A method, apparatus and device for simulating a real business environment

Abstract

The application discloses a method, device and equipment for simulating a real business environment, which comprises the following steps: creating a container image based on a virtualization technology; deploying the container image into a honeypot service based on an automatic deployment tool; deploying the obtained honeypot service into a simulation environment based on a specific scene; triggering data generation and updating in the simulation environment; storing the generated and updated data and associating the stored data to the corresponding honeypot service in real time, thereby completing the simulation of the real business environment. The embodiment of the application can realize the construction of a simulated real business environment, the production of a visual and interactive interface, the generation of virtual users, transaction records, device behaviors and other data in combination with a real business scene, thereby realizing the trapping and analysis of the behaviors of attackers.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a method, apparatus, and device for simulating a real business environment. Background Technology

[0002] The network is fraught with threats, both internal and external. Relying solely on network location and whether users have access privileges within the internal network is insufficient. Traditional network architectures use the network as a boundary, and their defense methods typically involve deploying firewalls, VPNs, intrusion detection systems, and other similar methods at the network boundary. Once a device connects to the network, it is considered trusted within the network and can access any service and resource within the network without restriction.

[0003] Current network security control strategies are relatively simple, merely denying attackers access to and attacks on real information within the network. While effective in certain attack behaviors, they still provide attackers with some usable information and fail to utilize the large amount of usable information from attackers, making it impossible to lure and analyze attacker behavior.

[0004] Therefore, existing technologies still need to be improved and developed. Summary of the Invention

[0005] In view of the shortcomings of the prior art, the purpose of the present invention is to provide a method, apparatus and equipment for simulating a real business environment, which aims to solve the technical problem that the corresponding strategies of network security control in the prior art are relatively simple, only rejecting the attacker's probe and attack on real information in the network. It has a certain effect on some attack behaviors, but still provides some usable information to the attacker, and does not make use of a large amount of usable information from the attacker, and cannot capture and analyze the attacker's behavior.

[0006] The technical solution of the present invention is as follows: A method for simulating a real business environment, the method comprising: Create container images based on virtualization technology; Based on automated deployment tools, the container image is deployed to the honeypot service, and based on the specific scenario, the resulting honeypot service is deployed to the simulation environment. Data generation and updating are triggered within the simulation environment; The generated and updated data are stored, and the stored data is associated with the corresponding honeypot service in real time to complete the simulation of a real business environment.

[0007] Furthermore, the creation of container images based on virtualization technology includes: Create cross-platform visual interactive interfaces based on web front-end development technologies; The code, dependencies, and resources of the visual interactive interface are packaged into a container image to form a container image that can be deployed quickly.

[0008] More preferably, the step of creating a cross-platform visual interactive interface based on web front-end development technology includes: Based on web front-end development technology, the interface parameters of the visual interactive interface are set; Create chart types, interactive features, and data-driven approaches based on visualization libraries and tools; Using visual programming tools, cross-platform visual interactive interfaces can be created by dragging, dropping, and connecting components.

[0009] More preferably, the step of deploying the container image to the honeypot service based on the automated deployment tool includes: The container image is deployed to the honeypot service using an automated deployment tool, and the service parameters of the deployed honeypot service are defined.

[0010] Preferably, the step of deploying the obtained honeypot service to the simulation environment based on a specific scenario includes: Obtain the specific scenario types and business requirements of real business systems; Based on the scenario type and business requirements, the obtained honeypot service is deployed to the simulation environment.

[0011] Furthermore, triggering data generation and updating in the simulation environment includes: Set the scheduling time interval using a scheduled task tool; Data updates are triggered periodically based on the aforementioned scheduling time interval.

[0012] Furthermore, triggering data generation and updating in the simulation environment includes: Real-time data is collected from data sources using data acquisition tools, and the real-time data is analyzed to generate and update data in the simulation environment.

[0013] Another embodiment of the present invention provides an apparatus for simulating a real business environment, the apparatus comprising: The container image creation module is used to create container images based on virtualization technology. The honeypot service deployment module is used to deploy the container image to the honeypot service based on automated deployment tools, and to deploy the resulting honeypot service to the simulation environment based on specific scenarios. A real-time data update module is used to trigger data generation and updates in the simulation environment; The business environment simulation module is used to store the generated and updated data and associate the stored data with the corresponding honeypot service in real time to complete the simulation of the real business environment.

[0014] Another embodiment of the present invention provides an apparatus for simulating a real business environment, the apparatus including at least one processor; and, A memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor, which enables the at least one processor to perform the method described above for simulating a real business environment.

[0015] Another embodiment of the present invention provides a non-volatile computer-readable storage medium storing computer-executable instructions that, when executed by one or more processors, cause the one or more processors to perform the above-described method for simulating a real business environment.

[0016] Beneficial effects: The embodiments of the present invention can construct a simulated real business environment; create visualization and interactive interfaces; and generate data such as virtual users, transaction records, and device behavior by combining real business scenarios, thereby enabling the capture and analysis of attackers' behavior. Attached Figure Description

[0017] The present invention will be further described below with reference to the accompanying drawings and embodiments. In the accompanying drawings: Figure 1 This is a flowchart of a preferred embodiment of a method for simulating a real business environment according to the present invention; Figure 2 This is a schematic diagram of the functional modules of a preferred embodiment of the device for simulating a real business environment according to the present invention; Figure 3 This is a schematic diagram of the hardware structure of a preferred embodiment of a device for simulating a real business environment according to the present invention. Detailed Implementation

[0018] To make the objectives, technical solutions, and effects of this invention clearer and more explicit, the invention is further described in detail below. It should be understood that the specific embodiments described herein are merely illustrative of the invention and are not intended to limit the invention.

[0019] The embodiments of the present invention will be described below with reference to the accompanying drawings.

[0020] This invention provides a method for simulating a real business environment. Please refer to [link / reference]. Figure 1 , Figure 1This is a flowchart illustrating a preferred embodiment of a method for simulating a real business environment according to the present invention. Figure 1 As shown, it includes the following steps: Step S100: Create a container image based on virtualization technology; Step S200: Based on the automated deployment tool, deploy the container image to the honeypot service, and based on the specific scenario, deploy the obtained honeypot service to the simulation environment; Step S300: Trigger data generation and updating in the simulation environment; Step S400: Store the generated and updated data, and associate the stored data with the corresponding honeypot service in real time to complete the simulation of the real business environment.

[0021] In practical implementation, the embodiments of the present invention are mainly used to simulate real business environments, providing convenience for capturing network attack behaviors.

[0022] This invention utilizes virtualization technology to create virtual machines or containers, constructing a simulated real business environment. Automated processes and tools are used to build container images from the configured interface. Statistical methods, random number generation, and machine learning techniques are employed to simulate the distribution and relationships of real data. During the automatic real-time generation and updating process, the consistency and integrity of the generated data are ensured. Real-time data generation and updating are supported, enabling the simulated environment to promptly reflect changes in the real business environment.

[0023] For example, based on web front-end technologies, create cross-platform interactive interfaces; package the code, dependencies, and resources of the interactive interface into a container image to form a container image that can be deployed quickly; Based on automated deployment tools or scripts, the container image is deployed to the honeypot service, and the service name, service type, and service port information are defined for the service; depending on the specific scenario and requirements, the service is deployed to the simulation environment; Data generation and update operations are triggered periodically using a scheduled task tool. By combining business systems to create services for different scenarios and linking corresponding data services, a simulation of the real business environment can be completed.

[0024] Use real-time databases or caching systems to store and update data, and associate the data with the corresponding honeypot services; By combining services from different business scenarios with the existing business systems and associating them with corresponding data services, a core simulated business system is formed within the simulated network environment. For example, the interfaces of several real business systems with different applications, such as user management, can be replicated. Configure user-related data services such as querying and adding users; Associating user interface interactions with corresponding services, or configuring the interface to call the corresponding data services.

[0025] Furthermore, container images are created based on virtualization technology, including: Create cross-platform visual interactive interfaces based on web front-end development technologies; The code, dependencies, and resources of the visual interactive interface are packaged into a container image to form a container image that can be deployed quickly.

[0026] In practice, based on web front-end development technologies, a cross-platform, visually rich, and interactive interface is created. The code, dependencies, and resources of this interactive interface are packaged into a container image, forming a rapidly deployable container image. The container image creation method is as follows: create a Dockerfile, write the Dockerfile, build the image, wait for the build process, and test and verify the image.

[0027] Dependencies refer to the external components, libraries, or modules that the code depends on at runtime. These dependencies provide the functionality or resources required by the code, enabling it to function correctly. Resources refer to image files.

[0028] Furthermore, based on web front-end development technologies, a cross-platform visual interactive interface is created, including: Based on web front-end development technology, the interface parameters of the visual interactive interface are set; Create chart types, interactive features, and data-driven approaches based on visualization libraries and tools; Using visual programming tools, cross-platform visual interactive interfaces can be created by dragging, dropping, and connecting components.

[0029] In practice, web front-end development technologies are used to create cross-platform, visually rich, and interactive interfaces. HTML defines the interface structure, CSS is used for styling and layout, and JavaScript implements interactive logic and dynamic effects. Dedicated visualization libraries and tools are used to create chart types, interactive functions, and data-driven interfaces. Visual programming tools are used to create visual and interactive interfaces by dragging and dropping and connecting components.

[0030] Furthermore, based on automated deployment tools, the container image is deployed to the honeypot service, including: The container image is deployed to the honeypot service using an automated deployment tool, and the service parameters of the deployed honeypot service are defined.

[0031] In practice, automated deployment tools or scripts such as Jenkins are used to deploy the container image to the honeypot service, defining information such as service name, service type, and service port for the service. The service name identifies the purpose of the service, such as "Student Management System". Service type: Used to identify what type of service it is, such as Web type or Service type; Service port: refers to the port number on which the service is accessed based on IP address, such as 8080, 8090, etc.

[0032] Furthermore, based on specific scenarios, the obtained honeypot service is deployed to the simulation environment, including: Obtain the specific scenario types and business requirements of real business systems; Based on the scenario type and business requirements, the obtained honeypot service is deployed to the simulation environment.

[0033] In practice, the service will be deployed to the simulation environment according to the specific scenario and requirements. For example, create honeypot services for commonly used business systems that are highly likely to be attacked, and then deploy them in a simulation environment.

[0034] Furthermore, triggering data generation and updates within the simulation environment includes: Set the scheduling time interval using a scheduled task tool; Data updates are triggered periodically based on the aforementioned scheduling time interval.

[0035] In practice, a scheduled task tool can be used to periodically trigger data generation and update operations by setting an appropriate scheduling interval, thus maintaining the real-time nature of the data. The time interval range needs to be set according to the frequency of normal data updates in the business system; Data production is performed based on configurations, such as periodically updating email data. In this case, some emails can be automatically sent according to rules, which can be configured to include recipient range, subject rules, content rules, etc.

[0036] Furthermore, triggering data generation and updates within the simulation environment includes: Real-time data is collected from data sources using data acquisition tools, and the real-time data is analyzed to generate and update data in the simulation environment.

[0037] In practice, appropriate data acquisition tools or technologies, such as Internet of Things (IoT) devices, sensors, API calls, or log monitoring, are used to collect real-time data from data sources, and the data processing system performs real-time analysis and generation.

[0038] In some other embodiments, data can also be automatically generated and updated in real time by writing automated scripts or using automated tools and integrating them into the system's automated processes. For example, the status value of data can be automatically updated through scripts or automation tools according to the configured rules.

[0039] As can be seen from the above method embodiments, the embodiments of the present invention create container images based on virtualization technology; deploy the container images to honeypot services using automated deployment tools; deploy the resulting honeypot services to a simulation environment based on specific scenarios; trigger data generation and updates in the simulation environment; store the generated and updated data; and associate the stored data with the corresponding honeypot services in real time to complete the simulation of a real business environment. The embodiments of the present invention can construct a simulated real business environment; create visualization and interactive interfaces; and generate data such as virtual users, transaction records, and device behavior based on real business scenarios, thereby enabling the capture and analysis of attacker behavior.

[0040] It should be noted that there is no necessary order between the above steps. Those skilled in the art will understand from the description of the embodiments of the present invention that the above steps may have different execution orders in different embodiments, that is, they may be executed in parallel or in turn, etc.

[0041] Another embodiment of the present invention provides an apparatus for simulating a real business environment, such as... Figure 2 As shown, device 1 includes: Container image creation module 11 is used to create container images based on virtualization technology; Honeypot service deployment module 12 is used to deploy the container image to the honeypot service based on automated deployment tools, and deploy the obtained honeypot service to the simulation environment based on specific scenarios. The real-time data update module 13 is used to trigger data generation and updating in the simulation environment; The business environment simulation module 14 is used to store the generated and updated data and associate the stored data with the corresponding honeypot service in real time to complete the simulation of the real business environment.

[0042] For specific implementation details, please refer to the method embodiment; they will not be repeated here.

[0043] Furthermore, the container image creation module 11 is specifically used for: Create cross-platform visual interactive interfaces based on web front-end development technologies; The code, dependencies, and resources of the visual interactive interface are packaged into a container image to form a container image that can be deployed quickly.

[0044] For specific implementation details, please refer to the method embodiment; they will not be repeated here.

[0045] Furthermore, the container image creation module 11 is also used for: Based on web front-end development technology, the interface parameters of the visual interactive interface are set; Create chart types, interactive features, and data-driven approaches based on visualization libraries and tools; Using visual programming tools, cross-platform visual interactive interfaces can be created by dragging, dropping, and connecting components.

[0046] For specific implementation details, please refer to the method embodiment; they will not be repeated here.

[0047] Furthermore, the honeypot service deployment module 12 is specifically used for: The container image is deployed to the honeypot service using an automated deployment tool, and the service parameters of the deployed honeypot service are defined.

[0048] For specific implementation details, please refer to the method embodiment; they will not be repeated here.

[0049] Furthermore, the honeypot service deployment module 12 is also used for: Obtain the specific scenario types and business requirements of real business systems; Based on the scenario type and business requirements, the obtained honeypot service is deployed to the simulation environment.

[0050] For specific implementation details, please refer to the method embodiment; they will not be repeated here.

[0051] Furthermore, the real-time data update module 13 is specifically used for: Set the scheduling time interval using a scheduled task tool; Data updates are triggered periodically based on the aforementioned scheduling time interval.

[0052] For specific implementation details, please refer to the method embodiment; they will not be repeated here.

[0053] Furthermore, the real-time data update module 13 is also used for: Real-time data is collected from data sources using data acquisition tools, and the real-time data is analyzed to generate and update data in the simulation environment.

[0054] For specific implementation details, please refer to the method embodiment; they will not be repeated here.

[0055] Another embodiment of the present invention provides a device for simulating a real business environment, such as... Figure 3 As shown, device 10 includes: One or more processors 110 and memory 120, Figure 3The following description uses a processor 110 as an example. The processor 110 and the memory 120 can be connected via a bus or other means. Figure 3 Taking the example of a connection between China and Israel via a bus.

[0056] Processor 110 is used to perform various control logics of device 10, and can be a general-purpose processor, digital signal processor (DSP), application-specific integrated circuit (ASIC), field-programmable gate array (FPGA), microcontroller, ARM (Acorn RISC Machine) or other programmable logic device, discrete gate or transistor logic, discrete hardware components, or any combination of these components. Furthermore, processor 110 can also be any conventional processor, microprocessor, or state machine. Processor 110 can also be implemented as a combination of computing devices, such as a combination of DSP and microprocessor, multiple microprocessors, one or more microprocessors combined with a DSP core, or any other such configuration.

[0057] The memory 120, as a non-volatile computer-readable storage medium, can be used to store non-volatile software programs, non-volatile computer-executable programs, and modules, such as the program instructions corresponding to the method for simulating a real business environment in the embodiments of the present invention. The processor 110 executes various functional applications and data processing of the device 10 by running the non-volatile software programs, instructions, and units stored in the memory 120, thereby implementing the method for simulating a real business environment in the above-described method embodiments.

[0058] The memory 120 may include a program storage area and a data storage area, wherein the program storage area may store applications required for operating the device and at least one function; and the data storage area may store data created according to the use of the device 10. Furthermore, the memory 120 may include high-speed random access memory and may also include non-volatile memory, such as at least one disk storage device, flash memory device, or other non-volatile solid-state storage device. In some embodiments, the memory 120 may optionally include memory remotely located relative to the processor 110, and these remote memories may be connected to the device 10 via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0059] One or more units are stored in memory 120, and when executed by one or more processors 110, they perform the method simulating a real business environment as described in any of the above method embodiments, for example, performing the above-described... Figure 1 The method steps S100 to S400.

[0060] This invention provides a non-volatile computer-readable storage medium storing computer-executable instructions that are executed by one or more processors, for example, to perform the operations described above. Figure 1 The method steps S100 to S400.

[0061] As an example, non-volatile storage media can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable ROM (EEPROM), or flash memory. Volatile memory can include random access memory (RAM) as an external cache memory. By way of illustration and not limitation, RAM can be obtained in many forms such as synchronous RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), dual data rate SDRAM (DDR SDRAM), enhanced SDRAM (ESDRAM), Synchlink DRAM (SLDRAM), and direct Rambus RAM (DRRAM). The memory components or memories disclosed in the operating environment described herein are intended to include one or more of these and / or any other suitable types of memory.

[0062] Another embodiment of the present invention provides a computer program product, which includes a computer program stored on a non-volatile computer-readable storage medium. The computer program includes program instructions that, when executed by a processor, cause the processor to perform the method described in the above-described method embodiments, simulating a real business environment. For example, performing the above-described... Figure 1 The method steps S100 to S400.

[0063] The embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs.

[0064] Through the description of the above embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus a general-purpose hardware platform, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the parts that contribute to the related technology, can be embodied in the form of a software product. This computer software product can exist in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., including several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods of various embodiments or some parts of embodiments.

[0065] Among other things, conditional language such as “can,” “may,” “may,” or “may,” unless otherwise specifically stated or otherwise understood as in the context in which they are used, is generally intended to convey that a particular implementation may include (but not others) certain features, elements, and / or operations. Therefore, such conditional language is also generally intended to imply that features, elements, and / or operations are necessary for one or more implementations in any way, or that one or more implementations must include logic for determining, with or without input or prompting, whether such features, elements, and / or operations are included or will be performed in any particular implementation.

[0066] The contents already described herein in this specification and accompanying drawings include examples of methods and apparatus capable of simulating real-world business environments. It is certainly not possible to describe every conceivable combination of elements and / or methods for the purpose of describing the various features of this disclosure, but it will be appreciated that many other combinations and substitutions of the disclosed features are possible. Therefore, it will be apparent that various modifications can be made to this disclosure without departing from the scope or spirit of this disclosure. Furthermore, or in alternatives, other embodiments of this disclosure may become apparent from consideration of this specification and accompanying drawings and from the practice of this disclosure as presented herein. It is intended that the examples presented in this specification and accompanying drawings be considered illustrative rather than restrictive in all respects. Although specific terminology is used herein, it is used in a general and descriptive sense and is not intended for limiting purposes.

Claims

1. A method for simulating a real business environment, characterized in that... The method includes: Create container images based on virtualization technology; Based on automated deployment tools, the container image is deployed to the honeypot service, and the resulting honeypot service is deployed to the simulation environment based on the specific scenario. Data generation and updating are triggered within the simulation environment; The generated and updated data are stored, and the stored data is associated with the corresponding honeypot service in real time to complete the simulation of a real business environment; The triggering of data generation and updating in the simulation environment includes: Based on a scheduled task tool, a scheduling time interval is set, and data updates are periodically triggered based on the scheduling time interval; and / or, real-time data is collected from a data source based on a data acquisition tool, the real-time data is analyzed, and data generation and updates are completed in the simulation environment. The step of storing the generated and updated data and associating the stored data with the corresponding honeypot service in real time includes: Use a real-time database or caching system to store and update data, and associate the data with the corresponding honeypot service; By combining business systems to create services for different business scenarios and associating them with corresponding data services, a core simulated business system is formed in the simulated network environment.

2. The method for simulating a real business environment according to claim 1, characterized in that, The creation of container images based on virtualization technology includes: Create cross-platform visual interactive interfaces based on web front-end development technologies; The code, dependencies, and resources of the visual interactive interface are packaged into a container image to form a container image that can be deployed quickly.

3. The method for simulating a real business environment according to claim 2, characterized in that, The creation of a cross-platform visual interactive interface based on web front-end development technology includes: Based on web front-end development technology, the interface parameters of the visual interactive interface are set; Create chart types, interactive features, and data-driven approaches based on visualization libraries and tools; Using visual programming tools, cross-platform visual interactive interfaces can be created by dragging, dropping, and connecting components.

4. The method for simulating a real business environment according to claim 3, characterized in that, The deployment of the container image to the honeypot service using automated deployment tools includes: The container image is deployed to the honeypot service using an automated deployment tool, and the service parameters of the deployed honeypot service are defined.

5. The method for simulating a real business environment according to claim 4, characterized in that, The process of deploying the obtained honeypot service to the simulation environment based on a specific scenario includes: Obtain the specific scenario types and business requirements of real business systems; Based on the scenario type and business requirements, the obtained honeypot service is deployed to the simulation environment.

6. An apparatus for simulating a real business environment, characterized in that, The device includes: The container image creation module is used to create container images based on virtualization technology. The honeypot service deployment module is used to deploy the container image to the honeypot service based on automated deployment tools, and to deploy the resulting honeypot service to the simulation environment based on specific scenarios. A real-time data update module is used to trigger data generation and updates in the simulation environment; The business environment simulation module is used to store the generated and updated data and associate the stored data with the corresponding honeypot service in real time to complete the simulation of the real business environment. The real-time data update module includes: Based on a scheduled task tool, a scheduling time interval is set, and data updates are periodically triggered based on the scheduling time interval; and / or, real-time data is collected from a data source based on a data acquisition tool, the real-time data is analyzed, and data generation and updates are completed in the simulation environment. The business environment simulation module includes: Use a real-time database or caching system to store and update data, and associate the data with the corresponding honeypot service; By combining business systems to create services for different business scenarios and associating them with corresponding data services, a core simulated business system is formed in the simulated network environment.

7. A device for simulating a real business environment, characterized in that, The device includes at least one processor; and, A memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor to enable the at least one processor to perform the method for simulating a real business environment as described in any one of claims 1-5.

8. A non-volatile computer-readable storage medium, characterized in that, The non-volatile computer-readable storage medium stores computer-executable instructions that, when executed by one or more processors, cause the one or more processors to perform the method of simulating a real business environment as described in any one of claims 1-5.

Images