Network asset simulation method and device based on honeypot technology, equipment and medium

Abstract

The present disclosure provides a network asset simulation method and device based on honeypot technology, equipment and medium, the method comprises: obtaining the attribute information of each target network asset in the target network segment in the active state and the service information of the opened target network service; for each target network asset, based on the service information and attribute information corresponding to the target network asset, determine whether there is a target honeypot service matched with the target network service in each honeypot service pre-generated in the honeypot system; if so, bind the target network asset to the target honeypot service. By using the method, when simulating network assets, the existing honeypot services in the honeypot system can be matched with the target network services, and the existing honeypot services in the honeypot system can be directly used to simulate network assets, so that the honeypot services do not need to be created every time, thereby saving the time of simulating network assets and realizing rapid simulation.

Description

TECHNICAL FIELD

[0001] The present disclosure relates to the technical field of honeypot technology, and particularly relates to a network asset simulation method and device based on honeypot technology, equipment and medium. BACKGROUND

[0002] Honeypot technology is a technology for deceiving an attack party. A defense party uses pre-set system or network vulnerabilities to induce the attack party to attack these system or network vulnerabilities, so as to obtain and analyze the attack method of the attack party, so that the defense party can clearly understand the security threats they face, and enhance the security protection capability of the actual system through technical and management means.

[0003] Network assets refer to various devices used in a computer network, mainly including hosts, network devices and security devices, etc. It is usually necessary to simulate network assets by using honeypot technology, to induce the attack party to attack the simulated network assets, so as to formulate a corresponding method for preventing attacks by analyzing the attack means of the attack party against the network assets, and improve the security protection capability of the network assets.

[0004] At present, the main way to simulate network assets of a certain network by using honeypot technology is that a user obtains the topology of the network and the service opening situation in the network segment in advance, then creates a honeypot service with security vulnerabilities, and then binds the network assets to the created honeypot service.

[0005] However, it is difficult to achieve the demand of quickly simulating a large amount of network asset data by using the existing method of simulating network assets. Therefore, how to quickly simulate a large amount of network assets has become a problem to be solved. SUMMARY

[0006] The present disclosure provides a network asset simulation method and device based on honeypot technology, and equipment and medium, to at least solve the above technical problems existing in the prior art.

[0007] According to a first aspect of the present disclosure, a network asset simulation method based on honeypot technology is provided, the method comprising:

[0008] Obtaining attribute information of each target network asset in a target network segment in an active state and service information of a target network service opened by the target network asset;

[0009] For each target network asset, based on the service information and the attribute information corresponding to the target network asset, determining whether there is a target honeypot service matching the target network service in each honeypot service pre-generated in a honeypot system;

[0010] If yes, binding the target network asset to the target honeypot service.

[0011] In an implementation, the attribute information includes: IP, belonging network segment and MAC address of the target network asset; and the service information includes: service port and service configuration information of the target network service.

[0012] In an implementation, before the binding of the target network asset to the target honeypot service, the method further includes:

[0013] Based on the service information, a proportion of each type of target network service in the target network services opened by the target network segment is counted;

[0014] Based on the proportion, a honeypot service combination including target honeypot services of each type is determined; wherein, the proportion of each type of target honeypot service in the honeypot service combination is consistent with the corresponding proportion of the target network service matched with the honeypot service of this type;

[0015] The binding of the target network asset to the target honeypot service includes:

[0016] Creating an emulated network asset corresponding to the target network asset;

[0017] Binding the emulated network asset to the matched target honeypot service in the honeypot service combination.

[0018] In an implementation, before the binding of the emulated network asset to the matched target honeypot service in the honeypot service combination, the method further includes:

[0019] Generating a simulated network address corresponding to the MAC address of each target network asset;

[0020] The binding of the emulated network asset to the matched target honeypot service in the honeypot service combination includes:

[0021] Based on the MAC address of the target network asset corresponding to the emulated network asset, binding the target network asset to the simulated network address corresponding to the MAC address;

[0022] Binding the emulated network asset with the simulated network address to the matched target honeypot service in the honeypot service combination.

[0023] In an implementation, the method further includes:

[0024] If there is no target honeypot service matched with the target network service in each honeypot service pre-generated in the honeypot system, binding the target network asset to any port response service of the target honeypot service.

[0025] According to a second aspect of the present disclosure, a network asset emulation device based on a honeypot technology is provided, and the device comprises:

[0026] an information acquisition module configured to acquire attribute information of each target network asset in an active state in a target network segment and service information of a target network service opened by the target network asset;

[0027] a matching module configured to, for each target network asset, determine, based on the service information and the attribute information corresponding to the target network asset, whether there is a target honeypot service matching the target network service in each honeypot service pre-generated in a honeypot system;

[0028] a binding module configured to, if yes, bind the target network asset to the target honeypot service.

[0029] In an implementation, the attribute information comprises a target network asset IP, a network segment to which the target network asset belongs, and a MAC address; and the service information comprises a service port and service configuration information of the target network service.

[0030] In an implementation, the device further comprises:

[0031] a service combination determination module configured to, based on the service information, count a proportion of each type of target network service in the target network services opened by the target network segment; and determine, based on the proportion, a honeypot service combination comprising target honeypot services of each type, wherein a proportion of each type of target honeypot service in the honeypot service combination is consistent with a proportion corresponding to the target network service matched by the honeypot service of the type;

[0032] the binding module is specifically configured to create an emulation network asset corresponding to the target network asset; and bind the emulation network asset and the target honeypot service matched in the honeypot service combination.

[0033] In an implementation, the device further comprises:

[0034] a simulation address generation module configured to generate a simulation network address corresponding to a MAC address of each target network asset;

[0035] the binding module is specifically configured to bind, based on the MAC address of the target network asset corresponding to the emulation network asset, the target network asset and a simulation network address corresponding to the MAC address; and bind the emulation network asset with the bound simulation network address and the target honeypot service matched in the honeypot service combination.

[0036] In an implementable manner, the binding module is further configured to, if there is no target honeypot service in the pre-generated honeypot services in the honeypot system that matches the target network service, bind the target network asset to any port answering service of the target honeypot service.

[0037] By using the method provided in the embodiments of the present disclosure, the attribute information of each target network asset in an active state in a target network segment and the service information of an opened target network service are acquired; for each target network asset, it is determined whether there is a target honeypot service in the pre-generated honeypot services in the honeypot system that matches the target network service based on the service information and the attribute information corresponding to the target network asset; if yes, the target network asset is bound to the target honeypot service. That is, the method of the present disclosure can directly use the existing honeypot service in the honeypot system to simulate the network asset by matching the existing honeypot service in the honeypot system with the target network service when simulating the network asset, and it is not necessary to create a honeypot service each time, thereby saving the time for simulating the network asset. Compared with the prior art, the method can realize fast simulation in the case that the number of network assets that need to be simulated is relatively large.

[0038] It should be understood that the content described in this part is not intended to identify key or important features of the embodiments of the present disclosure, nor is it used to limit the scope of the present disclosure. Other features of the present disclosure will become apparent through the following description. BRIEF DESCRIPTION OF DRAWINGS

[0039] The above and other objects, features and advantages of the exemplary embodiments of the present disclosure will be more apparent from the following detailed description taken in conjunction with the accompanying drawings, in which:

[0040] In the drawings, identical or corresponding reference signs refer to identical or corresponding parts.

[0041] Figure 1 An implementation flowchart of a network asset simulation method based on honeypot technology provided in the embodiments of the present disclosure is shown;

[0042] Figure 2 A flowchart of binding a simulated network asset to a honeypot service provided in the embodiments of the present disclosure is shown;

[0043] Figure 3 A structure schematic diagram of a network asset simulation device based on honeypot technology provided in the embodiments of the present disclosure is shown;

[0044] Figure 4 A composition structure schematic diagram of an electronic device provided in the embodiments of the present disclosure is shown. DETAILED DESCRIPTION

[0045] In order to make the purposes, characteristics and advantages of the present disclosure more obvious and easy to understand, the technical solutions in the embodiments of the present disclosure will be clearly and completely described below with reference to the drawings in the embodiments of the present disclosure. Obviously, the described embodiments are only part of the embodiments of the present disclosure, rather than all the embodiments. Based on the embodiments in the present disclosure, all other embodiments obtained by those skilled in the art without creative work fall within the scope of protection of the present disclosure.

[0046] Since the existing method of simulating network assets is difficult to meet the demand of quickly simulating a large amount of network asset data. Therefore, in order to realize the quick simulation of a large amount of network assets, the present disclosure provides a network asset simulation method, device, equipment and medium based on honeypot technology. The network asset simulation method based on honeypot technology provided by the present disclosure can be applied to electronic devices capable of network asset simulation, such as computers, mobile phones and servers.

[0047] The technical solutions of the embodiments of the present disclosure will be described below with reference to the drawings in the embodiments of the present disclosure.

[0048] Figure 1 An implementation flowchart of the network asset simulation method based on honeypot technology provided by the present disclosure is shown. As shown in Figure 1 The method comprises:

[0049] S101, obtaining attribute information of each target network asset in an active state and service information of a target network service opened in a target network segment.

[0050] In the present disclosure, tools such as Nmap (network mapper) or Masscan (Internet port scanner) can be used to detect target network assets in an active state. The target network assets include but are not limited to: websites, application programs, WeChat mini programs, routers, switches, gateways, firewalls and WAF (Web Application Firewall, network application protection system) and the like.

[0051] In the present disclosure, the attribute information of each target network asset can include: target network asset IP, belonging to the network segment and MAC address. The service information of the target network service opened can include: the service port and service configuration information of the target network service.

[0052] In the present disclosure, the target network segment can be a network of a specified area, such as the intranet of A company or the intranet of B company, etc.

[0053] S102, for each target network asset, based on the service information and attribute information corresponding to the target network asset, determine whether there is a target honeypot service in each honeypot service pre-generated in the honeypot system that matches the target network service.

[0054] The honeypot system is a computer system running on the Internet. The honeypot system is specially designed to attract and those who break into other computer systems by abnormal means (such as computer hackers). The honeypot system is a system containing vulnerabilities, which provides an easy target for attackers by simulating one or more vulnerable network assets (such as hosts and switches, etc.).

[0055] In the present disclosure, the user can pre-configure the simulation of the honeypot system for some specified network segments, and create simulation assets consistent with these specified network segments. For example, the specified network segment A includes network assets 1-11, and the user can pre-create multiple honeypot services in the honeypot system, with the honeypot information consistent with the MAC address, the network segment to which the network asset belongs, the open service name, the port, the version information and the device type of the network asset 1-11 of the specified network segment A.

[0056] When the honeypot host of the honeypot system detects the target network asset in an active state by using Nmap or Masscan and other tools, for each target network asset, based on the service information and attribute information corresponding to the target network asset, for example, the MAC address, the network segment to which the network asset belongs, the open service name, the port, the version information and the device type of the target network asset can be used to search for each honeypot service pre-generated in the honeypot system, whether there is a target honeypot service whose honeypot information matches the service information and attribute information of the target network service, if there is, the target network asset is bound to the target honeypot service that matches the service information and attribute information of the target network service.

[0057] S103, if so, the target network asset is bound to the target honeypot service.

[0058] According to the method provided in the embodiment of the present disclosure, the attribute information of each target network asset in an active state in a target network segment and the service information of the target network service opened by the target network asset are acquired; for each target network asset, it is determined whether there is a target honeypot service in each honeypot service pre-generated in a honeypot system that matches the target network service based on the service information and the attribute information corresponding to the target network asset; if so, the target network asset is bound to the target honeypot service. That is, the method of the present disclosure can directly simulate the network asset by matching the existing honeypot service in the honeypot system with the target network service when simulating the network asset, without creating a honeypot service each time, thereby saving the time for simulating the network asset. Compared with the prior art, the method can achieve rapid simulation in the case that the number of network assets that need to be simulated is relatively large.

[0059] In an implementable manner, before the target network asset is bound to the target honeypot service, the network asset simulation method based on the honeypot technology further includes steps A1-A2 as follows:

[0060] Step A1, based on the service information, the proportion of each type of target network service in the target network services opened by the target network segment is counted.

[0061] In this step, the number of times of occurrence of each target network service can be determined according to the service information of each target network segment, such as service port and service configuration information. For example, according to the service port and service configuration information, it can be determined that the target network segment includes a target network service "Nginx service" and a target network service "MySQL service", wherein the target network service "Nginx service" occurs 10 times, and the target network service "MySQL service" occurs 2 times. Then, the proportion of the target network service "Nginx service" opened by the target network segment can be counted as 10 / (10+2)*100% = 83.3%, and the proportion of the target network service "MySQL service" opened by the target network segment can be counted as 2 / (10+2)*100% = 16.7%.

[0062] Step A2, based on the proportion, a honeypot service combination including each type of target honeypot service is determined.

[0063] The proportion of each type of target honeypot service in the honeypot service combination is consistent with the proportion corresponding to the target network service matched by the honeypot service of this type.

[0064] In this step, the proportion of each type of target honeypot service included in the honeypot service combination can be determined according to the proportion of the target network service. For example, if the proportion of the target network service "Nginx service" is 83.3%, the proportion of the target network service "MySQL service" is 16.7%, the target network service "Nginx service" corresponds to the target honeypot service A, and the target network service "MySQL service" corresponds to the target honeypot service B, then the honeypot service combination with the proportion of the target honeypot service A being 83.3% and the proportion of the target honeypot service B being 16.7% can be determined.

[0065] The step of binding the target network asset to the target honeypot service can include steps B1-B2 as follows:

[0066] Step B1, creating an emulated network asset corresponding to the target network asset.

[0067] Specifically, an emulated network asset with attribute information consistent with the attribute information of the target network asset can be emulated. For example, if the target network asset is host A, the attribute information of host A includes IP "196.108.0.127", belongs to network segment "target network segment A", and MAC address "08:00:20:0A:8C:6C". An emulated network asset with IP "196.108.0.127", belongs to network segment "target network segment A", and MAC address "08:00:20:0A:8C:6C" can be emulated as the emulated network asset corresponding to host A.

[0068] Step B2, binding the emulated network asset to the matching target honeypot service in the honeypot service combination.

[0069] The emulated network asset corresponding to each target network asset can be bound to the target honeypot service matching the target network asset in the honeypot service combination.

[0070] Specifically, in the present disclosure, before the emulated network asset is bound to the matching target honeypot service in the honeypot service combination, the method further includes generating a simulated network address corresponding to the MAC address of each target network asset. The simulated network address is a simulated MAC address. In the present disclosure, a simulated MAC address corresponding to the MAC address of each target network asset can be emulated according to the MAC address of each target network asset.

[0071] Based on the simulated MAC address corresponding to each target network asset, Figure 2 A flowchart of binding an emulated network asset to a honeypot service is shown, as Figure 2As shown, the binding of the simulation network asset to the matched target honeypot service in the honeypot service combination can include:

[0072] S201, binding the target network asset to the simulation network address corresponding to the MAC address of the target network asset based on the MAC address of the target network asset.

[0073] Specifically, the simulation network asset corresponding to the target network asset is bound to the simulation network address corresponding to the MAC address of the target network asset.

[0074] S202, binding the simulation network asset bound with the simulation network address to the matched target honeypot service in the honeypot service combination.

[0075] For example, if the honeypot service matched by the target network asset A in the honeypot service combination is the target honeypot service X, the simulation asset corresponding to the target network asset A is the simulation network asset M, the simulation network address corresponding to the MAC address of the target network asset A is the address "08:02:00:0A:8C:6B", and the simulation network asset M is bound to the address "08:02:00:0A:8C:6B", then the simulation network asset M can be bound to the target honeypot service X in the honeypot service combination in this step.

[0076] In an implementable manner, the network asset simulation method based on the honeypot technology further includes the following step C1:

[0077] Step C1, if there is no target honeypot service matched with the target network service in each honeypot service pre-generated in the honeypot system, then binding the target network asset to any port response service of the target honeypot service.

[0078] In the present disclosure, if there is no target honeypot service matched with the target network service in each honeypot service pre-generated in the honeypot system, the target network asset can be bound to any port response service of the target honeypot service, and then a simulation network asset consistent with the target network service is created for the bound target honeypot service, for example, a simulation network asset with MAC address, belonging to network segment, open service name, port, version information and device type information consistent with the target network service is created, thereby improving the simulation degree of the target honeypot service and the target network service.

[0079] By using the method provided in the embodiments of the present disclosure, the problem of slow simulation asset speed and complicated binding can be effectively solved, and human and material resources can be saved.

[0080] Based on the same inventive concept, the network asset simulation method based on the honeypot technology provided by the above-mentioned embodiments of the present disclosure corresponds to another embodiment of the present disclosure, which provides a network asset simulation device based on the honeypot technology, a structural schematic diagram of which is shown in Figure 3 as follows, which specifically includes:

[0081] The information acquisition module 301 is configured to acquire attribute information of each target network asset in the target network segment in an active state and service information of a target network service opened by the target network asset.

[0082] The matching module 302 is configured to, for each target network asset, determine, based on the service information corresponding to the target network asset and the attribute information, whether there is a target honeypot service matching the target network service in each honeypot service pre-generated in the honeypot system.

[0083] The binding module 303 is configured to, if yes, bind the target network asset to the target honeypot service.

[0084] The device provided by the embodiments of the present disclosure acquires attribute information of each target network asset in the target network segment in an active state and service information of a target network service opened by the target network asset. For each target network asset, based on the service information corresponding to the target network asset and the attribute information, it is determined whether there is a target honeypot service matching the target network service in each honeypot service pre-generated in the honeypot system. If yes, the target network asset is bound to the target honeypot service. That is, the method of the present disclosure can directly utilize the existing honeypot service in the honeypot system to simulate the network asset by matching the existing honeypot service in the honeypot system with the target network service, without creating a honeypot service each time, thereby saving the time for simulating the network asset. Compared with the prior art, the method can realize rapid simulation in the case that the number of network assets to be simulated is relatively large.

[0085] In an implementable manner, the attribute information includes: IP, a network segment to which the target network asset belongs, and a MAC address; and the service information includes: a service port and service configuration information of the target network service.

[0086] In an implementable manner, the device further includes:

[0087] The service combination determination module (not shown in the figure) is configured to, based on the service information, count a proportion of each type of target network service in the target network services opened by the target network segment; determine a honeypot service combination including each type of target honeypot service based on the proportion; and the proportion of each type of target honeypot service in the honeypot service combination is consistent with the proportion corresponding to the target network service matched by the honeypot service of this type.

[0088] The binding module 303 is specifically configured to create an emulated network asset corresponding to the target network asset, and bind the emulated network asset and a target honeypot service matched in the honeypot service combination.

[0089] In an implementation, the device further includes:

[0090] An emulated address generation module (not shown in the figure) is configured to generate an emulated network address corresponding to a MAC address of each target network asset.

[0091] The binding module 303 is specifically configured to bind the target network asset and an emulated network address corresponding to a MAC address of the target network asset based on the emulated network asset, and bind the emulated network asset with the emulated network address bound thereto and the target honeypot service matched in the honeypot service combination.

[0092] In an implementation, the binding module 303 is further configured to bind the target network asset to any port response service of the target honeypot service if there is no target honeypot service matched with the target network service in each honeypot service pre-generated in the honeypot system.

[0093] The device provided by the embodiments of the present disclosure can effectively solve the problem of slow speed of user emulated assets and cumbersome binding, and save human and material resources.

[0094] According to the embodiments of the present disclosure, the present disclosure further provides an electronic device and a readable storage medium.

[0095] Figure 4 A schematic block diagram of an example electronic device 400 that can be used to implement embodiments of the present disclosure is shown. The electronic device is intended to represent various forms of digital computers, such as laptops, desktops, tablets, personal digital assistants, servers, blade servers, mainframes, and other appropriate computers. The electronic device can also represent various forms of mobile devices, such as personal digital assistants, cellular telephones, smartphones, wearable devices, and other similar computing devices. The components shown here, their connections and relationships, and their functions, are meant to be examples only, and are not intended to limit implementations of the present disclosure described and / or claimed in this document.

[0096] As Figure 4As shown, the device 400 includes a computing unit 401 that can perform various appropriate actions and processes in accordance with a computer program stored in a read-only memory (ROM) 402 or a computer program loaded into a random access memory (RAM) 403 from a storage unit 408. In the RAM 403, various programs and data required for the operation of the device 400 can also be stored. The computing unit 401, the ROM 402, and the RAM 403 are connected to each other through a bus 404. An input / output (I / O) interface 405 is also connected to the bus 404.

[0097] Various components in the device 400 are connected to the I / O interface 405, including an input unit 406, such as a keyboard, a mouse, etc., an output unit 407, such as various types of displays, speakers, etc., a storage unit 408, such as a magnetic disk, an optical disk, etc., and a communication unit 409, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 409 allows the device 400 to exchange information / data with other devices through a computer network, such as the Internet, and / or various telecommunication networks.

[0098] The computing unit 401 can be various general and / or special purpose processing components with processing and computing capabilities. Some examples of the computing unit 401 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various computing units running machine learning model algorithms, a digital signal processor (DSP), and any appropriate processor, controller, microcontroller, etc. The computing unit 401 performs various methods and processes described above, such as the honeypot technology-based network asset emulation method. For example, in some embodiments, the honeypot technology-based network asset emulation method can be implemented as a computer software program that is tangibly embodied in a machine-readable medium, such as the storage unit 408. In some embodiments, part or all of the computer program can be loaded and / or installed on the device 400 via the ROM 402 and / or the communication unit 409. When the computer program is loaded into the RAM 403 and executed by the computing unit 401, one or more steps of the honeypot technology-based network asset emulation method described above can be performed. Alternatively, in other embodiments, the computing unit 401 can be configured to perform the honeypot technology-based network asset emulation method by any other appropriate means, such as by means of firmware.

[0099] Various implementations of the systems and techniques described above can be realized in digital electronic circuitry, integrated circuitry, a field programmable gate array (FPGA), an application specific integrated circuit (ASIC), a system on a chip (SOC), a complex programmable logic device (CPLD), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include implementation in one or more computer programs that are executable and / or interpretable on a programmable system including at least one programmable processor, which can be special or general purpose, coupled to receive data and instructions from, and to transmit data and instructions to, a storage system, at least one input device, and at least one output device.

[0100] Program code for carrying out methods of the present disclosure can be written in any combination of one or more programming languages. The program code can be provided to a processor or controller of a general purpose computer, special purpose computer, or other programmable data processing apparatus to produce a machine, such that the program code, when executed by the processor or controller, produces the functions / operations specified in the flowcharts and / or the block diagrams. The program code can be executed entirely on a machine, partially on a machine, partially on a machine as a stand-alone software package, partially on a machine and partially on a remote machine or entirely on a remote machine or server.

[0101] In the context of the present disclosure, a machine-readable medium can be a tangible medium that contains or stores a program for use by or in connection with an instruction execution system, apparatus, or device. The machine-readable medium can be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium can include but is not limited to an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any suitable combination of the foregoing. More specific examples of a machine-readable storage medium will include one or more lines of electrical connections, portable computer disks, hard disk drives, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or Flash memory), optical fibers, portable compact disc read-only memories (CD-ROMs), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0102] To provide for interaction with a user, the systems and techniques described here can be implemented on a computer having a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user and a keyboard and a pointing device (e.g., a mouse or a trackball) by which the user can provide input to the computer. Other kinds of devices can be used to provide for interaction with a user as well; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form, including acoustic, speech, or tactile input.

[0103] The systems and techniques described here can be implemented in a computing system that includes a back end component (e.g., as a data server), or that includes a middleware component (e.g., an application server), or that includes a front end component (e.g., a user computer having a graphical user interface or a Web browser through which a user can interact with an implementation of the systems and techniques described here), or any combination of such back end, middleware, or front end components. The components of the system can be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include a local area network (LAN), a wide area network (WAN), and the Internet.

[0104] The computer system can include clients and servers. A client and server are generally remote from each other and typically interact through a communication network. The relationship of client and server is generally established by computer programs running on the respective computers and having a client-server relationship to each other. The servers can be cloud servers, servers of a distributed system, or servers combined with a blockchain.

[0105] It should be understood that the various forms of flow shown above can be re-ordered, added to, or deleted from without departing from the scope of the present disclosure. For example, the steps recited in the present disclosure can be executed in parallel, in series, or in a different order, without departing from the desired results of the technology disclosed herein, which are not limited herein.

[0106] In addition, the terms "first", "second", etc., are used herein only to describe different instances, and do not imply or suggest relative importance or imply the number of indicated technical features. Therefore, the features defined with "first", "second" can explicitly or implicitly include at least one of the features. In the description of the present disclosure, the meaning of "a plurality of" is two or more, unless otherwise specifically limited.

[0107] The above merely provides the specific implementation of the present disclosure, but the protection scope of the present disclosure is not limited thereto, any person skilled in the art can easily think of the changes or replacements within the technical range disclosed by the present disclosure, which should be covered within the protection scope of the present disclosure. Therefore, the protection scope of the present disclosure should be subject to the protection scope of the claims.

Claims

1. A network asset emulation method based on honeypot technology, characterized in that, The method comprises: obtaining attribute information of each target network asset in an active state in a target network segment and service information of a target network service opened; the attribute information comprises: target network asset IP, a network segment to which the target network asset belongs, and a MAC address; the service information comprises: a service port and service configuration information of the target network service; based on the service information, the proportion of each type of target network service in the target network service opened by the target network segment is counted; based on the proportion, a honeypot service combination comprising each type of target honeypot service is determined; wherein the proportion of each type of target honeypot service in the honeypot service combination is consistent with the proportion corresponding to the target network service matched by the honeypot service; for each target network asset, based on the service information and the attribute information corresponding to the target network asset, it is determined whether there is a target honeypot service matched with the target network service in each honeypot service pre-generated in the honeypot system; if yes, the target network asset is bound to the target honeypot service; before binding the simulation network asset to the target honeypot service matched in the honeypot service combination, the method further comprises: generating a simulation network address corresponding to the MAC address of each target network asset; the binding of the target network asset to the target honeypot service comprises: creating a simulation network asset corresponding to the target network asset; binding the simulation network asset to the target honeypot service matched in the honeypot service combination; the binding of the simulation network asset to the target honeypot service matched in the honeypot service combination comprises: based on the MAC address of the target network asset corresponding to the simulation network asset, binding the target network asset to the simulation network address corresponding to the MAC address; binding the simulation network asset with the bound simulation network address to the target honeypot service matched in the honeypot service combination; if there is no target honeypot service matched with the target network service in each honeypot service pre-generated in the honeypot system, the target network asset is bound to any port response service of the target honeypot service.

2. A network asset emulation device based on honeypot technology, characterized by, The device comprises: an information acquisition module configured to acquire attribute information of each target network asset in an active state in a target network segment and service information of a target network service opened; the attribute information comprises: target network asset IP, a network segment to which the target network asset belongs, and a MAC address; the service information comprises: a service port and service configuration information of the target network service; The matching module is configured to: based on the service information, count a proportion of each type of target network service in the target network services opened by the target network segment; determine a honeypot service combination including each type of target honeypot service based on the proportion; wherein the proportion of each type of target honeypot service in the honeypot service combination is consistent with the proportion corresponding to the target network service matched by the honeypot service; and for each target network asset, based on the service information and the attribute information corresponding to the target network asset, determine whether there is a target honeypot service matched with the target network service in each honeypot service pre-generated in the honeypot system. The binding module is configured to: if yes, bind the target network asset to the target honeypot service; before binding the simulation network asset to the target honeypot service matched in the honeypot service combination, further comprising: generating a simulation network address corresponding to the MAC address of each target network asset; the binding of the target network asset to the target honeypot service comprises: creating a simulation network asset corresponding to the target network asset; and binding the simulation network asset to the target honeypot service matched in the honeypot service combination; the binding of the simulation network asset to the target honeypot service matched in the honeypot service combination comprises: based on the MAC address of the target network asset corresponding to the simulation network asset, binding the simulation network address corresponding to the MAC address to the target network asset; and binding the simulation network asset with the bound simulation network address to the target honeypot service matched in the honeypot service combination; and if there is no target honeypot service matched with the target network service in each honeypot service pre-generated in the honeypot system, binding the target network asset to any port response service of the target honeypot service.

3. An electronic device, comprising: Comprise: At least one processor; And The memory is in communication connection with the at least one processor; wherein The memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to execute the method in claim 1.

4. A non-transitory computer-readable storage medium having stored thereon computer instructions, wherein, The computer instructions are used to make the computer execute the method in claim 1. The computer instructions are used to make the computer execute the method in claim 1.

Images