Honeypot generation method, device, equipment and readable storage medium

Abstract

The embodiment of the application provides a method, device and equipment for generating a honeypot, and a readable storage medium, the method comprising: obtaining a URL corresponding to an access object; obtaining information of a page corresponding to the access object according to the URL; and obtaining a honeypot of the access object according to the page information and an original honeypot.

Description

TECHNICAL FIELD

[0001] Embodiments of the present application relate to the field of communication technology, in particular to a honeypot generation method and device for attack trapping and tracing, a honeypot generation equipment and a readable storage medium. BACKGROUND

[0002] With the rapid development of communication technology and computer network technology, network attack events occur frequently. The demand for attack trapping and tracing also increases. Honeypot technology is one of the means for attack trapping and tracing. Honeypot technology is essentially a technology for deceiving attackers. By arranging some hosts, network services or information as decoys, attackers are induced to attack them, so that attack behavior can be captured and analyzed, the tools and methods used by attackers can be understood, attack intentions and motives can be inferred, and defenders can clearly understand the security threats they face and enhance the security protection capability of the actual system through technical and management means.

[0003] The existing honeypot for attack trapping and tracing has the problem that the honeypot is not sufficiently concealed and is easily discovered by attackers, which leads to the inability to capture attack behavior and the inability to trace attacks. SUMMARY

[0004] Embodiments of the present application provide a honeypot generation method, device, equipment and readable storage medium to solve the problem that honeypots are not sufficiently concealed and are easily discovered by attackers.

[0005] In a first aspect, a honeypot generation method is provided, comprising:

[0006] obtaining a uniform resource locator (URL) corresponding to an access object; obtaining information of a page corresponding to the access object according to the URL;

[0007] obtaining a honeypot of the access object according to the page information and an original honeypot.

[0008] Optionally, the step of obtaining the honeypot of the access object according to the page information and the original honeypot comprises:

[0009] retaining information corresponding to a page header and / or a page footer in the page information;

[0010] adding new information on the basis of the page information with the retained page header and / or page footer, wherein the new information includes calling and / or tracing code of the original honeypot interface.

[0011] Optionally, the method further comprises:

[0012] The code is dynamically generated according to a JavaScript interface corresponding to the test function in JavaScript.

[0013] Optionally, the method further comprises:

[0014] determining that the update state of the initial honeypot is in an open state;

[0015] if the update state of the initial honeypot is in the open state, performing the step of obtaining the honeypot of the access object according to the page information and the original honeypot;

[0016] if the update state of the initial honeypot is in a closed state, not performing the step of obtaining the honeypot of the access object according to the page information and the original honeypot, and using the original honeypot.

[0017] Optionally, the method further comprises:

[0018] setting the update state of the initial honeypot, the update state comprising: an open state and a closed state.

[0019] In a second aspect, a honeypot generation apparatus is provided, comprising:

[0020] a first obtaining module configured to obtain a URL corresponding to an access object;

[0021] a second obtaining module configured to obtain page information of a page corresponding to the access object according to the URL;

[0022] a generating module configured to obtain a honeypot of the access object according to the page information and an original honeypot.

[0023] Optionally, the generating module comprises a retaining unit and a processing unit.

[0024] The retaining unit is configured to retain information corresponding to a page header and / or a page footer in the page information.

[0025] The processing unit is configured to add new information on the basis of the page information with the retained page header and / or page footer, wherein the new information comprises: calling of the original honeypot interface and / or code for tracing.

[0026] Optionally, the code in the processing unit is dynamically generated according to a JavaScript interface corresponding to a test function in JavaScript.

[0027] Optionally, the apparatus further comprises:

[0028] A judging module is configured to judge whether the update state of the initial honeypot is an open state. If the update state of the initial honeypot is the open state, the step of obtaining the honeypot of the access object according to the page information and the original honeypot is performed. If the update state of the initial honeypot is a closed state, the step of obtaining the honeypot of the access object according to the page information and the original honeypot is not performed, and the original honeypot is used.

[0029] Optionally, the apparatus further comprises:

[0030] A setting module is configured to set the update state of the initial honeypot, and the update state comprises an open state and a closed state.

[0031] In a third aspect, an electronic device is provided, which comprises a processor, a memory, and a program stored in the memory and executable on the processor, and the program, when executed by the processor, implements the steps of the method according to the first aspect.

[0032] In a fourth aspect, a readable storage medium is provided, and the readable storage medium stores a program, and the program, when executed by a processor, implements the steps of the method according to the first aspect.

[0033] In the embodiments of the present application, the honeypot of the access object is obtained through the page information corresponding to the access object and the original honeypot, so that the honeypot generation and update oriented to attack luring and tracing are concealed, accurate and efficient, are not easy to be discovered by attackers, and are beneficial to capturing attack behaviors and tracing attacks. BRIEF DESCRIPTION OF DRAWINGS

[0034] Various other advantages and benefits will become apparent to those of ordinary skill in the art upon reading the following detailed description of the preferred embodiments. The accompanying drawings are included to provide a description of the preferred embodiments and are not intended to limit the scope of the present application. Moreover, the same reference numerals are used throughout the accompanying drawings to represent same or similar components. In the drawings:

[0035] Figure 1 is a schematic diagram of a threat perception and tracing platform corresponding to a honeypot system oriented to attack luring and tracing;

[0036] Figure 2 is one of flowcharts of a honeypot generation method provided by the embodiments of the present application;

[0037] Figure 3 is another of flowcharts of a honeypot generation method provided by the embodiments of the present application;

[0038] Figure 4 is a third of flowcharts of a honeypot generation method provided by the embodiments of the present application;

[0039] Figure 5 is one of code schematic diagrams provided by an embodiment of the present application;

[0040] Figure 6 is another one of code schematic diagrams provided by an embodiment of the present application;

[0041] Figure 7 is still another one of code schematic diagrams provided by an embodiment of the present application;

[0042] Figure 8 is a fifth flow chart of a honeypot generation method provided by an embodiment of the present application;

[0043] Figure 9 is a schematic diagram of a honeypot generation apparatus provided by an embodiment of the present application;

[0044] Figure 10 is a schematic diagram of an electronic device provided by an embodiment of the present application. DETAILED DESCRIPTION

[0045] The technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only some of the embodiments of the present application, but not all the embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative work fall within the scope of the present application.

[0046] The term “comprising” and any variation thereof in the specification and claims of the present application is intended to cover not exclusively including, for example, a process, method, system, product or device including a series of steps or units does not have to be limited to those steps or units clearly listed, but can include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices. In addition, the use of “and / or” in the specification and claims means at least one of the connected objects, for example, A and / or B means three cases including A alone, B alone, and A and B both.

[0047] In the embodiments of the present application, the words “exemplary” or “for example” are used to mean serving as an example, instance or illustration. Any embodiment or design solution described as “exemplary” or “for example” in the embodiments of the present application should not be interpreted as being more preferred or advantageous than other embodiments or design solutions. Rather, the use of “exemplary” or “for example” is intended to present relevant concepts in a concrete manner.

[0048] It is worth noting that the technology described in the embodiments of the present application is not limited to Long Term Evolution (LTE) / LTE-Advanced (LTE-A) systems, but can also be used in other wireless communication systems, such as Code Division Multiple Access (CDMA), Time Division Multiple Access (TDMA), Frequency Division Multiple Access (FDMA), Orthogonal Frequency Division Multiple Access (OFDMA), Single-carrier Frequency-Division Multiple Access (SC-FDMA) and other systems. The terms "system" and "network" in the embodiments of the present application are often used interchangeably, and the described technology can be used in the above-mentioned systems and radio technologies, as well as other systems and radio technologies. However, the following description describes a New Radio (NR) system for example purposes, and NR terminology is used in most of the following description, although these technologies can also be applied to applications other than NR system applications, such as 6th Generation (6G) communication systems.

[0049] As shown in Figure 1 The honeypot system for attack luring and tracing corresponds to a threat perception and tracing platform based on a burying point technology to realize threat perception of Web attacks, and is composed of a burying point page and a tracing platform. The burying point page is deployed in a target protection website in advance, and is an isolated page. Normal users access normal pages of the website and do not access the isolated burying point page. When an attacker scans the target website through a scanner or other tools, the isolated burying point page will be scanned, and it can be inferred that the user accessing the burying point page is a suspected attacker. The information collection script of the accessed burying point page automatically collects relevant information of the visitor and sends it to the tracing platform. The tracing platform receives the attack tracing information collected by the burying point tracing page, and performs multi-dimensional statistical analysis on the information to intuitively display in a chart. Users can log in to the threat perception and tracing platform to view the collected attacker information, attack detail information, and multi-dimensional statistical analysis results.

[0050] Referring to Figure 2 The embodiments of the present application provide a honeypot generation method, and the specific steps include steps 201, 202 and 203.

[0051] Step 201: obtaining a URL corresponding to an access object;

[0052] Step 202: obtaining page information of the access object according to the URL.

[0053] Step 202: obtaining the honeypot of the access object according to the page information and the original honeypot.

[0054] Optionally, the step of obtaining the honeypot of the access object according to the page information and the original honeypot comprises: retaining information corresponding to a page header and / or a page footer in the page information; and adding new information on the basis of the page information with the retained page header and / or page footer; wherein the new information comprises calling and / or tracing code of the original honeypot interface.

[0055] Optionally, the method further comprises:

[0056] The code is dynamically generated according to a JavaScript interface corresponding to a test function in JavaScript.

[0057] In the embodiments of the present application, the honeypot of the access object is obtained through the page information of the access object and the original honeypot, so that the honeypot generation and update for attack luring and tracing are concealed, accurate and efficient, are not easy to be discovered by attackers, and are beneficial to capturing attack behaviors and tracing attacks.

[0058] Referring to Figure 3 The embodiments of the present application provide a honeypot generation method, and the specific steps comprise steps 301, 302, 303, 304, 305 and 306.

[0059] Step 301: obtaining a URL corresponding to an access object;

[0060] Step 302: setting an update state of the initial honeypot, the update state comprising: an ON state and an OFF state.

[0061] Step 303: obtaining page information of the access object according to the URL.

[0062] Step 304: judging whether the update state of the initial honeypot is the ON state.

[0063] Step 305: if the update state of the initial honeypot is the ON state, obtaining the honeypot of the access object according to the page information and the original honeypot.

[0064] Optionally, the step of obtaining the honeypot of the access object according to the page information and the original honeypot comprises: retaining information corresponding to a page header and / or a page footer in the page information; and adding new information on the basis of the page information with the page header and / or the page footer retained, wherein the new information comprises calling and / or tracing code of the original honeypot interface.

[0065] Optionally, the method further comprises:

[0066] The code is dynamically generated according to a JavaScript interface corresponding to a test function in JavaScript.

[0067] Step 306: If the update state of the initial honeypot is OFF, the original honeypot is used.

[0068] As shown in the comparative diagram of Figure 4 The existing honeypot technology for attack luring and tracing, once a honeypot is generated, uses the honeypot all the time regardless of the URL page of the access object, and no longer updates the honeypot. This always uses one honeypot without change, which can easily be found by the attacker after a large number of uses that the honeypot is a disguised page, and the attacker can improve vigilance and no longer log in and perform subsequent behaviors, so that more attacker behaviors cannot be captured.

[0069] The honeypot generation method for attack luring and tracing according to the present application will be further described below, as shown in Figure 4 The honeypot generation method for attack luring and tracing according to the present application comprises the following steps.

[0070] Step 401: Obtain the URL corresponding to the access object. The access object here is a user or an attacker, such as a page of a business website or a page of a commodity ordering website, etc. The URL information is then output to step 402.

[0071] Step 402: Obtain the page information by crawling through a crawler using the URL information. That is, the URL information obtained in step 401 is used to obtain the information of the page corresponding to the URL through a crawler, and the result is output to step 403. The information of the page corresponding to the URL obtained through the crawler includes but is not limited to control information, hyperlink information, background information, title information, text information, image information, Flash animation information, color information, layout information, etc.

[0072] Step 403: Integrate the page information with the original honeypot page through an automated tool. That is, receive the page information obtained in step 402, and integrate it with the original initial honeypot page, specifically using an automated tool to integrate the page crawled by the crawler with the original honeypot page. The result is output to step 404.

[0073] The automated integration method here includes the following sub-steps:

[0074] Sub-step (1): The page information collected in step 402 is retained without changing the information corresponding to the header and / or footer of the page. That is, the information of <footer> 、< / footer> is retained. If the page only has header information without footer information, the header information is retained without change, that is, the information of

[0075] Sub-step (2): On the basis of the header and / or footer information of the page in the above sub-step (1), new information is added. The added information includes js calls of honeypot interfaces, traceability code syCode, etc. The code is as shown in Figure 5 .

[0076] Sub-step (3): The syCode code is dynamically generated through jstest corresponding js, and then forms the integrated code after the client, as shown in Figure 6 .

[0077] Sub-step (4): According to the jstest corresponding js interface, the syCode is dynamically generated, and the page is executed by calling, and different pages will be called according to different types. For example, when type = login1, the login1 code is dynamically generated through jstest corresponding js, and the page information code screenshot after generation is as shown in Figure 7 .

[0078] Through the above sub-steps (1)-(4), the process of step 403 of integrating the page information with the original honeypot page through an automated tool is completed.

[0079] Step 404: Form a specific honeypot corresponding to the access object. Through step 403, the integrated new honeypot page is obtained, thereby forming a specific honeypot corresponding to the access object. The result is output to step 405.

[0080] Step 405: Further, a honeypot similar to "thousand faces for a thousand people" is constructed, that is, for i pages, there are Xi honeypots. That is, for the access object i, there is a corresponding Xi honeypot. Here, "people" in "thousand faces for a thousand people" refers to different pages, and "faces" refers to different honeypots, that is, different URL pages correspond to different honeypots.

[0081] Thus, the entire method flow of the honeypot generation for attack luring and tracing is completed.

[0082] As shown in the technical solution, the honeypot updating method for attack luring and tracing includes the following steps. Figure 8

[0083] Step 801: Obtain the URL corresponding to the accessed object, denoted as URLi. Here, the accessed object is the object accessed by the user or the attacker, such as a page of each business website, a page of each commodity ordering website, etc. Then output to step 802.

[0084] Step 802: Set the honeypot updating switch button, including OFF and ON states. That is, set the honeypot updating switch button for the URLi information obtained in step 801.

[0085] Step 803: Operate the honeypot updating switch button to select the switch state. That is, operate the updating switch in step 802 to select a state. It can be ON state or OFF state. And output the result to step 804 or step 805.

[0086] If the ON state is selected in step 803, proceed to step 804; if the OFF state is selected in step 803, proceed to step 805. Specifically, step 804 and step 805 are as follows.

[0087] Step 804: If the honeypot updating switch is in the ON state, apply the new honeypot generated by the honeypot generation flow. That is, receive the ON state of step 803, and apply the new honeypot generated by the honeypot generation flow. That is, for URLi, apply the corresponding new honeypot Xi.

[0088] Step 805: If the honeypot updating switch is in the OFF state, the new honeypot generated by the honeypot generation flow is not effective, and the original honeypot is directly used. That is, receive the OFF state of step 803, and for URLi, directly apply the original honeypot.

[0089] Thus, the entire method flow of the honeypot updating for attack luring and tracing is completed.

[0090] Referring to Figure 9 , the embodiment of the present application provides a honeypot generation device, the device 900 includes:

[0091] The first obtaining module 901 is configured to obtain the URL corresponding to the accessed object.

[0092] ​The second obtaining module 902 is configured to obtain information of a page corresponding to the access object according to the URL.

[0093] The generating module 903 is configured to generate a honeypot of the access object according to the page information and the original honeypot.

[0094] In an embodiment of the present application, the generating module comprises a retaining unit and a processing unit.

[0095] The retaining unit is configured to retain information corresponding to a page header and / or a page footer in the page information.

[0096] The processing unit is configured to add new information on the basis of the page information with the page header and / or the page footer retained, wherein the new information comprises calling and / or tracing code of the original honeypot interface.

[0097] In an embodiment of the present application, the code in the processing unit is dynamically generated according to a JavaScript interface corresponding to a test function in JavaScript.

[0098] In an embodiment of the present application, the device further comprises:

[0099] The judging module is configured to judge whether the update state of the initial honeypot is an open state; if the update state of the initial honeypot is the open state, the step of generating the honeypot of the access object according to the page information and the original honeypot is executed; if the update state of the initial honeypot is a closed state, the step of generating the honeypot of the access object according to the page information and the original honeypot is not executed, and the original honeypot is used.

[0100] In an embodiment of the present application, the device further comprises:

[0101] The setting module is configured to set the update state of the initial honeypot, wherein the update state comprises an open state and a closed state.

[0102] The device provided by the embodiments of the present application can realize Figures 2-3 The method embodiments shown realize various processes and achieve the same technical effects, and thus details are not repeated here.

[0103] As Figure 10 The embodiments of the present application further provide an electronic device 1000, which comprises a processor 1001, a memory 1002, a program or instruction stored in the memory 1002 and executable on the processor 1001, and the program or instruction is executed by the processor 1001 to realize the above Figures 2 to 3The various processes of the method embodiments and can achieve the same technical effect. To avoid repetition, details are not repeated here.

[0104] The embodiment of the present application also provides a readable storage medium, which stores a program or instructions, and the program or instructions are executed by a processor to realize the above method. Figures 2 to 3 The various processes of the method embodiments and can achieve the same technical effect. To avoid repetition, details are not repeated here.

[0105] The processor is the processor in the terminal in the above embodiments. The readable storage medium includes a computer readable storage medium, such as a computer readable memory (Read-Only Memory, ROM), a random access memory (Random Access Memory, RAM), a magnetic disk or an optical disk, etc.

[0106] The steps of the method or algorithm described in connection with the present application can be implemented in hardware, or by a processor executing software instructions. The software instructions can be composed of corresponding software modules, which can be stored in RAM, flash memory, ROM, EPROM, EEPROM, registers, hard disk, mobile hard disk, read-only optical disk, or any other form of storage medium well known in the art. An exemplary storage medium is coupled to the processor, so that the processor can read information from the storage medium, and can write information to the storage medium. Of course, the storage medium can also be an integral part of the processor. The processor and the storage medium can be carried in an ASIC. In addition, the ASIC can be carried in the core network interface device. Of course, the processor and the storage medium can also exist as discrete components in the core network interface device.

[0107] Those skilled in the art should realize that in one or more examples described above, the functions described in the present application can be realized by hardware, software, firmware or any combination thereof. When realized by software, these functions can be stored in a computer readable medium or transmitted as one or more instructions or codes on a computer readable medium. The computer readable medium includes computer storage medium and communication medium, wherein the communication medium includes any medium that facilitates the transmission of computer programs from one place to another. The storage medium can be any available medium that can be accessed by a general or special purpose computer.

[0108] The specific implementation described above further details the purposes, technical solutions and beneficial effects of the present application. It should be understood that the above description is merely a specific implementation of the present application and is not intended to limit the protection scope of the present application. Any modifications, equivalent replacements, improvements, etc. made on the basis of the technical solutions of the present application shall be included in the protection scope of the present application.

[0109] Those skilled in the art should understand that the embodiments of the present application can be provided as a method, a system or a computer program product. Therefore, the embodiments of the present application can adopt a completely hardware embodiment, a completely software embodiment or an embodiment combining software and hardware aspects. Moreover, the embodiments of the present application can adopt a computer program product implemented on one or more computer usable storage media (including but not limited to disk memory, CD-ROM, optical memory, etc.) containing computer usable program codes.

[0110] The embodiments of the present application are described with reference to flowcharts and / or block diagrams according to the methods, devices (systems) and computer program products of the embodiments of the present application. It should be understood that each flow and / or block in the flowcharts and / or block diagrams and the combination of the flows and / or blocks can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device produce a device implemented in the flowcharts and / or block diagrams. Figure 1 one or more flows and / or blocks Figure 1 an apparatus that carries out the functions specified in one or more flows or blocks.

[0111] These computer program instructions can also be stored in a computer readable memory capable of directing the computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer readable memory produce a manufactured product including instruction apparatus, which implements the flowcharts and / or block diagrams. Figure 1 one or more flows and / or blocks Figure 1 an apparatus that carries out the functions specified in one or more flows or blocks.

[0112] These computer program instructions can also be loaded into a computer or other programmable data processing device, so that a series of operation steps are performed on the computer or other programmable device to produce a computer implemented process, so that the instructions executed on the computer or other programmable device provide a process for implementing the flowcharts and / or block diagrams. Figure 1 one or more flows and / or blocks Figure 1 an apparatus that carries out the functions specified in one or more flows or blocks.

[0113] It will be apparent to those skilled in the art that various modifications and variations can be made to the present application without departing from the spirit or scope of the application. Thus, it is intended that the present application cover modifications and variations of this application provided they come within the scope of the appended claims and their equivalents.

Claims

1. A method for generating honeypots, characterized in that, include: Get the Uniform Resource Locator URL corresponding to the accessed object; Set the update status of the initial honeypot, which includes: on and off states; Based on the URL, obtain the page information corresponding to the accessed object; Determine if the initial honeypot update status is enabled; If the initial honeypot is in the open state, then the step of obtaining the honeypot of the accessed object based on the page information and the original honeypot is executed. If the initial honeypot is in the off state, the step of obtaining the honeypot of the accessed object based on the page information and the original honeypot is not executed, and the original honeypot is used instead; The step of obtaining the honeypot of the accessed object based on the page information and the original honeypot includes: Using the URL information, a web crawler is used to retrieve page information; The page information and the original honeypot page are integrated to form a specific honeypot corresponding to the accessed object.

2. The method according to claim 1, characterized in that, The step of obtaining the honeypot of the accessed object based on the page information and the original honeypot includes: Retain the information corresponding to the page header and / or page footer in the page information; Based on retaining the page information in the page header and / or page footer, new information is added; wherein, the new information includes: the call to the original honeypot interface and / or the source code.

3. The method according to claim 2, characterized in that, The method further includes: The code is dynamically generated based on the JavaScript interface corresponding to the test function in JavaScript.

4. A honeypot generating device, characterized in that, include: The first acquisition module is used to obtain the URL corresponding to the accessed object; The settings module is used to set the update status of the initial honeypot, which includes: on state and off state; The second acquisition module is used to acquire page information corresponding to the accessed object based on the URL; The judgment module is used to determine whether the update status of the initial honeypot is in the open state. If the update status of the initial honeypot is in the open state, the generation module is triggered to execute the step of obtaining the honeypot of the access object based on the page information and the original honeypot. If the update status of the initial honeypot is in the closed state, the generation module is not triggered to execute the step of obtaining the honeypot of the access object based on the page information and the original honeypot, and the original honeypot is used. The generation module is used to crawl page information using the URL information; and to integrate the page information with the original honeypot page to form a specific honeypot corresponding to the access object.

5. The apparatus according to claim 4, characterized in that, The generation module includes: a retention unit and a processing unit; The retention unit is used to retain information corresponding to the page header and / or page footer in the page information; The processing unit is used to add new information based on the page information retained in the page header and / or page footer; wherein the added information includes: the call to the original honeypot interface and / or the source code.

6. The apparatus according to claim 5, characterized in that, The code in the processing unit is dynamically generated based on the JavaScript interface corresponding to the test function in JavaScript.

7. An electronic device, characterized in that, include: A processor, a memory, and a program stored in the memory and executable on the processor, wherein the program, when executed by the processor, implements the steps of the method as described in any one of claims 1 to 3.

8. A readable storage medium, characterized in that, The readable storage medium stores a program that, when executed by a processor, implements the steps of the method as described in any one of claims 1 to 3.

Images