Zero-day vulnerability attack capture method and electronic device based on honeypot

Abstract

The present disclosure provides a method and electronic device for capturing zero-day vulnerability attacks based on honeypots. The method includes dividing the attack process of an attacker in a target network into multiple attack stages. For each attack stage, a corresponding processing strategy is used to process the attack accordingly using a honeypot, so that the attack process enters the next attack stage to the final attack stage. In the final attack stage, the attacker's attack is analyzed to generate an attack response result. The present application adopts multiple strategies to capture and analyze unknown vulnerability attacks. The technical solution provided by the present application is deployed in the target network, which can effectively enhance the attack warning capability. The present application uses the high degree of interactive simulation of honeypots to obtain zero-day vulnerabilities.

Description

Technical Field

[0001] The present disclosure relates to the field of network security, and in particular to a zero-day vulnerability attack capture method based on a honeypot and an electronic device. Background Art

[0002] At present, the mainstream honeypot implementation technologies in the industry can be divided into two categories: pattern matching-based and virtual machine-based. Pattern matching-based honeypots analyze the attacker's input and respond to the attacker according to certain rules. The problem with this type of technology is that pattern matching cannot cover all scenarios. For example, when the Mirai botnet broke out in 2016, almost no honeypots could capture its samples because Mirai's scanner would execute the cat / bin / echo command before infection, and the honeypots at that time did not process this command when implementing pattern matching. Virtual machine-based honeypots redirect the attacker's input to the virtual machine, and then redirect the virtual machine's output to the attacker. The honeypot acts as an intermediate layer to record and analyze the attacker's information and behavior.

[0003] However, both types of honeypots cannot capture 0day vulnerability attacks. For honeypots based on pattern matching, honeypot developers cannot know the technical details of the 0day vulnerability exploited by attackers, and cannot correctly implement pattern matching and response; for honeypots based on virtual machines, honeypot developers do not know the target environment of the 0day vulnerability exploited by attackers, and cannot correctly configure the virtual machine environment. In general, capturing attacks based on 0day vulnerabilities in the real world is still a problem that needs to be solved urgently. Summary of the invention

[0004] The present disclosure provides a zero-day vulnerability attack capture method and electronic device based on a honeypot, so as to at least solve the above technical problems existing in the prior art.

[0005] According to a first aspect of the present disclosure, a method for capturing zero-day vulnerability attacks based on a honeypot is provided, the method comprising:

[0006] Divide the attacker's attack process in the target network into multiple attack stages;

[0007] For each attack stage, the honeypot is used to adopt the corresponding processing strategy to deal with the attack accordingly, so that the attack process enters the next attack stage to the final attack stage;

[0008] In the final attack phase, the attacker's attack is analyzed to generate attack response results.

[0009] In one possible implementation manner, the attack process of the attacker in the target network is divided into multiple attack stages, including:

[0010] Obtain the attacker's complete attack process in advance, and record and analyze the target information in the attack process;

[0011] The complete attack process is divided into three attack stages according to the target information; wherein the three attack stages include a first stage, a second stage and a third stage.

[0012] In one possible implementation, for each attack stage, using a honeypot to adopt a corresponding processing strategy to process the attack accordingly, so that the attack process enters the next attack stage to the final attack stage, including:

[0013] In the first stage, the response is output according to the attacker's attack requirements, and it is determined whether it passes the attacker's environment check. If it passes, it enters the second stage;

[0014] In the second stage, the attacker's attack payload is analyzed and the analysis results are obtained.

[0015] In one possible implementation manner, outputting a target response according to the attacker's attack requirements includes:

[0016] Determine the protocol type to which the attack requirement initiated by the attacker belongs, extract the corresponding field features, search for the target response corresponding to the field features in the rule base and output it;

[0017] Inputting the attack requirements initiated by the attacker into the large model, and the large model outputs a response based on a preset prompt word;

[0018] The scanner is used to obtain responses according to the attack requirements initiated by the attacker, and the heuristic method is used to analyze whether the target keywords exist in the responses, and the responses with the target keywords are output.

[0019] In one possible implementation, it is determined whether the attacker's environment check is passed. If passed, the second stage is entered, including:

[0020] Determine whether the attack requirements launched by the attacker contain sensitive keywords. If so, enter the second stage;

[0021] After the rule base, large model or heuristic strategy interacts with the attacker a preset number of times, the second stage begins.

[0022] In one possible implementation manner, analyzing the attacker's attack payload to obtain the analysis result includes:

[0023] Determine the attacker's attack payload's behavioral intent and corresponding additional information.

[0024] In one possible implementation manner, the determining of the attacker's behavioral intention of the attack payload and the corresponding additional information includes:

[0025] Inputting the attacker's attack payload into the large model, and using the large model to determine the attacker's attack payload's behavior intention and corresponding additional information;

[0026] If the large model analysis fails, a heuristic strategy is used to determine whether there is a legitimate file path in the attack payload. If so, it is considered that the behavior is intended to read sensitive files, and the file path to be read is analyzed; or

[0027] A heuristic strategy is used to use preset symbols as separators to determine whether a target command exists. If so, it is considered that the behavior intention is remote command execution, and the executed command is analyzed.

[0028] In one possible implementation manner, the analyzing the attacker's attack to generate an attack response result includes:

[0029] Read the corresponding file or execute the corresponding command in the virtual machine. If successful, the output is fed back to the attacker as a response result.

[0030] If it fails, the attack payload is input into the large model, and the large model generates a corresponding response result which is fed back to the attacker.

[0031] In one possible implementation, the complete attack process of the attacker is obtained in advance, including:

[0032] Use rule bases, heuristics or virtual machines to interact with attackers throughout the entire attack process, and record and analyze important information in the attack process.

[0033] According to a second aspect of the present disclosure, a zero-day vulnerability attack capture device based on a honeypot is provided, the device comprising:

[0034] A division module is used to divide the attack process of the attacker in the target network into multiple attack stages;

[0035] The processing module is used to process the attack in each attack stage using the honeypot and adopting the corresponding processing strategy, so that the attack process enters the next attack stage to the final attack stage;

[0036] The generation module is used to analyze the attacker's attack and generate attack response results in the final attack stage.

[0037] According to a third aspect of the present disclosure, there is provided an electronic device, including:

[0038] at least one processor; and

[0039] a memory communicatively connected to the at least one processor; wherein,

[0040] The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the method described in the present disclosure.

[0041] According to a fourth aspect of the present disclosure, a non-transitory computer-readable storage medium storing computer instructions is provided, wherein the computer instructions are used to cause the computer to execute the method described in the present disclosure.

[0042] The disclosed honeypot-based zero-day vulnerability attack capture method and electronic device divides the attack process into multiple stages, designs a corresponding response strategy for each stage, and processes the tasks of each attack stage by compositely using large models, rule bases, heuristics and other methods. Compared with existing honeypots based on pattern matching or virtual machines, the honeypot of the present invention has a higher degree of interactive simulation and can capture zero-day vulnerabilities.

[0043] It should be understood that the content described in this section is not intended to identify the key or important features of the embodiments of the present disclosure, nor is it intended to limit the scope of the present disclosure. Other features of the present disclosure will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] The above and other objects, features and advantages of the exemplary embodiments of the present disclosure will become readily understood by reading the detailed description below with reference to the accompanying drawings. In the accompanying drawings, several embodiments of the present disclosure are shown in an exemplary and non-limiting manner, in which:

[0045] In the drawings, the same or corresponding reference numerals represent the same or corresponding parts.

[0046] Figure 1 The following is a schematic diagram showing the implementation process of the zero-day vulnerability attack capture method based on honeypot in the embodiment of the present disclosure. Figure 1 ;

[0047] Figure 2 The following is a schematic diagram showing the implementation process of the zero-day vulnerability attack capture method based on honeypot in the embodiment of the present disclosure. Figure 2 ;

[0048] Figure 3 A schematic diagram of the structure of a zero-day vulnerability attack capture device based on a honeypot according to an embodiment of the present disclosure is shown;

[0049] Figure 4 A schematic diagram of the structure of an electronic device according to an embodiment of the present disclosure is shown. DETAILED DESCRIPTION

[0050] In order to make the purpose, features, and advantages of the present disclosure more obvious and easy to understand, the technical solutions in the embodiments of the present disclosure will be clearly and completely described below in conjunction with the drawings in the embodiments of the present disclosure. Obviously, the described embodiments are only part of the embodiments of the present disclosure, not all of the embodiments. Based on the embodiments in the present disclosure, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present disclosure.

[0051] Honeypots have a wide range of application scenarios in the field of network security, such as deploying honeypots in intranets to attract attackers to invade and issue timely alarms, and deploying honeypots on the Internet to monitor the spread of malware. The core of honeypots is to simulate systems or components with vulnerabilities, which makes them naturally unable to deal with unknown vulnerability attacks, because in order to simulate, you must first know the relevant information of the vulnerability, including the exploitation method, the target environment, etc. For unknown vulnerabilities, this information is unknown, so using honeypots to capture attacks launched using 0day vulnerabilities is a challenging problem. In the real world, many attacks are launched based on 0day vulnerabilities. Before launching the attack, no one except the attacker knows the information related to the vulnerability, so honeypots certainly do not have the ability to capture such attacks.

[0052] Honeypots use simulation and other means to disguise a vulnerable system, software, service, etc., to attract attackers to invade and record information. A zero-day vulnerability refers to the number of days between the discovery of a vulnerability and the first attack using it. When a zero-day vulnerability is used to launch an attack, no one except the attacker knows its related technical details, such as the method of use and the target.

[0053] The following describes the honeypot-based zero-day vulnerability attack capture method and electronic device provided by the present application in conjunction with the accompanying drawings.

[0054] like Figure 1 As shown, the present application provides a method for capturing zero-day vulnerability attacks based on a honeypot, comprising:

[0055] S101, dividing the attack process of the attacker in the target network into multiple attack stages;

[0056] It is understandable that the target network in this application can be an intranet or the Internet. The attacker has a certain attack process to attack the target network. In this application, the existing technology is first used to obtain a complete attack process of the attacker, and then a complete attack process is divided into multiple attack processes as needed.

[0057] S102, for each attack stage, using the honeypot to adopt a corresponding processing strategy to process the attack accordingly, so that the attack process enters the next attack stage to the final attack stage;

[0058] It is understandable that the present application utilizes a honeypot to ultimately generate an attack response result. Therefore, in the previous stage, it is necessary to make the attacker believe that the attack is correct to prevent the attack process from terminating, thereby allowing the attack process to enter the next attack stage, and thus enter the final attack stage.

[0059] S103, in the final attack stage, analyzing the attacker's attack to generate an attack response result.

[0060] After entering the final attack stage, the attacker's attack intention can be analyzed, and the attack response result can be generated according to the attacker's attack intention, deceiving the attacker into thinking that the attack was successfully executed.

[0061] The honeypot-based zero-day vulnerability attack capture method provided by this application conducts a complete attack process with the attacker, records and analyzes important information in the process, enters the final attack stage after each attack stage, generates output when the attack is successfully executed and sends it to the attacker, deceiving the attacker into thinking that the attack is successfully executed. It can not only effectively enhance the attack warning capability, but also use the high degree of honeypot interaction simulation to obtain zero-day vulnerabilities.

[0062] In some optional embodiments, the attack process of the attacker in the target network is divided into multiple attack stages, including:

[0063] Obtain the attacker's complete attack process in advance, and record and analyze the target information in the attack process;

[0064] The complete attack process is divided into three attack stages according to the target information; wherein the three attack stages include a first stage, a second stage and a third stage.

[0065] In some optional embodiments, the complete attack process of the attacker is obtained in advance, including:

[0066] Use rule bases, heuristics or virtual machines to interact with attackers throughout the entire attack process, and record and analyze important information in the attack process.

[0067] As a preferred implementation, the present application uses a large model as the core, and cooperates with the rule base, heuristics, virtual machines and other methods to conduct a complete attack process with the attacker, and records and analyzes important information in the process, such as the payload used by the attacker. A complete attack process can be divided into three stages: front, middle and back, that is, the first, second and third stages. The large model provided in this application is an artificial intelligence model with a large number of parameters. They can perform complex tasks such as text generation, image recognition, etc. by training on large-scale data sets, showing excellent performance and strong generalization ability.

[0068] In some optional embodiments, for each attack stage, using a honeypot to adopt a corresponding processing strategy to process the attack accordingly, so that the attack process enters the next attack stage to the final attack stage, including:

[0069] In the first stage, the response is output according to the attacker's attack requirements, and it is determined whether it passes the attacker's environment check. If it passes, it enters the second stage;

[0070] In the second stage, the attacker's attack payload is analyzed and the analysis results are obtained.

[0071] Specifically, in the first stage of this application, the attacker will check the target environment to see if it meets the preconditions for exploiting the vulnerability. If the first stage cannot be passed, the attack process will be terminated. Therefore, this application uses a combination of rule bases, large models, heuristic strategies and other methods to try to interact correctly with the attacker. At the same time, this application will periodically record scenarios where the interaction fails and submit them to security experts for analysis.

[0072] If the environment check is passed and the second stage is entered, the attacker will exploit the vulnerability to launch an attack. This application honeypot will record the attacker's attack payload and try to use large models and heuristic rules to analyze the intent of the payload, such as command execution, file reading, etc.

[0073] If the intent of the payload is successfully analyzed and the subsequent stage is entered, the present invention will disguise a suitable response based on the intent of the payload to deceive the attacker into thinking that the attack is successfully executed.

[0074] In some optional embodiments, outputting a target response according to the attacker's attack requirements includes:

[0075] Determine the protocol type to which the attack requirement initiated by the attacker belongs, extract the corresponding field features, search for the target response corresponding to the field features in the rule base and output it;

[0076] Inputting the attack requirements initiated by the attacker into the large model, and the large model outputs a response based on a preset prompt word;

[0077] The scanner is used to obtain responses according to the attack requirements initiated by the attacker, and the heuristic method is used to analyze whether the target keywords exist in the responses, and the responses with the target keywords are output.

[0078] Specifically, in the first stage, it is necessary to pass the attacker's environment check. There are two requirements for this stage: first, output a suitable response according to the attacker's request; second, determine whether it has passed the attacker's environment check and whether it can enter the second stage. This is to enable the attacker to successfully attack the network.

[0079] For the first requirement, there are three types of methods for processing responses. This application uses these three methods to process responses in turn:

[0080] 1) Rule base: According to the protocol type of the request initiated by the attacker, the corresponding fields are extracted as features, and the corresponding response is searched and output in the rule base. For example, for HTTP response, the Path, Body, Cookie, UA and other fields are extracted as features;

[0081] 2) Large model: Input the attacker’s request into the large model and set appropriate prompt words, and the large model will give an appropriate response;

[0082] 3) Heuristic: The environment check logic of some scanners is to initiate a request to obtain a response, and check whether there are specific keywords in the response. Therefore, if the rule base and the large model method fail, a response containing many keywords can be replied, such as "HTTP 200OK", "Success", etc.

[0083] In some optional embodiments, it is determined whether the attacker's environment check is passed. If passed, the second stage is entered, including:

[0084] Determine whether the attack requirements launched by the attacker contain sensitive keywords. If so, enter the second stage;

[0085] After the rule base, large model or heuristic strategy interacts with the attacker a preset number of times, the second stage begins.

[0086] For the second requirement, this application uses two strategies to determine whether to enter the second stage. The following are the two strategies:

[0087] 1) If a request contains sensitive keywords such as wget, curl, / etc / passwd, it is considered to have entered the second stage and the attacker has begun to exploit the vulnerability; among them, wget and curl are Linux environment commands used to download remote files to the local.

[0088] 2) If there are three consecutive interactions in the early stage, the second stage is forced to start. For strategy 1), the appearance of wget and curl keywords generally indicates remote command execution, and the appearance of / etc / passwd keywords generally indicates sensitive information reading. When these keywords appear, it can be considered that the system has entered the second stage. Strategy 2) can prevent the system from being in the second stage all the time.

[0089] At the same time, the present invention will record the requests for failed interactions, and use fuzzy hashing technology combined with K-Means clustering algorithm for clustering, and periodically output them to security experts for manual analysis.

[0090] In some optional embodiments, analyzing the attacker's attack payload to obtain the analysis result includes:

[0091] Determine the attacker's attack payload's behavioral intent and corresponding additional information.

[0092] In some optional embodiments, the determining of the behavioral intention of the attacker's attack payload and the corresponding additional information includes:

[0093] Inputting the attacker's attack payload into the large model, and using the large model to determine the attacker's attack payload's behavior intention and corresponding additional information;

[0094] If the large model analysis fails, a heuristic strategy is used to determine whether there is a legitimate file path in the attack payload. If so, it is considered that the behavior is intended to read sensitive files, and the file path to be read is analyzed; or

[0095] A heuristic strategy is used to use preset symbols as separators to determine whether a target command exists. If so, it is considered that the behavior intention is remote command execution, and the executed command is analyzed.

[0096] Specifically, in the second stage of the present application, the attacker's payload needs to be parsed. This stage needs to analyze the behavioral intention of the payload, so that in the third stage, a suitable response needs to be generated based on the analysis results to deceive the attacker.

[0097] This application divides the attacker's payload behavior intention into two categories: remote command execution and reading sensitive files. In the second stage, the payload behavior intention and corresponding additional information need to be analyzed. For example, for remote command execution, the executed command needs to be analyzed, and for reading sensitive files, the file path needs to be analyzed.

[0098] Specifically, in this application, we first try to input the attacker's payload into the big model, and the big model analyzes the behavioral intent and the corresponding additional information. If the big model cannot handle it correctly, it will be handled by the heuristic method. The heuristic method first tries to extract all legal file paths that appear in the payload. If they exist, it is considered that the behavioral intent is to read sensitive files. Then, symbols such as &&||; are used as separators to extract all possible Linux commands. If they exist, it is considered that the behavioral intent is remote command execution. If the heuristic method extracts both the file path and the Linux command, it is considered that the behavioral intent is remote command execution.

[0099] In some optional embodiments, the step of analyzing the attacker's attack to generate an attack response result includes:

[0100] Read the corresponding file or execute the corresponding command in the virtual machine. If successful, the output is fed back to the attacker as a response result.

[0101] If it fails, the attack payload is input into the large model, and the large model generates a corresponding response result which is fed back to the attacker.

[0102] Specifically, a virtual machine is a system with physical computer functions that is simulated by software in a computer. It can run multiple isolated operating system instances on the host operating system at the same time. In the third stage of this application, it is necessary to generate a suitable response based on the analysis of the attacker's payload to deceive the attacker into thinking that the attack is successful. The present invention uses two methods, virtual machines and large models, to handle this task. First, try to read the corresponding file or execute the corresponding command in the virtual machine. If successful, the output is returned to the attacker as a response. If it fails, the payload is input into the large model, and the large model generates a suitable response.

[0103] This application divides the attacker's behavior into three stages: 1) In the first stage, check the target environment to see if it matches the preconditions for exploiting the vulnerability; 2) In the second stage, the attacker sends a payload to execute the attack; 3) In the third stage, the attacker waits for the attack to be successfully executed. In the early stage, the honeypot system first extracts the features of the request sent by the attacker and extracts the appropriate response from the rule base. If it does not exist in the rule base, the large model is tried to analyze the attacker's request intent and give an appropriate response. If the large model cannot give an appropriate response, the default response is output for each protocol type of the request; in the mid-term stage, the honeypot system analyzes the attacker's payload and extracts the attacker's behavior. For known vulnerabilities, specific analysis rules can be written. For 0day vulnerabilities, only heuristic strategies and large models can be used for analysis and extraction; in the later stage, the honeypot system generates the output of the successful execution of the payload based on the payload's intent and sends it to the attacker, deceiving the attacker into thinking that the attack has been successfully executed.

[0104] like Figure 3 As shown, the embodiment of the present application provides a zero-day vulnerability attack capture device based on a honeypot, and the device includes:

[0105] A division module 301 is used to divide the attack process of the attacker in the target network into multiple attack stages;

[0106] Processing module 302, for processing the attack in each attack stage using a honeypot and a corresponding processing strategy, so that the attack process enters the next attack stage to the final attack stage;

[0107] The generation module 303 is used to analyze the attacker's attack and generate an attack response result in the final attack stage.

[0108] In some optional embodiments, the division module 301 includes:

[0109] An acquisition unit, used to acquire the complete attack process of the attacker in advance, and record and analyze the target information in the attack process;

[0110] A division unit is used to divide the complete attack process into three attack stages according to the target information; wherein the three attack stages include a first stage, a second stage and a third stage.

[0111] In some optional embodiments, the processing module 302 includes:

[0112] The judgment unit is used to output a response according to the attacker's attack requirements in the first stage, and to judge whether the attacker's environment check is passed. If it is passed, it will enter the second stage;

[0113] The first analysis unit is used to analyze the attacker's attack payload in the second stage to obtain an analysis result.

[0114] In some optional embodiments, the judging unit includes:

[0115] A determination unit, used to determine the protocol type to which the attack requirement initiated by the attacker belongs, extract the corresponding field features, search for the target response corresponding to the field features in the rule base and output it;

[0116] A first output unit, used to input the attack demand initiated by the attacker into the large model, and the large model outputs a response based on a preset prompt word;

[0117] The second analysis unit is used to use the scanner to obtain a response according to the attack requirements initiated by the attacker, use heuristic analysis to determine whether the target keyword exists in the response, and output a response with the target keyword.

[0118] In some optional embodiments, the judging unit includes:

[0119] The judgment subunit is used to judge whether the attack requirements initiated by the attacker contain sensitive keywords. If so, it enters the second stage;

[0120] The interaction subunit is used to enter the second stage after the rule base, large model or heuristic strategy interacts with the attacker for a preset number of times.

[0121] In some optional embodiments, the first analysis unit includes:

[0122] The determination subunit is used to determine the behavioral intention of the attacker's attack payload and the corresponding additional information.

[0123] In some optional embodiments, the determining subunit includes:

[0124] Inputting the attacker's attack payload into the large model, and using the large model to determine the attacker's attack payload's behavior intention and corresponding additional information;

[0125] If the large model analysis fails, a heuristic strategy is used to determine whether there is a legitimate file path in the attack payload. If so, it is considered that the behavior is intended to read sensitive files, and the file path to be read is analyzed; or

[0126] A heuristic strategy is used to use preset symbols as separators to determine whether a target command exists. If so, it is considered that the behavior intention is remote command execution, and the executed command is analyzed.

[0127] In some optional embodiments, the step of analyzing the attacker's attack to generate an attack response result includes:

[0128] Read the corresponding file or execute the corresponding command in the virtual machine. If successful, the output is fed back to the attacker as a response result.

[0129] If it fails, the attack payload is input into the large model, and the large model generates a corresponding response result which is fed back to the attacker.

[0130] In some optional embodiments, the acquisition unit includes:

[0131] Use rule bases, heuristics or virtual machines to interact with attackers throughout the entire attack process, and record and analyze important information in the attack process.

[0132] According to an embodiment of the present disclosure, the present disclosure also provides an electronic device and a readable storage medium.

[0133] Figure 4 A schematic block diagram of an example electronic device 400 that can be used to implement an embodiment of the present disclosure is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present disclosure described and / or required herein.

[0134] like Figure 4As shown, the device 400 includes a computing unit 401, which can perform various appropriate actions and processes according to a computer program stored in a read-only memory (ROM) 402 or a computer program loaded from a storage unit 408 into a random access memory (RAM) 403. In the RAM 403, various programs and data required for the operation of the device 400 can also be stored. The computing unit 401, the ROM 402, and the RAM 403 are connected to each other via a bus 404. An input / output (I / O) interface 405 is also connected to the bus 404.

[0135] A number of components in the device 400 are connected to the I / O interface 405, including: an input unit 406, such as a keyboard, a mouse, etc.; an output unit 407, such as various types of displays, speakers, etc.; a storage unit 408, such as a disk, an optical disk, etc.; and a communication unit 409, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 409 allows the device 400 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0136] The computing unit 401 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the computing unit 401 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various dedicated artificial intelligence (AI) computing chips, various computing units running machine learning model algorithms, digital signal processors (DSPs), and any appropriate processors, controllers, microcontrollers, etc. The computing unit 401 performs the various methods and processes described above, such as a zero-day vulnerability attack capture method based on a honeypot. For example, in some embodiments, a zero-day vulnerability attack capture method based on a honeypot may be implemented as a computer software program, which is tangibly contained in a machine-readable medium, such as a storage unit 408. In some embodiments, part or all of the computer program may be loaded and / or installed on the device 400 via the ROM 402 and / or the communication unit 409. When the computer program is loaded into the RAM 403 and executed by the computing unit 401, one or more steps of the zero-day vulnerability attack capture method based on the honeypot described above may be performed. Alternatively, in other embodiments, the computing unit 401 may be configured to execute the honeypot-based zero-day vulnerability attack capturing method in any other appropriate manner (for example, by means of firmware).

[0137] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), complex programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0138] The program code for implementing the method of the present disclosure may be written in any combination of one or more programming languages. These program codes may be provided to a processor or controller of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that the program code, when executed by the processor or controller, enables the functions / operations specified in the flow chart and / or block diagram to be implemented. The program code may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0139] In the context of the present disclosure, a machine-readable medium may be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, device, or equipment. A machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or equipment, or any suitable combination of the foregoing. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0140] To provide interaction with a user, the systems and techniques described herein can be implemented on a computer having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user can provide input to the computer. Other types of devices can also be used to provide interaction with the user; for example, the feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including acoustic input, voice input, or tactile input).

[0141] The systems and techniques described herein may be implemented in a computing system that includes back-end components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes front-end components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such back-end components, middleware components, or front-end components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), and the Internet.

[0142] A computer system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The relationship of client and server is generated by computer programs running on respective computers and having a client-server relationship with each other. The server may be a cloud server, a server of a distributed system, or a server combined with a blockchain.

[0143] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps recorded in this disclosure can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solutions disclosed in this disclosure can be achieved, and this document does not limit this.

[0144] In addition, the terms "first" and "second" are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include at least one of the features. In the description of the present disclosure, the meaning of "plurality" is two or more, unless otherwise clearly and specifically defined.

[0145] The above is only a specific embodiment of the present disclosure, but the protection scope of the present disclosure is not limited thereto. Any person skilled in the art who is familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed in the present disclosure, which should be included in the protection scope of the present disclosure. Therefore, the protection scope of the present disclosure should be based on the protection scope of the claims.

Claims

1. A zero-day vulnerability attack capture method based on honeypot, characterized in that: The method comprises: Divide the attacker's attack process in the target network into multiple attack stages; For each attack stage, the honeypot is used to adopt the corresponding processing strategy to deal with the attack accordingly, so that the attack process enters the next attack stage to the final attack stage; In the final attack phase, the attacker’s attack is analyzed to generate attack response results; The attack process of the attacker in the target network is divided into multiple attack stages, including: Obtain the attacker's complete attack process in advance, and record and analyze the target information in the attack process; The complete attack process is divided into three attack stages according to the target information; wherein the three attack stages include the first stage, the second stage and the third stage; the first stage is used to check whether the target environment matches the preconditions for vulnerability exploitation; the second stage is used for the attacker to send a payload to execute the attack; the third stage is used for the attacker to wait for the attack to be successfully executed and analyze the attacker's attack to generate an attack response result; For each attack stage, the honeypot is used to adopt a corresponding processing strategy to process the attack accordingly, so that the attack process enters the next attack stage to the final attack stage, including: In the first stage, the response is output according to the attacker's attack requirements, and it is determined whether it passes the attacker's environment check. If it passes, it enters the second stage; In the second stage, the attacker's attack payload is analyzed to obtain the analysis results; The outputting of the response according to the attacker's attack requirements includes: Determine the protocol type to which the attack requirement initiated by the attacker belongs, extract the corresponding field features, search for the target response corresponding to the field features in the rule base and output it; Inputting the attack requirements initiated by the attacker into the large model, and the large model outputs a response based on a preset prompt word; The scanner is used to obtain responses according to the attack requirements initiated by the attacker, and the heuristic method is used to analyze whether the target keyword exists in the response, and the response with the target keyword is output; Determine whether the attacker's environment check has been passed. If passed, enter the second stage, including: Determine whether the attack requirements launched by the attacker contain sensitive keywords. If so, enter the second stage; After the rule base, large model or heuristic strategy interacts with the attacker a preset number of times, it enters the second stage; The analyzing the attacker's attack payload to obtain the analysis result includes: Determine the attacker's attack payload behavior and corresponding additional information; The determination of the attacker's attack payload behavior intention and corresponding additional information includes: Inputting the attacker's attack payload into the large model, and using the large model to determine the attacker's attack payload's behavior intention and corresponding additional information; If the large model analysis fails, a heuristic strategy is used to determine whether there is a legitimate file path in the attack payload. If so, it is considered that the behavior is intended to read sensitive files, and the file path to be read is analyzed; or A heuristic strategy is used to use a preset symbol as a separator to determine whether a target command exists. If so, it is considered that the behavior intention is a remote command execution, and the executed command is analyzed; In the third stage, the attack analysis of the attacker generates an attack response result, including: Read the corresponding file or execute the corresponding command in the virtual machine. If successful, the output is fed back to the attacker as a response result. If it fails, the attack payload is input into the large model, and the large model generates a corresponding response result which is fed back to the attacker.

2. The method according to claim 1, characterized in that Get the attacker's complete attack process in advance, including: Use rule bases, heuristics or virtual machines to interact with attackers in a complete attack process, and record and analyze target information in the attack process.

3. An electronic device, characterized in that: include: at least one processor; as well as a memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the method according to any one of claims 1 to 2.

Images