Honeypot deployment method and device based on ant colony algorithm model and electronic equipment

Abstract

This invention discloses a honeypot deployment method, apparatus, and electronic device based on an ant colony algorithm model, relating to the fields of information security, artificial intelligence, or other related technical fields. The honeypot deployment method includes: constructing M target honeypots and setting an initial position for each target honeypot, obtaining honeypot information and an initial position for each target honeypot; inputting the honeypot information and initial position of each target honeypot into an ant colony algorithm model, outputting the target position to be deployed for each target honeypot; drawing a honeypot deployment map based on the target positions to be deployed for each target honeypot, and deploying the M target honeypots to the target network based on the honeypot deployment map. This invention solves the technical problems of low deployment efficiency and high maintenance costs associated with manually deploying honeypots in a target network to capture network attackers' attack behavior.

Description

Technical Field

[0001] This invention relates to the fields of information security, artificial intelligence, or other related technical fields. Specifically, it relates to a honeypot deployment method, apparatus, and electronic device based on an ant colony algorithm model. Background Technology

[0002] In network security protection, decoy hosts, network services, or network information are typically deployed to lure attackers into launching attacks. This allows for the capture and analysis of attack behavior, understanding the tools and methods used by the attackers, and inferring their intentions and motives. This enables defenders to clearly understand the security threats they face and enhance the security protection capabilities of the target system through technical and management measures. The process of deploying decoy hosts, network services, or network information on the target network is called honeypot deployment technology. Honeypot deployment technology can capture malicious attack behavior and improve system security.

[0003] Honeypot deployment mainly includes the following deployment methods: physical honeypots, network honeypots, virtual honeypots, and client-side honeypots. By simulating the vulnerabilities and behaviors of various real systems or services, they can lure attackers to attack and effectively obtain attacker information. In related technologies, honeypot deployment is based on the work experience of business personnel and is done manually. Steps such as determining the location of the honeypot, installing the honeypot software, configuring the honeypot, starting the honeypot, monitoring the honeypot, analyzing the honeypot data, and updating the honeypot all require human support, resulting in low deployment efficiency and high maintenance costs. Furthermore, honeypots deployed based on work experience cannot guarantee accurate capture of the attacker's attack behavior.

[0004] There is currently no effective solution to the above problems. Summary of the Invention

[0005] This invention provides a honeypot deployment method, apparatus, and electronic device based on an ant colony algorithm model, to at least solve the technical problems of low deployment efficiency and high maintenance cost in related technologies where honeypots are manually deployed in a target network to capture network attackers' attack behavior.

[0006] According to one aspect of the present invention, a honeypot deployment method based on an ant colony algorithm model is provided, comprising: constructing M target honeypots and setting an initial position for each target honeypot, obtaining honeypot information and the initial position corresponding to each target honeypot, wherein a honeypot refers to a decoy set up to counter network attacks, and M is a positive integer; inputting the honeypot information and the initial position of each target honeypot into the ant colony algorithm model, and outputting the target position to be deployed for each target honeypot, wherein the ant colony algorithm model iteratively calculates based on the ant colony algorithm to obtain the target position to be deployed for each target honeypot; drawing a honeypot deployment map based on the target position to be deployed for each target honeypot, and deploying the M target honeypots to a target network based on the honeypot deployment map.

[0007] Optionally, the ant colony algorithm model is pre-built. The steps of building the ant colony algorithm model include: determining the target network where honeypots are to be deployed, and scanning the target network to obtain the network topology and the network topology information corresponding to the network topology, wherein the network topology contains N network nodes where honeypots can be deployed, where N is a positive integer and N is greater than M; and building the ant colony algorithm model based on the network topology information.

[0008] Optionally, after inputting the honeypot information and initial position of each target honeypot into the ant colony algorithm model, the method further includes: initializing the pheromone value of each path in the network topology, wherein the connection between every two network nodes constitutes a path; selecting M ants based on the M target honeypots and randomly placing the M ants in the network topology; and deploying the M target honeypots in the network topology based on their initial positions.

[0009] Optionally, after deploying the M target honeypots in the network topology based on their initial positions, the method further includes: calculating the selection probability value of each ant choosing each adjacent network node based on the pheromone value; and determining the travel path of each ant in the network topology based on the selection probability value.

[0010] Optionally, after randomly placing the M ants in the network topology, the method further includes: constructing a node list for each ant based on the initial position of the M ants in the network topology, wherein the node list is used to store the network nodes that each ant has visited; and updating the node list based on the travel path of each ant.

[0011] Optionally, after determining the travel path of each ant in the network topology based on the selection probability value, the method further includes: calculating the pheromone value of each ant traversing each path in the travel path to obtain a pheromone value set; performing iterative calculation based on the ant colony algorithm, and updating the pheromone value set calculated in each iteration until the number of iterations reaches a preset threshold, stopping the iteration, and using the pheromone value set calculated in the last iteration as the target pheromone value set. Optionally, the formula for calculating the pheromone value is expressed as: Where, τ ij (t+1) represents the pheromone value of path (ij) at the end of the (t+1)th iteration, τ ij (t) represents the pheromone value of path (ij) at the end of the t-th iteration, ρ is a constant between 0 and 1, (1-ρ) represents the evaporation factor, and m represents the number of consecutive convergences. Denotes the continuously convergent value, where c is a constant, and Δτ ij Let Δτ represent the amount of pheromone left by the ant on path (ij) during the t-th iteration. ij =1 / d ij ,d ij τ represents the length of the path (ij). c A preset pheromone threshold is set based on the maximum pheromone value in the (t-1)th iteration during the iteration process.

[0012] Optionally, after using the set of pheromone values ​​obtained from the last iteration as the target pheromone value set, the method further includes: sorting the target pheromone value set to obtain a target pheromone list; determining a pheromone threshold based on the M target honeypots, and selecting the target pheromone values ​​in the target pheromone list that are greater than the pheromone threshold; determining the optimal path in the network topology based on the selected target pheromone values, and obtaining the target network nodes involved in the optimal path; using the target network nodes as the target locations to be deployed for the target honeypots, to obtain a target location set for the M target honeypots, wherein the target location set includes the target location to be deployed for each target honeypot.

[0013] Optionally, after deploying the M target honeypots to the target network based on the honeypot deployment map, the method further includes: calling a monitoring module to monitor the M target honeypots and obtaining monitoring logs; determining the operating status of each target honeypot based on the monitoring logs; and generating a honeypot update instruction if the operating status of a target honeypot does not meet preset conditions, wherein the honeypot update instruction is used to update the honeypot deployment map.

[0014] According to another aspect of the present invention, a honeypot deployment device based on an ant colony algorithm model is also provided, comprising: a construction unit, configured to construct M target honeypots, and set an initial position for each target honeypot, obtaining honeypot information and the initial position corresponding to each target honeypot, wherein a honeypot refers to a decoy set up to counter network attacks, and M is a positive integer; an output unit, configured to input the honeypot information and the initial position of each target honeypot into the ant colony algorithm model, and output the target position to be deployed for each target honeypot, wherein the ant colony algorithm model iteratively calculates based on the ant colony algorithm to obtain the target position to be deployed for each target honeypot; and a deployment unit, configured to draw a honeypot deployment map based on the target position to be deployed for each target honeypot, and deploy the M target honeypots to a target network based on the honeypot deployment map.

[0015] Optionally, the honeypot deployment device based on the ant colony algorithm model further includes: a first scanning module, used to determine the target network to which the honeypot is to be deployed, and to scan the target network to obtain the network topology and the network topology information corresponding to the network topology, wherein the network topology contains N network nodes that can deploy honeypots, where N is a positive integer and N is greater than M; and a first construction module, used to construct an ant colony algorithm model based on the network topology information.

[0016] Optionally, the honeypot deployment device based on the ant colony algorithm model further includes: a first initialization module, used to initialize the pheromone value of each path in the network topology, wherein the connection between every two network nodes is a path; a first selection module, used to select M ants based on the M target honeypots and randomly place the M ants in the network topology; and a first deployment module, used to deploy the M target honeypots in the network topology based on the initial positions of the M target honeypots.

[0017] Optionally, the honeypot deployment device based on the ant colony algorithm model further includes: a first calculation module, used to calculate the selection probability value of each ant choosing each adjacent network node based on the pheromone value; and a first determination module, used to determine the travel path of each ant in the network topology based on the selection probability value.

[0018] Optionally, the honeypot deployment device based on the ant colony algorithm model further includes: a second construction module, used to construct a node list for each ant based on the initial positions of the M ants in the network topology, wherein the node list is used to store the network nodes that each ant has visited; and a first update module, used to update the node list based on the travel path of each ant.

[0019] Optionally, the honeypot deployment device based on the ant colony algorithm model further includes: a second calculation module, used to calculate the pheromone value of each ant on each path in the travel path to obtain a pheromone value set; and a second update module, used to perform iterative calculation based on the ant colony algorithm and update the pheromone value set calculated in each iteration until the number of iterations reaches a preset threshold, at which point the iteration stops, and the pheromone value set calculated in the last iteration is used as the target pheromone value set.

[0020] Optionally, the formula for calculating pheromone values ​​is expressed as follows: Where, τ ij (t+1) represents the pheromone value of path (ij) at the end of the (t+1)th iteration, τ ij (t) represents the pheromone value of path (ij) at the end of the t-th iteration, ρ is a constant between 0 and 1, (1-ρ) represents the evaporation factor, and m represents the number of consecutive convergences. Denotes the continuously convergent value, where c is a constant, and Δτ ij Let Δτ represent the amount of pheromone left by the ant on path (ij) during the t-th iteration. ij =1 / d ij ,d ij τ represents the length of the path (ij). c A preset pheromone threshold is set based on the maximum pheromone value in the (t-1)th iteration during the iteration process.

[0021] Optionally, the honeypot deployment device based on the ant colony algorithm model further includes: a first sorting module, used to sort the target pheromone value set to obtain a target pheromone list; a second selection module, used to determine a pheromone threshold based on the M target honeypots, and select the target pheromone values ​​in the target pheromone list that are greater than the pheromone threshold; a first acquisition module, used to determine the optimal path in the network topology based on the selected target pheromone values, and acquire the target network nodes involved in the optimal path; and a first assignment module, used to use the target network nodes as the target locations to be deployed for the target honeypots, to obtain a target location set for the M target honeypots, wherein the target location set includes the target location to be deployed for each target honeypot.

[0022] Optionally, the honeypot deployment device based on the ant colony algorithm model further includes: a first invocation module, used to invoke the monitoring module to monitor the M target honeypots and obtain monitoring logs; and a first generation module, used to determine the operating status of each target honeypot based on the monitoring logs, and generate a honeypot update instruction if the operating status of the target honeypot does not meet preset conditions, wherein the honeypot update instruction is used to update the honeypot deployment map.

[0023] According to another aspect of the present invention, a computer-readable storage medium is also provided, the computer-readable storage medium including a stored computer program, wherein, when the computer program is executed, it controls the device where the computer-readable storage medium is located to execute any of the honeypot deployment methods based on the ant colony algorithm model described above.

[0024] According to another aspect of the present invention, an electronic device is also provided, including one or more processors and a memory, the memory being used to store one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors cause the one or more processors to implement any of the above-described honeypot deployment methods based on the ant colony algorithm model.

[0025] In this disclosure, the following steps are performed: First, M target honeypots are constructed, and an initial position is set for each target honeypot to obtain the honeypot information and initial position corresponding to each target honeypot. Here, a honeypot refers to a decoy set up to deal with network attacks, and M is a positive integer. Then, the honeypot information and initial position of each target honeypot are input into the ant colony algorithm model to output the target position to be deployed for each target honeypot. The ant colony algorithm model performs iterative calculations based on the ant colony algorithm to obtain the target position to be deployed for each target honeypot. Finally, a honeypot deployment map is drawn based on the target position to be deployed for each target honeypot, and the M target honeypots are deployed to the target network based on the honeypot deployment map.

[0026] In this disclosure, when deploying honeypots in a target network, the initial location of the target honeypot is input into an ant colony algorithm model. The optimal location of the honeypot is calculated using a pre-built ant colony algorithm model. The ant colony algorithm model iteratively calculates the optimal travel path of ants in the network topology, thereby obtaining the deployment location of the target honeypot. Finally, based on the drawn honeypot deployment map, the target honeypot is deployed in the target network. The target honeypot captures and analyzes the attacker's attack behavior, improving network security. The intelligent deployment of honeypots is achieved based on the ant colony algorithm model, obtaining the optimal deployment scheme through iterative calculation. No manual deployment is required, improving the efficiency and accuracy of honeypot deployment and reducing maintenance costs. This solves the technical problems of low deployment efficiency and high maintenance costs in related technologies that rely on manual deployment of honeypots in the target network to capture network attackers' attack behavior. Attached Figure Description

[0027] The accompanying drawings, which are included to provide a further understanding of the invention and form part of this application, illustrate exemplary embodiments of the invention and, together with their description, serve to explain the invention and do not constitute an undue limitation thereof. In the drawings:

[0028] Figure 1 This is a flowchart of an optional honeypot deployment method based on an ant colony algorithm model according to an embodiment of the present invention;

[0029] Figure 2 This is a schematic diagram of an optional honeypot deployment system according to an embodiment of the present invention;

[0030] Figure 3 This is a schematic diagram of an optional honeypot deployment process based on an ant colony algorithm model according to an embodiment of the present invention;

[0031] Figure 4 This is a schematic diagram of an optional honeypot deployment device based on an ant colony algorithm model according to an embodiment of the present invention;

[0032] Figure 5 This is a hardware structure block diagram of an electronic device (or mobile device) based on an ant colony algorithm model for honeypot deployment according to an embodiment of the present invention. Detailed Implementation

[0033] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0034] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0035] To facilitate understanding of the present invention by those skilled in the art, some terms or nouns involved in the various embodiments of the present invention are explained below:

[0036] Honeypots are a technique used to deceive attackers. By deploying decoy hosts, network services, or information (collectively referred to as honeypots), attackers are lured into launching attacks. This allows attackers to capture and analyze the attack behavior, understand the tools and methods used by the attackers, and infer their attack intentions and motives.

[0037] Ant colony optimization (ACO) is a probabilistic algorithm used to find optimal paths. It calculates paths by simulating the behavior of ants finding paths while searching for food.

[0038] A web server is a software or hardware device used to store, process, and transmit web resources (such as web pages, images, documents, etc.).

[0039] A DNS server (Domain Name System Server) is a server used to resolve the mapping relationship between domain names and IP addresses.

[0040] It should be noted that the honeypot deployment method and apparatus based on the ant colony algorithm model in this disclosure can be used in the field of information security to deploy honeypots based on the ant colony algorithm model to capture network attack behavior, and can also be used in any field other than information security to deploy honeypots based on the ant colony algorithm model to capture network attack behavior. This disclosure does not limit the application field of the honeypot deployment method and apparatus based on the ant colony algorithm model.

[0041] It should be noted that all information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, and displayed data) disclosed herein are information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, use, and processing of such data must comply with the relevant laws, regulations, and standards of the relevant countries and regions, and corresponding access points are provided for users to choose to authorize or refuse. For example, this system has interfaces with relevant users or organizations. Before obtaining relevant information, a request to obtain the information must be sent to the aforementioned user or organization through the interface, and the relevant information will be obtained only after receiving consent from the aforementioned user or organization.

[0042] The following embodiments of the present invention can be applied to various honeypot deployment systems / applications / devices. The present invention utilizes an adaptive ant colony algorithm to automatically deploy and optimize honeypots in a target network, improving honeypot deployment efficiency, reliability, and stability. The adaptive ant colony algorithm simulates the process of ants releasing and following pheromones while searching for food, iteratively finding the optimal solution to obtain the best honeypot deployment location, thereby effectively capturing attackers' attack behaviors.

[0043] The present invention will now be described in detail with reference to various embodiments.

[0044] Example 1

[0045] According to an embodiment of the present invention, an embodiment of a honeypot deployment method based on an ant colony algorithm model is provided. It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions. Furthermore, although a logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in a different order than that shown here.

[0046] Figure 1 This is a flowchart of an optional honeypot deployment method based on an ant colony algorithm model according to an embodiment of the present invention, such as... Figure 1 As shown, the method includes the following steps:

[0047] Step S101: Construct M target honeypots and set an initial position for each target honeypot to obtain the honeypot information and initial position corresponding to each target honeypot. Here, a honeypot refers to a decoy set up to deal with network attacks, and M is a positive integer.

[0048] Step S102: Input the honeypot information and initial location of each target honeypot into the ant colony algorithm model, and output the target location to be deployed for each target honeypot. The ant colony algorithm model performs iterative calculations based on the ant colony algorithm to obtain the target location to be deployed for each target honeypot.

[0049] Step S103: Draw a honeypot deployment map based on the target location of each target honeypot to be deployed, and deploy M target honeypots to the target network based on the honeypot deployment map.

[0050] Through the above steps, M target honeypots are first constructed, and an initial position is set for each target honeypot, obtaining the honeypot information and initial position corresponding to each target honeypot. Here, a honeypot refers to a decoy set up to deal with network attacks, and M is a positive integer. Then, the honeypot information and initial position of each target honeypot are input into the ant colony algorithm model, which outputs the target position to be deployed for each target honeypot. The ant colony algorithm model performs iterative calculations based on the ant colony algorithm to obtain the target position to be deployed for each target honeypot. Finally, a honeypot deployment map is drawn based on the target positions to be deployed for each target honeypot, and the M target honeypots are deployed to the target network based on the honeypot deployment map.

[0051] In this embodiment, when deploying honeypots in the target network, the initial location of the target honeypot is input into the ant colony algorithm model. The optimal location of the honeypot is calculated using the pre-built ant colony algorithm model. The ant colony algorithm model iteratively calculates the optimal travel path of ants in the topological network structure through ant colony algorithm, thereby obtaining the deployment location of the target honeypot. Finally, based on the drawn honeypot deployment map, the target honeypot is deployed in the target network. The target honeypot captures and analyzes the attacker's attack behavior, improving network security. The intelligent deployment of honeypots is achieved based on the ant colony algorithm model. The optimal deployment scheme is obtained through iterative calculation, eliminating the need for manual deployment. This improves the efficiency and accuracy of honeypot deployment, reduces maintenance costs, and solves the technical problems of low deployment efficiency and high maintenance costs in related technologies that rely on manual deployment of honeypots in the target network to capture network attackers' attack behavior.

[0052] The embodiments of the present invention will now be described in detail with reference to the steps described above.

[0053] It should be noted that the implementation subject of this invention is a honeypot deployment system. This honeypot deployment system uses an ant colony algorithm model to simulate the process of ants releasing pheromones and following pheromones when searching for food. By iterating multiple times to find the optimal solution, the best deployment location of the honeypot is obtained, thereby effectively capturing the attacker's attack behavior.

[0054] It should be noted that honeypot deployment technology uses decoy hosts, network services, or information to lure attackers into attacking them. This allows for the capture and analysis of attack behavior, understanding the tools and methods used by the attackers, and inferring their attack intentions and motives. This enables defenders to clearly understand the security threats they face and enhance the security protection capabilities of their network systems through technical and management means.

[0055] It should be noted that honeypot deployment can include the following methods: First, physical honeypots. This deployment technology involves setting up a honeypot system on real physical hardware. Physical honeypots can simulate real systems, attract attackers to launch attacks, and monitor and record attack behavior. Physical honeypots require specialized hardware and secure isolation and protection. Second, virtual honeypots. Virtual honeypot technology uses virtualization technology to create honeypots in a virtual environment. This deployment technology is more flexible and scalable, allowing multiple virtual honeypot instances to run on a single physical server. Virtual honeypots can also be deployed in cloud environments to save costs and management complexity. Third, network honeypots. Network honeypot deployment technology involves setting up a honeypot system in a network to attract and monitor attackers' network traffic. Network honeypots can detect and analyze attack behavior by monitoring network traffic and provide... Fourth, high-interaction honeypots: High-interaction honeypots are a type of honeypot technology that simulates complete systems and services to attract attackers to interact with the honeypot. This deployment technology usually requires more resources and management work, but it can provide more information about attacker behavior. Fifth, low-interaction honeypots: Low-interaction honeypots are a relatively lightweight honeypot deployment technology that captures attacker behavior by simulating some key services and system components, such as web servers or DNS servers. Low-interaction honeypots can be created using virtualization technology and usually do not involve real operating systems or applications. Sixth, middleware honeypots: Middleware honeypot technology is a honeypot deployment targeting certain middleware or applications. For example, a virtual database server can be set up to attract attackers to attack the database.

[0056] It should be noted that in existing technologies, deploying honeypots in a target network is often done manually. Steps such as determining honeypot locations, installing software, configuring, starting, monitoring, analyzing data, and updating honeypots rely heavily on the experience of personnel and lack professional expertise. Honeypot deployment strategies need to be configured based on attacker behavior to more accurately capture network attacks. This invention employs an ant colony algorithm, simulating attacker access paths by calculating the ant colony's travel paths, and then deploying target honeypots on nodes along those paths to accurately obtain attacker information.

[0057] It should be noted that the ant colony algorithm is a probabilistic algorithm used to find optimal paths. It seeks the optimal solution by simulating the behavior of ants finding paths in the process of searching for food. It has the characteristics of distributed computing, positive feedback of information and heuristic search. In essence, it is a heuristic global optimization algorithm. Before deploying the target honeypot, an ant colony algorithm model needs to be built first.

[0058] Optionally, the ant colony algorithm model is pre-built. The steps for building the ant colony algorithm model include: determining the target network where honeypots are to be deployed, and scanning the target network to obtain the network topology and the network topology information corresponding to the network topology. The network topology contains N network nodes where honeypots can be deployed, where N is a positive integer and N is greater than M; and building the ant colony algorithm model based on the network topology information.

[0059] It should be noted that when building the ant colony algorithm model, the target network for deploying honeypots needs to be determined first, and the target network needs to be scanned to obtain the topology and related information of the target network. Then, the ant colony algorithm model is built based on the network topology information. This is equivalent to deploying a network map in the ant colony algorithm model and obtaining the honeypot deployment location by simulating the foraging process of ants on the map.

[0060] It should be noted that the network topology of the ant colony algorithm model is the same as that of a real network. There are many network nodes in the network topology, and the connection between every two network nodes forms a path. When ants walk in the network topology, they often visit multiple paths, forming a circumnavigation path. The circumnavigation path involves many network nodes. Each network node in the network topology can be used as a honeypot deployment location. However, deploying a honeypot on every node is not only costly but also not very meaningful. Therefore, in order to effectively obtain the attacker's attack information, it is necessary to calculate the target honeypot and select the most suitable deployment location.

[0061] It should be noted that network topology information is used to indicate the connection relationships between various nodes in a network, and may include the following information: node information, i.e., the various devices or hosts in the target network, such as computers, routers, switches, etc.; connection information, identifying the physical or logical connections between nodes, such as Ethernet, wireless connections, fiber optic connections, etc.; network address information, i.e., the unique identifier of each node in the network, such as IP address, MAC address, etc.; and routing information, used to describe the routing relationships between nodes, including router tables, routing protocols, etc.

[0062] It should be noted that after constructing the ant colony algorithm model, the ant's travel route is simulated by the network topology results in the model, and the pheromone value is iteratively calculated to obtain the target pheromone set. Based on the target pheromone set, the optimal deployment location of the target honeypot is determined. The rule of the ant colony algorithm is that there is no direct relationship between ants, but each ant interacts with the environment. Through the link of pheromones, the ants are actually connected. For example, when an ant finds food, it does not need to tell other ants that there is food, but instead spreads pheromones to the environment. When other ants pass by, they can sense the presence of pheromones and then obtain food according to the guidance of pheromones. In this embodiment of the invention, ants can be used to indicate attackers in the actual environment. Pheromones actually refer to the information released by honeypots deployed in the target network, such as whether the current node is the location of a honeypot, the distance between the current node and the honeypot node, etc. Pheromones are calculated based on this information. When the pheromone value on a certain path is larger, ants are more likely to visit that path, which means that the attacker is more likely to attack the target network based on that path.

[0063] Step S101: Construct M target honeypots and set an initial position for each target honeypot, obtaining the honeypot information and initial position corresponding to each target honeypot.

[0064] It should be noted that during the honeypot deployment process, M target honeypots need to be created first according to actual needs. Then, the deployment range is determined based on the pre-obtained network topology information. Subsequently, an initial location is created for each target honeypot based on the deployment range, and the honeypot information and initial location of each honeypot are obtained.

[0065] Step S102: Input the honeypot information and initial location of each target honeypot into the ant colony algorithm model, and output the target location to be deployed for each target honeypot.

[0066] It should be noted that after the initial location and honeypot information of the target honeypot are input into the ant colony algorithm model, the model will perform simulation calculations based on the initial location of the target honeypot, and perform iterative calculations through the adaptive ant colony algorithm to continuously adjust the deployment location of the target honeypot, and finally obtain and output the optimal location for honeypot deployment (i.e., the target location).

[0067] Optionally, after inputting the honeypot information and initial position of each target honeypot into the ant colony algorithm model, the algorithm further includes: initializing the pheromone value of each path in the network topology, wherein the connection between every two network nodes is a path; selecting M ants based on the M target honeypots and randomly placing the M ants in the network topology; and deploying the M target honeypots in the network topology based on their initial positions.

[0068] It should be noted that after inputting the honeypot information and initial location of the target honeypot into the ant colony algorithm model, the model initializes the pheromone value of each path in the structure map based on the pre-created network topology. The network topology contains many network nodes, each of which can serve as a honeypot deployment location. These nodes are interconnected, and adjacent nodes form a path. The initial pheromone value is equal on all paths, and can be τ0 = M / L. m Where M is the total number of ants, L m This represents the path length constructed based on the nearest neighbor heuristic.

[0069] It should be noted that after initializing the pheromone value of each path, M ants are selected based on the number of target honeypots, and these M ants are randomly placed in the network topology. At the same time, based on the input honeypot information and the initial position of the target honeypots, M target honeypots are placed in the network topology.

[0070] Optionally, after deploying the M target honeypots in the network topology based on their initial positions, the method further includes: calculating the selection probability value of each ant choosing each adjacent network node based on the pheromone value; and determining the circumvention path of each ant in the network topology based on the selection probability value.

[0071] It should be noted that in simulating the foraging process of ants, the ant starts from its initial position and determines its travel path by calculating the selection probability values ​​between its current position and neighboring network nodes. The formula for calculating the selection probability value is: in, Let τ represent the probability of the k-th ant choosing path (ij). ij (t) represents the pheromone value of path (ij), η ij =1 / d ij Let d be the heuristic factor from node i to node j. ij a represents the distance from node i to node j. k Let α be the set of nodes that ant k is allowed to visit next (the node list stores the network nodes that the ant has already visited, i.e., the network nodes that are not allowed to visit). α and β are adjustment factors. According to the formula, if the pheromone value on the path from node i to node j is larger, the probability of the path being selected is greater. At the same time, if the path length is shorter, the heuristic factor is larger, and the probability of the path being selected is also greater. By calculating the selection probability value, the next node that the ant chooses to visit is determined. In this way, the circumvention path of each ant is calculated. That is, the circumvention path is obtained by connecting the multiple network nodes that the ant is most likely to visit.

[0072] Optionally, after randomly placing M ants in the network topology, the method further includes: constructing a node list for each ant based on the initial positions of the M ants in the network topology, wherein the node list is used to store the network nodes that each ant has visited; and updating the node list based on the circumvention path of each ant.

[0073] It should be noted that, in order to prevent ants from repeatedly visiting nodes that have already been visited, a node list is used to record the nodes that ant k has visited. After time t, all ants have completed one round trip. The length of the path traveled by each ant is calculated, and the shortest path length is saved. At the same time, the pheromone value on each path is updated.

[0074] Optionally, after determining the circumvention path of each ant in the network topology based on the selection probability value, the method further includes: calculating the pheromone value of each ant on each circumvention path to obtain a pheromone value set; performing iterative calculation based on the ant colony algorithm and updating the pheromone value set calculated in each iteration until the number of iterations reaches a preset threshold, stopping the iteration, and using the pheromone value set calculated in the last iteration as the target pheromone value set.

[0075] It should be noted that after determining the travel path of each ant, the pheromone value on each path needs to be updated based on the ant's travel path and the pheromone released by the honeypot. The larger the pheromone value on a path, the more information the path contains, and the greater the likelihood that it will be selected by other ants in subsequent iterations, thus forming clustered paths. By continuously updating the pheromone value during the iteration process and obtaining the pheromone value of each path after the iteration ends, the nodes most likely to be visited by M ants can be determined based on the magnitude of the pheromone value, which is the optimal deployment location of the target honeypot.

[0076] Optionally, the formula for calculating pheromone values ​​is expressed as follows: Where, τ ij (t+1) represents the pheromone value of path (ij) at the end of the (t+1)th iteration, τ ij (t) represents the pheromone value of path (ij) at the end of the t-th iteration, ρ is a constant between 0 and 1, (1-ρ) represents the evaporation factor, and m represents the number of consecutive convergences. Denotes the continuously convergent value, where c is a constant, and Δτ ij Let Δτ represent the amount of pheromone left by the ant on path (ij) during the t-th iteration. ij =1 / d ij ,d ij τ represents the length of the path (ij). cA preset pheromone threshold is set based on the maximum pheromone value in the (t-1)th iteration during the iteration process.

[0077] It should be noted that in related technologies, the calculation of pheromone value includes two parts: one part is the pheromone remaining after evaporation, and the other part is the pheromone released by the ant when passing through the path. The formula for calculating the pheromone value remaining after evaporation is: τ ij (n)=(1-ρ)τ ij (n-1), where τ ij (n) represents the residual pheromone value in the nth iteration, τ ij (n-1) represents the residual pheromone value in the (n-1)th iteration, ρ is a constant between 0 and 1, (1-ρ) represents the volatility factor, and the pheromone released by the kth ant is: in, d represents the pheromone value of the k-th ant on path (ij). ij a represents the length of the path (ij). k Let be the set of nodes that ant k is allowed to visit next, and j represent the j-th network node. The total pheromone value on the path is the sum of the two.

[0078] Based on the above algorithm to calculate pheromone values, since ants often choose paths with higher pheromone content during their movement, when many ants choose the same path, the pheromone content on that path will suddenly increase, causing many ants to concentrate on a certain path, resulting in a blockage and stagnation phenomenon. In practical applications, blockage or stagnation will cause attackers to realize the deceptive behavior of the honeypot, and thus be unable to effectively obtain relevant information from the attacker.

[0079] This invention improves the existing pheromone value calculation formula by using an adaptive ant colony algorithm. It dynamically adjusts the pheromone value through iterative information and adaptively updates the pheromone content according to the distribution of solutions. This dynamically adjusts the pheromone intensity on each path, preventing ants from becoming too concentrated or too dispersed, thus avoiding premature convergence and local convergence and improving global deployment capabilities.

[0080] Optionally, the formula for calculating pheromone values ​​is expressed as follows: Where, τ ij (t+1) represents the pheromone value of path (ij) at the end of the (t+1)th iteration, τ ij (t) represents the pheromone value of path (ij) at the end of the t-th iteration, ρ is a constant between 0 and 1, (1-ρ) represents the evaporation factor, and m represents the number of consecutive convergences. Denotes the continuously convergent value, where c is a constant, and Δτ ijLet Δτ represent the amount of pheromone left by the ant on path (ij) during the t-th iteration. ij =1 / d ij ,d ij τ represents the length of the path (ij). c A preset pheromone threshold is set based on the maximum pheromone value in the (t-1)th iteration during the iteration process.

[0081] It should be noted that the adaptive ant colony algorithm in this embodiment of the invention can be adaptively adjusted based on the pheromone values ​​of the first two iterations and the number of convergences of the iterations, so as to avoid the ants being too concentrated or too scattered on the path and improve the global deployment capability of the system.

[0082] Optionally, after using the set of pheromone values ​​obtained from the last iteration as the target pheromone value set, the method further includes: sorting the target pheromone value set to obtain a target pheromone list; determining a pheromone threshold based on M target honeypots and selecting target pheromone values ​​in the target pheromone list that are greater than the pheromone threshold; determining the optimal path in the network topology based on the selected target pheromone values ​​and obtaining the target network nodes involved in the optimal path; and using the target network nodes as the target locations to be deployed for the target honeypots to obtain a target location set for M target honeypots, wherein the target location set includes the target location to be deployed for each target honeypot.

[0083] It should be noted that during the iterative calculation process, the probability value of each ant's choice at each node in the current iteration is calculated based on the pheromone value obtained in the previous iteration. This allows us to obtain the most likely travel path for each ant in the current iteration. Then, the pheromone value of the current iteration is updated based on the ant's travel path. The target locations for honeypot deployment are determined based on the pheromone value updated in the last iteration. The pheromone values ​​in the target pheromone value set obtained in the last iteration are sorted, and the pheromone threshold is determined based on the number of honeypots to be deployed (M honeypots). Then, the values ​​greater than the pheromone threshold are extracted from the pheromone list, that is, the top M target pheromone values ​​are extracted from the list. The paths corresponding to these M pheromone values ​​are the target paths most likely to be visited by the ants. This allows us to determine the optimal path in the network topology and obtain the network nodes involved in the optimal path. These network nodes are the target locations for the target honeypots to be deployed, thus obtaining the target location set.

[0084] Step S103: Draw a honeypot deployment map based on the target location of each target honeypot to be deployed, and deploy M target honeypots to the target network based on the honeypot deployment map.

[0085] It should be noted that after obtaining the target location set of the target honeypots, since the network topology in the model is constructed based on the actual network topology, the target location set output from the model corresponds to each network node in the actual target network. A honeypot deployment map is drawn based on the target locations, and M target honeypots are deployed to the target network according to the honeypot deployment map.

[0086] Optionally, after deploying M target honeypots to the target network based on the honeypot deployment map, the method further includes: calling the monitoring module to monitor the M target honeypots and obtaining monitoring logs; determining the operating status of each target honeypot based on the monitoring logs; and generating a honeypot update instruction if the operating status of a target honeypot does not meet preset conditions, wherein the honeypot update instruction is used to update the honeypot deployment map.

[0087] It should be noted that after deploying the honeypot, it is also necessary to monitor the honeypot in real time, obtain monitoring logs, analyze the operation of the honeypot and the captured attack information, and synchronize the captured information to the ant colony algorithm model. If the operation of the target ant colony algorithm does not meet the preset conditions, a honeypot update instruction is generated, and the ant colony algorithm model redeploys the target honeypot to the location and updates the honeypot deployment map.

[0088] The following describes in detail another optional implementation method.

[0089] The implementation subject of this invention is a honeypot deployment system. It achieves automated deployment and optimization updates of honeypots through an adaptive ant colony algorithm. By deploying honeypots in the network, attackers are tricked into attacking them, thereby obtaining information about the attacker's behavior and methods. This allows for network defense and protection. The system automatically deploys honeypots using the adaptive ant colony algorithm, improving deployment efficiency and scope, and enhancing the reliability and stability of the honeypots. The training capability of the ant colony algorithm compensates for the shortcomings of manual deployment, monitoring, and optimization of honeypots, simplifying the deployment process, avoiding omissions, and preventing incomplete attack data coverage. Simultaneously, the model's computational power allows for real-time feedback and adjustment of the plan. Automated deployment and optimization updates through the ant colony algorithm save manpower and resources, improve efficiency, and effectively identify attackers' methods and behaviors, providing effective protection for network security.

[0090] Figure 2 This is a schematic diagram of an optional honeypot deployment system according to an embodiment of the present invention, such as... Figure 2 As shown, the honeypot deployment system consists of three parts: a honeypot deployment module, an adaptive ant colony algorithm module, and a monitoring module.

[0091] The honeypot deployment module first collects network topology information by scanning the target network of the honeypot to be deployed. This information can include host IP addresses, port numbers, service types, etc. Based on the collected network topology information, an ant colony algorithm model is constructed. M target honeypots are also constructed, and initial locations are configured for each target honeypot. Finally, the initial locations of the honeypots and their related information are input into the ant colony algorithm model.

[0092] The adaptive ant colony algorithm module, based on the input honeypot information and initial location, simulates ants searching for suitable locations within the search range according to the ant colony algorithm rules. It then feeds back the acquired location information and the pheromones released by the ants to the adaptive ant colony algorithm module. The adaptive ant colony algorithm module updates the ants' positions and search range based on the information fed back by the ants, and performs the next round of search, i.e., iterative calculation, to obtain the final calculation result.

[0093] The adaptive ant colony algorithm module feeds back the calculation results obtained from the iterative calculation to the honeypot deployment module. The honeypot deployment module draws a honeypot deployment map based on the calculation results and deploys the target honeypot in the actual network.

[0094] The adaptive ant colony algorithm module includes the following sub-modules:

[0095] The travel path calculation submodule completely simulates the search behavior of an ant colony within a target area. Initially, M ants are randomly placed in the city (corresponding to the network topology), and the pheromone values ​​on each path are initialized. Let T... ij (0) = τ0 is the initial value of the pheromone, which can be set as τ0 = M / L m ,L m The path length is constructed using the nearest neighbor heuristic, and the probability of the ant choosing the next path is: in, Let τ represent the probability of the k-th ant choosing path (ij). ij (t) represents the pheromone value of path (ij), η ij =1 / d ij Let d be the heuristic factor from node i to node j. ij a represents the distance from node i to node j. kLet α be the set of nodes that ant k is allowed to visit next (the node list stores the network nodes that the ant has already visited, i.e., the network nodes that are not allowed to visit). α and β are adjustment factors. According to the formula, if the pheromone value on the path from i to j is larger, the probability of that path being selected is greater. At the same time, if the path length is shorter, the heuristic factor is larger, and the probability of that path being selected is also greater. By calculating the selection probability value, the node that the ant will choose to visit next is determined. In this way, the circumvention path of each ant is calculated. That is, the circumvention path is obtained by connecting the multiple network nodes that the ant is most likely to visit.

[0096] To prevent ants from choosing cities they have already visited, a node list is used to record the cities that ant k has visited. After time t, all ants have completed one round trip. The length of the round trip path for each ant is calculated, and the shortest round trip path length is saved. At the same time, the pheromones on each path are updated, and the pheromone value corresponding to each path is calculated.

[0097] The formula for calculating pheromone levels is as follows: Where, τ ij (t+1) represents the pheromone value of path (ij) at the end of the (t+1)th iteration, τ ij (t) represents the pheromone value of path (ij) at the end of the t-th iteration, ρ is a constant between 0 and 1, (1-ρ) represents the evaporation factor, and m represents the number of consecutive convergences. Denotes the continuously convergent value, where c is a constant, and Δτ ij Let Δτ represent the amount of pheromone left by the ant on path (ij) during the t-th iteration. ij =1 / d ij ,d ij τ represents the length of the path (ij). c A preset pheromone threshold is set based on the maximum pheromone value in the (t-1)th iteration during the iteration process.

[0098] The adaptive ant colony algorithm submodule can adaptively update the information content according to the distribution of solutions, thereby dynamically adjusting the information intensity on each path so that the ants are neither too concentrated nor too dispersed, thus avoiding premature convergence and local convergence and improving global deployment capability.

[0099] The results output module outputs the results through code. The code framework is as follows:

[0100] Begin

[0101] initialization;

[0102] Whi le (the algorithm termination condition is not met);

[0103] {for(i = 1; i < m; i++); ## Randomly place M honeypots at the target locations

[0104] for(j = 1; j < n; j++); ## Iterate over n target locations

[0105] {for(i = 1; i < k; i++);

[0106] Ant i (Attacker i) selects the next location with probability ;

[0107] end

[0108] }

[0109] Find the optimal result;

[0110] Assign the optimal result to honeypot location i;

[0111] end

[0112] {if (the optimal result is equal to the optimal result n loops ago)

[0113] Update τ according to the formula

[0114]

[0115] for the next iteration;

[0116] end

[0117] }

[0118] end

[0119] }

[0120] Output the optimal result;

[0121] end

[0122] It should be noted that according to the iteration, the pheromone values on each path are updated until the iteration ends, obtaining the target pheromone value set. Select the M target pheromone values with the largest values from the target pheromone value set. The paths corresponding to these M target pheromone values are the paths that the ants are most likely to visit, that is, the paths that the attackers are most likely to attack. The nodes involved in this path are used as the optimal locations for the target honeypots to be deployed, so as to obtain the target locations of the target honeypots, and then deploy each honeypot to these target locations.

[0123] The monitoring module will monitor the target honeypots deployed in the network in real time, monitor the running status of the honeypots, and feedback to the adaptive ant colony algorithm module in time for optimizing and updating the deployment of the target honeypots.

[0124] Figure 3 This is a schematic diagram of an optional honeypot deployment process based on an ant colony algorithm model according to an embodiment of the present invention, such as... Figure 3 As shown, the honeypot deployment process based on the ant colony algorithm model includes the following steps:

[0125] Step 1, Begin;

[0126] Step 2: Collect network topology information;

[0127] Step 3: Construct the ant colony algorithm model;

[0128] Step 4: Construct M target honeypots and configure the initial position for each target honeypot;

[0129] Step 5: Input the M target honeypots into the ant colony algorithm model and place the target honeypots in the network topology according to their initial positions.

[0130] Step six: Feedback on ant information (corresponding to the pheromone values ​​mentioned above);

[0131] Step 7: Iterative calculations are performed using the adaptive ant colony algorithm to update the ant feedback information;

[0132] Step 8: Obtain the target location of the target honeypot based on the latest ant feedback information;

[0133] Step 9: Deploy the target honeypot to the target network based on the target location;

[0134] Step 10: Monitor the target honeypot using the monitoring module, analyze the monitoring results, and redeploy the target honeypot based on the monitoring results;

[0135] Step 11, End.

[0136] In this embodiment of the invention, the adaptive ant colony algorithm is used to automatically deploy and optimize honeypots in the target network, thereby improving deployment efficiency, reliability and stability. The adaptive ant colony algorithm simulates the process of ants releasing and following pheromones when searching for food, and finds the optimal solution through multiple iterations to obtain the best deployment location of the honeypot, thereby effectively capturing the attacker's attack behavior.

[0137] The following is a detailed description with reference to another embodiment.

[0138] Example 2

[0139] The honeypot deployment device based on the ant colony algorithm model provided in this embodiment includes multiple implementation units, each of which corresponds to a specific implementation step in Embodiment 1 above.

[0140] Figure 4This is a schematic diagram of an optional honeypot deployment device based on an ant colony algorithm model according to an embodiment of the present invention, such as... Figure 4 As shown, the honeypot deployment device includes: a construction unit 41, an output unit 42, and a deployment unit 43, wherein,

[0141] Construction unit 41 is used to construct M target honeypots and set the initial position for each target honeypot, and obtain the honeypot information and initial position corresponding to each target honeypot. Here, a honeypot refers to a decoy set up to deal with network attacks, and M is a positive integer.

[0142] Output unit 42 is used to input the honeypot information and initial position of each target honeypot into the ant colony algorithm model and output the target position to be deployed for each target honeypot. The ant colony algorithm model performs iterative calculations based on the ant colony algorithm and obtains the target position to be deployed for each target honeypot.

[0143] Deployment unit 43 is used to draw a honeypot deployment map based on the target location of each target honeypot to be deployed, and deploy M target honeypots to the target network based on the honeypot deployment map.

[0144] The honeypot deployment device described above constructs M target honeypots through the construction unit 41, sets an initial position for each target honeypot, and obtains the honeypot information and initial position corresponding to each target honeypot. Here, a honeypot refers to a decoy set up to deal with network attacks, and M is a positive integer. The output unit 42 inputs the honeypot information and initial position of each target honeypot into the ant colony algorithm model, and outputs the target position to be deployed for each target honeypot. Here, the ant colony algorithm model performs iterative calculations based on the ant colony algorithm to obtain the target position to be deployed for each target honeypot. The deployment unit 43 draws a honeypot deployment map based on the target position to be deployed for each target honeypot, and deploys the M target honeypots to the target network based on the honeypot deployment map.

[0145] In this embodiment, when deploying honeypots in the target network, the initial location of the target honeypot is input into the ant colony algorithm model. The optimal location of the honeypot is calculated using the pre-built ant colony algorithm model. The ant colony algorithm model iteratively calculates the optimal travel path of ants in the topological network structure through ant colony algorithm, thereby obtaining the deployment location of the target honeypot. Finally, based on the drawn honeypot deployment map, the target honeypot is deployed in the target network. The target honeypot captures and analyzes the attacker's attack behavior, improving network security. The intelligent deployment of honeypots is achieved based on the ant colony algorithm model. The optimal deployment scheme is obtained through iterative calculation, eliminating the need for manual deployment. This improves the efficiency and accuracy of honeypot deployment, reduces maintenance costs, and solves the technical problems of low deployment efficiency and high maintenance costs in related technologies that rely on manual deployment of honeypots in the target network to capture network attackers' attack behavior.

[0146] Optionally, the honeypot deployment device based on the ant colony algorithm model further includes: a first initialization module, used to initialize the pheromone value of each path in the network topology, wherein the connection between every two network nodes is a path; a first selection module, used to select M ants based on M target honeypots and randomly place the M ants in the network topology; and a first deployment module, used to deploy the M target honeypots in the network topology based on the initial positions of the M target honeypots.

[0147] Optionally, the honeypot deployment device based on the ant colony algorithm model further includes: a first calculation module, used to calculate the selection probability value of each ant choosing each adjacent network node based on the pheromone value; and a first determination module, used to determine the travel path of each ant in the network topology based on the selection probability value.

[0148] Optionally, the honeypot deployment device based on the ant colony algorithm model further includes: a second construction module, used to construct a node list for each ant based on the initial positions of M ants in the network topology, wherein the node list is used to store the network nodes that each ant has visited; and a first update module, used to update the node list based on the travel path of each ant.

[0149] Optionally, the honeypot deployment device based on the ant colony algorithm model further includes: a second calculation module, used to calculate the pheromone value of each path in the circumvention path of each ant to obtain a pheromone value set; and a second update module, used to perform iterative calculation based on the ant colony algorithm and update the pheromone value set calculated in each iteration until the number of iterations reaches a preset threshold, at which point the iteration stops, and the pheromone value set calculated in the last iteration is used as the target pheromone value set.

[0150] Optionally, the formula for calculating pheromone values ​​is expressed as follows: Where, τ ij (t+1) represents the pheromone value of path (ij) at the end of the (t+1)th iteration, τ ij (t) represents the pheromone value of path (ij) at the end of the t-th iteration, ρ is a constant between 0 and 1, (1-ρ) represents the evaporation factor, and m represents the number of consecutive convergences. Denotes the continuously convergent value, where c is a constant, and Δτ ij Let Δτ represent the amount of pheromone left by the ant on path (ij) during the t-th iteration. ij =1 / d ij ,d ij τ represents the length of the path (ij). c A preset pheromone threshold is set based on the maximum pheromone value in the (t-1)th iteration during the iteration process.

[0151] Optionally, the honeypot deployment device based on the ant colony algorithm model further includes: a first sorting module, used to sort the target pheromone value set to obtain a target pheromone list; a second selection module, used to determine a pheromone threshold based on M target honeypots and select target pheromone values ​​in the target pheromone list that are greater than the pheromone threshold; a first acquisition module, used to determine the optimal path in the network topology based on the selected target pheromone values ​​and acquire the target network nodes involved in the optimal path; and a first use module, used to use the target network nodes as the target locations to be deployed for the target honeypots to obtain a target location set of M target honeypots, wherein the target location set includes the target location to be deployed for each target honeypot.

[0152] Optionally, the honeypot deployment device based on the ant colony algorithm model further includes: a first calling module, used to call the monitoring module to monitor M target honeypots and obtain monitoring logs; and a first generation module, used to determine the operating status of each target honeypot based on the monitoring logs, and generate a honeypot update instruction if the operating status of the target honeypot does not meet preset conditions, wherein the honeypot update instruction is used to update the honeypot deployment map.

[0153] The honeypot deployment device based on the ant colony algorithm model may also include a processor and a memory. The construction unit 41, output unit 42, deployment unit 43, etc. are all stored in the memory as program units, and the processor executes the program units stored in the memory to realize the corresponding functions.

[0154] The aforementioned processor contains a kernel, which retrieves the corresponding program units from memory. One or more kernels can be configured, and by adjusting kernel parameters, honeypots can be deployed in the target network as decoys to capture attackers' malicious activities.

[0155] The aforementioned memory may include non-permanent memory in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash memory, and the memory includes at least one memory chip.

[0156] According to another aspect of the present invention, a computer-readable storage medium is also provided, the computer-readable storage medium including a stored computer program, wherein, when the computer program is running, it controls the device where the computer-readable storage medium is located to execute any of the honeypot deployment methods based on the ant colony algorithm model described above.

[0157] According to another aspect of the present invention, an electronic device is also provided, including one or more processors and a memory, wherein the memory is used to store one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors cause the one or more processors to implement any of the honeypot deployment methods based on the ant colony algorithm model described above.

[0158] This application also provides a computer program product, which, when executed on a data processing device, is suitable for executing an initialization program with the following method steps: constructing M target honeypots and setting an initial position for each target honeypot, obtaining the honeypot information and initial position corresponding to each target honeypot, wherein a honeypot refers to a decoy set up to counter network attacks, and M is a positive integer; inputting the honeypot information and initial position of each target honeypot into an ant colony algorithm model, and outputting the target position to be deployed for each target honeypot, wherein the ant colony algorithm model iteratively calculates based on the ant colony algorithm to obtain the target position to be deployed for each target honeypot; drawing a honeypot deployment map based on the target position to be deployed for each target honeypot, and deploying the M target honeypots to the target network based on the honeypot deployment map.

[0159] Figure 5 This is a hardware structure block diagram of an electronic device (or mobile device) according to an embodiment of the present invention, which describes a honeypot deployment method based on an ant colony algorithm model. Figure 5 As shown, an electronic device may include one or more ( Figure 5 The processor 502 (which may include, but is not limited to, a microprocessor MCU or a programmable logic device FPGA, etc.) and a memory 504 for storing data may also be included. In addition, it may include: a display, an input / output interface (I / O interface), a universal serial bus (USB) port (which may be included as one of the ports of the I / O interface), a network interface, a keyboard, a power supply, and / or a camera. Those skilled in the art will understand that... Figure 5 The structure shown is for illustrative purposes only and does not limit the structure of the electronic device described above. For example, the electronic device may also include components that are more... Figure 5 The more or fewer components shown, or having the same Figure 5 The different configurations shown.

[0160] The sequence numbers of the above embodiments of the present invention are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0161] In the above embodiments of the present invention, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0162] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. The device embodiments described above are merely illustrative; for example, the division of units can be a logical functional division, and in actual implementation, there may be other division methods. For instance, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the displayed or discussed mutual coupling, direct coupling, or communication connection may be through some interfaces; the indirect coupling or communication connection between units or modules may be electrical or other forms.

[0163] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0164] Furthermore, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0165] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, read-only memory (ROM), random access memory (RAM), portable hard drives, magnetic disks, or optical disks.

[0166] The above description is only a preferred embodiment of the present invention. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the principle of the present invention, and these improvements and modifications should also be considered within the scope of protection of the present invention.

Claims

1. A honeypot deployment method based on an ant colony algorithm model, characterized in that, include: Construct M target honeypots and set an initial position for each target honeypot to obtain honeypot information and the initial position for each target honeypot. Here, a honeypot refers to a decoy set up to deal with network attacks, and M is a positive integer. The honeypot information and initial position of each target honeypot are input into the ant colony algorithm model, and the target position to be deployed for each target honeypot is output. The ant colony algorithm model performs iterative calculations based on the ant colony algorithm to obtain the target position to be deployed for each target honeypot. A honeypot deployment map is drawn based on the target location of each target honeypot to be deployed, and the M target honeypots are deployed to the target network based on the honeypot deployment map; The ant colony algorithm model is pre-built. The steps of building the ant colony algorithm model include: determining the target network where honeypots are to be deployed, and scanning the target network to obtain the network topology and the network topology information corresponding to the network topology. The network topology contains N network nodes where honeypots can be deployed, where N is a positive integer and N is greater than M; and building the ant colony algorithm model based on the network topology information.

2. The honeypot deployment method according to claim 1, characterized in that, After inputting the honeypot information and initial position of each target honeypot into the ant colony algorithm model, the algorithm further includes: Initialize the pheromone value of each path in the network topology, wherein the connection between any two network nodes constitutes a path; Based on the M target honeypots, select M ants and randomly place the M ants in the network topology; The M target honeypots are deployed in the network topology based on their initial locations.

3. The honeypot deployment method according to claim 2, characterized in that, After deploying the M target honeypots in the network topology based on their initial locations, the method further includes: Calculate the probability value of each ant choosing each adjacent network node based on the pheromone value; The travel path of each ant in the network topology is determined based on the selection probability value.

4. The honeypot deployment method according to claim 2, characterized in that, After randomly placing the M ants in the network topology, the process further includes: Based on the initial positions of the M ants in the network topology, a node list is constructed for each ant, wherein the node list is used to store the network nodes that each ant has visited; The node list is updated based on the travel path of each ant.

5. The honeypot deployment method according to claim 3, characterized in that, After determining the travel path of each ant in the network topology based on the selection probability value, the method further includes: Calculate the pheromone value of each ant along each path in the travel path to obtain a set of pheromone values; The ant colony algorithm is used for iterative calculations, and the pheromone value set calculated in each iteration is updated until the number of iterations reaches a preset threshold. Then the iteration stops, and the pheromone value set calculated in the last iteration is used as the target pheromone value set.

6. The honeypot deployment method according to claim 5, characterized in that, The formula for calculating the pheromone value is as follows: ,in, This represents the pheromone value of path (ij) at the end of the (t+1)th iteration. Let represent the pheromone value of path (ij) at the end of the t-th iteration, where ρ is a constant between 0 and 1, (1-ρ) represents the volatile factor, and m represents the number of consecutive convergences. =m / c, This represents a continuously convergent value, where c is a constant. This represents the amount of pheromone left by the ant on path (ij) during the t-th iteration. =1 / , Indicates the length of the path (ij). A preset pheromone threshold is set based on the maximum pheromone value in the (t-1)th iteration during the iteration process.

7. The honeypot deployment method according to claim 5, characterized in that, After using the set of pheromone values ​​obtained from the last iteration as the target pheromone value set, the following is also included: The target pheromone value set is sorted to obtain a target pheromone list; Based on the M target honeypots, a pheromone threshold is determined, and the target pheromone values ​​in the target pheromone list that are greater than the pheromone threshold are selected. The optimal path in the network topology is determined based on the selected target pheromone value, and the target network nodes involved in the optimal path are obtained. The target network node is used as the target location to be deployed for the target honeypot, resulting in a set of target locations for the M target honeypots, wherein the set of target locations includes the target location to be deployed for each target honeypot.

8. The honeypot deployment method according to claim 1, characterized in that, After deploying the M target honeypots to the target network based on the honeypot deployment map, the process further includes: The monitoring module is invoked to monitor the M target honeypots and obtain monitoring logs; Based on the monitoring logs, the operating status of each target honeypot is determined. If the operating status of a target honeypot does not meet the preset conditions, a honeypot update instruction is generated, wherein the honeypot update instruction is used to update the honeypot deployment map.

9. A honeypot deployment device based on an ant colony algorithm model, characterized in that, include: A construction unit is used to construct M target honeypots, set an initial position for each target honeypot, and obtain honeypot information and the initial position corresponding to each target honeypot. Here, a honeypot refers to a decoy set up to deal with network attacks, and M is a positive integer. The output unit is used to input the honeypot information and the initial position of each target honeypot into the ant colony algorithm model, and output the target position to be deployed for each target honeypot, wherein the ant colony algorithm model performs iterative calculations based on the ant colony algorithm and obtains the target position to be deployed for each target honeypot; The deployment unit is used to draw a honeypot deployment map based on the target location of each target honeypot to be deployed, and to deploy the M target honeypots to the target network based on the honeypot deployment map; The first scanning module is used to determine the target network to which the honeypot is to be deployed, and to scan the target network to obtain the network topology and the network topology information corresponding to the network topology. The network topology contains N network nodes that can deploy honeypots, where N is a positive integer and N is greater than M. The first construction module is used to construct an ant colony algorithm model based on the network topology information.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium includes a stored computer program, wherein, when the computer program is executed, it controls the device where the computer-readable storage medium is located to perform the honeypot deployment method based on the ant colony algorithm model as described in any one of claims 1 to 8.

11. An electronic device, characterized in that, It includes one or more processors and a memory, the memory being used to store one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors cause the one or more processors to implement the honeypot deployment method based on the ant colony algorithm model as described in any one of claims 1 to 8.

Images