A method, device and storage medium for defining a honeypot service

Abstract

The application discloses a honeypot service definition method and device, equipment and storage medium, and relates to the technical field of network security, which comprises the following steps: obtaining public fingerprint rules and arranging the fingerprint rules to obtain a plurality of fingerprint rules; obtaining a fingerprint rule template designed based on the plurality of fingerprint rules and generating a custom fingerprint feature string and a file according to the fingerprint rule template; distributing the custom fingerprint feature string and the file to a target honeypot site based on a preset feature distribution mode and restarting the target honeypot site to obtain a target honeypot service. Through the obtained plurality of fingerprint rules, a user can generate a fingerprint rule template meeting the user's needs, so that various types of applications and systems can be better simulated, and since the generated fingerprint features are customized and difficult to be recognized by attackers, the deception of the honeypot is enhanced, and it is more difficult for the attackers to distinguish the real system from the honeypot system.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, in particular to a honeypot service definition method, device, equipment and storage medium. BACKGROUND

[0002] In the field of network security, honeypot is a widely used security tool for simulating vulnerable systems or services to attract attackers to attack and record the behavior and attack methods of attackers for analysis and improvement of defense capabilities. However, the existing honeypot technology often uses fixed templates or rules to simulate vulnerable systems or services, which has a big problem, and is easy to be recognized and evaded by attackers, thereby affecting its actual security effect. When deploying honeypot, it is necessary to deploy related vulnerability honeypot according to the current popular security vulnerability events and situation, which will undoubtedly be a tedious work to insert a large number of fingerprint features in the website. Figure 1 As shown in the figure, the existing technical solution inserts fingerprint features into the website to simulate some specific vulnerabilities or applications to lure attackers to further attack and obtain attack information of the attackers, and then improve the level of network security protection. This technical solution is relatively easy to identify for attackers, because attackers can identify these features to determine whether the website is a real site. In addition, this technical solution also has some problems in use, such as increasing the load of the website, which may reduce the performance of the website, and also needs manual updating of the fingerprint rule library, thereby increasing the maintenance cost and risk. Therefore, how to improve the flexibility and security of honeypot production is a problem to be solved. SUMMARY

[0003] Therefore, the purpose of the present application is to provide a honeypot service definition method, device, equipment and storage medium, which can generate self-defined type and application honeypot, and increase the flexibility and security of the honeypot. The specific scheme is as follows:

[0004] In a first aspect, the present application discloses a honeypot service definition method applied to a honeypot production system, comprising:

[0005] Obtaining public fingerprint rules and arranging the fingerprint rules to obtain a plurality of fingerprint rules;

[0006] Obtaining a fingerprint rule template designed based on the plurality of fingerprint rules and generating a self-defined fingerprint feature string and file according to the fingerprint rule template;

[0007] Distributing the self-defined fingerprint feature string and file to a target honeypot site based on a preset feature distribution method and restarting the target honeypot site to obtain a target honeypot service.

[0008] Optionally, the obtaining and sorting of the disclosed fingerprint rules to obtain target fingerprint rules comprises:

[0009] The disclosed fingerprint rules are crawled from the fingerprint rule repository of Github by a preset crawler program and are updated to a preset fingerprint library.

[0010] The fingerprint rules in the preset fingerprint library are sorted and classified based on preset sorting rules to obtain a plurality of fingerprint rules.

[0011] Optionally, the obtaining of a fingerprint rule template designed based on the plurality of fingerprint rules and the generation of a custom fingerprint feature string and file according to the fingerprint rule template comprises:

[0012] Target fingerprint rules are selected from the plurality of fingerprint rules based on a target business scenario.

[0013] A fingerprint rule template designed based on the target fingerprint rules is obtained, and a custom fingerprint feature string and file are generated according to the fingerprint rule template.

[0014] Optionally, the generation of a custom fingerprint feature string and file according to a fingerprint rule template comprises:

[0015] A corresponding custom fingerprint feature string is generated based on the target fingerprint rule used in the fingerprint rule template.

[0016] A corresponding file is generated based on the target fingerprint feature in the fingerprint rule template; the file includes a folder with a preset specific path and file content containing the target fingerprint feature.

[0017] Optionally, before the custom fingerprint feature string and file are issued to the target honeypot site based on the preset feature issuing mode and the target honeypot site is restarted, the method further comprises:

[0018] The historical custom fingerprint feature strings and historical files stored in the target honeypot site are cleared to obtain a cleared target honeypot site.

[0019] Optionally, the custom fingerprint feature string and file are issued to the target honeypot site based on the preset feature issuing mode and the target honeypot site is restarted to obtain a target honeypot service, comprising:

[0020] The custom fingerprint feature string and file are issued to the target page and target path corresponding to the cleared target honeypot site based on the preset feature issuing mode, and the target honeypot site is restarted to obtain a target honeypot service.

[0021] Optionally, the preset-feature-based issuing manner further comprises:

[0022] obtaining a supervision instruction issued for the target honeypot service and making corresponding modification and adjustment to information in the target honeypot service according to the supervision instruction;

[0023] obtaining attacker information collected by the target honeypot service, so as to take corresponding defense measures according to the attacker information.

[0024] In a second aspect, the present application discloses a honeypot service definition device applied to a honeypot making system, comprising:

[0025] a fingerprint rule management module configured to obtain public fingerprint rules and sort the fingerprint rules to obtain a plurality of fingerprint rules;

[0026] a custom template generation module configured to obtain a fingerprint rule template designed based on the plurality of fingerprint rules and generate a custom fingerprint feature string and file according to the fingerprint rule template;

[0027] a honeypot site feature management module configured to issue the custom fingerprint feature string and file to a target honeypot site based on a preset-feature-based issuing manner and restart the target honeypot site to obtain a target honeypot service.

[0028] In a third aspect, the present application discloses an electronic device, comprising:

[0029] a memory configured to save a computer program;

[0030] a processor configured to execute the computer program to implement the honeypot service definition method.

[0031] In a fourth aspect, the present application discloses a computer readable storage medium configured to save a computer program, wherein the computer program is executed by a processor to implement the honeypot service definition method.

[0032] It can be seen that in the present application, the disclosed fingerprint rules are acquired and arranged to obtain a plurality of fingerprint rules; a fingerprint rule template designed based on the plurality of fingerprint rules is acquired, and a custom fingerprint feature string and file are generated according to the fingerprint rule template; the custom fingerprint feature string and file are issued to a target honeypot site based on a preset feature issuing mode, and the target honeypot site is restarted to obtain a target honeypot service. In this way, the user generates a fingerprint rule template for a target business scenario based on the acquired plurality of fingerprint rules according to his own needs, and then configures the target honeypot site according to the generated template, so that various types of applications and systems can be better simulated, and the recognition ability of the honeypot is improved. In addition, since the generated fingerprint features are customized, it is difficult for attackers to identify them, thereby enhancing the deception of the honeypot and making it more difficult for attackers to distinguish between real systems and honeypot systems. BRIEF DESCRIPTION OF DRAWINGS

[0033] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the drawings needed to be used in the embodiments or prior art description will be briefly introduced below. Obviously, the drawings in the following description are only embodiments of the present application, and other drawings can be obtained by those skilled in the art without creative labor on the basis of the provided drawings.

[0034] Figure 1 A prior art honeypot service definition method flow chart disclosed by the present application;

[0035] Figure 2 A honeypot service definition method flow chart disclosed by the present application;

[0036] Figure 3 A specific honeypot service definition method flow chart disclosed by the present application;

[0037] Figure 4 A specific honeypot service definition method flow chart disclosed by the present application;

[0038] Figure 5 A honeypot service definition device structure schematic diagram disclosed by the present application;

[0039] Figure 6 A structure diagram of an electronic device disclosed by the present application. DETAILED DESCRIPTION

[0040] With reference to the drawings and the embodiments of the present application, the technical solutions in the embodiments of the present application will be described clearly and completely. Obviously, the described embodiments are only some of the embodiments of the present application, but not all of the embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative efforts are within the scope of the present application.

[0041] In the prior art, some specific vulnerabilities or applications are simulated by inserting fingerprint features into a website to lure attackers for further attacks, obtain attack information of the attackers, and thus improve the level of network security protection. The present application will specifically introduce a method for generating a custom type of honeypot service.

[0042] Referring to Figure 2 The present application discloses a honeypot service definition method, which is applied to a honeypot manufacturing system and includes the following steps.

[0043] Step S11: Obtain public fingerprint rules and sort the fingerprint rules to obtain a plurality of fingerprint rules.

[0044] In the present application, first, an open-source fingerprint tool warehouse is added to the system, then a fingerprint rule crawler program corresponding to the selected fingerprint tool warehouse is used to crawl public fingerprint rules on the Internet, and a real-time update instruction is set to automatically update the fingerprint rules in the fingerprint library in real time based on the real-time update instruction, so as to determine that the fingerprint rules stored in the fingerprint library are all the latest fingerprint rules. Then, the same fingerprint rules are merged and processed according to the fingerprint rules and fingerprint information obtained by the crawler module, and the merged fingerprint rules are classified and sorted. According to the technical principle of fingerprint identification, the fingerprint rule field is marked and saved, and the fingerprint is automatically verified and tested. If the fingerprint fails the verification, the fingerprint will not be used. In this way, the accuracy and reliability of the fingerprint can be ensured.

[0045] Step S12: Obtain a fingerprint rule template designed based on the plurality of fingerprint rules and generate a custom fingerprint feature string and file according to the fingerprint rule template.

[0046] In this embodiment, the obtaining of the fingerprint rule template designed based on the fingerprint rules and the generation of the custom fingerprint feature string and file according to the fingerprint rule template include: selecting a target fingerprint rule from the fingerprint rules based on a target business scenario; and obtaining the fingerprint rule template designed based on the target fingerprint rule and generating the custom fingerprint feature string and file according to the fingerprint rule template. The user can select a target fingerprint rule that meets the target application scenario from the fingerprint rules according to the target business scenario, and then design. The fingerprint rule template is designed according to the determined target fingerprint rule and contains different applications, such as application type, application name, manufacturer, and the like. That is, the user sets the custom fingerprint rule template according to the target fingerprint rule in the fingerprint rule library, and these templates can be classified by type, such as router template, firewall template, OA (Office Automation, i.e., office automation) application template, and the like, or classified by application, such as Tongda OA template, Zhizhi OA template, Huawei router template, and the like. The user can quickly issue the fingerprint rule with custom content and facilitate customization of different types of honeypots. After obtaining the fingerprint rule template, the custom fingerprint feature string and file are generated based on the fingerprint rule template. The generation of the custom fingerprint feature string and file according to the fingerprint rule template includes: generating a corresponding custom fingerprint feature string based on the target fingerprint rule used in the fingerprint rule template; and generating a corresponding file based on the target fingerprint feature in the fingerprint rule template; the file contains a folder with a preset specific path and file content containing the target fingerprint feature. That is, a random string that meets the rules is generated according to the fingerprint rule template. For the fingerprint feature string of a specific page, a folder with a specific path and file content containing the feature need to be generated. For the features of the home page, response header, 404 page, error page, and port banner, a string can be directly generated. In this way, the custom fingerprint feature string generated can meet the fingerprint rule and have a certain randomness.

[0047] Step S13: issuing the custom fingerprint feature string and file to the target honeypot site based on a preset feature issuing mode and restarting the target honeypot site to obtain a target honeypot service.

[0048] In this embodiment, the user can select different preset feature delivery methods according to business needs, including but not limited to homepage features, response header features, specified page features, 404 page features, error page features, and port service features. Then the honeypot production system delivers the custom fingerprint feature string and file to the target honeypot site according to the preset feature delivery method, and then restarts the honeypot site service to obtain the target honeypot service. After the custom fingerprint feature string and file are delivered to the target honeypot site based on the preset feature delivery method and the target honeypot site is restarted to obtain the target honeypot service, the method further includes: obtaining supervision instructions issued for the target honeypot service and making corresponding modifications and adjustments to information in the target honeypot service according to the supervision instructions; obtaining attacker information collected by the target honeypot service, so as to take corresponding defense measures according to the attacker information. The user can add, modify, and delete fingerprint features as needed. In this way, the honeypot site can be monitored and managed, including but not limited to adding, deleting, and modifying honeypot sites, viewing honeypot site logs and alarm information, etc. And through the rich analysis and statistical functions contained in the honeypot production system, the situation of the honeypot site can be better understood and mastered. The user can collect information of the attacker through the honeypot site, and take corresponding measures according to the collected information to ensure the security and stability of the system. At the same time, the user can compare and analyze the collected information with the fingerprint library in the system to better understand the characteristics and behaviors of the attacker.

[0049] As can be seen, in this embodiment, the disclosed fingerprint rules are obtained and arranged to obtain a plurality of fingerprint rules; a fingerprint rule template designed based on the plurality of fingerprint rules is obtained, and a custom fingerprint feature string and file are generated according to the fingerprint rule template; and the custom fingerprint feature string and file are delivered to a target honeypot site based on a preset feature delivery method, and the target honeypot site is restarted to obtain a target honeypot service. In this way, the user generates a fingerprint rule template for a target business scenario based on the obtained plurality of fingerprint rules according to his own needs, and then configures the target honeypot site according to the generated template, so as to better simulate various types of applications and systems and improve the recognition ability of the honeypot. In addition, since the generated fingerprint features are customized, it is difficult for attackers to identify them, thereby enhancing the deception of the honeypot and making it more difficult for attackers to distinguish between real systems and honeypot systems.

[0050] The above embodiments introduce a method of generating a custom type of honeypot service. In this embodiment, the process of arranging fingerprint rules and updating honeypot site information will be specifically introduced.

[0051] Referring to Figure 3As shown, the embodiment of the present application discloses a specific honeypot service definition method, which is applied to a honeypot making system and includes the following steps.

[0052] Step S21: The preset crawler program is used to crawl the public fingerprint rules from the fingerprint rule warehouse of Github and update them to the preset fingerprint library.

[0053] In the embodiment, the crawler program is used to crawl the public fingerprint rule warehouse of Github, obtain the latest fingerprint rules, and update them to the fingerprint library, so that the rule information in the fingerprint library is the latest.

[0054] Step S22: The fingerprint rules in the preset fingerprint library are de-duplicated, classified and arranged based on the preset fingerprint arrangement rules to obtain a plurality of fingerprint rules.

[0055] In the embodiment, the related rules of the fingerprint identification tool publicly available on the Internet are collected to obtain the preset fingerprint arrangement rules, and the fingerprint rules in the preset fingerprint library are de-duplicated, classified and arranged based on the fingerprint arrangement rules to obtain a plurality of fingerprint rules. For the classification of rules, the types of fingerprint identification are classified, such as OA, router, firewall, CMS (Content Management System, i.e., website content management system), etc., and the technologies of fingerprint identification are classified, such as file MD5 (Message-Digest Algorithm 5, i.e., information-digest algorithm) identification, homepage content identification, response header identification, error content identification, 404 content identification, etc. In addition, the fingerprint rule library is also arranged according to the content matching method of fingerprint identification, such as regular matching, string matching, etc.

[0056] Step S23: The fingerprint rule templates designed based on the plurality of fingerprint rules are obtained, and the custom fingerprint feature strings and files are generated according to the fingerprint rule templates.

[0057] Step S24: The historical custom fingerprint feature strings and historical files stored in the target honeypot site are cleared to obtain a cleared target honeypot site.

[0058] In the embodiment, if the historical custom fingerprint feature strings and historical files are stored in the target honeypot site, these contents need to be cleared first, for example, the fingerprint features of the issued port banner.

[0059] Step S25: The custom fingerprint feature strings and files are issued to the target pages and target paths corresponding to the cleared target honeypot site based on the preset feature issuing method, and the target honeypot site is restarted to obtain a target honeypot service.

[0060] In this embodiment, after clearing the historical custom fingerprint feature strings and historical files stored in the target honeypot site to obtain the cleared target honeypot site, the custom fingerprint feature strings and files are distributed to the target page and target path corresponding to the cleared target honeypot site based on a preset feature distribution method, and the honeypot site service is restarted. This ensures that the fingerprint features in the target honeypot site are updated in real time, improving the honeypot's identification capability, enhancing its deceptiveness, improving its real-time performance, and increasing its configurability.

[0061] The specific process of step S23 can be found in the relevant content disclosed in the foregoing embodiments, and will not be repeated here.

[0062] As can be seen, in this embodiment, as Figure 4 As shown, firstly, a pre-defined crawler program crawls publicly available fingerprint rules from a GitHub fingerprint rule repository and updates them to a pre-defined fingerprint database. Based on pre-defined fingerprint sorting rules, the fingerprint rules in the pre-defined fingerprint database are deduplicated and categorized to obtain several fingerprint rules. A fingerprint rule template designed based on these fingerprint rules is obtained, and a custom fingerprint feature string and file are generated according to the fingerprint rule template. The historical custom fingerprint feature strings and historical files stored in the target honeypot site are cleared to obtain a cleared target honeypot site. Based on a pre-defined feature distribution method, the custom fingerprint feature string and file are distributed to the target page and target path corresponding to the cleared target honeypot site, and the target honeypot site is restarted to obtain the target honeypot service. In this way, by developing an automated crawler program to obtain fingerprint features and automating their processing, classification, and organization, the timely updating and efficient utilization of the fingerprint feature database is ensured. Fingerprint rule templates for different applications can be set according to business scenarios, which greatly improves the usability and applicability of the honeypot. The function of distributing fingerprint features to designated honeypot sites and automatically updating fingerprint features ensures the timely updating and efficient utilization of the honeypot sites. Functions such as clearing previously existing fingerprint-feature honeypot sites, inserting corresponding fingerprint content and files into different pages and paths, and restarting the honeypot site service are used to ensure the stable operation and efficient utilization of the honeypot.

[0063] refer to Figure 5 The present application also discloses a honeypot service definition device, applied to a honeypot creation system, comprising:

[0064] The fingerprint rule management module 11 is used to obtain publicly available fingerprint rules and organize the fingerprint rules shown to obtain several fingerprint rules.

[0065] The self-defined template generation module 12 is configured to obtain a fingerprint rule template designed based on the plurality of fingerprint rules and generate a self-defined fingerprint feature string and file according to the fingerprint rule template;

[0066] The honeypot site feature management module 13 is configured to distribute the self-defined fingerprint feature string and file to a target honeypot site based on a preset feature distribution mode and restart the target honeypot site to obtain a target honeypot service.

[0067] It can be seen that in the embodiment, the disclosed fingerprint rules are obtained and arranged to obtain a plurality of fingerprint rules; a fingerprint rule template designed based on the plurality of fingerprint rules is obtained and a self-defined fingerprint feature string and file are generated according to the fingerprint rule template; and the self-defined fingerprint feature string and file are distributed to a target honeypot site based on a preset feature distribution mode and the target honeypot site is restarted to obtain a target honeypot service. In this way, the user can generate a fingerprint rule template for a target business scenario based on the obtained plurality of fingerprint rules according to his own needs, and then configure the target honeypot site according to the generated template, so as to better simulate various types of applications and systems and improve the recognition ability of the honeypot. In addition, since the generated fingerprint features are self-defined, it is difficult for attackers to identify them, thereby enhancing the deception of the honeypot and making it more difficult for attackers to distinguish between real systems and honeypot systems.

[0068] In some specific embodiments, the fingerprint rule management module 11 can specifically include:

[0069] The fingerprint crawling unit is configured to crawl the disclosed fingerprint rules from the fingerprint rule repository of Github through a preset crawler program and update them to a preset fingerprint library;

[0070] The fingerprint classification unit is configured to de-duplicate, classify and arrange the fingerprint rules in the preset fingerprint library based on a preset fingerprint arrangement rule to obtain a plurality of fingerprint rules.

[0071] In some specific embodiments, the self-defined template generation module 12 can specifically include:

[0072] The fingerprint selection unit is configured to select a target fingerprint rule from the plurality of fingerprint rules based on a target business scenario;

[0073] The feature generation unit is configured to obtain a fingerprint rule template designed based on the target fingerprint rule and generate a self-defined fingerprint feature string and file according to the fingerprint rule template.

[0074] In some specific embodiments, the self-defined template generation module 12 can specifically include:

[0075] a string generation unit configured to generate a corresponding custom fingerprint feature string based on the target fingerprint rule used in the fingerprint rule template;

[0076] a file generation unit configured to generate a corresponding file based on the target fingerprint feature in the fingerprint rule template; the file including a folder of a preset specific path and file content including the target fingerprint feature.

[0077] In some specific embodiments, the honeypot service definition apparatus can further include:

[0078] a historical information clearing module configured to clear historical custom fingerprint feature strings and historical files stored in the target honeypot site to obtain a cleared target honeypot site.

[0079] In some specific embodiments, the honeypot site feature management module 13 can be specifically configured to distribute the custom fingerprint feature strings and files to target pages and target paths corresponding to the cleared target honeypot site based on a preset distribution mode, and restart the target honeypot site to obtain a target honeypot service.

[0080] In some specific embodiments, the honeypot service definition apparatus can further include:

[0081] a honeypot modification and adjustment module configured to obtain a supervision instruction issued for the target honeypot service and make corresponding modification and adjustment to information in the target honeypot service according to the supervision instruction.

[0082] an attack information collection module configured to obtain attacker information collected by the target honeypot service, so as to take corresponding defense measures according to the attacker information.

[0083] Further, the embodiment of the present application further discloses an electronic device, Figure 6 is a structural diagram of an electronic device 20 according to an exemplary embodiment, and the content in the figure cannot be considered as any limitation on the use range of the present application.

[0084] Figure 6 A structural schematic diagram of an electronic device 20 provided by the embodiment of the present application. The electronic device 20 can specifically include at least one processor 21, at least one memory 22, a power supply 23, a communication interface 24, an input / output interface 25 and a communication bus 26. The memory 22 is used to store a computer program, the computer program is loaded and executed by the processor 21, so as to realize the related steps in the honeypot service definition method disclosed in any of the preceding embodiments. In addition, the electronic device 20 in the embodiment can be an electronic computer.

[0085] In this embodiment, the power supply 23 is configured to provide operating voltage for each hardware device on the electronic device 20; the communication interface 24 is configured to create a data transmission channel between the electronic device 20 and external devices, and the communication protocol followed by the communication interface 24 can be any communication protocol applicable to the technical solution of the present application, which will not be specifically limited herein; the input / output interface 25 is configured to obtain external input data or output data to the outside, and the specific interface type can be selected according to the specific application needs, which will not be specifically limited herein.

[0086] In addition, the memory 22 as a carrier for storing resources can be a read-only memory, a random access memory, a magnetic disk or an optical disk, etc., and the resources stored thereon can include an operating system 221, a computer program 222, etc., and the storage mode can be temporary storage or permanent storage.

[0087] The operating system 221 is configured to manage and control each hardware device on the electronic device 20 and the computer program 222, and can be Windows Server, Netware, Unix, Linux, etc. In addition to the computer program capable of completing the honeypot service definition method executed by the electronic device 20 disclosed in any of the preceding embodiments, the computer program 222 can further include a computer program capable of completing other specific work.

[0088] Further, the present application also discloses a computer readable storage medium for storing a computer program; wherein the computer program is executed by a processor to implement the honeypot service definition method disclosed above. For the specific steps of the method, please refer to the corresponding content disclosed in the preceding embodiments, which will not be described here.

[0089] The embodiments in the specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts of each embodiment can be referred to each other. For the device disclosed in the embodiments, since it corresponds to the method disclosed in the embodiments, the description is relatively simple, and the relevant parts can be referred to the method part.

[0090] The skilled person can further realize that the units and algorithm steps of the examples described in combination with the embodiments disclosed herein can be realized by electronic hardware, computer software or a combination of the two. In order to clearly show the interchangeability of hardware and software, the components and steps of each example have been described in a general manner in the above description. Whether the functions are realized in hardware or software depends on the specific application and design constraints of the technical solution. The skilled person can use different methods to realize the described functions for each specific application, but such implementation should not be considered beyond the scope of the present application.

[0091] The steps of a method or algorithm described in connection with the embodiments disclosed herein can be embodied directly in hardware, in a software module executed by a processor, or in a combination of the two. A software module can reside in RAM, flash memory, ROM, electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), registers, hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art. The

[0092] Finally, it should be noted that, in the description of the application, relational terms such as first and second, and the like can be used solely to distinguish one entity or action from another entity or action without necessarily requiring or implying any actual such relationship or order between such entities or actions. Moreover, the terms "comprises", "comprising", or any other variations thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but can include other elements not expressly listed or inherent to such process, method, article, or apparatus. Without further limitation, an element preceded by "comprises a" does not, without more constraints, foreclose the existence of additional identical elements in the process, method, article, or apparatus that comprises the recited element.

[0093] The above provides a detailed description of the technical solutions of the present application. The principles and implementation modes of the present application are described by applying specific examples. The above description of the embodiments is only used to help understand the method of the present application and its core idea; at the same time, for those skilled in the art, according to the idea of the present application, the specific implementation mode and application range will be changed; in summary, the content of the specification should not be understood as a limitation of the present application.

Claims

1. A method for defining a honeypot service, characterized by, The application is applied to a honeypot manufacturing system, comprising: Obtain public fingerprint rules and organize the fingerprint rules to obtain a plurality of fingerprint rules; Wherein, the obtaining of the public fingerprint rules and the organization of the fingerprint rules to obtain the target fingerprint rule comprises: through a preset crawler program, and based on a real-time update instruction, the latest public fingerprint rules are crawled from the fingerprint rule repository of Github and updated to the preset fingerprint library; based on the preset fingerprint organization rule, the fingerprint rules in the preset fingerprint library are de-duplicated, classified and organized to obtain a plurality of fingerprint rules; Obtain the fingerprint rule template designed based on the plurality of fingerprint rules and generate the custom fingerprint feature string and file according to the fingerprint rule template; The obtaining of the fingerprint rule template designed based on the plurality of fingerprint rules and the generation of the custom fingerprint feature string and file according to the fingerprint rule template comprises: selecting target fingerprint rules from the plurality of fingerprint rules based on a target business scenario; obtaining the fingerprint rule template designed based on the target fingerprint rules and generating the custom fingerprint feature string and file according to the fingerprint rule template; The generation of the custom fingerprint feature string and file according to the fingerprint rule template comprises: generating the corresponding custom fingerprint feature string based on the target fingerprint rules used in the fingerprint rule template; generating the corresponding file based on the target fingerprint features in the fingerprint rule template; the file contains a folder with a preset specific path and file content containing the target fingerprint features; Based on a preset feature delivery method, the custom fingerprint feature string and file are delivered to the target honeypot site and the target honeypot site is restarted to obtain a target honeypot service.

2. The honeypot service definition method of claim 1, wherein, Before the delivery of the custom fingerprint feature string and file to the target honeypot site based on the preset feature delivery method and the restarting of the target honeypot site, it further comprises: Clear the historical custom fingerprint feature string and historical file stored in the target honeypot site to obtain a cleared target honeypot site.

3. The honeypot service definition method of claim 2, wherein, The delivery of the custom fingerprint feature string and file to the target honeypot site based on the preset feature delivery method and the restarting of the target honeypot site to obtain a target honeypot service comprises: Based on a preset feature delivery method, the custom fingerprint feature string and file are delivered to the target page and target path corresponding to the cleared target honeypot site, and the target honeypot site is restarted to obtain a target honeypot service.

4. The honeypot service definition method of any one of claims 1 to 3, wherein, After the delivery of the custom fingerprint feature string and file to the target honeypot site based on the preset feature delivery method and the restarting of the target honeypot site to obtain a target honeypot service, it further comprises: Obtain the supervision instruction issued for the target honeypot service and make corresponding modifications and adjustments to the information in the target honeypot service according to the supervision instruction; Obtain the attacker information collected by the target honeypot service, so as to take corresponding defense measures according to the attacker information.

5. A honeypot service definition apparatus characterized by comprising: The application is applied to a honeypot manufacturing system, comprising: A fingerprint rule management module is configured to obtain public fingerprint rules and organize the fingerprint rules to obtain a plurality of fingerprint rules; The obtaining and collating of the disclosed fingerprint rules to obtain target fingerprint rules comprises: obtaining the latest disclosed fingerprint rules from a fingerprint rule repository of Github based on a preset crawler program and real-time update instructions and updating the latest disclosed fingerprint rules to a preset fingerprint library; and based on a preset fingerprint collation rule, the fingerprint rules in the preset fingerprint library are de-duplicated, classified and collated to obtain a plurality of fingerprint rules. The self-defined template generation module is configured to obtain a fingerprint rule template designed based on the plurality of fingerprint rules and generate a self-defined fingerprint feature string and file according to the fingerprint rule template. The obtaining of the fingerprint rule template designed based on the plurality of fingerprint rules and the generation of the self-defined fingerprint feature string and file according to the fingerprint rule template comprises: selecting target fingerprint rules from the plurality of fingerprint rules based on a target business scenario; and obtaining a fingerprint rule template designed based on the target fingerprint rules and generating a self-defined fingerprint feature string and file according to the fingerprint rule template. The generation of the self-defined fingerprint feature string and file according to the fingerprint rule template comprises: generating a corresponding self-defined fingerprint feature string based on the target fingerprint rules used in the fingerprint rule template; and generating a corresponding file based on the target fingerprint features in the fingerprint rule template; the file includes a folder of a preset specific path and file content including the target fingerprint features. The honeypot site feature management module is configured to distribute the self-defined fingerprint feature string and file to a target honeypot site based on a preset feature distribution mode and restart the target honeypot site to obtain a target honeypot service.

6. An electronic device, comprising: The honeypot service definition method comprises: a memory configured to save a computer program; a processor configured to execute the computer program to implement the honeypot service definition method according to any one of claims 1 to 4.

7. A computer readable storage medium characterized by The computer program is saved in the memory and is executed by the processor to implement the honeypot service definition method according to any one of claims 1 to 4.

Images