A host system vulnerability shielding method, system, device and medium

Abstract

The application provides a host system vulnerability shielding method, system, device and medium, the method comprising: acquiring all subsystems and multiple data parameters on the host system; establishing a subsystem vulnerability function according to the multiple data parameters, and calculating all subsystems to obtain a subsystem vulnerability value, and sorting according to the subsystem vulnerability value; creating target honeypot data for the subsystems greater than the vulnerability value threshold according to a preset vulnerability value threshold, and monitoring the target honeypot data; when the target honeypot data is accessed, isolating the corresponding subsystem through a virtual private cloud network. By monitoring the target honeypot data, attacks can be detected early, and appropriate security measures can be taken. The automation feature of the method enables automatic triggering of virtual private cloud network isolation when potential attacks are monitored, thereby reducing the security response time. It helps to quickly isolate the affected subsystems and reduces the opportunity for attacks to spread.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of computer security, in particular to a host system vulnerability shielding method, system, device and medium. BACKGROUND

[0002] In a computer, there can be many subsystems deployed on a host system, which can be different software, services or modules, running on the host system and performing specific tasks or functions. Different subsystems can have different vulnerabilities, and when a subsystem is attacked through a vulnerability, it can leak information of the host system or other subsystems. Therefore, shielding the impact of the subsystem with vulnerabilities on other subsystems or the host system is crucial for maintaining the security and normal operation of the host system and subsystems.

[0003] The prior art provides a vulnerability scanning system, including: a Master host and a plurality of Slave hosts; the Master host is used for: storing a plurality of vulnerability scanning tasks, and sending the vulnerability scanning tasks to the Slave hosts; the Slave host is used for: when receiving the vulnerability scanning task, performing vulnerability scanning based on the vulnerability scanning task, and sending the scanning result to the Master host. The vulnerability scanning system can perform vulnerability scanning at a faster speed, however, this method can only perform vulnerability scanning in advance, and can only scan the vulnerabilities existing in the vulnerability library, and cannot shield the impact of the subsystem with vulnerabilities on other subsystems or the host system when the subsystem is attacked through a vulnerability. SUMMARY

[0004] In view of the above-mentioned shortcomings of the prior art, the present application provides a host system vulnerability shielding method, system, device and medium to solve the above-mentioned technical problems.

[0005] The present application provides a host system vulnerability shielding method, applied to a host system, the method comprising:

[0006] Obtaining all subsystems on the host system, and obtaining a plurality of data parameters of all the subsystems;

[0007] Establishing a subsystem vulnerability function according to the plurality of data parameters;

[0008] Calculating the subsystem vulnerability values of all the subsystems according to the subsystem vulnerability function, and sorting all the subsystems in descending order of the subsystem vulnerability values;

[0009] Creating target honeypot data for the subsystems with a subsystem vulnerability value greater than a preset vulnerability value threshold, and monitoring the target honeypot data;

[0010] When the target honeypot data is monitored to be accessed, the corresponding subsystem is isolated by a virtual private cloud network.

[0011] In the present application, the plurality of data parameters include historical same period vulnerability proportion, unit time access amount proportion, open port number proportion.

[0012] In the present application, the subsystem vulnerability function is established according to the plurality of data parameters, and the specific logic is:

[0013]

[0014] Among them, the F sub is a subsystem vulnerability value, is a historical same period vulnerability proportion, LH all is the total number of vulnerabilities of the host system in a certain period of time, LH sub is the number of vulnerabilities of the subsystem in the same period, is a unit time access amount proportion, NA all is the total amount of access of the host system in a unit time, NA sub is the access amount of the subsystem in a unit time, is an open port number proportion, NP all is the total number of open ports of the host system, NP sub is the number of open ports of the subsystem, w1, w2, w3 are weight coefficients, w1, w2, w3 are all greater than 0 and w1+w2+w3=1.

[0015] In the present application, a target honeypot data is created for the subsystem greater than the vulnerability value threshold according to the preset vulnerability value threshold, and the target honeypot data is monitored, specifically including:

[0016] Creating target honeypot data, wherein the target honeypot data is false data;

[0017] Injecting the target honeypot data into the subsystem, and marking the target honeypot data as important data;

[0018] Event recording is performed on the target honeypot data.

[0019] In the present application, the read and write permissions of the target honeypot data are set to increase, modify and read.

[0020] In the present application, when the target honeypot data is monitored to be accessed, the corresponding subsystem is isolated by a virtual private cloud network, specifically including:

[0021] When the target honeypot data is monitored to be accessed, an event is generated and sent to a virtual private cloud network;

[0022] accepting the event through a virtual private cloud network, and synchronizing the subsystems;

[0023] when synchronization is completed, the subsystems are disconnected from the host system, moved to an independent virtual private cloud network, access is closed or the subsystems are isolated to ensure physical or logical isolation from other subsystems.

[0024] In the present application, the subsystems are synchronized, specifically including:

[0025] receiving a version package of the subsystems through the virtual private cloud network, and installing the version package;

[0026] when the version package installation is completed, the subsystems are deployed;

[0027] when the subsystem deployment is completed, the subsystem data is synchronized.

[0028] The present application also provides a host system vulnerability shielding system applied to a host system, the system comprising:

[0029] a parameter acquisition module: acquiring all subsystems on the host system, and acquiring multiple data parameters of all the subsystems;

[0030] a function establishment module: establishing a subsystem vulnerability function according to the multiple data parameters;

[0031] a system sorting module: calculating subsystem vulnerability values of all the subsystems according to the subsystem vulnerability function, and sorting all the subsystems in descending order of the subsystem vulnerability values;

[0032] a honeypot creation module: creating target honeypot data of a subsystem greater than a preset vulnerability value threshold according to the vulnerability value threshold, and monitoring the target honeypot data;

[0033] a network isolation module: when the target honeypot data is accessed, performing virtual private cloud network isolation on the corresponding subsystem.

[0034] The present application also provides an electronic device, comprising:

[0035] one or more processors;

[0036] a storage device for storing one or more programs, when the one or more programs are executed by the one or more processors, the electronic device implements a host system vulnerability shielding method according to any one of the above.

[0037] The application further provides a computer readable storage medium, which stores a computer program, and the computer program, when executed by a processor of a computer, causes the computer to perform the host system vulnerability shielding method according to any one of the above.

[0038] The application provides a host system vulnerability shielding method, system, device and medium, the method obtains all subsystems on the host system, and obtains multiple data parameters of all the subsystems; a subsystem vulnerability function is established according to the multiple data parameters; a subsystem vulnerability value is obtained by calculating all the subsystems according to the subsystem vulnerability function, and all the subsystems are sorted according to the subsystem vulnerability value from large to small; a target honeypot data is created for the subsystems greater than the vulnerability value threshold according to a preset vulnerability value threshold, and the target honeypot data is monitored; when the target honeypot data is accessed, the corresponding subsystem is isolated by a virtual private cloud network, and the beneficial effects include:

[0039] 1. The method helps to reduce the risk of potential vulnerabilities to the entire host system by sorting and isolating the subsystems according to their vulnerability values. By monitoring the target honeypot data, attacks can be detected early, and appropriate security measures can be taken.

[0040] 2. The automation feature of the method enables automatic triggering of virtual private cloud network isolation when potential attacks are monitored, thereby reducing the security response time. This helps to quickly isolate the affected subsystems and reduces the opportunity for attacks to spread.

[0041] 3. By concentrating the resources of the host system on the most protected subsystems, the method can help optimize resource utilization and ensure stronger security control over high-risk areas.

[0042] The above description is only a summary of the technical solutions of the application. In order to more clearly understand the technical means of the application, the application can be implemented according to the content of the specification, and in order to make the above and other purposes, features and advantages of the application more obvious and easy to understand, the following specific embodiments of the application are described. BRIEF DESCRIPTION OF DRAWINGS

[0043] In order to more clearly illustrate the technical solutions in the embodiments of the application, the following will briefly introduce the drawings needed in the embodiment description. Obviously, the drawings in the following description are only some embodiments of the application, and other drawings can be obtained by those skilled in the art without creative labor. In the drawings:

[0044] Figure 1 A flowchart of a host system vulnerability shielding method is shown for an exemplary embodiment of the application.

[0045] Figure 2 A host system vulnerability shielding system structure diagram is shown for an exemplary embodiment of the present application. DETAILED DESCRIPTION

[0046] Other advantages and novel features of the present application will become apparent from the following detailed description of the application when considered in conjunction with the drawings. The application can be put into practice / embodied in various ways and with different specific embodiments, and various modifications and changes can be made thereto without departing from the spirit and scope of the present application. It is to be understood that the preferred embodiments are merely illustrative of the present application and should not be taken as limiting the scope of the present application.

[0047] It should be noted that the drawings included in the following embodiments are only schematic and that actual implementations can differ from those depicted in the drawings. The various elements in the drawings are not necessarily drawn to scale. Furthermore, there can be variations in the materials, dimensions, and shapes of the various elements in the drawings. It should be understood that all these variations are within the scope of the present application.

[0048] In the following description, numerous specific details are discussed in order to provide a thorough understanding of the embodiments of the present application. However, it will be apparent to one of ordinary skill in the art that the embodiments of the present application can be practiced without these specific details. In other instances, well-known structures and devices are not described in detail in order to avoid obscuring the embodiments of the present application.

[0049] First of all, it should be noted that system vulnerabilities refer to security vulnerabilities or weaknesses in computer systems or software, which can be exploited by hackers or malicious users to perform unauthorized operations, intrude into systems, steal data, or disrupt system functions. System vulnerabilities can exist in various forms, including software vulnerabilities, operating system vulnerabilities, application program vulnerabilities, hardware vulnerabilities, configuration errors, zero-day vulnerabilities, social engineering. To mitigate the risks that system vulnerabilities may bring, organizations usually take vulnerability management measures, including regular vulnerability scanning, fixing vulnerabilities, strengthening access control, training employees, etc. These measures help improve system security and reduce the chances of potential attacks.

[0050] However, in a computer, there can be many subsystems deployed on the host system, which can be different software, services or modules, running on the host system and performing specific tasks or functions. Different subsystems can have different vulnerabilities, and when a subsystem is attacked through a vulnerability, it can leak information of the host system or other subsystems, therefore, shielding the impact of the subsystem with vulnerabilities on other subsystems or the host system is crucial to maintaining the security and normal operation of the host system and subsystems.

[0051] Figure 1 A flowchart of a host system vulnerability shielding method is shown for an exemplary embodiment of the present application;

[0052] As Figure 1 shown, the present application provides a host system vulnerability shielding method, applied to a host system, the method comprising:

[0053] Step S110: acquiring all subsystems on the host system, and acquiring multiple data parameters of all the subsystems;

[0054] Step S120: establishing a subsystem vulnerability function according to the multiple data parameters;

[0055] Step S130: calculating all the subsystems according to the subsystem vulnerability function to obtain subsystem vulnerability values, and sorting all the subsystems in descending order of the subsystem vulnerability values;

[0056] Step S140: creating target honeypot data for the subsystems greater than the vulnerability value threshold according to a preset vulnerability value threshold, and monitoring the target honeypot data;

[0057] Step S150: when the target honeypot data is accessed, performing virtual private cloud network isolation on the corresponding subsystem.

[0058] Specifically, in step S110, a system scanning tool or software is used to identify all deployed subsystems on the host system. These subsystems can include operating systems, applications, services, modules, etc. The multiple data parameters of the subsystems include historical same-period vulnerability number proportion, unit time access volume proportion, and open port number proportion.

[0059] In step S120, a subsystem vulnerability function is established according to the multiple data parameters, and the specific logic is as follows:

[0060]

[0061] Wherein, the F sub is the subsystem vulnerability value, is the historical same-period vulnerability number proportion, LHall LH is the total number of vulnerabilities in the host system history for a certain period of time, sub LH is the number of vulnerabilities in the host system history for a certain period of time, NA is the proportion of access volume per unit time, all NA is the total access volume per unit time in the host system, sub NA is the access volume per unit time in the subsystem, NP is the proportion of open port number, all NP is the total number of open ports in the host system, sub NP is the number of open ports in the subsystem, w1, w2, w3 are weight coefficients, w1, w2, w3 are all greater than 0 and w1+w2+w3=1.

[0062] First, calculate the proportion of historical vulnerability number in the subsystem, which represents how many vulnerabilities the subsystem has experienced in the past certain period of time. This is the vulnerability history of the subsystem. The higher the proportion of historical vulnerability number in the same period, the more vulnerabilities the subsystem has experienced in the past certain period of time. Therefore, the subsystem may be an easy target for attackers, as attackers usually look for vulnerable targets. This may increase the risk of potential attacks on the subsystem.

[0063] Next, calculate the proportion of access volume per unit time in the subsystem. This indicates how many access requests are directed at the subsystem. The higher the proportion of access volume per unit time, the more access requests the subsystem receives in the same period of time. A high-access-volume subsystem is usually an easier target for attacks, as attackers may want to obtain the data stored therein or misuse its functions. Therefore, a high proportion of access volume per unit time may increase the risk of potential attacks on the subsystem.

[0064] Then, calculate the proportion of open port number in the subsystem. This indicates the proportion of open network ports in the subsystem to the total open ports in the host system. A higher proportion of open port number makes the subsystem more accessible to external networks. This increases the chances of potential attackers finding and attempting to attack the subsystem.

[0065] The subsystem vulnerability function comprehensively evaluates the vulnerability risk of the subsystem based on multiple data parameters such as historical vulnerabilities, access conditions and open ports. By assigning different weight coefficients, the contribution of these parameters to the vulnerability value can be adjusted to adapt to the needs and risk models of specific organizations. When the vulnerability value of the subsystem is higher, it means that the vulnerability risk of the subsystem is greater. According to this value, further security measures can be taken for the subsystem.

[0066] In step S140, specifically comprising:

[0067] Creating target honeypot data, wherein the target honeypot data is false data;

[0068] injecting the target honeypot data into the subsystem and marking the target honeypot data as important data;

[0069] event logging the target honeypot data.

[0070] Specifically, after identifying a subsystem with a vulnerability value exceeding a set vulnerability value threshold, a fake target honeypot data is created. This target honeypot data is a fake data designed to attract potential attackers, aiming to lure potential attackers to attempt to invade or attack the subsystem. These honeypot data usually looks like real data, but in fact is specially designed for monitoring and detecting intrusion. The fake target honeypot data created is injected into the selected subsystem. These data can include fake files, virtual accounts, fake network resources or other simulated information. The injection of target honeypot data aims to simulate a real attack surface to lure potential attackers to interact with it. In order to make the target honeypot data look like real sensitive data, it can be marked as "important data". This may include simulating the naming, permission settings or labels of sensitive files to make them more attractive. The injected target honeypot data is monitored to detect potential attacks. If there is any activity trying to access, modify or manipulate these data, the system should record these events for further analysis and response.

[0071] Further, the read and write permissions of the target honeypot data are set to increase, modify and read. By setting these permissions for fake target honeypot data, the system can better simulate the behavior of potential attackers. If a potential attacker tries to access, modify or read these fake data, the system will be able to record these activities and issue an alarm in time to detect possible attacks.

[0072] In an exemplary embodiment, in step S150, when the target honeypot data is monitored to be accessed, the corresponding subsystem is isolated by a virtual private cloud network, specifically including:

[0073] When the target honeypot data is monitored to be accessed, an event is generated and sent to the virtual private cloud network;

[0074] The event is accepted by the virtual private cloud network, and the subsystem is synchronized;

[0075] When the synchronization is completed, the subsystem is cut off from the host system and moved to an independent virtual private cloud network, the access permission is closed or the subsystem is isolated to ensure physical or logical isolation from other subsystems.

[0076] Specifically, when the monitoring system detects that the target honeypot data is accessed, it generates an event, usually an alert or notification, to indicate that a potential attack behavior has occurred. This event is sent to the virtual private cloud network, which contains information about the event, such as time, location, and related subsystems. Upon receiving the event, the virtual private cloud network begins the process of isolation. It can initiate an automated process to ensure the integrity and security of the subsystem. This can include creating a virtual copy of the subsystem for further analysis and isolation. In the virtual private cloud network, the system will cut off the physical or logical connection between the target subsystem and the host system. The subsystem will be isolated and run in an independent virtual environment. This ensures that it is isolated from other subsystems to prevent the attack from spreading to other parts.

[0077] By performing these steps, the system is able to quickly respond to potential attacks, isolate the attacked subsystem from the host system, and take necessary security measures to ensure that the attack does not have a negative impact on the entire system. This helps to minimize the impact of potential attacks while protecting the stability of the host system and the security of other subsystems.

[0078] Furthermore, the synchronization of the subsystem is performed, specifically including:

[0079] The version package of the subsystem is received through the virtual private cloud network, and the version package installation is performed;

[0080] When the version package installation is completed, the subsystem deployment is performed;

[0081] When the subsystem deployment is completed, the subsystem data synchronization is performed.

[0082] Specifically, once the target subsystem is isolated and moved to the virtual private cloud network, the virtual private cloud network begins to communicate with the subsystem. It receives the version package of the subsystem through the network, which contains the configuration and application data of the subsystem. In the virtual private cloud network, the system begins to perform the installation process of the version package. This includes restoring the configuration, application, and operating system version of the subsystem to a known safe state. This ensures that the subsystem is in a clean, secure state, ready to accept new operations and data. After installation is complete, the system begins to deploy the subsystem. This includes setting up the network connection of the subsystem, starting necessary services and applications, and ensuring everything is running normally. The deployment of the subsystem needs to ensure that its functions are consistent with the original subsystem. Once the deployment is complete, the subsystem data needs to be synchronized. This may include synchronizing data stored elsewhere into the subsystem to ensure that it contains the latest information when running.

[0083] These steps aim to isolate and restore the target subsystem to a safe state for detailed analysis, detection and repair. This helps to ensure that the subsystem is not affected by attacks while maintaining its functionality and data integrity.

[0084] Figure 2 A host system vulnerability shielding system structure diagram is shown for an exemplary embodiment of the present application;

[0085] As shown in Figure 2 An exemplary host system vulnerability shielding system is applied to a host system, and the system comprises:

[0086] An acquisition parameter module 201 acquires all subsystems on the host system and acquires multiple data parameters of all the subsystems.

[0087] A function establishment module 202 establishes a subsystem vulnerability function according to the multiple data parameters.

[0088] A system sorting module 203 calculates subsystem vulnerability values of all the subsystems according to the subsystem vulnerability function and sorts all the subsystems in descending order of the subsystem vulnerability values.

[0089] A honeypot creation module 204 creates target honeypot data for a subsystem greater than a preset vulnerability value threshold and monitors the target honeypot data.

[0090] A network isolation module 205 performs virtual private cloud network isolation on the corresponding subsystem when the target honeypot data is accessed.

[0091] It should be noted that the host system vulnerability shielding system provided in the above embodiment and the host system vulnerability shielding method provided in the above embodiment belong to the same concept, wherein the specific manner in which each module and unit performs operations has been described in detail in the method embodiment, which will not be described here. The host system vulnerability shielding system provided in the above embodiment can distribute the above functions to different functional modules for completion in actual application, that is, the internal structure of the system is divided into different functional modules to complete all or part of the functions described above, and this is not limited herein.

[0092] Embodiments of the present application also provide an electronic device comprising one or more processors, a storage device for storing one or more programs, when the one or more programs are executed by the one or more processors, the electronic device implements the host system vulnerability shielding method provided in each of the above embodiments.

[0093] Embodiments of the present application also provide a computer system of an electronic device. It should be noted that the computer system of the electronic device is only an example, and should not bring any limitation to the functions and use range of the embodiments of the present application.

[0094] Specifically, the computer system includes a central processing unit (CPU) that can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) or a program loaded from a storage section into a random access memory (RAM), such as performing the method described in the above embodiments. In the RAM, various programs and data required for system operation are also stored. The CPU, the ROM, and the RAM are connected to each other through a bus. An input / output (I / O) interface is also connected to the bus.

[0095] The following components are connected to the I / O interface: an input section including a keyboard, a mouse, etc.; an output section including a display such as a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage section including a hard disk, etc.; and a communication section including a network interface card such as a LAN (Local Area Network) card, a modem, etc. The communication section performs communication processing via a network such as the Internet. A drive is also connected to the I / O interface as necessary. A removable medium such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc. is attached to the drive as necessary, so that a computer program read out therefrom is installed into the storage section as necessary.

[0096] In particular, according to the embodiments of the present application, the processes described above with reference to the flowcharts can be implemented as a computer software program. For example, the embodiments of the present application include a computer program product including a computer program carried on a computer-readable medium, the computer program containing a computer program for executing the method shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via the communication section, and / or installed from a removable medium. When the computer program is executed by a central processing unit (CPU), various functions defined in the system of the present application are performed.

[0097] It should be noted that the computer readable medium shown in the embodiments of the present application can be a computer readable signal medium or a computer readable storage medium or any combination of the two. The computer readable storage medium may, for example, be an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or apparatus, or any combination of the above. More specific examples of the computer readable storage medium can include, but are not limited to, an electrical connection having one or more wires, a portable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM), a flash memory, an optical fiber, a portable compact disk read-only memory (Compact Disc Read-Only Memory, CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present application, the computer readable signal medium can include a data signal carried in a baseband or as a part of a carrier wave, which carries the computer readable computer program. Such a propagated data signal can take various forms, including but not limited to an electromagnetic signal, an optical signal, or any suitable combination of the above. The computer readable signal medium can also be any computer readable medium other than the computer readable storage medium, which can send, propagate or transmit the program for use by or in connection with an instruction execution system, apparatus or device. The computer program contained on the computer readable medium can be transmitted by any suitable medium, including but not limited to wireless, wired, or the like, or any suitable combination of the above.

[0098] The units described in the embodiments of the present application can be implemented in software, or in hardware, or in a combination of software and hardware. The units described can also be arranged in a processor. In some cases, the names of the units do not constitute a limitation on the units themselves.

[0099] Another aspect of the present application also provides a computer readable storage medium having a computer program stored thereon, which, when executed by a processor, implements a host system vulnerability shielding method as described above. The computer readable storage medium can be included in the electronic device described in the above embodiments, or can exist separately and not be assembled into the electronic device.

[0100] Another aspect of the present application also provides a computer program product or computer program, which comprises computer instructions stored in a computer readable storage medium. A processor of a computer device reads the computer instructions from the computer readable storage medium, and the processor executes the computer instructions to make the computer device perform the host system vulnerability shielding method provided in each of the above embodiments.

[0101] The above embodiments only illustrate the principles and effects of the present application, but are not used to limit the present application. Any person skilled in the art can modify or change the above embodiments without departing from the spirit and scope of the present application. Therefore, all equivalent modifications or changes made by those skilled in the art without departing from the spirit and technical ideas disclosed by the present application should be covered by the claims of the present application.

Claims

1. A host system vulnerability shielding method, characterized in that: Applied to a host system, the method includes: Obtain all subsystems on the host system and obtain multiple data parameters of all subsystems; the multiple data parameters include the percentage of vulnerabilities in the same period in history, the percentage of visits per unit time, and the percentage of open ports; A subsystem vulnerability function is established based on multiple data parameters. The specific logic is as follows: Among them, the is the subsystem vulnerability value, The percentage of vulnerabilities in the same period in history. The total number of vulnerabilities in the host system during a certain period of time. is the number of vulnerabilities in the subsystem during the same period in history, is the percentage of visits per unit time, is the total number of accesses per unit time on the host system. is the number of visits per unit time of the subsystem, is the proportion of open ports, The total number of ports open for the host system, The number of ports opened for the subsystem, is the weight coefficient, are greater than 0 and ; Calculating all the subsystems according to the subsystem vulnerability function to obtain subsystem vulnerability values, and sorting all the subsystems from large to small according to the subsystem vulnerability values; Creating target honeypot data for subsystems whose vulnerability value is greater than the preset vulnerability value threshold according to the preset vulnerability value threshold, and monitoring the target honeypot data; When it is monitored that the target honeypot data is accessed, the corresponding subsystem is isolated through a virtual private cloud network.

2. A host system vulnerability shielding method according to claim 1, characterized in that: Creating target honeypot data for subsystems with vulnerability values ​​greater than the preset vulnerability threshold according to the vulnerability threshold, and monitoring the target honeypot data, specifically including: Creating target honeypot data, wherein the target honeypot data is false data; Injecting the target honeypot data into the subsystem and marking the target honeypot data as important data; Event recording is performed on the target honeypot data.

3. A host system vulnerability shielding method according to claim 2, characterized in that: The method further includes setting the target honeypot data read and write permissions to add, modify, and read.

4. A host system vulnerability shielding method according to claim 1, characterized in that: When it is monitored that the target honeypot data is accessed, the corresponding subsystem is isolated through a virtual private cloud network, specifically including: When monitoring detects that the target honeypot data is accessed, an event is generated and sent to a virtual private cloud network; receiving the event through a virtual private cloud network and synchronizing the subsystems; When synchronization is complete, the subsystem is disconnected from the host system, moved to an independent virtual private cloud network, and access permissions are closed or the subsystem is isolated to ensure physical or logical isolation from other subsystems.

5. A host system vulnerability shielding method according to claim 4, characterized in that: And synchronize the subsystems, specifically including: Receiving the version package of the subsystem through the virtual private cloud network and installing the version package; When the version package is installed, the subsystem is deployed; When the subsystem deployment is completed, subsystem data synchronization is performed.

6. A host system vulnerability shielding system, characterized in that: A host system vulnerability shielding method according to any one of claims 1 to 5 is applied, wherein the system comprises: Parameter acquisition module: acquires all subsystems on the host system and acquires multiple data parameters of all subsystems; Establishing a function module: establishing a subsystem vulnerability function according to a plurality of the data parameters; System sorting module: calculates the subsystem vulnerability values ​​of all the subsystems according to the subsystem vulnerability function, and sorts all the subsystems from large to small according to the subsystem vulnerability values; Creating a honeypot module: creating target honeypot data for subsystems with vulnerability values ​​greater than the preset threshold value according to the vulnerability value, and monitoring the target honeypot data; Network isolation module: When monitoring detects that the target honeypot data is accessed, the corresponding subsystem is isolated by a virtual private cloud network.

7. An electronic device, characterized in that: The electronic device comprises: one or more processors; A storage device for storing one or more programs, which, when executed by the one or more processors, enables the electronic device to implement a host system vulnerability shielding method as described in any one of claims 1 to 5.

8. A computer-readable storage medium, characterized in that A computer program is stored thereon, and when the computer program is executed by a processor of a computer, the computer is caused to execute a host system vulnerability shielding method according to any one of claims 1 to 5.

Images