Network defense method, device and equipment

Abstract

The network defense method, device and equipment provided by the present disclosure relate to computer network security technology, and include: obtaining a configuration file in a switch of a business server monitored by a honeypot server according to obtained honeypot deployment instructions, the configuration file including a live Internet Protocol address; determining a non-live Internet Protocol address according to the live Internet Protocol address; determining a target service set according to a preset genetic evolution algorithm, a preset initial port set and a preset first port set; and deploying a honeypot service to achieve network defense according to the target service set and the non-live Internet Protocol address. According to the present scheme, the honeypot service to be deployed is determined through the non-live Internet Protocol address, the preset port set and the first port set with higher attacker benefits, the deployed honeypot service can improve the trapping capability to a certain extent, and the genetic evolution algorithm is used to accelerate the deployment efficiency.

Description

TECHNICAL FIELD

[0001] The present disclosure relates to computer network security technology, and in particular, to a network defense method, device and equipment. BACKGROUND

[0002] At present, with the development of computer technology, network attacks are more and more frequent. In order to strengthen network defense, it is more and more common to use honeypot to actively lure potential attacks or even horizontal attacks.

[0003] In the prior art, there are various deployment methods of honeypot, such as determining the honeypot service to be deployed according to the experience of technical personnel.

[0004] However, the luring ability of the honeypot service deployed by the above method needs to be further improved. SUMMARY

[0005] The present disclosure provides a network defense method, device and equipment to solve the problem that the luring ability of the honeypot service deployed in the prior art needs to be further improved.

[0006] According to a first aspect of the present disclosure, a network defense method is provided, applied to a honeypot server, comprising:

[0007] Obtaining a honeypot deployment instruction, and obtaining a configuration file in a switch of a service server monitored by the honeypot server according to the honeypot deployment instruction, the configuration file including a live Internet Protocol address; determining a non-live Internet Protocol address according to the live Internet Protocol address;

[0008] Obtaining a preset initial port set and a preset first port set, and determining a target service set according to a preset genetic evolution algorithm, the preset initial port set, and the preset first port set; the preset first port set is determined according to the attacker's income; the port corresponds to the service one by one;

[0009] Deploying a honeypot service according to the target service set and the non-live Internet Protocol address; the honeypot service is used to lure attackers; the log file generated in the honeypot server after deploying the honeypot service is used to realize analysis and disposal of network attacks, so as to realize network defense.

[0010] According to a second aspect of the present disclosure, a network defense device is provided, applied to a honeypot server, comprising:

[0011] An acquisition unit is configured to acquire a honeypot deployment instruction, and acquire a configuration file in a switch of a service server monitored by a honeypot server according to the honeypot deployment instruction, the configuration file including a live Internet Protocol address; and determine a non-live Internet Protocol address according to the live Internet Protocol address.

[0012] A determination unit is configured to acquire a preset initial port set and a preset first port set, and determine a target service set according to a preset genetic evolution algorithm, the preset initial port set, and the preset first port set; the preset first port set is determined according to attacker benefits; and a port corresponds to a service one by one.

[0013] A deployment unit is configured to deploy a honeypot service according to the target service set and the non-live Internet Protocol address; the honeypot service is used to lure attackers; and a log file generated in the honeypot server after the honeypot service is deployed is used for analysis and disposal of network attacks, so as to realize network defense.

[0014] According to a third aspect of the present disclosure, a honeypot server is provided, including a memory and a processor; wherein,

[0015] The memory is configured to store a computer program.

[0016] The processor is configured to read the computer program stored in the memory, and execute the network defense method according to the computer program in the memory.

[0017] According to a fourth aspect of the present disclosure, a computer readable storage medium is provided, and the computer readable storage medium stores computer execution instructions; when a processor executes the computer execution instructions, the network defense method according to the first aspect is implemented.

[0018] According to a fifth aspect of the present disclosure, a computer program product is provided, including a computer program; when the computer program is executed by a processor, the network defense method according to the first aspect is implemented.

[0019] The network defense method, device and equipment provided by the present disclosure include: obtaining a honeypot deployment instruction, and obtaining a configuration file in a switch of a service server monitored by a honeypot server according to the honeypot deployment instruction, the configuration file including a live Internet Protocol address; determining a non-live Internet Protocol address according to the live Internet Protocol address; obtaining a preset initial port set and a preset first port set, and determining a target service set according to a preset genetic evolution algorithm, the preset initial port set and the preset first port set; the preset first port set is determined according to attacker benefits; a port corresponds to a service one by one; deploying a honeypot service according to the target service set and the non-live Internet Protocol address; the honeypot service is used to trap attackers; and a log file generated in the honeypot server after the honeypot service is deployed is used to realize analysis and disposal of network attacks, so as to realize network defense. The network defense method, device and equipment provided by the present scheme can determine the honeypot service to be deployed through the non-live Internet Protocol address, the preset port set and the first port set with high attacker benefits, and the deployed honeypot service can improve the ability to trap attackers to a certain extent; and the genetic evolution algorithm is used to accelerate the deployment efficiency. BRIEF DESCRIPTION OF DRAWINGS

[0020] In order to more clearly illustrate the technical solutions in the embodiments of the present disclosure or the prior art, the drawings needed to be used in the embodiments or the prior art description will be briefly introduced. Obviously, the drawings in the following description are only some embodiments of the present disclosure, and other drawings can be obtained by those skilled in the art without creative effort on the basis of these drawings.

[0021] Figure 1 A flowchart of a network defense method according to an exemplary embodiment of the present disclosure is shown.

[0022] Figure 2 A flowchart of a genetic evolution algorithm according to an exemplary embodiment of the present disclosure is shown.

[0023] Figure 3 A flowchart of a network defense method according to another exemplary embodiment of the present disclosure is shown.

[0024] Figure 4 A schematic diagram of a network defense system according to an exemplary embodiment of the present disclosure is shown.

[0025] Figure 5 A structural diagram of a network defense device according to an exemplary embodiment of the present disclosure is shown.

[0026] Figure 6 A structural diagram of a honeypot server according to an exemplary embodiment of the present disclosure is shown. DETAILED DESCRIPTION

[0027] Currently, with the development of computer technology, cyberattacks are becoming increasingly frequent. To strengthen network defenses, the use of honeypots to actively lure potential attacks, even lateral movement attacks, is becoming more and more common. In existing technologies, honeypots can be deployed in various ways; for example, the honeypot service to be deployed can be determined based on the experience of technical personnel.

[0028] However, the trapping capability of honeypot services deployed in the above manner needs to be further improved.

[0029] To address the aforementioned technical issues, the solution provided in this disclosure can identify honeypot services to be deployed by using inactive Internet Protocol addresses and services that offer high returns to attackers. This allows the deployed honeypot services to enhance the ability to trap attackers to a certain extent. Furthermore, the use of a genetic evolution algorithm accelerates the deployment process.

[0030] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this disclosure are all information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, use and processing of the relevant data must comply with the relevant laws, regulations and standards of the relevant countries and regions, and corresponding operation portals are provided for users to choose to authorize or refuse.

[0031] The technical solutions of this disclosure and how they solve the aforementioned technical problems will be described in detail below with specific embodiments. These specific embodiments can be combined with each other, and the same or similar concepts or processes may not be repeated in some embodiments. The embodiments of this disclosure will now be described with reference to the accompanying drawings.

[0032] Figure 1 This is a schematic flowchart illustrating a network defense method as an exemplary embodiment of the present disclosure. The network defense method provided in this embodiment can be applied to honeypot servers.

[0033] like Figure 1 As shown, the network defense method provided in this embodiment includes:

[0034] Step 101: Obtain the honeypot deployment instruction, and according to the honeypot deployment instruction, obtain the configuration file in the switch of the business server monitored by the honeypot server. The configuration file includes the active Internet Protocol addresses; based on the active Internet Protocol addresses, determine the inactive Internet Protocol addresses.

[0035] The method provided in this disclosure can be executed by a honeypot server.

[0036] The honeypot server can obtain honeypot deployment instructions.

[0037] Specifically, the honeypot server can be used to monitor business servers in order to lure attackers who are launching cyberattacks against the business servers.

[0038] Specifically, the configuration files in the switches corresponding to the business servers monitored by the honeypot server can be obtained according to the honeypot deployment instructions.

[0039] Specifically, the configuration file can include live Internet Protocol addresses (IPs) and available network segments. Available network segments include both live and inactive IP addresses; therefore, inactive IP addresses can be determined based on available network segments and live IP addresses.

[0040] Step 102: Determine the target service set according to the preset genetic evolution algorithm, the preset initial port set, and the preset first port set; the preset first port set is determined based on the attacker's profit; the port and service correspond one-to-one.

[0041] The preset initial port set includes multiple pre-configured ports. The ports in the preset initial port set can be determined based on the experience of technical personnel.

[0042] Specifically, each port can be associated with a specific service. For example, port 80 corresponds to the Hypertext Transfer Protocol (HTTP) service.

[0043] The attacker's gain refers to the ratio of the time and effort expended to the attack's objectives. Attack objectives include the number of hosts with gained access, etc.

[0044] The preset first port set includes multiple pre-defined ports. The top N ports that offer the highest potential benefit to attackers can be identified as the preset first port set.

[0045] Specifically, such as Figure 2 As shown, according to the preset genetic evolution algorithm, the preset initial port set and the preset first port set are first encoded. Then, the initial population is determined according to the vector encoded by the initial port set. Next, the individual fitness of each vector in the initial population is evaluated. If the individual fitness is determined to be poor, selection, crossover and mutation operations are performed on the vector. The vector encoded by the first port set is used as the constraint condition for the crossover and mutation operations to evolve and generate new vectors. The individual fitness of the new vectors is evaluated until a port set that satisfies the individual fitness is obtained.

[0046] Then, the target service set can be determined according to the obtained port set satisfying the individual fitness and the preset vulnerability library.

[0047] The preset vulnerability library can include services with vulnerabilities and port information corresponding to the services.

[0048] The target service set can include a plurality of services, and the services in the target service set are all services with vulnerabilities.

[0049] In step 103, a honeypot service is deployed according to the target service set and the non-living IP address. The honeypot service is used to lure attackers. The log file generated in the honeypot server after the deployment of the honeypot service is used for analysis and disposal of network attacks, so as to realize network defense.

[0050] Specifically, the honeypot service can be deployed according to the target service set and the non-living IP address. The honeypot service includes all services in the target service set. The attacker can call the honeypot service with vulnerabilities deployed in the honeypot server by accessing the non-living IP address, so as to achieve the purpose of luring attackers.

[0051] Further, the log file generated in the honeypot server after the deployment of the honeypot service can be sent to a server for analysis and disposal of network attacks, so that the server can analyze and dispose of network attacks through the analysis of the log file, and further realize network defense.

[0052] The network defense method provided by the present disclosure includes: obtaining a honeypot deployment instruction, and obtaining a configuration file in a switch of a business server monitored by a honeypot server according to the honeypot deployment instruction. The configuration file includes living IP addresses. Non-living IP addresses are determined according to the living IP addresses. An initial port set and a first port set are obtained, and a target service set is determined according to a preset genetic evolution algorithm, the initial port set, and the first port set. The first port set is determined according to the attacker's income. The port corresponds to the service one by one. The honeypot service is deployed according to the target service set and the non-living IP address. The honeypot service is used to lure attackers. The log file generated in the honeypot server after the deployment of the honeypot service is used for analysis and disposal of network attacks, so as to realize network defense. In the method adopted by the present disclosure, the honeypot service to be deployed can be determined through the non-living IP address, the preset port set, and the first port set with high attacker income. The deployed honeypot service can improve the ability to lure attackers to a certain extent. The genetic evolution algorithm is used to speed up the deployment efficiency.

[0053] Figure 3A flowchart of a network defense method is shown for another exemplary embodiment of the present disclosure. The network defense method provided in this embodiment can be applied to a honeypot server.

[0054] As shown in Figure 3 , the network defense method provided in this embodiment includes:

[0055] In step 301, a honeypot deployment instruction is obtained, and a configuration file in a switch of a service server monitored by a honeypot server is obtained according to the honeypot deployment instruction, the configuration file including a live Internet Protocol address; and a non-live Internet Protocol address is determined according to the live Internet Protocol address.

[0056] Specifically, the principle and implementation of step 301 are similar to those of step 101, and will not be described again.

[0057] In step 302, a preset initial port set and a preset first port set are obtained, and each port in the preset initial port set is encoded to obtain a first vector set; each port in the preset first port set is encoded to obtain a second vector set; the preset first port set is determined according to attacker revenue; and a port corresponds to a service one by one.

[0058] Specifically, the preset initial port set can be obtained, and each port in the preset initial port set can be encoded to obtain a first vector set; the first vector set can include a plurality of first vectors.

[0059] The preset first port set can be obtained, and each port in the preset first port set can be encoded to obtain a second vector set; the second vector set can include a plurality of second vectors.

[0060] The preset first port set includes a plurality of ports set in advance. The first preset port set can be determined as the first N ports with the highest attacker revenue.

[0061] Specifically, each port can correspond to a service one by one.

[0062] In step 303, a first result is determined according to a first vector in the first vector set.

[0063] Specifically, the first vector set can include a plurality of first vectors, and the first vector can be processed in a preset manner to determine the first result.

[0064] In an implementation, a preset feature similarity table and a preset feature sensitivity table are acquired; the preset feature similarity table includes a mapping relationship between a service and a service usage frequency in a normal network in a unit of time; and the preset feature sensitivity table includes a mapping relationship between a service and a scanning attack frequency of the service by an attacker in a honeypot server in a unit of time.

[0065] The preset feature similarity table is a table set in advance according to actual conditions, and the preset feature similarity table can include a mapping relationship between a service and a service usage frequency in a normal network in a unit of time.

[0066] The preset feature sensitivity table is a table set in advance according to actual conditions, and the preset feature sensitivity table can include a mapping relationship between a service and a scanning attack frequency of the service by an attacker in a honeypot server in a unit of time.

[0067] Specifically, a preset feature similarity table and a preset feature sensitivity table are acquired.

[0068] Then, according to the first vector and the preset feature similarity table, a service corresponding to the first vector is determined to have a service usage frequency in a normal network in a unit of time.

[0069] Specifically, according to the service corresponding to the first vector, the preset feature similarity table is queried to determine the service usage frequency of the service corresponding to the first vector in a normal network in a unit of time.

[0070] According to the first vector and the preset feature sensitivity table, a service corresponding to the first vector is determined to have a scanning attack frequency in a honeypot server in a unit of time.

[0071] Specifically, according to the service corresponding to the first vector, the preset feature sensitivity table is queried to determine the scanning attack frequency of the service corresponding to the first vector in a honeypot server in a unit of time.

[0072] Then, according to the service usage frequency of the service corresponding to the first vector in a normal network in a unit of time and the scanning attack frequency of the service corresponding to the first vector in a honeypot server in a unit of time, a first result is determined.

[0073] Specifically, the frequency of use of the service in the normal network in a unit of time can be taken as the characteristic similarity of the service, and the frequency of scanning attack of the attacker on the service in the honeypot server in a unit of time can be taken as the characteristic sensitivity of the service. Generally, the service with sensitivity is more deceptive to the attacker in the initial deployment of the honeypot. In the normal access process, the service with high frequency of use by the user is more likely to attract the interest of the attacker. Due to the autonomy and uncertainty of the attacker, the honeypot service with high similarity does not necessarily have high deception ability, and similarly, the honeypot service with high sensitivity does not necessarily have high similarity. Therefore, the frequency of use of the service corresponding to the first vector in the normal network in a unit of time and the frequency of scanning attack of the attacker on the service corresponding to the first vector in the honeypot server in a unit of time can be processed by using a pre-set manner to obtain a first result.

[0074] The first result can be used to represent the trapping ability of the service corresponding to the first vector to the attacker.

[0075] In step 304, if it is determined that the first result does not satisfy the preset condition, a second vector is determined in the second vector set by using a preset manner, so that a second result determined according to the second vector satisfies the preset condition.

[0076] The preset condition is a condition pre-set according to actual conditions. For example, the preset condition can be a percentage. When the first result is greater than the percentage, it can be determined that the first result satisfies the preset condition. When the first result is less than the percentage, it can be determined that the first result does not satisfy the preset condition.

[0077] The preset manner is a manner pre-set according to actual conditions.

[0078] Specifically, if it is determined that the first result does not satisfy the preset condition, a second vector can be determined in the second vector set by using a pre-set manner, so that a second result determined according to the second vector satisfies the preset condition.

[0079] Further, if it is determined that the second result does not satisfy the preset condition, the step of determining the second vector in the second vector set by using the preset manner can be continued until the second result determined according to the second vector satisfies the preset condition.

[0080] In one implementation manner, a third vector corresponding to the first result which does not satisfy the preset condition is selected.

[0081] Specifically, a third vector corresponding to the first result which does not satisfy the preset condition can be selected.

[0082] Then, a random number is obtained, and if it is determined that the random number is greater than a first preset value, data in a preset position of the third vector and a vector corresponding to any first result that does not satisfy the preset condition is exchanged to obtain a fourth vector.

[0083] The first preset value is a value set in advance according to actual conditions.

[0084] Specifically, the random number can be automatically generated and obtained through a preset function, and the value range of the random number can be (0, 1). When it is determined that the random number is greater than the first preset value, the data in the preset position of the third vector and the data in the preset position of any other vector corresponding to the first result that does not satisfy the preset condition can be exchanged, and then the third vector after the exchange is determined as the fourth vector.

[0085] For example, the data in the last four positions of the third vector and the data in the last four positions of any other vector corresponding to the first result that does not satisfy the preset condition can be exchanged to obtain the fourth vector.

[0086] If it is determined that the random number is less than or equal to the first preset value, the value of any bit in the third vector is transformed to obtain the fourth vector.

[0087] Specifically, if it is determined that the random number is less than or equal to the first preset value, the value of any bit in the third vector can be transformed, for example, 1 is transformed to 0 and 0 is transformed to 1, and then the third vector after the transformation is determined as the fourth vector.

[0088] Next, if it is determined that the fourth vector belongs to the second vector set, the fourth vector is determined as the second vector.

[0089] Specifically, it is determined whether the fourth vector belongs to the second vector set, and if it is determined that the fourth vector belongs to the second vector set, the fourth vector is determined as the second vector.

[0090] In one implementation manner, if it is determined that the fourth vector does not belong to the second vector set, the step of obtaining the random number is continued until the fourth vector belongs to the second vector set.

[0091] Specifically, if it is determined that the fourth vector does not belong to the second vector set, the step of obtaining the random number is continued until the fourth vector obtained belongs to the second vector set.

[0092] Next, if it is determined that the second result determined according to the second vector does not satisfy the preset condition, the step of obtaining the random number is continued until the second result satisfies the preset condition.

[0093] Specifically, the second result is determined according to the second vector, and it is determined whether the second result satisfies the preset condition. If the second result does not satisfy the preset condition, the step of obtaining the random number is continued until the second result satisfies the preset condition.

[0094] In step 305, the target service set is determined according to the first vector corresponding to the first result meeting the preset condition and the second vector corresponding to the second result.

[0095] Specifically, the service corresponding to the first vector can be obtained according to the first vector corresponding to the first result meeting the preset condition; and the service corresponding to the second vector can be obtained according to the second vector corresponding to the second result meeting the preset condition.

[0096] Further, the target service is determined according to the service corresponding to the first vector and the preset vulnerability library, and the target service is determined according to the service corresponding to the second vector and the preset vulnerability library. Then, the target service set is obtained according to the obtained target service.

[0097] In an implementation manner, according to the honeypot deployment instruction, every first preset time, the step of determining the target service set according to the preset genetic evolution algorithm, the preset initial port set, and the preset first port set is started to update the target service set.

[0098] The first preset time is a time interval set in advance according to actual conditions, which can be 24 hours, for example.

[0099] Specifically, the first preset port set can be determined as the first N ports with the highest attacker benefits. The ports in the preset first port set can be updated in real time according to actual conditions.

[0100] Specifically, according to the honeypot deployment instruction, every first preset time, the step of determining the target service set according to the preset genetic evolution algorithm, the preset initial port set, and the preset first port set is started to update the target service set according to the preset first port set updated in real time.

[0101] In step 306, the honeypot service is deployed according to the target service set and the non-living IP address. The honeypot service is used to trap attackers. The log file generated in the honeypot server after the honeypot service is deployed is used for analysis and disposal of network attacks to achieve network defense.

[0102] Specifically, the honeypot service can be deployed according to the target service set and the non-living IP address. The honeypot service includes all services in the target service set. The attacker can call the honeypot service with a vulnerability deployed in the honeypot server by accessing the non-living IP address, so as to achieve the purpose of trapping the attacker.

[0103] Further, the log file generated in the honeypot server after the honeypot service is deployed can be sent to a server for analyzing and disposing network attacks, so that the server can analyze and dispose the network attacks through analyzing the log file, and further implement network defense.

[0104] In an implementation, a change instruction indicating a change of the alive IP address is received, and the non-alive IP address is updated according to the change instruction, and the deployed honeypot service is updated according to the updated non-alive IP address.

[0105] Specifically, if the alive IP address in the switch changes, the switch can send a change instruction to the honeypot server, and the change instruction includes the new alive IP address. The honeypot server can receive the change instruction, update the non-alive IP address according to the change instruction, and update the deployed honeypot service according to the updated non-alive IP address.

[0106] Figure 4 A schematic diagram of a network defense system according to an example embodiment of the present disclosure.

[0107] With the development of Internet technology, the network provides people with more and more services, but the attack means of various networks and the generation and spread speed of viruses have also accelerated, which brings great challenges to network security. Some commonly used network security technologies, such as firewall technology and intrusion detection technology, are all passive defense measures, which are based on known facts and attack patterns. They often lag behind network attack behavior and are in a passive position. For advanced persistent threat (APT) attacks, traditional defense methods have little effect. As a deception defense technology, honeypot is a system that sets up vulnerabilities, sensitive information, etc. in the honeypot to lure intruders to attack, thereby reducing the risk of user computers being attacked and providing opportunities and time for finding attack solutions. Compared with traditional network defense methods, honeypot has the characteristics of active defense, network deception, and less resource consumption. However, the existing network deception defense system based on honeypot and honeynet has the defects of insufficient deception, static nature, complex deployment, and difficult maintenance. The evolved attackers can still bypass the defense mechanism after careful detection and analysis, and once the honeypot is disabled, it not only cannot protect the production network system, but also can be used by attackers as a stepping stone to attack other resources.

[0108] As Figure 4 ​As shown, the network defense system provided in the embodiment is an overall structure of an optimized active defense system based on honeypot and production environment, which comprehensively uses technologies such as honeypot, intrusion detection system, firewall, and the like, and also deploys certain deceptive measures on all hosts in the production environment to achieve a defense state of “all people are soldiers”. The deployment, diversion, monitoring and disposal, active value output, and the like are planned and designed, passive defense is changed into active attack, the active interaction is achieved, the deficiencies of traditional network security defense measures are made up, the network security is enhanced to a certain extent, and it is an optimized network security defense strategy. Specifically, the honeypot service can be deployed according to the manner provided in the above embodiment.

[0109] Specifically, the active defense system construction strategy and technology based on honeypot and production network are planned and designed from the aspects of deployment, diversion, monitoring and disposal, and value output, and aims to help security personnel to improve the ability of trapping attack behavior by using network deception and other active defense technologies, to lay traps in the network information system based on honeypot technology, to interfere with the perception and judgment of the attacker to the network information system, and to achieve the purpose of discovering, delaying or blocking the activities of the attacker. The active defense system construction strategy and technical scheme are as follows.

[0110] Deployment: On the one hand, the deployment strategy of “all people are soldiers” is used, and the production resources are also armed with certain defense deception, and some sensitive directories are placed with files in the form of “operation and maintenance information of interest to hackers”, which are actually honeypot or honeynet configuration information, so that when the hacker unfortunately gets the permission of the production resources, the hacker can be further induced to move horizontally into the honeynet. In addition, some low-privilege pseudo accounts can be established, and once the hacker tries to log in, the pseudo accounts can be monitored and recognized by the host-based intrusion detection system (HIDS) or the security information and event management (SIEM) platform in time, and further trigger the corresponding emergency disposal. On the other hand, various honeypot templates are pre-installed in the honeypot system, which can be quickly deployed, and each honeypot template needs to be customized according to the actual business situation of the production environment, the file name and directory structure in the honeypot system are designed in the form of interest to hackers and illegal intruders, various business services are simulated, some files and data that seem to be confidential but are actually not confidential are placed, and the honeypot has “high honey degree” to improve the visiting rate of the honeypot system by hackers and illegal intruders.

[0111] Drainage: The active induction strategy of the multi-technology honeypot: First, set up an intrusion detection system host to detect and judge all data entering the internal network, for example, if someone accesses a large number of non-existent domain names or IP addresses, it is judged as illegal access, and it is redirected into the honeypot system. Otherwise, it will enter the internal network normally. Second, deploy a large number of proxy servers and mix them into the real network environment, for example, deploy a proxy server in any C segment network, when the host detects that the accessed data packet is an illegal data packet, it will be introduced into the honeypot system established. Third, insert some false subdirectories into the real domain name directory for drainage into the honeypot. When a hacker scans a certain site directory, he will definitely scan the subdirectory linked to the honeypot, and if the hacker further accesses it, it will achieve the effect of protecting the target site. Fourth, genetic evolution calculation is combined with honeypot to increase the dynamics, randomness and uncertainty of the system: In view of the complexity and transformation of the attack and defense environment, the honeypot can fully utilize the high robustness and universality of the evolution calculation, and has the advantages of self-adaptation, self-organization and self-evolution. For example, it can monitor the non-living IP in the current network environment in real time, and if someone accesses it, it will be immediately drained into the honeypot system.

[0112] Monitoring and disposal: The monitoring module is linked to the SIEM platform, host protection, traffic monitoring and other security devices to analyze the behavior of the internal network. When the attacker enters the honeypot, the behavior of the attacker can be recorded, screen recorded, and replayed, which is convenient for security personnel to analyze. The disposal module uses artificial intelligence technology to make the honeypot have intelligent interaction, improve the learning and anti-recognition ability of the honeypot, and obtain more attack interaction data, and on the other hand, automatically match the advanced adversarial tactics, techniques and common knowledge (Adversarial Tactics, Techniques, and Common Knowledges, ATT&CK) framework, and give corresponding emergency defense disposal measures in time.

[0113] Value output: Establish a knowledge base module to record attack behavior analysis, verify the effectiveness of real system vulnerability discovery and security device monitoring and protection, and provide reference for security protection decision optimization.

[0114] Figure 5 The structure diagram of the network defense device shown in an exemplary embodiment of the present disclosure. The network defense device provided in the embodiment can be applied to a honeypot server.

[0115] As Figure 5 shown, the network defense device 500 provided by the present disclosure comprises:

[0116] The acquisition unit 510 is configured to acquire a honeypot deployment instruction, and acquire a configuration file in a switch of a service server monitored by a honeypot server according to the honeypot deployment instruction, the configuration file including a live Internet Protocol address; and determine a non-live Internet Protocol address according to the live Internet Protocol address.

[0117] The determination unit 520 is configured to acquire a preset initial port set and a preset first port set, and determine a target service set according to a preset genetic evolution algorithm, the preset initial port set, and the preset first port set; the preset first port set is determined according to attacker benefits; a port corresponds to a service one by one.

[0118] The deployment unit 530 is configured to deploy a honeypot service according to the target service set and the non-live Internet Protocol address; the honeypot service is used to lure attackers; a log file generated in the honeypot server after the honeypot service is deployed is used for analysis and disposal of network attacks, so as to realize network defense.

[0119] The determination unit 520 is specifically configured to encode each port in the preset initial port set to obtain a first vector set; and encode each port in the preset first port set to obtain a second vector set.

[0120] The first result is determined according to a first vector in the first vector set.

[0121] If the first result does not satisfy a preset condition, a second vector is determined in the second vector set by using a preset manner, so that a second result determined according to the second vector satisfies the preset condition.

[0122] The target service set is determined according to a first vector corresponding to the first result satisfying the preset condition and a second vector corresponding to the second result.

[0123] The determination unit 520 is specifically configured to acquire a preset feature similarity table and a preset feature sensitivity table; the preset feature similarity table includes a mapping relationship between a service and a service use frequency in a normal network in a unit of time; and the preset feature sensitivity table includes a mapping relationship between a service and a scanning attack frequency of the service by an attacker in the honeypot server in a unit of time.

[0124] The service use frequency in the normal network in a unit of time corresponding to the first vector is determined according to the first vector and the preset feature similarity table.

[0125] The scanning attack frequency of the service in the honeypot server in a unit of time corresponding to the first vector is determined according to the first vector and the preset feature sensitivity table.

[0126] The first result is determined according to a frequency of use of the service corresponding to the first vector in a normal network in a unit of time and a frequency of scanning attack of the attacker in the honeypot server in a unit of time.

[0127] The determining unit 520 is specifically configured to select a third vector corresponding to the first result that does not satisfy the preset condition.

[0128] The random number is obtained, and if it is determined that the random number is greater than a first preset value, data in a preset position of the third vector and any vector corresponding to the first result that does not satisfy the preset condition is exchanged to obtain a fourth vector.

[0129] If it is determined that the random number is less than or equal to the first preset value, the value of any bit in the third vector is transformed to obtain the fourth vector.

[0130] If it is determined that the fourth vector belongs to the second vector set, the fourth vector is determined as the second vector.

[0131] If it is determined that the second result determined according to the second vector does not satisfy the preset condition, the step of obtaining the random number is continued until the second result satisfies the preset condition.

[0132] The determining unit 520 is specifically configured to, if it is determined that the fourth vector does not belong to the second vector set, continue the step of obtaining the random number until the fourth vector belongs to the second vector set.

[0133] The determining unit 520 is specifically configured to, according to the honeypot deployment instruction, every first preset time, start the step of determining the target service set according to the preset genetic evolution algorithm, the preset initial port number set and the preset first port number set, to update the target service set.

[0134] The deployment unit 530 is further configured to receive a change instruction sent by the switch and representing a change of the living Internet protocol address, and update the non-living Internet protocol address according to the change instruction, and update the deployed honeypot service according to the updated non-living Internet protocol address.

[0135] Figure 6 A structure diagram of the honeypot server according to an example embodiment of the present disclosure.

[0136] As shown in Figure 6 , the honeypot server provided by the present embodiment comprises:

[0137] a memory 601;

[0138] a processor 602; and

[0139] a computer program;

[0140] The computer program is stored in the memory 601 and configured to be executed by the processor 602 to implement any of the network defense methods.

[0141] The embodiment further provides a computer readable storage medium, which stores a computer program. The computer program is executed by a processor to implement any of the network defense methods.

[0142] The embodiment further provides a computer program product, which comprises a computer program. The computer program is executed by a processor to implement any of the network defense methods.

[0143] Those skilled in the art can understand that all or part of the steps of the above-mentioned method embodiments can be completed by a program instruction related to hardware. The foregoing program can be stored in a computer readable storage medium. The program is executed to perform the steps of the above-mentioned method embodiments; and the foregoing storage medium includes: ROM, RAM, magnetic disk or optical disk and various media that can store program codes.

[0144] Finally, it should be noted that: the above embodiments are only used to illustrate the technical solutions of the present application, and not to limit them; although the present application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that: it can still modify the technical solutions recorded in the foregoing embodiments, or make equivalent replacement for part or all of the technical features; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the scope of the technical solutions of the embodiments of the present application.

Claims

1. A cyber defense method, comprising: The application is applied to a honeypot server, comprising: obtaining a honeypot deployment instruction, and obtaining a configuration file in a switch of a business server monitored by a honeypot server according to the honeypot deployment instruction, wherein the configuration file comprises a live Internet Protocol address; determining a non-live Internet Protocol address according to the live Internet Protocol address; obtaining a preset initial port set and a preset first port set, and determining a target service set according to a preset genetic evolution algorithm, the preset initial port set, and the preset first port set; the preset first port set is determined according to attacker benefits; a port corresponds to a service one by one; deploying a honeypot service according to the target service set and the non-live Internet Protocol address; the honeypot service is used to trap attackers; log files generated in the honeypot server after the honeypot service is deployed are used to realize analysis and disposal of network attacks, thereby realizing network defense; the method for determining the target service set according to the preset genetic evolution algorithm, the preset initial port set, and the preset first port set comprises: encoding each port in the preset initial port set to obtain a first vector set; encoding each port in the preset first port set to obtain a second vector set; determining a first result according to a first vector in the first vector set; if it is determined that the first result does not satisfy a preset condition, determining a second vector in the second vector set by using a preset mode, so that a second result determined according to the second vector satisfies the preset condition; determining a target service set according to a first vector corresponding to the first result satisfying the preset condition and a second vector corresponding to the second result.

2. The method of claim 1, wherein, the method for determining the first result according to the first vector in the first vector set comprises: obtaining a preset feature similarity table and a preset feature sensitivity table; the preset feature similarity table comprises a mapping relationship between a service and a service use frequency in a normal network in a unit of time; the preset feature sensitivity table comprises a mapping relationship between a service and a scanner attack frequency of the service in a honeypot server in a unit of time; determining a service use frequency of the first vector corresponding service in a normal network in a unit of time according to the first vector and the preset feature similarity table; determining a scanner attack frequency of the first vector corresponding service in a honeypot server in a unit of time according to the first vector and the preset feature sensitivity table; determining the first result according to the service use frequency of the first vector corresponding service in a normal network in a unit of time and the scanner attack frequency of the first vector corresponding service in a honeypot server in a unit of time.

3. The method of claim 1, wherein, the method for determining the second vector in the second vector set by using the preset mode comprises: selecting a third vector corresponding to the first result not satisfying the preset condition; obtaining a random number, if it is determined that the random number is greater than a first preset value, exchanging data in a preset position of the third vector with a vector corresponding to any first result that does not satisfy a preset condition to obtain a fourth vector; if it is determined that the random number is less than or equal to the first preset value, transforming a value of any bit in the third vector to obtain a fourth vector; if it is determined that the fourth vector belongs to the second vector set, determining the fourth vector as the second vector; if it is determined that a second result determined according to the second vector does not satisfy the preset condition, continuing the step of obtaining the random number until the second result satisfies the preset condition.

4. The method of claim 3, wherein, Further comprising: if it is determined that the fourth vector does not belong to the second vector set, continuing the step of obtaining the random number until the fourth vector belongs to the second vector set.

5. The method according to any one of claims 1 to 4, characterized in that, Further comprising: According to the honeypot deployment instruction, every first preset time, starting the step of determining the target service set according to the preset genetic evolution algorithm, the preset initial port set, and the preset first port set to update the target service set.

6. A network defense device characterized by comprising: Applied to a honeypot server, comprising: An obtaining unit is configured to obtain a honeypot deployment instruction, and according to the honeypot deployment instruction, obtain a configuration file in a switch of a business server monitored by a honeypot server, the configuration file including a live Internet Protocol address; and determine a non-live Internet Protocol address according to the live Internet Protocol address; A determining unit is configured to obtain a preset initial port set and a preset first port set, and determine a target service set according to a preset genetic evolution algorithm, the preset initial port set, and the preset first port set; the preset first port set is determined according to attacker benefits; and a port corresponds to a service one by one; A deploying unit is configured to deploy a honeypot service according to the target service set and the non-live Internet Protocol address; the honeypot service is used to trap attackers; and a log file generated in the honeypot server after the honeypot service is deployed is used to realize analysis and disposal of network attacks, thereby realizing network defense; The determining unit is specifically configured to: encode each port in the preset initial port set to obtain a first vector set; and encode each port in the preset first port set to obtain a second vector set; determine a first result according to a first vector in the first vector set; if it is determined that the first result does not satisfy a preset condition, determine a second vector in the second vector set by using a preset manner, so that a second result determined according to the second vector satisfies the preset condition; determine a target service set according to a first vector corresponding to a first result that satisfies the preset condition and a second vector corresponding to a second result.

7. A honeypot server, characterized in that comprising a memory and a processor; wherein the memory is configured to store a computer program; the processor is configured to read the computer program stored in the memory, and execute the method in any one of claims 1-5 according to the computer program in the memory.

8. A computer-readable storage medium, characterized in that, The computer readable storage medium stores computer execution instructions, and when a processor executes the computer execution instructions, the method in any one of claims 1-5 is implemented.

9. A computer program product comprising a computer program, characterized in that, The computer program is executed by the processor, and the method in any one of claims 1-5 is implemented.

Images