtained according to the access information of the data access request.

[0133] Access information is reference information for determining the identity of the client, including access sub-information such as the client, project data, data access method and / or the transmission network between the client and the project platform. Access information can be used as a reference to identify whether the client is an abnormal access client. Access information includes client information, project data information, data access method, transmission network information, etc. Client information is the identification information of the client, including client IP address, client Mac address, client geographic location, etc.; project data information is the identification information of the project data, including the naming of the project data, the type of project data, the storage address of the project data, etc. Data access methods include GET(), POST() and other methods. Transmission network information is the identification information of the transmission network between the client and the project platform, including network transmission protocol, network transmission path, etc.

[0134] Continuing with the above example, according to the name of the item data in the data access request Request "Customer_info", the corresponding honey bait data Fake_DATA is obtained.

[0135] By obtaining the corresponding honey bait data based on data access requests, a data basis is provided for the subsequent feedback of the honey bait data to the project platform, ensuring that the honey bait data with high similarity to the project data is obtained, making it impossible for the client to identify the honeypot platform, further improving the disguise of the honeypot platform.

[0136] Step 306: Feedback the honey bait data to the project platform.

[0137] After the honey bait data is fed back to the project platform, the project platform forwards the honey bait data to the client. This method of forwarding the honey bait data to the client through the project platform ensures that the client does not directly transmit data with the honeypot platform, making it difficult for abnormal access clients to detect the existence of the honeypot platform, and inducing abnormal access clients to continue to access the honeypot platform in depth.

[0138] Feedback the honey bait data to the project platform. Specifically, the honey bait data is fed back to the project platform through the honeypot interface.

[0139] Exemplarily, the honey bait data Fake_DATA is fed back to the project platform through the honeypot interface 1, so that the project platform forwards the honey bait data Fake_DATA to the client.

[0140] In an embodiment of the present specification, a data access request forwarded by a project platform is received, wherein the data access request is sent by a client to the project platform based on the project domain name, and the project platform and the honeypot platform have the same project domain name. According to the data access request, the corresponding honey bait data is obtained and the honey bait data is fed back to the project platform. The same project domain name is set for the project platform and the honeypot platform, so that the client cannot identify the honeypot platform. According to the data access request, the corresponding honey bait data is obtained, which ensures that the honey bait data with high similarity to the project data is obtained, so that the client cannot identify the honeypot platform, thereby improving the disguise of the honeypot platform. The honeypot platform feeds the honey bait data back to the project platform and does not directly transmit data with the client, making it difficult for abnormal access clients to feel the existence of the honeypot platform, further improving the disguise of the honeypot platform, avoiding abnormal access clients from attacking the project platform, and protecting the data security of the project platform.

[0141] Optionally, the honeypot platform and the project platform are deployed in different geographical locations.

[0142] Figure 2 This embodiment has been described in detail in the embodiments and will not be repeated here.

[0143] Optionally, the honeypot platform includes a honeypot agent;

[0144] Correspondingly, before step 304, the following specific steps are also included:

[0145] Determine the client's access rights to the target honeypot agent based on the data access request;

[0146] When the client has access rights to the target honeypot agent, the client obtains corresponding honey bait data from the target honeypot agent according to the access rights.

[0147] The honeypot platform is pre-installed with multiple honeypot agents, each of which corresponds to a honeypot interface on a project platform. Each honeypot agent is a fake project agent that is pre-set to correspond to the project agent in the project platform and has a high similarity with the project agent in the project platform. Setting up multiple honeypot agents ensures that after a honeypot agent is attacked by an abnormal access client, the honeypot platform can still induce the abnormal access client to continue to conduct in-depth access when the honeypot platform is difficult to distinguish. Generally, the project end in the project platform has access rights. For example, the project end corresponding to the platform management key requires an administrator to access it. Therefore, it is necessary to set the corresponding access rights for the honeypot agent to increase the difficulty of attacking the honeypot platform and the similarity between the honeypot platform and the project platform, thereby improving the disguise of the honeypot platform. The target honeypot agent is the honeypot agent that corresponds to the information of the project data in the data access request.

[0148] Access permissions represent the client's data access rights to some or all data deployed on the honeypot agent. Specific access permissions include class and method call permissions set at the application layer and container data access permissions at the container layer. For example, some classes and methods may present high-risk risks. Calling these classes and method data on the project side requires corresponding call permissions. Therefore, call permissions are set on the honeypot agent for these high-risk classes and method data. Similarly, data in some containers cannot be accessed, and corresponding access permissions are set.

[0149] The access rights of the client to the target honeypot agent are determined based on the data access request. Specifically, the access rights of the client to the target honeypot agent are determined based on the access information in the data access request. Furthermore, the access rights of the client to the target honeypot agent are determined based on the client information in the data access request.

[0150] For example, based on the client IP address 192.168.2.7 in the data access request, it is determined that the client's access permission to the target honeypot agent is: permission to all data. Based on the access permission (permission to all data), the corresponding honey bait data Fake_DATA is obtained from the target honeypot agent.

[0151] Based on the data access request, the client's access rights to the target honeypot agent are determined. If the client has access rights to the target honeypot agent, the corresponding honey bait data is obtained from the target honeypot agent based on the access rights. This increases the difficulty of attacking the honeypot platform and the similarity between the honeypot platform and the project platform, further improving the camouflage of the honeypot platform.

[0152] Optionally, the method further includes the following specific steps:

[0153] Collect client attack behavior events;

[0154] The attack behavior event is sent to the cloud server so that the cloud server generates a detection strategy based on the attack behavior event. The detection strategy is used by the access control component integrated on the project platform to identify whether the client is an abnormal access client using the detection strategy.

[0155] The cloud server is a server that collects and analyzes attack behavior events and distributes detection strategies. A data transmission connection exists between the cloud server and the access control component and the honeypot platform. This connection is a one-way one, from the honeypot platform to the cloud server. This ensures that the honeypot platform cannot obtain detection strategies from the cloud server through the data transmission connection if compromised by an unauthorized access client.

[0156] The detection strategy is a client identification strategy generated by the cloud server based on attack behavior events collected by the honeypot platform. The detection strategy implements traffic analysis functionality within the access control component. The specific generation process for the detection strategy can be achieved by adjusting a manually set initial detection strategy based on attack behavior events, or directly by analyzing attack behavior events. The specific analysis method for attack behavior events can be to extract access information from attack behavior events and then analyze them using a neural network model. Optionally, the detection strategy has a corresponding version, and an updated version of the detection strategy is generated according to preset version generation conditions.

[0157] The attack behavior event is sent to the cloud server via a one-way data transmission connection. Furthermore, the sending condition can be based on a preset frequency or after the client completes the attack on the honeypot platform, which is not limited here.

[0158] For example, the attack behavior event Logs are sent to the cloud service end through a one-way data transmission connection at a preset frequency of once per hour.

[0159] Collect attack behavior events from clients and send them to the cloud server, which then generates detection strategies based on these events. These strategies are then used by the access control components integrated into the project platform to identify clients as anomalous. This improves client identification accuracy, protecting the project platform from attacks. Furthermore, by collecting attack behavior events from anomalous clients in the honeypot platform, we can prevent and trace anomalous access to clients, thus protecting data security on the project platform.

[0160] The following combined Figure 4 , taking the application of the honeypot protection method provided in this specification to web application data as an example, the honeypot protection method is further explained. Figure 4 A flowchart of a processing process of a honeypot protection method applied to web application data provided by an embodiment of this specification is shown, which specifically includes the following steps.

[0161] Step 402: Receive the detection strategy sent by the cloud server;

[0162] The embodiments of this specification are applied to a traffic interceptor integrated on a web application platform.

[0163] The detection strategy is generated by the cloud server based on the historical attack behavior events sent by the honeypot platform.

[0164] Step 404: receiving a request for accessing web application data sent by the client according to the network domain name of the web application, wherein the network domain name of the web application platform is the same as the network domain name of the honeypot platform, and the web application platform and the honeypot platform are deployed in different computer rooms;

[0165] The web application's network domain name is the publicly available location identifier of the web application.

[0166] Step 406: Parse the access request for the web application data and obtain access information;

[0167] Step 408: Using the detection strategy, detect the access information to identify whether the client is an abnormal access client;

[0168] Step 410: If not, send the access request to the target web application data terminal of the web application platform through the web application data interface;

[0169] Step 412: Receive the web application data returned by the target web application data terminal based on the access request;

[0170] Step 414: Send the web application data to the client;

[0171] Step 416: If yes, forward the access request to the target honeypot agent in the honeypot platform through the honeypot interface;

[0172] The target honeypot proxy is a pre-built data access function module that has a high similarity with the web application data terminal.

[0173] Step 418: Receive the honey bait data returned by the target honeypot agent based on the access request;

[0174] Honey bait data is pre-set fake application data that has a high similarity to web application data.

[0175] Step 420: Send the honey bait data to the client.

[0176] In the embodiments of this specification, the web application platform and the honeypot platform are assigned the same project domain name, making it impossible for clients to identify the honeypot platform, thereby enhancing the honeypot platform's disguise. The web application platform and the honeypot platform are deployed in different computer rooms. This makes it difficult for unauthorized access clients to attack the web application platform even after the honeypot platform is compromised, preventing the honeypot platform from being used as a springboard for attacks against the web application platform. This further enhances the data security of the web application platform and reduces the performance burden on hardware devices handling normal web application data access, thereby improving the data processing performance of the web application platform. A detection strategy is used to detect access information and identify whether the client is an unauthorized access client, improving identification accuracy, preventing unauthorized access clients from attacking the web application platform, and protecting the data security of the web application data on the web application platform. When the client is identified as a normal access client, an access request is sent to the target web application data terminal of the web application platform via the web application data interface. The target web application data terminal then receives the web application data returned based on the access request, ensuring that the project platform can provide normal data access functions and maintaining the stability of the project platform. When the client is identified as an abnormal access client, the access request is forwarded to the target honeypot agent in the honeypot platform through the honeypot interface, the honey bait data returned by the target honeypot agent based on the access request is received, and the honey bait data is sent to the client, making it difficult for the abnormal access client to feel the existence of the honeypot platform, further improving the camouflage of the honeypot platform, avoiding the attack behavior of the abnormal access client on the web application platform, and further protecting the data security of the web application platform.

[0177] Corresponding to the above method embodiment, this specification also provides a honeypot protection system embodiment, Figure 5 FIG1 shows a schematic diagram of the structure of a honeypot protection system provided by an embodiment of this specification. Figure 5 As shown, the system includes a project platform 502 and a honeypot platform 504. The project platform is integrated with an access control component 5022;

[0178] The access control component 5022 is configured to receive a data access request sent by a client based on a project domain name, where the project platform 502 and the honeypot platform 504 have the same project domain name; identify whether the client is an abnormal access client based on the data access request; if so, forward the data access request to the honeypot platform 504, so that the client can access the honeypot platform 504;

[0179] The honeypot platform 504 is used to receive data access requests forwarded by the project platform 502 ; obtain corresponding honey bait data according to the data access request; and feed the honey bait data back to the project platform 502 .

[0180] Optionally, the system further includes a cloud service terminal 506;

[0181] The cloud service terminal 506 is used to receive the attack behavior events of the client sent by the honeypot platform 504; generate a detection strategy based on the attack behavior events; and send the detection strategy to the project platform 502;

[0182] The access control component 5022 is further configured to receive a detection policy, and use the detection policy to detect access information in a data access request to identify whether the client is an abnormal access client.

[0183] In the embodiments of this specification, the same project domain name is set for the project platform and the honeypot platform, so that the client cannot identify the honeypot platform, which improves the disguise of the honeypot platform and guides deeper access. When the client is identified as an abnormal access client, the data access request is forwarded to the honeypot platform, avoiding the abnormal access client's attack on the project platform and protecting the data security of the project platform. The attack behavior events of the client sent by the honeypot platform are received, and a detection strategy is generated according to the attack behavior events, and the detection strategy is sent to the project platform. The accuracy of client identification is improved, and the project platform is prevented from being attacked. By collecting the attack behavior events of the abnormal access client in the honeypot platform, the abnormal access client is prevented and traced, thereby protecting the security of the data on the project platform.

[0184] The above is a schematic scheme of a honeypot protection system of this embodiment. It should be noted that the technical scheme of the honeypot protection system and the technical scheme of the honeypot protection method described above are of the same concept. For details not described in detail in the technical scheme of the honeypot protection system, please refer to the description of the technical scheme of the honeypot protection method described above.

[0185] Corresponding to the above method embodiment, this specification also provides an access control component embodiment, Figure 6 FIG1 shows a schematic diagram of the structure of an access control component provided by an embodiment of this specification, wherein the access control component is integrated into the project platform. Figure 6 As shown, the component includes:

[0186] The first receiving module 602 is configured to receive a data access request sent by a client according to a project domain name, wherein the project platform and the honeypot platform have the same project domain name;

[0187] Identification module 604, configured to identify whether the client is an abnormal access client according to the data access request;

[0188] The forwarding module 606 is configured to forward the data access request to the honeypot platform if yes, so that the client can access the honeypot platform.

[0189] Optionally, the project platform and the honeypot platform are deployed in different geographical locations.

[0190] Optionally, the component further includes:

[0191] The release module is configured to allow the client to access the project data in the project platform if no.

[0192] Optionally, the project platform includes a project terminal;

[0193] Correspondingly, the release module can be further configured as follows:

[0194] Send a data access request to the target project side through the project interface; receive the project data returned by the target project side based on the data access request; and send the project data to the client.

[0195] Optionally, the honeypot platform includes a honeypot agent;

[0196] Correspondingly, the forwarding module 606 is further configured to:

[0197] The data access request is forwarded to the target honeypot agent through the honeypot interface; the honey bait data returned by the target honeypot agent based on the data access request is received; and the honey bait data is sent to the client.

[0198] Optionally, the component further includes:

[0199] A detection strategy receiving module is configured to receive a detection strategy sent by the cloud server, wherein the detection strategy is generated by the cloud server based on the attack behavior events of the client collected by the honeypot platform;

[0200] Correspondingly, the identification module 604 is further configured to:

[0201] Parse data access requests and obtain access information; use detection strategies to detect access information and identify whether the client is an abnormal access client.

[0202] In an embodiment of the present specification, a data access request sent by a client based on a project domain name is received, wherein the project platform and the honeypot platform have the same project domain name. Based on the data access request, it is identified whether the client is an abnormal access client. If so, the data access request is forwarded to the honeypot platform so that the client can access the honeypot platform. Setting the same project domain name for the project platform and the honeypot platform makes it impossible for the client to identify the honeypot platform, thereby improving the disguise of the honeypot platform and guiding deeper access. When the client is identified as an abnormal access client, the data access request is forwarded to the honeypot platform, thereby avoiding attacks on the project platform by abnormal access clients and protecting the data security of the project platform.

[0203] The above is a schematic scheme of an access control component of this embodiment. It should be noted that the technical solution of this access control component and the technical solution of the above-mentioned honeypot protection method are based on the same concept. For details not described in detail in the technical solution of the access control component, please refer to the description of the technical solution of the above-mentioned honeypot protection method.

[0204] Corresponding to the above method embodiment, this specification also provides a honeypot protection device embodiment, Figure 7 FIG1 shows a schematic diagram of the structure of a honeypot protection device provided by an embodiment of this specification, which is applied to a honeypot platform. Figure 7 As shown, the device includes:

[0205] The second receiving module 702 is configured to receive a data access request forwarded by the project platform, wherein the data access request is sent by the client to the project platform according to the project domain name, and the project platform and the honeypot platform have the same project domain name;

[0206] The acquisition module 704 is configured to acquire corresponding honey bait data according to the data access request;

[0207] The feedback module 706 is configured to feed back the honey bait data to the project platform.

[0208] Optionally, the honeypot platform and the project platform are deployed in different geographical locations.

[0209] Optionally, the honeypot platform includes a honeypot agent;

[0210] Correspondingly, the device further includes:

[0211] The access permission determination module is configured to determine the client's access permission to the target honeypot agent according to the data access request; if the client has access permission to the target honeypot agent, the module obtains the corresponding honey bait data from the target honeypot agent according to the access permission.

[0212] Optionally, the device further comprises:

[0213] The attack behavior event sending module is configured to collect attack behavior events from the client; send the attack behavior events to the cloud server so that the cloud server generates a detection strategy based on the attack behavior events. The detection strategy is used by the access control component integrated on the project platform to use the detection strategy to identify whether the client is an abnormal access client.

[0214] In an embodiment of the present specification, a data access request forwarded by a project platform is received, wherein the data access request is sent by a client to the project platform based on the project domain name, and the project platform and the honeypot platform have the same project domain name. According to the data access request, the corresponding honey bait data is obtained and the honey bait data is fed back to the project platform. The same project domain name is set for the project platform and the honeypot platform, so that the client cannot identify the honeypot platform. According to the data access request, the corresponding honey bait data is obtained, which ensures that the honey bait data with high similarity to the project data is obtained, so that the client cannot identify the honeypot platform, thereby improving the disguise of the honeypot platform. The honeypot platform feeds the honey bait data back to the project platform and does not directly transmit data with the client, making it difficult for abnormal access clients to feel the existence of the honeypot platform, further improving the disguise of the honeypot platform, avoiding abnormal access clients from attacking the project platform, and protecting the data security of the project platform.

[0215] The above is a schematic scheme of a honeypot protection device of this embodiment. It should be noted that the technical scheme of the honeypot protection device and the technical scheme of the above-mentioned honeypot protection method are of the same concept. For details not described in detail in the technical scheme of the honeypot protection device, please refer to the description of the technical scheme of the above-mentioned honeypot protection method.

[0216] Figure 8 8. The block diagram of a computing device according to one embodiment of the present disclosure is shown. Components of the computing device 800 include, but are not limited to, a memory 810 and a processor 820. The processor 820 is connected to the memory 810 via a bus 830, and a database 850 is used to store data.

[0217] The computing device 800 also includes an access device 840 that enables the computing device 800 to communicate via one or more networks 860. Examples of such networks include a public switched telephone network (PSTN), a local area network (LAN), a wide area network (WAN), a personal area network (PAN), or a combination of communication networks such as the Internet. The access device 840 may include one or more of any type of network interface (e.g., a network interface card (NIC)) whether wired or wireless, such as an IEEE 802.11 wireless local area network (WLAN) wireless interface, a World Interoperability for Microwave Access (Wi-MAX) interface, an Ethernet interface, a universal serial bus (USB) interface, a cellular network interface, a Bluetooth interface, a near field communication (NFC) interface, and the like.

[0218] In one embodiment of the present specification, the above components of the computing device 800 and Figure 8 Other components not shown in the figure may also be connected to each other, for example, via a bus. Figure 8 The computing device structure block diagram shown is for illustrative purposes only and is not intended to limit the scope of this specification. Those skilled in the art may add or replace other components as needed.

[0219] The computing device 800 can be any type of stationary or mobile computing device, including a mobile computer or mobile computing device (e.g., a tablet computer, a personal digital assistant, a laptop computer, a notebook computer, a netbook computer, etc.), a mobile phone (e.g., a smartphone), a wearable computing device (e.g., a smartwatch, smart glasses, etc.), or other types of mobile devices, or a stationary computing device such as a desktop computer or PC. The computing device 800 can also be a mobile or stationary server.

[0220] The processor 820 is configured to execute the following computer-executable instructions, which implement the steps of the above-mentioned honeypot protection method when executed by the processor.

[0221] The above is a schematic diagram of a computing device according to this embodiment. It should be noted that the technical solution of the computing device and the technical solution of the honeypot protection method described above are of the same concept. For details not described in detail in the technical solution of the computing device, please refer to the description of the technical solution of the honeypot protection method described above.

[0222] An embodiment of the present specification further provides a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, implement the steps of the above-mentioned honeypot protection method.

[0223] The above is a schematic diagram of a computer-readable storage medium according to this embodiment. It should be noted that the technical solution of this storage medium is identical to the technical solution of the honeypot protection method described above. For details not described in detail in the technical solution of the storage medium, please refer to the description of the technical solution of the honeypot protection method described above.

[0224] An embodiment of the present specification further provides a computer program, wherein when the computer program is executed in a computer, the computer is caused to execute the steps of the above-mentioned honeypot protection method.

[0225] The above is a schematic scheme of a computer program of this embodiment. It should be noted that the technical scheme of this computer program and the technical scheme of the above-mentioned honeypot protection method are based on the same concept. For details not described in detail in the technical scheme of the computer program, please refer to the description of the technical scheme of the above-mentioned honeypot protection method.

[0226] The foregoing description of this specification describes specific embodiments. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recited in the claims can be performed in an order different from that described in the embodiments and still achieve the desired results. Furthermore, the processes depicted in the accompanying drawings do not necessarily require the specific order shown or the sequential order to achieve the desired results. In certain embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0227] The computer instructions include computer program code, which may be in source code form, object code form, executable file, or some intermediate form. The computer-readable medium may include any entity or device capable of carrying the computer program code, a recording medium, a USB flash drive, a mobile hard drive, a magnetic disk, an optical disk, a computer memory, a read-only memory (ROM), a random access memory (RAM), an electrical carrier signal, a telecommunications signal, and a software distribution medium.

[0228] It should be noted that for the aforementioned method embodiments, for the sake of simplicity of description, they are all expressed as a series of action combinations, but those skilled in the art should be aware that the embodiments of this specification are not limited by the order of the actions described, because according to the embodiments of this specification, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in this specification are all preferred embodiments, and the actions and modules involved are not necessarily required by the embodiments of this specification.

[0229] In the above embodiments, the description of each embodiment has its own focus. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0230] The preferred embodiments disclosed above are intended only to help illustrate this specification. The optional embodiments do not exhaustively describe all details, nor do they limit the invention to the specific embodiments described. Obviously, many modifications and variations can be made based on the content of the embodiments of this specification. This specification selects and specifically describes these embodiments in order to better explain the principles and practical applications of the embodiments of this specification, so that those skilled in the art can better understand and utilize this specification. This specification is limited only by the claims and their full scope and equivalents.

Claims

1. A honeypot protection method, applied to the access control component integrated on the project platform, including: Receiving a data access request sent by a client according to a project domain name, wherein the project platform and the honeypot platform have the same project domain name, the project platform includes multiple project terminals, each project terminal corresponds to a specific data access function, the project platform is provided with multiple honeypot interfaces corresponding to the honeypot platform, the honeypot platform is preset with multiple honeypot proxy terminals, each of the honeypot interfaces corresponds to one or more preset honeypot proxy terminals, and the honeypot proxy terminals are fake project terminals pre-set to correspond to the project terminals in the project platform; identifying, according to the data access request, whether the client is an abnormal access client; If so, the data access request is forwarded to the honeypot platform so that the client can access the honeypot platform, wherein the data access request is forwarded to the honeypot platform so that the client can access the honeypot platform, including: forwarding the data access request to the corresponding honeypot agent in the honeypot platform through the honeypot interface so that the abnormal access client can access the honeypot platform.

2. According to the method of claim 1, the project platform and the honeypot platform are deployed in different geographical locations.

3. The method according to claim 1, after identifying whether the client is an abnormal access client based on the data access request, further comprising: If not, the client is allowed to access the project data in the project platform.

4. The method according to claim 3, wherein the project platform includes a project terminal; and allowing the client to access the project data in the project platform comprises: Sending the data access request to the target project end through the project interface; Receiving project data returned by the target project end based on the data access request; The project data is sent to the client.

5. The method according to claim 1, wherein the honeypot platform includes a honeypot agent; and forwarding the data access request to the honeypot platform comprises: Forwarding the data access request to the target honeypot agent through the honeypot interface; Receiving honey bait data returned by the target honeypot agent based on the data access request; The honey bait data is sent to the client.

6. The method according to any one of claims 1 to 5, before identifying whether the client is an abnormal access client based on the data access request, further comprising: Receiving a detection strategy sent by a cloud service end, wherein the detection strategy is generated by the cloud service end based on attack behavior events of the client collected by the honeypot platform; The step of identifying whether the client is an abnormal access client according to the data access request includes: Parsing the data access request to obtain access information; The access information is detected using the detection strategy to identify whether the client is an abnormal access client.

7. A honeypot protection method, applied to a honeypot platform, comprising: Receiving a data access request forwarded by a project platform, wherein the data access request is sent by a client to the project platform according to a project domain name, the project platform and the honeypot platform have the same project domain name, the project platform includes multiple project terminals, each project terminal corresponds to a specific data access function, multiple honeypot interfaces corresponding to the honeypot platform are set on the project platform, the honeypot platform is preset with multiple honeypot proxy terminals, each of the honeypot interfaces corresponds to one or more preset honeypot proxy terminals, and the honeypot proxy terminal is a fake project terminal pre-set to correspond to a project terminal in the project platform, and receiving the data access request forwarded by the project platform includes: receiving the data access request forwarded by the project platform through the honeypot interface; According to the data access request, obtain corresponding honey bait data; Feedback the honey bait data to the project platform.

8. The method according to claim 7, wherein the honeypot platform and the project platform are deployed in different geographical locations.

9. The method according to claim 7, wherein the honeypot platform includes a honeypot agent; and before obtaining the corresponding honey bait data according to the data access request, further comprising: Determining access rights of the client to the target honeypot agent according to the data access request; In the case that the client has access rights to the target honeypot agent, corresponding honey bait data is obtained from the target honeypot agent according to the access rights.

10. The method according to any one of claims 7 to 9, further comprising: Collecting attack behavior events of the client; The attack behavior event is sent to the cloud service end so that the cloud service end generates a detection strategy based on the attack behavior event. The detection strategy is used by the access control component integrated on the project platform to identify whether the client is an abnormal access client using the detection strategy.

11. A honeypot protection system, comprising a project platform and a honeypot platform, wherein the project platform is integrated with an access control component; The access control component is used to receive a data access request sent by a client according to a project domain name, wherein: The project platform and the honeypot platform have the same project domain name. The project platform includes multiple project terminals, each of which corresponds to a specific data access function. The project platform is provided with multiple honeypot interfaces corresponding to the honeypot platform. The honeypot platform is preset with multiple honeypot proxy terminals, each of which corresponds to one or more preset honeypot proxy terminals. The honeypot proxy terminals are fake project terminals that are pre-set to correspond to the project terminals in the project platform. According to the data access request, it is identified whether the client is an abnormal access client; If so, forwarding the data access request to the honeypot platform so that the client can access the honeypot platform, wherein forwarding the data access request to the honeypot platform so that the client can access the honeypot platform comprises: forwarding the data access request to the corresponding honeypot agent in the honeypot platform through the honeypot interface so that the abnormal access client can access the honeypot platform; The honeypot platform is configured to receive the data access request forwarded by the project platform; obtain corresponding honey bait data according to the data access request; and feed the honey bait data back to the project platform.

12. The system according to claim 11, further comprising a cloud service terminal; The cloud service end is used to receive the attack behavior event of the client sent by the honeypot platform; generate a detection strategy according to the attack behavior event; and send the detection strategy to the project platform; The access control component is further configured to receive the detection strategy, and use the detection strategy to detect access information in the data access request to identify whether the client is an abnormal access client.

13. A computing device comprising: memory and processor; The memory is used to store computer-executable instructions, and the processor is used to execute the computer-executable instructions. When the computer-executable instructions are executed by the processor, the steps of the honeypot protection method according to any one of claims 1 to 10 are implemented.

14. A computer-readable storage medium storing computer-executable instructions, wherein the computer-executable instructions, when executed by a processor, implement the steps of the honeypot protection method according to any one of claims 1 to 10.

Images