Intranet lateral movement attack defense method, system, device and storage medium

Abstract

The present invention discloses a defense method, system, device and storage medium for intranet lateral movement attack, and relates to the field of network security technology. By generating a false honey spot user similar to a normal user in the domain by imitating a unified naming method of users in the domain environment, it is possible to confuse the judgment of the attacker, so that the attacker cannot distinguish whether the user in the domain is real, and thus cannot filter the false honey spot user during communication. By configuring the false honey spot user, when the false honey spot user receives a message, an alarm signal can be issued, so that an alarm is issued in time when the domain controller authority is obtained by the attacker.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a method, system, device and storage medium for defending against lateral movement attacks on an intranet. Background Art

[0002] The workgroup is the most common and most prevalent resource management mode. By dividing different computers into different groups according to their functions, a more hierarchical network organization can be achieved. The establishment of the workgroup has achieved good resource sharing and management. However, as the number of computers in the network gradually increases, the requirements for security management and control are gradually increasing as the scale of assets continues to expand. The domain can achieve more complete unified management and centralized identity authentication than the workgroup, and has higher security. In a domain environment, all user accounts, user groups, computers and other network devices need to be registered in the central database of one or more domain controllers. Whenever a domain user needs to access resources within the domain, he must perform centralized identity authentication through the domain controller. In addition, the domain controller is also responsible for issuing instructions to hosts within the domain, responding to resource access requests from hosts within the domain, and executing domain security policies. As the "central control hub" of the domain environment, ensuring the security of the domain controller is an urgent problem to be solved.

[0003] Due to the clustered distribution of computers in the enterprise intranet, the enterprise intranet has become a disaster area for lateral movement attacks. When invading enterprise systems, attackers use lateral movement to escalate permissions and obtain key data information in important domains. Simply put, lateral movement means that after an attacker successfully invades a computer, the computer is used as a breakthrough point to cross horizontally to another computer in the domain, thereby obtaining a higher level of permissions and then stealing more sensitive and valuable information. The attacker uses a simple computer in the enterprise intranet as a breakthrough point to move laterally in the intranet unscrupulously, continuously escalating the level of permissions, and finally obtaining extremely critical domain control permissions. Once the domain control permissions are obtained and cannot be discovered in time, it will cause serious damage to the data security and privacy information of the attacked enterprise. The attacker will use key information and permissions as an excuse to implement blackmail.

[0004] There are already some methods to defend against lateral movement in the intranet. The main goal of most current methods is to increase the difficulty and cost of lateral movement for attackers, thereby blocking attackers' lateral movement within the domain. For example, password protection: by preventing attackers from stealing passwords, attackers are restricted from identity authentication and privilege escalation, ultimately blocking attackers' lateral movement; multi-factor authentication: by increasing authentication factors, attackers cannot achieve privilege escalation after obtaining only one authentication, thereby increasing the cost and difficulty of attackers' lateral movement; security patches and vulnerability management: by using security patches for system applications, fixing known vulnerabilities, and regularly performing vulnerability scans and security assessments, the security of systems and applications within the network is ensured, thereby eliminating the possibility of attackers' lateral movement.

[0005] However, the current method cannot detect in time that the domain controller permissions have been obtained and used, and thus cannot reduce the losses caused by lateral movement attacks. Technologies such as password protection and multi-factor authentication to defend against lateral movement in the intranet only increase the cost and price of lateral movement attacks, making it more difficult for attackers to escalate permissions. Nowadays, the means of attackers' lateral movement are very mature. In addition, the widespread use of lateral movement attack tools such as Mimikatz and PtH (Pass the hash) can achieve confrontation with defense methods, making the existing lateral movement defense methods ineffective. At the same time, the main goal of the current method is to block the attacker's lateral movement process and intercept the attack in the middle stage, and it cannot effectively detect in time that the domain controller permissions have been stolen. This means that once the attacker can successfully break through the limitations of the current defense method, he can successfully enter the intranet and "move around" in the intranet unscrupulously. If the domain controller permissions are obtained, the security personnel cannot know it in the first time, so there is no way to stop the further spread of the attack and the further expansion of the losses in time. Summary of the invention

[0006] The present invention aims to solve at least one of the technical problems existing in the prior art. To this end, the present invention proposes a method, system, device and storage medium for checking lateral movement attacks in an intranet, which can timely detect the status of a domain controller and realize effective lateral movement attack detection.

[0007] On the one hand, an embodiment of the present invention provides a method for defending against lateral movement attacks in an intranet, comprising the following steps:

[0008] Standardizing a first user name of a normal user in the domain according to a predefined user name structure, wherein the user name structure includes a name part and a tag part;

[0009] Generate a corresponding fake honey spot user identifier according to the first key, replace the marked part of the first user name with the fake honey spot user identifier, and obtain a second user name of the fake honey spot user with the same user name structure as that of a normal user;

[0010] Determine a list of false honey spot users using a plurality of false honey spot users generated by the first key;

[0011] A trigger script is configured for each false sweet spot user in the false sweet spot user list, so that the false sweet spot user sends out an alarm signal after receiving a message.

[0012] According to some embodiments of the present invention, based on a hash algorithm, the first key is encrypted by a hash function to obtain a first ciphertext;

[0013] The first ciphertext is processed according to a preset rule to obtain a verification ciphertext, and the verification ciphertext is stored in a database.

[0014] According to some embodiments of the present invention, an update instruction of a fake honey spot user is obtained, wherein the update instruction includes a second key and a third key;

[0015] The update instruction is authenticated according to the second key. When the update instruction passes the authentication, a new batch of fake honey spot users is generated according to the third key. The fake honey spot users in the fake honey spot user list are updated to the newly generated fake honey spot users, and the first key stored in the database is updated to the third key.

[0016] According to some embodiments of the present invention, the second key is encrypted using the same hash function as that used to encrypt the first key to obtain a second ciphertext;

[0017] Processing the second ciphertext according to the preset rule to obtain a verification ciphertext;

[0018] The verification ciphertext is compared with the check ciphertext. When the verification ciphertext is the same as the check ciphertext, the update instruction passes the authority authentication.

[0019] According to some embodiments of the present invention, determining a portion to be processed in the first ciphertext;

[0020] Mapping the first character string of the to-be-processed portion according to a preset mapping rule to obtain a second character string;

[0021] The second character string replaces the first character string of the part to be processed to obtain a verification ciphertext.

[0022] According to some embodiments of the present invention, selecting a first username from a plurality of first usernames as a target username;

[0023] The marked part in the target user name is replaced with the digital identifier to obtain a second user name of the fake honey spot user.

[0024] According to some embodiments of the present invention, a corresponding fake honey spot user identifier is generated according to the first key in the intra-domain communication instruction;

[0025] Filter out users whose marked part of the user name is the same as the false honey spot user identifier among all users in the domain, and establish communication with the filtered users.

[0026] On the other hand, an embodiment of the present invention further provides a defense system for intranet lateral movement attacks, including:

[0027] A first module is used to standardize a first user name of a normal user in the domain according to a predefined user name structure, wherein the user name structure includes a name part and a tag part;

[0028] The second module is used to generate a corresponding fake honey spot user identifier according to the first key, replace the marked part of the first user name with the fake honey spot user identifier, and obtain a second user name of the fake honey spot user with the same user name structure as that of a normal user;

[0029] A third module is used to generate a corresponding fake honey spot user identifier according to the first key, replace the marked part of the first user name with the fake honey spot user identifier, and obtain a second user name of the fake honey spot user with the same user name structure as that of a normal user;

[0030] The fourth module is used to configure a trigger script for each false honey spot user in the false honey spot user list, so that the false honey spot user sends an alarm signal after receiving the message.

[0031] On the other hand, an embodiment of the present invention further provides an electronic device, including a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the following steps are implemented:

[0032] On the other hand, an embodiment of the present invention further provides a computer-readable storage medium storing a computer program, wherein when the computer program is executed by a processor, the following steps are implemented:

[0033] The above technical solution of the present invention has at least one of the following advantages or beneficial effects: by generating a fake honey spot user similar to a normal user in the domain by imitating the unified naming method of users in the domain environment, it is possible to confuse the judgment of an attacker, so that the attacker cannot distinguish whether the user in the domain is real, and thus cannot filter the fake honey spot user during communication. By configuring the fake honey spot user, when the fake honey spot user receives a message, an alarm signal can be issued, so that an alarm is issued in time when the domain controller authority is obtained by the attacker. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] Figure 1 It is a flow chart of a method for defending against lateral movement attacks on an intranet provided by an embodiment of the present invention;

[0035] Figure 2 It is a schematic diagram of a process of generating a false honey spot user based on a key provided by an embodiment of the present invention;

[0036] Figure 3 The present invention is a flowchart of establishing communication with a user in a domain according to an embodiment of the present invention. DETAILED DESCRIPTION

[0037] Embodiments of the present invention are described in detail below, examples of which are shown in the accompanying drawings, wherein the same or similar reference numerals throughout represent the same or similar components or elements having the same or similar functions. The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain the present invention, and cannot be understood as limiting the present invention.

[0038] In the description of the present invention, it should be understood that descriptions involving orientation, such as up, down, left, right, etc., the orientations or positional relationships indicated are based on the orientations or positional relationships shown in the drawings, and are only for the convenience of describing the present invention and simplifying the description, rather than indicating or implying that the device or element referred to must have a specific orientation, be constructed and operated in a specific orientation, and therefore should not be understood as a limitation on the present invention.

[0039] In the description of the present invention, if there is a description of first, second, etc., it is only for the purpose of distinguishing technical features, and cannot be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features or implicitly indicating the sequence of the indicated technical features.

[0040] The embodiment of the present invention provides a method for defending against lateral movement attacks on an intranet. Figure 1 , including but not limited to the following steps:

[0041] S101: standardizing a first user name of a normal user in a domain according to a predefined user name structure, wherein the user name structure includes a name part and a tag part;

[0042] S102: Generate a corresponding fake honey spot user identifier according to the first key, replace the marked part in the first user name with the fake honey spot user identifier, and obtain a second user name of the fake honey spot user with the same user name structure as that of the normal user;

[0043] S103: Determine a false honey spot user list based on a plurality of false honey spot users generated by the first key;

[0044] S104: configuring a trigger script for each false honey spot user in the false honey spot user list, so that the false honey spot user sends an alarm signal after receiving the message.

[0045] In some embodiments, reference Figure 2 , taking the key as a password as an example, the administrator holds an original password, which can be composed of numbers, letters and some characters, represented by the string S k =S1S2……S n Indicates, where n represents the password length. The fake honey spot user generator first maps the password, which can include the number of fake honey spot users to be generated and the user name structure customized for the unified naming format. The password S held by the administrator is k Mapped to a seed S e , the role of the generator is to use the seed S e Within the scope of the number of users in the domain, the administrator decides to generate a specified number of fake honey spot users and fake honey spot user names, wherein the fake honey spot user names are generated by imitating the user names of normal users in the domain, thereby achieving the purpose of confusing attackers.

[0046] Specifically, the administrator divides the username structure into a name part and a mark part according to the first username of a normal user in the domain according to the predefined username structure specification, wherein the name part can be replaced according to different actual situations. For example, in the present embodiment, the name part is composed of User and an underscore "_". A fake honey spot user identifier is generated based on a specific algorithm according to the password. The fake honey spot user identifier replaces the mark part in the first username to obtain a second username of the fake honey spot user with the same username structure as the normal user.

[0047] The k fake honey spot users generated by the passwords form a fake honey spot user list, which acts as a domain controller tripwire in the domain. A trigger script is configured for each fake honey spot user in the fake honey spot user list. Since the fake honey spot users only lurk in the domain environment as bait for passive defense and do not generate message exchanges with any host in the domain, once the fake honey spot users receive a message from the domain controller, it means that there is a security threat to the domain controller. The fake honey spot users will immediately issue an alarm to remind the security management personnel that the domain controller permissions are being threatened. The fake honey spot users act as tripwires to passively capture the attacker's illegal intrusion. After the security incident is settled, the security management personnel can use attack tracing to lock the attacker who moved laterally in the intranet and track the attacker.

[0048] In this embodiment, the method for generating fake honey spot users has a high degree of simulation and concealment. The fake honey spot user names with the same naming structure as normal user names are used in a simulated manner to confuse attackers, so that it is difficult for attackers to distinguish the authenticity of domain users, thereby increasing the cost of lateral movement attacks. In addition, since fake honey spot users do not need to actively trap attacks, the domain controller can be detected through the state feedback of fake honey spot users, which can capture and discover anomalies in a tripwire manner, perform passive defense against lateral movement attacks, and achieve effective lateral movement attack detection.

[0049] In an embodiment of the present invention, the method for defending against an intranet lateral movement attack in an embodiment of the present invention further includes but is not limited to the following steps:

[0050] S201: Based on a hash algorithm, encrypt the first key through a hash function to obtain a first ciphertext;

[0051] S202: Process the first ciphertext according to a preset rule to obtain a verification ciphertext, and store the verification ciphertext in a database.

[0052] In some embodiments, the administrator password (ie, the first key) is stored in the database in ciphertext form. When the administrator successfully generates a group of fake honey spot users, the generator automatically obtains the password used by the administrator and encrypts it using a hash algorithm.

[0053] Specifically, the original password key1 is encrypted into the first ciphertext hash(key1) through a hash function, thereby reducing the probability of collision. Let hash(key1) = a1a2a3...a n, represents the ciphertext encrypted by the hash algorithm, a string of characters of length n. In order to prevent attackers from breaking into the database and obtaining the database file storing the administrator password, the hash (key1) encrypted by the hash algorithm is further processed according to the preset rules to generate the verification ciphertext Code (key1), where the process processed according to the preset rules is irreversible, that is, the original input cannot be reversed from the output result. The encryption process is made irreversible by further processing the ciphertext, which means that even if the attacker can obtain the ciphertext file containing the administrator password in the database, he cannot accurately restore the ciphertext processed according to the preset rules to obtain the original administrator password.

[0054] It should be noted that the construction methods of the hash function in step S201 include: direct addressing method, multiplication and integer method, square middle method, division and remainder method and random number method. When encrypting the first key, randomly adopt one of the construction methods of the hash function to encrypt, and after obtaining the first ciphertext corresponding to the first key, store the construction method of the hash function used, so that when the same key is used for decryption later, the unique corresponding first ciphertext can be obtained through the same hash function.

[0055] In this embodiment, the key is encrypted based on a hash algorithm, and the encrypted ciphertext is processed again according to preset rules, thereby ensuring that the encryption process is irreversible, so that the content stored in the database cannot be accurately restored, and the secure processing of key information can be achieved.

[0056] In an embodiment of the present invention, the method for defending against an intranet lateral movement attack in an embodiment of the present invention further includes but is not limited to the following steps:

[0057] S301: Obtaining an update instruction of a fake honey spot user, wherein the update instruction includes a second key and a third key;

[0058] S302: Perform authority verification on the update instruction according to the second key. When the update instruction passes the authority verification, generate a new batch of false honey spot users according to the third key, update the false honey spot users in the false honey spot user list to the newly generated false honey spot users, and update the first key stored in the database to the third key.

[0059] In some embodiments, the administrator can update the set password. Before updating the password, the administrator needs to enter the original password for authority verification. Only after passing the authority verification can the newly set password be entered for update. According to the updated password, the generator generates a new batch of fake honey spot users. All newly generated fake honey spot users form a fake honey spot user list, which serves as a new domain control tripwire.

[0060] In this embodiment, the update instruction is authenticated by the key, which can effectively block unauthorized access and malicious lateral movement attacks. Only authenticated users can perform operations. The administrator regularly iterates the key to make it difficult for attackers to obtain enough information to crack the key, thereby improving the robustness of the system.

[0061] In the embodiment of the present invention, the step of performing authority verification on the update instruction according to the second key in step S302 includes but is not limited to the following steps:

[0062] S401: Encrypt the second key using the same hash function as that used to encrypt the first key to obtain a second ciphertext;

[0063] S402: Process the second ciphertext according to a preset rule to obtain a verification ciphertext;

[0064] S403: Compare the verification ciphertext with the check ciphertext. When the verification ciphertext is the same as the check ciphertext, the update instruction passes the authority authentication.

[0065] In some embodiments, when performing authority verification, the administrator inputs the password key2 to be verified, encrypts the input password through the same hash function as the original password key1, generates a second ciphertext hash(key2), and further processes the unprocessed part of hash(key2) that is the same as hash(key1) according to preset rules to generate a verification ciphertext Code(key2), where k, m∈(1,n), and determines whether the password held by the administrator is the correct password by comparing Code(key2) and Code(key1). If they are the same, the authority verification is passed and subsequent operations can be performed.

[0066] In this embodiment, by comparing the generated verification ciphertext Code (key2) and the check ciphertext Code (key1), the server can determine whether the key held by the administrator is correct without performing a large amount of calculations, thereby reducing the server's calculation cost. In addition, since permission authentication is required before modification, attacks by internal personnel can be effectively prevented.

[0067] In the embodiment of the present invention, the step of processing the first ciphertext according to a preset rule to obtain a verified ciphertext in step S202 includes but is not limited to the following steps:

[0068] S501: Determine a part to be processed in the first ciphertext;

[0069] S502: Mapping the first character string of the to-be-processed portion according to a preset mapping rule to obtain a second character string;

[0070] S503: Replace the first character string of the part to be processed with the second character string to obtain a verification ciphertext.

[0071] In some embodiments, processing the first ciphertext according to a preset rule includes performing mapping processing and replacement processing. First, the first ciphertext can be specifically marked or the first string a of the part to be processed in the first ciphertext can be determined based on an algorithm. k 、a m , where k, m∈(1, n); secondly, according to the preset mapping rule, the first string of each part to be processed is subjected to a modulo operation, an XOR operation, an encoding or a character shift to obtain a second string b k , b m , where the preset mapping rule is irreversible, that is, the first string cannot be deduced from the second string; the obtained second string replaces the first string of the corresponding part to be processed in the original first ciphertext, and according to the preset rule, it can be selected to replace all the first strings or replace the first occurrence of the first string.

[0072] In this embodiment, by re-encrypting the first ciphertext and performing mapping and replacement processing based on preset rules, it is possible to ensure that the encrypted ciphertext is irreversible, and an attacker cannot infer the original key by obtaining the ciphertext, that is, it is ensured that the content stored in the database cannot be accurately restored, thereby improving the security of key information processing.

[0073] In the embodiment of the present invention, the fake honey spot user identifier is a digital identifier, and the step of replacing the marked part of the first user name with the fake honey spot user identifier in step S102 to obtain a second user name of the fake honey spot user with the same username structure as that of a normal user includes but is not limited to the following steps:

[0074] S601: Selecting a first user name from a plurality of first user names as a target user name;

[0075] S602: Replace the marked part of the target user name with a digital identifier to obtain a second user name of the fake honey spot user.

[0076] In some embodiments, taking the false honey spot user identifier as a digital identifier as an example, a first username is selected from multiple first usernames as the target username, and different selection strategies or rules can be used to select according to a specific algorithm, such as selecting a username that has logged in recently or a username with low security. After the target username is selected, the marked part in the target username is confirmed by string matching, and a digital identifier is generated as the false honey spot user identifier based on the password-based algorithm in accordance with the marked part in the target username. The digital identifier obtained by the algorithm is spliced ​​with the name part in the target username to form a second username of the false honey spot user. It should be pointed out that the false honey spot user identifier needs to follow specific requirements, that is, the result obtained in any generation process through the same password is the same, so as to ensure that the administrator can accurately recover the false honey spot user through the password. When the marked part in the username is a digital identifier generated by the password, the user can be judged as a false honey spot user.

[0077] In this embodiment, by replacing the marked part in the target user name with a digital identifier, the characteristics of the original target user name can be retained to the greatest extent, so that the attacker cannot distinguish between normal users and fake honey spot users in the domain, and the administrator can accurately identify the fake honey spot users in the domain based on the digital identifier generated by the key, without being affected by the deception defense. The marked part generates a fake honey spot user identifier in the normal user list through an algorithm.

[0078] It is understandable that the marking part of the username structure can be a combination of letters or characters and numbers in addition to the digital form. The embodiment of the present invention does not make any specific restrictions, as long as it can uniquely identify the fake honey spot username. The marking part can be used as a suffix of the name part or as a prefix of the name part. The embodiment of the present invention does not make any specific restrictions.

[0079] In an embodiment of the present invention, the method for defending against an intranet lateral movement attack in an embodiment of the present invention further includes but is not limited to the following steps:

[0080] S701: Generate a corresponding fake honey spot user identifier according to the first key in the intra-domain communication instruction;

[0081] S702: Filter out users whose marked part of the user name is the same as the false honey spot user identifier among all users in the domain, and establish communication with the filtered users.

[0082] In some embodiments, reference Figure 3When the administrator attempts to establish communication with normal users in the domain to send group messages, he can restore the fake honey spot user ID according to the password he holds, thereby obtaining a fake honey spot user list containing all fake honey spot users, so as to filter out users whose user name annotation part is the same as the fake honey spot user ID among all users in the domain, so that the administrator does not involve communication with fake honey spot users when executing group instructions. The attacker will obtain an incorrect fake honey spot user list based on an incorrect password, and there will be omissions and errors in the false honey spot users when filtering, and it is impossible to accurately filter all fake honey spot users among all users.

[0083] In this embodiment, since the false honey spot user list cannot be accurately obtained when the key is not held or the wrong key is held, the attacker is likely to involve message transmission with the false honey spot user when conducting a lateral movement attack. Once the attacker establishes communication with the false honey spot user, the false honey spot user can capture the abnormal situation in time as a tripwire to trigger an alarm. At the same time, this embodiment can ensure that the false honey spot user list generated by the generator each time using the same key is the same, that is, the generated result has the robustness in the time dimension. Since the strategy method has the robustness in the time dimension, the generated false honey spot user list does not need to be stored, and it is restored by the key each time, ensuring that the attacker cannot obtain the false honey spot user information by stealing the false honey spot user list file, and thus cannot distinguish between normal users and false honey spot users.

[0084] The embodiment of the present invention further provides a defense system for intranet lateral movement attacks, including:

[0085] The first module is used to standardize the first username of a normal user in the domain according to a predefined username structure, wherein the username structure includes a name part and a tag part;

[0086] The second module is used to generate a corresponding fake honey spot user identifier according to the first key, replace the marked part in the first user name with the fake honey spot user identifier, and obtain a second user name of the fake honey spot user with the same user name structure as that of the normal user;

[0087] A third module is used to determine a false honey spot user list based on a plurality of false honey spot users generated by the first key;

[0088] The fourth module is used to configure a trigger script for each false honey spot user in the false honey spot user list, so that the false honey spot user sends an alarm signal after receiving the message.

[0089] It can be understood that the contents of the above-mentioned embodiments of the defense method for intranet lateral movement attacks are all applicable to the embodiments of the present system, the functions specifically implemented by the embodiments of the present system are the same as those in the above-mentioned embodiments of the defense method for intranet lateral movement attacks, and the beneficial effects achieved are also the same as the beneficial effects achieved by the above-mentioned embodiments of the defense method for intranet lateral movement attacks.

[0090] An embodiment of the present invention further provides an electronic device, including a memory and a processor, wherein the memory stores a computer program, and the processor implements the steps of the above-mentioned method embodiments when executing the computer program.

[0091] In addition, an embodiment of the present invention further provides a computer-readable storage medium, in which a computer program is stored. When the computer program is executed by a processor, the steps of the above-mentioned method embodiments are implemented.

[0092] It will be appreciated by those skilled in the art that all or some of the steps and systems in the disclosed method above may be implemented as software, firmware, hardware and appropriate combinations thereof. Some physical components or all physical components may be implemented as software executed by a processor, such as a central processing unit, a digital signal processor or a microprocessor, or may be implemented as hardware, or may be implemented as an integrated circuit, such as an application specific integrated circuit. Such software may be distributed on a computer-readable medium, which may include a computer storage medium (or a non-transitory medium) and a communication medium (or a temporary medium). As known to those skilled in the art, the term computer storage medium includes volatile and non-volatile, removable and non-removable media implemented in any method or technology for storing information (such as computer-readable instructions, data structures, program modules or other data). Computer storage media include, but are not limited to, RAM, ROM, EEPROM, flash memory or other memory technologies, CD-ROM, digital versatile disks (DVD) or other optical disk storage, magnetic cassettes, magnetic tapes, disk storage or other magnetic storage devices, or any other medium that may be used to store desired information and may be accessed by a computer. Furthermore, it is well known to those skilled in the art that communication media typically embodies computer readable instructions, data structures, program modules, or other data in a modulated data signal such as a carrier wave or other transport mechanism, and may include any information delivery media.

[0093] The embodiments of the present invention are described in detail above with reference to the accompanying drawings, but the present invention is not limited to the above embodiments, and various changes can be made within the knowledge scope of ordinary technicians in the relevant technical field without departing from the purpose of the present invention.

Claims

1. A method for defending against lateral movement attacks on an intranet, characterized in that: The following steps are involved: Standardizing a first user name of a normal user in the domain according to a predefined user name structure, wherein the user name structure includes a name part and a tag part; Generate a corresponding fake honey spot user identifier according to the first key, replace the marked part of the first user name with the fake honey spot user identifier, and obtain a second user name of the fake honey spot user with the same user name structure as that of a normal user; Determine a list of false honey spot users using a plurality of false honey spot users generated by the first key; configuring a trigger script for each false honey spot user in the false honey spot user list, so that the false honey spot user sends an alarm signal after receiving a message; The method for defending against lateral movement attacks on an intranet further includes the following steps: Based on the hash algorithm, encrypt the first key through a hash function to obtain a first ciphertext; Processing the first ciphertext according to a preset rule to obtain a verification ciphertext, and storing the verification ciphertext in a database; Obtaining an update instruction of the fake honey spot user, wherein the update instruction includes a second key and a third key; Performing authority verification on the update instruction according to the second key, and when the update instruction passes the authority verification, generating a new batch of false honey spot users according to the third key, updating the false honey spot users in the false honey spot user list to the newly generated false honey spot users, and updating the first key stored in the database to the third key; The step of performing authority verification on the update instruction according to the second key comprises the following steps: Encrypting the second key using the same hash function as that used to encrypt the first key to obtain a second ciphertext; Processing the second ciphertext according to the preset rule to obtain a verification ciphertext; The verification ciphertext is compared with the check ciphertext. When the verification ciphertext is the same as the check ciphertext, the update instruction passes the authority authentication.

2. The method for defending against lateral movement attacks on an intranet according to claim 1, characterized in that: The step of processing the first ciphertext according to a preset rule to obtain a verification ciphertext comprises the following steps: Determining a portion to be processed in the first ciphertext; Mapping the first character string of the to-be-processed portion according to a preset mapping rule to obtain a second character string; The second character string replaces the first character string of the part to be processed to obtain a verification ciphertext.

3. The method for defending against lateral movement attacks on an intranet according to claim 1, characterized in that: The fake honey spot user identifier is a digital identifier, and the step of replacing the marked part of the first user name with the fake honey spot user identifier to obtain a second user name of the fake honey spot user having the same user name structure as that of a normal user includes the following steps: Selecting a first user name from the plurality of first user names as a target user name; The marked part in the target user name is replaced with the digital identifier to obtain a second user name of the fake honey spot user.

4. The method for defending against lateral movement attacks in an intranet according to claim 1, characterized in that: The method for defending against lateral movement attacks on the intranet also includes the following steps: Generate a corresponding fake honey spot user identifier according to the first key in the intra-domain communication instruction; Filter out users whose marked part of the user name is the same as the false honey spot user identifier among all users in the domain, and establish communication with the filtered users.

5. A defense system for intranet lateral movement attacks, characterized in that: include: A first module is used to standardize a first user name of a normal user in the domain according to a predefined user name structure, wherein the user name structure includes a name part and a tag part; The second module is used to generate a corresponding fake honey spot user identifier according to the first key, replace the marked part of the first user name with the fake honey spot user identifier, and obtain a second user name of the fake honey spot user with the same user name structure as that of a normal user; A third module is used to determine a false honey spot user list based on the multiple false honey spot users generated by the first key; The fourth module is used to configure a trigger script for each false honey spot user in the false honey spot user list, so that the false honey spot user sends an alarm signal after receiving the message; The method for defending against lateral movement attacks on an intranet further includes the following steps: Based on the hash algorithm, encrypt the first key through a hash function to obtain a first ciphertext; Processing the first ciphertext according to a preset rule to obtain a verification ciphertext, and storing the verification ciphertext in a database; Obtaining an update instruction of the fake honey spot user, wherein the update instruction includes a second key and a third key; Performing authority verification on the update instruction according to the second key, and when the update instruction passes the authority verification, generating a new batch of false honey spot users according to the third key, updating the false honey spot users in the false honey spot user list to the newly generated false honey spot users, and updating the first key stored in the database to the third key; The step of performing authority verification on the update instruction according to the second key comprises the following steps: Encrypting the second key using the same hash function as that used to encrypt the first key to obtain a second ciphertext; Processing the second ciphertext according to the preset rule to obtain a verification ciphertext; The verification ciphertext is compared with the check ciphertext. When the verification ciphertext is the same as the check ciphertext, the update instruction passes the authority authentication.

6. An electronic device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the method for defending against intranet lateral movement attacks described in any one of claims 1 to 4 is implemented.

7. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the method for defending against intranet lateral movement attacks as described in any one of claims 1 to 4 is implemented.

Images