A method, system and storage medium for attracting traffic to account honeypots based on MiTing agent

Abstract

The present invention discloses a method, system, and storage medium for diverting traffic from an account honeypot based on a MiTing agent. The method comprises: importing a pre-acquired blacklist file by modifying a global block in the configuration file, and introducing an account detection module by modifying a location block in the configuration file; receiving user access traffic, determining whether the user IP address corresponding to the user access traffic is a blacklisted IP address based on MiTing, forwarding the user access traffic to an account honeypot based on the judgment result, or performing a login operation detection on the user access traffic to obtain a user login request; determining whether encrypted and unencrypted user login requests contain a honeypot account through the account detection module, and then forwarding the corresponding user access traffic to a real business server or an account honeypot based on the account detection result. The present invention can achieve isolation from the real business server, has high security, and a low false alarm rate, and can be widely applied in the field of network security.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a method, system and storage medium for diverting traffic to account honey spots based on the MiTing agent. Background Art

[0002] Account honeypots are used to attract and identify malicious attackers or unauthorized users. They simulate accounts on real business servers, but are actually set up to collect attack data, monitor attack behavior, and protect real business servers. Existing account honeypots have the following shortcomings and limitations: First, they require additional resources on real business servers to create and maintain fake accounts, as well as to monitor and analyze attacker activity. This increases the system burden and requires additional hardware, storage, and network bandwidth. Second, account honeypots may sometimes misidentify legitimate users as attackers, leading to them being misled or restricted, which can negatively impact the user experience and increase the workload of support teams. Third, account honeypots themselves can become targets of attack. Attackers may attempt to bypass the account honeypot, compromise the integrity of the honeypot system, or use the honeypot system to launch attacks on other real business servers. Summary of the Invention

[0003] In order to solve the above technical problems, the purpose of the present invention is to provide an account honeypot drainage method, system and storage medium based on the MiTing agent with less impact on the real business server.

[0004] To achieve the above objectives, one aspect of the embodiments of the present application proposes an account honeypot drainage method based on the MiTing agent, comprising the following steps:

[0005] Modify the configuration file in Nginx, wherein the pre-obtained blacklist file is imported by modifying the global block in the configuration file, and the account detection module is introduced by modifying the location block in the configuration file;

[0006] Receive user access traffic, determine whether the user IP address corresponding to the user access traffic is a blacklisted IP address based on the blacklist file by MiTing, obtain a judgment result, and then forward the user access traffic to the account honeypoint according to the judgment result, or perform a login operation detection on the user access traffic according to the judgment result to obtain a user login request corresponding to the user access traffic;

[0007] Determining whether the user login request contains a honeypot account by the account detection module, obtaining an account detection result, and then forwarding the corresponding user login request to the real business server or the account honeypot according to the account detection result;

[0008] The user login request includes an encrypted user login request and a non-encrypted user login request.

[0009] In some embodiments, the step of modifying the configuration file in Nginx further includes:

[0010] Create a variable based on the user IP address by modifying the http block in the configuration file;

[0011] Define the listening port and server domain name by modifying the server block in the configuration file.

[0012] In some embodiments, the step of importing the pre-obtained blacklist file by modifying the global block in the configuration file specifically includes:

[0013] Get the blacklist file from the Modsecurity plugin;

[0014] Import the blacklist file by modifying the include directive in the global block;

[0015] The blacklist file includes a plurality of blacklist IP addresses.

[0016] In some embodiments, the judgment result includes a first judgment result and a second judgment result. The step of receiving user access traffic and determining whether the user IP address corresponding to the user access traffic is a blacklisted IP address based on the blacklist file of MiTing to obtain the judgment result specifically includes:

[0017] Receiving the user access traffic in the monitoring port;

[0018] Determine whether the user IP address is a blacklisted IP address through the Modsecurity plug-in;

[0019] When the user IP address is the blacklist IP address, mapping the variable corresponding to the user IP address to a first preset number to obtain the first judgment result;

[0020] When the user IP address is not the blacklist IP address, the variable corresponding to the user IP address is mapped to a second preset number to obtain the second judgment result.

[0021] In some embodiments, the step of forwarding the user access traffic to an account honeypot based on the judgment result, or performing a login operation detection on the user access traffic based on the judgment result to obtain a user login request, specifically includes:

[0022] forwarding the user access traffic corresponding to the first preset number to the account sweet spot according to the first judgment result;

[0023] Performing a login operation detection on the user access traffic corresponding to the second preset number according to the second judgment result;

[0024] When the user access traffic does not perform a login operation, forwarding the user access traffic to the real business server;

[0025] When the user accesses the traffic to perform a login operation, the user login request is obtained.

[0026] In some embodiments, the step of determining whether the user login request includes a honeypot account by the account detection module and obtaining an account detection result specifically includes:

[0027] Obtaining encrypted matching files and non-encrypted user login requests through the account honeypot;

[0028] Determine, by the account detection module, whether the user login request is the encrypted user login request or the non-encrypted user login request:

[0029] When the user login request is the encrypted user login request, determining whether the encrypted user login request includes the encrypted matching file;

[0030] If the encrypted user login request includes the encrypted matching file, a first account detection result is obtained; if the encrypted user login request does not include the encrypted matching file, a second account detection result is obtained;

[0031] When the user login request is the non-encrypted user login request, determining whether the non-encrypted user login request includes the non-encrypted user login request;

[0032] If the non-encrypted user login request includes the non-encrypted matching file, a third account detection result is obtained; if the non-encrypted user login request does not include the non-encrypted matching file, a fourth account detection result is obtained.

[0033] In some embodiments, the step of forwarding the corresponding user login request to the real business server or the account honeypot according to the account detection result specifically includes:

[0034] adding the user IP address corresponding to the encrypted user login request to the blacklist file according to the first account detection result, and forwarding the corresponding encrypted user login request to the account honeypot;

[0035] forwarding the corresponding encrypted user login request to the real business server according to the second account detection result;

[0036] adding the user IP address corresponding to the non-encrypted user login request to the blacklist file according to the third account detection result, and forwarding the corresponding non-encrypted user login request to the account honeypot;

[0037] The corresponding non-encrypted user login request is forwarded to the real business server according to the fourth account detection result.

[0038] To achieve the above objectives, another aspect of the present application provides an account honeypot drainage system based on the MiTing agent, comprising:

[0039] A configuration modification module is used to modify a configuration file in Nginx, wherein a pre-obtained blacklist file is imported by modifying a global block in the configuration file, and an account detection module is introduced by modifying a location block in the configuration file;

[0040] An IP address judgment module is used to receive user access traffic, determine whether the user IP address corresponding to the user access traffic is a blacklisted IP address based on the blacklist file of the honey court, obtain a judgment result, and then forward the user access traffic to the account honey point according to the judgment result, or perform a login operation detection on the user access traffic according to the judgment result to obtain a user login request corresponding to the user access traffic;

[0041] a content detection module, configured to determine whether the user login request contains a honeypot account through the account detection module, obtain an account detection result, and then forward the corresponding user login request to the real business server or the account honeypot according to the account detection result;

[0042] The user login request includes an encrypted user login request and a non-encrypted user login request.

[0043] To achieve the above-mentioned purpose, another aspect of an embodiment of the present application proposes an electronic device, which includes a memory, a processor, a program stored on the memory and runnable on the processor, and a data bus for realizing connection and communication between the processor and the memory. When the program is executed by the processor, the account honey spot diversion method based on the MiTing agent as described above is realized.

[0044] To achieve the above-mentioned purpose, another aspect of an embodiment of the present application proposes a storage medium, which is a computer-readable storage medium used for computer-readable storage. The storage medium stores one or more programs, and the one or more programs can be executed by one or more processors to implement the account honey point drainage method based on the MiTing agent as described above.

[0045] The beneficial effects of the present invention are as follows: the account honey spot drainage method, system and storage medium based on the Mi Ting agent of the present invention, on the one hand, detects encrypted and non-encrypted user login requests in the Mi Ting agent, forwards the login requests using the honey spot account to the account honey spot, and forwards the normal user login request proxy to the real business server, so that the account honey spot can be deployed in a separate network, isolated from the real business server, reducing the impact on the real business server, and can identify attack behaviors that use the honey spot account to launch attacks, with high security; on the other hand, by identifying whether the user IP address is a blacklisted IP address, the user IP address corresponding to the blacklisted IP address is forwarded to the account honey spot, and the normal user IP address that has not logged in is forwarded to the real business server, which can avoid misjudging legitimate users as attackers and has a low false alarm rate. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following introduction is made to the drawings required for use in the embodiments of the present invention. It should be understood that the drawings introduced below are only for the convenience of clearly describing some embodiments of the technical solutions of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without any creative work.

[0047] Figure 1 A flowchart of the steps of a method for diverting traffic to an account honeypot based on a MiTing agent provided in an embodiment of the present invention;

[0048] Figure 2 A flowchart of the account detection module provided in an embodiment of the present invention;

[0049] Figure 3 A flowchart of a method for diverting traffic to an account honeypot based on a MiTing agent is provided in an embodiment of the present invention;

[0050] Figure 4 A schematic diagram of the structure of an account honeypot drainage system based on the MiTing agent provided in an embodiment of the present invention;

[0051] Figure 5 A schematic structural diagram of a computer device provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0052] In order to make the purpose, technical solutions and advantages of the present application clearer, the present application is further described in detail below with reference to the accompanying drawings and examples. It should be understood that the specific embodiments described herein are only used to explain the present application and are not intended to limit the present application. When the following description refers to the drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the embodiments of the present application. They are merely examples of devices and methods consistent with some aspects of the embodiments of the present application as detailed in the appended claims.

[0053] It will be understood that the terms "first", "second", etc. used in this application may be used herein to describe various concepts, but unless otherwise specified, these concepts are not limited by these terms. These terms are only used to distinguish one concept from another. For example, without departing from the scope of the embodiments of the present application, the first information may also be referred to as the second information, and similarly, the second information may also be referred to as the first information. Depending on the context, the words "if" and "if" as used herein may be interpreted as "at the time of" or "when" or "in response to determining".

[0054] The terms "at least one", "plurality", "each", "any", etc. used in this application include "at least one", "two" or more, "plurality" or "each", "any" or "any one", "each" or "any one" as used herein.

[0055] Before explaining the embodiments of the present application in detail, some of the nouns and terms involved in the embodiments of the present application are first explained. The nouns and terms involved in the embodiments of the present application are subject to the following explanations.

[0056] Nginx is a high-performance HTTP and reverse proxy server, as well as an IMAP / POP3 / SMTP proxy server. It is lightweight, high-performance, highly concurrent, and uses little memory. It accepts client requests, forwards them to backend application servers, and returns responses from the backend servers to the clients. It is widely used as a web server and reverse proxy server. Nginx also offers a wealth of other features and modules, such as static resource serving, HTTPS support, and log management, to meet diverse needs.

[0057] MiTing is a reverse security proxy server. As a front-end system for the back-end server cluster, it has reverse proxy, trapping monitoring, access restriction, content anomaly detection and traffic forwarding functions. It is deployed between the communication link between the client and the back-end server cluster.

[0058] MiTing's security detection feature is based on Modsecurity, an open-source WAF tool. Modsecurity is an open-source Web Application Firewall (WAF) used to protect web applications from attacks. It detects and blocks common web attacks such as SQL injection, cross-site scripting (XSS), and remote file inclusion. It can be loaded into Nginx as a module to detect and analyze content anomalies in application-layer protocol packets and output detection results. MiTing will blacklist any access behavior that is deemed abnormal.

[0059] Honeyspots are a security technology designed to attract and deceive potential attackers in order to gather information about them, their strategies, and their intentions. Honeyspots are typically designed to appear vulnerable systems or network components. By exposing fake targets to attackers, researchers can observe their behavior, study their attack techniques and strategies, and thereby gain a deeper understanding of them. Honeyspots can also collect tools, exploit code, and malware samples used by attackers, helping researchers analyze and understand threat intelligence. Account honeyspots are used to attract and identify malicious attackers or unauthorized users. They simulate accounts on real business servers, but are actually set up to collect attack data, monitor attack behavior, and protect real business servers.

[0060] With the rapid development of Internet technology, an increasing number of network attack tools and techniques have emerged. To protect backend servers from malicious traffic and attacks, enterprises often use reverse proxies to hide real server information and implement security solutions to block and divert malicious traffic. Existing reverse proxy account honeypots have the following shortcomings and limitations: First, account honeypots require additional resources on real business servers to create and maintain fake accounts, as well as to monitor and analyze attacker activity, increasing system burden and requiring additional hardware, storage, and network bandwidth. Second, account honeypots may sometimes misidentify legitimate users as attackers, causing them to be misled or restricted, which can negatively impact user experience and increase support team workload. Third, account honeypots themselves can become targets of attack. Attackers may attempt to bypass the account honeypot, compromise the integrity of the honeypot system, or exploit the system to launch attacks on other real business servers.

[0061] The main reasons for the above shortcomings include two aspects: on the one hand, the account honey spot system cannot actively divert traffic and needs to be established in the real business server. It relies on account verification when logging into the system to forward user requests logged in using the honey spot account to the account honey spot; on the other hand, the account honey spot is not absolutely safe and may have unknown vulnerabilities. If the account honey spot is established in the real business server, attackers may exploit unknown vulnerabilities to bypass the account honey spot and attack the real business server.

[0062] To this end, an embodiment of the present invention proposes an account honeypot diversion method based on the Miting proxy. On the one hand, by detecting encrypted and non-encrypted user login requests in the Miting proxy, the login requests using the honeypot account are forwarded to the account honeypot, and the normal user login request proxy is forwarded to the real business server, so that the account honeypot can be deployed in a separate network, isolated from the real business server, reducing the impact on the real business server, and can identify attacks using the honeypot account to launch attacks, with high security. On the other hand, by identifying whether the user IP address is a blacklisted IP address, the user IP address corresponding to the blacklisted IP address is forwarded to the account honeypot, and the normal user IP address that has not logged in is forwarded to the real business server, which can avoid misjudging legitimate users as attackers and has a low false alarm rate. The account honeypot diversion method can be applied to scenarios such as online financial services, corporate intranets, and online social networks, but is not limited to these.

[0063] Reference Figure 1 , Figure 1 A flowchart of a method for diverting traffic from a sweet spot to an account based on a MiTing agent is provided in an embodiment of the present invention. The method includes steps S101 to S103:

[0064] S101. Modify the configuration file in Nginx, wherein the pre-obtained blacklist file is imported by modifying the global block in the configuration file, and the account detection module is configured by modifying the location block in the configuration file;

[0065] Specifically, the Nginx configuration file consists of multiple directives, which can be divided into global blocks, events blocks, http blocks, server blocks, and location blocks according to their functions. Among them, the global block includes directives that affect the operation of the entire Nginx server, such as the number of working processes, log file paths, etc.; the events block is used to control the network connection between the Nginx server and the user, such as whether to enable network connection serialization under multiple processes, the maximum number of connections, etc.; the http block is used to configure parameters related to the HTTP protocol, such as proxy servers, caches, etc. It can contain multiple server blocks, each of which is equivalent to a virtual host; the server block is used to specify the virtual server domain name, IP address, and listening port, etc. Multiple location blocks can be defined in the server block to match specific URL patterns; the location block is used to configure the request matching rules and corresponding processing logic. It specifies different URL paths or patterns and defines how the request should be processed when it matches the corresponding location block.

[0066] The embodiment of the present invention compiles the location block of Nginx proxy forwarding according to the following rules:

[0067] (1) Match the URL keyword of the login service in the form of a regular expression, in order to process the traffic related to the login service using the configuration in the location block;

[0068] (2) Match the URL of the non-login service in the form of universal path matching, with the purpose of processing the traffic of the non-login service using the configuration in the location block;

[0069] (3) Match the root path request, the purpose of which is to process the traffic that is not matched to any other location block using the configuration in the location block.

[0070] The configuration of rules (2) and (3) is based on specific business requirements. The embodiment of the present invention mainly uses the configuration block of rule (1) (i.e., the location block). In the configuration block (1), the loading instruction of the account detection module is first configured, and the account detection module is introduced to detect user access traffic. Then, based on the account detection result of the account detection module, the proxy forwarding path corresponding to the user login request is modified. At the same time, it is determined whether the source IP address corresponding to the request is added to the blacklist file, thereby determining the proxy rules.

[0071] As an optional implementation, the step of importing a blacklist and whitelist file through the include instruction in the global block may specifically include the following steps S1011 and S1012:

[0072] S1011. Get the blacklist file from the Modsecurity plugin;

[0073] S1012, importing the blacklist file by modifying the include directive in the global block;

[0074] The blacklist file includes multiple blacklist IP addresses.

[0075] Specifically, use the include directive to import a blacklist and whitelist file (blacklist.conf), which defines blacklisted IP addresses and maps them to 1, for example, "192.168.1.111-1; 192.168.1.112-1;." The blacklist file is provided by the Modsecurity plug-in. Modsecurity detects access traffic and updates the blacklist file with the source IP address of attack traffic in real time. Based on the user IP address, Modsecurity decides whether to mark the request as coming from the blacklist file. If the user IP address is in the blacklist file, the address is mapped to 1; otherwise, it is mapped to 0.

[0076] As an optional implementation, the step of modifying the configuration file in Nginx may further include the following steps S1013 and S1014:

[0077] S1013. Create a variable based on the user's IP address by modifying the http block in the configuration file;

[0078] Specifically, the map directive in the http block is used to create a variable mapping, which maps input values to different output values. In the http block of the Nginx configuration file, the map directive is used to create a variable and set the value of this variable ($blacklisted represents a custom blacklist variable) based on the user's IP address ($remote_addr is a built-in Nginx variable representing the user's IP address).

[0079] S1014. Define the listening port and server domain name by modifying the server block in the configuration file.

[0080] Specifically, the server directive block in the server block defines various server settings, such as the listening port, server domain name, IP address, and related location blocks.

[0081] S102: Receive user access traffic, determine whether the user IP address corresponding to the user access traffic is a blacklisted IP address based on the blacklist file, obtain a judgment result, and then forward the user access traffic to the account honeypot based on the judgment result, or perform a login operation detection on the user access traffic based on the judgment result to obtain a user login request corresponding to the user access traffic;

[0082] The user login request includes an encrypted user login request and a non-encrypted user login request.

[0083] As an optional implementation, the judgment result includes a first judgment result and a second judgment result. The step of receiving user access traffic and determining whether the user IP address corresponding to the user access traffic is a blacklisted IP address based on the blacklist file of MiTing to obtain the judgment result can be specifically divided into the following steps S1021 to S1024:

[0084] S1021. Receive user access traffic from the monitoring port;

[0085] S1022. Determine whether the user IP address is a blacklisted IP address through the Modsecurity plug-in;

[0086] S1023. When the user IP address is a blacklisted IP address, map the variable corresponding to the user IP address to a first preset number to obtain a first judgment result;

[0087] S1024: When the user IP address is not a blacklisted IP address, map the variable corresponding to the user IP address to a second preset number to obtain a second judgment result.

[0088] Specifically, the system receives user access traffic from the defined listening port, uses the Modsecurity plug-in to blacklist the user IP address corresponding to the access traffic, and uses the if directive in the Nginx configuration file where the blacklisted IP address check is required, and performs corresponding processing based on the value of the variable (0 or 1). For example, if($blacklisted){return403;} means that if the user IP address appears in the blacklist file, the value of the variable corresponding to the user IP address will be 1 (i.e., the first preset number); otherwise, it will be 0 (i.e., the second preset number).

[0089] As a further optional implementation, the user access traffic is forwarded to the account honeypot according to the judgment result, or the user access traffic is subjected to a login operation detection according to the judgment result to obtain the user login request. This step can be specifically divided into the following steps S1025 to S1028:

[0090] S1025. Forward the user access traffic corresponding to the first preset number to the account honeypot according to the first judgment result;

[0091] Specifically, if it is detected that the user's IP address exists in the blacklist file, it means that the user may have malicious behavior, such as sending spam, conducting DDoS attacks, or spreading malware. The variable corresponding to the user's IP address is mapped to 1 (that is, the first preset number), and the corresponding user access traffic proxy is forwarded to the account honeypot, thereby hiding the real business server, preventing the user's malicious behavior from affecting the real business server, and increasing security.

[0092] S1026: Perform a login operation detection on the user access traffic corresponding to the second preset number according to the second judgment result;

[0093] S1027. When the user access traffic does not perform a login operation, forward the user access traffic to the real business server;

[0094] S1028. When the user accesses the traffic to perform a login operation, a user login request is obtained.

[0095] Specifically, if it is detected that the user IP address does not exist in the blacklist file, it is further determined whether the user access traffic corresponding to the user IP address performs a login operation. If no login is performed, the user access traffic is forwarded to the real business server to ensure that the user has normal access and experience of the business, avoiding the denial of access to legitimate users due to misjudgment, thereby improving user experience and reducing the misjudgment rate; if a login operation is performed, the user login request is obtained for further corresponding processing. Through double verification, the access of illegal users to the real business server can be reduced, and security can be improved.

[0096] S103: Determine whether the user login request contains a honeypot account through the account detection module, obtain an account detection result, and then forward the corresponding user login request to the real business server or account honeypot according to the account detection result.

[0097] As an optional implementation, the account detection module determines whether the user login request includes a honeypot account and obtains the account detection result. This step can be specifically divided into the following steps S1031 to S1036:

[0098] S1031. Obtain encrypted matching files and non-encrypted matching files through the account honeypoint;

[0099] Specifically, the account detection module requires two matching files that store the honey point account information, one is the account and password data D1 stored in plain text (i.e., the encrypted matching file), and the other is the encrypted account and password data D2 (i.e., the non-encrypted matching file). Both files are provided by the account honey point.

[0100] S1032. Determine, through the account detection module, whether the user login request is an encrypted user login request or a non-encrypted user login request:

[0101] S1033: When the user login request is an encrypted user login request, determine whether the encrypted user login request includes an encrypted matching file;

[0102] S1034. If the encrypted user login request includes the encrypted matching file, obtain a first account detection result; if the encrypted user login request does not include the encrypted matching file, obtain a second account detection result;

[0103] S1035. When the user login request is a non-encrypted user login request, determine whether the non-encrypted user login request includes a non-encrypted user login request;

[0104] S1036. If the non-encrypted user login request includes a non-encrypted matching file, obtain a third account detection result; if the non-encrypted user login request does not include a non-encrypted matching file, obtain a fourth account detection result.

[0105] Specifically, if Figure 2 The figure shows the workflow of the account detection module. After receiving a request for user login service, the account detection module first determines whether the data of the request is encrypted. If it is an encrypted user login request, the module searches whether the request contains the account and password data in file D2 (i.e., the encrypted matching file); if it is an unencrypted user login request, the module searches whether the request contains the account and password data in file D1 (i.e., the unencrypted matching file). In this way, the module determines whether the encrypted and unencrypted user login requests contain a honeypot account, and obtains multiple account detection results.

[0106] As an optional implementation, the step of forwarding the corresponding user login request to the real business server or account honeypot according to the account detection result can be specifically divided into the following steps S1037 to S10310:

[0107] S1037. Add the user IP address corresponding to the encrypted user login request to a blacklist file based on the first account detection result, and forward the corresponding encrypted user login request to an account honeypot;

[0108] S1038. Forward the corresponding encrypted user login request to the real business server based on the second account detection result;

[0109] S1039: Add the user IP address corresponding to the unencrypted user login request to a blacklist file based on the third account detection result, and forward the corresponding unencrypted user login request to an account honeypot;

[0110] S10310. Forward the corresponding non-encrypted user login request to the real business server according to the fourth account detection result.

[0111] Specifically, if Figure 2 The figure shows the workflow of the account detection module. According to the results of various account retrieval, if the encrypted and unencrypted user login requests contain a honeypot account, the source user IP address of the request is added to the blacklist file, and the proxy forwarding path of the request is modified to send it to the account honeypot; if the encrypted and unencrypted user login requests do not contain a honeypot account, the request is not modified and the proxy forwarding of the request is sent to the real business server. In this way, the account honeypot can be deployed in a separate network, isolated from the real business server, and the impact on the real business server is reduced.

[0112] To sum up, the process of the honeypot drainage method based on the MiTing agent is as follows: Figure 3 As shown:

[0113] In the first step, Nginx receives and parses the access traffic of the listening port;

[0114] In the second step, the Modsecurity plug-in determines whether the user's IP address is a blacklisted IP address, forwards the user's IP address corresponding to the blacklisted IP address to the account honeypot, and performs login operation detection on the normal user IP address;

[0115] The third step is to forward the access traffic of users who have not logged in to the real business server;

[0116] The fourth step is to determine whether the user login request for the login operation contains a honeypot account;

[0117] Step 5: Add the user IP address containing the honeydeck account to the blacklist file and forward the corresponding user login request to the account honeydeck;

[0118] Step 6: Forward the user login request that does not contain the honeypot account to the real business server.

[0119] The above describes the account honey spot diversion method based on the MiTing proxy according to the embodiment of the present invention. It can be recognized that, compared with the existing reverse proxy account honey spots, the embodiment of the present invention configures the account detection module by modifying the location block in the Nginx configuration file, and imports the pre-acquired blacklist file by modifying the global block in the configuration file, thereby obtaining the user access traffic of the monitoring port, and determining whether the user IP address corresponding to the user access traffic is a blacklist IP address based on the blacklist file of MiTing, obtaining a judgment result, and forwarding the user access traffic to the account honey spot or performing a login operation detection on the user access traffic according to the judgment result, obtaining the user login request corresponding to the user access traffic, and finally determining whether the encrypted user login request and the non-encrypted user login request contain a honey spot account through the account detection module, obtaining the account detection result, and forwarding the corresponding user access traffic to the real business server or the account honey spot according to the account detection result. On the one hand, the present invention detects encrypted and non-encrypted user login requests in the Honey Court proxy, forwards login requests using honey point accounts to the account honey point, and forwards normal user login request proxies to the real business server, so that the account honey point can be deployed in a separate network, isolated from the real business server, reducing the impact on the real business server, and can identify attack behaviors that use honey point accounts to launch attacks, with high security; on the other hand, by identifying whether the user IP address is a blacklisted IP address, it can avoid misjudging legitimate users as attackers, and the false alarm rate is low.

[0120] Reference Figure 4 The embodiment of the present invention further provides an account honeypot drainage system based on the MiTing agent, comprising:

[0121] The configuration modification module is used to modify the Nginx configuration file. The pre-obtained blacklist file is imported by modifying the global block in the configuration file, and the account detection module is introduced by modifying the location block in the configuration file.

[0122] The IP address judgment module is used to receive user access traffic, determine whether the user IP address corresponding to the user access traffic is a blacklisted IP address based on the blacklist file of the honey court, obtain a judgment result, and then forward the user access traffic to the account honey point according to the judgment result, or, based on the judgment result, perform a login operation detection on the user access traffic to obtain the user login request corresponding to the user access traffic;

[0123] The content detection module is used to determine whether the user login request contains a honeypot account through the account detection module, obtain the account detection result, and then forward the corresponding user login request to the real business server or account honeypot according to the account detection result;

[0124] The user login request includes an encrypted user login request and a non-encrypted user login request.

[0125] The contents of the above-mentioned embodiment of the account honey spot drainage method based on Mi Ting agent are all applicable to the embodiment of the account honey spot drainage system based on Mi Ting agent. The functions specifically implemented by the embodiment of the account honey spot drainage system based on Mi Ting agent are the same as those of the above-mentioned embodiment of the account honey spot drainage method based on Mi Ting agent, and the beneficial effects achieved are also the same as those achieved by the above-mentioned embodiment of the account honey spot drainage method based on Mi Ting agent.

[0126] An embodiment of the present invention further provides an electronic device comprising: a memory, a processor, a program stored in the memory and executable on the processor, and a data bus for enabling communication between the processor and the memory. When the program is executed by the processor, the aforementioned method for diverting traffic to a honeypot account based on a MiTing agent is implemented. The electronic device can be any intelligent terminal, including a tablet computer and an in-vehicle computer.

[0127] like Figure 5 FIG2 is a schematic diagram of the hardware structure of the electronic device provided by the embodiment of the present invention, referring to FIG2 Figure 5 , an embodiment of the present invention provides an electronic device, including:

[0128] The processor 1001 may be implemented as a general-purpose CPU (Central Processing Unit), a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits, and is configured to execute relevant programs to implement the technical solutions provided by the embodiments of the present invention.

[0129] The memory 1002 can be implemented in the form of a read-only memory (ROM), a static storage device, a dynamic storage device, or a random access memory (RAM). The memory 1002 can store an operating system and other application programs. When the technical solutions provided in the embodiments of this specification are implemented through software or firmware, the relevant program codes are stored in the memory 1002, and the processor 1001 calls and executes the account honeypot drainage method based on the honey court agent according to the embodiment of the present invention.

[0130] Input / output interface 1003, used to implement information input and output;

[0131] Communication interface 1004, used to implement communication interaction between this device and other devices, which can be achieved through wired means (such as USB, network cable, etc.) or wireless means (such as mobile network, WiFi, Bluetooth, etc.);

[0132] Bus 1005 , which transmits information between various components of the device (e.g., processor 1001 , memory 1002 , input / output interface 1003 , and communication interface 1004 );

[0133] The processor 1001 , the memory 1002 , the input / output interface 1003 and the communication interface 1004 are connected to each other in communication within the device via the bus 1005 .

[0134] An embodiment of the present invention also provides a storage medium, which is a computer-readable storage medium used for computer-readable storage. The storage medium stores one or more programs, and the one or more programs can be executed by one or more processors to implement the above-mentioned account honey point drainage method based on the MiTing agent.

[0135] The memory, as a non-transient computer-readable storage medium, can be used to store non-transient software programs and non-transient computer executable programs. In addition, the memory may include a high-speed random access memory and may also include a non-transient memory, such as at least one disk storage device, a flash memory device, or other non-transient solid-state storage device. In some embodiments, the memory may optionally include a memory remotely arranged relative to the processor, and these remote memories may be connected to the processor via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0136] The embodiment of the present invention also discloses a computer program product or computer program, which includes computer instructions stored in a computer-readable storage medium. A processor of a computer device can read the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, so that the computer device performs Figure 1 The method shown.

[0137] In some optional embodiments, the function / operation mentioned in the block diagram may not occur in the order mentioned in the operation diagram. For example, depending on the function / operation involved, the two boxes shown in succession can actually be executed substantially simultaneously or the above-mentioned boxes can sometimes be executed in reverse order. In addition, the embodiment presented and described in the flow chart of the present invention is provided in an exemplary manner for the purpose of providing a more comprehensive understanding of the technology. The disclosed method is not limited to the operation and logic flow presented herein. Optional embodiments are contemplated in which the order of the various operations is changed and the sub-operations described as a part of a larger operation are performed independently.

[0138] In addition, although the present invention is described in the context of functional modules, it should be understood that, unless otherwise stated, one or more of the above-mentioned functions and / or features can be integrated into a single physical device and / or software module, or one or more functions and / or features can be implemented in separate physical devices or software modules. It is also understood that a detailed discussion of the actual implementation of each module is not necessary for understanding the present invention. More specifically, given the properties, functions, and internal relationships of the various functional modules in the devices disclosed herein, the actual implementation of the module will be understood within the routine skills of an engineer. Therefore, a person skilled in the art can implement the present invention set forth in the claims using ordinary skills without undue experimentation. It is also understood that the specific concepts disclosed are merely illustrative and are not intended to limit the scope of the present invention, which is determined by the full scope of the appended claims and their equivalents.

[0139] If the above functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes several instructions for enabling a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the steps of the above methods of each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, and other media that can store program code.

[0140] The logic and / or steps represented in the flowcharts or otherwise described herein, for example, can be considered as an ordered list of executable instructions for implementing the logical functions, and can be embodied in any computer-readable medium for use by, or in conjunction with, an instruction execution system, apparatus, or device (e.g., a computer-based system, a system including a processor, or other system that can fetch and execute instructions from an instruction execution system, apparatus, or device). For purposes of this specification, a "computer-readable medium" can be any device that can contain, store, communicate, propagate, or transport a program for use by, or in conjunction with, an instruction execution system, apparatus, or device.

[0141] More specific examples (a non-exhaustive list) of computer-readable media include the following: an electrical connection with one or more wires (electronic devices), a portable computer disk cartridge (magnetic devices), a random access memory (RAM), a read-only memory (ROM), an erasable and programmable read-only memory (EPROM or flash memory), a fiber optic device, and a portable compact disc read-only memory (CDROM). In addition, the computer-readable medium may even be paper or other suitable media on which the program is printed, since the program may be obtained electronically, for example, by optically scanning the paper or other media, followed by editing, deciphering, or processing in another suitable manner as necessary, and then stored in a computer memory.

[0142] It should be understood that various parts of the present invention can be implemented using hardware, software, firmware, or a combination thereof. In the above-described embodiments, multiple steps or methods can be implemented using software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented using hardware, as in another embodiment, any one of the following technologies known in the art or a combination thereof can be used: a discrete logic circuit having a logic gate circuit for implementing a logic function on a data signal, an application-specific integrated circuit having a suitable combination of logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc.

[0143] In the above description of this specification, reference to the terms "one embodiment / example," "another embodiment / example," or "certain embodiments / examples" means that the specific features, structures, materials, or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present invention. In this specification, the schematic representation of the above terms does not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in any one or more embodiments or examples.

[0144] While embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions, and variations may be made to the embodiments without departing from the principles and spirit of the invention, and that the scope of the invention is defined by the claims and their equivalents.

[0145] The above is a specific description of the preferred implementation of the present invention, but the present invention is not limited to the embodiments. Those skilled in the art can make various equivalent modifications or substitutions without violating the spirit of the present invention. These equivalent modifications or substitutions are all included in the scope defined by the claims of this application.

Claims

1. A method for attracting traffic from honeypots based on MiTing agent, characterized in that: The following steps are involved: Modify the configuration file in Nginx, wherein the pre-obtained blacklist file is imported by modifying the global block in the configuration file, and the account detection module is introduced by modifying the location block in the configuration file; Receive user access traffic, determine whether the user IP address corresponding to the user access traffic is a blacklisted IP address based on the blacklist file by MiTing, obtain a judgment result, and then forward the user access traffic to the account honeypoint according to the judgment result, or perform a login operation detection on the user access traffic according to the judgment result to obtain a user login request corresponding to the user access traffic; Determining whether the user login request contains a honeypot account by the account detection module, obtaining an account detection result, and then forwarding the corresponding user login request to the real business server or the account honeypot according to the account detection result; The user login request includes an encrypted user login request and a non-encrypted user login request.

2. The method for diverting traffic to an account honeypot based on the MiTing agent according to claim 1 is characterized in that: The step of modifying the configuration file in Nginx specifically includes: Create a variable based on the user IP address by modifying the http block in the configuration file; Define the listening port and server domain name by modifying the server block in the configuration file.

3. The method for diverting traffic to an account honeypot based on a MiTing agent according to claim 1, characterized in that: The step of importing the pre-acquired blacklist file by modifying the global block in the configuration file specifically includes: Get the blacklist file from the Modsecurity plugin; Import the blacklist file by modifying the include directive in the global block; The blacklist file includes a plurality of blacklist IP addresses.

4. The method for attracting traffic to an account honeypot based on a MiTing agent according to claim 2, characterized in that: The judgment result includes a first judgment result and a second judgment result. The step of receiving user access traffic and determining whether the user IP address corresponding to the user access traffic is a blacklisted IP address based on the blacklist file of MiTing to obtain the judgment result specifically includes: Receiving the user access traffic in the monitoring port; Determine whether the user IP address is a blacklisted IP address through the Modsecurity plug-in; When the user IP address is the blacklist IP address, mapping the variable corresponding to the user IP address to a first preset number to obtain the first judgment result; When the user IP address is not the blacklist IP address, the variable corresponding to the user IP address is mapped to a second preset number to obtain the second judgment result.

5. The method for attracting traffic to an account honeypot based on a MiTing agent according to claim 4 is characterized in that: The step of forwarding the user access traffic to an account honeypot according to the judgment result, or performing a login operation detection on the user access traffic to obtain a user login request according to the judgment result, specifically includes: forwarding the user access traffic corresponding to the first preset number to the account sweet spot according to the first judgment result; Performing a login operation detection on the user access traffic corresponding to the second preset number according to the second judgment result; When the user access traffic does not perform a login operation, forwarding the user access traffic to the real business server; When the user accesses the traffic to perform a login operation, the user login request is obtained.

6. The method for attracting traffic to an account honeypot based on a MiTing agent according to claim 1, characterized in that: The step of determining whether the user login request includes a honeypot account by the account detection module and obtaining an account detection result specifically includes: Obtaining encrypted matching files and non-encrypted matching files through the account honeypoint; Determine, by the account detection module, whether the user login request is the encrypted user login request or the non-encrypted user login request: When the user login request is the encrypted user login request, determining whether the encrypted user login request includes the encrypted matching file; If the encrypted user login request includes the encrypted matching file, a first account detection result is obtained; if the encrypted user login request does not include the encrypted matching file, a second account detection result is obtained; When the user login request is the non-encrypted user login request, determining whether the non-encrypted user login request includes the non-encrypted matching file; If the non-encrypted user login request includes the non-encrypted matching file, a third account detection result is obtained; if the non-encrypted user login request does not include the non-encrypted matching file, a fourth account detection result is obtained.

7. The method for attracting traffic to an account honeypot based on a MiTing agent according to claim 6, characterized in that: The step of forwarding the corresponding user login request to the real business server or the account honeypot according to the account detection result specifically includes: adding the user IP address corresponding to the encrypted user login request to the blacklist file according to the first account detection result, and forwarding the corresponding encrypted user login request to the account honeypot; forwarding the corresponding encrypted user login request to the real business server according to the second account detection result; adding the user IP address corresponding to the non-encrypted user login request to the blacklist file according to the third account detection result, and forwarding the corresponding non-encrypted user login request to the account honeypot; The corresponding non-encrypted user login request is forwarded to the real business server according to the fourth account detection result.

8. An account honeypot drainage system based on MiTing agent, characterized in that: include: A configuration modification module is used to modify a configuration file in Nginx, wherein a pre-obtained blacklist file is imported by modifying a global block in the configuration file, and an account detection module is introduced by modifying a location block in the configuration file; An IP address judgment module is used to receive user access traffic, determine whether the user IP address corresponding to the user access traffic is a blacklisted IP address based on the blacklist file of the honey court, obtain a judgment result, and then forward the user access traffic to the account honey point according to the judgment result, or perform a login operation detection on the user access traffic according to the judgment result to obtain a user login request corresponding to the user access traffic; a content detection module, configured to determine whether the user login request contains a honeypot account through the account detection module, obtain an account detection result, and then forward the corresponding user login request to the real business server or the account honeypot according to the account detection result; The user login request includes an encrypted user login request and a non-encrypted user login request.

9. An electronic device, characterized in that: The electronic device includes a memory, a processor, a program stored in the memory and executable on the processor, and a data bus for realizing connection and communication between the processor and the memory. When the program is executed by the processor, the steps of the account honey spot drainage method based on the Mi Ting agent are realized as described in any one of claims 1 to 7.

10. A storage medium, which is a computer-readable storage medium and is used for computer-readable storage, characterized in that: The storage medium stores one or more programs, and the one or more programs can be executed by one or more processors to implement the steps of the account honey spot drainage method based on the MiTing agent as described in any one of claims 1 to 7.

Images