A honey spot domain name optimization deployment method, system, device and storage medium

Abstract

The present invention discloses a method, system, device and storage medium for optimizing and deploying a honey spot domain name. The method comprises: obtaining a plurality of preset subdomain name blasting dictionaries and a plurality of subdomain names; preprocessing the plurality of subdomain name blasting dictionaries to obtain a fusion dictionary, and then calculating the word frequency corresponding to each of the subdomain names in the fusion dictionary; calculating the correlation between the protected system and each of the subdomain names, obtaining a false subdomain name according to the correlation and the word frequency, and then deploying a simulated web page honey spot according to the false subdomain name; regularly obtaining the stepping data of the simulated web page honey spot, and updating the simulated web page honey spot according to the stepping data. The present invention can generate corresponding false subdomain names according to the attack tendency of the attacker, thereby deploying the honey spot, can defend against the attacker more comprehensively and accurately, improve the effectiveness and sustainability of the honey spot, and can be widely used in the field of network security.

Description

Technical Field

[0001] The present invention relates to the field of network security, and in particular to a method, system, device and storage medium for optimizing and deploying a honeypot domain name. Background Art

[0002] With the rapid development of Internet technology, network information security has become increasingly important. In the existing technology, network security personnel usually use honeypots to implement active defense. Honeypots are usually divided into low-interaction and high-interaction types. Low-interaction honeypots mainly perform simple simulations of system or application services, and can capture very limited attack behaviors; high-interaction honeypots or honeynets generally simulate real system services, which requires a lot of resources and is costly. It is usually difficult to deploy a large number of high-interaction honeypots in the business network, but a single and small number of honeypot nodes are difficult to play the role of honeypots, and the protection range is not comprehensive enough. Therefore, honeypot technology has the problem of difficulty in deployment in actual application.

[0003] Honey spots are simulation systems that use simulation technology and trap technology to build alerts for protected systems. They do not need to simulate all the functions of the protected system, but can sense suspicious attacks and effectively block attackers from entering the protected system without affecting the normal use of users. They have low resource consumption and can be deployed in relatively large batches. Lightweight honey spot technology is different from honeypot technology. Honey spots only passively detect attacks, rather than actively trapping like honeypots, so the false alarm rate is extremely low. However, on the one hand, the existing honey spot technology lacks honey spot deployment strategies for attackers' information behavior, resulting in insufficient comprehensive and accurate defense against attackers, and inability to effectively interfere with attackers' information collection activities; on the other hand, honey spots are generally randomly generated and fixed, making it difficult to cope with attackers' changing strategies. Honey spots have low pertinence and effectiveness, and low misleading effects on attackers. Summary of the invention

[0004] In order to solve the above technical problems, the purpose of the present invention is to provide a method, system, device and storage medium for optimizing the deployment of honey spot domain names, which can improve the effectiveness and sustainability of honey spots and defend against attackers more comprehensively and accurately.

[0005] The technical solution adopted in one aspect of the present invention is:

[0006] A method for optimizing and deploying a honeypot domain name comprises the following steps:

[0007] Get the preset multiple subdomain blasting dictionaries and multiple subdomains;

[0008] Preprocessing the plurality of subdomain blasting dictionaries to obtain a fused dictionary, and then calculating the word frequency corresponding to each subdomain in the fused dictionary;

[0009] Calculating the correlation between the protected system and each of the subdomains, obtaining a false subdomain according to the correlation and the word frequency, and then deploying a simulated webpage honey spot according to the false subdomain;

[0010] The stepping data of the simulated webpage honey spot is obtained regularly, and the simulated webpage honey spot is updated according to the stepping data.

[0011] Furthermore, the simulated web page honey spot is used to simulate the appearance and interaction process of the protected system.

[0012] Furthermore, the step of preprocessing the plurality of subdomain blasting dictionaries to obtain a fused dictionary, and then calculating the word frequency corresponding to each subdomain in the fused dictionary specifically includes:

[0013] De-duplication and cleaning of each subdomain blasting dictionary are performed to obtain a plurality of first dictionaries;

[0014] Normalizing each of the first dictionaries to obtain a dictionary list;

[0015] Merging the dictionary lists to obtain the fused dictionary;

[0016] The frequency of each of the subdomains appearing in the fusion dictionary is calculated to obtain the word frequency.

[0017] Furthermore, the step of calculating the relevance between the protected system and each of the subdomains specifically includes:

[0018] Acquire keywords and business information of the protected system, and then obtain first semantic information according to the keywords and the business information;

[0019] Semantic analysis is performed on each of the subdomains to obtain second semantic information, and then the relevance is obtained according to the first semantic information and the second semantic information.

[0020] Furthermore, the step of obtaining a false subdomain name according to the relevance and the word frequency, and then deploying a simulated webpage honey spot according to the false subdomain name specifically includes:

[0021] Obtaining the importance value of the subdomain name according to the relevance and the word frequency;

[0022] Using the importance value as the weight value of the subdomain, and then obtaining the false subdomain by weighted sampling method;

[0023] The simulated webpage honeypot is deployed in a preset website according to the false subdomain name.

[0024] Further, the step of updating the simulated webpage honey spot according to the stepping data specifically includes:

[0025] When the simulated webpage honey spot is stepped on by the attacker, the simulated webpage honey spot is retained;

[0026] When the simulated webpage honey spot is not stepped on by the attacker within the preset first time period, the correlation is recalculated and a new simulated webpage honey spot is generated according to the new correlation.

[0027] The technical solution adopted in another aspect of the present invention is:

[0028] A honey spot domain name optimization deployment system, comprising:

[0029] The subdomain acquisition module is used to obtain multiple preset subdomain blasting dictionaries and multiple subdomains;

[0030] A dictionary fusion module is used to pre-process the multiple subdomain blasting dictionaries to obtain a fused dictionary, and then calculate the word frequency corresponding to each subdomain in the fused dictionary;

[0031] A honey spot deployment module, used to calculate the correlation between the protected system and each of the subdomains, obtain a false subdomain according to the correlation and the word frequency, and then deploy a simulated webpage honey spot according to the false subdomain;

[0032] The honey spot updating module is used to periodically obtain the hitting data of the simulated web page honey spot, and update the simulated web page honey spot according to the hitting data.

[0033] Furthermore, the simulated web page honey spot is used to simulate the appearance and interaction process of the protected system.

[0034] The technical solution adopted in another aspect of the present invention is:

[0035] A computer device comprising:

[0036] at least one processor;

[0037] at least one memory for storing at least one program;

[0038] When the at least one program is executed by the at least one processor, the at least one processor implements the aforementioned method for optimizing and deploying the honey spot domain name.

[0039] The technical solution adopted in another aspect of the present invention is:

[0040] A computer-readable storage medium stores a program executable by a processor, wherein the program executable by the processor is used to implement the aforementioned honey spot domain name optimization deployment method when executed by the processor.

[0041] The beneficial effects of the present invention are as follows: the honey spot domain name optimization deployment method, system, device and storage medium of the present invention, on the one hand, can generate false subdomains related to the protected system by obtaining multiple subdomain blasting dictionaries and subdomains commonly used by attackers, and then deploy a large number of simulated web page honey spots according to the false subdomains, so as to defend against attackers more comprehensively and accurately; on the other hand, by regularly obtaining honey spot hit data and regenerating and deploying honey spots that have not been hit for a long time, the effectiveness and sustainability of the honey spots can be improved, and the efficiency of capturing attackers can be increased. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] Figure 1 A flowchart of the steps of a method for optimizing and deploying a honey spot domain name provided by an embodiment of the present invention;

[0043] Figure 2 A dictionary fusion flow chart of a method for optimizing and deploying a honey spot domain name provided by an embodiment of the present invention;

[0044] Figure 3 A schematic diagram of generating a honey spot domain name provided by an embodiment of the present invention;

[0045] Figure 4 A processing flow chart of a method for optimizing and deploying a honey spot domain name provided by an embodiment of the present invention;

[0046] Figure 5 A schematic diagram of the structure of a honey spot domain name optimization deployment system provided by an embodiment of the present invention;

[0047] Figure 6 A schematic diagram of the structure of a computer device provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0048] With the rapid development of Internet technology, network information security has become increasingly important. Honey spots are simulation systems that use simulation technology and trap technology to build a protected system for alerting. It does not need to simulate all the functions of the protected system, can sense suspicious attacks, and effectively block attackers from entering the protected system without affecting the normal use of users. It has low resource consumption and can be deployed in relatively large batches. Lightweight honey spot technology is different from honeypot technology. Honey spots only passively detect attacks, and do not actively trap like honeypots, so the false alarm rate is extremely low. However, the existing honey spot technology lacks a honey spot deployment strategy for attackers' information behavior, resulting in insufficient comprehensive and accurate defense against attackers, and cannot effectively interfere with attackers' information collection activities; on the other hand, it generally generates honey spots randomly and the honey spots are fixed, which makes it difficult to cope with attackers' changing strategies. Honey spots have low pertinence and effectiveness, and low misleading effect on attackers.

[0049] To this end, an embodiment of the present invention proposes a method for optimizing the deployment of honey spot domain names. On the one hand, by obtaining multiple subdomain blasting dictionaries and subdomains commonly used by attackers, false subdomains related to the protected system can be generated, and then a large number of simulated web page honey spots are deployed based on the false subdomains, so as to defend against attackers more comprehensively and accurately; on the other hand, by regularly obtaining honey spot hit data and regenerating and deploying honey spots that have not been hit for a long time, the effectiveness and sustainability of the honey spots can be improved, and the efficiency of capturing attackers can be increased.

[0050] The embodiment of the present invention proposes a method for optimizing and deploying a honeypot domain name. Figure 1 As shown, the method includes steps S101 to S104:

[0051] S101, obtaining a preset multiple subdomain blasting dictionary and multiple subdomains;

[0052] Specifically, by studying and analyzing multiple subdomain blasting tools commonly used by attackers, such as SubGDC, Dumb, ksubdomain, and DN-Scan, we can collect the built-in dictionaries used by these subdomain blasting tools. We can also obtain multiple subdomain blasting dictionaries commonly used by attackers through open source dictionaries, dictionaries contributed by the security community, and domain name data publicly available on the Internet. These dictionaries contain common subdomains commonly used by attackers.

[0053] S102, preprocessing multiple subdomain blasting dictionaries to obtain a fusion dictionary, and then calculating the word frequency corresponding to each subdomain in the fusion dictionary;

[0054] Reference Figure 2As an optional implementation, multiple subdomain blasting dictionaries are preprocessed to obtain a fusion dictionary, and then the word frequency corresponding to each subdomain in the fusion dictionary is calculated. This step can be divided into the following steps S1021 to S1024:

[0055] S1021, de-duplicate and clean up each subdomain blasting dictionary to obtain multiple first dictionaries;

[0056] Specifically, since there may be duplicate data and non-compliant characters in a single subdomain blasting dictionary, in order to ensure the cleanliness and consistency of the dictionary, it is necessary to deduplicate and clean the data of each subdomain blasting dictionary obtained to obtain multiple first dictionaries.

[0057] S1022, normalize each first dictionary to obtain a dictionary list;

[0058] Specifically, the purpose of normalization is to unify the first dictionaries from different sources so that they have the same features, units and data formats for subsequent processing and fusion. After normalization, a dictionary list D = [D1, D2, ... Dn] is obtained.

[0059] S1023, merging the dictionary lists to obtain a fused dictionary;

[0060] Specifically, the dictionary list D=[D1, D2, ...Dn] is fused into a fused dictionary, and the fused dictionary is imported into the database.

[0061] S1024: Calculate the frequency of each subdomain appearing in the fusion dictionary to obtain the word frequency.

[0062] Specifically, in the process of importing the fusion dictionary into the database, the word frequency f(d) of each subdomain in the fusion dictionary is counted. The word frequency can measure the number of times the subdomain appears in the data source. Subdomains with higher frequencies may be more important.

[0063] S103, calculating the correlation between the protected system and each subdomain, obtaining a false subdomain according to the correlation and word frequency, and then deploying a simulated webpage honey spot according to the false subdomain;

[0064] Among them, the simulated web page honey spot is used to simulate the appearance and interaction process of the protected system. It does not have to realize all the functions of the protected system. The honeypot technology needs to realize all the functions and services of the real system, and the deployment and configuration process is more complicated, requiring more system resources and time. Therefore, the deployment of honey spots is simpler than honeypot technology and consumes less resources.

[0065] Specifically, by using data sources such as subdomain blasting dictionaries commonly used by attackers to generate subdomains with high blasting frequencies used by attackers as honey spot domains, attackers can be lured into hitting the honey spots according to their attack tendencies.

[0066] As an optional implementation, the step of calculating the relevance between the protected system and each subdomain name can be further divided into the following steps S1031 and S1032:

[0067] S1031, obtaining keywords and business information of the protected system, and then obtaining first semantic information according to the keywords and business information;

[0068] Specifically, first semantic information K related to the protected system is obtained according to the keyword k and business information of the protected system.

[0069] S1032, performing semantic analysis on each subdomain to obtain second semantic information, and then obtaining a relevance based on the first semantic information and the second semantic information;

[0070] Specifically, the probability that each subdomain d contains the semantics related to the protected system is calculated, and the common substring length P(k∩d) of the subdomain d and the protected system keyword k is expressed using the following formula:

[0071] P(k∩d)=LCS(k,d) / (L(k)+L(d))

[0072] Among them, LCS(k,d) represents the length of the longest common subsequence of keyword k and subdomain d, L(k) represents the length of keyword k, L(d) represents the length of subdomain d, and k∈K.

[0073] Next, the conditional probability P(K|d) of the semantic information K related to the protected system in the subdomain d is calculated according to the following formula. Then, the relevance R(d) of each subdomain d to the protected system is P(K|d):

[0074] P(K|d)=ΣP(k|d)

[0075] As an optional implementation, the step of obtaining a false subdomain name according to the relevance and the word frequency, and then deploying a simulated webpage honey spot according to the false subdomain name can be further divided into the following steps S1033 and S1035:

[0076] S1033, obtaining the importance value of the subdomain name according to the relevance and word frequency;

[0077] Specifically, the importance value I(d) of subdomain d is obtained according to the following formula:

[0078] I(d)=f(d)*R(d)

[0079] Among them, I(d) is the product of the word frequency f(d) and the relevance R(d). By performing the product operation on the word frequency f(d) and the relevance R(d), the frequency of the subdomain d appearing in the data source and the degree of association with the protected system can be comprehensively considered to obtain the importance of the subdomain d.

[0080] S1034, using the importance value as the weight value of the subdomain, and then obtaining the false subdomain through a weighted sampling method;

[0081] Specifically, firstly, the sum of the weights of all subdomains d is calculated according to the importance value I(d) of each subdomain d, and then the proportion of the weight value of each subdomain d to the total weight value P(d) is calculated by the following formula, and then a random number r between 0 and 1 is generated, and all subdomains d are traversed, and their weight value proportions are accumulated until the accumulated value is greater than r, and the corresponding subdomain d is returned as a fake subdomain:

[0082]

[0083] Using the weighted sampling method can make the subdomain d with a higher importance value I(d) more likely to be selected, while not losing the diversity of the generated fake subdomains.

[0084] S1035, deploying a simulated webpage honeypot according to the fake subdomain in the preset URL.

[0085] Specifically, Figure 3 A schematic diagram is generated for the honey spot domain name. The honey spot URL generated by randomly combining the generated fake subdomain name with the commonly used web page directory of the protected system is transmitted to the honey spot domain name generator, and the corresponding simulated web page honey spots are deployed around the protected system. The honey spot page is no different from the real business page in appearance and interaction mode, thereby increasing the misleading effect on attackers.

[0086] S104, regularly obtaining the hitting data of the simulated web page honey spot, and updating the simulated web page honey spot according to the hitting data.

[0087] As an optional implementation, step S104 may be further divided into the following steps S1041 and S1042:

[0088] S1041, when the simulated webpage honey spot is stepped on by the attacker, the simulated webpage honey spot is retained;

[0089] Specifically, if the deployed simulated webpage honey spot is hit by an attacker, the system can record the attacker's detection behavior without being noticed, indicating that the simulated webpage honey spot is a blasting subdomain commonly used by the attacker, and retain it to continuously detect the attacker's detection behavior.

[0090] S1042, when the simulated webpage honey spot is not stepped on by the attacker within the preset first time period, recalculate the correlation and generate a new simulated webpage honey spot according to the new correlation;

[0091] Specifically, if the simulated web page honey spot does not detect the attacker's detection behavior within the preset first time period, it means that the simulated web page honey spot has not been stepped on by the attacker for a long time and is not a blasting subdomain commonly used by the attacker. Then, the correlation between each acquired subdomain and the protected system is recalculated, and a new simulated web page honey spot is generated based on the new correlation to ensure the effectiveness and sustainability of the honey spot.

[0092] As mentioned above, the process of the honeypot domain name optimization deployment method is as follows Figure 4 As shown:

[0093] Step 1: Get the subdomain blasting dictionary commonly used by attackers;

[0094] Step 2: Fusion-optimize the dictionary and obtain word frequency;

[0095] Step 3: Generate fake subdomains with high attack frequency and related to the protected system;

[0096] Step 4: Deploy high-simulation web honey spots;

[0097] Step 5: Update high-simulation web page honey spots regularly.

[0098] The above is an explanation of the honey spot domain name optimization deployment construction method of the embodiment of the present invention. It can be recognized that, compared with the existing honey spot deployment method, the embodiment of the present invention, on the one hand, obtains multiple subdomain name blasting dictionaries and subdomain names commonly used by attackers, merges multiple dictionaries and calculates the word frequency corresponding to each subdomain name in the dictionary, and can generate false subdomain names according to the word frequency and the correlation between the protected system and each subdomain name, and then deploys a large number of simulated web page honey spots according to the false subdomain names, and defends against attackers more comprehensively and accurately according to the attacker's attack tendency; on the other hand, by regularly obtaining honey spot stepping data and regenerating and deploying honey spots that have not been stepped on for a long time, the effectiveness and sustainability of honey spots can be improved, and the capture efficiency of attackers can be increased; in addition, compared with the traditional honeypot deployment method, the simulated web page honey spots generated by the embodiment of the present invention only need to simulate the appearance and interaction process of the protected system, and the deployment process is simpler and resource consumption is lower.

[0099] Reference Figure 5 The embodiment of the present invention further provides a honey spot domain name optimization deployment system, including:

[0100] The subdomain acquisition module is used to obtain multiple preset subdomain blasting dictionaries and multiple subdomains;

[0101] The dictionary fusion module is used to pre-process multiple subdomain blasting dictionaries to obtain a fused dictionary, and then calculate the word frequency corresponding to each subdomain in the fused dictionary;

[0102] A honey spot deployment module is used to calculate the correlation between the protected system and each subdomain, obtain a fake subdomain based on the correlation and word frequency, and then deploy a simulated web page honey spot based on the fake subdomain;

[0103] The honey spot update module is used to regularly obtain the hit data of the simulated web page honey spot and update the simulated web page honey spot according to the hit data.

[0104] The contents of the above-mentioned sweet spot domain name optimization and deployment method embodiments are all applicable to the present sweet spot domain name optimization and deployment system embodiments. The functions specifically implemented by the present sweet spot domain name optimization and deployment system embodiments are the same as those of the above-mentioned sweet spot domain name optimization and deployment method embodiments, and the beneficial effects achieved are also the same as those achieved by the above-mentioned sweet spot domain name optimization and deployment method embodiments.

[0105] Reference Figure 6 , an embodiment of the present invention further provides a computer device, including:

[0106] at least one processor;

[0107] at least one memory for storing at least one program;

[0108] When at least one program is executed by at least one processor, the at least one processor implements Figure 1 The honey spot domain name optimization deployment method shown.

[0109] The contents of the above-mentioned sweet spot domain name optimization deployment method embodiment are all applicable to the present computer device embodiment. The functions specifically implemented by the present computer device embodiment are the same as those of the above-mentioned sweet spot domain name optimization deployment method embodiment, and the beneficial effects achieved are also the same as those achieved by the above-mentioned sweet spot domain name optimization deployment method embodiment.

[0110] The embodiment of the present invention further provides a computer-readable storage medium, wherein a program executable by a processor is stored, and the program executable by the processor is used to implement Figure 1 The honey spot domain name optimization deployment method shown.

[0111] A computer-readable storage medium according to an embodiment of the present invention can execute the honey spot domain name optimization deployment method provided by the method embodiment of the present invention, can execute any combination of implementation steps of the method embodiment, and has the corresponding functions and beneficial effects of the method.

[0112] The embodiment of the present invention also discloses a computer program product or a computer program, wherein the computer program product or the computer program includes computer instructions, and the computer instructions are stored in a computer-readable storage medium. A processor of a computer device can read the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, so that the computer device executes Figure 1 The method shown.

[0113] In some selectable embodiments, the function / operation mentioned in the block diagram may not occur in the order mentioned in the operation diagram. For example, depending on the function / operation involved, the two boxes shown in succession can actually be executed substantially simultaneously or the above-mentioned boxes can sometimes be executed in reverse order. In addition, the embodiment presented and described in the flow chart of the present invention is provided by way of example, for the purpose of providing a more comprehensive understanding of technology. The disclosed method is not limited to the operation and logic flow presented herein. Selectable embodiments are expected, wherein the order of various operations is changed and the sub-operation of a part for which is described as a larger operation is performed independently.

[0114] In addition, although the present invention is described in the context of functional modules, it should be understood that, unless otherwise specified to the contrary, one or more of the above-mentioned functions and / or features can be integrated into a single physical device and / or software module, or one or more functions and / or features can be implemented in a separate physical device or software module. It is also understood that a detailed discussion of the actual implementation of each module is unnecessary for understanding the present invention. More specifically, in view of the properties, functions and internal relationships of the various functional modules in the device disclosed herein, the actual implementation of the module will be understood within the conventional skills of the engineer. Therefore, those skilled in the art can implement the present invention set forth in the claims without excessive experimentation using ordinary techniques. It is also understood that the specific concepts disclosed are merely illustrative and are not intended to limit the scope of the present invention, which is determined by the full scope of the appended claims and their equivalents.

[0115] If the above functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the above methods of each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk and other media that can store program codes.

[0116] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as an ordered list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by an instruction execution system, device or apparatus (such as a computer-based system, a system including a processor, or other system that can fetch instructions from an instruction execution system, device or apparatus and execute instructions), or in conjunction with such instruction execution systems, devices or apparatuses. For the purposes of this specification, "computer-readable medium" can be any device that can contain, store, communicate, propagate or transmit a program for use by an instruction execution system, device or apparatus, or in conjunction with such instruction execution systems, devices or apparatuses.

[0117] More specific examples of computer-readable media (a non-exhaustive list) include the following: an electrical connection with one or more wires (electronic device), a portable computer disk case (magnetic device), a random access memory (RAM), a read-only memory (ROM), an erasable and editable read-only memory (EPROM or flash memory), an optical fiber device, and a portable compact disk read-only memory (CDROM). In addition, the computer-readable medium may even be a paper or other suitable medium on which the above-mentioned program is printed, since the above-mentioned program can be obtained electronically, for example, by optically scanning the paper or other medium, followed by editing, deciphering or processing in other suitable ways as necessary, and then stored in a computer memory.

[0118] It should be understood that the various parts of the present invention can be implemented by hardware, software, firmware or a combination thereof. In the above-mentioned embodiments, a plurality of steps or methods can be implemented by software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented by hardware, as in another embodiment, it can be implemented by any one of the following technologies known in the art or their combination: a discrete logic circuit having a logic gate circuit for implementing a logic function for a data signal, a dedicated integrated circuit having a suitable combination of logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc.

[0119] In the above description of this specification, the description with reference to the terms "one embodiment / example", "another embodiment / example" or "certain embodiments / examples" etc. means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present invention. In this specification, the schematic representation of the above terms does not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described may be combined in any one or more embodiments or examples in a suitable manner.

[0120] Although embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions and variations may be made to the embodiments without departing from the principles and spirit of the present invention, and that the scope of the present invention is defined by the claims and their equivalents.

[0121] The above is a specific description of the preferred implementation of the present invention, but the present invention is not limited to the embodiments. Those skilled in the art may make various equivalent modifications or substitutions without violating the spirit of the present invention. These equivalent modifications or substitutions are all included in the scope defined by the claims of this application.

Claims

1. A method for optimizing and deploying a honeypot domain name, characterized in that: The following steps are involved: Get the preset multiple subdomain blasting dictionaries and multiple subdomains; Preprocessing the plurality of subdomain blasting dictionaries to obtain a fused dictionary, and then calculating the word frequency corresponding to each subdomain in the fused dictionary; Calculating the correlation between the protected system and each of the subdomains, obtaining a false subdomain according to the correlation and the word frequency, and then deploying a simulated webpage honey spot according to the false subdomain; regularly obtaining the stepping data of the simulated webpage honey spot, and updating the simulated webpage honey spot according to the stepping data; The step of calculating the relevance between the protected system and each of the subdomains specifically includes: Acquire keywords and business information of the protected system, and then obtain first semantic information according to the keywords and the business information; Performing semantic analysis on each of the subdomains to obtain second semantic information, and then obtaining the relevance according to the first semantic information and the second semantic information; The step of obtaining a false subdomain name according to the relevance and the word frequency, and then deploying a simulated webpage honey spot according to the false subdomain name specifically includes: Obtaining the importance value of the subdomain name according to the relevance and the word frequency; Using the importance value as the weight value of the subdomain, and then obtaining the false subdomain by weighted sampling method; The simulated webpage honeypot is deployed in a preset website according to the false subdomain name.

2. A method for optimizing and deploying a honeypot domain name according to claim 1, characterized in that: The simulated webpage honey spot is used to simulate the appearance and interaction process of the protected system.

3. A method for optimizing and deploying a honeypot domain name according to claim 1, characterized in that: The step of preprocessing the plurality of subdomain blasting dictionaries to obtain a fused dictionary, and then calculating the word frequency corresponding to each subdomain in the fused dictionary specifically includes: De-duplication and cleaning of each subdomain blasting dictionary are performed to obtain a plurality of first dictionaries; Normalizing each of the first dictionaries to obtain a dictionary list; Merging the dictionary lists to obtain the fused dictionary; The frequency of each of the subdomains appearing in the fusion dictionary is calculated to obtain the word frequency.

4. A method for optimizing and deploying a honeypot domain name according to claim 1, characterized in that: The step of updating the simulated webpage honey spot according to the stepping data specifically includes: When the simulated webpage honey spot is stepped on by the attacker, the simulated webpage honey spot is retained; When the simulated webpage honey spot is not stepped on by the attacker within the preset first time period, the correlation is recalculated and a new simulated webpage honey spot is generated according to the new correlation.

5. A honey spot domain name optimization deployment system, characterized by: include: The subdomain acquisition module is used to obtain multiple preset subdomain blasting dictionaries and multiple subdomains; A dictionary fusion module is used to pre-process the multiple subdomain blasting dictionaries to obtain a fused dictionary, and then calculate the word frequency corresponding to each subdomain in the fused dictionary; A honey spot deployment module, used to calculate the correlation between the protected system and each of the subdomains, obtain a false subdomain according to the correlation and the word frequency, and then deploy a simulated webpage honey spot according to the false subdomain; A honey spot updating module, used for periodically acquiring the hit data of the simulated web page honey spot, and updating the simulated web page honey spot according to the hit data; The step of calculating the relevance between the protected system and each of the subdomains specifically includes: Acquire keywords and business information of the protected system, and then obtain first semantic information according to the keywords and the business information; Performing semantic analysis on each of the subdomains to obtain second semantic information, and then obtaining the relevance according to the first semantic information and the second semantic information; The step of obtaining a false subdomain name according to the relevance and the word frequency, and then deploying a simulated webpage honey spot according to the false subdomain name specifically includes: Obtaining the importance value of the subdomain name according to the relevance and the word frequency; Using the importance value as the weight value of the subdomain, and then obtaining the false subdomain by weighted sampling method; The simulated webpage honeypot is deployed in a preset website according to the false subdomain name.

6. A honey spot domain name optimization deployment system according to claim 5, characterized in that: The simulated webpage honey spot is used to simulate the appearance and interaction process of the protected system.

7. A computer device, characterized in that: include: at least one processor; at least one memory for storing at least one program; When the at least one program is executed by the at least one processor, the at least one processor implements the method according to any one of claims 1 to 4.

8. A computer-readable storage medium storing a program executable by a processor, characterized in that: The program executable by the processor is used to implement the method according to any one of claims 1 to 4 when executed by the processor.

Images