Honeypot trapping method and device, electronic equipment and storage medium

Abstract

The application provides a honeypot trapping method and device, electronic equipment and storage medium, and relates to the technical field of Internet security. The honeypot trapping method comprises the following steps: obtaining a network access request sent by an attacker to a server; generating, through a honeypot system, fake reply information corresponding to the network access request based on the request content contained in the network access request; returning the fake reply information to the attacker; executing a data loading instruction to trigger the database to record access record information of the attacker through the data loading instruction in the case where it is detected that the attacker successfully connects with the database of the server; and analyzing the attacker based on the access record information to obtain an analysis result corresponding to the attacker, so that automatic tracing is realized, the problem that a traditional honeypot in the prior art needs manual intervention to analyze data and trace attackers is solved, and the operation cost of the honeypot is reduced.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of Internet security, and particularly relates to a honeypot trapping method and device, electronic equipment and a storage medium. BACKGROUND

[0002] On the network, security threats and attack events are increasing, and hackers, malware and cyber criminals are constantly evolving and improving their attack skills, affecting network security. Taking Internet of Things devices as an example, with the explosive growth of Internet of Things applications, Internet of Things devices are directly exposed to the Internet and have become the focus of hacker attacks, and have caused a large number of security incidents.

[0003] Although traditional security measures such as firewalls and intrusion detection systems have a certain protective effect, they are still difficult to completely prevent advanced attacks. At present, active defense is mainly carried out through a honeypot system to prevent advanced network attacks. Specifically, the honeypot system, as an active defense means, lures attackers into a simulated environment to help network security researchers understand the behavior and strategy of the attackers, but this requires network security researchers to analyze data and trace the attackers by manually intervening through the honeypot system, which requires a large amount of manpower and time, and is easy to miss key information, affecting network security. SUMMARY

[0004] The purpose of the embodiments of the present application is to provide a honeypot trapping method, device, electronic equipment and storage medium to solve the problem that manual intervention is required to analyze data and trace attackers in the existing honeypot system. The specific technical solutions are as follows:

[0005] In a first aspect, the present application provides a honeypot trapping method, comprising:

[0006] Obtaining a network access request sent by an attacker to a server;

[0007] Based on the request content contained in the network access request, generating a disguised reply information corresponding to the network access request through a honeypot system;

[0008] Returning the disguised reply information to the attacker;

[0009] In the case where it is detected that the database connection of the attacker and the server is successful, executing a data loading instruction to trigger the database to record the access record information of the attacker through the data loading instruction;

[0010] Based on the access record information, analyzing the attacker to obtain an analysis result corresponding to the attacker.

[0011] In a possible implementation, the generating, by the honeypot system, of the disguised reply information corresponding to the network access request based on the request content contained in the network access request comprises:

[0012] The first prompt information is used to instruct a language model to generate text information corresponding to the request content.

[0013] The network access request and the first prompt information are input into the language model to obtain first reply content output by the language model.

[0014] The first reply content is encapsulated according to a protocol adopted by the network access request to obtain the disguised reply information.

[0015] In a possible implementation, the generating, by the honeypot system, of the disguised reply information corresponding to the network access request based on the request content contained in the network access request comprises:

[0016] The request content contained in the network access request is parsed by the honeypot system.

[0017] Second reply content matched with the request content is searched in a preset database according to the request content.

[0018] The second reply content is encapsulated according to a protocol adopted by the network access request to obtain the disguised reply information.

[0019] In a possible implementation, the executing, in a case where it is detected that the attacker successfully connects to the database of the server, of a data loading instruction to trigger the database to record access record information of the attacker by the data loading instruction comprises:

[0020] In a case where it is detected that the attacker successfully connects to the database, the server is controlled to send a data loading instruction to the attacker, and the data loading instruction is used to read network access record of the attacker.

[0021] The read network access record is stored into the database as the access record information.

[0022] In a possible implementation, the analyzing, based on the access record information, of the attacker to obtain an analysis result corresponding to the attacker comprises:

[0023] The access record information is preprocessed to obtain to-be-analyzed information corresponding to the attacker, and the to-be-analyzed information is to-be-analyzed data information.

[0024] characteristics information of the attacker, the access behavior characteristics information being information representing access attack behavior characteristics;

[0025] generating an attacker portrait corresponding to the attacker based on the access behavior characteristics information, and taking the attacker portrait as the analysis result.

[0026] In one possible implementation, the generating the attacker portrait corresponding to the attacker based on the access behavior characteristics information includes:

[0027] converting the access behavior characteristics information by using a preset language model to obtain a conversion result output by the language model, the conversion result containing language and character information for describing behavior and characteristics of the attacker;

[0028] performing portrait construction according to the language and character information to obtain a target portrait containing behavior and characteristics of the attacker, the characteristics of the attacker being characteristics of the attacker;

[0029] taking the target portrait as the attacker portrait.

[0030] In one possible implementation, after the analyzing the attacker based on the access record information to obtain the analysis result corresponding to the attacker, the method further includes:

[0031] obtaining a preset report generation format;

[0032] generating an analysis report corresponding to the analysis result according to the report generation format.

[0033] In a second aspect, the present application provides a honeypot trapping device, including:

[0034] a request acquisition module configured to acquire a network access request sent by an attacker to a server;

[0035] an information generation module configured to generate, by a honeypot system, fake reply information corresponding to the network access request based on request content contained in the network access request;

[0036] an information return module configured to return the fake reply information to the attacker;

[0037] a data loading instruction module configured to execute a data loading instruction to trigger a database to record access record information of the attacker by the data loading instruction, in a case where it is detected that the attacker successfully connects to the database of the server;

[0038] An attack analysis module is configured to analyze the attacker based on the access record information, and obtain an analysis result corresponding to the attacker.

[0039] In a third aspect, an electronic device is provided, which includes a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other through the communication bus; the memory is configured to store a computer program; and the processor is configured to execute the program stored in the memory to implement the honeypot trapping method according to any one of the first aspect.

[0040] In a fourth aspect, a computer readable storage medium is provided, which stores a computer program, and the computer program is executed by a processor to implement the honeypot trapping method according to any one of the first aspect.

[0041] In a fifth aspect, a computer program product including instructions is provided, which, when executed on a computer, causes the computer to perform the honeypot trapping method according to any one of the first aspect.

[0042] The embodiments of the present application provide a honeypot trapping method and device, an electronic device and a storage medium. The honeypot trapping method includes the following steps: obtaining a network access request sent by an attacker to a server; generating, by a honeypot system, fake reply information corresponding to the network access request based on request content contained in the network access request; returning the fake reply information to the attacker; and executing a data loading instruction to trigger a database of the server to record access record information of the attacker by the data loading instruction, when it is detected that the attacker successfully connects to the database of the server. The honeypot trapping method can analyze the attacker based on the access record information, realize automatic tracing, obtain an analysis result corresponding to the attacker, and effectively reduce the operation cost of the honeypot. BRIEF DESCRIPTION OF DRAWINGS

[0043] The accompanying drawings, which are incorporated herein and form a part of the specification, illustrate embodiments consistent with the present application and, together with the description, further serve to explain the principles of the application.

[0044] In order to more clearly illustrate the technical solutions of the embodiments of the present application or the prior art, the accompanying drawings needed to be used in the embodiments or prior art description will be briefly introduced as follows. Obviously, for those skilled in the art, other drawings can also be obtained based on these drawings without any creative work.

[0045] One or more embodiments are illustrated by way of example, in connection with the drawings presented is provided for the purpose of simplification and explanation and is not intended to limit the scope of the embodiments. Elements having the same reference numbers designate similar elements throughout the drawings, unless expressly stated otherwise. The drawings presented in the accompanying drawings are not intended to be to scale.

[0046] Figure 1 A flowchart of a honeypot trapping method provided by an embodiment of the present application;

[0047] Figure 2 A structural schematic diagram of a honeypot trapping device provided by an embodiment of the present application;

[0048] Figure 3 A structural schematic diagram of an electronic device provided by an embodiment of the present application. DETAILED DESCRIPTION

[0049] To make the objectives, technical solutions, and advantages of the embodiments of the present application clearer, the technical solutions in the embodiments of the present application will be described below in connection with the drawings in the embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, rather than all the embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by a person of ordinary skill in the art without creative work fall within the protection scope of the present application.

[0050] The following disclosure provides many different embodiments, or examples, for implementing different structures of the present application. For the purpose of simplification, the components and arrangements of specific examples are described in the following. Of course, they are only examples and are not intended to limit the present application. In addition, reference numbers and / or letters can be repeated in different examples. Such repetition is for the purpose of simplification and clarity, and does not indicate a relationship between the various embodiments and / or arrangements being discussed.

[0051] Figure 1 A flowchart of a honeypot trapping method provided by an embodiment of the present application. As shown in Figure 1 The honeypot trapping method provided by the embodiment of the present application can specifically include the following steps:

[0052] Step S101, obtaining a network access request sent by an attacker to the server;

[0053] The honeypot trapping method provided by the embodiment of the present application can be applied to a honeypot agent program, which is pre-arranged in the server and can obtain a network access request sent by an attacker to the server. The attacker is a client sending the network access request, for example, when the attacker wants to attack the MySQL server, the attacker is a MySQL client, which can attack the MySQL server by sending a large number of network access requests.

[0054] In an optional embodiment of the present application, the network access request sent by the attacker to the service end can be an access request generated by using a structured query language (SQL), so that the honeypot agent program can receive and respond to the network access request sent by the attacker to the service end according to the specification of the SQL protocol.

[0055] In step S102, the honeypot system generates the corresponding fake reply information of the network access request based on the request content contained in the network access request.

[0056] In step S103, the fake reply information is returned to the attacker.

[0057] The fake reply information refers to the reply information generated by the honeypot system. Specifically, after obtaining the network access request sent by the attacker to the service end, the honeypot system generates false information corresponding to the network access request as the fake reply information of the network access request, and sends it to the attacker. The attacker is replied by the fake reply information generated by the honeypot system, and does not need to respond to the attacker by using a real device, thereby ensuring information security.

[0058] In step S104, when it is detected that the attacker successfully connects to the database of the service end, a data loading instruction is executed to trigger the database to record the access record information of the attacker by using the data loading instruction.

[0059] In step S105, the attacker is analyzed based on the access record information, and an analysis result corresponding to the attacker is obtained.

[0060] In summary, the embodiments of the present application obtain the network access request sent by the attacker to the service end, generate the corresponding fake reply information of the network access request by the honeypot system based on the request content contained in the network access request, return the fake reply information to the attacker, and then execute the data loading instruction to trigger the database to record the access record information of the attacker when it is detected that the attacker successfully connects to the database of the service end. Thus, the attacker can be analyzed based on the access record information, automatic tracing is realized, an analysis result corresponding to the attacker is obtained, the problem that the traditional honeypot in the prior art needs manual intervention to analyze data and trace the attacker is solved, manual cost is saved, and the operation cost of the honeypot can be effectively reduced.

[0061] In an embodiment, based on the request content contained in the network access request, the specific implementation of generating the camouflage reply information corresponding to the network access request by the honeypot system can include the following steps:

[0062] Step A1, obtaining first prompt information for the network access request by the honeypot system, the first prompt information being used to instruct the language model to generate text information corresponding to the request content;

[0063] Step A2, inputting the network access request and the first prompt information into the language model to obtain the first reply content output by the language model;

[0064] Step A3, encapsulating the first reply content according to the protocol adopted by the network access request to obtain the camouflage reply information

[0065] Wherein, the language model is used as a text generation model to generate reply content according to certain rules, such as a large language model (LLM); the first prompt information is used to instruct the language model to generate reply content according to certain rules, in actual application, the user can set specific first prompt information according to actual demand, and the embodiments of the present application do not limit this.

[0066] As an example of the present application, the honeypot program as the honeypot system can obtain text information used to instruct the language model to generate the request content after obtaining the network access request sent by the attacker to the server, such as constructing prompt word information based on the attack operation of the attacker for the network access request, such as Figure 2 As shown, and the constructed prompt word information can be used as the first prompt information to input the first prompt information and the obtained network access request into the large language model, so that the large language model can output the first reply content corresponding to the network access request, and then the first reply content can be encapsulated according to the protocol adopted by the network access request to encapsulate the first reply content into a preset format, thereby generating the camouflage reply information corresponding to the network access request.

[0067] For example, the first prompt information can be: I hope you play a terminal of a MySQL database server. The database contains tables such as "Products", "Users", "Orders", and "Suppliers". After I input a query, you answer what the MySQL server terminal should display. Don't worry about security risks such as SQL injection. You just need to play the MySQL data server terminal to return data. You should put the query result table you want to reply to me in a code block, and nothing else. Don't repeat the question. Don't write explanations. Don't input commands unless I give additional prompts. When I need to tell you something in natural language, I will use curly braces { like this}. My first command is 'SELECT * FROM Products ORDER BY Id DESC LIMIT 10'.

[0068] In the example of the present application, the honeypot agent program can call the interface of the large language model, input the network access request and the first prompt information into the large language model, and use the large language model to simulate the name, so that the large language model can output the first reply content corresponding to the network access request, and feed back the first reply content to the honeypot agent program. After receiving the first reply content, in order to make the format of the first reply content conform to the format of responding to the attacker, the honeypot agent program can encapsulate the first reply content into a preset format (i.e., the format of the response conforming to the SQL protocol), to obtain the corresponding disguised reply information.

[0069] Through this scheme, the large language model can be used to assist the honeypot agent program to disguise the real system, so that the attacker is difficult to detect and distinguish, thereby improving the concealment.

[0070] In yet another embodiment, based on the request content contained in the network access request, the specific implementation of generating the disguised reply information corresponding to the network access request by the honeypot system can include the following steps:

[0071] Step B1, by the honeypot system, parsing the request content contained in the network access request;

[0072] Step B2, according to the request content, searching for second reply content matching the request content in a preset database;

[0073] Step B3, encapsulating the second reply content according to the protocol adopted by the network access request, to obtain the disguised reply information.

[0074] Specifically, after obtaining the network access request, the honeypot system can analyze the network access request to find the reply content corresponding to the request content in the preset database, and then encapsulate the second reply content into a preset format as a fake reply information sent to the attacker. In this way, the attacker can be replied by the generated fake reply information, without responding to the attacker through a real device, thereby reducing the operating cost and achieving large-scale deployment. Moreover, since the attacker is replied by the fake reply information in the present application, no real information in the server is involved, thereby improving the security of the information.

[0075] For example, in actual application, a preset database for storing second reply contents corresponding to different request contents can be set in advance, wherein the second reply content corresponding to each request content can be set by a user according to actual demand.

[0076] Based on this, the honeypot agent arranged in the server as a honeypot system can analyze the request content contained in the network access request sent by the attacker, then find the second reply content corresponding to the request content in the preset database, and finally encapsulate the second reply content into a preset format (i.e., the format of the response conforming to the SQL protocol) to obtain the corresponding fake reply information. After obtaining the fake reply information through the above-mentioned manner, the honeypot agent can feed back the fake reply information as a return value to the attacker, thereby realizing the confusion of the attacker, making the attacker mistakenly believe that the attack is successful, but actually the return value is false information and will not affect the security of the server. Through the scheme, the user can flexibly set the second reply content responding to different network access requests according to actual demand.

[0077] It can be seen that, by obtaining the network access request sent by the attacker to the server, and then generating the fake reply information corresponding to the network access request based on the request content contained in the network access request through the honeypot system, and returning the fake reply information to the attacker, the attacker can be replied by the generated fake reply information, without responding to the attacker through a real device, thereby reducing the operating cost and achieving large-scale deployment. Moreover, since the attacker is replied by the fake reply information in the present application, no real information in the server is involved, thereby ensuring the data security.

[0078] In some optional embodiments of this application, when a successful connection between the attacker and the server's database is detected, executing a data loading instruction to trigger the database to record the attacker's access log information may specifically include the following sub-steps:

[0079] Sub-step S201: If it is detected that the attacker has successfully connected to the database corresponding to the server, the server is controlled to send a data loading instruction to the attacker. The data loading instruction is used to read the network access records corresponding to the attacker.

[0080] Sub-step S202: The read network access record is stored in the database as the access record information.

[0081] It should be noted that in practical applications, honeypot technology can be used to deliberately expose the MySQL database of the MySQL server and set the MySQL database to a weak password, allowing attackers to brute-force the account and password, and then use tools to connect based on that account and password.

[0082] Based on this, the honeypot system in this embodiment can control the server to use the data loading instruction (i.e., the LOAD DATA LOCAL command) to read arbitrary files from the MySQL client when it detects that the attacker has successfully connected to the database. Then, a fake malicious server sends a payload to the client connected to this server to read the file. Correspondingly, the LOAD DATA LOCAL INFILE statement can be used in the MySQL client to load the data file, thereby realizing the reading of the attacker's network access records.

[0083] Before implementing the above solution in an application, the following preparatory work can be done:

[0084] 1. Set file permissions: Configure the MySQL server to have permission to read files on the client's local machine, ensuring that the MySQL process has sufficient permissions to access the client's files.

[0085] 2. Set file location: The file path should be relative to the MySQL server, not the client, and ensure that the data file is located in a directory accessible by the MySQL server. In practice, for security reasons, files should also be avoided in sensitive directories, which can be set by the user according to actual needs.

[0086] 3. Set file load permissions: The MySQL server's configuration needs to allow the use of LOAD DATA LOCAL INFIL. This can be enabled by using the -local-infile option when starting the MySQL server or by adding local_infile=1 in the configuration file.

[0087] As an example of the present application, the network access record can be a browser access record, and in the case where the attacker successfully connects to the database corresponding to the server, the server is controlled to send a data loading instruction to the attacker, so as to read the attacker's network browser access record through the data loading instruction, thereby realizing reading of the attacker's browser access record. For example, in the MySQL client, the LOAD DATA LOCAL INFILE statement can be used to load a data file, and then the attacker can be analyzed based on the browser access record to obtain a corresponding analysis result.

[0088] In some optional embodiments of the present application, the attacker is analyzed based on the access record information to obtain an analysis result corresponding to the attacker, which can specifically include: preprocessing the access record information to obtain to-be-analyzed information corresponding to the attacker, the to-be-analyzed information being data information to be analyzed; performing feature extraction on the to-be-analyzed information to obtain access behavior feature information of the attacker, the access behavior feature information being information representing an access attack behavior feature; generating an attacker portrait corresponding to the attacker based on the access behavior feature information, and taking the attacker portrait as the analysis result.

[0089] For example, in the case where the browser access record is taken as the access record information, the to-be-analyzed information useful for subsequent analysis of the attacker can be extracted from the browser access record through preprocessing, such as identity information of the attacker, access behavior information for a specific website, and the like, so that the access behavior feature information of the attacker can be extracted based on the to-be-analyzed information in the subsequent analysis, and then the attacker portrait corresponding to the attacker can be generated based on the access behavior feature information, so as to take the attacker portrait as the analysis result.

[0090] In a possible implementation, the user can pre-set an information white list, and extract to-be-analyzed information through the information white list. For example, the information white list can contain URLs, timestamps, and some specific websites visited in history, and then the information of the URLs, timestamps, and specific websites visited in history can be extracted from the browser access record as to-be-analyzed information.

[0091] In another possible implementation, the user can pre-set an information blacklist, filter out some useless information through the information blacklist, and the remaining information is the to-be-analyzed information. For example, in the case that the information blacklist contains some specific websites (such as specific query websites) that are historically visited, based on the information blacklist, information related to visiting these specific websites can be filtered out from the browser access record, so as to take other information as the to-be-analyzed information.

[0092] After obtaining the to-be-analyzed information corresponding to the attacker, feature extraction can be performed based on the to-be-analyzed information to extract access behavior feature information corresponding to the attacker, such as extracting feature information such as the type of website visited by the attacker, the access time, the access frequency, and the dwell time according to the timestamp and the related information of the historically visited website, as the access behavior feature information of the attacker. Subsequently, the attacker portrait corresponding to the attacker can be generated based on the extracted feature information, that is, the attacker portrait corresponding to the attacker is generated based on the access behavior feature information, thereby obtaining the analysis result of the attacker.

[0093] In one possible implementation, generating the attacker portrait corresponding to the attacker based on the access behavior feature information can include the following steps: converting the access behavior feature information by using a preset language model to obtain a conversion result output by the language model, the conversion result containing language and character information for describing the behavior and features of the attacker; constructing a portrait according to the language and character information to obtain a target portrait containing the behavior and features of the attacker, the features of the attacker being the features of the attacker; and taking the target portrait as the attacker portrait.

[0094] As an example of the present application, the honeypot agent program can call the interface of the language model, input the access behavior feature information into the preset language model, and convert the access behavior feature information into language and character information for describing the behavior and features of the attacker by the language model. Then, a portrait can be constructed according to the language and character information to obtain a target portrait as the attacker portrait corresponding to the attacker. For example, the target, type, and technology used by the attacker are used for portrait construction, thereby realizing automatic generation of the attacker portrait.

[0095] In addition, in another embodiment of the present application, after analyzing the attacker based on the access record information and obtaining the analysis result corresponding to the attacker, the following steps can be further included:

[0096] Step D1, obtaining a preset report generation format;

[0097] Step D2, generating an analysis report corresponding to the analysis result according to the report generation format.

[0098] The report generation format is used to indicate that a corresponding report is generated in a certain format.

[0099] For example, in combination with the above example, after obtaining the analysis result, the honeypot agent program can call the interface of the report generation service, and input the report generation format and the analysis result to the report generation service. The report generation service generates a corresponding analysis report based on the report generation format and the analysis result, and stores it in a pre-set storage space. In this way, the staff can view the analysis result through the analysis report.

[0100] In practical applications, after generating the analysis report, the analysis report can also be automatically displayed, thereby further facilitating user viewing. For example, the analysis report can be displayed through a corresponding visualization component of the server; or the analysis report can be sent to a mobile display device (such as a mobile phone, a tablet, or the like) used by the user, so as to display the analysis report through the display screen of the mobile display device.

[0101] As can be seen, after obtaining the network access record of the client where the attacker is located, the present application embodiment can realize analysis of the attacker through the network access record, obtain the analysis result corresponding to the attacker, and then generate an analysis report according to the analysis result, thereby realizing countermeasures and tracing of the attacker.

[0102] It should be noted that, for the method embodiments, in order to simply describe, they are all described as a series of action combinations, but those skilled in the art should know that the present application embodiments are not limited by the action order described, because according to the present application embodiments, certain steps can be performed in other order or simultaneously.

[0103] Based on the same technical concept, the present application embodiment also provides a honeypot trapping device, as shown in Figure 2 The device comprises:

[0104] The request acquisition module 201 is configured to acquire a network access request sent by an attacker to a server;

[0105] The information generation module 202 is configured to generate, through a honeypot system, pseudo reply information corresponding to the network access request based on request content contained in the network access request;

[0106] The information return module 203 is configured to return the pseudo reply information to the attacker;

[0107] The data loading instruction module 204 is configured to execute a data loading instruction to trigger the database to record access record information of the attacker through the data loading instruction in the case where it is detected that the attacker successfully connects to the database of the server;

[0108] The attack analysis module 205 is configured to analyze the attacker based on the access record information, and obtain an analysis result corresponding to the attacker.

[0109] In a possible implementation, the information generation module 202 includes:

[0110] The first prompt information acquisition submodule is configured to acquire first prompt information for the network access request through the honeypot system, the first prompt information being used to instruct a language model to generate text information corresponding to the request content;

[0111] The information input submodule is configured to input the network access request and the first prompt information into the language model, and obtain first reply content output by the language model;

[0112] The pseudo-reply information submodule is configured to encapsulate the first reply content according to a protocol adopted by the network access request, and obtain the pseudo-reply information.

[0113] In another possible implementation, the information generation module 202 includes:

[0114] The analysis submodule is configured to analyze request content contained in the network access request through the honeypot system;

[0115] The reply content searching submodule is configured to search, according to the request content, a second reply content matching the request content in a preset database;

[0116] The encapsulation submodule is configured to encapsulate the second reply content according to a protocol adopted by the network access request, and obtain the pseudo-reply information.

[0117] In a possible implementation, the data loading instruction module 204 includes:

[0118] The instruction sending submodule is configured to, in a case where it is detected that the attacker successfully connects to the database corresponding to the server, control the server to send a data loading instruction to the attacker, the data loading instruction being used to read network access record of the attacker.

[0119] The storage submodule is configured to store the read network access record as the access record information to the database.

[0120] In a possible implementation, the attack analysis module 205 includes:

[0121] The preprocessing submodule is configured to pre-process the access record information, and obtain to-be-analyzed information corresponding to the attacker, the to-be-analyzed information being to-be-analyzed data information.

[0122] a feature extraction submodule configured to perform feature extraction on the information to be analyzed to obtain access behavior feature information of the attacker, the access behavior feature information being information representing access attack behavior features;

[0123] a portrait generation submodule configured to generate an attacker portrait corresponding to the attacker based on the access behavior feature information, and use the attacker portrait as the analysis result.

[0124] In a possible implementation, the portrait generation submodule is specifically configured to: convert the access behavior feature information by using a preset language model to obtain a conversion result output by the language model, the conversion result containing language information used to describe the behavior and features of the attacker; construct a target portrait containing the behavior and features of the attacker according to the language information, the features of the attacker being the features of the attacker; and use the target portrait as the attacker portrait.

[0125] In a possible implementation, the honeypot trapping device further includes a report generation module configured to: obtain a preset report generation format; and generate an analysis report corresponding to the analysis result according to the report generation format.

[0126] In a specific implementation, the honeypot trapping device can be integrated in an electronic device, so that the electronic device can obtain a network access request sent by an attacker to a server, generate, based on request content contained in the network access request, pseudo reply information corresponding to the network access request by using a honeypot system, and return the pseudo reply information to the attacker, and then execute a data loading instruction to trigger a database to record access record information of the attacker by using the data loading instruction in a case where it is detected that the attacker successfully connects to the database of the server, so that the attacker can be analyzed based on the access record information, automatic tracing is implemented, an analysis result corresponding to the attacker is obtained, and the problem that a traditional honeypot in the prior art needs manual intervention to analyze data and trace the attacker is solved, thereby effectively reducing the operation cost of the honeypot.

[0127] Based on the same technical concept, the embodiments of the present application further provide an electronic device, which is configured to Figure 3As shown, the electronic device includes a processor 111, a communication interface 112, a memory 113 and a communication bus 114, wherein the processor 111, the communication interface 112 and the memory 113 communicate with each other through the communication bus 114, the memory 113 is configured to store a computer program, and the processor 111 is configured to execute the program stored in the memory 113 to implement the steps of the honeypot trapping method provided in any one of the preceding method embodiments.

[0128] In an embodiment of the present application, the processor 111 is configured to execute the program stored in the memory 113 to implement the honeypot trapping method provided in any one of the preceding method embodiments, including: obtaining a network access request sent by an attacker to a server; generating, by a honeypot system, pseudo reply information corresponding to the network access request based on request content contained in the network access request; returning the pseudo reply information to the attacker; in a case where it is detected that the attacker successfully connects to a database of the server, executing a data loading instruction to trigger the database to record access record information of the attacker by the data loading instruction; and analyzing the attacker based on the access record information to obtain an analysis result corresponding to the attacker.

[0129] The communication bus 114 mentioned in the above electronic device can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. The communication bus 114 can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, only one thick line is used in the figure, but it does not mean that there is only one bus or only one type of bus.

[0130] The communication interface 112 is configured to communicate between the above electronic device and other devices.

[0131] The memory 113 can include a Random Access Memory (RAM) and can also include a Non-Volatile Memory (NVM), for example, at least one disk memory. Optionally, the memory 113 can also be at least one storage device located away from the processor 111.

[0132] The processor 111 described above can be a general processor, including a central processing unit (CPU), a network processor (NP), etc.; can also be a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field-programmable gate array (FPGA) or other programmable logic device, a discrete gate or transistor logic device, a discrete hardware component.

[0133] In yet another embodiment provided in the present application, a computer readable storage medium is provided, and the computer readable storage medium stores a computer program. The computer program is executed by a processor to implement any of the above honeypot trapping methods.

[0134] In yet another embodiment provided in the present application, a computer program product containing instructions is provided, and when the computer program product is run on a computer, the computer is caused to perform the steps of any of the honeypot trapping methods in the above embodiments.

[0135] The device embodiments described above are merely illustrative, wherein the units described as separate components can or can not be physically separated, and the components displayed as units can or can not be physical units, i.e., can be located in one place, or can be distributed on multiple network units. Part or all of the modules can be selected according to actual needs to achieve the purpose of the embodiment scheme.

[0136] From the above description of the embodiments, those skilled in the art can clearly understand that the embodiments can be implemented by means of software plus a general hardware platform, and of course can also be implemented by hardware. Based on such understanding, the above technical solutions can be embodied in the form of a software product, which can be stored in a computer readable storage medium, such as a ROM / RAM, a magnetic disk, an optical disk, etc., and includes a number of instructions to make a computer device (which can be a personal computer, a server, or a network device, etc.) execute the methods described in the various embodiments or some parts of the embodiments.

[0137] It is to be understood that the terminology used herein is for the purpose of describing particular example embodiments only and is not intended to be limiting. As used herein, the singular forms "a", "an" and "the" are intended to include the plural forms as well, unless the context clearly indicates otherwise. The terms "comprises", "comprising", "includes", "including" and "has" are inclusive and therefore specify the presence of stated features, steps, operations, elements, and / or components, but do not preclude the presence or addition of one or more other features, steps, operations, elements, components, and / or groups thereof. The method steps, processes, and operations described herein are not to be construed as necessarily requiring their performance in the particular order

[0138] The above description is merely that of the specific embodiments of the application and as such is not to be taken in a limiting sense. Various modifications and alterations of the embodiments described herein will become apparent to those skilled in the art from the foregoing description, which does not limit the generality presented. It is the intention that all such modifications and alterations be considered equaliy by the spirit and scope of this application. It is therefore intended to cover in the appended claims all such changes and alterations that come within the scope of this application.

Claims

1. A method of honeypotting, the method comprising: The method comprises: obtaining a network access request sent by an attacker to a server; generating, by a honeypot system, fake reply information corresponding to the network access request based on the request content contained in the network access request; returning the fake reply information to the attacker; in the case where it is detected that the attacker successfully connects to a database of the server, executing a data loading instruction to trigger the database to record access record information of the attacker by the data loading instruction; analyzing the attacker based on the access record information to obtain an analysis result corresponding to the attacker, including: preprocessing the access record information to obtain to-be-analyzed information corresponding to the attacker, the to-be-analyzed information being data information to be analyzed; performing feature extraction on the to-be-analyzed information to obtain access behavior feature information of the attacker, the access behavior feature information being information representing an access attack behavior feature; generating an attacker portrait corresponding to the attacker based on the access behavior feature information, and taking the attacker portrait as the analysis result; wherein the generating of the attacker portrait corresponding to the attacker based on the access behavior feature information comprises: converting the access behavior feature information by using a preset language model to obtain a conversion result output by the language model, the conversion result containing language and character information for describing behaviors and features of the attacker; constructing a target portrait containing behaviors and attacker features of the attacker according to the language and character information to obtain the target portrait, the attacker features being features of the attacker; and taking the target portrait as the attacker portrait.

2. The method of claim 1, wherein, The generating of the fake reply information corresponding to the network access request by the honeypot system based on the request content contained in the network access request comprises: obtaining first prompt information for the network access request by the honeypot system, the first prompt information being used to instruct a language model to generate text information corresponding to the request content; inputting the network access request and the first prompt information into the language model to obtain first reply content output by the language model; encapsulating the first reply content according to a protocol adopted by the network access request to obtain the fake reply information.

3. The method of claim 1, wherein, The generating of the fake reply information corresponding to the network access request by the honeypot system based on the request content contained in the network access request comprises: analyzing the request content contained in the network access request by the honeypot system; finding second reply content matching the request content in a preset database according to the request content; encapsulating the second reply content according to a protocol adopted by the network access request to obtain the fake reply information.

4. The method of claim 1, wherein, The execution of the data loading instruction to trigger the database to record the access record information of the attacker by the data loading instruction in the case where it is detected that the attacker successfully connects to the database of the server comprises: In a case where it is detected that the attacker successfully connects with the database, the server is controlled to send a data loading instruction to the attacker, the data loading instruction being used to read network access records of the attacker; The read network access records are stored in the database as the access record information.

5. The method of claim 1, wherein, After the analysis of the attacker based on the access record information is performed to obtain an analysis result corresponding to the attacker, the method further includes: Obtaining a preset report generation format; Generating an analysis report corresponding to the analysis result according to the report generation format.

6. A honeypot trap device characterized by, The apparatus includes: A request obtaining module configured to obtain a network access request sent by an attacker to a server; An information generating module configured to generate, based on request content contained in the network access request, pseudo-reply information corresponding to the network access request through a honeypot system; An information returning module configured to return the pseudo-reply information to the attacker; A data loading instruction module configured to, in a case where it is detected that the attacker successfully connects with a database of the server, execute a data loading instruction to trigger the database to record access record information of the attacker through the data loading instruction; An attack analysis module configured to analyze the attacker based on the access record information to obtain an analysis result corresponding to the attacker; The attack analysis module includes a preprocessing submodule, a feature extraction submodule, and a portrait generation submodule. The preprocessing submodule is configured to preprocess the access record information to obtain to-be-analyzed information corresponding to the attacker, the to-be-analyzed information being data information to be analyzed. The feature extraction submodule is configured to extract features from the to-be-analyzed information to obtain access behavior feature information of the attacker, the access behavior feature information being information representing access attack behavior features. The portrait generation submodule is configured to generate an attacker portrait corresponding to the attacker based on the access behavior feature information, and use the attacker portrait as the analysis result. The generation of the attacker portrait corresponding to the attacker based on the access behavior feature information includes: converting the access behavior feature information by using a preset language model to obtain a conversion result output by the language model, the conversion result containing language and character information used to describe behaviors and features of the attacker; constructing a target portrait containing behaviors and attacker features of the attacker according to the language and character information to obtain the target portrait, the attacker features being features of the attacker; and using the target portrait as the attacker portrait.

7. An electronic device, comprising: The apparatus includes a processor, a communication interface, a memory, and a communication bus, wherein the processor, the communication interface, and the memory communicate with each other through the communication bus. The memory is configured to store a computer program. The processor is configured to execute the program stored in the memory to implement the honeypot trapping method in any one of claims 1-5.

8. A computer-readable storage medium, characterized in that, The computer readable storage medium stores a computer program, and the computer program is executed by the processor to implement the honeypot trapping method in any one of claims 1-5.

Images