Method, system and device for preventing cyber attacks based on honey point generation

Abstract

The application discloses a network attack prevention method, system and device based on a honeypot, which comprises a honeypot controller, a honeypot image and a feedback receiver.The honeypot controller is used to acquire user network environment information, automatically create a docker component, automatically build a honeypot image according to the docker component and automatically generate a deception strategy code and put the deception strategy code into the honeypot image.The honeypot image is used to collect service logs in the honeypot installation, send an alarm information to the feedback receiver when attack traces are found in the logs and execute the deception strategy code.The feedback receiver is used to store the attack traces, receive the alarm information and call an API interface in the honeypot controller to execute the deception strategy code which cannot be executed by the honeypot image.The application can prevent network attacks.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of network attack prevention, in particular to a network attack prevention method, system and device based on honeypot generation. BACKGROUND

[0002] Network deception technology is an active defense strategy taken by the defender, which can confuse the perception of the attacker, lure and capture the attacker by placing false information in the target user network, so as to protect the real assets of the user. The world's first open source deception tool DTK (Deception Toolkit) was released in 1998, which is also the origin of deception technology. With the emergence of worms, botnets and APT (Advanced Persistent Threat), the attack means of attackers is becoming more and more sophisticated, and the disadvantages of traditional passive defense mechanisms are becoming more and more obvious: the update of the defense rule library is based on the latest attack technology of the attacker, which means that the defense rules can always be bypassed by the attacker with new technology. Therefore, since 2010, the new security system based on network deception has become the focus of research of various security companies.

[0003] Regarding the research on active deception defense, it is mainly aimed at honeypot and honeypot. Honeypot can be classified into low, medium and high interaction levels according to the interaction type range. Low-interaction honeypot only responds to network layer protocols (ICMP, TCP, UDP, etc.) and some simple application layer protocols (HTTP, etc.), and is generally used to detect scanners in the network, and representative products include Honeyd, Opencanary, etc.; medium-interaction honeypot has certain interaction ability and can complete some simple interactions with the attacker, and is generally used to attract the attention of the attacker for a short time and discover the attacker in time, and representative products include Cowire, WordPot, etc.; high-interaction honeypot is generally implemented based on virtualization technologies such as docker and virtual machine, which can simulate the operation of the entire operating system and has strong attraction to the attacker, and is generally used to analyze and research the behavior of the attacker and steal the attack technology of the attacker, and honeypot is mainly composed of some documents or web pages containing false information, and if the attacker accesses the honeypot, the defender will discover and capture the attacker. SUMMARY

[0004] The present application aims to provide a network attack prevention method, system and device based on honeypot generation, which aims to solve the problem of network attack prevention based on honeypot generation.

[0005] The present application also provides a network attack prevention system based on honeypot generation, which comprises:

[0006] The honey point controller is used to acquire user network environment information, automatically create a docker component according to the network environment information, and automatically build a honey point image according to the docker component; and automatically generate a deception strategy code and place it into the honey point image.

[0007] The honey point image is used to collect service logs in honey point installation, send alarm information to the feedback receiver when attack traces are found in the logs, and execute the deception strategy code.

[0008] The feedback receiver is used to store attack traces, receive alarm information, and call an API interface in the honey point controller to execute the deception strategy code that cannot be executed by the honey point image.

[0009] The application provides a network attack prevention method based on honey point generation, comprising the following steps:

[0010] The user network environment information is acquired by the honey point controller, a docker component is automatically created according to the network environment information, a honey point image is automatically built according to the docker component, a deception strategy code is automatically generated and placed into the honey point image.

[0011] The service logs in honey point installation are collected by the honey point image, alarm information is sent to the feedback receiver when attack traces are found in the logs, and the deception strategy code is executed.

[0012] The attack traces are stored by the feedback receiver, alarm information is received, and the deception strategy code that cannot be executed by the honey point image is executed by calling an API interface in the honey point controller.

[0013] The application further provides a network attack prevention device based on honey point generation, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the computer program is executed by the processor to implement the steps of the above method.

[0014] The application further provides a computer readable storage medium, wherein the computer readable storage medium stores an information transmission implementation program, and the program is executed by the processor to implement the steps of the above method.

[0015] The application can implement network attack prevention based on honey point generation.

[0016] The above description is only a summary of the technical scheme of the application, in order to more clearly understand the technical means of the application, implement the content of the specification, and make the above and other purposes, features and advantages of the application more obvious and easy to understand, the specific implementation method of the application is described below. BRIEF DESCRIPTION OF DRAWINGS

[0017] In order to more clearly illustrate the technical solutions in the specific embodiments of the present application or the prior art, the drawings required to be used in the specific embodiments or prior art description will be briefly introduced below. Obviously, the drawings in the following description are some embodiments of the present application, and other drawings can be obtained by those skilled in the art without creative labor on the basis of these drawings.

[0018] Figure 1 is a schematic diagram of the anti-network attack system based on the honeypot generation of the embodiment of the present application;

[0019] Figure 2 is a business host schematic diagram of the anti-network attack system based on the honeypot generation of the embodiment of the present application;

[0020] Figure 3 is a flowchart of the honeypot controller of the anti-network attack system based on the honeypot generation of the embodiment of the present application;

[0021] Figure 4 is a schematic diagram of the deception strategy database structure of the anti-network attack system based on the honeypot generation of the embodiment of the present application;

[0022] Figure 5 is a honeypot mirror function flowchart of the anti-network attack system based on the honeypot generation of the embodiment of the present application;

[0023] Figure 6 is a feedback receiver function flowchart of the anti-network attack system based on the honeypot generation of the embodiment of the present application;

[0024] Figure 7 is a schematic diagram of the anti-network attack device based on the honeypot generation of the embodiment of the present application. DETAILED DESCRIPTION

[0025] The technical solutions of the present application will be described below in conjunction with the embodiments, obviously, the described embodiments are part of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor belong to the scope of protection of the present application.

[0026] Method embodiments

[0027] According to the embodiments of the present application, an anti-network attack system based on honeypot generation is provided, Figure 1 is a schematic diagram of the anti-network attack system based on the honeypot generation of the embodiment of the present application, as Figure 1 shown, specifically comprising:

[0028] The honey point controller is used for obtaining user network environment information, automatically creating a docker component according to the network environment information, and automatically building a honey point image by the docker according to the docker component; and automatically generating a deception strategy code and placing the deception strategy code into the honey point image.

[0029] The honey point controller is specifically used for assembling installation statements into a dockerfile through service information provided by a network environment, automatically building a corresponding honey point image by the docker according to the dockerfile, setting a deception strategy component library, and dividing the deception strategy component library into a service content component library and a stress reaction component library; the service content component library is stored in a honey point database of Mongodb, and has two data sets, namely a service password strategy and a service content strategy; the password strategy data set stores user commonly used password pairs, authentication passwords, corresponding service types and risk levels, and the content strategy data set stores contents and content types and service types in the honey point service; the stress reaction component library is realized through a shell script, and predefines stress reaction shell scripts of each supported service, and the scripts are placed into the image when the honey point image is built.

[0030] The honey point image is used for collecting service logs in honey point installation, sending alarm information to a feedback receiver when attack traces in the logs are found, and executing a deception strategy code.

[0031] The honey point image is specifically used for collecting service logs in honey point installation, the service logs including mysql logs, SSH logs and Redis logs, sending alarm information to a feedback receiver when attack traces in the logs are found, and executing a deception strategy code, the strategy code including restarting a service, modifying service content and modifying a service password.

[0032] The feedback receiver is used for storing attack traces, expanding a deception strategy library according to the attack traces, receiving alarm information, and calling an API interface in a honey point controller to execute a deception strategy code that cannot be executed by a honey point image.

[0033] The feedback receiver is specifically used for storing normalized attack traces, receiving alarm information, and calling an API interface in a honey point controller to execute a deception strategy code that cannot be executed by a honey point image, the deception strategy code that cannot be executed including changing an IP address and destroying the IP address.

[0034] The specific implementation method is as follows:

[0035] The honey point generation system is mainly divided into three parts of honey point controller, honey point image and feedback receiver, wherein the honey point controller is responsible for managing and generating the honey point, and in order to facilitate the management of the honey point equipment, the honey point management API is also opened on the honey point controller; the honey point image represents a honey point equipment, the honey point equipment is composed of a behavior log collector and a deception strategy executor, the behavior log collector is responsible for collecting the log of the built-in service of the honey point, and the formatted log is sent to the feedback receiver, and the deception strategy executor is responsible for executing the stress behavior of the honey point after being attacked; the feedback receiver is responsible for collecting and storing the log, and also executes the stress behavior in the honey point image which cannot be executed in the honey point image through the honey point management API, such as IP address conversion, start and stop of the honey point and the like.

[0036] The honey point generated by the controller can automatically install services similar to the user business host, and the data in the service can be flexibly added after being completely desensitized by a professional, and can be modified and changed at any time.

[0037] Figure 2 The figure is a business host schematic diagram of the network attack prevention system based on honey point generation of the embodiment of the application.

[0038] The purpose of the honey point invention is to attract the attacker to interact and delay the time during the period from the attack of the attacker to the judgment and disposal of the security researcher.

[0039] The light-weight simulation refers to that the honey point installs the same service according to the service, version number and system number deployed on the real host, but the content is light-weight simulation, for example, the HTTP service only simulates the front-end interface, and the service content in some database only contains some pre-defined deception information or enterprise data desensitized by a professional, so that the simulation can be guaranteed to the maximum extent while protecting the data security of the enterprise.

[0040] Honey point controller

[0041] Figure 3 The figure is a flow chart of the honey point controller of the network attack prevention system based on honey point generation of the embodiment of the application.

[0042] The honey point controller is responsible for generating and managing the honey point equipment, first, the input of the controller is the network environment information of the user, indicating that the current network has which host and service, then the honey point controller will automatically create dockerfile and related docker file according to the service type, then the user can select the service content and stress behavior in the deception strategy, or the system can automatically select, the controller will automatically splice the corresponding stress program code and service content setting command according to the template, and finally deliver to the docker to build the container.

[0043] Many component libraries are contained in the controller, and the automation construction function of the system is realized through the component libraries. First, the docker component library contains installation commands of various services in different systems, and the controller assembles the installation statements into a dockerfile according to the service information provided by the network environment, and the docker automatically constructs the corresponding honeypot image according to the dockerfile. Then, the deception strategy component library is divided into service content component library and stress reaction component library. The deception content component library is stored in the honeypot database of Mongodb, which has two data sets, TokenStrategy (password strategy) and ContentStrategy (content strategy). The password strategy data set stores the commonly used password pairs of users, authentication passwords and corresponding service types, risk levels, and the content strategy data set stores the contents and content types of the honeypot service, service types (such as FTP service needs to place a decoy file, and the service is ftp, the content is the absolute path of the file, and the type is file_path, and the surface current content is a file path).

[0044] Figure 4 The deception strategy database structure diagram of the network attack prevention system based on honeypot generation of the embodiment of the application is shown in the figure.

[0045] Among them, the filling of the strategy is given to professional security personnel, and the user only needs to be responsible for selecting or handing over the system to select the appropriate deception strategy database structure diagram:

[0046] The stress reaction strategy library is realized through a shell script, and in the honeypot controller, the stress reaction shell script of each supported service is predefined, and the script is put into the image during the construction of the honeypot image, and then it is executed by the honeypot image. Through the deception strategy library and the docker component library, the system can realize the automatic creation of a complete network binding honeypot.

[0047] Network binding honeypot image

[0048] Figure 5 The honeypot image function flow chart of the network attack prevention system based on honeypot generation of the embodiment of the application is shown in the figure.

[0049] The network tripwire honeypot mirror mainly includes a log collector and a deception strategy executor. The log collector collects logs of all services installed in the honeypot. If an attacker interacts with the honeypot, traces will be left in the corresponding service logs. The log collector collects these traces and stores them in the feedback receiver after normalization. When the log collector finds attack traces, the strategy executor is triggered to complete the stress response of the honeypot, such as modifying the corresponding service password, content, or restarting the service. This operation is achieved by executing the stress response shell script produced by the honeypot controller.

[0050] The stress response function of the honeypot is to confuse the attacker in the following two stages:

[0051] Before the attacker discovers a honeypot as an attack target: the attacker is misled to believe that the attack has been discovered by the operation and maintenance personnel, causing psychological pressure to the attacker, greatly delaying the attack progress and prolonging the attack time.

[0052] The attacker has discovered that the IP is a honeypot device: after the honeypot is discovered by the attacker, it loses its significance. By moving the honeypot to another IP address and making some changes, the invalid honeypot can be effectively recycled, the system resources are released, and the attacker cannot confirm the location of the honeypot, which effectively prevents the attacker from perceiving the network environment.

[0053] Feedback receiver

[0054] Figure 6 The feedback receiver function flowchart of the network attack prevention system based on the honeypot generated by the embodiment of the application;

[0055] The feedback receiver is responsible for receiving, processing and storing the alarm information sent by the network tripwire honeypot. If the honeypot is configured with some stress strategies that cannot be executed in the honeypot device, such as changing the IP address or destroying, the deception strategy executor in the feedback receiver needs to be completed. When the deception strategy executor in the feedback receiver needs to execute the command, it will organize the relevant information and call the API interface in the honeypot controller to complete the stress response of the honeypot.

[0056] In summary, the dynamic network stumbling point generation system provided by the application is convenient to configure, supports automatic deployment, and if a user wants to customize a honey point strategy, only needs to make a simple selection, without the need to create a new template by oneself, solves the problem of complex configuration of a traditional honeypot, the form of the honey point is no longer a stack of vulnerabilities or a highly simulated form that consumes a large amount of internal network resources, but a lightweight simulation, the purpose being to attract an attacker within a certain time, the honey point alarm information is not dependent on traffic monitoring and rule matching, but dependent on service logs, and an attacker is difficult to bypass through the construction of a special traffic package, and the dynamic stress response of the honey point is realized, the honey point can interact with an attacker simply, and is no longer a static target like a traditional honeypot.

[0057] Since a traditional honeypot configuration template needs certain professional ability to complete, the application provides a way of generating a honey point through simple selection, and supports more fine-grained configuration, and the password and content of a service can be modified through configuration.

[0058] The traditional honeypot uses a scheme of stacking vulnerability scenes, which is not quite consistent with a real network environment of a user, and a high simulation scheme will consume a large amount of internal network resources and cause harm to data security of the user, the application provides a lightweight simulation honey point, which can quickly deploy a lightweight simulation host of a real host, can attract an attacker to interact within a certain time range, and allows a security analyst to have time to make a research and disposition.

[0059] The application provides a honey point stress response module, so that the honey point device can change more flexibly when facing an attacker, instead of only waiting for a security analyst to make a research and disposition.

[0060] The application provides a dynamic network stumbling point generation system, which simulates a user business host in a lightweight manner to fit the user internal network environment, the simulation service content is all pre-defined deception data of the system or desensitization data imported by a professional operation and maintenance personnel, the user data security is protected, and the user internal network environment is fitted to the greatest extent, a honey point stress behavior is provided, so that the honey point can complete some emergency response strategies before a security analyst makes a research and disposition, the generation of a honey point alarm log is completed by collecting internal service logs of the honey point, and the attacker is not discovered based on traffic rule matching, so that false positives and false negatives are greatly reduced.

[0061] Method embodiment one

[0062] According to the application, a network attack prevention method based on honey point generation is provided, and the method specifically comprises the following steps.

[0063] The user network environment information is acquired by the honeypot controller, the docker component is automatically created according to the network environment information, and the honeypot image is automatically built by the docker according to the docker component; the deception strategy code is automatically generated and placed in the honeypot image.

[0064] The user network environment information is acquired by the honeypot controller, the docker component is automatically created according to the network environment information, and the honeypot image is automatically built by the docker according to the docker component; the deception strategy code is automatically generated and placed in the honeypot image, specifically including: the installation statement is assembled into a dockerfile through the service information provided by the network environment, and the docker automatically builds the corresponding honeypot image according to the dockerfile; a deception strategy component library is set, and the deception strategy component library is divided into a service content component library and a stress reaction component library; the service content component library is stored in the honeypot database of Mongodb, and has two data sets, namely a service password strategy and a service content strategy; the password strategy data set stores user commonly used password pairs, authentication passwords, corresponding service types and risk levels, and the content strategy data set stores the content and content type of the honeypot service and the service type; the stress reaction component library is realized through a shell script, and the stress reaction shell script of each supported service is predefined, and the script is placed in the image when the honeypot image is built.

[0065] The service logs in the honeypot installation are collected through the honeypot image, and when attack traces are found in the logs, alarm information is sent to the feedback receiver to execute the deception strategy code;

[0066] The service logs in the honeypot installation are collected through the honeypot image, and when attack traces are found in the logs, alarm information is sent to the feedback receiver to execute the deception strategy code, specifically including: collecting service logs in the honeypot installation, the service logs including: mysql logs, SSH logs and Redis logs, when attack traces are found in the logs, alarm information is sent to the feedback receiver to execute the deception strategy code, and the strategy code includes: restarting the service, modifying the service content and modifying the service password.

[0067] The attack traces are stored through the feedback receiver, the alarm information is received, and the API interface in the honeypot controller is called to execute the deception strategy code that cannot be executed by the honeypot image.

[0068] The attack traces are stored through the feedback receiver, the deception strategy library is expanded according to the attack traces, the alarm information is received, and the API interface in the honeypot controller is called to execute the deception strategy code that cannot be executed by the honeypot image, specifically including: the attack traces are normalized and stored, the alarm information is received, and the API interface in the honeypot controller is called to execute the deception strategy code that cannot be executed by the honeypot image, and the deception strategy code that cannot be executed includes: changing the IP address and destroying the IP address.

[0069] The embodiment of the present application is a system embodiment corresponding to the above method embodiment, and the specific operation of each module can be understood with reference to the description of the method embodiment, which will not be repeated here.

[0070] Device embodiment one

[0071] The embodiment of the present application provides a network attack prevention device based on a honey point, as shown in the figure, comprising a memory 70, a processor 72, and a computer program stored on the memory 70 and executable on the processor 72, and the computer program is executed by the processor to realize the steps in the above method embodiment. Figure 7

[0072] Device embodiment two

[0073] The embodiment of the present application provides a computer readable storage medium, and the computer readable storage medium stores an implementation program of information transmission, and the program is executed by the processor 72 to realize the steps in the above method embodiment.

[0074] Finally, it should be noted that: the above embodiments are only used to illustrate the technical solutions of the present application, and not to limit them; although the present application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that: it can still modify the technical solutions recorded in the foregoing embodiments, or make equivalent replacement for part or all of the technical features; and these modifications or replacements do not make the essence of the corresponding technical solution deviate from the scope of the present application.​

Claims

1. A system for preventing cyber attacks based on honey point generation, characterized by, The application relates to a honeypot system. The honeypot controller acquires user network environment information, automatically creates a docker component according to the network environment information, and the docker automatically builds a honeypot image according to the docker component; and automatically generates a deception strategy code and places the deception strategy code in the honeypot image. The honeypot image is used for collecting service logs in a honeypot installation, and when attack traces are found in the logs, alarm information is sent to a feedback receiver to execute the deception strategy code. The strategy code includes restarting a service, modifying service content and modifying a service password. The feedback receiver is used for storing attack traces, receiving alarm information and calling an API interface in the honeypot controller to execute deception strategy codes that cannot be executed by the honeypot image.

2. The system of claim 1, wherein, The honeypot controller is specifically used for assembling installation statements into a dockerfile according to service information provided by a network environment, and a docker automatically builds a corresponding honeypot image according to the dockerfile; a deception strategy component library is set, and the deception strategy component library is divided into a service content component library and a stress reaction component library; the service content component library is stored in a honeypot database of Mongodb, and two data sets, a service password strategy and a service content strategy, are stored in the service content component library. Password strategy data sets store commonly used password pairs, authentication passwords, corresponding service types and risk levels, content strategy data sets store content, content types and service types in the honeypot service, and the stress reaction component library is realized through a shell script, and stress reaction shell scripts of each supported service are predefined and placed in the honeypot image during construction of the honeypot image.

3. The system of claim 2, wherein, The honeypot image is specifically used for collecting service logs in a honeypot installation, and the service logs include mysql logs, SSH logs and Redis logs; when attack traces are found in the logs, alarm information is sent to a feedback receiver to execute the deception strategy code.

4. The system of claim 3, wherein, The feedback receiver is specifically used for storing normalized attack traces, expanding a deception strategy library according to the attack traces, receiving alarm information, calling an API interface in the honeypot controller to execute deception strategy codes that cannot be executed by the honeypot image, and the deception strategy codes that cannot be executed include changing an IP address and destroying the IP address.

5. A method for preventing cyber attacks based on a honey point generation, characterized by, The application relates to a honeypot system. The honeypot controller acquires user network environment information, automatically creates a docker component according to the network environment information, and the docker automatically builds a honeypot image according to the docker component; and automatically generates a deception strategy code and places the deception strategy code in the honeypot image. The honeypot image is used for collecting service logs in a honeypot installation, and when attack traces are found in the logs, alarm information is sent to a feedback receiver to execute the deception strategy code. The strategy code includes restarting a service, modifying service content and modifying a service password. The feedback receiver is used for storing attack traces, receiving alarm information and calling an API interface in the honeypot controller to execute deception strategy codes that cannot be executed by the honeypot image.

6. The method of claim 5, wherein, The user network environment information is acquired by the honeypot controller, the docker component is automatically created, the docker automatically builds the honeypot image according to the docker component, and the automatic generation of the deception strategy code is put into the honeypot image, and specifically includes: assembling installation statements into a dockerfile through service information provided by a network environment, and the docker automatically builds a corresponding honeypot image according to the dockerfile; a deception strategy component library is set, and the deception strategy component library is divided into a service content component library and a stress reaction component library; the service content component library is stored in a honeypot database of Mongodb, and two data sets are provided in the service content component library, which are a service password strategy and a service content strategy; the password strategy data set stores user commonly used password pairs, authentication passwords, corresponding service types and risk levels, the content strategy data set stores contents and content types and service types in the honeypot service, and the stress reaction component library is realized through a shell script, and stress reaction shell scripts of each supported service are predefined, and the scripts are put into the image when the honeypot image is built.

7. The method of claim 6, wherein, The service logs in the honeypot installation are collected through the honeypot image, if attack traces in the logs are found, alarm information is sent to a feedback receiver, and the deception strategy code is executed, and specifically includes: collecting service logs in the honeypot installation, the service logs include: mysql logs, SSH logs and Redis logs, if attack traces in the logs are found, alarm information is sent to a feedback receiver, and the deception strategy code is executed.

8. The method of claim 7, wherein, The attack traces are stored through the feedback receiver, the deception strategy library is expanded according to the attack traces, the alarm information is received, and the API interface in the honeypot controller is called to execute the deception strategy code that cannot be executed by the honeypot image, and specifically includes: storing the attack traces after normalization, receiving the alarm information, calling the API interface in the honeypot controller to execute the deception strategy code that cannot be executed by the honeypot image, and the deception strategy code that cannot be executed includes: changing an IP address and destroying the IP address.

9. A network attack prevention device based on honey point generation, comprising: It includes: A memory, a processor and a computer program stored on the memory and executable on the processor, when the computer program is executed by the processor, the steps of the network attack prevention method based on the honeypot generation in any one of claims 5 to 8 are realized.

10. A computer-readable storage medium, characterized in that, The computer readable storage medium stores an information transmission implementation program, and the program is executed by the processor to realize the steps of the network attack prevention method based on the honeypot generation in any one of claims 5 to 8.

Images