A method and device for constructing an automated mimic honeypot

Abstract

The present invention discloses a method and device for constructing an automated mimetic honeypot, the method comprising: obtaining business information and website data of a business system uploaded by a user; selecting a basic image corresponding to the first sub-business information from an image library; desensitizing the business website data to obtain desensitized business website data; binding the basic image with the desensitized business website data to obtain a business image; automatically generating and running a mimetic honeypot in a virtual machine based on the business image and the second sub-business information; analyzing the traffic and logs of the mimetic honeypot to obtain attack events; the attack events include known vulnerabilities deployed in the honeypot and unknown attacks on the mimetic honeypot. The present invention constructs a mimetic honeypot based on relevant information and website data of the business system, reflecting the association between the constructed mimetic honeypot and the business system, and can better attract and confuse attackers.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a method and device for constructing an automated mimicry honeypot. Background Art

[0002] Amidst the development of cloud-network transformation and digital transformation, the business, data, and applications of enterprises and institutions are constantly evolving. The functionality, scale, and interactivity of information systems are constantly increasing, and the attack surface is also expanding. New attack groups, techniques, and methods are constantly emerging, and cybersecurity threats are becoming increasingly diverse and unpredictable. Traditional cybersecurity defense methods, which focus on external security hardening of target systems and detecting and eliminating known threats, are no longer effective against these attacks. To address this shortcoming, active defense technologies, primarily honeypots, are gaining increasing attention among security professionals. Honeypots actively expose vulnerabilities to lure attackers into a "fake" environment. Defenders can then obtain more information about the attackers by recording and analyzing attack activity using honeypots. However, existing honeypots have little relevance to real-world business environments, making it easy for attackers to recognize the trap and leave, limiting their effectiveness. Furthermore, existing cybersecurity defense technologies, while also comprised of hardware and software, can introduce new vulnerabilities to the target system due to their own inherent flaws. If an attacker breaks through the system's defense system through unknown vulnerabilities in the system, it is very likely that the attacker will use the honeypot as a springboard to attack the real business system.

[0003] Therefore, we must fundamentally shift our cyberspace defense philosophy and move away from the pursuit of a flawless, backdoor-free, and flawless operational scenario or defense environment to combat various cyberspace security threats. Cyberspace mimicry defense, as a new, endogenous security technology, can address threats based on vulnerabilities, backdoors, viruses, and Trojans across various cyberspace domains. This addresses the current situation where traditional security development is dominated by security attacks and risks, and achieves the ideal goal of integrated cybersecurity and functional safety.

[0004] Patent CN112367315B discloses a honeypot deployment method for an intrinsically secure WAF (Web Application Firewall). When the algorithm identifies abnormal traffic, the method doesn't deny access to the traffic. Instead, it redirects the attacker's traffic into the honeypot, misleading the attacker and obtaining relevant information. This prevents the attacker from continuously searching for patterns that might allow them to bypass the WAF. However, this invention fails to address the connection between the honeypot and the business system, making it easy for attackers to discover the nature of the honeypot and shift their attack targets or attempt to evade the attack. Summary of the Invention

[0005] The purpose of the present invention is to provide a method and device for constructing an automated mimetic honeypot, so as to reflect the association between the constructed mimetic honeypot and the business system, so as to better attract and confuse attackers.

[0006] To achieve the above object, the present invention provides the following solutions:

[0007] The present invention provides a method for constructing an automated mimic honeypot, the method comprising the following steps:

[0008] Obtaining business information and business website data uploaded by users of the business system; the business information includes first sub-business information and second sub-business information, the first sub-business information including business website front-end language type x1, business website front-end language version x2, business website back-end language type x3, business website back-end language version x4, business website middleware type x5, business website middleware version x6, business website database type x7, and business website database version x8; the second sub-business information includes an idle second-level domain name x9;

[0009] Selecting a base image corresponding to the first sub-business information from the image library; the base image includes a front-end base image y1, a back-end base image y2, and a database base image y3;

[0010] Desensitizing the business website data to obtain desensitized business website data; the desensitized business website data includes desensitized front-end code, desensitized back-end code, and desensitized database files;

[0011] Binding the base image with the desensitized business website data to obtain a business image;

[0012] Automatically generate and run a mimetic honeypot in a virtual machine based on the business image and the second sub-business information; the mimetic honeypot includes: a front-end container, a back-end container, and a database container. The operation of the mimetic honeypot is used to characterize the interaction between the front-end container and the back-end container, the interaction between the back-end container and the database container, and the network relationship of the back-end container bound to the idle second-level domain name x9 mapping the business website to the outside world;

[0013] The traffic and logs of the mimetic honeypot are analyzed to obtain unknown attacks; the unknown attacks include attacks on the business system and attacks on the mimetic honeypot.

[0014] Optionally, selecting a base image corresponding to the first sub-business information from an image library specifically includes:

[0015] Select the front-end basic image y1 from the image library that corresponds to the business website front-end language type x1 and business website front-end language version x2;

[0016] Select the backend base image y2 from the image library that corresponds to the business website backend language type x3, business website backend language version x4, business website middleware type x5, and business website middleware version x6;

[0017] Select the database base image y3 corresponding to the business website database type x7 and business website database version x8 from the image library.

[0018] Optionally, desensitizing the business website data to obtain the desensitized business website data specifically includes:

[0019] Perform static desensitization on the database files in the business website data to obtain the desensitized database files;

[0020] The front-end pages and back-end data type interfaces in the business website data are desensitized by the application system to obtain the desensitized front-end code and desensitized back-end code.

[0021] Optionally, binding the base image with the desensitized business website data to obtain a business image specifically includes:

[0022] Replace the front-end code in the base image with the desensitized front-end code to obtain the front-end image in the business image;

[0023] Replace the backend code in the base image with the desensitized backend code to obtain the backend image in the business image;

[0024] The database file in the basic image is replaced with the desensitized database file to obtain the database image in the business image.

[0025] An automated mimic honeypot construction device, applied to the above method, comprising:

[0026] A business system information acquisition module is configured to acquire business information and business website data uploaded by users of the business system; the business information includes first sub-business information and second sub-business information, the first sub-business information including business website front-end language type x1, business website front-end language version x2, business website back-end language type x3, business website back-end language version x4, business website middleware type x5, business website middleware version x6, business website database type x7, and business website database version x8; the second sub-business information includes an idle second-level domain name x9;

[0027] A base image selection module is used to select a base image corresponding to the first sub-business information from the image library; the base image includes a front-end base image y1, a back-end base image y2, and a database base image y3;

[0028] A desensitizing module is used to desensitize the business website data to obtain desensitized business website data; the desensitized business website data includes desensitized front-end code, desensitized back-end code and desensitized database files;

[0029] A binding module, used to bind the base image with the desensitized business website data to obtain a business image;

[0030] A mimetic honeypot generation and operation module, configured to automatically generate and operate a mimetic honeypot within a virtual machine based on the business image and the second sub-business information; the mimetic honeypot includes a front-end container, a back-end container, and a database container. The operation of the mimetic honeypot is used to characterize the interaction between the front-end container and the back-end container, the interaction between the back-end container and the database container, and the network relationship of the back-end container bound to the idle second-level domain name x9 mapping the business website externally;

[0031] The traffic and log analysis module is used to analyze the traffic and logs of the mimetic honeypot to obtain unknown attacks; the unknown attacks include attacks on the business system and attacks on the mimetic honeypot.

[0032] An electronic device includes a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the above method when executing the computer program.

[0033] A computer-readable storage medium stores a computer program, which implements the above method when executed.

[0034] According to the specific embodiments provided by the present invention, the present invention discloses the following technical effects:

[0035] The present invention discloses a method and device for constructing an automated mimetic honeypot, the method comprising: obtaining business information and business website data uploaded by users of a business system; selecting a basic image corresponding to the first sub-business information from an image library; desensitizing the business website data to obtain desensitized business website data; binding the basic image with the desensitized business website data to obtain a business image; automatically generating and running a mimetic honeypot in a virtual machine based on the business image and the second sub-business information; analyzing the traffic and logs of the mimetic honeypot to obtain unknown attacks; the unknown attacks include attacks on the business system and attacks on the mimetic honeypot. The present invention constructs a mimetic honeypot based on the business information and business website data of the business system, reflecting the association between the constructed mimetic honeypot and the business system, allowing attackers to discover that the attack target is the mimetic honeypot. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0037] Figure 1 A flowchart of a method for constructing an automated mimic honeypot provided by an embodiment of the present invention;

[0038] Figure 2 A schematic diagram of the structure of an automated mimic honeypot construction device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0039] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0040] The purpose of the present invention is to provide a method and device for constructing an automated mimetic honeypot, so as to reflect the association between the constructed mimetic honeypot and the business system, so as to better attract and confuse attackers.

[0041] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, the present invention is further described in detail below with reference to the accompanying drawings and specific embodiments.

[0042] Embodiment 1 of the present invention provides a method for constructing an automated mimic honeypot, such as Figure 1 As shown, the method includes the following steps:

[0043] Step 101, obtain the business information and business website data of the business system uploaded by the user; the business information includes first sub-business information and second sub-business information, the first sub-business information includes business website front-end language type x1, business website front-end language version x2, business website back-end language type x3, business website back-end language version x4, business website middleware type x5, business website middleware version x6, business website database type x7, business website database version x8, the second sub-business information includes an idle second-level domain name x9.

[0044] Among them, business information is

[0045] Step 102: Select a base image corresponding to the first sub-business information from the image library. The base image includes a front-end base image y1, a back-end base image y2, and a database base image y3, wherein the front-end base image y1 is selected based on the business website front-end language type x1 and the business website front-end language version x2, the back-end base image y2 is selected based on the business website back-end language type x3 and the business website back-end language version x4, the business website middleware type x5 and the business website middleware version x6, and the database base image y3 is selected based on the business website database type x7 and the business website database version x8. For example, if the business website back-end language type uploaded by the user is php (Hypertext Preprocessor, a scripting language executed on the server side), the business website back-end language version is 5.6, the business website middleware type is nginx (engine x, a high-performance HTTP and reverse proxy web server), and the business website middleware version is 1.22.1, then a base image named php5.6+nginx1.22.1 is automatically selected from the warehouse, and this base image is stored in the warehouse (i.e., the image library).

[0046] Step 103: desensitize the business website data to obtain desensitized business website data;

[0047] The database files are statically desensitized, and the front-end pages and back-end data type interface APIs are desensitized by the application system. The desensitized business website data is Including the desensitized front-end code k1, the desensitized back-end code k2 and the desensitized database file k3.

[0048] Step 104: Bind the basic image with the desensitized business website data to obtain a business image.

[0049] The base image and business website data Bind one by one and generate corresponding business images Among them, z1 is the front-end image that replaces k1 with the front-end code in the base image, z2 is the back-end image that replaces k2 with the back-end code in the base image, and z3 is the database image that replaces k3 with the database file in the base image.

[0050] Step 104 binds the basic image with the desensitized business website data to obtain a business image, specifically including: replacing the front-end code in the basic image with the desensitized front-end code to obtain a front-end image in the business image; replacing the back-end code in the basic image with the desensitized back-end code to obtain a back-end image in the business image; replacing the database file in the basic image with the desensitized database file to obtain a database image in the business image.

[0051] Step 105, based on the business image and the second sub-business information, automatically generate and run a mimetic honeypot in the virtual machine; the mimetic honeypot includes: a front-end container, a back-end container and a database container, and the operation of the mimetic honeypot is used to characterize the network relationship between the front-end container and the back-end container, the back-end container and the database container, and the back-end container bound to the idle second-level domain name x9 to map the business website to the outside. Referring to the network relationship that the front-end container needs to interact with the back-end container, the back-end container needs to interact with the database container, the back-end container maps the business website to the outside and is bound to the idle second-level domain name x9, the platform is based on the business image Three containers are automatically generated and run within the virtual machine.

[0052] Step 106: Analyze the traffic and logs of the mimetic honeypot to obtain unknown attacks; the unknown attacks include attacks on the business system and attacks on the mimetic honeypot.

[0053] Example 2

[0054] Embodiment 2 of the present invention provides an automated mimic honeypot construction device, which is applied to the method of embodiment 1, such as Figure 2 As shown, the device includes:

[0055] The business system information acquisition module 201 is used to obtain business information and business website data uploaded by users of the business system; the business information includes first sub-business information and second sub-business information, the first sub-business information includes the business website front-end language type x1, the business website front-end language version x2, the business website back-end language type x3, the business website back-end language version x4, the business website middleware type x5, the business website middleware version x6, the business website database type x7, and the business website database version x8, and the second sub-business information includes an idle second-level domain name x9.

[0056] The basic image selection module 202 is used to select a basic image corresponding to the first sub-business information from the image library; the basic image includes a front-end basic image y1, a back-end basic image y2 and a database basic image y3.

[0057] The desensitizing module 203 is used to desensitize the business website data to obtain desensitized business website data; the desensitized business website data includes desensitized front-end code, desensitized back-end code and desensitized database files.

[0058] The binding module 204 is used to bind the basic image with the desensitized business website data to obtain a business image.

[0059] The mimetic honeypot generation and operation module 205 is used to automatically generate and run a mimetic honeypot in a virtual machine based on the business image and the second sub-business information; the mimetic honeypot includes: a front-end container, a back-end container and a database container. The operation of the mimetic honeypot is used to characterize the interaction between the front-end container and the back-end container, the interaction between the back-end container and the database container, and the network relationship of the back-end container bound to the idle second-level domain name x9 to externally map the business website.

[0060] The traffic and log analysis module 206 is used to analyze the traffic and logs of the mimetic honeypot to obtain attack events; the attack events include known vulnerabilities deployed in the honeypot and unknown attacks on the mimetic honeypot.

[0061] Example 3

[0062] Embodiment 3 of the present invention provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the method of embodiment 1 when executing the computer program.

[0063] In addition, when the computer program in the above-mentioned memory is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes several instructions for enabling a computer device (which can be a personal computer, server or network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory, a random access memory, a magnetic disk or an optical disk.

[0064] Example 4

[0065] Embodiment 4 of the present invention provides a computer-readable storage medium having a computer program stored thereon, which implements the method of embodiment 1 when the computer program is executed.

[0066] In summary, compared with the prior art, the method provided by the embodiments of the present invention has the following beneficial effects: the present invention constructs a mimetic honeypot based on the business information and business website data of the business system, demonstrating the association between the constructed mimetic honeypot and the business system, allowing attackers to discover that the attack target is the mimetic honeypot. This can trick attackers into continuing their attacks and proactively discover unknown attacks against the business system. Furthermore, the present invention also has automated construction capabilities, which can reduce the cost of customized mimetic design for different business systems.

[0067] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on the differences from other embodiments. Reference can be made to the common and similar parts between the various embodiments. For the devices disclosed in the embodiments, since they correspond to the methods disclosed in the embodiments, the description is relatively simple, and the relevant parts can be referred to the method description.

[0068] This document uses specific examples to illustrate the principles and implementation methods of the present invention. The above examples are only intended to help understand the method and core concept of the present invention. At the same time, those skilled in the art will find that the specific implementation methods and application scopes may vary based on the concept of the present invention. In summary, the contents of this specification should not be construed as limiting the present invention.

Claims

1. A method for constructing an automated mimic honeypot, characterized in that: The method comprises the following steps: Obtain business information and business website data of the business system uploaded by the user; the business information includes first sub-business information and second sub-business information, the first sub-business information including business website front-end language type x1, business website front-end language version x2, business website back-end language type x3, business website back-end language version x4, business website middleware type x5, business website middleware version x6, business website database type x7, and business website database version x8; the second sub-business information includes an idle second-level domain name x9; Selecting a base image corresponding to the first sub-business information from the image library; the base image includes a front-end base image y1, a back-end base image y2, and a database base image y3; Desensitizing the business website data to obtain desensitized business website data; the desensitized business website data includes desensitized front-end code, desensitized back-end code, and desensitized database files; Binding the base image with the desensitized business website data to obtain a business image; Automatically generate and run a mimetic honeypot in a virtual machine based on the business image and the second sub-business information; the mimetic honeypot includes: a front-end container, a back-end container, and a database container. The operation of the mimetic honeypot is used to characterize the interaction between the front-end container and the back-end container, the interaction between the back-end container and the database container, and the network relationship of the back-end container bound to the idle second-level domain name x9 mapping the business website to the outside world; The traffic and logs of the mimetic honeypot are analyzed to obtain attack events; the attack events include known vulnerabilities deployed in the honeypot and unknown attacks on the mimetic honeypot.

2. The method for constructing an automated mimic honeypot according to claim 1, wherein: The selecting, from the image library, a basic image corresponding to the first sub-service information specifically includes: Select the front-end basic image y1 from the image library that corresponds to the business website front-end language type x1 and business website front-end language version x2; Select the backend base image y2 from the image library that corresponds to the business website backend language type x3, business website backend language version x4, business website middleware type x5, and business website middleware version x6; Select the database base image y3 corresponding to the business website database type x7 and business website database version x8 from the image library.

3. The method for constructing an automated mimic honeypot according to claim 1, wherein: Desensitizing the business website data to obtain the desensitized business website data, specifically including: Perform static desensitization on the database files in the business website data to obtain the desensitized database files; The front-end pages and back-end data type interfaces in the business website data are desensitized by the application system to obtain the desensitized front-end code and desensitized back-end code.

4. The method for constructing an automated mimic honeypot according to claim 1, wherein: Binding the basic image with the desensitized business website data to obtain the business image specifically includes: Replace the front-end code in the base image with the desensitized front-end code to obtain the front-end image in the business image; Replace the backend code in the base image with the desensitized backend code to obtain the backend image in the business image; The database file in the basic image is replaced with the desensitized database file to obtain the database image in the business image.

5. An automated mimic honeypot construction device, characterized in that: The device is applied to the method according to any one of claims 1 to 4, and the device comprises: A business system information acquisition module is configured to acquire business information and business website data uploaded by users for a business system; the business information includes first sub-business information and second sub-business information, wherein the first sub-business information includes business website front-end language type x1, business website front-end language version x2, business website back-end language type x3, business website back-end language version x4, business website middleware type x5, business website middleware version x6, business website database type x7, and business website database version x8; and the second sub-business information includes an idle second-level domain name x9; A base image selection module is used to select a base image corresponding to the first sub-business information from the image library; the base image includes a front-end base image y1, a back-end base image y2, and a database base image y3; A desensitizing module is used to desensitize the business website data to obtain desensitized business website data; the desensitized business website data includes desensitized front-end code, desensitized back-end code and desensitized database files; A binding module, used to bind the base image with the desensitized business website data to obtain a business image; A mimetic honeypot generation and operation module, configured to automatically generate and operate a mimetic honeypot within a virtual machine based on the business image and the second sub-business information; the mimetic honeypot includes a front-end container, a back-end container, and a database container. The operation of the mimetic honeypot is used to characterize the interaction between the front-end container and the back-end container, the interaction between the back-end container and the database container, and the network relationship of the back-end container bound to the idle second-level domain name x9 mapping the business website externally; The traffic and log analysis module is used to analyze the traffic and logs of the mimetic honeypot to obtain attack events; the attack events include known vulnerabilities deployed in the honeypot and unknown attacks on the mimetic honeypot.

6. An electronic device, characterized in that: The method comprises a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the method according to any one of claims 1 to 4 when executing the computer program.

7. A computer-readable storage medium, characterized in that A computer program is stored thereon, and when the computer program is executed, the method according to any one of claims 1 to 4 is implemented.

Images