Method, device and storage medium for generating web parasite honey point and tracing attacker

Abstract

This invention provides a method, device, and storage medium for generating web parasitic honeypots and tracing attackers. The method includes: a honeypot engine monitoring attackers' access to an initial honeypot page and their target scanning operations on a web server, obtaining paths to non-existent web servers accessed by the attacker, and generating new honeypot pages based on these paths; generating Docker containers with vulnerabilities of the attack type based on the attacker's attack type, redirecting the paths of the attacked honeypot pages to the Docker containers, obtaining successfully attacked Docker containers and marking them as honey bait Dockers, and deploying honey bait documents and honey bait accounts of different types and paths into the honey bait Dockers; and a honeypot engine monitoring attackers' opening of honey bait documents and usage of honey bait accounts, recording the attacker's current IP address to trace the attacker, thereby protecting the normal operation of web services, dispersing attacker attack power, and capturing attacker behavioral characteristics.

Description

Technical Field

[0001] This document relates to the field of network security technology, and in particular to a method, device and storage medium for generating web parasitic honeypots and tracing attackers. Background Technology

[0002] Honeypots, also known as "honeypots," are one of the most important proactive defense systems for protecting real-world service resources and studying attacker behavior and objectives. According to a FreeBuf survey, 53% of enterprises have already deployed honeypots, 36% plan to deploy them, and only 11% have not. Honeypots not only detect attacks but also feature attack decoy, attack mitigation, decoy attack, and attack attribution capabilities. With the increasing severity of cybersecurity issues, the constantly evolving attack methods, and the increasing number of attack types, the threats to internet services and infrastructure are gradually growing. More and more small and medium-sized enterprises are beginning to prioritize cybersecurity and start protecting their services and infrastructure.

[0003] Honeypot technology, as a special security protection technology, is applied to various aspects of the Internet. From a deployment perspective, the main types of existing honeypots are production honeypots and research honeypots. From an interaction perspective, the main types of existing honeypots are low-interaction honeypots, medium-interaction honeypots, and high-interaction honeypots. Low-interaction honeypots simulate operating system and network services at a low level, so the attack behaviors attackers can perform in such honeypots are limited, and therefore the effective information that can be collected through low-interaction honeypots is relatively small. Furthermore, low-interaction honeypots are virtualized honeypots, so they will more or less contain some fingerprint information that can be identified by hackers. Medium-interaction honeypots are the most common type of honeypot on the market. Due to their widespread deployment, attackers with prior knowledge can easily distinguish whether it is a honeypot environment. Moreover, common medium-interaction honeypots have a fixed state and cannot dynamically expose vulnerabilities based on attack behavior and objectives, thus potentially missing a lot of critical attack data. High-interaction honeypots provide a completely realistic attack environment, but while giving attackers unlimited freedom of action, they also greatly increase the risk. Once a honeypot is compromised, it is highly likely to be used as a jump server to move laterally to the internal network, causing incalculable losses. Furthermore, highly interactive honeypots are difficult to deploy and have high maintenance costs.

[0004] Existing web service defense technologies primarily consist of Web Application Firewalls (WAFs), including hardware WAFs, software WAFs, and cloud WAFs. A WAF is a type of application firewall that filters, monitors, and blocks HTTP / HTTPS traffic entering and leaving web services. Web service protection is typically achieved through IP blacklists and regular expression matching of HTTP / HTTPS traffic. The main drawback of hardware WAFs is their high cost, ranging from hundreds of thousands to millions of dollars for small and medium-sized enterprises (SMEs). While many open-source software WAF products exist, they are only suitable for SMEs due to numerous bypass methods and the high memory consumption associated with parsing and identifying each request. Cloud WAFs are relatively inexpensive, easy to deploy, and have low maintenance costs, but they are vulnerable to bypassing. Cloud WAFs achieve protection by resolving the user's DNS to cloud nodes; if an attacker obtains the server's real IP address through other means, they can easily bypass the cloud WAF and launch attacks on the web service. Summary of the Invention

[0005] This invention provides a method, device, and storage medium for generating web parasitic honeypots and tracing attackers, aiming to solve the above-mentioned problems.

[0006] This invention provides a method for generating web parasitic honeypots and tracing attackers, including:

[0007] S1. Generate honeypot pages: The system pre-generates an initial honeypot page, monitors the attacker's access to the initial honeypot page and target scanning operations on the web server based on the preset honeypot engine, obtains the non-existent paths of the web server accessed by the attacker, generates new honeypot pages based on the paths, and marks the attacker's IP.

[0008] S2. Generate a Docker container. The preset honeypot engine listens for attackers' access to the honeypot page. Based on the type of attacker's attack, it automatically generates a Docker container with the vulnerability of that attack type and redirects the path of the attacked honeypot page to the Docker container. The preset honeypot engine synchronously records the attacker's attack behavior and the configuration of the generated Docker container, and marks the attacker with a unique identifier.

[0009] S3. Deploy honey bait: The preset honey spot engine monitors the attacker's attack behavior on each Docker container, obtains the successfully attacked Docker container and marks the successfully attacked Docker as honey bait Docker, and deploys honey bait documents and honey bait accounts of different types and paths into the honey bait Docker.

[0010] S4. Attacker attribution: The pre-configured honey spot engine monitors the attacker's opening of honey bait documents and usage of honey bait accounts, and records the attacker's current IP address to trace the attacker's origin.

[0011] This invention provides an electronic device, comprising:

[0012] Processor; and,

[0013] A memory is configured to store computer-executable instructions, which, when executed, cause the processor to perform steps such as generating web parasitic honeypots and tracing attackers.

[0014] This invention provides a storage medium for storing computer-executable instructions, which, when executed, implement steps such as generating web parasitic honeypots and tracing attackers.

[0015] The method for generating web parasitic honeypots and tracing attackers according to embodiments of the present invention automatically installs honeypots based on the attacker's attack methods. It has strong scalability and can effectively resist, disperse, and trace attacks. It has a good protective effect and attacker tracing function for small and medium-sized web services, and therefore has good feasibility and practicality. Attached Figure Description

[0016] To more clearly illustrate the technical solutions in one or more embodiments of this specification or in the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in this specification. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0017] Figure 1 This is a flowchart illustrating a method for generating web parasitic honeypots and tracing attackers according to an embodiment of the present invention.

[0018] Figure 2 This is a schematic diagram illustrating the generation of the honey spot page according to an embodiment of the present invention;

[0019] Figure 3 This is a schematic diagram illustrating the generation of Docker containers according to an embodiment of the present invention;

[0020] Figure 4 This is a schematic diagram illustrating the addition of honey bait to a Docker container according to an embodiment of the present invention;

[0021] Figure 5 This is a schematic diagram illustrating the process of tracing the attacker's origin according to an embodiment of the present invention;

[0022] Figure 6 This is a confidence level curve when the parameter t = 0.05 in an embodiment of the present invention.

[0023] Figure 7 This is a confidence level curve when the parameter t = 0.2 in the confidence level of an embodiment of the present invention. Detailed Implementation

[0024] To enable those skilled in the art to better understand the technical solutions in one or more embodiments of this specification, the technical solutions in one or more embodiments of this specification will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of this specification, and not all of the embodiments. Based on one or more embodiments of this specification, all other embodiments obtained by those skilled in the art without creative effort should fall within the protection scope of this document.

[0025] Method Implementation Examples

[0026] This invention provides a method for generating web parasitic honeypots and tracing attackers' origins. Figure 1 This is a schematic diagram illustrating a method for generating web parasitic honeypots and tracing attackers according to an embodiment of the present invention, as shown below. Figure 1 As shown, the method for generating web parasitic honeypots and tracing attackers in this embodiment of the invention includes:

[0027] S1. Generate honeypot pages: The system pre-generates an initial honeypot page. Based on a preset honeypot engine, it monitors the attacker's access to the initial honeypot page and the target scanning operation of the web server. It obtains the non-existent paths of the web server accessed by the attacker, generates new honeypot pages based on the paths, and marks the attacker's IP.

[0028] like Figure 2 The diagram shown is a schematic diagram of generating a honey spot page according to an embodiment of the present invention. Figure 2As shown, initially, only a small number of initial honeydecoy pages exist on the web service. These initial honeydecoy pages are generated based on commonly used directory scanning dictionaries. The content of these honeydecoy pages is identical to the real business system, but only includes a static login page on the front end. At this time, the honeydecoy engine monitors access to the initial honeydecoy pages and directory scanning attacks on the web server. If an attacker accesses an initial honeydecoy page, the honeydecoy engine records the accessing IP address and the specific honeydecoy page accessed. If the attacker performs a directory scan on the server, the honeydecoy engine collects which page paths the attacker scanned that do not exist on the web server itself. It then selects several non-existent page paths using a custom algorithm, stores them in the honeydecoy engine database, and automatically generates pages on those paths. Whether the attacker accesses an initial honeydecoy page or performs a directory scan on the server, the honeydecoy engine identifies the IP address as belonging to the attacker and assigns it a unique internal identifier. Honeydecoy pages generated in this way have a higher probability of being scanned by attackers, thus protecting the real business pages and distributing the attacker's firepower.

[0029] In this embodiment of the invention, the defender uses this system on the web server side. When the system is installed for the first time, it will automatically detect the server's version information and operating system information, and modify ServerSignature to Off and Servertokens to Prod in the Apache configuration file to hide the server banner in the response header to the client.

[0030] In this embodiment of the invention, during the system initialization phase, pre-set honeypot pages are automatically added to the server's page directory. The initial honeypot page generation process is as follows:

[0031] S11. First, read the path of the honeypot page to be generated from the system configuration file, and create this path from the server page path using the command "mkdir -p Path".

[0032] S12. After the path is created, according to the configuration file, select the system's built-in Honeypoint page source code compressed package and extract it to the path you just created.

[0033] S13. Use Apache's built-in tool apxs to create a Mod template file, named after the honeypot page path. Automatically modify the function names in the Mod template file according to the type of the honeypot page, and use the "ap_rputs()" function to output the HTML page. Then, use apxs to compile the Mod file, adding the corresponding Mod.conf file to the Module directory of the Apache he folder. In the Mod.conf file, use LoadModule to link the Mod.so file, which was just compiled by apxs, into Apache.

[0034] S14. Read each line of the configuration file and repeat steps S11-S13 according to the parameters to create the initial honey spot page on the server.

[0035] Once a honeypot page exists on the server, the honeypot engine begins listening to and analyzing the logs generated by Apache. When an attacker performs a directory scan on the server, a large number of 404 logs are generated. At this time, the honeypot engine selects several 404 pages from the 404 pages scanned by the attacker and uses steps S11-S13 above to generate a honeypot page under that path.

[0036] S2. Generate a Docker container. The preset honeypot engine monitors the attacker's access to the honeypot page. Based on the type of attacker's attack, it automatically generates a Docker container with the vulnerability of that attack type and redirects the path of the attacked honeypot page to the Docker container. The preset honeypot engine synchronously records the attacker's attack behavior and the configuration of the generated Docker container, and marks the attacker with a unique identifier.

[0037] Figure 3 This is a schematic diagram illustrating the generation of Docker containers according to an embodiment of the present invention. Figure 3As shown, if multiple attackers perform directory scans on the web server, the number of honeypot pages generated by the honeypot engine will increase accordingly. As the number of honeypot pages dynamically increases, the probability of attackers launching attacks on these pages also increases. Initially, when generating honeypot pages, the honeypot engine automatically selects a suitable static page from pre-stored page templates based on keywords in the path. For example, for admin / login.html, the honeypot engine will generate an administrator login page consistent with the business system (if the protected business system does not have an administrator login page, it will use the static page provided by the honeypot engine). When an attacker launches an attack on any honeypot page, the honeypot engine automatically generates a corresponding Docker container with the vulnerability of that attack type, and redirects / reverse proxies the path to the Docker container. The honeypot engine has built-in Docker vulnerabilities including SQL injection, data leakage, and common CVE vulnerabilities. It automatically generates a page consistent with the business system and existing on the backend, based on the current business system configuration. At this time, the path of the original static page will be redirected / reverse proxies to a web page provided by a Docker container with a specific vulnerability. At the same time, the honeypot engine records the attacker's behavior and the configuration of the generated Docker, and identifies the attacker with a unique identifier.

[0038] The automatic Docker configuration in this embodiment of the invention includes: selecting a vulnerable Docker container built into the system based on the honeypot page type or as needed; when the Docker image needs to be modified, only the Dockerfile needs to be modified, such as adding a specific decoy file or changing the honeypot page.

[0039] S3. Deploy honey bait: The preset honey spot engine monitors the attacker's attack behavior on each Docker container, obtains the successfully attacked Docker container and marks the successfully attacked Docker container as honey bait Docker, and deploys honey bait documents and honey bait accounts of different types and paths into the honey bait Docker.

[0040] Figure 4 This is a schematic diagram illustrating the addition of honey bait to a Docker container according to an embodiment of the present invention. Figure 4As can be seen, based on the automatically generated honeypot pages mentioned earlier, and with the passage of time and the increasing number of attacks, the number of honeypot pages redirecting to Docker containers will also increase. The honeypot engine also monitors attack behavior on each Docker container. When an attacker successfully compromises a Docker container, the honeypot engine marks it as a honey bait Docker. The honeypot engine centrally manages all honey bait Dockers and deploys different types and paths of honey bait according to the scenario. Currently available honey bait types include Docx documents (HoneyDecoy Docx), Excel spreadsheets (HoneyDecoy Excel), and honey bait accounts (HoneyDecoy Account). After an attacker successfully gains shell access, they will find deceptive honey bait files such as "LoginAccount.docx" and pre-prepared honey bait accounts and passwords in sensitive directories.

[0041] S4. Attacker tracing: The pre-set honey spot engine monitors the attacker's opening of honey bait documents and usage of honey bait accounts, and records the attacker's current IP address to trace the attacker's origin.

[0042] Figure 5 This is a schematic diagram illustrating the process of tracing the attacker's origin according to an embodiment of the present invention. Figure 5 It is known that the Honeypoint Engine continuously monitors attackers' actions regarding opening the Honeybait document and using the Honeybait account. When an attacker successfully attacks and steals the Honeybait file on the Honeybait Docker container, the Honeypoint Engine immediately alerts the attacker when they attempt to open the document, records the attacker's current IP address, and marks the attacker. Subsequently, when the attacker attempts to log in to the Honeypoint page using a pre-prepared Honeybait account from the document, the Honeypoint Engine will also detect the use of the Honeybait account, record the attacker's IP address, and identify which Honeypoint page the Honeybait account was used on, and mark the attacker accordingly.

[0043] When an IP address identified as an attacker accesses a normal page in the business system, the honeypot engine automatically configures a suitable Docker container based on previous attack behavior recorded in the database. This Docker container then simulates the page the attacker intends to access, and a honey bait document and account uniquely identifying the attacker are deployed to it. The page the attacker wants to access is then reverse-proxied to the newly generated Docker container. Because the Docker container is generated based on the attacker's previous attack behavior and contains the corresponding vulnerability, the attacker can easily obtain the honey bait. When the attacker opens the honey bait document and uses the honey bait account, the honeypot engine automatically associates this IP address with the honey bait uniquely identifying the attacker. Subsequently, if the attacker sends the honey bait file or honey bait account to another unknown attacker within the organization, when the unknown attacker opens or uses the honey bait account, the honeypot engine immediately identifies this attacker and classifies both attackers as belonging to the same organization.

[0044] In this embodiment of the invention, the pre-defined honeypot engine is primarily responsible for generating and configuring honeypot pages, generating and configuring honeypot Docker containers, and tracing, marking, and identifying attackers. The game theory-based attacker identification method in the honeypot engine of this embodiment is also the core method in the web parasitic honeypot system. The honeypot engine determines whether the accessing entity is an attacker, thus deciding on the generation and configuration of the honeypot page and honeypot Docker container.

[0045] We define HED for entity i as:

[0046]

[0047] in:

[0048] AE i (Abnormal Entity): Abnormal entity, indicating whether HED classifies the requested entity i as an abnormal entity.

[0049] NE i (Normal Entity): Normal entity, indicating whether HED classifies the requested entity i as a normal entity.

[0050] AS i (Abnormal Score): An outlier value, representing an abnormal value calculated from the request behavior of entity i to the server within a certain period of time.

[0051] NS i (Normal Score): Normal value, representing the normal value calculated from the request behavior of entity i to the server over a period of time.

[0052] Ei (Belief): Confidence level, indicating the likelihood that the current entity is an anomalous entity.

[0053] (Action): Action space, representing all actions of entity i in response to server requests.

[0054] e: Threshold, set uniformly by the user. Entity i will be judged as an abnormal entity when its confidence level is greater than or equal to the threshold.

[0055] Whether entity i is an anomalous or normal entity is determined jointly by the confidence level and the threshold. The threshold is set by the user, making the calculation of the confidence level particularly important. The confidence level is calculated by applying the difference between the outlier and normal values ​​of entity i to the function f. E After transformation, we get:

[0056] E i =f E (AS i -NS i )

[0057] Among them, AS i and NS i Behavior space of entity i Under normal circumstances, all requests made by entity i to the server will be recorded by the honeypoint engine, and this series of requests constitutes entity i's behavior space. According to entity i And the AS of entity i calculated by the value mapped to the behavior in the mapping table. i and NS i :

[0058]

[0059]

[0060] from arrive Representing n access requests for entity i, each request is processed by two different functions f. A and f N Calculate the exception score and normal score for each request separately, and then sum the weighted scores of the n requests to obtain the AS. i and NS i Specifically, NS i If there is an initial value k, the honeypot engine will default to accessing normal entities initially.

[0061] f A and f N The calculation method maps different behaviors to different scores, f A and fN The two corresponding mapping rule tables are initially provided by the Honeypoint system, and users can add their own on top of them later.

[0062] AS was calculated i and NS i Due to the behavioral space of entities It can approach infinity, and the scores mapped to the behavior are all positive, so when:

[0063]

[0064] At that time, we can obtain:

[0065]

[0066]

[0067] AS i -NS i ∈(-∞,+∞)

[0068] However, the confidence level was changed from

[0069] E i =f E (AS i -NS i )

[0070] Get, when

[0071] AS i -NS i →+∞

[0072] When, specifically when the outlier is significantly greater than the normal value, the following needs to be done:

[0073]

[0074] Similarly, when the number of normal behaviors of an entity is absolutely greater than the number of abnormal behaviors, that is:

[0075] AS i -NS i →-∞

[0076] At that time, it is necessary to:

[0077] E i →0

[0078] Therefore, in order to compress infinity to within the range of 0 to 1, it is necessary to define E. i The computation function f E for:

[0079]

[0080] That is, the Sigmoid function. (The last part, "AS", appears to be a typo and can be left as i and NS i Substituting the values, we finally get E. i The calculation formula is as follows:

[0081]

[0082] The value of t is determined based on the values ​​in the mapping table. When the mapping values ​​are generally high, t can be appropriately decreased. Similarly, when the mapping values ​​are generally low, t can be appropriately increased to ensure that E... i It remains within a stable range.

[0083] The default value is 0.05. Figure 6 This is a confidence level curve for a confidence level of t = 0.05 in an embodiment of the present invention. When AS i -NS i When = 46, E i ≈0.9.

[0084] When t = 0.2, as Figure 7 This is a confidence level curve for the parameter t = 0.2 in an embodiment of the present invention. i -NS i =11, E i ≈0.9.

[0085] With a default t=0.05, obviously abnormal behaviors, such as attempting SQL injection or brute-force attacks, will be assigned a large score in the mapping table. For example, SQL injection behavior will be mapped to a value of 50, while normal behaviors such as visiting the homepage and browsing the homepage will be mapped to values ​​of 2 respectively. When an entity visits the homepage, browses it, and then attempts SQL injection, when NS... i When the initial value k=5, the honeypot engine can calculate the E of this entity. i ≈0.885. E was calculated to be... i After the value is given, the honeypot engine will calculate E. i The difference between AE and the threshold e is used to determine AE. i and NE i AE i and NE i, The definition is as follows:

[0086]

[0087] When AE i When = 1, it means that this entity is marked as a suspicious entity, and the Honeypoint Engine will generate a Honeypoint page and subsequent HoneyDecoy Docker based on this entity. When NE iWhen the value is 1, it indicates that this entity is accessing normally, and the honeypot engine will not take any defense measures for the time being. AE i Calculated as follows:

[0088]

[0089] Therefore in E i With an approximation value of ≈0.885 and e = 0.5, this entity will obviously be marked as an abnormal entity by the engine, and the engine will take measures to defend against it.

[0090] Traditional honeypots typically offer limited simulations, simulating specific services, hosts, or application environments. While honeypots are based on simulation technology, they are only single-dimensional simulations, mimicking a single service or host, resulting in low realism. Attackers, upon entering a honeypot environment, often examine the actual traffic or analyze service fingerprints, making it easy to identify the honeypot environment. Multi-dimensional simulations, including traffic simulation, simulating normal network behavior, dynamic network configuration, and redirection techniques, can improve realism to some extent, deceiving and enticing attackers. However, they still suffer from drawbacks such as limited configuration (lacking automation), fixed attack surfaces (inability to customize vulnerabilities), poor attribution capabilities (difficult to trace back to the real attacker), inability to understand the attacker's objectives (the intent of the attack, not just an attack for the sake of attack), fixed honeypot fingerprints (honeypots cannot be modified), and non-reusability (once an attacker discovers a honeypot, they will not access it again).

[0091] In response to the increasingly serious attacks on Web services and the various shortcomings of current honeypots, this invention proposes a method for automatically generating Web parasitic honeypots, which can effectively resist attacks, expand the attack surface, and trace the attackers.

[0092] This paper proposes a method to generate corresponding honeypot pages based on pages accessed or scanned by attackers. 404 pages in the logs are filtered before the honeypot engine collects and generates the honeypot pages. It also proposes a method to reverse proxy or redirect accessed pages to vulnerable Docker containers based on the attacker's intent. The method determines the possible attack type based on the types of pages accessed by the attacker or the attacker's historical attack methods in the honeypot engine database, and then configures Apache to proxy the page to the Docker container with the vulnerability. Furthermore, it proposes a method for deploying honeypot files in Docker containers, which allows for rapid tracing of attackers and their organizations. Finally, it proposes a definition of honeypot engine entities and an algorithm for calculating whether an entity is abnormal.

[0093] The following beneficial effects are achieved by employing the embodiments of the present invention:

[0094] Due to limitations of traditional WAFs and honeypots, they cannot dynamically establish defenses based on attacker behavior after deployment. The method proposed in this paper can automatically install honeypots based on attacker tactics, offering strong scalability and effectively resisting, dispersing, and tracing attacks. It provides excellent protection for small and medium-sized web services and facilitates attacker attribution, thus demonstrating good feasibility and practicality.

[0095] Device Example 1

[0096] This invention provides an electronic device, comprising:

[0097] Processor; and,

[0098] A memory is configured to store computer-executable instructions, which, when executed, cause the processor to perform the steps described in the above method embodiments.

[0099] Device Example 2

[0100] This invention provides a storage medium for storing computer-executable instructions, which, when executed, perform the steps described in the above method embodiments.

[0101] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for generating web parasitic honeypots and tracing attackers, characterized in that, include: S1. Generate honeypot page: The system pre-generates an initial honeypot page. Based on the preset honeypot engine, it monitors the attacker's access to the initial honeypot page and the target scanning operation of the web server. It obtains the non-existent path of the web server accessed by the attacker, stores the non-existent path in the honeypot engine database, and then the honeypot engine automatically generates the page on the path and marks the attacker's IP. S2. Generate a Docker container. The preset honeypot engine listens to the attacker's access to the honeypot page. Based on the type of attacker's attack, it automatically generates a Docker container with the vulnerability of that attack type and redirects the path of the attacked honeypot page to the Docker container. The preset honeypot engine synchronously records the attacker's attack behavior and the configuration of the generated Docker container, and marks the attacker with a unique identifier. S3. Deploy honey bait: The preset honey spot engine monitors the attacker's attack behavior on each Docker container, obtains the successfully attacked Docker container and marks the successfully attacked Docker container as honey bait Docker, and deploys honey bait documents and honey bait accounts of different types and paths into the honey bait Docker. S4. Attacker tracing: The pre-set honey spot engine monitors the attacker's opening of honey bait documents and usage of honey bait accounts, and records the attacker's current IP address to trace the attacker's origin.

2. The method according to claim 1, characterized in that, Before generating a honeypot page, the preset honeypot engine needs to determine whether the accessing entity is an attacker. For entities that access normally, the honeypot engine does not perform any defense.

3. The method according to claim 2, characterized in that, The pre-configured honeypot engine defines the request entity using Formula 1 and determines whether the request entity is an attacker: Official 1; in, An abnormal entity indicates an issue with the request entity. Does the honeyspot engine classify the entity as an abnormal entity? A normal entity indicates that the requesting entity is being addressed. Does the honeypot engine classify entities as normal entities? An outlier indicates an entity Anomalies in server request behavior over a period of time are calculated. Normal values ​​indicate entities The normal value of server request behavior over a period of time is calculated. The confidence level indicates the current entity The possibility of it being an anomalous entity; For behavior space, represent entities All actions related to server requests; The threshold is set uniformly by the user, and the entity... confidence level Greater than or equal to the threshold It will be judged as an abnormal entity.

4. The method according to claim 3, characterized in that, The specific steps for obtaining the confidence level include: The confidence level is obtained using Formula 2. : Official 2; in, f E For the calculation function, and From entity behavioral space Decision, based on entity of The values ​​that the behavior maps to in the mapping table are calculated using Formulas 3 and 4 to determine the entity. of and : Official 3; Official 4; Obtained through formula 5 f E : Official 5; in, The value is determined based on the values ​​in the mapping table; The final formula for calculating the confidence level is obtained from formulas 3, 4, and 5: Official 6.

5. The method according to claim 4, characterized in that, The determination of whether the requesting entity is an attacker specifically includes: Honey Point Engine Calculation and threshold The difference is used to determine and , and The definition is as follows: Official 7; when At that time, representing the entity Once marked as a suspicious entity, the honeypot engine will generate a honeypot page and subsequent honey bait Docker based on this entity; when When this occurs, it indicates that the entity is accessing normally, and the honeypot engine will not take any defense measures at this time. in, Calculated as follows: Official 8.

6. The method according to claim 1, characterized in that, The method further includes: Honeybee Engine monitors access to normal pages from IPs marked as attackers, and automatically configures Docker containers based on the attacker's previous attack behavior, and delivers honeybee documents and honeybee accounts that uniquely identify the attacker to the Docker containers.

7. The method according to claim 1, characterized in that, The honeypot engine monitors whether an attacker sends honey bait files or honey bait accounts to other unknown attackers. When an unknown attacker opens or uses a honey bait account, the honeypot engine marks the attacker and lists the two attackers as the same organization.

8. The method according to claim 1, characterized in that, The system pre-generates the initial honey spot page, specifically including: S11. Read the path of the honey point page to be generated in the system configuration file and create this path; S12. According to the configuration file, select the system's built-in Honey Point page source code compressed package and extract it to the created path; S13. Use Apache's built-in tools to create a Mod template file, named after the Honeydot page path; S14. Read the configuration file and repeat steps S11-S13 according to the parameters to create the initial honey spot page on the server.

9. An electronic device, comprising: processor; as well as, A memory configured to store computer-executable instructions, which, when executed, cause the processor to perform the steps of the method for generating a web parasitic honeypot and tracing an attacker as described in any one of claims 1-8.

10. A storage medium for storing computer-executable instructions, which, when executed, implement the steps of the method for generating a web parasitic honeypot and tracing an attacker as described in any one of claims 1-8.

Images