A camouflage method and device based on honeypot identification technology, electronic equipment and computer storage medium

Abstract

The application discloses a camouflage method and device, electronic equipment and computer storage medium. The method comprises the following steps: obtaining honeypot data; performing feature analysis on the honeypot data to determine honeypot feature data; wherein the honeypot feature data is used to represent feature data of an attacker terminating an attack due to identification of the honeypot; generating at least one camouflage strategy according to the honeypot feature data; determining a target camouflage strategy of a camouflaged object from the at least one camouflage strategy, and performing configuration processing on the camouflaged object according to the target camouflage strategy, so that the camouflaged object is identified as a honeypot when the attacker attacks the camouflaged object. In this way, the server can be protected from being invaded by the attacker by camouflaging the server as a honeypot, thereby improving the security protection of the server.

Description

Technical Field

[0001] This application relates to the field of honeypot identification technology, and more particularly to a camouflage method, apparatus, electronic device, and computer storage medium. Background Technology

[0002] With the rapid development of the internet, hacker intrusions are occurring frequently, causing increasing losses to the social economy. Existing defense measures, such as firewalls and intrusion detection systems, are too passive, resulting in high rates of false negatives and missed detections, failing to achieve the desired protective effect.

[0003] Honeypot technology, as a proactive network protection method, effectively compensates for the shortcomings of existing protection measures and is receiving increasing attention. Its basic idea is to simulate vulnerable target resources as traps, causing attackers to target these network traps, thus delaying and confusing them from attacking the real target, thereby protecting truly valuable resources. However, if attackers identify and bypass the honeypot, they may be able to compromise the real business servers. Summary of the Invention

[0004] This application provides a disguise method, apparatus, electronic device, and computer storage medium that can improve server security by disguising the server as a honeypot.

[0005] The technical solution of this application is implemented as follows:

[0006] In a first aspect, embodiments of this application provide a camouflage method, the method comprising:

[0007] Obtain honeypot data;

[0008] The honeypot data is subjected to feature analysis to determine honeypot feature data; wherein, the honeypot feature data is used to characterize the feature data that causes the attacker to terminate the attack due to the identification of the honeypot;

[0009] Based on the honeypot feature data, at least one camouflage strategy is generated;

[0010] The target camouflage strategy of the camouflaged object is determined from the at least one camouflage strategy, and the camouflaged object is configured according to the target camouflage strategy so that the attacker will identify the camouflaged object as a honeypot when attacking the camouflaged object.

[0011] Secondly, embodiments of this application provide a camouflage device, which includes an acquisition unit, an analysis unit, a generation unit, and a configuration unit; wherein,

[0012] The acquisition unit is configured to acquire honeypot data;

[0013] The analysis unit is configured to perform feature analysis on the honeypot data to determine honeypot feature data; wherein, the honeypot feature data is used to characterize the feature data that causes the attacker to terminate the attack due to the identification of the honeypot;

[0014] The generation unit is configured to generate at least one camouflage strategy based on the honeypot feature data;

[0015] The configuration unit is configured to determine the target camouflage strategy of the camouflaged object from the at least one camouflage strategy, and to perform configuration processing on the camouflaged object according to the target camouflage strategy, so that when the attacker attacks the camouflaged object, the camouflaged object will be identified as a honeypot.

[0016] Thirdly, embodiments of this application provide an electronic device, which includes a memory and a processor, wherein...

[0017] The memory is used to store computer programs that can run on the processor;

[0018] The processor is configured to execute the method as described in the first aspect when running the computer program.

[0019] Fourthly, embodiments of this application provide a computer storage medium storing a computer program that, when executed by at least one processor, implements the method described in the first aspect.

[0020] This application provides a disguise method, apparatus, electronic device, and computer storage medium that acquires honeypot data; performs feature analysis on the honeypot data to determine honeypot feature data; wherein the honeypot feature data is used to characterize the features that cause an attacker to terminate their attack upon recognizing the honeypot; generates at least one disguise strategy based on the honeypot feature data; determines a target disguise strategy for the disguised object from the at least one disguise strategy, and configures the disguised object according to the target disguise strategy so that when an attacker attacks the disguised object, the disguised object is recognized as a honeypot. In this way, by performing feature analysis on the honeypot data to determine the honeypot feature data that causes an attacker to terminate their attack upon recognizing the honeypot; and generating a disguise strategy based on this honeypot feature data, the server is disguised as a honeypot, which can cause attackers to abandon further intrusion into the server, thereby protecting the server from intrusion and improving server security. Attached Figure Description

[0021] Figure 1 A flowchart illustrating a camouflage method provided in an embodiment of this application;

[0022] Figure 2 A flowchart illustrating another camouflage method provided in this application embodiment;

[0023] Figure 3 A flowchart illustrating yet another camouflage method provided in an embodiment of this application;

[0024] Figure 4 A schematic diagram illustrating the correspondence between attack stages and camouflage strategies provided in an embodiment of this application;

[0025] Figure 5 A flowchart illustrating another camouflage method provided in an embodiment of this application;

[0026] Figure 6 A flowchart illustrating another camouflage method provided in an embodiment of this application;

[0027] Figure 7 This is a schematic diagram of the composition structure of a camouflage device provided in an embodiment of this application;

[0028] Figure 8 A schematic diagram of the composition structure of an electronic device provided in an embodiment of this application;

[0029] Figure 9 This is a schematic diagram of the composition structure of another electronic device provided in an embodiment of this application. Detailed Implementation

[0030] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. It should be understood that the specific embodiments described herein are only for explaining the relevant application and not for limiting the application. Furthermore, it should be noted that, for ease of description, only the parts related to the relevant application are shown in the accompanying drawings.

[0031] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application belongs. The terminology used herein is for the purpose of describing embodiments of this application only and is not intended to limit this application.

[0032] In the following description, references are made to “some embodiments,” which describe a subset of all possible embodiments. However, it is understood that “some embodiments” may be the same subset or different subsets of all possible embodiments and may be combined with each other without conflict.

[0033] It should be noted that the terms "first, second, and third" used in the embodiments of this application are merely to distinguish similar objects and do not represent a specific ordering of objects. It is understood that "first, second, and third" can be interchanged in a specific order or sequence where permitted, so that the embodiments of this application described herein can be implemented in an order other than that illustrated or described herein.

[0034] A honeypot is a fake, vulnerable information asset; it's a "trap" program—a fake system vulnerability specifically designed for intruders. These fake vulnerabilities, when used to lure intruders into scanning or attacking, activate software that triggers alerts.

[0035] Honeypot technology is essentially a technique to deceive attackers. By deploying decoy hosts, network services, or information, it lures attackers to launch attacks against them. This allows for the capture and analysis of attack behavior, understanding the tools and methods used by the attackers, and inferring their intentions and motives. It enables defenders to clearly understand the security threats they face and enhance the security capabilities of their systems through technical and management measures. However, once attackers identify and bypass the honeypot, they may be able to compromise the real business servers. Honeypot identification technology is the technique attackers use to identify honeypots and bypass them to attack the real business servers.

[0036] In related technologies, there are currently many methods for honeypot identification, but the conventional operation is to disguise the honeypot as the asset to be protected. However, existing honeypot technologies involve capturing malicious behavior and isolating unknown threat behaviors. Once an attacker identifies and bypasses the honeypot, they may be able to compromise the real business server. Based on this, the embodiments of this application use honeypot identification technology to disguise the asset to be protected as a honeypot, in order to confuse and deceive attackers.

[0037] This application provides a disguise method. The basic idea of ​​this method is as follows: acquire honeypot data; perform feature analysis on the honeypot data to determine honeypot feature data; wherein, the honeypot feature data is used to characterize the feature data that causes an attacker to terminate the attack due to the identification of the honeypot; generate at least one disguise strategy based on the honeypot feature data; determine the target disguise strategy for the disguised object from the at least one disguise strategy, and configure the disguised object according to the target disguise strategy so that when an attacker attacks the disguised object, the disguised object is identified as a honeypot. In this way, based on existing protection service technologies, by performing feature analysis on honeypot data to determine the honeypot feature data that causes an attacker to terminate the attack due to the identification of the honeypot, and generating a disguise strategy based on this honeypot feature data, the server can be disguised as a honeypot, which can cause attackers to give up further in-depth intrusion into the server, thereby protecting the server from intrusion and improving server security.

[0038] The embodiments of this application will now be described in detail with reference to the accompanying drawings.

[0039] In one embodiment of this application, see [link to embodiment]. Figure 1 The diagram illustrates a flowchart of a camouflage method provided in an embodiment of this application. Figure 1As shown, the method may include:

[0040] S101, Obtain honeypot data.

[0041] It should be noted that this application provides a spoofing method, specifically a service spoofing method based on honeypot identification. This method can be applied to a spoofing device (also known as a "management center"), or an electronic device integrated with such a device or management center. Here, the electronic device can be such as a computer, smartphone, tablet, laptop, PDA, personal digital assistant (PDA), navigation device, wearable device, etc., and this application does not specifically limit the application.

[0042] In some embodiments, obtaining honeypot data may include:

[0043] Deploy at least one honeypot;

[0044] Data is collected from at least one honeypot to obtain honeypot data.

[0045] It should be noted that, in this embodiment, by deploying at least one honeypot, collecting data on the attacker's behavior, steps, and attack termination conditions within the honeypot, and uploading the obtained honeypot data to a management center, honeypot data can be obtained. Here, the management center can be an automated program capable of collecting data from the honeypots and issuing modification policies to them.

[0046] S102. Perform feature analysis on the honeypot data to determine the honeypot feature data; wherein, the honeypot feature data is used to characterize the feature data that causes the attacker to terminate the attack due to the identification of the honeypot.

[0047] It should be noted that, in this embodiment of the application, after obtaining the honeypot data, it is necessary to perform feature analysis on the honeypot data in order to determine the honeypot feature data that characterizes the attacker's termination of the attack due to the identification of the honeypot.

[0048] Specifically, in this application embodiment, it is first necessary to determine the termination feature data when the attacker terminates the attack; however, there are many reasons why the attacker stops attacking the honeypot, such as being unable to breach the server, having breached the server, having no attractive information on the server, identifying the honeypot, or other reasons; therefore, this application embodiment also needs to further determine the target feature data that matches the attacker's termination of the attack due to the identification of the honeypot from the termination feature data, namely, the honeypot feature data.

[0049] S103. Generate at least one camouflage strategy based on honeypot feature data.

[0050] It should be noted that, in this embodiment of the application, the management center will generate at least one camouflage strategy based on the obtained honeypot feature data in order to cope with changes in the attacker's attack trend.

[0051] It should also be noted that, in the embodiments of this application, one method for generating at least one camouflage strategy is to deploy multiple different honeypots. When the attacker terminates the attack, the method analyzes and determines the honeypot feature data obtained by the attacker when they abandoned the attack due to recognizing the honeypot. Then, at least one camouflage strategy is generated based on this honeypot feature data. In addition, in some embodiments, after obtaining the honeypot data, the method may further include:

[0052] Honeypot identification algorithms are used to identify features in honeypot data and determine honeypot feature data.

[0053] Based on the honeypot feature data, generate at least one camouflage strategy.

[0054] In other words, for at least one method of generating a camouflage strategy, another method is to obtain it by analyzing the current method of identifying honeypots. Here, honeypot identification algorithms can include various specific algorithms, such as identification algorithms based on interactive simulation differences, identification algorithms based on stealth behavior discovery, etc. Among them, identification algorithms based on interactive simulation differences represent a direct confrontation between the attacker and the honeypot designer in their research on the target system. Attackers can identify honeypots by discovering functions that the honeypot has not implemented. Identification algorithms based on stealth behavior discovery identify honeypots by extracting behavioral characteristics from non-interactive processing processes such as threat capture and security control in the honeypot system. However, the embodiments of this application do not specifically limit this.

[0055] S104. Determine the target camouflage strategy for the camouflaged object from at least one camouflage strategy, and configure the camouflaged object according to the target camouflage strategy so that the camouflaged object is identified as a honeypot when an attacker attacks it.

[0056] It should be noted that, in this embodiment, when an attack is detected on a disguised object, the target disguise strategy for the disguised object needs to be determined from at least one disguise strategy. The management center will configure the disguised object according to the target disguise strategy, so that when an attacker attacks the disguised object, the disguised object is identified as a honeypot. Additionally, it should be noted that the disguised object in this embodiment can be an asset that needs protection, such as a business server or a service that needs protection; here, "service" can refer to some service characteristics, such as processes, responses, and some system information, etc., and this embodiment does not specifically limit it.

[0057] In simple terms, the embodiments of this application involve forging identifiable honeypot feature data based on data collected from at least one honeypot, in order to disguise the object to be disguised (e.g., a business server) as a honeypot, thereby deceiving attackers into believing that the business server is a honeypot and causing them to abandon their attack on the server. In other words, social engineering deception is used to add a layer of security protection to the service.

[0058] This application provides a disguise method that involves acquiring honeypot data; performing feature analysis on the honeypot data to determine honeypot characteristic data; wherein the honeypot characteristic data is used to characterize the features that cause attackers to terminate their attacks upon recognizing the honeypot; generating at least one disguise strategy based on the honeypot characteristic data; determining the target disguise strategy for the disguised object from the at least one disguise strategy; and configuring the disguised object according to the target disguise strategy so that attackers can identify the disguised object as a honeypot when attacking it. Thus, based on existing protection service technologies, by performing feature analysis on honeypot data to determine the honeypot characteristic data that causes attackers to terminate their attacks upon recognizing the honeypot; and generating a disguise strategy based on this honeypot characteristic data, the server can be disguised as a honeypot. This can cause attackers to abandon further intrusion into the server, thereby protecting the server from intrusion and improving server security.

[0059] In another embodiment of this application, see Figure 2 This illustrates a flowchart of another camouflage method provided in an embodiment of this application. For example... Figure 2 As shown, the method may include:

[0060] S201, Obtain honeypot data.

[0061] S202. Perform first feature analysis on the honeypot data to determine the termination feature data when the attacker terminates the attack.

[0062] S203. Perform a second feature analysis on the termination feature data, and determine the target feature data that matches the attacker's termination of the attack due to the identification of the honeypot from the termination feature data, and determine the target feature data as honeypot feature data.

[0063] S204. Generate at least one camouflage strategy based on the honeypot feature data.

[0064] S205. Determine the target camouflage strategy for the camouflaged object from at least one camouflage strategy, and configure the camouflaged object according to the target camouflage strategy so that the camouflaged object is identified as a honeypot when an attacker attacks it.

[0065] It should be noted that in this embodiment, steps S201, S204, and S205 correspond to steps S101, S103, and S104 in the aforementioned embodiments, respectively, and will not be described again for the sake of brevity. Furthermore, steps S202 and S203 are specific implementations of step S102 in the aforementioned embodiments, and will be described in detail below.

[0066] Understandably, for step S202, after obtaining the honeypot data, it is necessary to first perform a first feature analysis on the honeypot data to determine the termination feature data when the attacker terminates the attack.

[0067] In one possible embodiment, a binary classification method can be used to distinguish between an attacker who terminated their attack or who did not. Therefore, the classification model needs to be constructed first. In some embodiments, the method may further include:

[0068] Obtain at least one attack chain sample;

[0069] At least one attack chain sample is analyzed and machine learning is performed to establish a classification model; the classification model is used to distinguish between the attacker's terminated attack behavior and the non-terminated attack behavior.

[0070] It should be noted that, in the embodiments of this application, the classification model classifies the attacker's terminated attack behavior and the attacker's non-terminated attack behavior using a machine learning classification algorithm. Here, the machine learning classification algorithm can include various specific algorithms, such as K-nearest neighbors, decision trees, Naive Bayes, logistic regression, support vector machines, random forests, etc., and this embodiment of the application does not impose specific limitations.

[0071] Accordingly, in some embodiments, performing a first feature analysis on the honeypot data to determine termination feature data when the attacker terminates the attack may include:

[0072] During the data collection process of the honeypot, the attack chain was obtained;

[0073] The attack chain is analyzed, and the termination characteristic data when the attacker terminates the attack is determined by a classification model.

[0074] It should be noted that, in the embodiments of this application, the attack chain can be obtained during the data collection process of one or more honeypots, and the embodiments of this application do not make specific limitations.

[0075] It should also be noted that, in the embodiments of this application, during the process of collecting data from at least one honeypot, an attack chain is obtained, and then the attack chain is analyzed using a machine learning classification algorithm to determine the termination feature data when the attacker terminates the attack.

[0076] It is also understandable that, for step S203, after obtaining the termination feature data when the attacker terminates the attack by performing the first feature analysis on the honeypot data, it is also necessary to perform the second feature analysis on the termination feature data to determine the honeypot feature data that matches the attacker's termination of the attack due to the identification of the honeypot.

[0077] In one possible embodiment, there are many reasons why an attacker might stop attacking a honeypot, such as being unable to compromise the server, having already compromised the server, finding unattractive information on the server, recognizing the honeypot, or other reasons. It is necessary to identify the behavior that caused the attacker to terminate the attack because they recognized the honeypot. Therefore, in some embodiments, performing a second feature analysis on the termination feature data may include:

[0078] Based on the second feature analysis results corresponding to the termination feature data, the termination feature data is determined to include at least one of the following:

[0079] The characteristics of an attacker terminating an attack because they cannot compromise the disguised object; the characteristics of an attacker terminating an attack because they have compromised the disguised object; the characteristics of an attacker terminating an attack because the disguised object lacks appeal; and the characteristics of an attacker terminating an attack because they have identified the honeypot.

[0080] In the embodiments of this application, the termination feature data when the attacker terminates the attack can include many types, and is not limited to the examples mentioned above. No specific limitation is made here.

[0081] It should be noted that after obtaining the above-mentioned termination feature data, it is necessary to identify the feature data that the attacker terminated the attack due to the recognition of the honeypot from the termination feature data as the target feature data, and to identify the target feature data as the honeypot feature data.

[0082] It should also be noted that, in the embodiments of this application, the target feature data that the attacker terminates the attack due to the identification of the honeypot can be determined from the termination feature data based on relevant technologies and some empirical values. For example, when performing vulnerability scanning, if the attacker manually scans and finds honeypot information, he will not continue to attack the server. This is not specifically limited here.

[0083] Thus, feature analysis of honeypot data can include first feature analysis and second feature analysis. Specifically, in this embodiment, honeypot data is first acquired; then, first feature analysis is performed on the honeypot data to determine termination feature data when the attacker terminates the attack using a classification model; then, second feature analysis is performed on the termination feature data to determine the target feature data from the termination feature data based on relevant technologies and some empirical values, identifying the target feature data as honeypot feature data; next, at least one camouflage strategy is generated based on the honeypot feature data; finally, the target camouflage strategy for the camouflaged object is determined from the at least one camouflage strategy, and the camouflaged object is configured according to the target camouflage strategy so that when the attacker attacks the camouflaged object, the camouflaged object is identified as a honeypot.

[0084] In another embodiment of this application, see [link to application]. Figure 3 This illustrates a flowchart of yet another camouflage method provided in an embodiment of this application. For example... Figure 3 As shown, the method may include:

[0085] S301, Obtain honeypot data.

[0086] S302. Perform first feature analysis on the honeypot data to determine the termination feature data when the attacker terminates the attack.

[0087] S303. Perform a second feature analysis on the termination feature data, and determine the target feature data that matches the attacker's termination of the attack due to the identification of the honeypot from the termination feature data, and determine the target feature data as honeypot feature data.

[0088] S304. Generate at least one camouflage strategy based on the honeypot feature data.

[0089] S305. When an attack is detected on a disguised object, determine the current attack phase of the attacker.

[0090] S306. Predict attack behavior for the current attack phase and the next attack phase, and determine the camouflage strategy corresponding to the current attack phase and the next attack phase from at least one camouflage strategy based on the prediction results.

[0091] S307. Take the camouflage strategy corresponding to the current attack phase and the next phase as the target camouflage strategy of the camouflaged object, and configure the camouflaged object according to the target camouflage strategy so that the attacker can identify the camouflaged object as a honeypot when attacking the camouflaged object.

[0092] It should be noted that in this embodiment, steps S301, S302, S303, and S304 correspond to steps S201, S202, S203, and S204 in the aforementioned embodiments, respectively, and will not be described again here for the sake of brevity. Furthermore, steps S305, S306, and S307 are specific implementations of step S205 in the aforementioned embodiments, and will be described in detail below.

[0093] Understandably, for step S305, the attack phase includes six stages: information reconnaissance, payload delivery and attack, system control, intranet detection, intranet propagation, and data leakage. When the disguised object is detected to be under attack, it is necessary to determine the current attack phase of the attacker from these six attack phases.

[0094] It should be noted that, in the embodiments of this application, the attack phase is described in detail as follows:

[0095] (1) Information reconnaissance

[0096] Attackers use methods such as port scanning and web crawling to obtain information about the exploitable services and ports running on the target system.

[0097] (2) Payload delivery and attack

[0098] Attackers launch attacks against the service. These attacks include denial-of-service attacks, business logic attacks, web service attacks, SQL injection, and XSS.

[0099] (3) System Control

[0100] After a successful attack, the attacker gains system privileges. They may use various methods to obtain control of the target system, or escalate the privileges of a regular account to a higher level, gaining more operational permissions.

[0101] (4) Internal network detection

[0102] Attackers probe other hosts on the internal network to see if there are any exploitable vulnerabilities.

[0103] (5) Intranet spread

[0104] This phase primarily involves spreading the intrusion into the internal network, expanding its impact, and taking control of other servers.

[0105] (6) Data breach

[0106] Attackers have gained access to the target system or even the internal network system, obtained monitoring hosts, and can obtain sensitive data, causing the target to leak data without their knowledge.

[0107] It should be noted that, in the payload delivery and attack phase, the payload here refers to the attack payload, such as Structured Query Language (SQL) injection statements, Cross-Site Scripting (CSS, i.e., XSS) statements, business logic attack statements, etc., without specific limitations.

[0108] It should also be noted that, in the context of data breaches, "sensitive data" refers to data that, if leaked, could cause serious harm to society or individuals. Sensitive data includes personal privacy data, such as names, ID numbers, addresses, phone numbers, bank account numbers, email addresses, passwords, medical information, and educational backgrounds; it also includes data that businesses or organizations are not suitable to disclose, such as a company's operational information, network structure, and IP address lists, etc., without further specific limitations.

[0109] It is also understandable that, for step S306, after determining the current attack stage of the attacker, it is necessary to predict the attack behavior of the current attack stage and the next attack stage. This can be done by combining existing attack behavior prediction methods, such as using Bayes networks and attack graphs to predict the attacker's behavior, etc., without making specific limitations here. Among them, Bayes networks have the characteristic of handling uncertain data; attack graphs can automatically identify possible vulnerabilities based on the vulnerability assessment system, and then display all attack paths by analyzing the dependencies of vulnerabilities, ultimately playing a role in comprehensively assessing the security trend of the system.

[0110] It should be noted that, for step S307, after taking the camouflage strategy corresponding to the current attack phase and the next phase as the target camouflage strategy of the camouflaged object, and configuring the camouflaged object according to the target camouflage strategy, it is necessary to determine whether the target camouflage strategy is effective, and then confirm whether the camouflaged object can be successfully camouflaged.

[0111] Furthermore, in some embodiments, after configuring the object to be disguised according to the target camouflage strategy, the method may further include:

[0112] Before configuring the disguised object according to the target camouflage strategy, determine the first attack probability value of the attacker attacking the disguised object;

[0113] After configuring the disguised object according to the target camouflage strategy, a second attack probability value is determined for the attacker to attack the disguised object;

[0114] If the second attack probability value is lower than the first attack probability value, then the target camouflage strategy is determined to be an effective camouflage strategy so that the camouflaged object can be successfully camouflaged.

[0115] If the second attack probability value is not lower than the first attack probability value, then the target camouflage strategy is determined to be an invalid camouflage strategy, so that the camouflage of the disguised object fails.

[0116] It should be noted that in this embodiment, the first attack probability value before the disguised object is configured is first obtained, and then the second attack probability value after the disguised object is configured according to the target disguise strategy is obtained. If the attack probability value of the attacker still choosing to attack after obtaining the information corresponding to the target disguise strategy after configuring the disguised object according to the target disguise strategy does not decrease, then it can be determined that the target disguise strategy is an invalid disguise strategy, that is, an ineffective disguise strategy, which will cause the disguised object to fail to disguise.

[0117] Furthermore, the management center will adjust and optimize the camouflage strategy to remove ineffective camouflage strategies. Therefore, when there are one or more honeypots, in some embodiments, after determining the target camouflage strategy for the camouflaged object, the method may further include:

[0118] Send the target masquerading strategy to the masqueraded object and at least one honeypot;

[0119] If the attacker continues to attack at least one honeypot while the attacker is launching an attack, the target camouflage strategy is optimized to obtain an optimized target camouflage strategy. The optimized target camouflage strategy is then sent to the camouflaged object and at least one honeypot until the attacker stops attacking at least one honeypot.

[0120] It should be noted that, in this embodiment of the application, after determining the target masquerading strategy for the masqueraded object, the target masquerading strategy also needs to be sent to the masqueraded object and at least one honeypot. Then, when an attacker launches an attack, if the attacker continues to attack at least one honeypot, the management center will adjust and optimize the target masquerading strategy and delete invalid target masquerading strategies, thereby obtaining an optimized target masquerading strategy. After that, the optimized target masquerading strategy needs to be sent to the masqueraded object and at least one honeypot again. If the attacker continues to attack at least one honeypot, the target masquerading strategy will continue to be adjusted and optimized, and the step of sending the optimized target masquerading strategy to the masqueraded object and at least one honeypot will be repeated until the attacker stops attacking at least one honeypot.

[0121] It should be noted that, see Figure 4 This diagram illustrates the correspondence between attack stages and camouflage strategies provided in an embodiment of this application. Figure 4As shown, spoofing strategies can be divided into four categories: forging the characteristics of request feedback, forging the data packets sent, forging the characteristic information of running services, and adding forged information to services.

[0122] It should also be noted that, in the embodiments of this application, the camouflage strategies that can be selected for each attack stage are as follows: Figure 4 As shown, for example, during the payload delivery and attack phase, a masquerade strategy that uses forged request feedback features can be selected; during the data leakage phase, a masquerade strategy that uses forged sent data packets, forged running service feature information, or forged information added to the service can be selected.

[0123] It should also be noted that, in the embodiments of this application, the camouflage strategy is described in detail as follows:

[0124] 1. Characteristics of forged request responses

[0125] Attackers actively send packets to identify targets based on the characteristics reflected by the system. Disguise strategies can mimic the features of typical existing honeypots, for example:

[0126] (1) Forging Transmission Control Protocol / Internet Protocol (TCP / IP) stack fingerprint features

[0127] (2) Characteristics of forged TCP / IP protocol stack behavior

[0128] (3) Falsifying online behavior characteristics

[0129] (4) Characteristics of counterfeit service behavior

[0130] (5) Characteristics of forged system behavior

[0131] (6) Fake saturation attack characteristics

[0132] (7) Extend the response time for abnormal requests.

[0133] 2. Forged data packets sent

[0134] In order to perform its functions, each part of a honeypot needs to transmit the captured information. Attackers will use sniffing tools to capture data packets on the honeypot network to analyze and determine the existence of the honeypot.

[0135] The spoofing strategy can forge information that captures the attacker's actions and send it out in plaintext.

[0136] 3. Forging service feature information

[0137] (1) Fake services running on the server to make attackers believe that there are data capture processes and abnormal services on the server;

[0138] (2) Fake the running process of the data capture tool or run the data capture tool directly;

[0139] (3) Modify the default port of the service and change the original default port to a fake similar service.

[0140] 4. Adding fake information to the service

[0141] Disguise strategies can insert honeypot information and identifiers in places that are obvious to attackers, thereby providing them with cues. For example:

[0142] (1) In the comments of the web page

[0143] (2) In the response to the request

[0144] (3) Important directories on the server

[0145] (4) Database structure and data

[0146] (5) In some front-end pages that are not visible to normal users

[0147] It should be noted that, in the embodiments of this application, the data capture tool in step 3 may include many kinds, such as network traffic analysis (awesome-pcaptools), malware analysis (awesome-malware-analysis), etc., and is not specifically limited here.

[0148] It should also be noted that, in the embodiments of this application, spoofing elements can be added to the attacker's attack behavior in the current attack phase or the next attack phase. For example, when it is detected that an attacker is conducting information reconnaissance and using port scanning, only spoofing port services can effectively deal with it. In this case, it is only necessary to expose the ports commonly used by the honeypot to the attacker and provide spoofed service feature information. Or when it is detected that the attacker is using a crawler, multiple spoofing strategies can be effective. For example, inserting a page response containing honeypot information or a link to the honeypot version information in the WEB page comments into the response and returning it to the attacker is not specifically limited here.

[0149] In summary, this embodiment provides a camouflage method, specifically a service camouflage method based on honeypot identification. Based on data collected from the honeypot, identifiable features are forged to deceive attackers, causing them to believe the service (i.e., the camouflaged object) is a honeypot and thus abandon their attack. Specifically, the method monitors attacker behavior within the honeypot and transmits the behavioral data to a management center. The management center analyzes the information the attacker obtains to determine when to stop the attack and then modifies the service server's configuration based on this information. This means adaptively modifying the server without affecting its existing operations, thereby protecting the service server.

[0150] In one specific embodiment, the camouflage method described in the foregoing embodiments may include the following steps:

[0151] Step 1: Adjust the honeypot configuration based on the information collected in real time.

[0152] It should be noted that, in the embodiments of this application, see... Figure 5 First, multiple honeypots are deployed. Then, the management center collects data on attacker behavior, steps, and termination conditions within the honeypots. In this way, the running honeypots can dynamically generate camouflage strategies to counter attackers in response to changes in attack trends, and distribute the modified strategies (which the management center adjusts and optimizes) to both the honeypots and the business servers.

[0153] It should also be noted that, in this application embodiment, the camouflage strategy is generated in two ways:

[0154] (1) Generate a camouflage strategy by analyzing the current methods for identifying honeypots;

[0155] (2) By deploying multiple different honeypots, when the attacker terminates the attack, the attack chain is analyzed, and when the attacker gives up due to the identification of the honeypot, the information obtained by the attacker is used to generate a disguise strategy.

[0156] In the embodiments of this application, see Figure 6 The generated masquerade policies are distributed to each honeypot and the business servers that need protection. If attackers do not stop attacking the honeypots because of the masquerade policies, the management center will adjust the policies, optimize the weight of the specific implementation policies, and delete invalid masquerade policies.

[0157] Step 2: Select the attack chain where the attacker stops attacking because they recognize the server as a honeypot.

[0158] It should be noted that, in the embodiments of this application, existing attack chains are analyzed based on experience to distinguish behaviors that terminate the attack due to the identification of honeypots, and a machine learning-based classification algorithm is selected to perform binary classification, so that the attacker's behavior of abandoning the attack can be identified through the algorithm.

[0159] It should be noted that, in this embodiment of the application, there are multiple reasons why an attacker might stop attacking a honeypot, including: inability to compromise the server, the server already compromised, the server lacking attractive information, the honeypot being identified, and other reasons. It is necessary to identify the behavior that causes the attacker to terminate the attack due to the identification of the honeypot from multiple attack chains.

[0160] It should be noted that, in the embodiments of this application, the machine learning classification algorithms include, but are not limited to, K-nearest neighbors, decision trees, Naive Bayes, logistic regression, support vector machines, random forests, etc., and are not specifically limited here.

[0161] It should also be noted that, in the embodiments of this application, when the attacker stops attacking the honeypot, the characteristic state parameters generated by the attack include: port scan completeness, port service identification completeness, web page crawling degree, sensitive information leakage degree, honeypot feature exposure degree, server compromise degree, and time consumption of each attack stage, etc., which are not specifically limited here.

[0162] Step 3: Modify the current response configuration based on the attacker's current attack signature identification.

[0163] It should be noted that, in this embodiment of the application, when an attack on the business server is detected, the current stage and characteristics of the attacker are analyzed, triggering the current and next stage of protection strategies (i.e., spoofing strategies). Attacker behavior is predicted, and the effectiveness of the spoofing strategy is set according to the weight of specific operations in the protection strategy, so as to respond promptly to the attacker's attack while ensuring the performance of the current business server.

[0164] It should also be noted that, in the embodiments of this application, existing attack behavior prediction methods can be combined to predict attacker behavior, and spoofing elements can be added to the attacker's current or planned attack behavior. For example, when it is detected that an attacker is conducting information reconnaissance and using port scanning, only spoofing port services can effectively counter this. In this case, it is only necessary to expose the ports commonly used by honeypots to the attacker and provide spoofed service feature information. When it is detected that an attacker is using a web crawler, multiple spoofing strategies can be effective, such as inserting links containing honeypot information or honeypot version information in web page comments into the response and returning it to the attacker.

[0165] In other words, in this embodiment of the application, a service masquerading method based on honeypot identification is used to disguise the service as a honeypot, causing attackers to abandon further intrusion into the server, thereby adding a layer of security protection to the service through social engineering deception.

[0166] This embodiment provides a disguise method. The specific implementation of the aforementioned embodiments is described in detail below. It can be seen that, according to the technical solution of the aforementioned embodiments, attacker behavior is monitored within the honeypot, and the behavioral data is transmitted to the management center. The management center analyzes existing honeypot identification methods and the acquired behavioral data to generate a disguise strategy, which is then distributed to the honeypot and the business servers requiring protection. The disguise strategy is adjusted based on real-time information collected from the honeypot to achieve the effect of dynamically protecting the business servers. Furthermore, compared to related technologies, existing honeypot technologies aim to capture malicious behavior and separate unknown threat behaviors, while honeypot identification technology is used by attackers to identify honeypots and bypass them to attack the real business services. Thus, on the one hand, this application, based on honeypot identification technology, disguises services as honeypots to protect them from intrusion; on the other hand, this application does not replace related technologies. Once a honeypot is identified and bypassed by an attacker, the server may be compromised. This application proposes a service disguise method based on honeypot identification, which can disguise services as honeypots from multiple angles, causing attackers to abandon further intrusion into the server, adding a layer of security protection to the service through social engineering.

[0167] In another embodiment of this application, see [reference needed]. Figure 7 This illustrates a schematic diagram of the structural composition of a camouflage device 70 provided in an embodiment of this application. For example... Figure 7 As shown, the camouflage device 70 may include an acquisition unit 701, an analysis unit 702, a generation unit 703, and a configuration unit 704, wherein,

[0168] Unit 701 is configured to acquire honeypot data.

[0169] Analysis unit 702 is configured to perform feature analysis on honeypot data to determine honeypot feature data; wherein, honeypot feature data is used to characterize the feature data that causes an attacker to terminate the attack due to the identification of the honeypot;

[0170] The generation unit 703 is configured to generate at least one camouflage strategy based on honeypot feature data;

[0171] Configuration unit 704 is configured to determine the target masquerading strategy of the masqueraded object from at least one masquerading strategy, and to perform configuration processing on the masqueraded object according to the target masquerading strategy, so that when an attacker attacks the masqueraded object, the masqueraded object is identified as a honeypot.

[0172] In some embodiments, the acquisition unit 701 is further configured to deploy at least one honeypot; and to collect data from at least one honeypot to obtain honeypot data.

[0173] In some embodiments, the analysis unit 702 is further configured to perform a first feature analysis on the honeypot data to determine termination feature data when the attacker terminates the attack; and to perform a second feature analysis on the termination feature data to determine target feature data from the termination feature data that matches the attacker's termination of the attack due to the identification of the honeypot, and to determine the target feature data as honeypot feature data.

[0174] In some embodiments, the acquisition unit 701 is further configured to acquire at least one attack chain sample; and to analyze and perform machine learning on the at least one attack chain sample to establish a classification model; wherein the classification model is used to distinguish between the attacker's terminated attack behavior and the non-terminated attack behavior; correspondingly, the analysis unit 702 is further configured to acquire the attack chain during the data collection process of the honeypot; and to analyze the attack chain and determine the termination feature data when the attacker terminates the attack through the classification model.

[0175] In some embodiments, the analysis unit 702 is further configured to determine, based on the second feature analysis result corresponding to the termination feature data, that the termination feature data includes at least one of the following: feature data of the attacker terminating the attack because it is unable to break through the disguised object, feature data of the attacker terminating the attack because it has broken through the disguised object, feature data of the attacker terminating the attack because the disguised object lacks attractiveness, and feature data of the attacker terminating the attack because it identifies the honeypot.

[0176] In some embodiments, the generation unit 703 is further configured to perform feature recognition on the honeypot data using a honeypot identification algorithm to determine honeypot feature data; and to generate at least one camouflage strategy based on the honeypot feature data.

[0177] In some embodiments, such as Figure 7 As shown, the camouflage device 70 may include a determining unit 705, configured to determine the current attack phase of the attacker when the camouflaged object is detected to be under attack; and to predict the attack behavior of the current attack phase and the next attack phase, and to determine the camouflage strategy corresponding to the current attack phase and the next attack phase in at least one camouflage strategy based on the prediction result; and to use the camouflage strategy corresponding to the current attack phase and the next phase as the target camouflage strategy of the camouflaged object.

[0178] In some embodiments, the configuration unit 704 is further configured to: determine a first attack probability value for an attacker to attack the disguised object before configuring the disguised object according to the target masquerading strategy; and determine a second attack probability value for an attacker to attack the disguised object after configuring the disguised object according to the target masquerading strategy; and if the second attack probability value is lower than the first attack probability value, determine the target masquerading strategy as an effective masquerading strategy so that the disguised object can be successfully disguised; and if the second attack probability value is not lower than the first attack probability value, determine the target masquerading strategy as an invalid masquerading strategy so that the disguised object fails to be disguised.

[0179] In some embodiments, the determining unit 705 is further configured to send the target camouflage strategy to the camouflaged object and the honeypot; and when an attacker launches an attack, if the attacker continues to attack the honeypot, optimize the target camouflage strategy to obtain an optimized target camouflage strategy, and execute the step of sending the optimized target camouflage strategy to the camouflaged object and the honeypot, until the attacker stops attacking the honeypot.

[0180] Understandably, in this embodiment, a "unit" can be a portion of a circuit, a portion of a processor, a portion of a program or software, etc., and can also be a module or a non-modular component. Furthermore, the components in this embodiment can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional module.

[0181] If the integrated unit is implemented as a software functional module and not sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this embodiment, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) or processor to execute all or part of the steps of the method described in this embodiment. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0182] Therefore, this embodiment provides a computer storage medium storing a computer program that, when executed by at least one processor, implements the steps of any of the spoofing methods described in the foregoing embodiments.

[0183] Based on the above-described composition of the camouflage device 70 and the computer storage medium, see [link to relevant documentation]. Figure 8 This illustrates a schematic diagram of the structural composition of an electronic device 80 provided in an embodiment of this application. For example... Figure 8 As shown, electronic device 80 may include: a communication interface 801, a memory 802, and a processor 803; the various components are coupled together via a bus system 804. It is understood that the bus system 804 is used to implement communication between these components. In addition to a data bus, the bus system 804 also includes a power bus, a control bus, and a status signal bus. However, for clarity, in... Figure 8 The various buses are all labeled as bus system 804. Among them, the communication interface 801 is used for receiving and sending signals during the process of sending and receiving information with other external network elements;

[0184] Memory 802 is used to store computer programs that can run on processor 803;

[0185] Processor 803, when running the computer program, performs the following:

[0186] Obtain honeypot data;

[0187] Feature analysis is performed on honeypot data to determine honeypot feature data; among which, honeypot feature data is used to characterize the features that cause attackers to terminate their attacks due to the identification of honeypots;

[0188] Based on honeypot feature data, generate at least one camouflage strategy;

[0189] Determine the target masquerading strategy for the masqueraded object from at least one masquerading strategy, and configure the masqueraded object according to the target masquerading strategy so that the masqueraded object is identified as a honeypot when an attacker attacks the masqueraded object.

[0190] It is understood that the memory 802 in the embodiments of this application can be volatile memory or non-volatile memory, or may include both volatile and non-volatile memory. The non-volatile memory can be read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), or flash memory. The volatile memory can be random access memory (RAM), which is used as an external cache. By way of example, but not limitation, many forms of RAM are available, such as Static Random Access Memory (SRAM), Dynamic Random Access Memory (DRAM), Synchronous DRAM (SDRAM), Double Data Rate SDRAM (DDRSDRAM), Enhanced Synchronous DRAM (ESDRAM), Synchronous Link DRAM (SLDRAM), and Direct Rambus RAM (DRRAM). The memory 802 of the systems and methods described herein is intended to include, but is not limited to, these and any other suitable types of memory.

[0191] The processor 803 may be an integrated circuit chip with signal processing capabilities. In implementation, each step of the above method can be completed by the integrated logic circuitry in the hardware of the processor 803 or by instructions in software form. The processor 803 can be a general-purpose processor, a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. It can implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of this application. The general-purpose processor can be a microprocessor or any conventional processor. The steps of the methods disclosed in the embodiments of this application can be directly embodied in the execution of a hardware decoding processor, or executed by a combination of hardware and software modules in the decoding processor. The software modules can be located in random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, registers, or other mature storage media in the art. This storage medium is located in memory 802, and the processor 803 reads the information in memory 802 and, in conjunction with its hardware, completes the steps of the above method.

[0192] It is understood that the embodiments described herein can be implemented in hardware, software, firmware, middleware, microcode, or a combination thereof. For hardware implementation, the processing unit can be implemented in one or more application-specific integrated circuits (ASICs), digital signal processors (DSPs), digital signal processing devices (DSPDs), programmable logic devices (PLDs), field-programmable gate arrays (FPGAs), general-purpose processors, controllers, microcontrollers, microprocessors, other electronic units for performing the functions described herein, or combinations thereof.

[0193] For software implementation, the techniques described herein can be achieved through modules (e.g., procedures, functions, etc.) that perform the functions described herein. The software code can be stored in memory and executed by a processor. The memory can be implemented within the processor or externally.

[0194] Alternatively, as another embodiment, the processor 803 is also configured to perform the method described in any of the foregoing embodiments when running the computer program.

[0195] In another embodiment of this application, see [link to application]. Figure 9 This illustrates a schematic diagram of the structural composition of another electronic device 80 provided in an embodiment of this application. For example... Figure 9 As shown, the electronic device 80 includes at least the camouflage device 70 described in any of the foregoing embodiments.

[0196] In this embodiment of the application, for electronic device 80, based on existing protection service technologies, by disguising the service as a honeypot, attackers are deterred from further penetrating the server. Social engineering deception is used to add a layer of security protection to the service, thereby improving the security of the server.

[0197] The above description is merely a preferred embodiment of this application and is not intended to limit the scope of protection of this application.

[0198] It should be noted that, in this application, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0199] The sequence numbers of the embodiments in this application are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0200] The methods disclosed in the several method embodiments provided in this application can be arbitrarily combined without conflict to obtain new method embodiments.

[0201] The features disclosed in the several product embodiments provided in this application can be arbitrarily combined without conflict to obtain new product embodiments.

[0202] The features disclosed in the several method or device embodiments provided in this application can be arbitrarily combined without conflict to obtain new method or device embodiments.

[0203] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A spoofing method based on honeypot identification technology, characterized in that, The method includes: Obtain honeypot data; The honeypot data is subjected to feature analysis to determine honeypot feature data; wherein, the honeypot feature data is used to characterize the feature data that causes the attacker to terminate the attack due to the identification of the honeypot; Based on the honeypot feature data, at least one camouflage strategy is generated; The target camouflage strategy of the camouflaged object is determined from the at least one camouflage strategy, and the camouflaged object is configured according to the target camouflage strategy so that the attacker will identify the camouflaged object as a honeypot when attacking the camouflaged object; The method further includes: predicting the attacker's behavior using a Bayes network and an attack graph; The step of performing feature analysis on the honeypot data to determine honeypot feature data includes: Perform a first feature analysis on the honeypot data to determine the termination feature data when the attacker terminates the attack; A second feature analysis is performed on the termination feature data to determine the target feature data that matches the attacker's termination of the attack due to the identification of the honeypot, and the target feature data is determined as the honeypot feature data. The method further includes: determining a first attack probability value for the attacker to attack the disguised object before configuring the disguised object according to the target camouflage strategy; After configuring the disguised object according to the target camouflage strategy, the method further includes: determining a second attack probability value for the attacker to attack the disguised object; If the second attack probability value is lower than the first attack probability value, then the target camouflage strategy is determined to be an effective camouflage strategy, so that the camouflaged object can be successfully camouflaged. If the second attack probability value is not lower than the first attack probability value, then the target camouflage strategy is determined to be an invalid camouflage strategy, so that the camouflage of the disguised object fails.

2. The method according to claim 1, characterized in that, The method further includes: Obtain at least one attack chain sample; The at least one attack chain sample is analyzed and machine learning is performed to establish a classification model; wherein the classification model is used to distinguish between the attacker's terminated attack behavior and non-terminated attack behavior; Accordingly, the first feature analysis of the honeypot data to determine the termination feature data when the attacker terminates the attack includes: During the data collection process of the honeypot, the attack chain is obtained; The attack chain is analyzed, and the termination feature data when the attacker terminates the attack is determined by the classification model.

3. The method according to claim 1, characterized in that, The second feature analysis of the termination feature data includes: Based on the second feature analysis result corresponding to the termination feature data, the termination feature data is determined to include at least one of the following: The characteristic data of the attacker terminating the attack because they could not break through the disguised object, the characteristic data of the attacker terminating the attack because they had broken through the disguised object, the characteristic data of the attacker terminating the attack because the disguised object lacked attractiveness, and the characteristic data of the attacker terminating the attack because they identified the honeypot.

4. The method according to claim 1, characterized in that, Determining the target camouflage strategy for the camouflaged object from the at least one camouflage strategy includes: When the disguised object is detected to be under attack, the current attack phase of the attacker is determined; Attack behavior prediction is performed for the current attack phase and the next attack phase, and the camouflage strategy corresponding to the current attack phase and the next attack phase is determined from the at least one camouflage strategy based on the prediction results. The camouflage strategies corresponding to the current attack phase and the next phase are used as the target camouflage strategies for the camouflaged object.

5. The method according to claim 1, characterized in that, After determining the target camouflage strategy for the camouflaged object, the method further includes: The target camouflage strategy is sent to the camouflaged object and the honeypot; If the attacker continues to attack the honeypot while the attacker is launching an attack, the target camouflage strategy is optimized to obtain an optimized target camouflage strategy. The optimized target camouflage strategy is then sent to the camouflaged object and the honeypot until the attacker stops attacking the honeypot.

6. A camouflage device based on honeypot identification technology, characterized in that, The camouflage device includes an acquisition unit, an analysis unit, a generation unit, and a configuration unit; wherein, The acquisition unit is configured to acquire honeypot data; The analysis unit is configured to perform feature analysis on the honeypot data to determine honeypot feature data; wherein, the honeypot feature data is used to characterize the feature data that causes the attacker to terminate the attack due to the identification of the honeypot; The generation unit is configured to generate at least one camouflage strategy based on the honeypot feature data; The configuration unit is configured to determine the target camouflage strategy of the camouflaged object from the at least one camouflage strategy, and to perform configuration processing on the camouflaged object according to the target camouflage strategy, so that when the attacker attacks the camouflaged object, the camouflaged object will be identified as a honeypot. The analysis unit is further configured to perform a first feature analysis on the honeypot data to determine the termination feature data when the attacker terminates the attack; and to perform a second feature analysis on the termination feature data to determine the target feature data that matches the attacker's termination of the attack due to the identification of the honeypot, and to determine the target feature data as the honeypot feature data. The configuration unit is further configured to predict the attacker's behavior using a Bayesian network and an attack graph; and to determine a first attack probability value for the attacker to attack the disguised object before configuring the disguised object according to the target masquerading strategy; and to determine a second attack probability value for the attacker to attack the disguised object after configuring the disguised object according to the target masquerading strategy; and if the second attack probability value is lower than the first attack probability value, then the target masquerading strategy is determined to be an effective masquerading strategy so that the disguised object can be successfully disguised; and if the second attack probability value is not lower than the first attack probability value, then the target masquerading strategy is determined to be an invalid masquerading strategy so that the disguised object fails to be disguised.

7. An electronic device, characterized in that, The electronic device includes a memory and a processor, wherein, The memory is used to store computer programs that can run on the processor; The processor is configured to perform the method as described in any one of claims 1 to 5 when running the computer program.

8. A computer storage medium, characterized in that, The computer storage medium stores a computer program that, when executed by at least one processor, implements the method as described in any one of claims 1 to 5.

Images