Honeypot development method, device, equipment and storage medium

Abstract

The application relates to a honeypot development method, device and equipment and a storage medium, and relates to the technical field of communication. The method comprises the following steps: obtaining multiple honeypot resources, and generating multiple honeypot nodes corresponding to the multiple honeypot resources according to the multiple honeypot resources; determining the identifier of a resource request device of each honeypot node in the multiple honeypot nodes as the identifier of an electronic device; and in response to a honeypot resource request sent by each honeypot node, matching a processing function corresponding to the honeypot resource request from a preset request path routing table, and processing the honeypot resource request.

Description

Technical Field

[0001] This application relates to the field of communication technology, and in particular to a honeypot development method, apparatus, device and storage medium. Background Technology

[0002] In the field of computer technology, with the development of Internet technology, cyberattacks have become very common. To defend against and detect cyberattacks, honeypot technology has emerged. Honeypot technology deploys decoy hosts, network services, or information to lure attackers into attacking them. The attacker's attack behavior is captured and analyzed, thereby inferring the attacker's intent and taking countermeasures based on that intent to enhance network security protection capabilities.

[0003] In related technologies, when multiple honeypots need to be deployed, multiple honeypots need to be developed and deployed separately. However, honeypot development efficiency is relatively low. Summary of the Invention

[0004] This application provides a honeypot development method, apparatus, device, and storage medium to at least solve the technical problem of low honeypot development efficiency in related technologies. The technical solution of this application is as follows:

[0005] According to a first aspect of the embodiments of this application, a honeypot development method is provided, comprising: acquiring multiple honeypot resources, and generating multiple honeypot nodes corresponding one-to-one with the multiple honeypot resources; determining the identifier of the resource request device of each honeypot node in the multiple honeypot nodes as the identifier of the electronic device; and in response to a honeypot resource request sent by each honeypot node, matching the processing function corresponding to the honeypot resource request from a preset request path routing table, and processing the honeypot resource request.

[0006] In one possible implementation, at least one honeypot node set is determined from a plurality of honeypot nodes; the honeypot nodes in each honeypot node set have the same honeypot resource type; in response to a honeypot resource request from a honeypot node in the target honeypot node set, target data corresponding to the target honeypot node set is obtained from the honeypot resource request, and a log is generated based on the target data; the target data includes at least one of the attacker's username, password, Internet Protocol IP address, port, and user agent; the target honeypot node set is at least one of at least one honeypot node set; different honeypot node sets correspond to different target data.

[0007] In one possible implementation, acquiring multiple honeypot resources includes: acquiring multiple network resources; generating multiple honeypot resources that correspond one-to-one with the multiple network resources; and ensuring that the similarity between the resource information of the honeypot resources and the resource information of the network resources corresponding to the honeypot resources is greater than a preset similarity.

[0008] In one possible implementation, the method further includes: obtaining the port number of each honeypot node among multiple honeypot nodes; generating a startup command for each honeypot node based on the port number; and executing the startup command to start each honeypot node.

[0009] In one possible implementation, the method further includes: parsing the logs using a filter; and visually displaying the logs obtained after parsing.

[0010] According to a second aspect of the embodiments of this application, a honeypot development apparatus is provided. The apparatus includes: an acquisition unit, a determination unit, and a processing unit. The acquisition unit is configured to acquire multiple honeypot resources and generate multiple honeypot nodes corresponding one-to-one with the multiple honeypot resources. The determination unit is configured to determine the identifier of the resource request device of each honeypot node among the multiple honeypot nodes as the identifier of an electronic device. The processing unit is configured to respond to the honeypot resource request sent by each honeypot node, match the processing function corresponding to the honeypot resource request from a preset request path routing table, and process the honeypot resource request.

[0011] In one possible implementation, the honeypot development apparatus further includes: a generation unit; a determining unit, further configured to determine at least one honeypot node set among a plurality of honeypot nodes; the honeypot nodes in each honeypot node set have the same honeypot resource type; an acquisition unit, further configured to, in response to a honeypot resource request from a honeypot node in the target honeypot node set, acquire target data corresponding to the target honeypot node set from the honeypot resource request; and a generation unit, configured to generate logs based on the target data; the target data includes at least one of the attacker's username, password, Internet Protocol IP address, port, and user agent; the target honeypot node set is at least one of at least one honeypot node set; different honeypot node sets correspond to different acquired target data.

[0012] In one possible implementation, in the honeypot development apparatus described above, the acquisition unit is specifically used to: acquire multiple network resources; generate multiple honeypot resources that correspond one-to-one with the multiple network resources; and ensure that the similarity between the resource information of the honeypot resources and the resource information of the network resources corresponding to the honeypot resources is greater than a preset similarity.

[0013] In one possible implementation, the honeypot development apparatus further includes: an acquisition unit, configured to acquire the port number of each honeypot node among a plurality of honeypot nodes; a generation unit, configured to generate a startup instruction for each honeypot node based on the port number; and a processing unit, configured to execute the startup instruction to start each honeypot node.

[0014] In one possible implementation, the processing unit in the honeypot development apparatus described above is further configured to: parse logs using filters; and visualize the logs obtained after parsing.

[0015] According to a third aspect of the embodiments of this application, an electronic device is provided, comprising: a processor; a memory for storing processor-executable instructions; wherein the processor is configured to execute instructions to implement the method of the first aspect described above and any possible implementation thereof.

[0016] According to a fourth aspect of the embodiments of this application, a computer-readable storage medium is provided, which, when the instructions in the computer-readable storage medium are executed by a processor of an electronic device, enables the electronic device to perform the methods of the first aspect and any possible implementation thereof.

[0017] According to a fifth aspect of the embodiments of this application, a computer program product is provided, the computer program product including computer instructions, which, when executed on an electronic device, cause the electronic device to perform the method described in the first aspect and any possible implementation thereof.

[0018] The technical solution of the first aspect provided by the embodiments of this application has at least the following beneficial effects:

[0019] The technical solution provided in this application acquires multiple honeypot resources and generates multiple honeypot nodes that correspond one-to-one with each honeypot resource. The identifier of the resource request device for each honeypot node is determined as the identifier of the electronic device. In response to a honeypot resource request sent by each honeypot node, the processing function corresponding to the honeypot resource request is matched from a preset request path routing table, and the honeypot resource request is processed. In this way, multiple honeypot nodes are deployed simultaneously, and honeypot resource requests are processed through a single electronic device, enabling batch development of honeypots and greatly improving honeypot development efficiency.

[0020] It should be noted that the technical effects of any of the implementation methods in aspects two through five can be found in the technical effects of the corresponding implementation methods in aspect one, and will not be repeated here.

[0021] It should be understood that the above general description and the following detailed description are exemplary and explanatory only, and do not limit this application. Attached Figure Description

[0022] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application, and do not constitute an undue limitation of this application.

[0023] Figure 1This is a schematic diagram illustrating the structure of a honeypot development system according to an exemplary embodiment;

[0024] Figure 2 This is a flowchart illustrating a honeypot development method according to an exemplary embodiment;

[0025] Figure 3 This is a schematic diagram illustrating a honeypot development method according to an exemplary embodiment;

[0026] Figure 4 This is a flowchart illustrating yet another honeypot development method according to an exemplary embodiment;

[0027] Figure 5 This is a flowchart illustrating yet another honeypot development method according to an exemplary embodiment;

[0028] Figure 6 This is a flowchart illustrating yet another honeypot development method according to an exemplary embodiment;

[0029] Figure 7 This is a block diagram illustrating a honeypot development apparatus according to an exemplary embodiment;

[0030] Figure 8 This is a block diagram illustrating an electronic device according to an exemplary embodiment. Detailed Implementation

[0031] To enable those skilled in the art to better understand the technical solutions of this application, the technical solutions in the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings.

[0032] It should be noted that the terms "first," "second," etc., used in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented in orders other than those illustrated or described herein. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this application. Rather, they are merely examples of apparatuses and methods consistent with some aspects of this application as detailed in the appended claims.

[0033] For ease of understanding, the terminology used in the embodiments of this application will be introduced below.

[0034] Honeypot technology: A technique to deceive attackers by deploying decoy hosts, network services, or information to deliberately lure them into launching attacks. This allows attackers to capture and analyze the attack behavior, infer their intent and motives, and enable defenders to collect attack information and take countermeasures, thereby enhancing the security of the actual system.

[0035] Honeypot technology in web security protection: (1) Non-targeted web attack honeypots: The source of the attack is often an automated attack script. These attack scripts do not have a clear target and scan and verify web applications on the Internet in batches; honeypots have web attack warning and payload capture capabilities. (2) Targeted web attack honeypots: The attack is mostly carried out by the attacker himself, and the attack has a clear target, such as the official website homepage or a sub-department's second-level domain website; in addition to web attack warning and payload capture capabilities, honeypots can also delay the attack process and give security personnel more emergency response time.

[0036] Express: Express is a fast, open, and minimalist web development framework based on the Node.js platform. Essentially, it is a third-party package on npm that provides a convenient way to quickly create web servers and can be used to develop single-page, multi-page, and hybrid web applications.

[0037] The framebeat+kafka+logstash framework: (1) Framebeat is responsible for collecting log information generated by the honeypot from the server and sending the log information to Logstash; (2) Logstash processes and filters the log information and pushes specific information to Kafka according to the requirements; (3) Kafka is a message middleware whose main function is to collect, store and process massive amounts of real-time log data for other applications to process and use.

[0038] Before providing a detailed introduction to the resource deployment method provided in this application, let's first briefly introduce the application scenarios involved in this application.

[0039] In the field of computer technology, with the development of Internet technology, cyberattacks have become very common. To defend against and detect cyberattacks, honeypot technology has emerged. Honeypot technology deploys decoy hosts, network services, or information to lure attackers into attacking them. The attacker's attack behavior is captured and analyzed, thereby inferring the attacker's intent and taking countermeasures based on that intent to enhance network security protection capabilities.

[0040] In related technologies, when multiple honeypots need to be deployed, multiple honeypots need to be developed and deployed separately. However, honeypot development efficiency is relatively low.

[0041] Furthermore, existing honeypots have a low level of simulation, which makes attackers question the authenticity of the honeypots when they attack them, resulting in less information about the attackers being captured.

[0042] To address the aforementioned issues, this application proposes a honeypot development method. This method involves acquiring multiple honeypot resources and generating multiple honeypot nodes, each corresponding to one of the resources. The identifier of the resource requesting device for each honeypot node is then used as the identifier of the electronic device. In response to each honeypot resource request sent by a honeypot node, the method matches the corresponding processing function from a pre-defined request path routing table and processes the request. This approach enables the simultaneous deployment of multiple honeypot nodes and the processing of honeypot resource requests through a single electronic device, achieving batch honeypot development and significantly improving development efficiency.

[0043] Before providing a detailed introduction to the honeypot development method provided in this application, let's briefly introduce the implementation environment (implementation architecture) involved in this application.

[0044] The honeypot development method provided in this application can be applied to honeypot development systems. Figure 1 A schematic diagram of one structure of the honeypot development system is shown. For example... Figure 1 As shown, the honeypot development system 10 includes an electronic device 11 and a server 12 corresponding to the honeypot resources. The electronic device 11 and the server 12 corresponding to the honeypot resources are connected by a wired or wireless connection.

[0045] The electronic device 11 can be used to interact with the server 12 corresponding to the honeypot resources. For example, it can obtain multiple honeypot resources from the server 12 corresponding to the honeypot resources and generate multiple honeypot nodes that correspond one-to-one with the multiple honeypot resources.

[0046] Furthermore, the electronic device 11 is also used to identify the identifier of the resource request device of each of the multiple honeypot nodes as the identifier of the electronic device.

[0047] The electronic device 11 is also used to respond to honeypot resource requests sent by each honeypot node by matching the processing function corresponding to the honeypot resource request from a preset request path routing table and processing the honeypot resource request.

[0048] Optionally, the electronic device 11 can be a physical machine, such as a base station device, a desktop computer, a server, or a server group composed of multiple servers.

[0049] Optionally, the aforementioned electronic device 11 can also achieve the functions to be performed by a virtual machine (VM) deployed on a physical machine.

[0050] In the following embodiments provided in this application, the electronic device 11 is described as an example of being set up independently.

[0051] To facilitate understanding, the honeypot development method provided in this application will be described in detail below with reference to the accompanying drawings.

[0052] Figure 2 This is a flowchart illustrating a honeypot development method according to an exemplary embodiment. This method can be applied to electronic devices, or to honeypot development devices connected to or located within electronic devices. The following description uses the application of this method to an electronic device as an example to illustrate the method. Figure 2 As shown, the honeypot development method includes the following steps:

[0053] S201. The electronic device acquires multiple honeypot resources and generates multiple honeypot nodes that correspond one-to-one with the multiple honeypot resources.

[0054] As one possible implementation, electronic devices acquire multiple network resources.

[0055] Electronic devices generate multiple honeypot resources that correspond one-to-one with each of the multiple network resources.

[0056] Subsequently, the electronic device generates multiple honeypot nodes that correspond one-to-one with the multiple honeypot resources.

[0057] It should be noted that the similarity between the resource information of the honeypot resource and the resource information of the network resource corresponding to the honeypot resource is greater than the preset similarity.

[0058] In practical applications, network resources can be web pages. Web crawling tools are used to pre-save crawlable resources from web pages, and then tools like wget or curl are used to download unsaved resources to the local machine. This ensures that the elements on the local web page are essentially identical to the original website, providing a high degree of fidelity and allowing attackers to indiscriminately access both the original web page address and the honeypot URL.

[0059] S202. The electronic device identifies the identifier of the resource request device of each honeypot node among multiple honeypot nodes.

[0060] In practical applications, the electronic device places multiple local web pages into the templates subfolder of the general template folder, and modifies the action request path in the form to the identifier of the electronic device, so as to make it consistent with the listening path in the electronic device.

[0061] S203. The electronic device responds to the honeypot resource request sent by each honeypot node, matches the processing function corresponding to the honeypot resource request from the preset request path routing table, and processes the honeypot resource request.

[0062] like Figure 3 As shown, Figure 3 An exemplary diagram illustrates how an electronic device matches the processing function corresponding to a honeypot resource request from a preset request path routing table and processes the honeypot resource request.

[0063] As is understood, the technical solution provided in this application acquires multiple honeypot resources and generates multiple honeypot nodes that correspond one-to-one with each honeypot resource. The identifier of the resource request device for each honeypot node is determined as the identifier of the electronic device. In response to a honeypot resource request sent by each honeypot node, the processing function corresponding to the honeypot resource request is matched from a preset request path routing table, and the honeypot resource request is processed. In this way, multiple honeypot nodes are deployed simultaneously, and honeypot resource requests are processed through a single electronic device, enabling batch development of honeypots and greatly improving honeypot development efficiency.

[0064] In some embodiments, such as Figure 4 As shown in the embodiments of this application, the honeypot development method further includes the following steps:

[0065] S301. The electronic device determines at least one set of honeypot nodes among a plurality of honeypot nodes.

[0066] In each honeypot node set, the honeypot nodes have the same honeypot resource type.

[0067] As one possible implementation, the electronic device identifies honeypot nodes with the same honeypot resources among multiple honeypot nodes as a honeypot resource set. Furthermore, the electronic device identifies at least one set of honeypot nodes.

[0068] S302. The electronic device responds to the honeypot resource request of the honeypot node in the target honeypot node set, obtains the target data corresponding to the target honeypot node set from the honeypot resource request, and generates logs based on the target data.

[0069] The target data includes at least one of the attacker's username, password, Internet Protocol IP address, port, and user agent; the target honeypot node set is at least one of at least one honeypot node set; different honeypot node sets correspond to different target data.

[0070] In practical applications, if an attacker performs a web login operation, the log file will record the account information and password information submitted by the attacker.

[0071] The electronic device generates logs based on the target data and stores them in access.log.

[0072] As is understood, the technical solution provided in this application determines at least one honeypot node set among multiple honeypot nodes. In response to a honeypot resource request from a honeypot node in the target honeypot node set, target data corresponding to the target honeypot node set is obtained from the honeypot resource request, and logs are generated based on the target data. Thus, since the target data required from different types of honeypot nodes is different, pre-determining at least one honeypot node set and performing the same processing on honeypot resource requests within the same honeypot node set allows for the simultaneous processing of multiple honeypot nodes of different types.

[0073] In some embodiments, such as Figure 5 As shown in the embodiments of this application, the honeypot development method further includes the following steps:

[0074] S401. Electronic devices obtain the port number of each honeypot node among multiple honeypot nodes.

[0075] For example, multiple honeypot nodes include honeypot node 1, honeypot node 2, and honeypot node 3. The electronic device obtains that the port number of honeypot node 1 is 2001, the port number of honeypot node 2 is 2005, and the port number of honeypot node 3 is 2009.

[0076] S402. The electronic device generates a startup command for each honeypot node based on the port number.

[0077] In practical applications, the electronic device generates the startup command for each honeypot node based on the port number as "nodeserver.js port number".

[0078] S403. The electronic device executes the startup command to start each honeypot node.

[0079] It is understood that the technical solution provided in this application embodiment only requires one command to start the honeypot service in the honeypot node, without the need to install third-party dependencies for the task, and further simplifies the operation process by directly setting the port in the startup command, thus improving efficiency.

[0080] In some embodiments, such as Figure 6 As shown in the embodiments of this application, the honeypot development method further includes the following steps:

[0081] S501: Electronic devices parse logs using filters.

[0082] In practical applications, electronic devices adopt a framebeat + logstash + kafka architecture. In framebeat, framestream is configured to collect and read access.log log content in real time, and send newly added content of the log file to logstash. In logstash, framestream is configured to parse the log in JSON format.

[0083] S502, Visual display of electronic devices shows the logs obtained after parsing the logs.

[0084] In practical applications, electronic devices acquire visualization requirements, add and rename fields related to these requirements in logs, and add timestamps. Then, the electronic devices send the processed logs to Kafka for consumption or visualization by other functional components.

[0085] The foregoing primarily describes the solutions provided in the embodiments of this application from a methodological perspective. To achieve the aforementioned functions, the honeypot development apparatus or electronic device includes hardware structures and / or software modules corresponding to the execution of each function. Those skilled in the art should readily recognize that, based on the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein, this application can be implemented in hardware or a combination of hardware and computer software. Whether a function is executed in hardware or by computer software driving hardware depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0086] This application embodiment can, according to the above method, exemplarily divide a honeypot development device or electronic device into functional modules. For example, the honeypot development device or electronic device may include functional modules corresponding to each functional division, or two or more functions may be integrated into one processing module. The integrated module can be implemented in hardware or as a software functional module. It should be noted that the module division in this application embodiment is illustrative and only represents one logical functional division; in actual implementation, there may be other division methods.

[0087] For example, embodiments of this application also provide a honeypot development apparatus.

[0088] In some embodiments, Figure 7 This is a block diagram illustrating a honeypot development apparatus according to an exemplary embodiment. (Refer to...) Figure 7 The honeypot development device 600 includes an acquisition unit 601, a determination unit 602, and a processing unit 603.

[0089] The acquisition unit 601 is used to acquire multiple honeypot resources and generate multiple honeypot nodes that correspond one-to-one with the multiple honeypot resources.

[0090] The determining unit 602 is used to determine the identifier of the resource request device of each honeypot node among multiple honeypot nodes as the identifier of the electronic device.

[0091] The processing unit 603 is used to respond to the honeypot resource request sent by each honeypot node, match the processing function corresponding to the honeypot resource request from the preset request path routing table, and process the honeypot resource request.

[0092] Optional, such as Figure 7 As shown, the apparatus provided in this application embodiment further includes: a generation unit 604.

[0093] The determining unit 602 is also used to determine at least one honeypot node set among multiple honeypot nodes; the honeypot nodes in each honeypot node set have the same honeypot resource type.

[0094] The acquisition unit 601 is also used to respond to the honeypot resource request of the honeypot node in the target honeypot node set and obtain the target data corresponding to the target honeypot node set from the honeypot resource request.

[0095] The generation unit 604 is used to generate logs based on target data; the target data includes at least one of the attacker's username, password, Internet Protocol IP address, port, and user agent; the target honeypot node set is at least one of at least one honeypot node set; different honeypot node sets correspond to different target data.

[0096] Optional, such as Figure 7 As shown, the acquisition unit 601 provided in this embodiment is specifically used for:

[0097] Acquire multiple network resources.

[0098] Multiple honeypot resources are generated based on multiple network resources, each corresponding to one of the network resources; the similarity between the resource information of the honeypot resources and the resource information of the corresponding network resources is greater than the preset similarity.

[0099] Optional, such as Figure 7As shown, the apparatus provided in this application embodiment further includes:

[0100] The acquisition unit 601 is also used to acquire the port number of each honeypot node among multiple honeypot nodes.

[0101] The generation unit 604 is also used to generate startup instructions for each honeypot node based on the port number.

[0102] The processing unit 603 is also used to execute startup instructions to start each honeypot node.

[0103] Optional, such as Figure 7 As shown, the processing unit 603 provided in this embodiment is further used for:

[0104] The logs are parsed using filters.

[0105] The logs are visualized and displayed after parsing.

[0106] Regarding the apparatus in the above embodiments, the specific manner in which each module performs its operation has been described in detail in the embodiments related to the method, and will not be elaborated upon here.

[0107] Figure 8 This is a block diagram illustrating an electronic device according to an exemplary embodiment. Figure 8 As shown, the electronic device 700 includes, but is not limited to, a processor 701 and a memory 702.

[0108] The memory 702 described above is used to store the executable instructions of the processor 701. It is understood that the processor 701 is configured to execute instructions to implement the honeypot development method in the above embodiments.

[0109] It should be noted that those skilled in the art will understand that Figure 8 The electronic device structure shown does not constitute a limitation on the electronic device; the electronic device may include, but is not limited to, other electronic devices. Figure 8 This may indicate more or fewer components, or combinations of certain components, or different component arrangements.

[0110] Processor 701 is the control center of the electronic device. It connects various parts of the electronic device via various interfaces and lines. By running or executing software programs and / or modules stored in memory 702, and by calling data stored in memory 702, it performs various functions and processes data, thereby providing overall monitoring of the electronic device. Processor 701 may include one or more processing units. Optionally, processor 701 may integrate an application processor and a modem processor. The application processor mainly handles the operating system, user interface, and applications, while the modem processor mainly handles wireless communication. It is understood that the modem processor may not be integrated into processor 701.

[0111] The memory 702 can be used to store software programs and various data. The memory 702 may primarily include a program storage area and a data storage area. The program storage area may store the operating system, application programs required by at least one functional module (such as a determination unit, processing unit, etc.), etc. Furthermore, the memory 702 may include high-speed random access memory, and may also include non-volatile memory, such as at least one disk storage device, flash memory device, or other volatile solid-state storage device.

[0112] In an exemplary embodiment, a computer-readable storage medium including instructions is also provided, such as a memory 702 including instructions, which can be executed by a processor 701 of an electronic device 700 to implement the honeypot development method in the above embodiments.

[0113] In actual implementation, Figure 7 The functions of the acquisition unit 601, determination unit 602, processing unit 603, and generation unit 604 can all be provided by... Figure 8 The processor 701 calls the computer program stored in the memory 702 to implement the process. The specific execution process can be found in the description of the honeypot development method in the previous embodiment, and will not be repeated here.

[0114] Optionally, the computer-readable storage medium may be a non-transitory computer-readable storage medium, such as a read-only memory (ROM), random access memory (RAM), CD-ROM, magnetic tape, floppy disk, and optical data storage device.

[0115] In an exemplary embodiment, this application also provides a computer program product including one or more instructions, which can be executed by a processor 701 of an electronic device to complete the honeypot development method in the above embodiments.

[0116] It should be noted that when one or more instructions in the computer-readable storage medium or computer program product are executed by the processor of the electronic device, they implement the various processes of the honeypot development method embodiment described above, and can achieve the same technical effect as the honeypot development method described above. To avoid repetition, they will not be described again here.

[0117] Through the above description of the embodiments, those skilled in the art can clearly understand that, for the sake of convenience and brevity, only the division of the above functional modules is used as an example. In actual applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above.

[0118] In the several embodiments provided in this application, it should be understood that the disclosed apparatus and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of modules or units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another apparatus, or some features may be ignored or not executed. Furthermore, the mutual coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between apparatuses or units may be electrical, mechanical, or other forms.

[0119] The units described as separate components may or may not be physically separate. A component shown as a unit can be one or more physical units; that is, it can be located in one place or distributed in multiple different locations. Some or all of the classified units can be selected to achieve the purpose of this embodiment, depending on actual needs.

[0120] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0121] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a readable storage medium. Based on this understanding, the technical solution of the embodiments of this application, essentially, or the part that contributes to the prior art, or a complete or partial classification of the technical solution, can be embodied in the form of a software product. This software product is stored in a storage medium and includes several instructions to cause a device (which may be a microcontroller, chip, etc.) or processor to execute all or part of the steps of the methods of the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, ROM, RAM, magnetic disks, or optical disks.

[0122] The above are merely specific embodiments of this application, but the scope of protection of this application is not limited thereto. Any changes or substitutions within the technical scope disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A honeypot development method, characterized in that, Applied to electronic devices, the method includes: Acquire multiple honeypot resources, and generate multiple honeypot nodes that correspond one-to-one with the multiple honeypot resources; The identifier of the resource requesting device of each of the multiple honeypot nodes is determined as the identifier of the electronic device; In response to the honeypot resource request sent by each honeypot node, the processing function corresponding to the honeypot resource request is matched from the preset request path routing table, and the honeypot resource request is processed. The method further includes: Identify at least one set of honeypot nodes among the plurality of honeypot nodes; the honeypot nodes in each set of honeypot nodes have the same honeypot resource type; In response to a honeypot resource request from a honeypot node in the target honeypot node set, target data corresponding to the target honeypot node set is obtained from the honeypot resource request, and logs are generated based on the target data; the target data includes at least one of the attacker's username, password, Internet Protocol IP address, port, and user agent; the target honeypot node set is at least one of the at least one honeypot node set; different honeypot node sets correspond to different target data.

2. The method according to claim 1, characterized in that, The acquisition of multiple honeypot resources includes: Acquire multiple network resources; Multiple honeypot resources are generated based on the multiple network resources, each corresponding to one of the multiple network resources; the similarity between the resource information of the honeypot resources and the resource information of the network resources corresponding to the honeypot resources is greater than a preset similarity.

3. The method according to any one of claims 1-2, characterized in that, The method further includes: Obtain the port number of each honeypot node among the multiple honeypot nodes; The startup command for each honeypot node is generated based on the port number; Execute the startup command to start each honeypot node.

4. The method according to claim 1, characterized in that, The method further includes: The logs are parsed using filters; The logs are visualized and displayed after parsing.

5. A honeypot development device, characterized in that, Applied to electronic devices, the device includes: an acquisition unit, a determination unit, a processing unit, and a generation unit; The acquisition unit is used to acquire multiple honeypot resources and generate multiple honeypot nodes that correspond one-to-one with the multiple honeypot resources. The determining unit is used to determine the identifier of the resource requesting device of each of the plurality of honeypot nodes as the identifier of the electronic device; The processing unit is configured to respond to the honeypot resource request sent by each honeypot node, match the processing function corresponding to the honeypot resource request from a preset request path routing table, and process the honeypot resource request. The determining unit is further configured to determine at least one honeypot node set among the plurality of honeypot nodes; the honeypot nodes in each honeypot node set have the same honeypot resource type; The acquisition unit is further configured to respond to a honeypot resource request from a honeypot node in the target honeypot node set and acquire target data corresponding to the target honeypot node set from the honeypot resource request; The generation unit is used to generate logs based on the target data; the target data includes at least one of the attacker's username, password, Internet Protocol IP address, port, and user agent; the target honeypot node set is at least one of the at least one honeypot node set; different honeypot node sets correspond to different target data.

6. The apparatus according to claim 5, characterized in that, The acquisition unit is specifically used for: Acquire multiple network resources; Multiple honeypot resources are generated based on the multiple network resources, each corresponding to one of the multiple network resources; the similarity between the resource information of the honeypot resources and the resource information of the network resources corresponding to the honeypot resources is greater than a preset similarity.

7. The apparatus according to any one of claims 5-6, characterized in that, The device further includes: The acquisition unit is also used to acquire the port number of each honeypot node among the plurality of honeypot nodes; The generation unit is also used to generate a startup command for each honeypot node based on the port number; The processing unit is also configured to execute the startup command to start each honeypot node.

8. The apparatus according to claim 5, characterized in that, The processing unit is further configured to: The logs are parsed using filters; The logs are visualized and displayed after parsing.

9. An electronic device, characterized in that, include: processor; Memory used to store the processor's executable instructions; The processor is configured to execute the instructions to implement the method as described in any one of claims 1 to 4.

10. A computer-readable storage medium, characterized in that, When the computer-executable instructions stored in the computer-readable storage medium are executed by the processor of the electronic device, the electronic device is capable of performing the method as described in any one of claims 1 to 4.

Images