Information acquisition method, device, electronic device and storage medium

Abstract

Embodiments of the present invention are applicable to the field of computer technology and provide an information acquisition method, device, electronic device, and storage medium, wherein the information acquisition method includes: upon obtaining a first access request for a set path, sending an identity authentication response to the sender of the first access request, wherein the identity authentication response is in the form of: a query / response identity authentication protocol NTLM authentication invitation; obtaining an NTLM authentication request initiated by the sender based on the NTLM authentication invitation; and obtaining the sender's identity information based on the NTLM authentication request.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to an information acquisition method, device, electronic device and storage medium. Background Art

[0002] Related technologies obtain attacker information by using JSONP requests to capture the virtual identity information logged into third-party applications (such as Weibo or Baidu Netdisk) on the attacker's host. This method of obtaining attacker information has a disadvantage: the attacker must have logged into the third-party application in a browser and the identity information must still be valid. Generally, attackers use relatively clean browsers, making it difficult to obtain attacker information. Summary of the Invention

[0003] To solve the above problems, embodiments of the present invention provide an information acquisition method, apparatus, electronic device, and storage medium, which at least solve the problem that related technologies have difficulty in capturing attacker information.

[0004] The technical solution of the present invention is achieved as follows:

[0005] In a first aspect, an embodiment of the present invention provides an information acquisition method, the method comprising:

[0006] In the case of obtaining a first access request for the set path, sending an identity authentication response to the sender of the first access request, wherein the identity authentication response is in the form of a challenge / response NTLM authentication invitation;

[0007] Obtaining an NTLM authentication request initiated by the sender based on the NTLM authentication invitation;

[0008] The identity information of the sender is obtained based on the NTLM authentication request.

[0009] In the above solution, the first access request is an HTTP request, and the identity authentication response is a 401 authentication response.

[0010] In the above solution, the method is applied to a honeypot; the first access request is specifically an access request directed to the honeypot by setting the network device diversion path to the set path.

[0011] In the above solution, the sending of the NTLM authentication invitation to the sender of the first access request includes:

[0012] The file accessed by the first access request is returned as a response, wherein the preset configuration of the file includes an NTLM authentication code.

[0013] In the above solution, obtaining the identity information of the sender based on the NTLM authentication request includes:

[0014] generating a challenge data packet, and sending the challenge data packet to the sender;

[0015] Obtaining a response data packet sent by the sender; the sender generates the response data packet based on the challenge data packet; the response data packet includes host information of the sender;

[0016] The response data packet is parsed to obtain the identity information of the sender.

[0017] In the above solution, the identity information includes host information.

[0018] In the above solution, after obtaining the identity information of the sender based on the NTLM authentication request, the method further includes:

[0019] The sender's identity information is added to a set blacklist for subsequent data analysis or access interception.

[0020] In a second aspect, an embodiment of the present invention provides an information acquisition device, the device comprising:

[0021] a sending module configured to, upon receiving a first access request for a set path, send an identity authentication response to a sender of the first access request, wherein the identity authentication response is in the form of a challenge / response NTLM authentication invitation;

[0022] A first acquisition module is configured to acquire an NTLM authentication request initiated by the sender based on the NTLM authentication invitation;

[0023] The second acquisition module is used to obtain the identity information of the sender based on the NTLM authentication request.

[0024] In a third aspect, an embodiment of the present invention provides an electronic device comprising a processor and a memory, wherein the processor and the memory are connected to each other, wherein the memory is used to store a computer program, the computer program comprises program instructions, and the processor is configured to call the program instructions to execute the steps of the information acquisition method provided in the first aspect of the embodiment of the present invention.

[0025] In a fourth aspect, an embodiment of the present invention provides a computer-readable storage medium, comprising: the computer-readable storage medium storing a computer program. When the computer program is executed by a processor, the computer program implements the steps of the information acquisition method provided in the first aspect of the embodiment of the present invention.

[0026] When the embodiment of the present invention obtains the first access request for the set path, an identity authentication response is sent to the sender of the first access request, and the identity authentication response is in the form of an NTLM authentication invitation. The NTLM authentication request initiated by the sender based on the NTLM authentication invitation is obtained, and the identity information of the sender is obtained based on the NTLM authentication request. The present application obtains the identity information of the attacker based on NTLM authentication, and can accurately obtain the real identity information of the attacker. Based on the obtained identity information of the attacker, the defense system of the business system can be consolidated, the protection capability of the business system can be strengthened, and the security of the business system can be enhanced. Compared with the virtual identity information captured by related technologies, the identity information obtained by the present application is of higher quality and plays a greater role in the security of the business system. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] Figure 1 This is a schematic diagram of an attack traffic trend provided by an embodiment of the present invention;

[0028] Figure 2 This is a schematic diagram of another attack traffic trend provided by an embodiment of the present invention;

[0029] Figure 3 This is a schematic diagram of an implementation flow of an information acquisition method provided by an embodiment of the present invention;

[0030] Figure 4 This is a schematic diagram of an implementation flow of another information acquisition method provided by an embodiment of the present invention;

[0031] Figure 5 This is a schematic diagram of an NTLM authentication process provided by an embodiment of the present invention;

[0032] Figure 6 is a schematic diagram of a parsing result of a response data packet provided by an embodiment of the present invention;

[0033] Figure 7 This is a schematic diagram of a NTLM authentication process provided by an embodiment of the present invention;

[0034] Figure 8 is a schematic diagram of an information acquisition device provided by an embodiment of the present invention;

[0035] Figure 9 FIG. 1 is a schematic diagram of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0036] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of them. All other embodiments obtained by ordinary technicians in this field based on the embodiments of the present invention without making any creative efforts shall fall within the scope of protection of the present invention.

[0037] The traditional method of obtaining attacker information involves inserting JavaScript code into the honeypot page and using JSONP requests to capture the virtual identity information logged into third-party applications. This method has a drawback: the attacker must have logged into the third-party application (such as a search or news app) through a browser and their identity information must be valid. However, attackers typically use clean browsers or clean up login traces before use, making this method difficult to obtain attacker information. Another drawback is that anti-honeypot plugins deployed on the attacker's host can detect the JavaScript code inserted into the honeypot page, rendering identity tracing ineffective.

[0038] In view of the shortcomings of the above-mentioned related technologies, the embodiments of the present invention provide an information acquisition method that can reduce the difficulty of obtaining attacker information and improve the quality of the obtained attacker information. To illustrate the technical solution of the present invention, a specific embodiment is provided below.

[0039] Figure 1 This is a schematic diagram illustrating attack traffic patterns, provided by an embodiment of the present invention. The network device can be a virtual device installed on the host computer hosting the service system, such as a virtual machine firewall. Alternatively, the network device can be a hardware server, such as a gateway or proxy server. The network device forwards access requests from an attacker to the honeypot and responses from the honeypot to the attacker.

[0040] Figure 2 This is a schematic diagram of another attack traffic trend provided by an embodiment of the present invention. Figure 2 compared to Figure 1 Without network equipment, attackers can directly access the honeypot, and the honeypot's response packets can also be sent directly to the attacker.

[0041] Figure 3 This is a schematic diagram of an implementation flow of an information acquisition method provided by an embodiment of the present invention. The execution subject of the information acquisition method can be the above-mentioned Figure 1 or Figure 2 The honeypot in Figure 1 The embodiment of the present invention can be applied to the network device in Figure 1 or Figure 2 This application is not limited to any scenario.

[0042] refer to Figure 3 , information acquisition methods include:

[0043] S301, when a first access request for a set path is obtained, an identity authentication response is sent to the sender of the first access request, wherein the identity authentication response is in the form of a challenge / response authentication protocol (NTLM, NT LAN MANAGER) authentication invitation.

[0044] NTLM is a network authentication protocol. It is an authentication mode based on the Challenge / Response authentication mechanism and is commonly used in Windows systems.

[0045] In one embodiment, the set path may refer to any path in a real business system, and any access to any path by a visitor will trigger NTLM authentication.

[0046] In one embodiment, the set path may refer to the Uniform Resource Locator (URL) path of a fake application or system deployed on the honeypot corresponding to the business system. Because the set path is not the actual path of the business system, normal users cannot access the set path. Only attackers can obtain the set path and access it through attack scripts. Therefore, if a first access request for the set path is obtained, it can be determined that the sender of the first access request is an attacker.

[0047] A honeypot is a virtual system that deploys and exposes fake applications or systems on a Docker container or virtual machine, luring attackers into accessing them. Once an attacker has infiltrated, the system monitors and analyzes the hacker's tools and information, thereby strengthening its own defenses.

[0048] For example, the real paths of the x.com business site include http: / / x.com / a and http: / / x.com / b, and the corresponding set paths include: http: / / x.com / admin, http: / / x.com / c, and http: / / x.com / admin / admin.php, which are URLs that normal users do not access.

[0049] In this application, the reason for choosing NTLM authentication is that: embedding the json identity tracing code in the honeypot page as mentioned above may cause identity acquisition failure; but directly returning to the ordinary authentication page that requires the input of the username will inevitably arouse the attacker's vigilance, and they will not be able to enter the real identity information. Therefore, this application proposes a method for obtaining identity information using NTLM authentication. This method adopts an inherent feature of NTLM, that is, during the NTLM identity authentication process, some inherent attribute information of the attacker's host (such as the host name) will be sent out (the sending of inherent attribute information is not controllable by the attacker). It is based on this inherent feature of NTLM that we propose the attacker identity acquisition method described in this application. Therefore, tracing the attacker through the NTLM authentication method is the core invention of this application.

[0050] In one embodiment, all URL paths on the honeypot can trigger NTLM authentication; in another embodiment, only selected URL paths can trigger NTLM authentication, and the URL paths that can trigger NTLM authentication can be pre-configured.

[0051] Since the authentication method of the returned authentication response is set to NTLM authentication, after the attacker obtains the authentication response, any information entered on the authentication page is equivalent to initiating NTLM authentication.

[0052] exist Figure 1 In a network scenario, an attacker accesses the honeypot through a network device. The network device can modify the response message returned by the honeypot to an authentication response with NTLM authentication mode (this can be achieved by embedding NTLM authentication code in the message, etc. The specific implementation method is not limited to the scope of this application and will be determined by those skilled in the art according to actual needs); or, after receiving the access request, the network device can directly send an NTLM authentication invitation to the visitor.

[0053] Here, the NTLM authentication invitation may be sent to the sender of the first access request in the form of a page or a pop-up box, and the authentication invitation is used to prompt the sender of the first access request that NTLM authentication is required.

[0054] S302: Obtain an NTLM authentication request initiated by the sender based on the NTLM authentication invitation.

[0055] After obtaining the NTLM authentication invitation, the sender of the first access request initiates NTLM authentication. When the execution subject is a honeypot, the specific step is to send an NTLM authentication request to the honeypot.

[0056] In actual applications, the browser of the sender of the first access request receives an NTLM authentication invitation. The NTLM authentication invitation provides a dialog box for entering a user name and password. The sender of the first access request enters the user name and password in the dialog box to initiate NTLM authentication. After the sender confirms the entered user name and password, the sender's client sends an NTLM authentication request to the honeypot or network device. The NTLM authentication request contains the user information entered by the user.

[0057] S303: Acquire the identity information of the sender based on the NTLM authentication request.

[0058] In order to obtain the visitor's identity information, this application sends an identity authentication response to the visitor. If the visitor is an attacker, it is impossible for the attacker to enter real identity information, so the attacker's real identity information cannot be obtained. This application sets the identity authentication method to NTLM authentication, and the real identity information can be obtained through NTLM authentication.

[0059] The identity information of the sender of the first access request is captured based on NTLM authentication, which is based on the characteristics of Windows and cannot be forged by attackers. Compared with the virtual identity information obtained by related technologies, the identity information obtained in this embodiment is more accurate, plays a greater role in the security of the business system, and can greatly enhance the security of the business system.

[0060] During the NTLM authentication process, the sender of the first access request and the honeypot / network device exchange data. The data packet sent by the sender to the honeypot / network device carries its own identity information. By parsing the data packet sent by the sender of the first access request to the honeypot / network device, the sender's identity information can be obtained. The sender's identity information can be used to trace the source of network attacks and strengthen the defense system of the honeypot / network device, enhancing the protection capabilities of the business system and enhancing the security of the business system.

[0061] When the embodiment of the present invention obtains the first access request for the set path, an identity authentication response is sent to the sender of the first access request, and the identity authentication response is in the form of an NTLM authentication invitation. The NTLM authentication request initiated by the sender based on the NTLM authentication invitation is obtained, and the identity information of the sender is obtained based on the NTLM authentication request. The present application obtains the identity information of the attacker based on NTLM authentication, and can accurately obtain the real identity information of the attacker. Based on the obtained identity information of the attacker, the defense system of the business system can be consolidated, the protection capability of the business system can be strengthened, and the security of the business system can be enhanced. Compared with the virtual identity information captured by related technologies, the identity information obtained by the present application is of higher quality and plays a greater role in the security of the business system.

[0062] In one embodiment, the first access request is an HTTP request, and the identity authentication response is a 401 authentication response.

[0063] You can configure a 401 authentication code in the file corresponding to the set path, and trigger a 401 authentication when the set path is accessed. For example, if a 401 authentication code is configured in the admin.php file at http: / / x.com / admin / admin.php, an attacker will be prompted with a 401 authentication login dialog box whenever they access the path http: / / x.com / admin / admin.php.

[0064] In practice, the 401 authentication response can be a 401 error message, indicating that the user does not have access rights and requires identity authentication. The 401 error message is returned along with the authentication method and field names used. After receiving the 401 error message, the browser of the sender of the first access request interprets it and displays a dialog box for entering a username and password.

[0065] The user information entered by the sender of the first access request in the 401 authentication box may be forged or randomly entered. Since it is not the attacker's real user information, it has little effect on the security of the business system. Figure 4 The illustrated embodiment further mines the identity information of the sender to obtain the real host information of the sender.

[0066] refer to Figure 4 In one embodiment, obtaining the identity information of the sender based on the NTLM authentication request includes:

[0067] S401: Generate a challenge data packet, and send the challenge data packet to the sender.

[0068] S402, obtaining a response data packet sent by the sender; the sender generates the response data packet based on the challenge data packet; the response data packet includes the host information of the sender.

[0069] S403: Parse the response data packet to obtain the identity information of the sender.

[0070] NTLM authentication in a network environment uses a Challenge / Response authentication mechanism. Figure 5 This is a schematic diagram of an NTLM authentication process provided by an embodiment of the present invention. Figure 5In this context, client refers to the sender of the initial access request, and server refers to the honeypot or network device. As can be seen from the interaction process, the client sends type 1 and type 3 messages to the server, and the server sends type 2 messages to the client. The NTLM authentication process primarily consists of three messages: type 1 negotiation message; type 2 challenge message; and type 3 authentication message.

[0071] The specific NTLM authentication process includes:

[0072]

[0073] Among them, C corresponds to client and S corresponds to server.

[0074] First, the sender of the first access request sends an HTTP request to request access to business system resources.

[0075] Because the server has NTLM authentication enabled, it returns a 401 error message to the sender of the first access request, indicating that NTLM authentication is required.

[0076] The sender of the first access request initiates NTLM authentication, sending a Type 1 Negotiate message. This NTLM authentication request corresponds to a Type 1 Negotiate message, which includes information such as the username, domain, encryption level, and the security services to be used. At this point, the sender caches a copy of the NTLM hash of the password locally, and the original password is discarded. Original passwords must never be cached; this is a fundamental security principle.

[0077] After receiving the Type 1 negotiation message, the server checks whether the username exists in the local account list. If so, it generates a 16-bit random character, called a "Challenge." It then encrypts the Challenge using the NTLM hash corresponding to the login username to generate Challenge 1. It also generates a Net-NTLM hash and stores it in memory. After Challenge 1 is generated, it sends the Challenge to the sender of the first access request. The Challenge is a Type 2 message (called a Challenge message).

[0078] After receiving the type 2 message from the server, the sender of the first access request extracts the Challenge, encrypts it with the cached password's NTLM-Hash, and combines it with the username, Challenge, etc. to obtain the Net-NTLM Hash. Finally, the Net-NTLM-Hash is encapsulated into a type 3 message (called the Authenticate authentication message) and sent to the server.

[0079] After receiving the Type 3 message, the server encrypts the Challenge with the NTLM hash of its own password and compares the calculated Net NTLM hash with the authentication message sent by the sender of the first access request. If they match, the sender of the first access request has the correct password and authentication succeeds. Otherwise, authentication fails.

[0080] exist Figure 4 In the illustrated embodiment, the NTLM authentication request corresponds to the type 1 information in the above embodiment, the challenge data packet corresponds to the type 2 information, and the response data packet corresponds to the type 3 information.

[0081] Type 3 information includes the username, host name, domain, and Net NTLM hash. By parsing the response packet, you can obtain the sender's identity information. This information includes the sender's host information, which can include the sender's machine name and domain. The host name refers to the name the sender gives to their machine.

[0082] Figure 6 Schematic diagram of the parsing result of a response data packet provided by an embodiment of the present invention, such as Figure 6 As shown, the resolution results include Domain name (domain name), Username (user name) and Host name (host name).

[0083] The host information of the sender of the first access request is captured based on NTLM authentication. This is based on the characteristics of Windows and cannot be forged by attackers. Compared with the virtual identity information obtained by related technologies, the obtained host information is more accurate, plays a greater role in the security of the business system, and can greatly enhance the security of the business system.

[0084] In one embodiment, the user information and host information of the sender of the first access request are obtained. The more identity information obtained, the more helpful it is for security protection and attack tracing.

[0085] The identity information obtained by this application is unrelated to the NTLM authentication result. According to the above NTLM authentication process, it can be seen that this application only needs to parse type 3 information to obtain the sender's user information and host information. It does not require NTLM authentication to succeed. The sender's user information and host information can still be obtained even if NTLM authentication fails.

[0086] In one embodiment, the method is applied to a honeypot; the first access request is specifically an access request directed to the honeypot by setting a network device diversion path to the set path.

[0087] In this embodiment, a diversion path is set as a set path on the network device. When the network device receives an access request to access the set path, the access request is diverted to the honeypot.

[0088] The technical solution of this application is deployed in a honeypot, which can enhance the security of the business system compared to being deployed in a real business system. Even if it is attacked, only the honeypot is attacked and the real business system will not be affected.

[0089] Accordingly, sending the NTLM authentication invitation to the sender of the first access request includes:

[0090] Sending an NTLM authentication invitation to the sender of the first access request based on the network device;

[0091] Correspondingly, obtaining the NTLM authentication request initiated by the sender based on the NTLM authentication invitation includes:

[0092] An NTLM authentication request initiated by the sender based on the NTLM authentication invitation is obtained based on the network device.

[0093] Here, the network device can be a virtual device installed on the host where the business system is located, such as a firewall in the form of a virtual machine; the network device can also be a hardware server, such as a gateway or proxy server.

[0094] like Figure 2 As shown, the role of the network device is to forward data between the honeypot and the attacker. For example, it forwards the first access request to the honeypot; forwards the NTLM authentication invitation to the sender of the first access request; and forwards the NTLM authentication request to the honeypot.

[0095] The present application can configure a set path on a network device. When the network device receives an access request for the set path, the access request is forcibly directed into the honeypot.

[0096] By using network devices as intermediaries to forward data, all attacker traffic must pass through them, preventing them from directly accessing real business systems. By deploying proactive protection policies on network devices and initially reviewing access traffic for anomalies, we can protect backend business systems and reduce the number of abnormal access attempts. This also reduces the amount of data the honeypot must process, increasing its efficiency.

[0097] In one embodiment, after obtaining the identity information of the sender based on the NTLM authentication request, the method further includes:

[0098] The sender's identity information is added to a set blacklist for subsequent data analysis or access interception.

[0099] Here, the blacklist can be deployed in the honeypot or in the aforementioned network devices. By intercepting access requests corresponding to the identity information in the blacklist, attackers can be prevented from accessing the real business system, preventing damage to the business system and protecting the data security of the business system.

[0100] In one embodiment, sending a Challenge / Response NTLM authentication invitation to the sender of the first access request includes:

[0101] The file accessed by the first access request is returned as a response, wherein the preset configuration of the file includes an NTLM authentication code.

[0102] In this embodiment, an NTLM authentication code is preset in the file accessed by the first access request. When the first access request accesses the file, the file is returned to the visitor as a response. Since the file carries the NTLM authentication code, the visitor will be prompted to perform NTLM authentication when opening the file.

[0103] This embodiment directly returns the corresponding file when receiving an access request, without the need for complex request message processing logic, which is easier to implement for a honeypot.

[0104] refer to Figure 7 , Figure 7 This is a schematic diagram of an NTLM authentication process provided by an embodiment of the present invention. The NTLM authentication process includes:

[0105] In the first step, the attacker accesses the attack path, such as http: / / x.com / admin / admin.php.

[0106] In the second step, the firewall matches the attack path and forces the traffic into the virtual honeypot system.

[0107] Enable an active protection policy based on URL path diversion on the firewall. If an access attack path is found, it will be forcibly diverted to the virtual honeypot system.

[0108] In the third step, the virtual honeypot system returns a 401 authentication response.

[0109] In the fourth step, the firewall forwards the authentication response to the attacker.

[0110] In the fifth step, the attacker initiates NTLM authentication.

[0111] In the sixth step, the firewall forwards the NTLM authentication to the virtual honeypot system.

[0112] Step 7: The virtual honeypot system initiates a challenge.

[0113] The virtual honeypot system generates a 16-byte random number based on the authentication information input by the attacker and sends the random number to the attacker. The random number is usually called a challenge.

[0114] In step 8, the attacker receives the challenge forwarded by the firewall.

[0115] In the ninth step, the attacker encrypts the challenge and generates a response data packet (including identity information).

[0116] The attacker encrypts the Challenge sent with the hash value of the user's password and sends the result back to the virtual honeypot system. This step is usually called a response.

[0117] In the tenth step, the virtual honeypot system receives the attacker's response data packet through the firewall. The response data packet contains the attacker's identity information. The virtual honeypot system parses the response data packet and obtains the attacker's identity information.

[0118] If the user is a legitimate user and accesses the real path, the firewall will forward the access request to the real business system. The real business system responds to the access request, and the firewall returns a normal response request to the legitimate user.

[0119] This application obtains the attacker's identity information through NTLM authentication, accurately obtaining the attacker's true identity information. This information can be used to strengthen the defense system of firewalls or honeypots, enhancing defense capabilities and, in turn, improving the security of business systems. Furthermore, this application obtains the attacker's identity information with minimal difficulty and higher quality. By receiving network traffic from both attackers and legitimate users through the firewall, attackers are prevented from directly accessing the actual business system, protecting the data security of the business system.

[0120] It should be understood that the size of the serial numbers of the steps in the above embodiments does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present invention.

[0121] It will be understood that when used in this specification and the appended claims, the terms “comprises” and “comprising” indicate the presence of described features, integers, steps, operations, elements and / or components, but do not preclude the presence or addition of one or more other features, integers, steps, operations, elements, components and / or groups thereof.

[0122] It should be noted that the technical solutions described in the embodiments of the present invention can be arbitrarily combined without conflict.

[0123] In addition, in the embodiments of the present invention, “first”, “second”, etc. are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence.

[0124] refer to Figure 8 , Figure 8 is a schematic diagram of an information acquisition device provided by an embodiment of the present invention, such as Figure 8 As shown, the device includes a sending module, a first acquisition module and a second acquisition module.

[0125] a sending module configured to, upon receiving a first access request for a set path, send an identity authentication response to a sender of the first access request, wherein the identity authentication response is in the form of a challenge / response NTLM authentication invitation;

[0126] A first acquisition module is configured to acquire an NTLM authentication request initiated by the sender based on the NTLM authentication invitation;

[0127] The second acquisition module is used to obtain the identity information of the sender based on the NTLM authentication request.

[0128] In one embodiment, the first access request is an HTTP request, and the identity authentication response is a 401 authentication response.

[0129] In one embodiment, the first access request is specifically an access request directed to the honeypot by setting the diversion path of the network device to the set path.

[0130] In one embodiment, the sending module sends an NTLM authentication invitation to the sender of the first access request, including:

[0131] The file accessed by the first access request is returned as a response, wherein the preset configuration of the file includes an NTLM authentication code.

[0132] In one embodiment, the second obtaining module obtains the identity information of the sender based on the NTLM authentication request, including:

[0133] generating a challenge data packet, and sending the challenge data packet to the sender;

[0134] Obtaining a response data packet sent by the sender; the sender generates the response data packet based on the challenge data packet; the response data packet includes host information of the sender;

[0135] The response data packet is parsed to obtain the identity information of the sender.

[0136] In one embodiment, the identity information includes host information.

[0137] In one embodiment, the apparatus further comprises:

[0138] The interception module is used to add the identity information of the sender to a set blacklist for subsequent data analysis or access interception.

[0139] In actual application, the sending module, the first acquisition module and the second acquisition module can be implemented by a processor in an electronic device, such as a central processing unit (CPU), a digital signal processor (DSP), a microcontroller unit (MCU) or a programmable gate array (FPGA).

[0140] It should be noted that the above embodiments provide an example of the division of the above modules when performing information acquisition. In actual applications, the above processing can be assigned to different modules as needed, that is, the internal structure of the device can be divided into different modules to complete all or part of the above-described processing. In addition, the information acquisition device and the information acquisition method embodiment provided in the above embodiments are based on the same concept. The specific implementation process is detailed in the method embodiment and will not be repeated here.

[0141] The information acquisition device may be in the form of an image file. After the image file is executed, it can be run in the form of a container or a virtual machine to implement the information acquisition method described in this application. Of course, it is not limited to the image file form. As long as some software form can implement the information acquisition method described in this application, it is within the scope of protection of this application. For example, it can also be a software module implemented in the hypervisor (virtual machine monitor) in a cloud computing platform.

[0142] Based on the hardware implementation of the above program modules, and in order to implement the method of the embodiment of the present application, the embodiment of the present application further provides an electronic device, and the above method is implemented by a processor of the electronic device. Figure 9 This is a schematic diagram of the hardware structure of the electronic device according to the embodiment of the present application. Figure 9 As shown, the electronic equipment includes:

[0143] Communication interface, capable of exchanging information with other devices such as network equipment;

[0144] The processor is connected to the communication interface to implement information exchange with other devices and is used to execute the methods provided by one or more technical solutions on the electronic device side when running a computer program. The computer program is stored in the memory.

[0145] Of course, in actual applications, the various components in the electronic device are coupled together through a bus system. It is understood that the bus system is used to achieve connection and communication between these components. In addition to the data bus, the bus system also includes a power bus, a control bus, and a status signal bus. However, for the sake of clarity, Figure 9 Various buses are labeled as bus systems.

[0146] In addition, the electronic devices of the present application may be in the form of clusters, such as a cloud computing platform composed of clusters. The so-called cloud computing platform is a business model that uses virtualization technology to pool the resources of multiple terminals and then provide the required virtual resources and services.

[0147] In one embodiment, the honeypot is provided in an electronic device, and the method implemented by the honeypot is implemented by a processor of the electronic device.

[0148] The memory in the embodiments of the present application is used to store various types of data to support the operation of the electronic device. Examples of such data include: any computer program used to operate on the electronic device.

[0149] It is understood that the memory can be volatile memory or non-volatile memory, or can include both volatile and non-volatile memory. Among them, non-volatile memory can be read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), magnetic random access memory (FRAM), flash memory, magnetic surface memory, optical disk, or compact disc read-only memory (CD-ROM); magnetic surface memory can be magnetic disk memory or tape memory. Volatile memory can be random access memory (RAM), which is used as an external cache. By way of example and not limitation, many forms of RAM are available, such as static random access memory (SRAM), synchronous static random access memory (SSRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDRSDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link dynamic random access memory (SLDRAM), and direct rambus random access memory (DRRAM).The memories described in the embodiments of this application are intended to include, but are not limited to, these and any other suitable types of memories.

[0150] An embodiment of the present invention further provides a cloud computing platform, comprising a data processing software module for implementing the information acquisition method, wherein the data processing software module is used to implement the steps of the information acquisition method provided in the embodiment of the present invention.

[0151] A cloud computing platform is a service model that uses compute virtualization, network virtualization, and storage virtualization technologies to organize the physical hardware resources of multiple independent servers into pooled resources. It is a software-defined resource architecture based on the development of virtualization technology, providing resource capabilities in the form of virtual machines and containers. By eliminating the fixed relationship between hardware and operating systems and relying on network connectivity to unify resource scheduling and then provide the required virtual resources and services, it is a new IT and software delivery model that is flexible, elastic, distributed, multi-tenant, and on-demand.

[0152] The current cloud computing platform supports several service models:

[0153] SaaS (Software as a Service): Cloud computing platform users do not need to purchase software, but instead rent software deployed on the cloud computing platform. Users do not need to maintain the software, and the software service provider will fully manage and maintain the software.

[0154] PaaS (Platform as a Service): Cloud computing platform users (usually software developers) can build new applications or extend existing applications on the cloud computing platform's infrastructure without having to purchase development, quality control, or production servers.

[0155] IaaS (Infrastructure as a Service): Cloud computing platforms provide data centers, infrastructure hardware, and software resources through the Internet. Cloud computing platforms under the IaaS model can provide servers, operating systems, disk storage, databases, and / or information resources.

[0156] The methods disclosed in the above embodiments of the present application can be applied to a processor or implemented by a processor. The processor may be an integrated circuit chip with signal processing capabilities. During implementation, the steps of the above methods can be completed by hardware integrated logic circuits in the processor or instructions in software form. The above processor may be a general-purpose processor, a DSP, or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The processor can implement or execute the various methods, steps and logic block diagrams disclosed in the embodiments of the present application. The general-purpose processor may be a microprocessor or any conventional processor, etc. The steps of the methods disclosed in the embodiments of the present application can be directly embodied as being executed by a hardware decoding processor, or can be executed by a combination of hardware and software modules in the decoding processor. The software module can be located in a storage medium, which is located in a memory. The processor reads the program in the memory and completes the steps of the above methods in combination with its hardware.

[0157] Optionally, when the processor executes the program, it implements the corresponding processes implemented by the electronic device in each method of the embodiments of the present application, which will not be described here for the sake of brevity.

[0158] In an exemplary embodiment, the present application also provides a storage medium, namely, a computer storage medium, specifically a computer-readable storage medium, including, for example, a first memory storing a computer program, wherein the computer program can be executed by a processor of an electronic device to perform the steps of the aforementioned method. The computer-readable storage medium can be a memory such as FRAM, ROM, PROM, EPROM, EEPROM, Flash Memory, magnetic surface storage, optical disk, or CD-ROM.

[0159] In the several embodiments provided in this application, it should be understood that the disclosed devices, electronic devices and methods can be implemented in other ways. The device embodiments described above are merely schematic. For example, the division of the units is merely a logical function division. In actual implementation, there may be other division methods, such as: multiple units or components can be combined, or can be integrated into another system, or some features can be ignored or not executed. In addition, the coupling, direct coupling, or communication connection between the components shown or discussed can be through some interfaces, and the indirect coupling or communication connection of the devices or units can be electrical, mechanical or other forms.

[0160] The units described above as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units; some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0161] In addition, all functional units in the embodiments of the present application can be integrated into one processing unit, or each unit can be a separate unit, or two or more units can be integrated into one unit; the above-mentioned integrated units can be implemented in the form of hardware or in the form of hardware plus software functional units.

[0162] Those skilled in the art will understand that all or part of the steps of implementing the above-mentioned method embodiment can be completed by hardware related to program instructions, and the aforementioned program can be stored in a computer-readable storage medium. When the program is executed, it executes the steps of the above-mentioned method embodiment; and the aforementioned storage medium includes: mobile storage devices, ROM, RAM, disks or optical disks, etc. Various media that can store program codes.

[0163] Alternatively, if the above-mentioned integrated unit of the present application is implemented in the form of a software function module and sold or used as an independent product, it can also be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the embodiment of the present application is essentially or the part that contributes to the prior art can be embodied in the form of a software product, which is stored in a storage medium and includes a number of instructions for enabling a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the methods described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as mobile storage devices, ROM, RAM, magnetic disks or optical disks.

[0164] It should be noted that the technical solutions described in the embodiments of the present application can be combined arbitrarily without conflict.

[0165] In addition, in the examples of this application, "first", "second", etc. are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence.

[0166] The above description is merely a specific embodiment of the present application, but the scope of protection of the present application is not limited thereto. Any changes or substitutions that can be easily conceived by a person skilled in the art within the technical scope disclosed in this application should be included in the scope of protection of this application. Therefore, the scope of protection of this application should be based on the scope of protection of the claims.

Claims

1. An information acquisition method, characterized in that: The method comprises: When a first access request for a set path is obtained, an identity authentication response is sent to the sender of the first access request, wherein the identity authentication response is in the form of a challenge / response NTLM authentication invitation; the set path is deployed in a honeypot, and the set path is a diversion path for the sender to trigger NTLM authentication; Obtaining an NTLM authentication request initiated by the sender based on the NTLM authentication invitation; The identity information of the sender is obtained based on the NTLM authentication request.

2. The method according to claim 1, characterized in that The first access request is an HTTP request, and the identity authentication response is a 401 authentication response.

3. The method according to claim 1, characterized in that The method is applied to a honeypot; the first access request is specifically an access request directed to the honeypot by setting a network device diversion path to the set path.

4. The method according to claim 3, characterized in that The sending of the NTLM authentication invitation to the sender of the first access request includes: The file accessed by the first access request is returned as a response, wherein the preset configuration of the file includes an NTLM authentication code.

5. The method according to claim 1, wherein The obtaining the identity information of the sender based on the NTLM authentication request includes: generating a challenge data packet, and sending the challenge data packet to the sender; Obtaining a response data packet sent by the sender; the sender generates the response data packet based on the challenge data packet; the response data packet includes host information of the sender; The response data packet is parsed to obtain the identity information of the sender.

6. The method according to claim 5, characterized in that The identity information includes host information.

7. The method according to any one of claims 1 to 6, characterized in that After obtaining the identity information of the sender based on the NTLM authentication request, the method further includes: The sender's identity information is added to a set blacklist for subsequent data analysis or access interception.

8. An information acquisition device, characterized in that: include: a sending module configured to, upon receiving a first access request for a set path, send an identity authentication response to the sender of the first access request, wherein the identity authentication response is in the form of a challenge / response NTLM authentication invitation; the set path is deployed in a honeypot, and the set path is a traffic diversion path for the sender to trigger NTLM authentication; A first acquisition module is configured to acquire an NTLM authentication request initiated by the sender based on the NTLM authentication invitation; The second acquisition module is used to obtain the identity information of the sender based on the NTLM authentication request.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the computer program, the information acquisition method according to any one of claims 1 to 7 is implemented.

10. A computer-readable storage medium, characterized in that The computer-readable storage medium stores a computer program, wherein the computer program includes program instructions, and when the program instructions are executed by a processor, the processor executes the information acquisition method according to any one of claims 1 to 7.

Images