An ELF file-based honeypot security method, device, equipment and storage medium

Abstract

The application discloses a honeypot security method and device based on an ELF file, equipment and a storage medium, relates to the field of network security, and comprises the following steps: generating a sub-process based on preset assembly codes, connecting a honeypot control end by using the sub-process, and generating a target file; adding the target file to a preset ELF file, and performing address modification operation on the ELF file after addition to obtain a target ELF file; and determining whether the target ELF file is acquired by an attack terminal, and if yes, controlling the attack terminal by using the honeypot control end. As can be seen, the network security can be implemented by connecting the honeypot control end through the ELF file, when it is determined that the ELF file is acquired and run by the attack terminal, the equipment of the attack terminal can be controlled through the honeypot control end, so that the security countermeasure method of the honeypot is implemented. In this way, the countermeasure is effectively implemented, the network security is avoided by finding the vulnerability, and the efficiency of the network security is improved.

Description

Technical Field

[0001] This invention relates to the field of network security, and in particular to a honeypot security method, apparatus, equipment and storage medium based on ELF files. Background Technology

[0002] In current cybersecurity scenarios, attackers and defenders are often at an unequal footing. Historically, defenders have focused on strengthening their own security to defend against intrusions. However, in some cybersecurity scenarios, defenders need more than just hardening their own security to prevent intrusions; they also need to use countermeasures and attribution techniques to obtain the attacker's true identity, create a hacker profile, and confirm the attacker's true identity.

[0003] In existing technologies, unpatched vulnerabilities in certain clients are typically exploited to obtain information about attackers and important files on their devices, thereby achieving countermeasures and tracing the source. However, with existing solutions, countermeasures become ineffective once the client program is updated to a patched version. Furthermore, existing solutions only work for specific client versions, resulting in poor universality and limited countermeasure capabilities. They can only obtain some files and are not very convenient to operate. Because control of the shell terminal is not obtained, countermeasure operations are restricted. Summary of the Invention

[0004] In view of this, the purpose of this invention is to provide a honeypot security method, apparatus, device, and storage medium based on ELF files. This method enables network security by connecting to a honeypot control terminal via an ELF file. Once the ELF file is obtained and executed by the attacking end, the attacking device can be controlled through the honeypot control terminal, thus achieving a honeypot security countermeasure. This effectively counters the security breach, avoiding the need for vulnerability discovery in network security and improving network security efficiency. The specific solution is as follows:

[0005] Firstly, this application discloses a honeypot security method based on ELF files, including:

[0006] A subprocess is generated based on preset assembly code, and the subprocess is used to connect to the honeypot control terminal to generate the target file;

[0007] The target file is added to a preset ELF file, and the address of the added ELF file is modified to obtain the target ELF file;

[0008] Determine whether the target ELF file has been obtained by the attacking terminal. If so, use the honeypot control terminal to control the attacking terminal.

[0009] Optionally, the step of generating a subprocess based on preset assembly code and using the subprocess to connect to the honeypot control terminal to generate the target file includes:

[0010] The fork function is used to derive a child process, and the child process is used to connect to the honeypot control terminal so as to perform anti-control operations based on the honeypot control.

[0011] The subprocess executes a preset assembler to obtain the target file based on the code in the assembler.

[0012] Optionally, adding the target file to a preset ELF file and modifying the address of the added ELF file to obtain the target ELF file includes:

[0013] The target file is added to a preset ELF file, and the corresponding section head information in the preset ELF file is modified to obtain a new ELF file;

[0014] Modify the entry address of the new ELF file to obtain the target ELF file.

[0015] Optionally, determining whether the target ELF file has been obtained by the attacking terminal, and if so, controlling the attacking terminal using the honeypot control terminal, includes:

[0016] Determine whether the target ELF file has been obtained by the attacking terminal. If the target ELF file has been obtained by the attacking terminal, receive the anti-control command sent by the honeypot control terminal so as to control the attacking terminal based on the anti-control command.

[0017] Optionally, before determining whether the target ELF file has been obtained by the attacking terminal, and if so, controlling the attacking terminal using the honeypot control terminal, the method further includes:

[0018] The entry address of the target ELF file is pointed to the child process, so that the code in the anti-control instruction sent by the honeypot control terminal is executed based on the child process, and the code of the preset ELF file is executed by the original process corresponding to the preset ELF file.

[0019] Optionally, the preset assembly code is shell-based code; the child process runs in a Linux-based environment.

[0020] Secondly, this application discloses a honeypot security device based on ELF files, comprising:

[0021] The file generation module uses a language based on preset assembly code to generate a subprocess, and uses the subprocess to connect to the honeypot control terminal to generate the target file;

[0022] The file modification module adds the target file to a preset ELF file and modifies the address of the added ELF file to obtain the target ELF file.

[0023] The security countermeasure module is used to determine whether the target ELF file has been obtained by the attacking terminal. If so, the attacking terminal is controlled by the honeypot control terminal.

[0024] Optionally, the security countermeasure module may include:

[0025] The instruction execution unit is used to determine whether the target ELF file has been obtained by the attacking terminal. If the target ELF file has been obtained by the attacking terminal, it receives the anti-control instruction sent by the honeypot control terminal so as to control the attacking terminal based on the anti-control instruction.

[0026] Thirdly, this application discloses an electronic device, including:

[0027] Memory, used to store computer programs;

[0028] A processor for executing the computer program to implement the honeypot security method based on ELF files as described above.

[0029] Fourthly, this application discloses a computer-readable storage medium for storing a computer program, which, when executed by a processor, implements the honeypot security method based on ELF files as described above.

[0030] In this application, a subprocess is first generated based on preset assembly code, and this subprocess is used to connect to the honeypot control terminal to generate a target file. Then, the target file is added to a preset ELF file, and the address of the added ELF file is modified to obtain the target ELF file. Finally, it is determined whether the target ELF file has been obtained by the attacking terminal. If so, the attacking terminal is controlled using the honeypot control terminal. Therefore, the honeypot security method based on ELF files described in this application can generate a subroutine based on preset code, connect to the honeypot control terminal through the generated subroutine to obtain the target file, and then obtain the target ELF file. When it is determined that the ELF file has been obtained and run by the attacking terminal, the attacking terminal's device can be controlled through the honeypot control terminal to achieve a honeypot security countermeasure. This effectively achieves countermeasures against honeypots, avoiding the need for vulnerability discovery in network security and improving the efficiency of network security. Attached Figure Description

[0031] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0032] Figure 1 A flowchart of a honeypot security method based on ELF files is provided for this application;

[0033] Figure 2 A timing diagram of a honeypot security method based on ELF files provided in this application;

[0034] Figure 3 A flowchart of a specific honeypot security method based on ELF files is provided in this application;

[0035] Figure 4 This application provides a schematic diagram of ELF file address modification;

[0036] Figure 5 This application provides a schematic diagram of a honeypot security device based on an ELF file.

[0037] Figure 6 This application provides a structural diagram of an electronic device. Detailed Implementation

[0038] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0039] In existing technologies, unpatched vulnerabilities in certain clients are typically exploited to obtain information about attackers and important files on their devices, thereby achieving countermeasures and tracing the source. However, with existing solutions, countermeasures become ineffective once the client program is updated to a patched version. Furthermore, existing solutions only work for specific client versions, resulting in poor universality and limited countermeasure capabilities. They can only obtain some files and are not very convenient to operate. Because control of the shell terminal is not obtained, countermeasure operations are restricted.

[0040] To overcome the aforementioned technical problems, this application provides a honeypot security method, apparatus, device, and storage medium based on ELF files. This method enables network security by connecting to a honeypot control terminal via an ELF file. Once the ELF file is obtained and executed by the attacking end, the attacking end's device can be controlled through the honeypot control terminal, thus achieving a honeypot security countermeasure. This effectively counters the security breach, avoiding reliance on vulnerability discovery for network security and improving network security efficiency.

[0041] See Figure 1 As shown, this embodiment of the invention discloses a honeypot security method based on ELF files, including:

[0042] Step S11: Generate a subprocess based on preset assembly code, and use the subprocess to connect to the honeypot control terminal to generate the target file.

[0043] In this embodiment, a child process is generated based on preset assembly code, and the child process is used to connect to the honeypot control terminal to generate the target file. That is, in a Linux environment, code with security countermeasure capabilities needs to be pre-written using shell language, and then a child process is spawned using the fork function. The generated child process is then used to connect to the honeypot control terminal. It should be noted that after spawning the child process using the fork function, the spawned child process needs to be compiled to obtain the target file. After obtaining the target file, the original parent program continues to execute, while the child process receives anti-control instructions from the honeypot control terminal and executes the operations related to those instructions.

[0044] It should be further noted that the assembly code in this application is assumed to be shell-based code, and the subprocess runs in a Linux-based environment.

[0045] Step S12: Add the target file to the preset ELF file, and modify the address of the added ELF file to obtain the target ELF file.

[0046] In this embodiment, the target file is added to a preset ELF file, and the address of the added ELF file is modified to obtain the target ELF file. That is, the target file obtained by compiling the relevant code of the subprocess is added to the preset ELF file, i.e., the original ELF file. The target file needs to be treated as a new section (revert section), i.e., a new section, and the corresponding section header information is modified. The resulting new ELF file is then named, for example, elf_new_1. Then, the entry point address in elf_new_1 is modified to the address of the revert section, i.e., the entry address in elf_new_1 is modified to the address of the new section, and the modified ELF file is named, for example, elf_new_2, and the elf_new_2 file is determined as the target ELF file.

[0047] Step S13: Determine whether the target ELF file has been obtained by the attacking terminal. If so, control the attacking terminal using the honeypot control terminal.

[0048] In this embodiment, it is determined whether the target ELF file has been obtained by the attacking terminal. If so, the attacking terminal is controlled using the honeypot control terminal. That is, if... Figure 2 As shown, once the target ELF file is identified, it contains a subprocess connected to the honeypot control terminal, thus making it a potentially countermeasure-enabled ELF file. Furthermore, the target ELF file is distributed to a specific location awaiting acquisition by the attacker. Once the program is executed on the attacker's terminal, the attacker can control the terminal through the honeypot system's control terminal.

[0049] It should be noted that, before determining whether the target ELF file has been obtained by the attacking terminal, and if so, controlling the attacking terminal using the honeypot control terminal, the process further includes:

[0050] The entry address of the target ELF file is pointed to the child process, so that the code in the anti-control instructions sent by the honeypot control terminal can be executed based on the child process, and the code of the preset ELF file can be executed using the original process corresponding to the preset ELF file. In other words, the entry address of the target ELF file needs to be pointed to the child process. This way, when the target ELF file is obtained, the anti-control instructions sent by the honeypot control terminal can be executed through the child process to counter the attacking terminal.

[0051] Therefore, in this embodiment, a subprocess is first generated based on preset assembly code, and the subprocess is used to connect to the honeypot control terminal to generate a target file. Then, the target file is added to a preset ELF file, and the address of the added ELF file is modified to obtain the target ELF file. Finally, it is determined whether the target ELF file has been obtained by the attacking terminal. If so, the attacking terminal is controlled using the honeypot control terminal. Thus, the honeypot security method based on ELF files described in this application can generate a subroutine based on preset code, connect to the honeypot control terminal through the generated subroutine to obtain the target file, and then obtain the target ELF file. When it is determined that the ELF file has been obtained and run by the attacking terminal, the attacking terminal's device can be controlled through the honeypot control terminal to achieve a honeypot security countermeasure. This effectively achieves countermeasures against the honeypot, avoiding network security measures based on vulnerability discovery, and improving the efficiency of network security.

[0052] As can be seen from the foregoing embodiments, this application requires the method of connecting a child process derived from an ELF file to the honeypot control terminal to achieve countermeasures against the attacking terminal. Therefore, this embodiment provides a detailed description of how to achieve countermeasures against the control terminal. See [link to relevant documentation]. Figure 3 As shown, this embodiment of the invention discloses a honeypot security method based on ELF files, including:

[0053] Step S21: Derive a child process based on the fork function, and use the child process to connect to the honeypot control terminal so as to perform anti-control operations based on the honeypot control.

[0054] In this embodiment, a child process is spawned using the `fork` function, and this child process is used to connect to the honeypot control terminal to perform counter-control operations based on the honeypot control. That is, after pre-writing security countermeasure code in the shell language within the Linux environment, a child process is spawned using the `fork` function. Then, the child process's current standard input, standard output, and error output are redirected to a handle connected to the honeypot control terminal to establish the connection. In this way, the spawned child process can receive counter-control commands from the honeypot control terminal without affecting the original process. Furthermore, it should be noted that because the countermeasure code used in the spawned child process is relatively small, the size of the original process is essentially unaffected and difficult to detect. Therefore, the impact on the original process is also minimal. This allows for countermeasures against the attacking terminal without affecting the original process.

[0055] Step S22: Execute a preset assembler using the subprocess to obtain the target file based on the code in the assembler.

[0056] In this embodiment, the child process executes a preset assembler to obtain the target file based on the code in the assembler. That is, after obtaining the child process, the child process needs to execute a preset / bin / sh program to switch to a shell terminal program, and then compile the preset assembly code into the target file.

[0057] Step S23: Add the target file to the preset ELF file and modify the corresponding section head information in the preset ELF file to obtain a new ELF file.

[0058] In this embodiment, the target file is added to a preset ELF file, and the corresponding section head information in the preset ELF file is modified to obtain a new ELF file. That is, as shown... Figure 4 As shown, in the original ELF file, the obtained target file needs to be treated as a new section (revert section), i.e., a new section, and the corresponding section header information needs to be modified to generate a new ELF file. It should be noted that in the ELF file, the corresponding _start function needs to be found based on the Entry point address in the ELF header. From the _start function, the user-written program code is executed in the main function (user program content) entered through __libc_start_glibc. All of the executable code mentioned above exists in the .text section of the ELF file. To achieve program injection, a new section with countermeasure capabilities (such as getshell) needs to be inserted into the original ELF file, and the ELF file's Entry point address needs to be pointed to the newly inserted section. A new process, i.e., the child process mentioned in the previous steps, is spawned in the newly inserted section. Then, the child process executes the countermeasure code, while the original process continues to execute the normal code blocks in the original ELF file to avoid being detected by the user.

[0059] Step S24: Modify the entry address of the new ELF file to obtain the target ELF file.

[0060] In this embodiment, the entry address of the new ELF file is modified to obtain the target ELF file. That is, the entry point address of the new ELF file is modified to the address of the revert section, which in turn modifies the entry address of the new ELF file to the address of the new section, so that the anti-control instructions of the honeypot control terminal can be executed through the child process in the revert section.

[0061] Step S25: Determine whether the target ELF file has been obtained by the attacking terminal. If the target ELF file has been obtained by the attacking terminal, receive the anti-control instruction sent by the honeypot control terminal so as to control the attacking terminal based on the anti-control instruction.

[0062] In this embodiment, it is determined whether the target ELF file has been acquired by the attacking terminal. If the target ELF file has been acquired by the attacking terminal, a counter-control instruction sent by the honeypot control terminal is received, so as to control the attacking terminal based on the counter-control instruction. That is, if the target ELF file has been acquired by the attacking terminal and the target ELF file is executed on the attacking terminal, the counter-control instruction sent by the honeypot control terminal can be received through a child process in the target ELF file, and the counter-control instruction can be executed to achieve counter-control of the attacking terminal. It should be noted that in the prior art, it is common to use certain unpatched vulnerabilities in certain clients to obtain the attacker and some important files on them, so as to achieve the effect of counter-attack and tracing. However, with the existing technology, when the client program is updated to the version with the vulnerability patched, the counter-attack will no longer be effective. Moreover, the existing technology is only effective for specific versions of clients, with poor universality and poor counter-attack capability. It can only obtain some files, and the operation is not convenient. Since control of the shell terminal is not obtained, the counter-attack operation is limited. This avoids exploiting vulnerabilities to achieve countermeasures, and even without vulnerabilities, it is still possible to counter control of the control terminal, thus enhancing the universality of countermeasures.

[0063] Therefore, in this embodiment, a child process is first spawned using the fork function, and this child process is used to connect to the honeypot control terminal to perform anti-control operations based on the honeypot control. The child process executes a preset assembly program to obtain a target file based on the code in the assembly program. Then, the target file is added to a preset ELF file, and the corresponding section head information in the preset ELF file is modified to obtain a new ELF file. The entry address of the new ELF file is modified to obtain the target ELF file. Finally, it is determined whether the target ELF file has been obtained by the attacking terminal. If the target ELF file has been obtained by the attacking terminal, an anti-control instruction sent by the honeypot control terminal is received to control the attacking terminal based on the anti-control instruction. Thus, the honeypot security method based on ELF files described in this application allows for the generation of a child process, which connects to the honeypot control terminal to obtain the target file. The target ELF file is then obtained from the target file. Once it is determined that the ELF file has been obtained and run by the attacking terminal, the attacking terminal's device can be controlled through the honeypot control terminal, thereby realizing a honeypot security countermeasure method. This avoids exploiting vulnerabilities for countermeasures. Even without vulnerabilities, it is still possible to counter control terminals, enhancing the universality of countermeasures and improving the efficiency of network security.

[0064] See Figure 5 As shown, this embodiment of the invention discloses a honeypot security device based on ELF files, comprising:

[0065] The file generation module 11 generates a subprocess based on preset assembly code, and uses the subprocess to connect to the honeypot control terminal to generate the target file;

[0066] The file modification module 12 adds the target file to a preset ELF file and modifies the address of the added ELF file to obtain the target ELF file.

[0067] The security countermeasure module 13 is used to determine whether the target ELF file has been obtained by the attacking terminal. If so, the attacking terminal is controlled by the honeypot control terminal.

[0068] Therefore, in this embodiment, a subprocess is first generated based on preset assembly code, and the subprocess is used to connect to the honeypot control terminal to generate a target file. Then, the target file is added to a preset ELF file, and the address of the added ELF file is modified to obtain the target ELF file. Finally, it is determined whether the target ELF file has been obtained by the attacking terminal. If so, the attacking terminal is controlled using the honeypot control terminal. Thus, the honeypot security method based on ELF files described in this application can generate a subroutine based on preset code, connect to the honeypot control terminal through the generated subroutine to obtain the target file, and then obtain the target ELF file. When it is determined that the ELF file has been obtained and run by the attacking terminal, the attacking terminal's device can be controlled through the honeypot control terminal to achieve a honeypot security countermeasure. This effectively achieves countermeasures against the honeypot, avoiding network security measures based on vulnerability discovery, and improving the efficiency of network security.

[0069] In some embodiments, the file generation module 11 may specifically include:

[0070] A process generation unit is used to spawn child processes based on the fork function and use the child processes to connect to the honeypot control terminal so as to perform anti-control operations based on the honeypot control.

[0071] The file generation unit is used to execute a preset assembler program using the subprocess to obtain the target file based on the code in the assembler program.

[0072] In some embodiments, the file modification module 12 may specifically include:

[0073] The file adding unit is used to add the target file to a preset ELF file and modify the corresponding section head information in the preset ELF file to obtain a new ELF file;

[0074] The data modification unit is used to modify the entry address of the new ELF file to obtain the target ELF file.

[0075] In some embodiments, the security countermeasure module 13 may specifically include:

[0076] The instruction execution unit is used to determine whether the target ELF file has been obtained by the attacking terminal. If the target ELF file has been obtained by the attacking terminal, it receives the anti-control instruction sent by the honeypot control terminal so as to control the attacking terminal based on the anti-control instruction.

[0077] In some embodiments, the ELF file-based honeypot security device may further include:

[0078] The code execution unit is used to point the entry address of the target ELF file to the child process, so as to execute the code in the anti-control instruction sent by the honeypot control terminal based on the child process, and to execute the code of the preset ELF file using the original process corresponding to the preset ELF file.

[0079] Furthermore, embodiments of this application also disclose an electronic device, Figure 6 This is a structural diagram of an electronic device 20 according to an exemplary embodiment. The content of the diagram should not be construed as limiting the scope of this application.

[0080] Figure 6 This is a schematic diagram of the structure of an electronic device 20 provided in an embodiment of this application. Specifically, the electronic device 20 may include: at least one processor 21, at least one memory 22, a power supply 23, a communication interface 24, an input / output interface 25, and a communication bus 26. The memory 22 stores a computer program, which is loaded and executed by the processor 21 to implement the relevant steps in the ELF file-based honeypot security method disclosed in any of the foregoing embodiments. Alternatively, the electronic device 20 in this embodiment may specifically be a computer.

[0081] In this embodiment, the power supply 23 is used to provide operating voltage for each hardware device on the electronic device 20; the communication interface 24 can create a data transmission channel between the electronic device 20 and external devices, and the communication protocol it follows can be any communication protocol applicable to the technical solution of this application, and is not specifically limited here; the input / output interface 25 is used to acquire external input data or output data to the outside world, and its specific interface type can be selected according to specific application needs, and is not specifically limited here.

[0082] In addition, the memory 22, as a carrier for resource storage, can be a read-only memory, random access memory, disk or optical disk, etc. The resources stored thereon can include operating system 221, computer program 222, etc., and the storage method can be temporary storage or permanent storage.

[0083] The operating system 221 is used to manage and control the various hardware devices on the electronic device 20 and the computer program 222, which may be Windows Server, Netware, Unix, Linux, etc. In addition to including a computer program capable of performing the ELF file-based honeypot security method executed by the electronic device 20 as disclosed in any of the foregoing embodiments, the computer program 222 may further include a computer program capable of performing other specific tasks.

[0084] Furthermore, this application also discloses a computer-readable storage medium for storing a computer program; wherein, when the computer program is executed by a processor, it implements the aforementioned honeypot security method based on ELF files. Specific steps of this method can be found in the corresponding content disclosed in the foregoing embodiments, and will not be repeated here.

[0085] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For the apparatus disclosed in the embodiments, since it corresponds to the method disclosed in the embodiments, the description is relatively simple; relevant parts can be referred to in the method section.

[0086] Those skilled in the art will further recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0087] The steps of the methods or algorithms described in conjunction with the embodiments disclosed herein can be implemented directly by hardware, a software module executed by a processor, or a combination of both. The software module can be located in random access memory (RAM), main memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disk, removable disk, CD-ROM, or any other form of storage medium known in the art.

[0088] Finally, it should be noted that in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0089] The technical solutions provided in this application have been described in detail above. Specific examples have been used to illustrate the principles and implementation methods of this application. The descriptions of the above embodiments are only for the purpose of helping to understand the methods and core ideas of this application. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of this application. Therefore, the content of this specification should not be construed as a limitation of this application.

Claims

1. A honeypot security method based on ELF files, characterized in that, include: A subprocess is generated based on preset assembly code, and the subprocess is used to connect to the honeypot control terminal to generate the target file; The target file is added to a preset ELF file, and the address of the added ELF file is modified to obtain the target ELF file; Determine whether the target ELF file has been obtained by the attacking terminal; if so, use the honeypot control terminal to control the attacking terminal. The step of generating a subprocess based on preset assembly code and using the subprocess to connect to the honeypot control terminal to generate the target file includes: The fork function is used to derive a child process, and the child process is used to connect to the honeypot control terminal so as to perform anti-control operations based on the honeypot control. The subprocess executes a preset assembler to obtain the target file based on the code in the assembler.

2. The honeypot security method based on ELF files according to claim 1, characterized in that, The step of adding the target file to a preset ELF file and modifying the address of the added ELF file to obtain the target ELF file includes: The target file is added to a preset ELF file, and the corresponding sectionhead information in the preset ELF file is modified to obtain a new ELF file; Modify the entry address of the new ELF file to obtain the target ELF file.

3. The honeypot security method based on ELF files according to claim 1, characterized in that, The step of determining whether the target ELF file has been obtained by the attacking terminal, and if so, controlling the attacking terminal using the honeypot control terminal, includes: Determine whether the target ELF file has been obtained by the attacking terminal. If the target ELF file has been obtained by the attacking terminal, receive the anti-control command sent by the honeypot control terminal so as to control the attacking terminal based on the anti-control command.

4. The honeypot security method based on ELF files according to claim 3, characterized in that, Before determining whether the target ELF file has been obtained by the attacking terminal, and if so, controlling the attacking terminal using the honeypot control terminal, the method further includes: The entry address of the target ELF file is pointed to the child process, so that the code in the anti-control instruction sent by the honeypot control terminal is executed based on the child process, and the code of the preset ELF file is executed by the original process corresponding to the preset ELF file.

5. The honeypot security method based on ELF files according to any one of claims 1 to 4, characterized in that, The preset assembly code is shell-based code; the child process runs in a Linux-based environment.

6. A honeypot security device based on ELF files, characterized in that, include: The file generation module is used to generate a subprocess based on preset assembly code, and use the subprocess to connect to the honeypot control terminal to generate the target file; The file modification module is used to add the target file to a preset ELF file and modify the address of the added ELF file to obtain the target ELF file; The security countermeasure module is used to determine whether the target ELF file has been obtained by the attacking terminal. If so, the attacking terminal is controlled by the honeypot control terminal. The file generation module includes: A process generation unit is used to spawn child processes based on the fork function and use the child processes to connect to the honeypot control terminal so as to perform anti-control operations based on the honeypot control. The file generation unit is used to execute a preset assembler program using the subprocess to obtain the target file based on the code in the assembler program.

7. The honeypot security device based on ELF files according to claim 6, characterized in that, The security countermeasure module includes: The instruction execution unit is used to determine whether the target ELF file has been obtained by the attacking terminal. If the target ELF file has been obtained by the attacking terminal, it receives the anti-control instruction sent by the honeypot control terminal so as to control the attacking terminal based on the anti-control instruction.

8. An electronic device, characterized in that, include: Memory, used to store computer programs; A processor for executing the computer program to implement the ELF file-based honeypot security method as described in any one of claims 1 to 5.

9. A computer-readable storage medium, characterized in that, Used to store computer programs, which, when executed by a processor, implement the honeypot security method based on ELF files as described in any one of claims 1 to 5.

Images