Safety hazard detection method, system, device, storage medium and electronic equipment

Abstract

The present disclosure relates to the field of data processing, and in particular to a method, system, device, storage medium, and electronic device for detecting security risks. The method is applied to a target server, the target server being connected to multiple servers to be detected, and the target server and the multiple servers to be detected being connected to a target network. The method comprises: receiving sample information of multiple high-risk sample files sent by a honeypot server; determining information of threat files in each server to be detected based on the sample information of the multiple high-risk sample files; the threat files being files stored in the server to be detected that meet preset similarity conditions with any high-risk sample file; and treating the server to be detected whose corresponding threat file information meets the preset conditions as a server to be processed, and interrupting the connection between the server to be processed and the target network. The present disclosure can reduce information security risks of the server to be detected.

Description

Technical Field

[0001] The present disclosure relates to the field of data processing, and in particular to a method, system, device, storage medium, and electronic device for detecting potential safety hazards. Background Art

[0002] In terms of server management, server information security is an issue that most server managers are more concerned about.

[0003] In order to ensure the information security of the server, the server is generally self-checked periodically through the security protection software installed in the server to identify high-risk files in the server and perform corresponding defense or antivirus processing on the identified high-risk files.

[0004] However, the self-check of the above-mentioned server identifies high-risk files in the server based on the identification method set in the security protection software. In actual application, since the attackers' attack methods on the server are updated quickly, and the attack methods of different attackers are also likely to be different, the more diverse attack methods make it impossible for the security protection software to identify high-risk files in real time. As a result, it is more likely that some high-risk files in the server are generated when the attacker attacks the server, and these high-risk files are not identified as high-risk files by the security protection software in the server. At this time, the information security risks of the server are relatively large. Summary of the Invention

[0005] In response to the technical problem of the significant information security risks of the above-mentioned servers, the technical solution adopted by this disclosure is:

[0006] According to one aspect of the present disclosure, a security risk detection method is provided, which is applied to a target server. The target server is connected to multiple servers to be detected, and the target server and the multiple servers to be detected are all connected in a target network.

[0007] The method includes:

[0008] Receive sample information of several high-risk sample files sent by the honeypot server; the sample information is determined by the honeypot server according to the attack operations it has been subjected to.

[0009] According to the sample information of several high-risk sample files, the information of the threat file in each server to be detected is determined respectively; the threat file is a file stored in the server to be detected that meets the preset similarity conditions with any high-risk sample file.

[0010] The server to be detected whose information of the corresponding threat file meets the preset conditions is used as a server to be processed, and the connection between the server to be processed and the target network is interrupted.

[0011] Referring to the above scheme, the high-risk sample files used to determine threat files in the server to be detected in the present disclosure are obtained based on the attacker's attack operations. Based on this, even if the attacker's attack means for the server to be detected are relatively novel, the attacker is still likely to use the same or similar attack means to attack the honeypot server, so the high-risk sample files can also be updated in a timely manner. Furthermore, the present invention identifies threat files based on high-risk sample files in the honeypot server, which can reduce the number of high-risk files in the server to be detected that are not identified as threat files, thereby achieving the purpose of reducing security risks of the server.

[0012] Optionally, before receiving sample information of several high-risk sample files sent by the honeypot server, the method further includes:

[0013] In response to the connection request sent by the honeypot server, the connection between each server to be detected and the target network is interrupted.

[0014] A connection is established with the honeypot server through the target network; the honeypot server is configured to disconnect from the current network before sending a connection request, and after receiving several high-risk sample files sent by the honeypot server, the honeypot server will disconnect from the target server.

[0015] The method further includes:

[0016] When the connection with the honeypot server is interrupted, each server to be detected is connected to the target network.

[0017] Referring to the above solution, compared to a honeypot server sending several high-risk sample files to a target server via a Bluetooth connection, the honeypot server in the present disclosure can send several high-risk sample files to a target server via a network connection. This reduces the time required for the honeypot server to send several high-risk sample files to the target server, thereby reducing the possibility of attackers attacking the target server through the honeypot server and reducing security risks for the target server. Furthermore, the honeypot server and the server to be detected will not be connected to the target network at the same time, thereby reducing the possibility of attackers attacking the server to be detected through the honeypot server and reducing security risks for the server to be detected.

[0018] Optionally, the sample information includes: file feature information of several high-risk sample files; the threat file information includes: the number of threat files in each server to be detected.

[0019] Based on the sample information of several high-risk sample files, determine the information of the threat files in each server to be detected, including:

[0020] The file feature information of each high-risk sample file is sent to each server to be detected.

[0021] The number of threat files in each server to be detected is received, which is returned by the server to be detected; and the file feature information of the threat file and the file feature information of any high-risk sample file meet the preset similarity condition.

[0022] The servers whose threat file information meets the preset conditions are designated as servers to be processed, including:

[0023] The servers to be detected whose corresponding number of threat files is greater than a preset number are regarded as servers to be processed.

[0024] Referring to the above scheme, the present disclosure adopts a technical scheme in which the target server receives the file feature information of several high-risk sample files sent by the honeypot server. Compared with the target server receiving several high-risk sample files sent by the honeypot server, the amount of data sent by the honeypot server to the target server in the present disclosure is smaller, and thus the time for data transmission between the honeypot server and the target server is less, which can reduce the security risks of the target server.

[0025] Optionally, the information about the threat files includes: the number of threat files in each server to be detected and the threat level of the threat files.

[0026] The servers whose threat file information meets the preset conditions are designated as servers to be processed, including:

[0027] Based on the number and threat level of threat files corresponding to each server to be detected, the threat level of each server to be detected is evaluated.

[0028] The servers to be detected whose corresponding threat levels are greater than the preset threat level are taken as servers to be processed.

[0029] Optionally, the high-risk sample file is a file that is added or opened when the honeypot server is attacked.

[0030] According to another aspect of the present disclosure, a security risk detection system is provided, including: a vulnerability deception module, a network attack defense module, a sample information audit module and a risk detection module.

[0031] Vulnerability deception module, used to induce attackers to attack the honeypot server.

[0032] The network attack defense module is used to control the connection between the honeypot server and the target network; the target network includes a target server and multiple servers to be detected, and the target server is connected to multiple servers to be detected.

[0033] The sample information audit module is used to determine the sample information of several high-risk sample files when the honeypot server is attacked, and to regularly send the sample information to the hidden danger detection module.

[0034] The hidden danger detection module is used to determine the information of threat files in each server to be detected based on the sample information of several high-risk sample files, and to select the server to be detected whose corresponding threat file information meets the preset conditions as a server to be processed, and to interrupt the connection between the server to be processed and the target network; the threat file is a file stored in the server to be detected that meets the preset similarity conditions with any high-risk sample file.

[0035] Optional sample information audit module, used to identify sample information of several high-risk sample files when the honeypot server is attacked, including:

[0036] The sample information audit module is used to use the sample information of files added and opened in the honeypot server as sample information of high-risk sample files when the honeypot server is attacked; the honeypot server stores a number of target files, and the target file is a file whose file name includes at least one target keyword. Each target file is randomly stored in any storage path of the honeypot server.

[0037] According to another aspect of the present disclosure, a security risk detection device is provided. The device is connected to multiple servers to be detected. The device and the multiple servers to be detected are both connected to a target network. The device includes:

[0038] The receiving module is used to receive sample information of several high-risk sample files sent by the honeypot server; the sample information is determined by the honeypot server according to the attack operations it is subjected to.

[0039] The determination module is used to determine the information of threat files in each server to be detected based on the sample information of several high-risk sample files; the threat file is a file stored in the server to be detected that meets the preset similarity conditions with any high-risk sample file.

[0040] The comparison module is used to select the server to be detected whose information of the corresponding threat file meets the preset conditions as a server to be processed, and interrupt the connection between the server to be processed and the target network.

[0041] According to another aspect of the present disclosure, a non-transitory computer-readable storage medium is also provided, in which at least one instruction or at least one program is stored. The at least one instruction or at least one program is loaded and executed by a processor to implement the above-mentioned safety hazard detection method.

[0042] According to another aspect of the present disclosure, an electronic device is provided, including a processor and the above-mentioned non-transitory computer-readable storage medium.

[0043] The technical solutions provided by the embodiments of the present disclosure may have the following beneficial effects:

[0044] The target server in the present disclosure can obtain the information of the threat files in each server to be detected based on the sample information of several high-risk sample files determined by the attack operation on the honeypot server, and then the server to be detected whose corresponding threat file information meets the preset conditions is regarded as a server to be processed, and the connection between the server to be processed and the target network is interrupted. In the related art, the server to be detected directly identifies high-risk files through the security protection software installed therein. Due to the relatively diverse attack methods, the identification method of the security protection software for identifying high-risk files cannot be updated in real time. Therefore, it is more likely that some high-risk files in the server to be detected in the related art are generated by the attacker when attacking the server to be detected, and these high-risk files are not identified as high-risk files by the security protection software in the server. The high-risk sample files used to determine threat files in the server to be detected in the present disclosure are obtained based on the attacker's attack operations. Based on this, even if the attacker's attack method for the server to be detected is relatively new, the attacker is still likely to use the same or similar attack method to attack the honeypot server. Therefore, the high-risk sample files can also be updated in a timely manner. Furthermore, the present invention identifies threat files based on high-risk sample files in the honeypot server, which can reduce the number of high-risk files in the server to be detected that are not identified as threat files, thereby achieving the purpose of reducing security risks of the server.

[0045] It should be understood that the foregoing general description and the following detailed description are exemplary only and are not restrictive of the present disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] In order to more clearly illustrate the technical solutions in the embodiments of the present disclosure, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present disclosure. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work. The drawings here are incorporated into the specification and constitute a part of this specification, showing embodiments that comply with the present disclosure and are used together with the specification to explain the principles of the present disclosure.

[0047] Figure 1 The figure is a flowchart of a method for detecting potential safety hazards according to an exemplary embodiment.

[0048] Figure 2The figure is a schematic block diagram of a safety hazard detection device according to an exemplary embodiment. DETAILED DESCRIPTION

[0049] The following will be combined with the accompanying drawings in the embodiments of the present disclosure to clearly and completely describe the technical solutions in the embodiments of the present disclosure. Obviously, the embodiments described are only part of the embodiments of the present disclosure, not all of the embodiments. Based on the embodiments of the present disclosure, all other embodiments obtained by those skilled in the art without making any creative efforts shall fall within the scope of protection of the present disclosure.

[0050] The embodiments of the present disclosure provide a method for detecting security risks, wherein the method can be completed by any one of the following or any combination thereof: a terminal, a server, or other devices with processing capabilities, which is not limited by the embodiments of the present disclosure.

[0051] The present disclosure embodiment takes the application of the security risk detection method to the target server as an example. Figure 1 The flowchart of the safety hazard detection method shown in the figure introduces the safety hazard detection method.

[0052] The target server is connected to a plurality of servers to be detected, and the target server and the plurality of servers to be detected are all connected in a target network. Wherein, the target network can be a network such as a wide area network or a local area network, and preferably, the target network can be a local area network.

[0053] The method comprises the following steps:

[0054] S100: Receive sample information of several high-risk sample files sent by a honeypot server.

[0055] The sample information is determined by the honeypot server according to the attack operations it is subjected to.

[0056] In one possible implementation, a user without a password or with a weak password can be created in the honeypot server system, and several common protocol ports, such as SSH (Secure Shell) or FTP (File Transfer Protocol), can be established. In this case, the honeypot server has low security protection, so as to make the attacker think that the honeypot server is easy to invade. After the honeypot server is attacked by an attacker, several high-risk sample files will be generated due to the attacker's attack operations. At this time, the honeypot server can send sample information of these high-risk sample files to the target server.

[0057] S200: Determine information about threat files in each server to be detected based on a number of high-risk sample files.

[0058] The threat file is a file stored in the server to be detected that meets the preset similarity conditions with any high-risk sample file.

[0059] Specifically, the sample information may include the corresponding high-risk sample file and / or key information of the corresponding high-risk sample file. The key information may include the file name, file type, file size, MD, and / or keywords in the file content of the corresponding high-risk sample file, which is not limited in the present embodiment. The threat file information may include the number of threat files and / or the threat level of the threat files, which is not limited in the present embodiment.

[0060] In one possible implementation, after a target server receives several high-risk sample files, it can retrieve files stored on each server to be detected based on the server identifier of each server to be detected. The server identifier can be a unique identifier for the corresponding server, such as an IP address. For each server to be detected, the target server then determines information about files stored on that server that meet a preset similarity condition with each high-risk sample file, thereby obtaining information about threat files corresponding to each high-risk sample file on each server to be detected. The threat file corresponding to each high-risk sample file is a file stored on the server to be detected that meets the preset similarity condition with the high-risk sample file.

[0061] Among them, any high-risk sample file meets the preset similarity condition with any file in the server to be detected, which can be that the similarity between the file content of the high-risk sample file and the file content of any file reaches above a preset threshold, and the preset threshold can be 70%-100%. For example, the similarity between the file content of the high-risk sample file and the file content of any file reaches above 80%.

[0062] S300: The server to be detected whose information of the corresponding threat file meets the preset conditions is used as a server to be processed, and the connection between the server to be processed and the target network is disconnected.

[0063] Specifically, the server to be detected whose threat file information meets the preset conditions may have a number of threat files greater than a preset number and / or a threat level greater than a preset threat level. The specific value of the preset number can be set based on actual conditions such as security performance requirements of the server to be detected, and is not limited in this disclosure. For example, the preset number can be set to 10 to 50.

[0064] In one possible implementation, for each server to be detected, a determination is made as to whether the threat file information corresponding to the server meets preset conditions. If so, the server is designated as a server to be processed. A determination is then made as to whether any of the servers to be processed exist among the servers to be detected. If so, a disconnection request is sent to each server to be processed. Upon receiving the disconnection request, each server to be processed will disconnect from the target network and may also send an alert to the administrator.

[0065] Therefore, the target server in the present disclosure can obtain the information of the threat files in each server to be detected based on the sample information of several high-risk sample files determined by the attack operation on the honeypot server, and then the server to be detected whose corresponding threat file information meets the preset conditions is regarded as a server to be processed, and the connection between the server to be processed and the target network is interrupted. In the related art, the server to be detected directly identifies high-risk files through the security protection software installed therein. Due to the relatively diverse attack methods, the identification method of the security protection software for identifying high-risk files cannot be updated in real time. Therefore, in the related art, it is more likely that some high-risk files in the server to be detected are the attacker's target of the server to be detected.

[0066] The high-risk files are generated when the server performs an attack operation, and these high-risk files are not identified as high-risk files by the security protection software in the server. The high-risk sample files used to identify threat files in the server to be detected in the present disclosure are obtained based on the attacker's attack operation. Based on this, even if the attacker's attack method on the server to be detected is relatively new, the attacker is still likely to use the same or similar attack method to attack the honeypot server. Therefore, the high-risk sample files can also be updated in time. In addition, the present invention can reduce the risk of identifying threat files based on the high-risk sample files in the honeypot server.

[0067] The number of high-risk files that are not identified as threat files in the server to be detected has been reduced to 0, thereby achieving the purpose of reducing the security risks of the server to 0.

[0068] Furthermore, the honeypot server in the present disclosure can send the sample information of several high-risk sample files collected to the target server, and then the target server can determine the servers to be processed among several servers to be detected, that is, the target server can determine the servers to be detected with greater information security risks among several servers to be detected, and interrupt the information security risks.

[0069] The connection between the server with the greater information security risk to be detected and the target network is reduced to reduce the impact of the server with the greater information security risk on the information security of the other 5 servers to be detected, thereby reducing the information security risk of each server to be detected.

[0070] Compared with the honeypot server sending the collected attack information directly to the server to be detected, the honeypot server and the server to be detected in the present disclosure do not need to directly communicate data, thereby reducing the possibility of attackers attacking the server to be detected through the honeypot server, further reducing the information security risks of the server to be detected.

[0071] Optionally, before the above step S100, the method further includes the following steps:

[0072] S400: In response to the connection request sent by the honeypot server, disconnect each server to be detected from the target network. S500: Establish a connection with the honeypot server via the target network.

[0073] The honeypot server is configured to disconnect from the current network before sending a connection request, and after the above step S100, the honeypot server disconnects from the target server.

[0074] The method further comprises the following steps: 5S600, when the connection with the honeypot server is interrupted, each server to be detected is connected to the target network

[0075] In one possible implementation, after the honeypot server receives several high-risk sample files, it may first disconnect from the current network and then send a connection request to the target server. Upon receiving the connection request, the target server establishes a data transmission connection with the honeypot server. The target server then proceeds to step S100 to receive the sample files of the high-risk sample files sent by the honeypot server. After the transmission is complete, the target server disconnects the data transmission connection between the target server and the honeypot server. The data transmission connection may be a Bluetooth connection, a network connection, or other connection methods capable of data transmission. The target server then proceeds to step S200.

[0076] Therefore, if an attacker is carrying out specific attack operations on a successfully controlled honeypot server before the honeypot server sends sample information of several high-risk sample files to the target server, then the honeypot server's disconnection from the current network can interrupt the attacker's control of the honeypot server, and the attacker will then need to try to re-control the honeypot server. Therefore, while the honeypot server is sending several high-risk sample files to the target server, the attacker is likely to be re-attempting to control the honeypot server or giving up on controlling the honeypot server. Consequently, while the honeypot server is sending high-risk sample files to the target server, the attacker is less likely to attack the target server through the honeypot server, thereby reducing the target server's information security risks.

[0077] In one possible implementation, the current network and the target network can be the same network. In this case, the working honeypot server and the server to be detected are connected to the same network. Files generated by the server to be detected in response to the attack will generally have similar files on the honeypot server. Therefore, compared to a scenario where the working honeypot server and the server to be detected are connected to different networks, more files with security risks can be detected on the server to be detected by using sample information from several high-risk sample files on a honeypot server connected to the same network as the server to be detected.

[0078] Regarding the current network and the target network, in another possible implementation, the current network can be a different network from the target network. In this case, the working honeypot server and the server to be detected are connected to different networks. Compared to when the working honeypot server and the server to be detected are connected to the same network, the possibility of an attacker attacking the detection server through the network connected to the honeypot server that is different from the target network is lower.

[0079] Preferably, the current network is a wide area network (WAN) and the target network is a local area network (LAN). Because devices connected to a WAN pose greater information security risks than those connected to a local area network, a WAN enables the honeypot server to collect more high-risk sample files, while a local area network can minimize information risks for the target server and the server to be tested.

[0080] In another possible embodiment, in response to receiving a connection request from the honeypot server, the target server may disconnect each server to be detected from the target network, then disconnect the honeypot server from the current network, and establish a connection between the honeypot server and the target network. In this case, the honeypot server may send sample information of several high-risk sample files to the target server via the target network. After receiving the sample information of the several high-risk sample files, the target server may return a request to disconnect the target network to the honeypot server. After receiving the request, the honeypot server may disconnect the connection with the target network. The target server may then send a connection request to the target network to each server to be detected, and each server to be detected may connect to the target network in response to the corresponding connection request. After this, the target server executes step S200 again.

[0081] Therefore, compared to a honeypot server sending several high-risk sample files to a target server via a Bluetooth connection, the honeypot server in the present disclosure can send several high-risk sample files to the target server via a network connection. This reduces the time required for the honeypot server to send several high-risk sample files to the target server, thereby reducing the possibility of attackers attacking the target server through the honeypot server and reducing the security risks of the target server. Furthermore, the honeypot server and the server to be detected will not be connected to the target network at the same time, which reduces the possibility of attackers attacking the server to be detected through the honeypot server and reduces the security risks of the server to be detected.

[0082] In another possible implementation, network security protection software such as a firewall may be installed in the honeypot server. When the honeypot server is connected to the target network, the network security protection software in the honeypot server may interrupt the connection between each server to be detected and the target network.

[0083] In another possible embodiment, the target network is the first network, and the target server, in response to receiving the connection request sent by the honeypot server, disconnects the honeypot server from the current network, and then can establish a connection between the honeypot server and the second network, where both the first network and the current network are different from the second network. At this time, the honeypot server can send sample information of several high-risk sample files to the target server connected to the first network through the second network, and then after the target server receives the sample information of several high-risk sample files, it can return a request to disconnect the second network to the honeypot server. After receiving the request, the honeypot server can disconnect from the second network and establish a connection with the current network. Therefore, even if the server to be detected is not disconnected from the first network, the honeypot server will not be connected to the first network at the same time as the server to be detected, saving computing resources. Preferably, the second network can be a local area network.

[0084] Optionally, the sample information includes: file feature information of several high-risk sample files; the threat file information includes: the number of threat files in each server to be detected:

[0085] The above step S200 includes the following steps:

[0086] S210: Send the file feature information of each high-risk sample file to each server to be detected.

[0087] S220: Receive the number of threat files in each server to be detected, which is returned by the server to be detected.

[0088] The threat file is a file whose file feature information meets a preset similarity condition with the file feature information of any high-risk sample file, and the threat file is a file stored in the server to be detected.

[0089] Specifically, the threat file is a file that has been stored in the server to be detected and whose file feature information is the same as the file feature information of any high-risk sample file.

[0090] In a possible implementation, the file characteristic information may be an identifier used to uniquely identify corresponding file content. For example, the file characteristic information may be an MD5 (MD5 Message-Digest Algorithm) value.

[0091] After obtaining a number of high-risk sample files, the honeypot server can determine the file feature information of each high-risk sample file, and then send the file feature information of the high-risk sample files to the target server.

[0092] After receiving the file characteristic information of several high-risk sample files from the honeypot server, the target server can send the file characteristic information of each high-risk sample file to the server to be detected. After receiving the file characteristic information of several high-risk sample files, each server to be detected can determine the number of threat files corresponding to each high-risk sample file on the server to be detected. The number of threat files corresponding to each high-risk sample file is the number of files on the corresponding server to be detected whose file characteristic information meets the preset similarity criteria with the file characteristic information of the high-risk sample file.

[0093] Then, each server to be detected can return the server identifier of the server to be detected and the number of threat files corresponding to each high-risk sample file in the server to be detected to the target server. The target server will sum the number of threat files corresponding to each high-risk sample file received from the same server to be detected, and associate the server identifier received from the server to be detected with the summation result to obtain the number of threat files in each server to be detected.

[0094] Therefore, the present disclosure adopts a technical solution in which the target server receives the file feature information of several high-risk sample files sent by the honeypot server. Compared with the case in which the target server receives several high-risk sample files sent by the honeypot server, the amount of data sent by the honeypot server to the target server in the present disclosure is smaller, and the time for data transmission between the honeypot server and the target server is less, which can reduce the security risks of the target server.

[0095] Furthermore, the present disclosure employs a method in which the target server receives information from each server to be detected regarding the number of threatening files in that server. Compared to related art techniques in which the target server receives file feature information for each file in each server to be detected and then determines the number of threatening files in each server to be detected based on the received file feature information for each high-risk sample file and the file feature information for each file in each server to be detected, the present disclosure can reduce the amount of data transmitted from the server to be detected to the target server, conserving the target server's computing and storage resources.

[0096] Based on this, the servers to be detected whose information of the corresponding threat files meets the preset conditions are used as servers to be processed, including:

[0097] The servers to be detected whose corresponding number of threat files is greater than a preset number are regarded as servers to be processed.

[0098] In one possible implementation, after obtaining the number of threat files corresponding to each high-risk sample file on each server to be detected, the number of threat files corresponding to each high-risk sample file on each server to be detected can be summed to obtain the number of threat files on each server to be detected. A correlation is then established between the server identifier of each server to be detected and the number of threat files on that server. For each server identifier of the server to be detected, a determination is then made as to whether the number of threat files associated with that server identifier is greater than a preset number. If so, the server to be detected corresponding to that server identifier is designated as a server to be processed.

[0099] Optionally, the information about the threat files includes: the number of threat files in each server to be detected and the threat level of the threat files.

[0100] Based on this, the servers to be detected whose information of the corresponding threat files meets the preset conditions are used as servers to be processed, including:

[0101] Based on the number and threat level of threat files corresponding to each server to be detected, the threat level of each server to be detected is evaluated.

[0102] The servers to be detected whose corresponding threat levels are greater than the preset threat level are taken as servers to be processed.

[0103] Specifically, the threat level of a threat file can be assessed based on its function, purpose, and / or stealthiness. For example, if a first threat file is used to hide itself and other viruses on its device, while a second threat file is used to collect information on its server, the threat level of the first threat file is higher than that of the second threat file.

[0104] In one possible implementation, for any server to be detected, after the target server obtains the number of threat files corresponding to it and the threat level of each threat file, the threat levels of the threat files corresponding to the target server can be summed to obtain a total threat level, and the number of threat files corresponding to the target server can be summed to obtain a total number, and then the ratio of the total threat level to the total number is used as the threat level corresponding to the server to be detected.

[0105] Optionally, the high-risk sample files are files added or opened in the honeypot server according to the attack operations it is subjected to.

[0106] In one possible implementation, when a first preset time is reached, the honeypot server may identify each file added and opened by a preset user after a second preset time as a high-risk sample file. The preset user is the aforementioned user without a password or with a weak password. The second preset time is before the first preset time. For example, the first preset time may be midnight on any date after the second preset time.

[0107] In another possible implementation, when the first preset time is reached, the operation log of the honeypot server may be searched for several files recorded in the operation log after the second preset time, and then each of the several files may be used as a high-risk sample file.

[0108] Optionally, the honeypot server stores a plurality of target files, where the target files are files whose names include at least one target keyword, and each target file is randomly stored in any storage path of the honeypot server.

[0109] In one possible implementation, the target keywords may be words that the attacker is particularly interested in, such as financial information, material transportation information, and / or bidding information. For example, the target file name may be "XXX financial information.doc," "XXX regional material transportation information.doc," or "XXX bidding information.doc."

[0110] Since the honeypot server contains files whose file names include target keywords, attackers will be more interested in attacking the honeypot server, which will enable the honeypot server to collect more high-risk sample files.

[0111] In another possible implementation, the target file may store counter-attack data. This counter-attack data is used to obtain device information of the attacker's device and / or attempt to manipulate the attacker's device after the attacker's device downloads and opens the corresponding target file. The device information may include the device's IP address, attack software installed on the device, or the port number of a protocol port established on the device.

[0112] In another possible implementation, the storage paths of target files opened by the attacker may be collected, and each server to be detected may be preferentially searched from the collected storage paths to determine whether there are threat files, thereby reducing the possibility that the threat files in the server to be detected are not detected.

[0113] Optionally, the target server can be protected with tools or technologies such as antivirus software, firewalls, SELinux (Security-Enhanced Linux), authentication, access control, and / or communication data encryption. This can reduce the possibility of attackers attacking the target server through the honeypot server and mitigate security risks of the target server.

[0114] Optionally, several commonly used software can be installed in the honeypot server, such as document editing, browser or video and audio playback software, to simulate a real server, so as to make attackers mistakenly believe that the honeypot server is a server storing real information, thereby inducing attackers to perform more attack operations in the honeypot server and obtain more high-risk sample files.

[0115] The disclosed embodiment also provides a security risk detection system, which includes a vulnerability deception module, a network attack defense module, a sample information audit module and a risk detection module.

[0116] Vulnerability deception module, used to induce attackers to attack the honeypot server.

[0117] The network attack defense module is used to control the connection between the honeypot server and the target network.

[0118] The target network includes a target server and multiple servers to be detected, and the target server is connected to multiple servers to be detected.

[0119] The sample information audit module is used to determine the sample information of several high-risk sample files when the honeypot server is attacked, and to regularly send the sample information to the hidden danger detection module.

[0120] The hidden danger detection module is used to determine the information of threat files in each server to be detected based on the sample information of several high-risk sample files, and to select the server to be detected whose corresponding threat file information meets the preset conditions as a server to be processed, and to interrupt the connection between the server to be processed and the target network.

[0121] The threat file is a file stored in the server to be detected that meets the preset similarity conditions with any high-risk sample file.

[0122] Optional sample information audit module, used to identify sample information of several high-risk sample files when the honeypot server is attacked, including:

[0123] The sample information audit module is used to treat the sample information of files added and opened in the honeypot server as the sample information of high-risk sample files when the honeypot server is attacked.

[0124] The target file is a file whose file name includes at least one target keyword, and each target file is randomly stored in any storage path of the Honeypot 5 server.

[0125] The embodiments of the present disclosure also provide a safety hazard detection device, which is used to implement the above-mentioned safety hazard detection method.

[0126] The device is connected to a plurality of servers to be detected, and both the device and the plurality of servers to be detected are connected in a target network.

[0127] Reference Figure 2 As shown in the schematic block diagram of the safety hazard detection device, the safety hazard detection device 700 includes: a receiving module 701, a determining module 702 and a comparing module 703.

[0128] 0 Receiving module 701 is used to receive sample information of several high-risk sample files sent by the honeypot server; the sample information is determined by the honeypot server according to the attack operations it has been subjected to.

[0129] The determination module 702 is used to determine the information of threat files in each server to be detected based on the sample information of several high-risk sample files; a threat file is a file stored in the server to be detected that meets the preset similarity conditions with any high-risk sample file.

[0130] The comparison module 703 is configured to select the server to be detected whose information of the corresponding threat file meets the preset conditions as a server to be processed, and to disconnect the server to be processed from the target network.

[0131] Optionally, the device further includes a network disconnection module, configured to:

[0132] Before receiving sample information of several high-risk sample files sent by the honeypot server, in response to a connection request sent by the honeypot server, the connection between each server to be detected and the target network is interrupted.

[0133] 0 Establish a connection with the honeypot server through the target network; the honeypot server is configured to disconnect from the current network before sending a connection request, and after receiving several high-risk sample files sent by the honeypot server, the honeypot server will disconnect from the target server.

[0134] The device also includes a connection module for:

[0135] When the connection with the honeypot server is interrupted, each server to be detected is connected to the target network.

[0136] 5 Optionally, the sample information includes: file feature information of several high-risk sample files; the threat file information includes: the number of threat files in each server to be detected.

[0137] Optionally, the determining module 702 is further configured to:

[0138] The file feature information of each high-risk sample file is sent to each server to be detected.

[0139] The number of threat files in each server to be detected is received, which is returned by the server to be detected; and the file feature information of the threat file and the file feature information of any high-risk sample file meet the preset similarity condition.

[0140] The comparison module 703 is further configured to:

[0141] The servers to be detected whose corresponding number of threat files is greater than a preset number are regarded as servers to be processed.

[0142] Optionally, the information about the threat files includes: the number of threat files in each server to be detected and the threat level of the threat files.

[0143] The comparison module 703 is further configured to:

[0144] Based on the number and threat level of threat files corresponding to each server to be detected, the threat level of each server to be detected is evaluated.

[0145] The servers to be detected whose corresponding threat levels are greater than the preset threat level are taken as servers to be processed.

[0146] Optionally, the high-risk sample file is a file that is added or opened when the honeypot server is attacked.

[0147] An embodiment of the present disclosure also provides a non-transitory computer-readable storage medium, which can be set in an electronic device to store at least one instruction or at least one program related to implementing a method in a method embodiment. The at least one instruction or the at least one program is loaded and executed by the processor to implement the method provided in the above embodiment.

[0148] An embodiment of the present disclosure further provides an electronic device including a processor and the aforementioned non-transitory computer-readable storage medium.

[0149] Although some specific embodiments of the present disclosure have been described in detail by way of examples, those skilled in the art will appreciate that the above examples are for illustrative purposes only and are not intended to limit the scope of the present disclosure. Those skilled in the art will also appreciate that various modifications may be made to the embodiments without departing from the scope and spirit of the present disclosure. The scope of the present disclosure is defined by the appended claims.

Claims

1. A method for detecting potential safety hazards, characterized in that: Applied to a target server, the target server is connected to a plurality of servers to be detected, and the target server and the plurality of servers to be detected are all connected in a target network; The method comprises: Receive sample information of several high-risk sample files sent by a honeypot server; the sample information is determined by the honeypot server according to the attack operation it is subjected to; Determine information about threat files in each server to be detected based on sample information of the plurality of high-risk sample files; the threat files are files stored in the server to be detected that meet preset similarity conditions with any of the high-risk sample files; The server to be detected whose information of the corresponding threat file meets the preset conditions is designated as a server to be processed, and the connection between the server to be processed and the target network is disconnected; Before receiving sample information of a plurality of high-risk sample files sent by the honeypot server, the method further includes: In response to a connection request sent by the honeypot server, interrupting the connection between each of the servers to be detected and the target network; Establishing a connection with the honeypot server through the target network; the honeypot server is configured to disconnect from the current network before sending the connection request, and after receiving several high-risk sample files sent by the honeypot server, the honeypot server disconnects from the target server; The method further comprises: When the connection with the honeypot server is disconnected, each of the servers to be detected is connected to the target network.

2. The method according to claim 1, characterized in that The sample information includes: file feature information of several high-risk sample files; the information of the threat files includes: the number of threat files in each server to be detected; The step of determining information about threatening files in each server to be detected based on sample information of the plurality of high-risk sample files includes: Sending the file feature information of each high-risk sample file to each of the servers to be detected; receiving the number of threat files in each of the servers to be detected, which is returned by the server to be detected; and verifying that the file feature information of the threat file and the file feature information of any of the high-risk sample files meet a preset similarity condition; The step of selecting a server to be detected whose information of the corresponding threat file meets a preset condition as a server to be processed includes: The servers to be detected whose corresponding number of threat files is greater than a preset number are regarded as servers to be processed.

3. The method according to claim 1, characterized in that The information of the threat files includes: the number of threat files in each server to be detected and the threat level of the threat files; The step of selecting a server to be detected whose information of the corresponding threat file meets a preset condition as a server to be processed includes: Evaluate the threat level of each server to be detected based on the number and threat level of threat files corresponding to each server to be detected; The servers to be detected whose corresponding threat levels are greater than the preset threat level are taken as servers to be processed.

4. The method according to claim 1, wherein The high-risk sample files are files that are added or opened when the honeypot server is attacked.

5. A safety hazard detection system, characterized in that: The system includes vulnerability deception module, network attack defense module, sample information audit module and hidden danger detection module; The vulnerability deception module is used to induce attackers to attack the honeypot server; The network attack defense module is used to control the connection between the honeypot server and the target network; the target network includes a target server and multiple servers to be detected, and the target server is connected to multiple servers to be detected; The sample information audit module is used to determine the sample information of several high-risk sample files when the honeypot server is attacked, and to regularly send the sample information to the hidden danger detection module; The hidden danger detection module is configured to determine the information of threat files in each server to be detected based on the sample information of the plurality of high-risk sample files, select a server to be detected whose threat file information meets preset conditions as a server to be processed, and disconnect the server to be processed from the target network; the threat file is a file stored in the server to be detected that meets preset similarity conditions with any of the high-risk sample files; In response to receiving the connection request sent by the honeypot server, the target server disconnects each server to be detected from the target network; The honeypot server is disconnected from the current network and connected to the target network. The honeypot server sends sample information of several high-risk sample files to the target server through the target network. After the target server receives sample information of several high-risk sample files, it returns a request to disconnect the target network to the honeypot server. After receiving the request, the honeypot server disconnects from the target network. The target server sends a connection request of the target network to each server to be detected, and each server to be detected connects to the target network in response to the corresponding connection request.

6. The system according to claim 5, characterized in that The sample information audit module is used to identify sample information of several high-risk sample files when the honeypot server is attacked, including: The sample information audit module is used to use the sample information of files added and opened in the honeypot server as sample information of high-risk sample files when the honeypot server is attacked; the honeypot server stores a number of target files, and the target files are files whose file names include at least one target keyword. Each of the target files is randomly stored in any storage path of the honeypot server.

7. A safety hazard detection device, characterized in that: The device is connected to a plurality of servers to be detected, and the device and the plurality of servers to be detected are all connected to a target network; The device comprises: A receiving module, configured to receive sample information of a plurality of high-risk sample files sent by a honeypot server; the sample information is determined by the honeypot server according to the attack operation it is subjected to; a determination module, configured to determine information about a threat file in each server to be detected based on sample information of the plurality of high-risk sample files; the threat file being a file stored in the server to be detected that meets a preset similarity condition with any of the high-risk sample files; A comparison module is used to select a server to be detected whose information of the corresponding threat file meets the preset conditions as a server to be processed, and to interrupt the connection between the server to be processed and the target network; The device further includes a network disconnection module, configured to: Before receiving sample information of several high-risk sample files sent by the honeypot server, in response to a connection request sent by the honeypot server, interrupt the connection between each server to be detected and the target network; Establish a connection with the honeypot server through the target network; the honeypot server is configured to disconnect from the current network before sending a connection request, and after receiving several high-risk sample files from the honeypot server, the honeypot server will disconnect from the target server; The device also includes a connection module for: When the connection with the honeypot server is interrupted, each server to be detected is connected to the target network.

8. A non-transitory computer-readable storage medium, wherein the storage medium stores at least one instruction or at least one program, wherein the at least one instruction or the at least one program is loaded and executed by a processor to implement the method according to any one of claims 1 to 4.

9. An electronic device, characterized in that: comprising a processor and the non-transitory computer-readable storage medium of claim 8.

Images