A honeypot system identification method, device, terminal equipment and storage medium

Abstract

The present invention discloses a honeypot system identification method, apparatus, terminal device, and storage medium. By performing an asset search operation on a target network, after obtaining a number of target assets, all target assets obtained from the search are subjected to honeypot feature judgment, business response time variance mean judgment, and attack feedback result judgment, thereby respectively identifying all target assets as belonging to a first honeypot system group, a second honeypot system group, and a third honeypot system group. Among all target assets, target assets that are simultaneously marked with the first honeypot system group, the second honeypot system group, and the third honeypot system group are identified as target honeypot systems, thereby completing the identification of the target honeypot system. Compared to the prior art of inferential identification by extracting honeypot features, the present invention can greatly improve the accuracy of honeypot identification by identifying honeypots based on three dimensions: honeypot features, business application scenarios, and security defense.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to an identification method, device, terminal equipment and storage medium of a honeypot system. Background Art

[0002] A honeypot is a device used to trap network attackers. It deliberately exposes vulnerable systems to lure attackers into attacking, thereby obtaining information such as the attacker's IP address, attack payload, and attack tools. During attack and defense exercises, defenders often use honeypots to collect information about the attacker, thereby directly blocking the attacker's IP address. To minimize the damage caused by honeypots, it is essential to effectively identify honeypots and prevent further penetration attacks against them. However, existing identification methods primarily rely on features from open source honeypots such as Dionaea, Conpot, and t-pot, or extract specific attribute features from industrial control system honeypots and then infer them based on industrial control business models. These methods cannot detect general honeypots or honeypot systems with good anti-detection capabilities. Therefore, existing technologies have low accuracy in identifying honeypot systems.

[0003] Therefore, there is an urgent need for an identification strategy for the honeypot system to solve the current problem of low accuracy in identifying the honeypot system. Summary of the Invention

[0004] The embodiments of the present invention provide a method, an apparatus, a terminal device and a storage medium for identifying a honeypot system, so as to improve the accuracy of current identification of the honeypot system.

[0005] To solve the above problem, an embodiment of the present invention provides a method for identifying a honeypot system, comprising:

[0006] Perform asset search operations on the target network to obtain several target assets;

[0007] Extracting system feature data of each target asset, clustering each system feature data, and then marking the target assets corresponding to the honeypot feature as a first honeypot system group through a honeypot feature determination operation based on the clustering result;

[0008] Through a preset business detection operation, the variance of the business response time of each target asset is calculated, and then according to the mean variance of the business response time of all the target assets, the target assets corresponding to which the variance of the business response time is less than the mean variance are marked as the second honeypot system group;

[0009] Through a preset attack detection operation, each target asset is scanned for attack feedback results, and then, based on the attack feedback results obtained from the scan, an attack feedback result judgment operation is performed to mark the target assets corresponding to non-empty attack feedback results as the third honeypot system group;

[0010] According to the first honeypot system group, the second honeypot system group and the third honeypot system group, target assets simultaneously marked as the first honeypot system group, the second honeypot system and the third honeypot system are selected and determined as target honeypot systems.

[0011] As an improvement to the above solution, the system feature data of each target asset is extracted and each system feature data is clustered, specifically:

[0012] Extract the system version number, middleware version number and number of open ports of each target asset, and perform mean-variance clustering on all the target assets based on the system version number, middleware version number and number of open ports of each target asset to obtain first cluster assets and second cluster assets; wherein the system feature data includes: system version number, middleware version number and number of open ports.

[0013] As an improvement to the above solution, according to the clustering result, through the honeypot feature judgment operation, the target assets corresponding to the honeypot features are marked as the first honeypot system group;

[0014] The clustering results include: first cluster assets and second cluster assets;

[0015] Performing a honeypot feature determination operation on the clustering result to identify system feature data of the target asset in the clustering result;

[0016] If the number of open ports of all target assets in the first cluster of assets is greater than the port number threshold, the number of different values ​​of the middleware version numbers of all target assets in the first cluster of assets is greater than the type threshold, and the middleware version number of a target asset in the first cluster of assets matches a lower-version middleware version number database, then the target asset corresponding to the first cluster of assets is determined to be the first honeypot system group;

[0017] If the number of open ports of all target assets in the second cluster of assets is greater than the port number threshold, the number of different values ​​of the middleware version numbers of all target assets in the second cluster of assets is greater than the type threshold, and there is a target asset in the second cluster of assets whose middleware version number matches the lower version middleware version number database, then the target asset corresponding to the second cluster of assets is judged to be the first honeypot system group.

[0018] As an improvement to the above solution, the variance of the service response time of each target asset is calculated through a preset service detection operation, specifically:

[0019] Performing a business detection operation with a form submission function on each target asset, and obtaining a business response time of each target asset within a preset business detection time;

[0020] Calculating the variance of the business response time of each target asset according to the business response time of each target asset;

[0021] According to the variance of the service response time of each target asset, the variance mean of the service response time of all the target assets is calculated.

[0022] As an improvement to the above solution, the preset attack detection operation is used to scan the attack feedback results of each target asset, specifically:

[0023] By using an attack payload with plain text, attack detection is performed on each target asset, and after the attack detection is completed, the attack feedback result of each target asset is scanned by executing the attack payload of the attack detection to obtain the attack feedback result of each target asset.

[0024] As an improvement to the above solution, the attack feedback results obtained from the scan are judged by the attack feedback results, and the target assets corresponding to the attack feedback results being non-empty are marked as the third honeypot system group, specifically:

[0025] Performing an attack feedback result judgment operation according to the attack feedback result of each target asset;

[0026] If the attack feedback result of the target asset indicates that the attack payload used for attack detection is not blocked by the firewall, the attack feedback result is considered to be empty.

[0027] If the attack feedback result of the target asset is that the attack payload performing the attack detection is blocked by the firewall, the attack feedback result is determined to be non-empty, and the target asset with the non-empty attack feedback result is marked as the third honeypot system group.

[0028] Accordingly, an embodiment of the present invention further provides an identification device for a honeypot system, comprising: a data acquisition module, a first honeypot identification module, a second honeypot identification module, a third honeypot identification module, and a result generation module;

[0029] The data acquisition module is used to perform an asset search operation on the target network to obtain a number of target assets;

[0030] The first honeypot identification module is configured to extract system feature data of each target asset, cluster each system feature data, and then, based on the clustering results, mark the target assets corresponding to the honeypot features as the first honeypot system group through a honeypot feature determination operation;

[0031] The second honeypot identification module is configured to calculate the variance of the service response time of each target asset through a preset service detection operation, and then mark the target assets whose service response time variance is less than the mean variance as a second honeypot system group based on the mean variance of the service response time of all target assets;

[0032] The third honeypot identification module is configured to scan the attack feedback results of each target asset through a preset attack detection operation, and then, based on the attack feedback results obtained from the scan, perform an attack feedback result judgment operation to mark the target assets corresponding to non-empty attack feedback results as the third honeypot system group;

[0033] The result generation module is configured to select a target asset that is simultaneously marked as the first honeypot system group, the second honeypot system group, and the third honeypot system group based on the first honeypot system group, the second honeypot system group, and the third honeypot system group, and determine the target asset as the target honeypot system.

[0034] As an improvement to the above solution, the system feature data of each target asset is extracted and each system feature data is clustered, specifically:

[0035] Extract the system version number, middleware version number and number of open ports of each target asset, and perform mean-variance clustering on all the target assets based on the system version number, middleware version number and number of open ports of each target asset to obtain first cluster assets and second cluster assets; wherein the system feature data includes: system version number, middleware version number and number of open ports.

[0036] As an improvement to the above solution, according to the clustering result, through the honeypot feature judgment operation, the target assets corresponding to the honeypot features are marked as the first honeypot system group;

[0037] The clustering results include: first cluster assets and second cluster assets;

[0038] According to the number of open ports of the first clustered assets and the number of open ports of the second clustered assets, a honeypot feature judgment operation is performed on the clustering results, and the clustering result corresponding to the largest number of open ports is judged as a honeypot feature and marked as a first honeypot system group.

[0039] As an improvement to the above solution, the variance of the service response time of each target asset is calculated through a preset service detection operation, specifically:

[0040] Performing a business detection operation with a form submission function on each target asset, and obtaining a business response time of each target asset within a preset business detection time;

[0041] Calculating the variance of the business response time of each target asset according to the business response time of each target asset;

[0042] According to the variance of the service response time of each target asset, the variance mean of the service response time of all the target assets is calculated.

[0043] As an improvement to the above solution, the preset attack detection operation is used to scan the attack feedback results of each target asset, specifically:

[0044] By using an attack payload with plain text, attack detection is performed on each target asset, and after the attack detection is completed, the attack feedback result of each target asset is scanned by executing the attack payload of the attack detection to obtain the attack feedback result of each target asset.

[0045] As an improvement to the above solution, the attack feedback results obtained from the scan are judged by the attack feedback results, and the target assets corresponding to the attack feedback results being non-empty are marked as the third honeypot system group, specifically:

[0046] Performing an attack feedback result judgment operation according to the attack feedback result of each target asset;

[0047] If the attack feedback result of the target asset indicates that the attack payload used for attack detection is not blocked by the firewall, the attack feedback result is considered to be empty.

[0048] If the attack feedback result of the target asset is that the attack payload performing the attack detection is blocked by the firewall, the attack feedback result is determined to be non-empty, and the target asset with the non-empty attack feedback result is marked as the third honeypot system group.

[0049] Correspondingly, an embodiment of the present invention also provides a computer terminal device, including a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, and when the processor executes the computer program, it implements a honeypot system identification method as described in the present invention.

[0050] Correspondingly, an embodiment of the present invention further provides a computer-readable storage medium, which includes a stored computer program, wherein when the computer program is running, the device where the computer-readable storage medium is located is controlled to execute a honeypot system identification method as described in the present invention.

[0051] As can be seen from the above, the present invention has the following beneficial effects:

[0052] The present invention provides a method for identifying honeypot systems. By performing an asset search operation on a target network, after obtaining a number of target assets, all target assets obtained from the search are subjected to honeypot feature judgment, business response time variance mean judgment, and attack feedback result judgment. Thus, all target assets are respectively identified as belonging to a first honeypot system group, a second honeypot system group, and a third honeypot system group. Among all target assets, target assets that are simultaneously marked with the first honeypot system group, the second honeypot system group, and the third honeypot system group are identified as target honeypot systems, thereby completing the identification of the target honeypot system. Compared to the prior art that uses inference identification by extracting honeypot features, the present invention identifies honeypots based on three dimensions: honeypot features, business application scenarios, and security defense, which can greatly improve the accuracy of honeypot identification. BRIEF DESCRIPTION OF THE DRAWINGS

[0053] Figure 1 This is a flow chart of a method for identifying a honeypot system according to an embodiment of the present invention;

[0054] Figure 2 This is a schematic diagram of the structure of an identification device for a honeypot system provided by an embodiment of the present invention;

[0055] Figure 3 This is a schematic diagram of the structure of a terminal device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0056] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. All other embodiments obtained by ordinary technicians in this field based on the embodiments of the present invention without making any creative efforts shall fall within the scope of protection of the present invention.

[0057] Example 1

[0058] See also Figure 1 , Figure 1 FIG. 1 is a flow chart of a method for identifying a honeypot system according to an embodiment of the present invention. Figure 1 As shown, this embodiment includes steps 101 to 105, and each step is specifically as follows:

[0059] Step 101: Perform an asset search operation on the target network to obtain several target assets.

[0060] In a specific embodiment, the vulnerability scanning engine is used to perform asset discovery and asset vulnerability scanning functions on the target network, including returning the system version, middleware version, and open ports of the discovered assets, to provide basic information for further honeypot identification.

[0061] Step 102: extracting system feature data of each target asset, clustering each system feature data, and then marking the target assets corresponding to the honeypot features as the first honeypot system group through a honeypot feature judgment operation based on the clustering result.

[0062] In this embodiment, the system feature data of each target asset is extracted and clustered, specifically:

[0063] Extract the system version number, middleware version number and number of open ports of each target asset, and perform mean-variance clustering on all the target assets based on the system version number, middleware version number and number of open ports of each target asset to obtain first cluster assets and second cluster assets; wherein the system feature data includes: system version number, middleware version number and number of open ports.

[0064] In a specific embodiment, the system version number, middleware version number, and number of open ports of all target assets are calculated, and these data are used as features and input into a clustering model to perform K-means variance clustering (an existing clustering method); wherein K is the number of target types that need to be clustered. Through K-means variance clustering, target assets with similar system version numbers, middleware version numbers, and numbers of open ports can be divided into one category.

[0065] In this embodiment, according to the clustering result, through the honeypot feature judgment operation, the target asset corresponding to the honeypot feature is marked as the first honeypot system group;

[0066] The clustering results include: first cluster assets and second cluster assets;

[0067] According to the number of open ports of the first clustered assets and the number of open ports of the second clustered assets, a honeypot feature judgment operation is performed on the clustering results, and the clustering result corresponding to the largest number of open ports is judged as a honeypot feature and marked as a first honeypot system group.

[0068] In a specific embodiment, since the honeypot system group has more open ports and the normal assets have fewer open ports, the honeypot system group can be well distinguished by comparing the open port numbers of the clustered target assets.

[0069] In another specific embodiment, performing honeypot feature evaluation: identifying the clustering results:

[0070] If the number of open port word vectors of the first clustered asset is small (i.e., the number of open port word vectors is less than the port threshold, which is adjusted according to user needs), the types of the middleware version word vectors are uniform (i.e., the number of different types is less than the type threshold, which is adjusted according to user needs), and the type of the middleware version word vector is high version (i.e., the type of the middleware version word vector matches the high version middleware database), then it is considered a normal asset;

[0071] If the number of open port word vectors of the first clustering assets is large (that is, the number of open port word vectors described in the claims of the present invention is greater than the port threshold, and the setting of the port threshold is adjusted according to the needs of the user), the types of middleware version word vectors are not uniform (that is, the number of different types described in the claims of the present invention is greater than the type threshold, and the setting of the type threshold is adjusted according to the needs of the user), and there is a low version of the type of the middleware version word vector (that is, the type of the middleware version word vector described in the claims of the present invention matches the low version middleware database), it is considered to be the first honeypot system group.

[0072] Step 103: Through a preset business detection operation, the variance of the business response time of each target asset is calculated, and then according to the mean variance of the business response time of all the target assets, the target assets corresponding to which the variance of the business response time is less than the mean variance are marked as the second honeypot system group.

[0073] In this embodiment, the variance of the service response time of each target asset is calculated through the preset service detection operation, specifically:

[0074] Performing a business detection operation with a form submission function on each target asset, and obtaining a business response time of each target asset within a preset business detection time;

[0075] Calculating the variance of the business response time of each target asset according to the business response time of each target asset;

[0076] According to the variance of the service response time of each target asset, the variance mean of the service response time of all the target assets is calculated.

[0077] In a specific embodiment, a business consistency assessment is performed: a business probe is performed on all target assets for 24 hours (i.e., the business probe time described in the claims of the present invention), performed every 10 minutes, the business response time is recorded, the average of the response time per hour is calculated, the variance of the response time per hour in the 24 hours is calculated, the average of the variance of the business response time of all target assets is calculated, and assets with a response time greater than the average and a response time less than the average are divided into two groups;

[0078] If the value is greater than the mean, it is a normal asset, and if the value is less than the mean, it is the second honeypot system group.

[0079] Step 104: Scan the attack feedback results of each target asset through a preset attack detection operation, and then, based on the attack feedback results obtained from the scan, perform an attack feedback result judgment operation to mark the target assets corresponding to non-empty attack feedback results as the third honeypot system group.

[0080] In this embodiment, the preset attack detection operation is used to scan each target asset for attack feedback results, specifically:

[0081] By using an attack payload with plain text, attack detection is performed on each target asset, and after the attack detection is completed, the attack feedback result of each target asset is scanned by executing the attack payload of the attack detection to obtain the attack feedback result of each target asset.

[0082] In this embodiment, according to the attack feedback results obtained by scanning, the attack feedback result judgment operation is performed to mark the target assets corresponding to the attack feedback results as non-empty as the third honeypot system group, specifically:

[0083] Performing an attack feedback result judgment operation according to the attack feedback result of each target asset;

[0084] If the attack feedback result of the target asset indicates that the attack payload used for attack detection is not blocked by the firewall, the attack feedback result is considered to be empty.

[0085] If the attack feedback result of the target asset is that the attack payload performing the attack detection is blocked by the firewall, the attack feedback result is determined to be non-empty, and the target asset with the non-empty attack feedback result is marked as the third honeypot system group.

[0086] In a specific embodiment, a security defense strength consistency assessment is performed: attack detection is performed on all target assets using plaintext attack payloads, including SQL injection, webshell connection, remote control port connection, and other detection methods. After attack detection, each target asset is scanned using the same IP address as the attack payload used for attack detection to determine whether the IP address is blocked by the firewall, and the attack feedback results are recorded;

[0087] The attack feedback results are judged, and those that are blocked by defense are marked as the third honeypot system group, and those that are not blocked by defense are classified as normal assets.

[0088] Step 105: According to the first honeypot system group, the second honeypot system group and the third honeypot system group, a target asset marked as the first honeypot system group, the second honeypot system and the third honeypot system is selected and determined as a target honeypot system.

[0089] In a specific embodiment, for better explanation, the following example is given for illustration:

[0090] Perform asset discovery and asset vulnerability scanning on the target network;

[0091] Assume that 20 assets are found, asset A to asset T, and these assets are all web servers;

[0092] Extract the system characteristics of assets and cluster them based on the system characteristics, clustering the assets into two categories, with A to J as group 1 and K to T as group 2;

[0093] Through analysis, we found that the number of open ports in the assets of Group 1 was relatively small, and the middleware versions used were uniform and advanced. The number of developed ports in the assets of Group 2 was relatively large, and the middleware versions used were inconsistent, with some of them being low-level. Therefore, Group 2 was marked as a suspected honeypot system group.

[0094] Perform business detection with form submission function on all assets. This function needs to be written separately and called by the system's business detection engine. After 24 hours of execution, the business response time is recorded.

[0095] Calculate the variance of business response time and divide all assets into two groups based on the mean of the variance. Group 3 contains assets with a greater variance, and Group 4 contains assets with a lesser variance.

[0096] Perform webshell connection and SQL injection attack detection on all assets, and then use the same IP to perform an asset scan to test whether the return results can be obtained;

[0097] The assets that cannot get the return result are recorded as group 5, and the assets that can get the return result are recorded as group 6;

[0098] Calculate the intersection of group 2, group 4, and group 6, and mark the assets in the intersection as honeypots.

[0099] This embodiment performs an asset search operation on the target network. After obtaining a number of target assets, it performs honeypot feature judgment, business response time variance mean judgment, and attack feedback result judgment on all target assets obtained from the search, thereby identifying the first honeypot system group, the second honeypot system group, and the third honeypot system group for all target assets. Among all target assets, the target assets marked with the first honeypot system group, the second honeypot system group, and the third honeypot system group are identified as target honeypot systems, thereby completing the identification of the target honeypot system. This embodiment can identify honeypot systems that cannot fully simulate the timing characteristics of business flows in the honeypot based on business consistency assessment; based on security defense strength consistency assessment, it can capture the characteristics of honeypot systems that often do not have conventional security defense measures; this embodiment is also applicable to honeypot identification of general systems.

[0100] Example 2

[0101] See also Figure 2 , Figure 2 2 is a schematic structural diagram of an identification device for a honeypot system provided by an embodiment of the present invention, comprising: a data acquisition module 201, a first honeypot identification module 202, a second honeypot identification module 203, a third honeypot identification module 204 and a result generation module 205;

[0102] The data acquisition module 201 is used to perform an asset search operation on the target network to obtain a number of target assets;

[0103] The first honeypot identification module 202 is configured to extract system feature data of each target asset, cluster each system feature data, and then, based on the clustering results, mark the target assets corresponding to the honeypot features as the first honeypot system group through a honeypot feature determination operation;

[0104] The second honeypot identification module 203 is configured to calculate the variance of the service response time of each target asset through a preset service detection operation, and then mark the target assets whose service response time variance is less than the mean variance as the second honeypot system group based on the mean variance of the service response time of all target assets;

[0105] The third honeypot identification module 204 is configured to scan the attack feedback results of each target asset through a preset attack detection operation, and then, based on the attack feedback results obtained from the scan, perform an attack feedback result judgment operation to mark the target assets corresponding to non-empty attack feedback results as the third honeypot system group;

[0106] The result generation module 205 is configured to select target assets that are simultaneously marked as the first honeypot system group, the second honeypot system group, and the third honeypot system group according to the first honeypot system group, the second honeypot system group, and the third honeypot system group, and determine them as target honeypot systems.

[0107] As an improvement to the above solution, the system feature data of each target asset is extracted and each system feature data is clustered, specifically:

[0108] Extract the system version number, middleware version number and number of open ports of each target asset, and perform mean-variance clustering on all the target assets based on the system version number, middleware version number and number of open ports of each target asset to obtain first cluster assets and second cluster assets; wherein the system feature data includes: system version number, middleware version number and number of open ports.

[0109] As an improvement to the above solution, according to the clustering result, through the honeypot feature judgment operation, the target assets corresponding to the honeypot features are marked as the first honeypot system group;

[0110] The clustering results include: first cluster assets and second cluster assets;

[0111] According to the number of open ports of the first clustered assets and the number of open ports of the second clustered assets, a honeypot feature judgment operation is performed on the clustering results, and the clustering result corresponding to the largest number of open ports is judged as a honeypot feature and marked as a first honeypot system group.

[0112] As an improvement to the above solution, the variance of the service response time of each target asset is calculated through a preset service detection operation, specifically:

[0113] Performing a business detection operation with a form submission function on each target asset, and obtaining a business response time of each target asset within a preset business detection time;

[0114] Calculating the variance of the business response time of each target asset according to the business response time of each target asset;

[0115] According to the variance of the service response time of each target asset, the variance mean of the service response time of all the target assets is calculated.

[0116] As an improvement to the above solution, the preset attack detection operation is used to scan the attack feedback results of each target asset, specifically:

[0117] By using an attack payload with plain text, attack detection is performed on each target asset, and after the attack detection is completed, the attack feedback result of each target asset is scanned by executing the attack payload of the attack detection to obtain the attack feedback result of each target asset.

[0118] As an improvement to the above solution, the attack feedback results obtained from the scan are judged by the attack feedback results, and the target assets corresponding to the attack feedback results being non-empty are marked as the third honeypot system group, specifically:

[0119] Performing an attack feedback result judgment operation according to the attack feedback result of each target asset;

[0120] If the attack feedback result of the target asset indicates that the attack payload used for attack detection is not blocked by the firewall, the attack feedback result is considered to be empty.

[0121] If the attack feedback result of the target asset is that the attack payload performing the attack detection is blocked by the firewall, the attack feedback result is determined to be non-empty, and the target asset with the non-empty attack feedback result is marked as the third honeypot system group.

[0122] This embodiment acquires target assets through a data acquisition module, performs honeypot feature determination on the target assets through a first honeypot identification module, marks the target assets in a first honeypot system group, calculates the business response time variance of the target assets through a second honeypot identification module, marks the target assets in a second honeypot system group, scans the target assets for attack feedback results through a third honeypot identification module, marks the target assets in a third honeypot system group, and finally identifies the target assets marked as being in the first, second, and third honeypot system groups as target honeypot systems through a result generation module. Compared to the prior art, which uses honeypot feature extraction for inference identification, the present invention identifies honeypots based on three dimensions: honeypot features, business application scenarios, and security defense, significantly improving the accuracy of honeypot identification.

[0123] Example 3

[0124] See also Figure 3 , Figure 3 It is a schematic diagram of the terminal device structure provided by one embodiment of the present invention.

[0125] A terminal device of this embodiment includes: a processor 301, a memory 302, and a computer program stored in the memory 302 and executable on the processor 301. When the processor 301 executes the computer program, the steps of the above-mentioned honeypot system identification method in the embodiment are implemented, for example Figure 1 Alternatively, when the processor executes the computer program, the functions of the modules in the above-mentioned device embodiments are realized, for example: Figure 2 All modules of the identification device of the honeypot system are shown.

[0126] In addition, an embodiment of the present invention further provides a computer-readable storage medium, which includes a stored computer program, wherein when the computer program is running, the device where the computer-readable storage medium is located is controlled to execute the honeypot system identification method described in any of the above embodiments.

[0127] Those skilled in the art will understand that the schematic diagram is merely an example of a terminal device and does not constitute a limitation on the terminal device. The terminal device may include more or fewer components than shown in the diagram, or a combination of certain components, or different components. For example, the terminal device may also include input and output devices, network access devices, buses, etc.

[0128] The processor 301 may be a central processing unit (CPU), other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA), other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or any conventional processor. The processor 301 is the control center of the terminal device, connecting various parts of the entire terminal device using various interfaces and lines.

[0129] The memory 302 can be used to store the computer programs and / or modules. The processor 301 implements various functions of the terminal device by running or executing the computer programs and / or modules stored in the memory and calling the data stored in the memory 302. The memory 302 can mainly include a program storage area and a data storage area. The program storage area can store an operating system and at least one application required for a function (such as a sound playback function, an image playback function, etc.); the data storage area can store data created based on the use of the mobile phone (such as audio data, a phone book, etc.). In addition, the memory can include a high-speed random access memory and can also include a non-volatile memory, such as a hard disk, internal memory, a plug-in hard disk, a smart media card (SMC), a secure digital (SD) card, a flash card, at least one disk storage device, a flash memory device, or other volatile solid-state storage device.

[0130] Wherein, if the module / unit integrated in the terminal device is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the present invention implements all or part of the process in the above-mentioned embodiment method, and can also be completed by instructing the relevant hardware through a computer program. The computer program can be stored in a computer-readable storage medium, and when the computer program is executed by the processor, it can implement the steps of the above-mentioned various method embodiments. Wherein, the computer program includes computer program code, and the computer program code can be in source code form, object code form, executable file or some intermediate form. The computer-readable medium may include: any entity or device capable of carrying the computer program code, recording medium, USB flash drive, mobile hard disk, magnetic disk, optical disk, computer memory, read-only memory (ROM), random access memory (RAM), electric carrier signal, telecommunication signal and software distribution medium, etc.

[0131] It should be noted that the device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed across multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the present embodiment. In addition, in the drawings of the device embodiments provided by the present invention, the connection relationship between the modules indicates that there is a communication connection between them, which may be specifically implemented as one or more communication buses or signal lines. A person of ordinary skill in the art can understand and implement the present invention without inventive effort.

[0132] The above is a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present invention. These improvements and modifications are also considered to be within the scope of protection of the present invention.

Claims

1. A method for identifying a honeypot system, characterized in that: include: Perform asset search operations on the target network to obtain several target assets; Extracting system feature data of each target asset, clustering each system feature data, and then marking the target assets corresponding to the honeypot feature as a first honeypot system group through a honeypot feature determination operation based on the clustering result; Through a preset business detection operation, the variance of the business response time of each target asset is calculated, and then according to the mean variance of the business response time of all the target assets, the target assets corresponding to which the variance of the business response time is less than the mean variance are marked as the second honeypot system group; Through a preset attack detection operation, each of the target assets is scanned for attack feedback results, and then, based on the attack feedback results obtained from the scan, an attack feedback result judgment operation is performed, and the target assets corresponding to the attack feedback results being non-empty are marked as the third honeypot system group; wherein, based on the attack feedback results obtained from the scan, an attack feedback result judgment operation is performed, and the target assets corresponding to the attack feedback results being non-empty are marked as the third honeypot system group, specifically: based on the attack feedback results of each of the target assets, an attack feedback result judgment operation is performed; if the attack feedback result of the target asset is that the attack payload for executing the attack detection is not blocked by the firewall, then the attack feedback result is judged to be empty; if the attack feedback result of the target asset is that the attack payload for executing the attack detection is blocked by the firewall, then the attack feedback result is judged to be non-empty, and the target asset with the non-empty attack feedback result is marked as the third honeypot system group; According to the first honeypot system group, the second honeypot system group and the third honeypot system group, target assets simultaneously marked as the first honeypot system group, the second honeypot system and the third honeypot system are selected and determined as target honeypot systems.

2. The identification method of the honeypot system according to claim 1, characterized in that: The extracting of system feature data of each target asset and clustering of each system feature data is specifically as follows: Extract the system version number, middleware version number and number of open ports of each target asset, and perform mean-variance clustering on all the target assets based on the system version number, middleware version number and number of open ports of each target asset to obtain first cluster assets and second cluster assets; wherein the system feature data includes: system version number, middleware version number and number of open ports.

3. The identification method of the honeypot system according to claim 2, characterized in that: According to the clustering result, through the honeypot feature judgment operation, the target assets corresponding to the honeypot features are marked as the first honeypot system group; The clustering results include: first cluster assets and second cluster assets; According to the number of open ports of the first clustered assets and the number of open ports of the second clustered assets, a honeypot feature judgment operation is performed on the clustering results, and the clustering result corresponding to the largest number of open ports is judged as a honeypot feature and marked as a first honeypot system group.

4. The identification method of the honeypot system according to claim 1, characterized in that: The business response time variance calculation for each target asset is performed through the preset business detection operation, specifically: Performing a business detection operation with a form submission function on each target asset, and obtaining a business response time of each target asset within a preset business detection time; Calculating the variance of the business response time of each target asset according to the business response time of each target asset; According to the variance of the service response time of each target asset, the variance mean of the service response time of all the target assets is calculated.

5. The identification method of the honeypot system according to claim 1, characterized in that: The preset attack detection operation is used to scan each target asset for attack feedback results, specifically: By using an attack payload with plain text, attack detection is performed on each target asset, and after the attack detection is completed, the attack feedback result of each target asset is scanned by executing the attack payload of the attack detection to obtain the attack feedback result of each target asset.

6. An identification device for a honeypot system, characterized in that: include: Data acquisition module, first honeypot identification module, second honeypot identification module, third honeypot identification module and result generation module; The data acquisition module is used to perform an asset search operation on the target network to obtain a number of target assets; The first honeypot identification module is configured to extract system feature data of each target asset, cluster each system feature data, and then, based on the clustering results, mark the target assets corresponding to the honeypot features as the first honeypot system group through a honeypot feature determination operation; The second honeypot identification module is configured to calculate the variance of the service response time of each target asset through a preset service detection operation, and then mark the target assets whose service response time variance is less than the mean variance as a second honeypot system group based on the mean variance of the service response time of all target assets; The third honeypot identification module is configured to scan the attack feedback results of each target asset through a preset attack detection operation, and then, based on the attack feedback results obtained from the scan, perform an attack feedback result judgment operation to mark the target assets corresponding to non-empty attack feedback results as the third honeypot system group; wherein, based on the attack feedback results obtained from the scan, perform an attack feedback result judgment operation to mark the target assets corresponding to non-empty attack feedback results as the third honeypot system group, specifically: perform an attack feedback result judgment operation based on the attack feedback results of each target asset; if the attack feedback result of the target asset is that the attack payload of the attack detection is not blocked by the firewall, then the attack feedback result is judged to be empty; if the attack feedback result of the target asset is that the attack payload of the attack detection is blocked by the firewall, then the attack feedback result is judged to be non-empty, and the target asset with the non-empty attack feedback result is marked as the third honeypot system group; The result generation module is configured to select a target asset that is simultaneously marked as the first honeypot system group, the second honeypot system group, and the third honeypot system group based on the first honeypot system group, the second honeypot system group, and the third honeypot system group, and determine the target asset as the target honeypot system.

7. A computer terminal device, characterized in that: The method comprises a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, wherein when the processor executes the computer program, the method for identifying a honeypot system according to any one of claims 1 to 5 is implemented.

8. A computer-readable storage medium, characterized in that The computer-readable storage medium includes a stored computer program, wherein when the computer program is executed, the device where the computer-readable storage medium is located is controlled to execute the honeypot system identification method according to any one of claims 1 to 5.

Images