A network defense method, device, electronic device, and storage medium

Abstract

The embodiment of the application is suitable for the technical field of computers, and provides a network defense method and device, electronic equipment and a storage medium, wherein the network defense method is applied to a honeypot system, and the method comprises the following steps: in the case that the honeypot system and a client establish a transport layer connection, determining whether to send a first packet message to the client; if the first packet message is sent to the client, obtaining an access request of the client after the first packet message is sent to the client; and closing the transport layer connection between the honeypot system and the client.

Description

Technical Field

[0001] This invention relates to the field of computer technology, and in particular to a network defense method, apparatus, electronic device, and storage medium. Background Technology

[0002] Based on their interaction capabilities, honeypots are categorized into low-interaction, medium-interaction, and high-interaction honeypots. The higher the interaction capability of a honeypot, the more attacker information it can collect, providing richer tracing data. However, the risk of being compromised and controlled by attackers is also higher, posing a greater threat to the system's security. Regardless of whether a honeypot is high-interaction or low-interaction, it still requires application-layer interaction with attackers, resulting in poor security. Summary of the Invention

[0003] To address the aforementioned problems, embodiments of the present invention provide a network defense method, apparatus, electronic device, and storage medium, to at least resolve the issue of poor honeypot security in related technologies.

[0004] The technical solution of this invention is implemented as follows:

[0005] In a first aspect, embodiments of the present invention provide a network defense method applied to a honeypot system, the method comprising:

[0006] When the honeypot system establishes a transport layer connection with the client, it determines whether to send the first packet to the client.

[0007] If the first packet is sent to the client, then after sending the first packet to the client, the client's access request is obtained;

[0008] The honeypot system and the client's transport layer connection are closed.

[0009] In the above scheme, the honeypot system includes multiple different honeypot services; determining whether to send the first packet to the client includes:

[0010] Obtain the resource information that the client wants to access, and determine the honeypot service that matches the resource information;

[0011] The decision to send the first packet to the client is determined by using the different application layer protocols of the servers corresponding to different honeypot services.

[0012] Accordingly, obtaining the client's access request after sending the first packet to the client includes:

[0013] After the honeypot service sends the first packet to the client, the honeypot service obtains the client's access request.

[0014] In the above scheme, the honeypot service sends the first packet to the client, including:

[0015] The honeypot service generates the first packet corresponding to the application layer protocol;

[0016] The honeypot service sends the first packet to the client.

[0017] In the above scheme, after determining whether to send the first packet to the client, the method further includes:

[0018] If the first packet is not sent to the client, then the client's access request is obtained.

[0019] In the above scheme, the honeypot system also includes a proxy component, which establishes a transport layer connection with the client. The proxy component is deployed in the gateway device corresponding to the server.

[0020] In the above scheme, obtaining the resource information that the client wants to access and determining the honeypot service that matches the resource information includes:

[0021] Obtain the resource information that the client wants to access, determine the honeypot service that matches the resource information, and set a connection timeout for the client based on the connection timeout time corresponding to the matched honeypot service; wherein, the connection timeout time corresponding to different honeypot services is different.

[0022] In the above scheme, after obtaining the client's access request, the method further includes:

[0023] Attack tracing is performed based on the access request.

[0024] In the above scheme, the attack tracing based on the access request includes:

[0025] Determine whether the honeypot service has received the access request from the client;

[0026] If the honeypot service receives an access request from the client, it determines whether the access request matches the traffic model corresponding to the honeypot service.

[0027] Output the corresponding security event based on the matching results.

[0028] Secondly, embodiments of the present invention provide a network defense device, the device comprising:

[0029] The determination module is used to determine whether to send the first packet to the client when the honeypot system establishes a transport layer connection with the client.

[0030] The acquisition module is used to acquire the client's access request after sending the first packet to the client if the first packet is sent to the client.

[0031] The shutdown module is used to close the transport layer connection between the honeypot system and the client.

[0032] Thirdly, embodiments of the present invention provide an electronic device including a processor and a memory interconnected thereto. The memory is used to store a computer program, the computer program including program instructions, and the processor is configured to invoke the program instructions to execute the steps of the network defense method provided in the first aspect of the present invention.

[0033] Fourthly, embodiments of the present invention provide a computer-readable storage medium, comprising: the computer-readable storage medium storing a computer program. When the computer program is executed by a processor, it implements the steps of the network defense method provided in the first aspect of the present invention.

[0034] In this embodiment of the invention, after establishing a transport layer connection between the honeypot system and the client, it determines whether to send an initial packet to the client. If so, after sending the initial packet, it obtains the client's access request and closes the transport layer connection between the honeypot system and the client. The honeypot system in this embodiment can simulate a real business system sending an initial packet to the client, making it more realistic and better able to lure attackers. Furthermore, by closing the transport layer connection after receiving the client's access request, the honeypot system does not respond to the attacker's interactive commands, reducing the risk of intrusion and control by attackers and ensuring the security of the honeypot system. Attached Figure Description

[0035] Figure 1 This is a schematic diagram illustrating the implementation process of a network defense method provided in an embodiment of the present invention;

[0036] Figure 2 This is a schematic diagram of a zero-trust access control architecture provided by an embodiment of the present invention;

[0037] Figure 3 This is a schematic diagram of an attack traffic flow provided by an embodiment of the present invention;

[0038] Figure 4 This is a schematic diagram of the traffic processing flow of a non-interactive honeypot service in a zero-trust gateway device provided by an embodiment of the present invention;

[0039] Figure 5 This is a timing diagram of an SSH non-interactive honeypot provided in an embodiment of the present invention;

[0040] Figure 6 This is a timing diagram of an LDAP non-interactive honeypot provided in an embodiment of the present invention;

[0041] Figure 7 This is a schematic diagram of a network defense device provided in an embodiment of the present invention;

[0042] Figure 8 This is a schematic diagram of an electronic device provided in an embodiment of the present invention. Detailed Implementation

[0043] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0044] A honeypot is a virtual service that lures attackers to access fake applications or systems by creating and opening them. After intrusion, attackers can monitor and analyze the data to collect information about the tools and methods used, thereby strengthening their own defenses.

[0045] Based on their level of interaction, honeypots are categorized into low-interaction, medium-interaction, and high-interaction honeypots. Low-interaction honeypots provide limited interactive information and services, medium-interaction honeypots can simulate various system behaviors, and high-interaction honeypots provide a realistic system representation. The higher the degree of interaction, the more attacker information can be collected, providing richer tracing data. However, the risk of intrusion and control by attackers is also higher, posing a greater threat to the system's own security.

[0046] Whether high-interaction or low-interaction, honeypots simulate network services or systems, inevitably using application-layer communication protocols. In the seven-layer network communication model, application-layer vulnerabilities account for over 99% at layer seven, while vulnerabilities below layer six account for less than 1%. Application-layer vulnerabilities like openssl Heartbleed or Secure Shell (SSH) buffer overflows are always uncontrollable, introducing additional security risks to honeypot usage.

[0047] Therefore, application-layer interaction between a honeypot and an attacker leads to poor honeypot security. Conversely, if a honeypot has no interaction with an attacker at all—that is, if it doesn't send any messages to the attacker—while security is guaranteed, its realism to the actual business system is low, making it potentially recognizable as a honeypot by attackers.

[0048] To address the shortcomings of the aforementioned related technologies, this invention provides a network defense method that can increase the realism of the honeypot and better lure attackers without affecting its security. Specific embodiments are described below to illustrate the technical solution of this invention.

[0049] Figure 1 This is a schematic diagram illustrating the implementation process of a network defense method provided in an embodiment of the present invention. The executing entity of the network defense method can be a honeypot system. (Refer to...) Figure 1 Network defense methods include:

[0050] S101, if the honeypot system establishes a transport layer connection with the client, determine whether to send the first packet to the client.

[0051] Here, the honeypot system can be deployed on a server or on a proxy device (such as a gateway device).

[0052] Honeypot systems publish fake business addresses that are invisible to legitimate users and only visible to attackers. For example, the legitimate business addresses of the x.com website include http: / / x.com / a and http: / / x.com / b, while the fake business addresses include URLs such as http: / / x.com / admin, http: / / x.com / c, and http: / / x.com / admin / admin.php—paths that legitimate users would not access.

[0053] When an attacker accesses a honeypot system through a client, the first step is to request and establish a transport layer connection with the honeypot system, which involves a three-way handshake using the Transmission Control Protocol (TCP). Once the transport layer connection is established, the attacker can then send access requests to the honeypot system through the client.

[0054] It should be understood that after the transport layer connection is established, the interaction between the honeypot system and the client takes place at the application layer.

[0055] In some real-world business servers, due to the characteristics of the application layer protocols used by the business server, after establishing a transport layer connection with the client, the server needs to send an initial packet to the client to inform the client that the connection has been established.

[0056] Here, the first packet does not contain specific information about the honeypot system; it only sends the version information of the application layer protocol to the client to inform the client that the connection has been established and that access requests can be sent based on the application layer protocol.

[0057] To more realistically simulate a real business system, the honeypot system in this embodiment determines whether to send an initial packet to the client after establishing a transport layer connection. Sending the initial packet can mislead attackers into believing that the honeypot system is a real system, enticing them to send further access requests.

[0058] Here, if the server that the attacker wants to access needs to send the first packet, the honeypot system will also send the first packet.

[0059] In one embodiment, the honeypot system includes multiple different honeypot services; determining whether to send the first packet to the client includes:

[0060] Obtain the resource information that the client wants to access, and determine the honeypot service that matches the resource information;

[0061] The decision to send the first packet to the client is determined by using the different application layer protocols of the servers corresponding to different honeypot services.

[0062] Accordingly, obtaining the client's access request after sending the first packet to the client includes:

[0063] After the honeypot service sends the first packet to the client, the honeypot service obtains the client's access request.

[0064] Here, the honeypot system includes multiple different honeypot services, each simulating a real business system.

[0065] The honeypot system obtains information about the resources that the client wants to access. For example, the information about the resources that the client wants to access includes: server identifier (appID), etc.

[0066] Different honeypot services correspond to different servers. Matching a honeypot service with resource information actually means matching the resource information with the server corresponding to the honeypot service. For example, matching the server identifier in the resource information with the server identifier corresponding to the honeypot service. If the two identifiers are the same, then it is determined that the resource information matches the honeypot service.

[0067] The decision to send an initial packet to the client is determined by the different application layer protocols used by the servers corresponding to different honeypot services. For example, if the server corresponding to the honeypot service matching the resource information uses the Secure Shell (SSH) application layer protocol, then an initial packet needs to be sent. SSH is a security protocol built on the application layer, specifically designed for remote login sessions and other network services.

[0068] If the server corresponding to the honeypot service matching the resource information uses the Lightweight Directory Access Protocol (LDAP) as its application layer protocol, then no initial packet needs to be sent. LDAP is a protocol used to access directory servers; it is an application layer protocol based on TCP / IP.

[0069] The honeypot system in this embodiment can be applied to various application layer protocols, including but not limited to: File Transfer Protocol (FTP), Simple Mail Transfer Protocol (SMTP), Hypertext Transfer Protocol (HTTP), LDAP, SSH, Telnet, Simple Network Management Protocol (SNMP), etc.

[0070] S102, if the first packet is sent to the client, then after sending the first packet to the client, the client's access request is obtained.

[0071] After the honeypot system sends the first packet to the client, the attacker mistakenly believes that the honeypot system is a real system, and therefore sends further access requests to the honeypot system through the client.

[0072] In one embodiment, the honeypot service sends the first packet to the client, including:

[0073] The honeypot service generates the first packet corresponding to the application layer protocol;

[0074] The honeypot service sends the first packet to the client.

[0075] Here, the first packet generated by the honeypot service matches the application layer protocol used by the server corresponding to the honeypot service. For example, if the application layer protocol used by the server corresponding to the honeypot service is SSH, then the honeypot needs to generate an SSH first packet, which includes SSH service version information.

[0076] The initial packet messages corresponding to different application layer protocols are different. The honeypot service generates the initial packet message corresponding to the server's application layer protocol in a targeted manner, which can further increase the realism of the honeypot service and better lure attackers, making them believe that the honeypot service is a real system.

[0077] S103, Close the transport layer connection between the honeypot system and the client.

[0078] Upon receiving an access request, the honeypot system closes the transport layer connection between itself and the client. The honeypot system does not interact with attackers or respond to their commands, thus reducing the risk of intrusion and control and ensuring its security.

[0079] In this embodiment of the invention, after establishing a transport layer connection between the honeypot system and the client, it determines whether to send an initial packet to the client. If so, after sending the initial packet, it obtains the client's access request and closes the transport layer connection between the honeypot system and the client. The honeypot system in this embodiment can simulate a real business system sending an initial packet to the client, making it more realistic and better able to lure attackers. Furthermore, by closing the transport layer connection after receiving the client's access request, the honeypot system does not respond to the attacker's interactive commands, reducing the risk of intrusion and control by attackers and ensuring the security of the honeypot system.

[0080] In one embodiment, after determining whether to send the first packet to the client, the method further includes:

[0081] If the first packet is not sent to the client, then the client's access request is obtained.

[0082] In one embodiment, the honeypot system further includes a proxy component, through which a transport layer connection is established with the client, and the proxy component is deployed in the gateway device corresponding to the server.

[0083] Here, the honeypot system also includes a proxy component, which is deployed in the gateway device corresponding to the server.

[0084] The proxy component is a software module that deploys a configured path. This configured path refers to the fake address of the fake system or application corresponding to the honeypot system. The configured path is only visible to attackers and not to normal users. The proxy component is responsible for forwarding client requests targeting the configured path to the honeypot system and forwarding the first packet to the client. It also forwards requests targeting the normal path to the real server and forwards the real server's response packets to the client.

[0085] This embodiment does not require honeypot deployment on the user's real business network. By deploying fake business addresses, malicious traffic is redirected to the honeypot system, thus completing threat capture.

[0086] Deploying the honeypot system in the gateway device corresponding to the server eliminates the need to deploy honeypots on the user's real business network. This approach can effectively reduce the difficulty of deploying honeypot systems for complex, distributed, and large user networks.

[0087] In practical applications, manufacturers can embed the honeypot system of this embodiment into the gateway device. This allows the honeypot system to be deployed without deployment. Users do not need to establish network service application layer protocols, making it simple and resource-efficient. By natively embedding the honeypot system into the zero-trust gateway device, administrators are spared the deployment operation.

[0088] The honeypot system in this embodiment can be applied to various types of products, including but not limited to: Zero Trust Access (SDP, Software Defined Perimeter) products, Virtual Private Network (VPN) products, Zero Trust Security Architecture products, Zero Trust SASE Access products, Zero Trust Network Access (ZTNA) products, and honeypot products.

[0089] In one embodiment, obtaining the resource information that the client wishes to access and determining the honeypot service that matches the resource information includes:

[0090] Obtain the resource information that the client wants to access, determine the honeypot service that matches the resource information, and set a connection timeout for the client based on the connection timeout time corresponding to the matched honeypot service; wherein, the connection timeout time corresponding to different honeypot services is different.

[0091] The specific implementation process for determining the honeypot service that matches the resource information is detailed in the above method implementation examples, and will not be repeated here.

[0092] In this embodiment, each honeypot service is set with a different connection timeout.

[0093] In practical applications, if multiple honeypot services are set with the same connection timeout, when an attacker accesses multiple honeypot services at the same time, it is easy to find that the connection timeouts of these honeypot services are the same. Therefore, this embodiment sets different connection timeouts for different honeypot services, which can prevent attackers from identifying honeypot services through connection timeouts.

[0094] In one embodiment, after obtaining the client's access request, the method further includes:

[0095] Attack tracing is performed based on the access request.

[0096] This embodiment performs attack tracing upon receiving an access request, identifying the attacker's true identity, tools used, severity of harm, and scope of impact. The honeypot system in this embodiment has strong tracing capabilities, allowing attacker information to be traced for each access request.

[0097] In one embodiment, the attack attribution based on the access request includes:

[0098] Determine whether the honeypot service has received the access request from the client;

[0099] If the honeypot service receives an access request from the client, it determines whether the access request matches the traffic model corresponding to the honeypot service.

[0100] Output the corresponding security event based on the matching results.

[0101] Here, it is necessary to determine whether the honeypot service has received the client's access request, which means that the honeypot service has interacted with the client at the application layer. If the honeypot service has received the client's access request, it means that the two have interacted.

[0102] If the honeypot service does not receive an access request from the client, meaning there is no interaction between the honeypot service and the client, it is not considered a security event.

[0103] The system determines whether the access request matches the traffic model corresponding to the honeypot service. Each honeypot service has its own traffic model, or different application layer protocols correspond to different traffic models. If the access request matches the traffic model of the honeypot service, it means that the access request is indeed directed to the server corresponding to the honeypot service, and a honeypot access security event can be output.

[0104] Here, if the access request does not match the traffic model corresponding to the honeypot service, it is determined whether the access request matches the general traffic model. This situation indicates that the access request is unknown traffic, such as the SSH honeypot receiving HTTP traffic, which does not match the SSH honeypot's traffic model.

[0105] If the access request matches the general traffic model, an unexpected honeypot access security event is output.

[0106] If the access request does not match the general traffic model, an unknown traffic honeypot access security event is output.

[0107] The honeypot service in this embodiment is hidden from normal users, so any security incidents that occur are of high confidence and can be handled automatically without human supervision.

[0108] In combination with the above embodiments, this embodiment can achieve a self-closed loop of attack and defense (threat detection, handling, and tracing) without relying on third-party security services.

[0109] Figure 2This is a schematic diagram of a zero-trust access control architecture provided by an embodiment of the present invention. The architecture mainly includes a device terminal, a zero-trust control center, a zero-trust proxy gateway, and enterprise resources.

[0110] The zero-trust proxy gateway integrates a non-interactive honeypot service and a proxy service. The non-interactive honeypot service includes a non-interactive honeypot resource pool, an identity resolution module, and an analysis engine. The non-interactive honeypot resource pool contains multiple non-interactive honeypots, the identity resolution module is used to obtain the attacker's identity and resource information, and the analysis engine is used to analyze, trace, and audit attack behavior.

[0111] The proxy service includes a honeypot service proxy module and a deception probe module. The honeypot service proxy module is used to forward access traffic targeting the deception probe to the non-interactive honeypot service, where the non-interactive honeypot handles the traffic.

[0112] The Zero Trust Control Center includes a deception probe management module, which manages the deception probes deployed on the Zero Trust Gateway device. These deception probes are fake resource addresses used to lure attackers. Before attackers conduct network environment probing on their terminal devices, they cannot distinguish between the deception probes deployed on the Zero Trust Gateway device and real service addresses.

[0113] The specific flow of attack traffic is as follows: Figure 3 As shown, if the access traffic is directed to a real business system address, the proxy service will forward the access traffic to the enterprise resources.

[0114] If the access traffic is aimed at a deceptive probe, the proxy service will redirect the access traffic to the honeypot service proxy module. The honeypot service proxy module will then transmit the access traffic to the non-interactive honeypot service for identity resolution. Based on the resolution result, the non-interactive honeypot in the honeypot resource pool will be scheduled to complete the interaction. The non-interactive honeypot will output the result to the analysis engine, which will then perform analysis, source tracing, and auditing.

[0115] It should be noted that the lack of interaction in this embodiment does not mean that there is no data packet interaction at all. In addition to establishing a transport layer connection, at the application layer, the honeypot will send the first packet to the client according to the application layer protocol.

[0116] Among them, the non-interactive honeypot service in the zero-trust gateway device handles traffic processing as follows: Figure 4 As shown, it includes:

[0117] S401, AcceptConnect.

[0118] Receive TCP connection requests from clients.

[0119] S402, GohandleConn.

[0120] Use the GohandleConn goroutine to handle this connection request.

[0121] S403, read the pp packet and parse the identity.

[0122] pp stands for proxy-protocol, indicating a custom protocol. The proxy service sends pp packets to the non-interactive honeypot service using this custom protocol. Here, the pp packet refers to a connection request used to establish a TCP connection.

[0123] By parsing PP packets, user and resource information about the traffic can be obtained.

[0124] S404, SetConntimeout.

[0125] Set connection timeout period dynamically based on APPID to reduce honeypot characteristics.

[0126] S405, match non-interactive honeypots based on appID.

[0127] If a match is successful, execute S406; otherwise, execute S411.

[0128] S406, Do we need to send the first packet?

[0129] If yes, execute S407; otherwise, execute S408.

[0130] S407, send the first packet of the application layer protocol.

[0131] S408, read traffic.

[0132] S409, Connection Closed.

[0133] Close the TCP connection.

[0134] S410, Behavior Record.

[0135] Record attack behavior.

[0136] S411, matches empty honeypots.

[0137] No honeypot was found.

[0138] S412, read traffic.

[0139] S413, connection closed.

[0140] S414, whether to generate application layer interaction.

[0141] That is, whether data packets sent by the terminal are received after the transport layer connection is established.

[0142] If yes, execute S415; otherwise, execute S417.

[0143] S415, whether to match the honeypot's traffic model.

[0144] If yes, execute S416; otherwise, execute S418.

[0145] S416 outputs a honeypot access security event.

[0146] S417 records system logs.

[0147] If there is no application layer interaction, it is not considered a security event.

[0148] S418, Unknown Traffic Detection.

[0149] For example, an SSH honeypot might receive HTTP traffic.

[0150] S419, whether it matches the general traffic model.

[0151] If yes, execute S420; otherwise, execute S421.

[0152] S420 outputs an unexpected honeypot access security event.

[0153] S421 outputs an unknown traffic honeypot access security event.

[0154] S406 determines whether an initial packet needs to be sent. Some application layer protocols require an initial packet to be sent, such as... Figure 5 As shown, Figure 5 This is a timing diagram of an SSH non-interactive honeypot.

[0155] First, the client establishes a TCP connection with the proxy service. The proxy service transmits identity information to the identity resolution module, which then schedules the SSH non-interactive honeypot to establish a TCP connection with the proxy service. The SSH non-interactive honeypot forges the SSH protocol server header and forwards it to the client through the proxy service. This SSH protocol server header includes SSH service version information. The client sends its SSH client version information to the proxy service, initiating SSH session negotiation. The proxy service forwards the SSH client version information to the SSH non-interactive honeypot. The SSH non-interactive honeypot closes its TCP connection with the proxy service, and the proxy service closes its TCP connection with the client. Finally, the SSH non-interactive honeypot outputs SSH application access records to the analysis engine.

[0156] Some application layer protocol servers do not need to send an initial packet; instead, they attract attackers by publishing through default ports, such as... Figure 6 As shown, Figure 6 This is a timing diagram of an LDAP non-interactive honeypot.

[0157] First, the client establishes a TCP connection with the proxy service. The proxy service transmits identity information to the identity resolution module, which then schedules the LDAP non-interactive honeypot to establish a TCP connection with the proxy service. The proxy service forwards the Bing request command sent by the client to the LDAP non-interactive honeypot. The LDAP non-interactive honeypot closes its TCP connection with the proxy service, and the proxy service closes its TCP connection with the client. Finally, the LDAP non-interactive honeypot outputs LDAP application access records to the analysis engine.

[0158] In this embodiment, the honeypot system can simulate a real server to forge the first packet of the application layer protocol, increasing the realism of the honeypot system and making attackers believe that the honeypot system is a real system, thus better luring attackers.

[0159] The zero-trust access architecture in this embodiment has the following advantages:

[0160] 1. Each access connection can be traced back to its identity, tools, and other detailed information, providing strong traceability capabilities.

[0161] 2. The zero-trust access control architecture has the capabilities of user identity, security detection, and account terminal handling. Therefore, the non-interactive honeypot technology can achieve a closed loop of threat detection, handling, and tracing without relying on third-party security services.

[0162] 3. Non-interactive honeypots do not require the establishment of network service application layer protocols, making them simple to implement and with low resource consumption. By natively integrating the non-interactive honeypot service into the zero-trust gateway device, administrators are spared the task of deploying honeypots. Non-interactive honeypot technology eliminates the need to deploy honeypots on the user's real business network. It uses deceptive probes deployed on the zero-trust gateway device to redirect malicious traffic to the built-in non-interactive honeypot, thus completing threat capture.

[0163] 3. Non-interactive honeypots are security honeypots built on a zero-trust access control architecture. Non-interactive honeypots do not respond to attackers' commands, maximizing the controllability and security of the honeypot.

[0164] 4. Non-interactive honeypots are hidden from normal users, therefore any threat intelligence generated is of high confidence and can be automatically processed without human supervision. Based on the attacker's perspective, non-interactive honeypots can gain the initiative and advantage in the attack-defense game. By actively exposing false information, they disrupt the attacker's information gathering activities, thereby making decisions that benefit the defender.

[0165] It should be understood that the sequence number of each step in the above embodiments does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present invention.

[0166] It should be understood that, when used in this specification and the appended claims, the terms "comprising" and "including" indicate the presence of the described features, integrals, steps, operations, elements and / or components, but do not exclude the presence or addition of one or more other features, integrals, steps, operations, elements, components and / or collections thereof.

[0167] It should be noted that the technical solutions described in the embodiments of the present invention can be combined arbitrarily without conflict.

[0168] In addition, in the embodiments of the present invention, "first," "second," etc. are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence.

[0169] refer to Figure 7 , Figure 7 This is a schematic diagram of a network defense device provided in an embodiment of the present invention. The device includes a determination module, an acquisition module, and a shutdown module.

[0170] The determination module is used to determine whether to send the first packet to the client when the honeypot establishes a transport layer connection with the client.

[0171] The acquisition module is used to acquire the client's access request after sending the first packet to the client if the first packet is sent to the client.

[0172] The shutdown module is used to close the transport layer connection between the honeypot and the client.

[0173] In one embodiment, the honeypot system includes multiple different honeypot services; the determining module determines whether to send the first packet to the client, including:

[0174] Obtain the resource information that the client wants to access, and determine the honeypot service that matches the resource information;

[0175] The decision to send the first packet to the client is determined by using the different application layer protocols of the servers corresponding to different honeypot services.

[0176] Accordingly, after sending the first packet to the client, the acquisition module acquires the client's access request, including:

[0177] After the honeypot service sends the first packet to the client, the honeypot service obtains the client's access request.

[0178] In one embodiment, the apparatus further includes a sending module that sends the first packet corresponding to the application layer protocol generated by the honeypot service to the client.

[0179] In one embodiment, the acquisition module is further configured to:

[0180] If the first packet is not sent to the client, then the client's access request is obtained.

[0181] In one embodiment, the honeypot system further includes a proxy component, through which a transport layer connection is established with the client, and the proxy component is deployed in the gateway device corresponding to the server.

[0182] In one embodiment, the determining module obtains the resource information that the client wants to access, and determines the honeypot service that matches the resource information, specifically for:

[0183] Obtain the resource information that the client wants to access, determine the honeypot service that matches the resource information, and set a connection timeout for the client based on the connection timeout time corresponding to the matched honeypot service; wherein, the connection timeout time corresponding to different honeypot services is different.

[0184] In one embodiment, the device further includes:

[0185] The tracing module is used to trace the source of attacks based on the access request.

[0186] In one embodiment, the tracing module is specifically used to include:

[0187] Determine whether the honeypot service has received the access request from the client;

[0188] If the honeypot service receives an access request from the client, it determines whether the access request matches the traffic model corresponding to the honeypot service.

[0189] Output the corresponding security event based on the matching results.

[0190] In practical applications, the determining module, the acquiring module, and the closing module can be implemented by processors in electronic devices, such as central processing units (CPUs), digital signal processors (DSPs), microcontroller units (MCUs), or field-programmable gate arrays (FPGAs).

[0191] It should be noted that the above embodiments of the device are only illustrated by the division of the modules described above when acquiring information. In actual applications, the above processing can be assigned to different modules as needed, that is, the internal structure of the device can be divided into different modules to complete all or part of the processing described above. In addition, the network defense device and network defense method embodiments provided in the above embodiments belong to the same concept, and their specific implementation process can be found in the method embodiments, which will not be repeated here.

[0192] The aforementioned network defense device can be in the form of an image file. After execution, the image file can run as a container or virtual machine to implement the network defense method described in this application. However, it is not limited to the image file format; any software form capable of implementing the network defense method described in this application is within the scope of protection of this application. For example, it can also be a software module implemented in a hypervisor (virtual machine monitor) in a cloud computing platform.

[0193] Based on the hardware implementation of the above-described program modules, and in order to implement the method of this application embodiment, this application embodiment also provides an electronic device in which a honeypot system is deployed, and the above-described method is implemented by the processor of the electronic device. The electronic device can be a server, a gateway device, etc. Figure 8 This is a schematic diagram of the hardware structure of the electronic device according to an embodiment of this application, as shown below. Figure 8 As shown, the electronic device includes:

[0194] A communication interface enables information exchange with other devices, such as network devices.

[0195] The processor, connected to the communication interface, enables information interaction with other devices and, when running a computer program, executes the methods provided by one or more technical solutions on the electronic device side. The computer program is stored in memory.

[0196] Of course, in practical applications, the various components in an electronic device are coupled together through a bus system. It can be understood that the bus system is used to achieve communication and connection between these components. In addition to the data bus, the bus system also includes a power bus, a control bus, and a status signal bus. However, for the sake of clarity, in... Figure 8 The general will label all buses as bus systems.

[0197] Furthermore, the electronic devices in this application can be in the form of a cluster, such as a cloud computing platform composed of clusters. A cloud computing platform is a business model that uses virtualization technology to pool the resources of multiple terminals and then provides the necessary virtual resources and services.

[0198] The memory in this application embodiment is used to store various types of data to support the operation of the electronic device. Examples of such data include any computer program used to operate on the electronic device.

[0199] It is understood that memory can be volatile or non-volatile, or both. Non-volatile memory can be read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), ferromagnetic random access memory (FRAM), flash memory, magnetic surface memory, optical disc, or compact disc read-only memory (CD-ROM); magnetic surface memory can be disk storage or magnetic tape storage. Volatile memory can be random access memory (RAM), which is used as an external cache. By way of example, but not limitation, many forms of RAM are available, such as Static Random Access Memory (SRAM), Synchronous Static Random Access Memory (SSRAM), Dynamic Random Access Memory (DRAM), Synchronous Dynamic Random Access Memory (SDRAM), Double Data Rate Synchronous Dynamic Random Access Memory (DDRSDRAM), Enhanced Synchronous Dynamic Random Access Memory (ESDRAM), SyncLink Dynamic Random Access Memory (SLDRAM), and Direct Rambus Random Access Memory (DRRAM). The memories described in the embodiments of this application are intended to include, but are not limited to, these and any other suitable types of memory.

[0200] This invention also provides a cloud computing platform, including a data processing software module for implementing a network defense method. The data processing software module is used to implement the steps of the network defense method provided in this invention.

[0201] Cloud computing platforms are a business model that uses compute virtualization, network virtualization, and storage virtualization technologies to organize multiple independent server physical hardware resources into a pool of resources. It is a software-defined resource structure based on virtualization technology, capable of providing resource capabilities in the form of virtual machines and containers. By eliminating the fixed relationship between hardware and operating systems, relying on network connectivity for unified resource scheduling, and then providing the necessary virtual resources and services, it represents a new IT software delivery model characterized by flexibility, elasticity, distributed nature, multi-tenancy, and on-demand capabilities.

[0202] Current cloud computing platforms support several service models:

[0203] SaaS (Software as a Service): Cloud computing platform users do not need to purchase software, but instead rent software deployed on the cloud computing platform. Users do not need to maintain the software, as the software service provider will manage and maintain the software in its entirety.

[0204] PaaS (Platform as a Service): Cloud computing platform users (usually software developers) can build new applications or extend existing applications on the architecture provided by the cloud computing platform without having to purchase development, quality control or production servers.

[0205] IaaS (Infrastructure as a Service): Cloud computing platforms provide data centers, infrastructure hardware and software resources via the Internet. Cloud computing platforms under the IaaS model can provide servers, operating systems, disk storage, databases and / or information resources.

[0206] The methods disclosed in the embodiments of this application can be applied to a processor or implemented by a processor. The processor may be an integrated circuit chip with signal processing capabilities. During implementation, each step of the above method can be completed by integrated logic circuits in the processor's hardware or by instructions in software form. The processor may be a general-purpose processor, a DSP, or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The processor can implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of this application. A general-purpose processor may be a microprocessor or any conventional processor, etc. The steps of the methods disclosed in the embodiments of this application can be directly manifested as execution by a hardware decoding processor, or execution by a combination of hardware and software modules in the decoding processor. The software modules may be located in a storage medium, which is located in memory. The processor reads the program from the memory and, in conjunction with its hardware, completes the steps of the aforementioned method.

[0207] Optionally, when the processor executes the program, it implements the corresponding processes implemented by the electronic device in the various methods of the embodiments of this application. For the sake of brevity, these will not be described in detail here.

[0208] In an exemplary embodiment, this application also provides a storage medium, namely a computer storage medium, specifically a computer-readable storage medium, such as a first memory storing a computer program, which can be executed by a processor of an electronic device to complete the steps described in the aforementioned method. The computer-readable storage medium may be a memory such as FRAM, ROM, PROM, EPROM, EEPROM, Flash Memory, magnetic surface memory, optical disc, or CD-ROM.

[0209] In the several embodiments provided in this application, it should be understood that the disclosed apparatus, electronic devices, and methods can be implemented in other ways. The apparatus embodiments described above are merely illustrative. For example, the division of units is only a logical functional division, and in actual implementation, there may be other division methods, such as: multiple units or components may be combined, or integrated into another system, or some features may be ignored or not executed. In addition, the coupling, direct coupling, or communication connection between the various components shown or discussed may be through some interfaces, and the indirect coupling or communication connection between devices or units may be electrical, mechanical, or other forms.

[0210] The units described above as separate components may or may not be physically separate. The components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of the units may be selected to achieve the purpose of this embodiment according to actual needs.

[0211] In addition, each functional unit in the various embodiments of this application can be integrated into one processing unit, or each unit can be a separate unit, or two or more units can be integrated into one unit; the integrated unit can be implemented in hardware or in the form of hardware plus software functional units.

[0212] Those skilled in the art will understand that all or part of the steps of the above method embodiments can be implemented by hardware related to program instructions. The aforementioned program can be stored in a computer-readable storage medium. When the program is executed, it performs the steps of the above method embodiments. The aforementioned storage medium includes various media that can store program code, such as mobile storage devices, ROM, RAM, magnetic disks, or optical disks.

[0213] Alternatively, if the integrated units described above are implemented as software functional modules and sold or used as independent products, they can also be stored in a computer-readable storage medium. Based on this understanding, the technical solutions of the embodiments of this application, or the parts that contribute to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as mobile storage devices, ROM, RAM, magnetic disks, or optical disks.

[0214] It should be noted that the technical solutions described in the embodiments of this application can be combined arbitrarily without conflict.

[0215] In addition, in this application example, terms such as "first" and "second" are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence.

[0216] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A network defense method, the method being applied to a honeypot system, characterized by, The method comprises: In the case that the honeypot system establishes a transport layer connection with a client, determining whether to send a first packet message to the client; If the first packet message is sent to the client, after sending the first packet message to the client, obtaining an access request of the client; Closing the transport layer connection between the honeypot system and the client; The honeypot system comprises a plurality of different honeypot services; the determination of whether to send the first packet message to the client comprises: Obtaining resource information that the client intends to access, and determining a honeypot service matched with the resource information; Determining whether to send the first packet message to the client through different application layer protocols of different servers corresponding to different honeypot services; Correspondingly, the obtaining of the access request of the client after sending the first packet message to the client comprises: After the honeypot service sends the first packet message to the client, the honeypot service obtains the access request of the client.

2. The method of claim 1, wherein, The honeypot service sending the first packet message to the client comprises: The honeypot service generates a first packet message corresponding to the application layer protocol; The honeypot service sends the first packet message to the client.

3. The method of claim 1, wherein, After determining whether to send the first packet message to the client, the method further comprises: If the first packet message is not sent to the client, obtaining an access request of the client.

4. The method of claim 1, wherein, The honeypot system further comprises a proxy component, and the transport layer connection is established between the proxy component and the client; the proxy component is deployed in a gateway device corresponding to the server.

5. The method of claim 1, wherein, The obtaining of the resource information that the client intends to access, and the determination of the honeypot service matched with the resource information comprise: Obtaining the resource information that the client intends to access, determining the honeypot service matched with the resource information, and setting a connection timeout time for the client according to the connection timeout time corresponding to the matched honeypot service; wherein the connection timeout times corresponding to different honeypot services are different.

6. The method according to any one of claims 1 to 5, characterized in that, After obtaining the access request of the client, the method further comprises: Performing attack tracing based on the access request.

7. The method of claim 6, wherein, The performing of attack tracing based on the access request comprises: Determining whether the honeypot service receives the access request of the client; If the honeypot service receives the access request of the client, determining whether the access request matches a traffic model corresponding to the honeypot service; According to the matching result, outputting a corresponding security event.

8. A network defense device characterized by comprising: Comprise: A determination module, configured to determine whether to send a first packet message to the client in the case that a honeypot system establishes a transport layer connection with the client; An obtaining module, configured to obtain an access request of the client after sending the first packet message to the client if the first packet message is sent to the client; A closing module, configured to close the transport layer connection between the honeypot system and the client; The honeypot system includes a plurality of different honeypot services; the determination module is further configured to acquire resource information that the client intends to access, determine a honeypot service that matches the resource information, and determine whether to send a first packet message to the client through different application layer protocols of different servers corresponding to different honeypot services. The acquisition module is further configured to acquire an access request of the client by the honeypot service after the honeypot service sends the first packet message to the client.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, The processor executes the computer program to implement the network defense method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, The computer readable storage medium stores a computer program, and the computer program includes program instructions, which, when executed by a processor, cause the processor to execute the network defense method according to any one of claims 1 to 7.

Images