Honeypot deployment method, device, equipment and storage medium

Abstract

The application provides a method, device, equipment and storage medium for deploying a honeypot. The method comprises: receiving a honeypot deployment request sent by a user, performing probe environment initialization according to the honeypot deployment request to obtain an environment initialization result, obtaining a honeypot according to the environment initialization result and a preset honeypot library, connecting the honeypot to pseudo traffic, generating a honeypot service script, and controlling the honeypot service script to run on a target probe after initialization. The above method makes the deployment of the honeypot scalable, easy to operate, and enables real-time monitoring of the state of the honeypot. In combination with the understanding of the business and the cognition of the threat, the method provides a multi-dimensional simulation degree of the honeypot, enhances the authenticity of the honeypot, and realizes higher deception.

Description

Technical Field

[0001] This application relates to the field of network security technology, and in particular to a method, apparatus, device and storage medium for honeypot deployment. Background Technology

[0002] Honeypot technology is essentially a technique to deceive attackers. By deploying decoy hosts, network services, or information, attackers are lured to launch attacks against them. This allows attackers to capture and analyze the attack behavior, understand the tools and methods used by the attackers, and infer their attack intentions and motives. It enables defenders to clearly understand the security threats they face and enhance the security protection capabilities of their actual systems through technical and management means.

[0003] In existing technologies, honeypot deployment is mainly divided into proxy mode and agentless mode. Proxy mode primarily uses a combination of a central hub and client-side components. The client proxies traffic to the honeypot, while intermediate devices are used to monitor, block, and counterattack attacks. Agentless mode involves building fully simulated honeypots and deploying them directly within the honeynet. These honeypots directly face attackers, and monitoring and countermeasures are primarily implemented through the individual honeypots themselves. However, as networks become increasingly complex and attack-defense confrontations intensify, conventional honeypot deployments can no longer meet the demands of complex networks.

[0004] In summary, how to easily implement multidimensional honeypot deployment is a problem that urgently needs to be solved in this field. Summary of the Invention

[0005] This application provides a method, apparatus, device, and storage medium for honeypot deployment, to solve the problem of how to easily implement multidimensional honeypot deployment.

[0006] Firstly, this application provides a method for honeypot deployment, applied to a honeypot deployment platform, including:

[0007] Receive a honeypot deployment request sent by a user, wherein the honeypot deployment request includes the target probe selected by the user;

[0008] Based on the honeypot deployment request, the probe environment is initialized to obtain the environment initialization result, which includes the initialized target probe.

[0009] Based on the environment initialization results and the preset honeypot library, honeypots are obtained, and the honeypot library includes multiple pre-configured honeypots;

[0010] The honeypot is connected to spoofed traffic to generate a honeypot service script, which includes a dynamic honeypot and a honeypot startup script.

[0011] The honeypot service script is controlled to run on the target probe after initialization.

[0012] In conjunction with the first aspect, in some embodiments, the step of connecting the honeypot to spoofed traffic and generating a honeypot service script includes:

[0013] Based on the honeypot, adjust the dynamic parameters of the spoofed traffic to generate a dynamic honeypot;

[0014] The instructions for deploying honeypot services in the Ansible module include honeypot startup instructions. The Ansible module is set up internally by the honeypot deployment platform.

[0015] Based on the dynamic honeypot and the honeypot service instructions, the honeypot service script is generated.

[0016] In conjunction with the first aspect, in some embodiments, obtaining a honeypot from a pre-defined honeypot repository based on the honeypot deployment request includes:

[0017] The Ansible module is instructed to retrieve the honeypot, and the Ansible module retrieves the honeypot from the honeypot repository according to the honeypot retrieval instruction. The honeypot retrieval instruction includes the service name of the honeypot.

[0018] In conjunction with the first aspect, in some embodiments, the access method for connecting the honeypot to the spoofed traffic includes any one of an email system, an information technology (IT) system, a database service, an application service, and a web server service.

[0019] In conjunction with the first aspect, in some embodiments, based on the honeypot deployment request, probe environment initialization is performed to obtain environment initialization results, including:

[0020] The environment initialization command is given to the ansible module, and the ansible module generates an environment initialization script based on the environment initialization command. The environment initialization script includes a script to close the default port of the deployment device, a script to ensure network connectivity, a script to delete residual installation packages, and a script to close irrelevant services.

[0021] The environment initialization script is controlled to run on the target probe to obtain the environment initialization result.

[0022] In conjunction with the first aspect, in some embodiments, the honeypot service script further includes a honeypot service monitoring script, and the method further includes:

[0023] Obtain the honeypot parameters provided in real time by the initialized target probe, including health status, traffic, and probe performance;

[0024] Real-time honeypot information is generated based on the honeypot parameters. The real-time honeypot information includes the operating status of the honeypot and the initialized target probe, network traffic, and attack information.

[0025] Secondly, this application provides an apparatus for honeypot deployment, comprising:

[0026] A receiving module is used to receive a honeypot deployment request sent by a user, wherein the honeypot deployment request includes the target probe selected by the user;

[0027] An initialization module is used to initialize the probe environment according to the honeypot deployment request and obtain the environment initialization result, which includes the initialized target probe.

[0028] The first acquisition module is used to acquire honeypots based on the environment initialization result and a preset honeypot library, wherein the honeypot library includes multiple pre-configured honeypots.

[0029] The script generation module is used to connect the honeypot to the disguised traffic and generate a honeypot service script, which includes a dynamic honeypot and a honeypot startup script.

[0030] The script execution module is used to control the honeypot service script to run on the target probe after initialization.

[0031] In conjunction with the second aspect, in some embodiments, the script generation module includes:

[0032] A dynamic adjustment unit is used to adjust the dynamic parameters of the spoofed traffic according to the honeypot, thereby generating a dynamic honeypot;

[0033] The instruction deployment unit is used to deploy honeypot service instructions in the Ansible module. The honeypot service instructions include honeypot startup instructions. The Ansible module is set up internally by the honeypot deployment platform.

[0034] The script generation unit is used to generate the honeypot service script based on the dynamic honeypot and the honeypot service instructions.

[0035] In conjunction with the second aspect, in some embodiments, the first acquisition module includes:

[0036] The acquisition unit is used to instruct the Ansible module to acquire the honeypot, and the Ansible module acquires the honeypot from the honeypot repository according to the honeypot acquisition instruction. The honeypot acquisition instruction includes the service name of the honeypot.

[0037] In conjunction with the second aspect, in some embodiments, the access method for connecting the honeypot to the spoofed traffic includes any one of an email system, an information technology (IT) system, a database service, an application service, and a web server service.

[0038] In conjunction with the second aspect, in some embodiments, the initialization module includes:

[0039] The script generation unit is used to instruct the Ansible module on environment initialization instructions, and the Ansible module generates an environment initialization script based on the environment initialization instructions. The environment initialization script includes a script to close the default port of the deployment device, a script to ensure network connectivity, a script to delete residual installation packages, and a script to close irrelevant services.

[0040] The script execution unit is used to control the environment initialization script to run on the target probe and obtain the environment initialization result.

[0041] In conjunction with the second aspect, in some embodiments, the honeypot service script further includes a honeypot service monitoring script, and the device further includes:

[0042] The second acquisition module is used to acquire the honeypot parameters provided in real time by the initialized target probe. The honeypot parameters include health status, traffic, and probe performance.

[0043] The information generation module is used to generate real-time information about the honeypot based on the honeypot parameters. The real-time information about the honeypot includes the operating status of the honeypot and the initialized target probe, network traffic, and attack information.

[0044] Thirdly, this application provides an electronic device, including: a memory, a processor, and a display;

[0045] The memory stores computer-executed instructions;

[0046] The processor executes computer execution instructions stored in the memory to implement the method described in any of the above aspects.

[0047] Fourthly, this application provides a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, are used to implement the honeypot deployment method described in any of the preceding aspects.

[0048] The honeypot deployment method, apparatus, equipment, and storage medium provided in this application initialize the probe environment based on a honeypot deployment request sent by a user, obtain the environment initialization result, acquire the honeypot based on the environment initialization result and a preset honeypot library, and finally connect the honeypot to masquerading traffic to generate a honeypot service script, and control the honeypot service script to run on the target probe after initialization. This method enables large-scale honeypot deployment, simplifies operation, allows real-time monitoring of honeypot status, and, combined with business understanding and threat awareness, provides multi-dimensional honeypot simulation, enhancing honeypot realism and achieving higher deception capabilities. Attached Figure Description

[0049] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0050] Figure 1 This is an application scenario diagram of the honeypot deployment method provided in the embodiments of this application;

[0051] Figure 2 A flowchart illustrating an embodiment of the honeypot deployment method provided in this application;

[0052] Figure 3 A flowchart illustrating a second embodiment of the honeypot deployment method provided in this application;

[0053] Figure 4 A flowchart illustrating a third embodiment of the honeypot deployment method provided in this application;

[0054] Figure 5 A flowchart illustrating Embodiment 4 of the honeypot deployment method provided in this application;

[0055] Figure 6 A flowchart illustrating Embodiment 5 of the honeypot deployment method provided in this application;

[0056] Figure 7 A schematic diagram of the structure of a honeypot deployment device according to an embodiment of this application;

[0057] Figure 8 A schematic diagram of the structure of the honeypot deployment device according to Embodiment 2 of this application;

[0058] Figure 9 A schematic diagram of the structure of the honeypot deployment device according to Embodiment 3 of this application;

[0059] Figure 10 A schematic diagram of the structure of the honeypot deployment device according to Embodiment 4 of this application;

[0060] Figure 11 A schematic diagram of the structure of the honeypot deployment device according to embodiment five of this application;

[0061] Figure 12 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application.

[0062] The accompanying drawings illustrate specific embodiments of this application, which will be described in more detail below. These drawings and descriptions are not intended to limit the scope of the concept in any way, but rather to illustrate the concept of this application to those skilled in the art through reference to particular embodiments. Detailed Implementation

[0063] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numbers in different drawings denote the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this application. Rather, they are merely examples of apparatuses and methods consistent with some aspects of this application as detailed in the appended claims.

[0064] As cyberattack countermeasures escalate, traditional one-way perimeter defense technologies are increasingly unable to meet enterprises' needs for advanced, unknown threats. Honeypots are a proactive network defense technology that uses tools to deceive attackers, allowing security personnel to observe them. From conception to implementation, honeypots began in 1998. In its early stages, this technology primarily used virtual operating systems and network services to deceive intruders. Honeypot deployment is mainly divided into proxy mode and agentless mode. Proxy mode primarily uses a combination of central and client components, with clients proxying traffic to the honeypot while using intermediate devices to monitor, block, and counterattack attacks. Agentless mode involves building completely simulated honeypots and deploying them directly within the honeynet. These honeypots directly face attackers, and monitoring and countermeasures are primarily implemented through the individual honeypots themselves. However, as networks become increasingly complex and attack-defense confrontations intensify, conventional honeypot deployments can no longer meet the needs of complex networks.

[0065] To address the aforementioned issues, this application provides a simplified and scalable honeypot deployment method, apparatus, equipment, and storage medium. Specifically, honeypot deployment involves proxying traffic to the honey farm via a client, while simultaneously using intermediate devices to monitor, block, and counterattack attacks. Alternatively, it involves constructing fully simulated honeypots and deploying them directly into the honeynet. These honeypots directly face attackers, and monitoring and countermeasures are primarily implemented through the individual honeypots themselves. Conventional deployment methods are complex, require specialized technical personnel, and large-scale deployments consume significant manpower and resources. Furthermore, real-time monitoring is impossible, and the simulation level is insufficient for effective trapping. Considering these problems, the inventors investigated whether Ansible could be used to scale up honeypot deployment, simplify operation, and provide real-time monitoring of honeypot status. By combining business understanding and threat awareness, a multi-dimensional honeypot simulation level can be provided to enhance honeypot realism. Based on this, the technical solution of this application is proposed.

[0066] Figure 1 An application scenario diagram of the honeypot deployment method provided in the embodiments of this application is shown, such as... Figure 1 As shown, the honeypot deployment method provided in this application is mainly applied to honeypot deployment scenarios. It mainly includes a honeypot deployment platform, which can be any electronic device capable of data processing and communication, such as a large server device. The platform is configured with an Ansible module for honeypot deployment, a monitoring module for honeypot monitoring, a pre-configured honeypot library and probe library, and a traffic spoofing module for spoofing access traffic. It can also be configured with a display screen for user operation. The user can operate the platform through a touch screen or through pre-defined controls. The specific operation method is not specifically limited in this application. All the above modules can achieve data communication, and the form of the above physical devices is not specifically limited.

[0067] The technical solution of this application and how the technical solution of this application solves the above-mentioned technical problems are described in detail below with specific embodiments. These specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described again in some embodiments. The embodiments of this application will now be described with reference to the accompanying drawings.

[0068] Figure 2 A flowchart illustrating an embodiment of the honeypot deployment method provided in this application is shown below. Figure 2 As shown in the embodiments of this application, the honeypot deployment method and platform specifically include:

[0069] S101: Receives honeypot deployment requests sent by users.

[0070] In this step, to achieve large-scale deployment of honeypots, users send honeypot deployment requests to the honeypot deployment platform through device operation. The honeypot deployment platform receives the honeypot deployment requests sent by users, which include the target probes selected by the users.

[0071] Specifically, users can send honeypot deployment requests directly through the honeypot deployment platform's display, or remotely via a third-party device using wireless signals. This application does not limit the specific method by which users send honeypot deployment requests to the platform. Users can select target probes from a probe library, which includes multiple pre-configured target probes. Users can select one or more target probes.

[0072] S102: Based on the honeypot deployment request, perform probe environment initialization and obtain the environment initialization result.

[0073] In this step, in order to improve the utilization rate of the target probe and make the method of this application more universal and more compatible, after receiving the honeypot deployment request sent by the user after the above steps, the probe environment of the target probe is initialized according to the honeypot deployment request to obtain the environment initialization result, which includes the initialized target probe.

[0074] Specifically, the environment initialization command is given to the ansible module, and the ansible module generates an environment initialization script based on the environment initialization command. The environment initialization script is then run on the target probe to obtain the environment initialization result.

[0075] S103: Obtain honeypots based on the environment initialization results and the preset honeypot database.

[0076] In this step, after initializing the target probe in the above steps, honeypots are obtained from a preset honeypot library based on the environment initialization results. The honeypot library includes multiple pre-configured honeypots.

[0077] Specifically, the ansible module is instructed to retrieve honeypots, and the ansible module retrieves honeypots from the honeypot repository based on the instructions. To achieve scalable honeypot deployment, multiple honeypots can be retrieved.

[0078] S104: Connect the honeypot to the disguised traffic and generate the honeypot service script.

[0079] In this step, to make the honeypot more realistic and thus more deceptive to attackers, the honeypot is connected to disguised traffic, thereby generating a honeypot service script for honeypot deployment. The honeypot service script includes a dynamic honeypot and a honeypot startup script.

[0080] Specifically, based on the honeypot, the dynamic parameters of the spoofed traffic are adjusted to generate a dynamic honeypot. Honeypot service instructions are deployed in the Ansible module, and honeypot service scripts are generated based on the dynamic honeypot and the honeypot service instructions.

[0081] S105: Controls the honeypot service script to run on the target probe after initialization.

[0082] In this step, the honeypot service script was generated in the previous steps. In order to simplify the honeypot deployment, the honeypot deployment platform controls the honeypot service script to run the target probe after initialization, thereby completing the honeypot deployment.

[0083] Specifically, the honeypot deployment platform sends honeypot service instructions to the Ansible module. The Ansible module generates a honeypot service script based on the instructions and the dynamic honeypot, and then sends the honeypot service script to the initialized target probe. The honeypot startup command in the honeypot service script is executed, deploying the dynamic honeypot in the honeypot service script to the initialized target probe and starting it for use.

[0084] The honeypot deployment method provided in this embodiment receives a honeypot deployment request sent by a user, initializes the probe environment according to the request, obtains the environment initialization result, acquires a honeypot based on the environment initialization result and a preset honeypot library, connects the honeypot to masquerading traffic, generates a honeypot service script, and controls the honeypot service script to run on the target probe after initialization. This method enables large-scale honeypot deployment, simplifies operation, allows real-time monitoring of honeypot status, and, combined with business understanding and threat awareness, provides multi-dimensional honeypot simulation, enhancing honeypot realism and achieving higher deception capabilities.

[0085] Figure 3 A flowchart illustrating a second embodiment of the honeypot deployment method provided in this application is shown below. Figure 3 As shown, based on the above embodiment one, step S104 specifically includes:

[0086] S1041: Based on the honeypot, adjust the dynamic parameters of the spoofed traffic to generate a dynamic honeypot.

[0087] In this step, to improve the simulation of the honeypot and make it more realistic, the honeypot is connected to spoofed traffic. Based on the honeypot, the dynamic parameters of the spoofed traffic are adjusted to generate a dynamic honeypot. The dynamic parameters include traffic size, request time, request frequency, etc. The dynamic parameters can be adjusted according to the actual system situation to make the honeypot more similar to the real operating system and increase the realism of the honeypot.

[0088] Specifically, the honeypot can be connected to the disguised traffic through any of the following methods: email system, information technology (IT) system, database service, application service, and web server service. This application does not limit the access method of the honeypot to the disguised traffic.

[0089] S1042: Command to deploy honeypot service in the ansible module.

[0090] In this step, after creating a dynamic honeypot by spoofing traffic through the steps described above, an Ansible module is configured to simplify deployment. Specifically, the honeypot deployment platform deploys honeypot service commands within the Ansible module. These commands include honeypot startup commands and can also include honeypot service monitoring. The Ansible module acts as an intermediary, receiving commands from the honeypot deployment platform and generating corresponding scripts. These scripts are then controlled to run on the target probe.

[0091] S1043: Generate honeypot service script based on dynamic honeypot and honeypot service instructions.

[0092] In this step, to simplify and scale honeypot deployment, after obtaining the dynamic honeypot in the above steps, a honeypot service script is generated based on the dynamic honeypot and the instructions for deploying the honeypot service in the ansible module.

[0093] Specifically, after receiving the honeypot service instructions from the honeypot deployment platform, the Ansible module, which has the function of simplifying deployment, translates the honeypot service instructions and dynamic honeypots into honeypot service scripts. These honeypot service scripts include honeypot startup scripts and dynamic honeypots, and may also include honeypot service monitoring scripts. The honeypot service scripts can be used to control the target probes after initialization to run scripts, thereby realizing the deployment, startup, and monitoring of the honeypot.

[0094] The honeypot deployment method provided in this embodiment adjusts the dynamic parameters of the spoofed traffic according to the honeypot to generate a dynamic honeypot, deploys honeypot service instructions in the Ansible module, and generates a honeypot service script based on the dynamic honeypot and the honeypot service instructions. By connecting the honeypot to the spoofed traffic, the honeypot becomes more realistic, improves the simulation degree of the honeypot, enhances the authenticity of the honeypot, and thus achieves a higher level of deception.

[0095] Figure 4 A flowchart illustrating a third embodiment of the honeypot deployment method provided in this application is shown below. Figure 4 As shown, based on the aforementioned embodiments, step S103 specifically includes:

[0096] S1031: Instruct the ansible module to retrieve honeypots, and then use the ansible module to retrieve honeypots from the honeypot repository according to the instructions.

[0097] In this step, in order to save manpower and resources, improve compatibility, and thus achieve large-scale honeypot deployment, the Ansible module is used to implement honeypot deployment, abandoning the traditional method of relying on other devices. The honeypot deployment platform directly issues instructions to the Ansible module to retrieve honeypots. According to the instructions, the Ansible module directly retrieves honeypots from the honeypot repository, which includes multiple pre-configured honeypots.

[0098] Specifically, the honeypot acquisition command includes the service name of the honeypot. The honeypot deployment platform can achieve batch honeypot deployment, so the honeypot acquired can be one or multiple. Based on the service name of the honeypot, the corresponding service name is searched in the honeypot database. After the corresponding service name is found, the corresponding honeypot is retrieved from the honeypot database.

[0099] The honeypot deployment method provided in this embodiment instructs the Ansible module to retrieve honeypots, and the Ansible module retrieves honeypots from the honeypot repository according to the honeypot retrieval instructions. By setting up the Ansible module, a large amount of physical equipment is saved, making honeypot deployment simpler and saving manpower and resources.

[0100] Figure 5 The flowchart of the honeypot deployment method embodiment four provided in this application is shown below. Figure 5 As shown, based on the aforementioned embodiments, step S102 specifically includes:

[0101] S1021: Instructs the ansible module to perform environment initialization commands and generates an environment initialization script based on the environment initialization commands through the ansible module.

[0102] In this step, in order to improve the utilization rate of the target probe resources and enhance compatibility, the target probe is preprocessed to initialize its probe environment.

[0103] Specifically, the honeypot deployment platform sends environment initialization instructions to the ansible module, which then translates these instructions into environment initialization scripts. These scripts include scripts for closing default ports on the deployment device, ensuring network connectivity, deleting residual installation packages, and shutting down irrelevant services.

[0104] S1022: The control environment initialization script runs on the target probe to obtain the environment initialization result.

[0105] In this step, after the environment initialization script is generated in the above steps, in order to initialize the probe environment, the Ansible module sends the environment initialization script to the target probe for execution, thereby realizing operations such as closing the default port of the deployment device, ensuring network connectivity, deleting residual installation packages, and shutting down irrelevant services. Finally, the environment initialization result is obtained, which includes the initialized target probe.

[0106] The honeypot deployment method provided in this embodiment instructs the Ansible module to perform environment initialization commands, and the Ansible module generates an environment initialization script based on the environment initialization commands. The environment initialization script is then run on the target probe to obtain the environment initialization result. By initializing the probe environment, the Ansible module compiles commands and distributes tasks, thereby improving the utilization rate of probe resources and making the method proposed in this application more practical and more compatible.

[0107] Figure 6 A flowchart illustrating Embodiment 5 of the honeypot deployment method provided in this application is shown below. Figure 6 As shown in the embodiments of this application, the honeypot deployment method further includes:

[0108] S106: Obtain the honeypot parameters provided in real time by the target probe after initialization.

[0109] In this step, to enable real-time monitoring of the honeypot status, a monitoring module is set up on the honeypot deployment platform. The honeypot service script also includes a honeypot service monitoring script. The honeypot deployment platform sends honeypot service monitoring instructions to the Ansible module. The Ansible module translates the honeypot service monitoring instructions into honeypot service monitoring scripts and distributes the honeypot service monitoring scripts to the initialized target probes. It controls the honeypot service monitoring scripts to run on the initialized target probes, thereby achieving real-time monitoring of the honeypot. The monitoring module obtains the honeypot parameters provided in real time by the initialized target probes, including health status, traffic, and probe performance.

[0110] Specifically, the honeypot service monitoring script runs in the target probe after initialization, which then pushes the honeypot parameters to Kafka. The parameters are then transmitted to the monitoring module of the honeypot deployment platform via the Flink channel. Kafka is a tool for processing mobile log information, while Flink can process streaming data.

[0111] S107: Generate real-time honeypot information based on honeypot parameters.

[0112] In this step, in order to enable users to understand the status of the target probe and honeypot after initialization in real time, and thus enable users to analyze the attacker's proactive network defense techniques, after obtaining the honeypot parameters, real-time honeypot information is generated based on the honeypot parameters and displayed on the screen for users to view. The real-time honeypot information includes the operating status of the honeypot and the target probe after initialization, network traffic, and attack information.

[0113] The honeypot deployment method provided in this embodiment obtains honeypot parameters provided in real time by the target probe, generates real-time honeypot information based on the honeypot parameters, monitors the honeypot status in real time, and aggregates the detection parameters into real-time information for users to view, enabling users to perceive attacker behavior more quickly.

[0114] Figure 7 A schematic diagram of the structure of the honeypot deployment device according to an embodiment of this application is shown below. Figure 7 As shown, the honeypot deployment device 200 includes:

[0115] The receiving module 201 is used to receive a honeypot deployment request sent by a user, which includes the target probe selected by the user.

[0116] The initialization module 202 is used to initialize the probe environment according to the honeypot deployment request and obtain the environment initialization result, which includes the initialized target probe.

[0117] The first acquisition module 203 is used to acquire honeypots based on the environment initialization results and a preset honeypot library, which includes multiple pre-configured honeypots.

[0118] The script generation module 204 is used to connect the honeypot to the disguised traffic and generate the honeypot service script, which includes dynamic honeypot and honeypot startup script.

[0119] The script execution module 205 is used to control the honeypot service script to run on the target probe after initialization.

[0120] Figure 8 A schematic diagram of the structure of the honeypot deployment device according to Embodiment 2 of this application is shown below. Figure 8 As shown, the script generation module 204 includes:

[0121] The dynamic adjustment unit 2041 is used to adjust the dynamic parameters of the spoofed traffic according to the honeypot to generate a dynamic honeypot.

[0122] The instruction deployment unit 2042 is used to deploy honeypot service instructions in the Ansible module. The honeypot service instructions include honeypot startup instructions. The Ansible module is set up internally by the honeypot deployment platform.

[0123] The script generation unit 2043 is used to generate honeypot service scripts based on dynamic honeypots and honeypot service instructions.

[0124] Figure 9 A schematic diagram of the structure of the honeypot deployment device according to Embodiment 3 of this application is shown below. Figure 9 As shown, the first acquisition module 203 includes:

[0125] The acquisition unit 2031 is used to instruct the ansible module to acquire honeypots, and the ansible module acquires honeypots from the honeypot repository according to the honeypot acquisition instructions. The honeypot acquisition instructions include the service name of the honeypot.

[0126] The honeypot deployment apparatus provided in this application embodiment allows the honeypot to access spoofed traffic via any one of the following methods: email system, information technology (IT) system, database service, application service, and web server service.

[0127] Figure 10 A schematic diagram of the structure of the honeypot deployment device according to embodiment four of this application is shown below. Figure 10 As shown, the initialization module 202 includes:

[0128] The script generation unit 2021 is used to instruct the Ansible module on environment initialization instructions, and the Ansible module generates environment initialization scripts based on the environment initialization instructions. The environment initialization scripts include scripts for closing the default ports of the deployment device, scripts for ensuring network connectivity, scripts for deleting residual installation packages, and scripts for closing irrelevant services.

[0129] The script execution unit 2022 is used to control the environment initialization script to run on the target probe and obtain the environment initialization result.

[0130] Figure 11 A schematic diagram of the structure of the honeypot deployment device according to embodiment five of this application is shown below. Figure 11 As shown, the honeypot deployment device 200 also includes:

[0131] The second acquisition module 206 is used to acquire the honeypot parameters provided in real time by the target probe after initialization. The honeypot parameters include health status, traffic, and probe performance.

[0132] The information generation module 207 is used to generate real-time honeypot information based on honeypot parameters. The real-time honeypot information includes the running status of the honeypot and the initialized target probe, network traffic, and attack information.

[0133] The honeypot deployment apparatus provided in this embodiment is used to execute the honeypot deployment method in any of the aforementioned method embodiments. Its implementation principle and technical effect are similar, and will not be described again here.

[0134] Figure 12 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Figure 12 As shown, the electronic device 300 includes: a memory 301, a processor 302, and a display 303;

[0135] Memory 301 stores computer-executed instructions.

[0136] The processor 302 executes computer execution instructions stored in the memory 301 to implement the technical solutions in any of the above embodiments.

[0137] Display 303 is used to display real-time information about the honeypot.

[0138] It should be understood that the processor can be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), etc. A general-purpose processor can be a microprocessor or any conventional processor. The steps of the method disclosed in this application can be directly manifested as being executed by a hardware processor, or executed by a combination of hardware and software modules within the processor.

[0139] All or part of the steps in the above method embodiments can be implemented by hardware related to program instructions. The aforementioned program can be stored in a readable memory. When the program is executed, it performs the steps of the above method embodiments; and the aforementioned memory (storage medium) includes: read-only memory (ROM), RAM, flash memory, hard disk, solid-state drive, magnetic tape, floppy disk, optical disk, and any combination thereof.

[0140] The electronic device provided in this application embodiment is used to execute the technical solution in any of the foregoing method embodiments. Its implementation principle and technical effect are similar, and will not be repeated here.

[0141] This application also provides a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, are used to implement the method in any of the embodiments.

[0142] The aforementioned readable storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory, electrically erasable programmable read-only memory, erasable programmable read-only memory, programmable read-only memory, read-only memory, magnetic storage, flash memory, magnetic disk, or optical disk. The readable storage medium can be any available medium accessible to a general-purpose or special-purpose computer.

[0143] Optionally, a readable storage medium can be coupled to the processor, enabling the processor to read information from and write information to the readable storage medium. Alternatively, the readable storage medium can be an integral part of the processor. The processor and the readable storage medium can reside in an Application Specific Integrated Circuit (ASIC). Alternatively, the processor and the readable storage medium can exist as discrete components in the device.

[0144] This application also provides a computer program product, which includes a computer program stored in a computer-readable storage medium. At least one processor can read the computer program from the computer-readable storage medium, and when the at least one processor executes the computer program, it can implement the technical solutions provided in any of the above method embodiments.

[0145] Other embodiments of this application will readily occur to those skilled in the art upon consideration of the specification and practice of the invention disclosed herein. This application is intended to cover any variations, uses, or adaptations of this application that follow the general principles of this application and include common knowledge or customary techniques in the art not disclosed herein. The specification and examples are to be considered exemplary only, and the true scope and spirit of this application are indicated by the following claims.

[0146] It should be understood that this application is not limited to the precise structure described above and shown in the accompanying drawings, and various modifications and changes can be made without departing from its scope. The scope of this application is limited only by the appended claims.

Claims

1. A method for deploying honeypots, characterized in that, Applications to honeypot deployment platforms include: Receive a honeypot deployment request sent by a user, wherein the honeypot deployment request includes the target probe selected by the user; Based on the honeypot deployment request, the target probe is initialized with an environment initialization command. The environment initialization command is sent to the Ansible module, and the Ansible module generates an environment initialization script based on the environment initialization command. The environment initialization script includes a script to close the default port of the deployment device, a script to ensure network connectivity, a script to delete residual installation packages, and a script to close irrelevant services. The Ansible module is set up internally by the honeypot deployment platform. The environment initialization script is controlled to run on the target probe to obtain the environment initialization result, which includes the initialized target probe. Based on the environment initialization results and the preset honeypot library, honeypots are obtained, and the honeypot library includes multiple pre-configured honeypots; The honeypot is connected to the spoofed traffic, and the dynamic parameters of the spoofed traffic are adjusted according to the honeypot to generate a dynamic honeypot; the dynamic parameters include traffic size, request time, and request frequency. Generate a honeypot service script based on the dynamic honeypot and honeypot service instructions; The honeypot service script is controlled to run on the target probe after initialization.

2. The method according to claim 1, characterized in that, The honeypot service script includes a honeypot startup script. The process of generating the honeypot service script based on the dynamic honeypot and honeypot service instructions includes: Deploy honeypot service instructions in the Ansible module, the honeypot service instructions including honeypot startup instructions; Based on the dynamic honeypot and the honeypot service instructions, the honeypot service script is generated.

3. The method according to claim 2, characterized in that, The step of obtaining honeypots from a pre-defined honeypot repository based on the honeypot deployment request includes: The Ansible module is instructed to retrieve the honeypot, and the Ansible module retrieves the honeypot from the honeypot repository according to the honeypot retrieval instruction. The honeypot retrieval instruction includes the service name of the honeypot.

4. The method according to any one of claims 1 to 3, characterized in that, The access methods for connecting the honeypot to the disguised traffic include any one of email systems, IT systems, database services, application services, and web services on website servers.

5. The method according to claim 1, characterized in that, The honeypot service script also includes a honeypot service monitoring script, and the method further includes: Obtain the honeypot parameters provided in real time by the initialized target probe, including health status, traffic, and probe performance; Real-time honeypot information is generated based on the honeypot parameters. The real-time honeypot information includes the operating status of the honeypot and the initialized target probe, network traffic, and attack information.

6. A device for deploying honeypots, characterized in that, include: A receiving module is used to receive a honeypot deployment request sent by a user, wherein the honeypot deployment request includes the target probe selected by the user; An initialization module is used to initialize the environment of the target probe according to the honeypot deployment request, instruct the Ansible module to perform environment initialization commands, and generate an environment initialization script through the Ansible module according to the environment initialization commands. The environment initialization script includes a script for closing the default port of the deployment device, a script for ensuring network connectivity, a script for deleting residual installation packages, and a script for closing irrelevant services. The Ansible module is set up internally by the honeypot deployment platform. The environment initialization script is controlled to run on the target probe to obtain the environment initialization result, which includes the initialized target probe. The first acquisition module is used to acquire honeypots based on the environment initialization result and a preset honeypot library, wherein the honeypot library includes multiple pre-configured honeypots. The script generation module is used to connect the honeypot to the spoofed traffic, and adjust the dynamic parameters of the spoofed traffic according to the honeypot to generate a dynamic honeypot; The dynamic parameters include traffic volume, request time, and request frequency; Based on the dynamic honeypot and honeypot service instructions, generate a honeypot service script; The script execution module is used to control the honeypot service script to run on the target probe after initialization.

7. The apparatus according to claim 6, characterized in that, The honeypot service script includes a honeypot startup script, and the script generation module includes: The instruction deployment unit is used to deploy honeypot service instructions in the Ansible module, the honeypot service instructions including honeypot startup instructions; The script generation unit is used to generate the honeypot service script based on the dynamic honeypot and the honeypot service instructions.

8. The apparatus according to claim 7, characterized in that, The first acquisition module includes: The acquisition unit is used to instruct the Ansible module to acquire the honeypot, and the Ansible module acquires the honeypot from the honeypot repository according to the honeypot acquisition instruction. The honeypot acquisition instruction includes the service name of the honeypot.

9. The apparatus according to any one of claims 6 to 8, characterized in that, The access methods for connecting the honeypot to the disguised traffic include any one of email systems, IT systems, database services, application services, and web services on website servers.

10. The apparatus according to claim 6, characterized in that, The honeypot service script also includes a honeypot service monitoring script, and the device further includes: The second acquisition module is used to acquire the honeypot parameters provided in real time by the initialized target probe. The honeypot parameters include health status, traffic, and probe performance. The information generation module is used to generate real-time information about the honeypot based on the honeypot parameters. The real-time information about the honeypot includes the operating status of the honeypot and the initialized target probe, network traffic, and attack information.

11. An electronic device, characterized in that, include: Memory, processor, display; The memory stores computer-executed instructions; The processor executes computer execution instructions stored in the memory to implement the method as described in any one of claims 1 to 5.

12. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer-executable instructions, which, when executed by a processor, are used to implement the honeypot deployment method as described in any one of claims 1 to 5.

Images