Honeypot technology implementation method, device and equipment and storage medium

Abstract

The application discloses a honeypot technology implementation method and device, equipment and a storage medium, relates to the network security technical field, and is used for improving the deployment efficiency of the honeypot technology. The method comprises the following steps: dividing a physical host into a plurality of virtual nodes, wherein the plurality of virtual nodes at least comprise a virtual configuration node and a virtual capture node; configuring network parameters for the virtual capture node through the virtual configuration node, wherein the network parameters comprise at least one of the following: an IP address, a MAC address, a gateway address and a subnet mask; capturing abnormal data through the virtual capture node, wherein the abnormal data comprises at least one of the following: an identifier of an abnormal host and an abnormal behavior, and a honeypot pseudo-service is deployed in the virtual capture node. The application is applied to a scene of deploying the honeypot technology.

Description

Technical Field

[0001] This application relates to the field of network security technology, and in particular to a honeypot technology implementation method, apparatus, device and storage medium. Background Technology

[0002] Currently, network intrusions primarily occur by compromising computer service ports. In computer communication services, services such as Secure Shell (SSH) and File Transfer Protocol (FTP) require specific ports (e.g., ports 1-65535), allowing the computer to communicate and perform these services. In related technologies, honeypots can be deployed to protect network security. A honeypot is a virtualized device that simulates fake services on a port to deceive malicious hosts and gain access to the malicious host's Internet Protocol Address (IP address) and attack methods. Honeypots are typically implemented through highly integrated host hardware deployment or software-based deployment.

[0003] However, in the methods described above, highly integrated host hardware is often large equipment in data centers, requiring significant space. Furthermore, highly integrated host hardware is typically a product of security vendors, resulting in high procurement costs and high space and economic costs for deployment. Software honeypots, on the other hand, require specific physical hosts to complete deployment, which are often unavailable in dedicated data centers such as communication equipment rooms, as well as in some remote areas. Moreover, the deployment of software honeypots is cumbersome, demanding a high level of technical expertise from deployment personnel; improper deployment can also create other security risks. Therefore, current honeypot technology deployment efficiency is low, and deployment is difficult. Summary of the Invention

[0004] This application provides a method, apparatus, device, and storage medium for implementing honeypot technology, which can improve the deployment efficiency of honeypot technology.

[0005] To achieve the above objectives, this application adopts the following technical solution:

[0006] Firstly, a honeypot technology implementation method is provided, which includes: dividing a physical host into multiple virtual nodes, the multiple virtual nodes including at least: a virtual configuration node and a virtual capture node; configuring network parameters for the virtual capture node through the virtual configuration node, the network parameters including at least one of the following: IP address, MAC address, gateway address, and subnet mask; capturing abnormal data through the virtual capture node, the abnormal data including at least one of the following: the identifier of the abnormal host and abnormal behavior, and a honeypot pseudo-service is deployed in the virtual capture node.

[0007] In one design, the multiple virtual nodes also include a virtual center node, and the method further includes: configuring network parameters for the virtual center node through a virtual configuration node; recording abnormal data captured by the virtual capture node through the virtual center node, and outputting the abnormal data.

[0008] In one design, the virtual capture node includes at least one of the following: an interactive pseudo-port, a recording pseudo-port, and a recording unit. The interactive pseudo-port is used to simulate interactive information and acquire interactive data. The recording pseudo-port is used to acquire access data when interactive information cannot be simulated. The recording unit is used to record interactive data and access data. Abnormal data includes interactive data and access data. Capturing abnormal data through the virtual capture node includes: when access data is received, simulating the business interaction process through the interactive pseudo-port to determine the interactive data corresponding to the access data; when access data is received but the business interaction process cannot be simulated through the interactive pseudo-port, acquiring the access data through the recording pseudo-port; and recording the interactive data and access data through the recording unit.

[0009] In one design, the physical host is an x86 architecture physical micro-host, and the virtual configuration nodes, virtual capture nodes, and virtual central nodes interact with each other through a virtual switch.

[0010] Secondly, a honeypot technology implementation device is provided, comprising: a processing unit, a configuration unit, and a capture unit; the processing unit is used to divide a physical host into multiple virtual nodes, the multiple virtual nodes including at least: a virtual configuration node and a virtual capture node; the configuration unit is used to configure network parameters for the virtual capture node through the virtual configuration node, the network parameters including at least one of the following: IP address, MAC address, gateway address, and subnet mask; the capture unit is used to capture abnormal data through the virtual capture node, the abnormal data including at least one of the following: the identifier of the abnormal host and abnormal behavior, and a honeypot pseudo-service is deployed in the virtual capture node.

[0011] In one design, the multiple virtual nodes further include a virtual central node. The honeypot technology implementation device also includes a recording unit; a configuration unit for configuring network parameters for the virtual central node through a virtual configuration node; and a recording unit for recording abnormal data captured by the virtual capture node through the virtual central node and outputting the abnormal data.

[0012] In one design, the virtual capture node includes at least one of the following: an interactive pseudo-port, a recording pseudo-port, and a recording unit; the interactive pseudo-port is used to simulate interactive information and acquire interactive data; the recording pseudo-port is used to acquire access data when interactive information cannot be simulated; the recording unit is used to record interactive data and access data; and abnormal data includes interactive data and access data. A processing unit is used to, upon receiving access data, simulate a business interaction process through the interactive pseudo-port to determine the corresponding interactive data; a processing unit is used to, upon receiving access data and when a business interaction process cannot be simulated through the interactive pseudo-port, acquire the access data through the recording pseudo-port; and a processing unit is used to record interactive data and access data through the recording unit.

[0013] In one design, the physical host is an x86 architecture physical micro-host, and the virtual configuration nodes, virtual capture nodes, and virtual central nodes interact with each other through a virtual switch.

[0014] Thirdly, an electronic device is provided, comprising: a processor and a memory; wherein the memory is used to store one or more programs, the one or more programs including computer execution instructions, and when the electronic device is running, the processor executes the computer execution instructions stored in the memory to cause the electronic device to perform a honeypot technology implementation method as described in the first aspect.

[0015] Fourthly, a computer-readable storage medium is provided for storing one or more programs, the one or more programs including instructions that, when executed by a computer, cause the computer to perform a honeypot technology implementation method as described in the first aspect.

[0016] This application provides a method, apparatus, device, and storage medium for implementing honeypot technology, applied in scenarios where honeypot technology is deployed, to improve the deployment efficiency of honeypot technology. First, the physical host is divided into multiple virtual nodes, including virtual configuration nodes and virtual capture nodes with deployed honeypot pseudo-services. Network parameters, including IP address, MAC address, gateway address, and subnet mask, are configured for the virtual capture nodes through the virtual configuration nodes. Then, abnormal data, including the identifier of abnormal hosts and abnormal behavior, is captured through the virtual capture nodes. This method achieves software and hardware decoupling based on the physical host and virtual nodes, and configures the network parameters of other virtual nodes based on the virtual configuration nodes, enabling plug-and-play deployment of honeypot technology and improving deployment efficiency. Attached Figure Description

[0017] Figure 1 A schematic diagram of a honeypot technology implementation system provided for embodiments of this application. Figure 1 ;

[0018] Figure 2 A flowchart illustrating a honeypot technology implementation method provided in this application. Figure 1 ;

[0019] Figure 3 A flowchart illustrating a honeypot technology implementation method provided in this application. Figure 2 ;

[0020] Figure 4 A flowchart illustrating a honeypot technology implementation method provided in this application. Figure 3

[0021] Figure 5 A schematic diagram of a honeypot technology implementation system provided for embodiments of this application. Figure 2 ;

[0022] Figure 6 A schematic diagram of a honeypot technology implementation system provided for embodiments of this application. Figure 3 ;

[0023] Figure 7 A schematic diagram of a honeypot technology implementation device provided for an embodiment of this application;

[0024] Figure 8 This is a schematic diagram of an electronic device structure provided for an embodiment of this application. Detailed Implementation

[0025] The technical solutions in the embodiments of this application will now be described with reference to the accompanying drawings.

[0026] In the description of this application, unless otherwise stated, " / " means "or". For example, A / B can mean A or B. "And / or" in this document is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A alone, A and B simultaneously, and B alone. Furthermore, "at least one" and "multiple" refer to two or more. The terms "first," "second," etc., do not limit the quantity or order of execution, and "first," "second," etc., do not necessarily imply differences.

[0027] The honeypot technology implementation method provided in this application embodiment can be applied to honeypot technology implementation systems. Figure 1 A schematic diagram of one structure of the honeypot technology implementation system is shown. Figure 1 As shown, the honeypot technology implementation system 20 includes: server 21 and electronic device 22.

[0028] The honeypot technology implementation system 20 can be used in the Internet of Things. The honeypot technology implementation system 20 may include hardware such as multiple central processing units (CPUs), multiple memories, and storage devices storing multiple operating systems.

[0029] Server 21 is used to store data. For example, server 21 can be a database that stores network parameters, providing the electronic device 22 with the data format required to configure network parameters.

[0030] Optionally, server 21 can also be used to store abnormal data.

[0031] Electronic device 22 can be used in the Internet of Things to process data. For example, electronic device 22 can interact with server 21 to obtain network parameters stored by server 21 and configure network parameters for virtual capture nodes.

[0032] The following describes a honeypot technology implementation method provided by an embodiment of this application with reference to the accompanying drawings.

[0033] like Figure 2 As shown, an embodiment of this application provides a honeypot technology implementation method, including steps S201-S203:

[0034] S201. Divide the physical host into multiple virtual nodes.

[0035] Among them, multiple virtual nodes include at least: virtual configuration nodes and virtual capture nodes.

[0036] Optionally, the physical host can be divided into multiple virtual nodes through host virtualization.

[0037] It's important to understand that host virtualization can be understood as building an abstraction layer on top of computer hardware (physical host) through software. This allows the hardware's processor, memory, storage hard drive, etc., to be divided into multiple virtual machines (VMs), each running its own operating system. Thus, even though they are all actually running on the underlying computer hardware, each VM can behave as an independent computer.

[0038] Optionally, each virtual node can be directly connected to a physical port of the physical host.

[0039] Optionally, multiple virtual nodes can be connected to their respective production networks.

[0040] For example, a virtual configuration node can be connected to an intranet, i.e., a local area network (LAN), while a virtual capture node can be connected to an extranet (also known as a wide area network or public network).

[0041] S202. Configure network parameters for the virtual capture node through the virtual configuration node.

[0042] The network parameters include at least one of the following: IP address, MAC address, gateway address, and subnet mask.

[0043] Optional, MAC address, refers to Media Access Control (MAC) address, also known as physical address or hardware address, used to define the location of network devices; gateway address, also known as gateway, usually refers to the IP address of a network that connects to other networks; subnet mask, also known as network mask, address mask, or subnet mask, is used to indicate which bits of an IP address identify the subnet where the host is located, and which bits identify the host bitmask.

[0044] Optionally, the IP address of a computer or other device terminal can be set to the default network segment of the virtual configuration node (e.g., 192.168.188.1) through initial configuration to access the web page of the virtual configuration node, thereby configuring network parameters for the virtual capture node.

[0045] Optionally, after configuration, network parameters can be transmitted to the virtual capture node via a communication connection.

[0046] Optionally, based on specific business needs, honeypot technology configuration information can be configured for the virtual capture node through the virtual configuration node, such as collection port information and abnormal data recording format. Collection port information refers to the types and number of ports collected by the virtual capture node, to avoid misjudgments by the virtual capture node.

[0047] It should be noted that configuring network parameters for the virtual capture node through the virtual configuration node can be understood as ensuring that the relevant network parameters of the virtual capture node are consistent with the network parameters of the location where the honeypot technology is deployed.

[0048] For example, taking an IP address as an example, an IP address is an Internet Protocol address (IP address). In this embodiment of the application, the IP address can be the IP address of the network where the honeypot technology is deployed. For example, if the honeypot technology needs to be deployed in data center A, then the IP address is the IP address of data center A.

[0049] It should be noted that honeypot technology can be deployed in a plug-and-play manner through virtual configuration nodes. That is, for different scenarios, technical personnel only need to deploy the physical host in a specific location and change the network configuration parameters of the relevant virtual nodes to deploy the honeypot technology.

[0050] Optionally, after the network parameters are configured, the physical port of the virtual configuration node can be disconnected and wait for other virtual nodes to come online.

[0051] S203. Capture abnormal data through a virtual capture node.

[0052] The abnormal data includes at least one of the following: the identifier and abnormal behavior of the abnormal host, and the deployment of a honeypot pseudo-service in the virtual capture node.

[0053] Optionally, the identifier of the abnormal host can be a unique identifier that indicates the abnormal host, such as its IP address.

[0054] It should be noted that abnormal behavior mainly refers to the attack behavior of abnormal hosts (i.e., attackers), the tools and methods used by attackers, and other information.

[0055] Optionally, a honeypot pseudo-service is deployed in the virtual capture node. This can be understood as the virtual capture node being the deployment node for the honeypot pseudo-service. The honeypot pseudo-service refers to the pseudo-service in honeypot technology.

[0056] It should be noted that honeypot technology is essentially a technique to deceive attackers. It usually requires deploying some attention, network services, or information (i.e., pseudo-services in the embodiments of this application) to induce attackers to launch attacks on the pseudo-services.

[0057] Optionally, after capturing abnormal data through the virtual capture node, the abnormal data can also be organized, parsed, and recorded.

[0058] In this embodiment, the physical host is first divided into multiple virtual nodes, including virtual configuration nodes and virtual capture nodes with deployed honeypot pseudo-services. Network parameters, including IP address, MAC address, gateway address, and subnet mask, are configured for the virtual capture nodes through the virtual configuration nodes. Then, the virtual capture nodes capture abnormal data, including the identifier of the abnormal host and abnormal behavior. This method achieves software and hardware decoupling based on the physical host and virtual nodes, and configures the network parameters of other virtual nodes based on the virtual configuration nodes, enabling plug-and-play deployment of honeypot technology and improving deployment efficiency.

[0059] In one design, multiple virtual nodes also include: a virtual central node, such as... Figure 3 As shown, the honeypot technology implementation method provided in this application embodiment further includes S301-S302:

[0060] S301. Configure network parameters for the virtual center node through the virtual configuration node.

[0061] Among them, the first type of terminal equipment is the terminal equipment that connects to the macro base station in the first time slot.

[0062] Optionally, the IP address of a computer or other device terminal can be set to the default network segment of the virtual configuration node (e.g., 192.168.188.1) through initial configuration to access the web page of the virtual configuration node, thereby configuring network parameters for the virtual center node.

[0063] Optionally, after configuration, network parameters can be transmitted to the virtual central node via a communication connection.

[0064] Optionally, based on specific business needs, relevant configuration information for honeypot technology can be configured for the virtual central node through virtual configuration nodes, such as collection port information and abnormal data recording format.

[0065] It should be noted that configuring network parameters for the virtual central node through the virtual configuration node can be understood as ensuring that the relevant network parameters of the virtual central node are consistent with the network parameters of the location where the honeypot technology is deployed.

[0066] For example, taking an IP address as an example, in this embodiment of the application, the IP address can be the IP address of the network where the honeypot technology is deployed. For example, if the honeypot technology needs to be deployed in data center A, then the IP address is the IP address of data center A.

[0067] Optionally, the network parameters of the virtual capture node and the virtual center node can be further adjusted based on deployment requirements and related business needs.

[0068] For example, for a virtual capture node, since it is necessary to capture abnormal data in a timely manner, the network parameters of the virtual capture node can be configured to the network parameters of the public network; for a virtual center node, since it records core abnormal data information, in order to avoid the exposure of this information, the network parameters of the virtual center node can be configured to the network parameters of the local area network (internal network), so that for the attacker, only the pseudo-service deployed by the virtual capture node exists, thereby better enticing the attacker to carry out the attack.

[0069] S302. Record the abnormal data captured by the virtual capture node through the virtual central node, and output the abnormal data.

[0070] Optionally, after capturing abnormal data, the virtual capture node can organize and record the abnormal data, and then send the record to the virtual central node.

[0071] Optionally, abnormal data information can be sent to the virtual central node in the form of logs.

[0072] Optionally, after receiving the log, the virtual central node can organize, parse, and store the log file in the database, thereby recording abnormal data.

[0073] Optionally, the virtual central node can also analyze and summarize abnormal data and output it in the form of graphical reports.

[0074] Optionally, a virtual central node can be used to achieve log reception and report output in a distributed deployment mode of honeypot technology.

[0075] In this embodiment, by setting up a virtual central node, the abnormal data captured by the virtual capture node is organized, summarized and output, realizing the rapid recording and visual analysis of abnormal data. This enables further analysis of abnormal data after the honeypot technology is deployed, thereby improving the user experience of the honeypot technology.

[0076] In one design, the virtual capture node includes at least one of the following: an interactive pseudo-port, a recording pseudo-port, and a recording unit. The interactive pseudo-port is used to simulate interactive information and acquire interactive data. The recording pseudo-port is used to acquire access data when interactive information cannot be simulated. The recording unit is used to record interactive data and access data. Abnormal data includes interactive data and access data, such as... Figure 4 As shown, in the honeypot technology implementation method provided in this application embodiment, the above-mentioned S203 includes S401-S403:

[0077] S401. Upon receiving access data, simulate the business interaction process through an interactive pseudo-port to determine the corresponding interaction data.

[0078] Optional, such as Figure 5 As shown, interactive pseudo-ports can simulate common service ports, such as port 21 for File Transfer Protocol (FTP), port 22 for Secure Shell Protocol (SSH), port 23 for TELNET, port 25 for Simple Mail Transfer Protocol (SMTP), port 53 for Domain Name System (DNS), port 80 for Hypertext Transfer Protocol (HTTP), and port 443 for Hypertext Transfer Protocol over Secure Socket Layer (HTTPS).

[0079] Optionally, for common service ports, normal business interaction processes can be simulated based on preset protocol standards to achieve the effect of interactive pseudo-ports.

[0080] For example, if message A sent by the attacker is determined to be a message that conforms to the SSH service, the virtual capture node can simulate an interactive pseudo-port 22 to simulate the normal business interaction process of the SSH protocol and return the corresponding message a to the attacker in order to prevent it from being detected by Trojan viruses and to obtain the attacker's access traffic information (i.e., interaction data).

[0081] S402. When access data is received and the business interaction process cannot be simulated through the interactive pseudo-port, the access data is obtained through the logistic pseudo-port.

[0082] Optional, such as Figure 5 As shown, the record-style pseudo-port is an uncommon service port, meaning that the protocol standard corresponding to the attacker's message cannot be determined in advance, and the business interaction process cannot be simulated.

[0083] For example, if the protocol standard corresponding to message 123 sent by the attacker cannot be determined after evaluation, the virtual capture node will mimic a recording pseudo-port to obtain the attacker's access traffic information (i.e., access data).

[0084] S403. Record interactive data and access data through the recording unit.

[0085] Optional, combined Figure 5After the virtual capture node obtains the attacker's access traffic information through an interactive pseudo-port or a logging pseudo-port, it can record the access traffic information through the logging unit and generate a log file that is sent to the virtual central node periodically or at fixed intervals.

[0086] For example, after recording access traffic information, the recording unit can generate a log file once per hour or per minute and send the log file to the virtual central node.

[0087] In this embodiment, a virtual capture node is used to mimic common service interfaces, simulating normal business interaction processes to prevent detection by Trojan viruses and thus improve the security of honeypot technology.

[0088] In one design, in a honeypot technology implementation method provided in this application embodiment, the physical host is a physical micro-host with an x86 architecture, and the virtual configuration node, virtual capture node and virtual center node interact with each other through a virtual switch.

[0089] It should be noted that in current related technologies, honeypot technology is mainly deployed on 1U hardware devices. However, when the honeypot technology implementation method provided in this application embodiment is deployed on a physical microcomputer with an x86 architecture, the deployment cost of honeypot technology can be greatly reduced due to the lower cost of the physical microcomputer with an x86 architecture. Furthermore, due to the small size of the microcomputer, the deployment space requirement is lower, and the deployment of honeypot technology can be implemented more flexibly.

[0090] For example, such as Figure 6 As shown, the x86 microcomputer can be virtualized into three parts: a virtual configuration node, a virtual capture node, and a virtual center node. The three virtual nodes are connected through a virtual switch.

[0091] Furthermore, such as Figure 6 As shown, the three virtual nodes can each directly connect to one of the three physical ports of the x86 host and are connected to the corresponding production network.

[0092] In this embodiment, a micro x86 host is used, and software and hardware are decoupled based on host virtualization, so that the device (x86 host) for deploying honeypot technology can be placed on any node, thereby achieving low-cost and wide-coverage deployment of honeypot technology.

[0093] The foregoing mainly describes the solutions provided by the embodiments of this application from a methodological perspective. To achieve the above functions, it includes corresponding hardware structures and / or software modules for executing each function. Those skilled in the art should readily recognize that, in conjunction with the units and algorithm steps of the various examples described in the embodiments disclosed herein, the embodiments of this application can be implemented in hardware or a combination of hardware and computer software. Whether a function is executed in hardware or by computer software driving hardware depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0094] This application embodiment can divide a honeypot technology implementation device into functional modules based on the above method example. For example, each function can be divided into its own functional modules, or two or more functions can be integrated into one processing module. The integrated module can be implemented in hardware or as a software functional module. Optionally, the module division in this application embodiment is illustrative and only represents one logical functional division; other division methods may be used in actual implementation.

[0095] Figure 7 This is a schematic diagram of a honeypot technology implementation device provided in an embodiment of this application. Figure 7 As shown, the honeypot technology implementation device 40 is used to improve the deployment efficiency of honeypot technology, for example, for executing... Figure 2 The diagram illustrates a method for implementing honeypot technology. The honeypot technology implementation device 40 includes: a processing unit 401, a configuration unit 402, and a capture unit 403.

[0096] Processing unit 401 is used to divide the physical host into multiple virtual nodes.

[0097] Among them, multiple virtual nodes include at least: virtual configuration nodes and virtual capture nodes.

[0098] Configuration unit 402 is used to configure network parameters for virtual capture nodes through virtual configuration nodes.

[0099] The network parameters include at least one of the following: IP address, MAC address, gateway address, and subnet mask.

[0100] The capture unit 403 is used to capture abnormal data through a virtual capture node.

[0101] The abnormal data includes at least one of the following: the identifier and abnormal behavior of the abnormal host, and the deployment of a honeypot pseudo-service in the virtual capture node.

[0102] In one design, multiple virtual nodes also include: a virtual central node, such as... Figure 7 As shown, the honeypot technology implementation device 40 also includes a recording unit 404.

[0103] Configuration unit 402 is used to configure network parameters for the virtual central node through the virtual configuration node.

[0104] Recording unit 404 is used to record abnormal data captured by virtual capture node through virtual central node and output abnormal data.

[0105] In one design, the virtual capture node includes at least one of the following: an interactive pseudo-port, a recording pseudo-port, and a recording unit 404. The interactive pseudo-port is used to simulate interactive information and acquire interactive data. The recording pseudo-port is used to acquire access data when interactive information cannot be simulated. The recording unit 404 is used to record interactive data and access data. Abnormal data includes interactive data and access data.

[0106] The processing unit 401 is used to determine the corresponding interactive data by simulating the business interaction process through an interactive pseudo-port when it receives access data.

[0107] The processing unit 401 is used to obtain access data through a record-style pseudo-port when it receives access data and cannot simulate the business interaction process through an interactive pseudo-port.

[0108] The processing unit 401 is used to record interaction data and access data through the recording unit 404.

[0109] In one design, the physical host is an x86 architecture physical micro-host, and the virtual configuration nodes, virtual capture nodes, and virtual central nodes interact with each other through a virtual switch.

[0110] In the case of implementing the functions of the integrated modules described above in hardware, this application provides another possible structural diagram of the electronic device involved in the above embodiments. For example... Figure 8 As shown, an electronic device 70 is used to improve the rationality of honeypot technology implementation, for example, for performing... Figure 2 This illustrates a honeypot technology implementation method. The electronic device 70 includes a processor 701, a memory 702, and a bus 703. The processor 701 and the memory 702 are connected via the bus 703.

[0111] Processor 701 is the control center of the communication device. It can be a single processor or a collective term for multiple processing elements. For example, processor 701 can be a general-purpose central processing unit (CPU) or other general-purpose processors. Among them, the general-purpose processor can be a microprocessor or any conventional processor.

[0112] As one embodiment, processor 701 may include one or more CPUs, for example Figure 8 CPU 0 and CPU 1 are shown in the diagram.

[0113] The memory 702 may be a read-only memory (ROM) or other type of static storage device capable of storing static information and instructions, random access memory (RAM) or other type of dynamic storage device capable of storing information and instructions, or electrically erasable programmable read-only memory (EEPROM), disk storage medium or other magnetic storage device, or any other medium capable of carrying or storing desired program code in the form of instructions or data structures and accessible by a computer, but is not limited thereto.

[0114] As one possible implementation, the memory 702 can exist independently of the processor 701. The memory 702 can be connected to the processor 701 via a bus 703 and is used to store instructions or program code. When the processor 701 calls and executes the instructions or program code stored in the memory 702, it can implement a honeypot technology implementation method provided in this application embodiment.

[0115] In another possible implementation, the memory 702 can also be integrated with the processor 701.

[0116] Bus 703 can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus. This bus can be divided into address bus, data bus, control bus, etc. For ease of representation, Figure 8 The bus is represented by a single thick line, but this does not mean that there is only one bus or one type of bus.

[0117] It should be pointed out that, Figure 8 The structure shown does not constitute a limitation on the electronic device 70. Except... Figure 8 In addition to the components shown, the electronic device 70 may include more or fewer components than illustrated, or combine certain components, or have different component arrangements.

[0118] As an example, combined Figure 7 The honeypot technology implementation device 40 performs the functions of the processing unit 401, configuration unit 402, capture unit 403, and recording unit 404. Figure 8 The processor 701 in it has the same function.

[0119] Optional, such as Figure 8 As shown, the electronic device 70 provided in this application embodiment may further include a communication interface 704.

[0120] Communication interface 704 is used to connect with other devices via a communication network. This communication network can be Ethernet, a wireless access network, a wireless local area network (WLAN), etc. Communication interface 704 may include a receiving unit for receiving data and a transmitting unit for transmitting data.

[0121] In one design, the communication interface in the electronic device provided in this application embodiment can also be integrated into the processor.

[0122] Through the above description of the embodiments, those skilled in the art will clearly understand that, for the sake of convenience and brevity, only the division of the above functional units is used as an example. In practical applications, the above functions can be assigned to different functional units as needed, that is, the internal structure of the device can be divided into different functional units to complete all or part of the functions described above. The specific working process of the system, device, and unit described above can be referred to the corresponding process in the foregoing method embodiments, and will not be repeated here.

[0123] This application also provides a computer-readable storage medium storing instructions. When a computer executes these instructions, the computer performs each step of the method flow shown in the above-described method embodiments.

[0124] Embodiments of this application provide a computer program product containing instructions that, when executed on a computer, cause the computer to perform a honeypot technology implementation method as described in the above method embodiments.

[0125] The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of computer-readable storage media (a non-exhaustive list) include: an electrical connection having one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM), registers, hard disks, optical fibers, compact disc read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof, or any other form of computer-readable storage medium in the art. An exemplary storage medium is coupled to a processor, enabling the processor to read information from and write information to the storage medium. Of course, the storage medium may also be a component of the processor. The processor and the storage medium may reside in an application-specific integrated circuit (ASIC). In the embodiments of this application, the computer-readable storage medium can be any tangible medium that contains or stores a program that can be used by or in conjunction with an instruction execution system, apparatus, or device.

[0126] Since the electronic devices, computer-readable storage media, and computer program products in the embodiments of this application can be applied to the above methods, the technical effects they can achieve can also be referred to the above method embodiments. The embodiments of this application will not be repeated here.

[0127] The above are merely specific embodiments of this application, but the scope of protection of this application is not limited thereto. Any changes or substitutions within the technical scope disclosed in this application should be covered within the scope of protection of this application.

Claims

1. A method for implementing honeypot technology, characterized in that, The method includes: The physical host is divided into multiple virtual nodes, which include at least: a virtual configuration node, a virtual capture node, and a virtual center node; the physical host is an x86 architecture physical micro-host. The virtual configuration node configures network parameters for the virtual capture node and the virtual center node to enable plug-and-play honeypot technology; the network parameters include at least one of the following: IP address, MAC address, gateway address, and subnet mask; The virtual capture node captures abnormal data, which includes at least one of the following: the identifier of the abnormal host and abnormal behavior. A honeypot pseudo-service is deployed in the virtual capture node. The virtual capture node includes at least one of the following: an interactive pseudo-port, a recording pseudo-port, and a recording unit. The interactive pseudo-port is used to simulate interactive information and obtain interactive data. The recording pseudo-port is used to obtain access data when interactive information cannot be simulated. The recording unit is used to record the interactive data and the access data. The abnormal data includes the interactive data and the access data. The process of capturing abnormal data through the virtual capture node includes: Upon receiving access data, the target interaction protocol standard is determined based on the access data, and the business interaction process of the target interaction protocol standard is simulated through the interactive pseudo-port to determine the interaction data corresponding to the access data. When access data is received and the business interaction process cannot be simulated through the interactive pseudo-port, the access data is obtained through the recording pseudo-port. The interaction data and the access data are recorded by the recording unit; The abnormal data captured by the virtual capture node is recorded by the virtual central node, and the abnormal data is output.

2. The honeypot technology implementation method according to claim 1, characterized in that, The virtual configuration node, the virtual capture node, and the virtual center node interact with each other via a virtual switch.

3. A honeypot technology implementation device, characterized in that, The device includes: a processing unit, a configuration unit, and a capture unit; The processing unit is used to divide the physical host into multiple virtual nodes, the multiple virtual nodes including at least: a virtual configuration node, a virtual capture node, and a virtual center node; the physical host is an x86 architecture physical micro-host; The configuration unit is used to configure network parameters for the virtual capture node and the virtual center node through the virtual configuration node, so as to realize the plug-and-play honeypot technology; the network parameters include at least one of the following: IP address, MAC address, gateway address, and subnet mask; The capture unit is used to capture abnormal data through the virtual capture node. The abnormal data includes at least one of the following: the identifier of the abnormal host and abnormal behavior. A honeypot pseudo-service is deployed in the virtual capture node. The virtual capture node includes at least one of the following: an interactive pseudo-port, a recording pseudo-port, and a recording unit. The interactive pseudo-port is used to simulate interactive information and obtain interactive data. The recording pseudo-port is used to obtain access data when interactive information cannot be simulated. The recording unit is used to record the interactive data and the access data. The abnormal data includes the interactive data and the access data. The process of capturing abnormal data through the virtual capture node includes: Upon receiving access data, the target interaction protocol standard is determined based on the access data, and the business interaction process of the target interaction protocol standard is simulated through the interactive pseudo-port to determine the interaction data corresponding to the access data. When access data is received and the business interaction process cannot be simulated through the interactive pseudo-port, the access data is obtained through the recording pseudo-port. The interaction data and access data are recorded by the recording unit.

4. The honeypot technology implementation device according to claim 3, characterized in that, The virtual configuration node, the virtual capture node, and the virtual center node interact with each other via a virtual switch.

5. An electronic device, characterized in that, include: A processor and a memory; wherein the memory is used to store one or more programs, the one or more programs including computer execution instructions, and when the electronic device is running, the processor executes the computer execution instructions stored in the memory to cause the electronic device to execute a honeypot technology implementation method as described in claim 1 or 2.

6. A computer-readable storage medium for storing one or more programs, characterized in that, The one or more programs include instructions that, when executed by a computer, cause the computer to perform a honeypot technology implementation method as described in claim 1 or 2.

Images