Network attack processing method and device based on large model honeypot, medium and equipment

Abstract

The application provides a network attack processing method and device based on a large model honeypot, a medium and equipment. The method comprises the following steps: creating a honeypot with a large model in a container; wherein the large model is a deep learning model for learning attack strategies of attackers; deploying the honeypot constructed in the container in a kubernetes cluster; creating a configuration file of each honeypot deployed in the kubernetes cluster, so that the honeypot simulates services and ports according to the configuration file; controlling the honeypot to open the simulated services and ports to attract attackers, delivering instructions of the attracted attackers to the large model, learning attack strategies of the attackers through the large model in the honeypot, and responding to the attackers according to the learned attack strategies. The application learns attack strategies of attackers through a large model, has the ability to constantly adapt to network attack strategies, and thus helps enterprises to more effectively protect the safety of themselves and customers.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, and in particular to a network attack processing method and device based on a large model honeypot, a medium and equipment. BACKGROUND

[0002] In view of the fact that network attacks pose a significant threat to enterprises and individuals, it is particularly crucial to establish effective prevention and investigation measures. One of these measures is to use honeypot technology, which is a computer system designed to attract and intercept network criminals or malicious software to study their attack strategies and technical means. Traditional honeypot methods mainly rely on static data and rules to identify attackers. However, these methods are easily detected by network attackers or malicious software. SUMMARY

[0003] To address at least one of the above technical problems, embodiments of the present application provide a network attack processing method and device based on a large model honeypot, a medium and equipment.

[0004] According to a first aspect, the embodiments of the present application provide a network attack processing method based on a large model honeypot, which includes:

[0005] creating a honeypot with a large model in a container; wherein the large model is a deep learning model that learns the attack strategies of attackers;

[0006] deploying the honeypot built in the container in a kubernetes cluster;

[0007] creating a configuration file for each honeypot deployed in the kubernetes cluster, so that the honeypot simulates services and ports according to the configuration file;

[0008] controlling the honeypot to open the simulated services and ports to attract attackers, passing the instructions of the attracted attackers to the large model, learning the attack strategies of the attackers through the large model in the honeypot, and responding to the attackers according to the learned attack strategies.

[0009] In one embodiment, the method of creating a honeypot with a large model in a container includes:

[0010] If the large model is a pre-trained model generator, the honeypot is configured through a local plugin of the large model, and a virtual terminal is generated; wherein the virtual terminal is a window for the attacker to interact with the honeypot.

[0011] In one embodiment, the configuration file created for the port includes at least one of the following: a version of the configuration file, a protocol used, an IP address and a port listened to, server description information, a response rule for multiple URL paths or multiple instructions, and a status code of response information.

[0012] In one embodiment, the configuration file for the 80 port also has response header information; the response rule for multiple URL paths, if the URL path in a request matches any path in the multiple URL paths, a preset HTML page is taken as the response information of the request, and a first status code is returned, the first status code being a status code indicating a successful response; if the URL path in a request does not match any path in the multiple URL paths, a second status code is returned, the second status code being a status code indicating a failed response.

[0013] In one embodiment, the configuration file for the 8080 port has two response rules: a first response rule and a second response rule, the first response rule including a matched first URL path, first response header information and first response information, the first response rule corresponding to a first status code; the second response rule including a matched second URL path, second response header information and second response information, the second response rule corresponding to a second status code; the first status code being a status code indicating a successful response; the second status code being a status code indicating a failed response.

[0014] In one embodiment, the configuration file for the 22 port has multiple instruction response rules, each response rule including response information for an instruction; the configuration file for the 22 port also includes a regular expression for matching a user password and a session timeout time limit.

[0015] According to a second aspect, an embodiment of the present application provides a network attack processing device based on a large model honeypot, comprising:

[0016] A first creation module is configured to create a honeypot with a large model in a container; wherein the large model is a deep learning model for learning attack strategies of attackers;

[0017] A first deployment module is configured to deploy the honeypot built in the container in a kubernetes cluster;

[0018] A second creation module is configured to create a configuration file of each honeypot deployed in the kubernetes cluster, so that the honeypot simulates services and ports according to the configuration file;

[0019] The first simulation module is configured to control the services and ports simulated by the honeypot to attract attackers, transmit the instructions of the attracted attackers to the large model, learn the attack strategies of the attackers through the large model in the honeypot, and respond to the attackers according to the learned attack strategies.

[0020] In one embodiment, the first creation module is specifically configured to: if the large model is a pre-training model, configure the honeypot through a local plug-in of the large model, and generate a virtual terminal; and the virtual terminal is a window for an attacker to interact with the honeypot.

[0021] According to a third aspect, an embodiment of the present application provides a computer readable storage medium having a computer program stored thereon, which, when executed in a computer, causes the computer to perform the method provided in the first aspect.

[0022] According to a fourth aspect, an embodiment of the present application provides a computing device including a memory and a processor, the memory having executable code stored therein, and the processor, when executing the executable code, implements the method provided in the first aspect.

[0023] The method and device for processing network attacks based on a large model honeypot provided by the embodiments of the present application first create a honeypot with a large model in a container, then deploy the honeypot constructed in the container in a kubernetes cluster, and then create a configuration file for each honeypot deployed in the kubernetes cluster, so that the honeypot simulates services and ports according to the configuration file; control the services and ports simulated by the honeypot to attract attackers, transmit the instructions of the attracted attackers to the large model, learn the attack strategies of the attackers through the large model in the honeypot, and respond to the attackers according to the learned attack strategies. It can be seen that, compared with the prior art which relies on static data and rules to identify attackers, the embodiments of the present application learn the attack strategies of the attackers through the large model, have the ability to adapt to network attack strategies, are not easy to be detected by network attackers or malicious software, and thus help enterprises to more effectively protect their own and customers' safety. BRIEF DESCRIPTION OF DRAWINGS

[0024] Figure 1 The flowchart of the method for processing network attacks based on a large model honeypot in an embodiment of the present application;

[0025] Figure 2 The structural block diagram of the device for processing network attacks based on a large model honeypot in an embodiment of the present application. DETAILED DESCRIPTION

[0026] In a first aspect, an embodiment of the present application provides a network attack processing method based on a large model honeypot, referring to Figure 1 The method comprises the following steps S110-S140:

[0027] S110, creating a honeypot with a large model in a container; wherein the large model is a deep learning model that learns the attack strategy of an attacker;

[0028] For example, the honeypot can be built using Docker Compose. Specifically, the container image is built by the command docker-compose build, and the honeypot is started in detached mode by the command docker-compose up-d.

[0029] In one embodiment, the creating a honeypot with a large model in a container in S110 can specifically include: if the large model is a pre-trained model, configuring the honeypot through a local plugin of the large model, and generating a virtual terminal; wherein the virtual terminal is a window for an attacker to interact with the honeypot.

[0030] The pre-trained model is a GPT model, where GPT stands for Generative Pre-Trained, which is a deep learning model based on the Internet and trained with data for text generation.

[0031] For example, the local plugin of the large model can be a ChatGPT plugin, and the ChatGPT plugin and secret key are used to configure the honeypot, and then a virtual terminal is generated. The generation of the virtual terminal is equivalent to the entrance of the honeypot, which can combine the instructions of the attacker and output the feedback of the honeypot. It can be seen that the honeypot interacts with the attacker through the virtual terminal.

[0032] When the honeypot receives an instruction, it can prompt the large model to tell the large model what to do, so that the large model learns and gives a response.

[0033] S120, deploying the honeypot built in the container in a kubernetes cluster;

[0034] For example, the honeypot can be deployed on the kubernetes cluster using the helm component. First, install the helm component, and then deploy the honeypot based on the helm component by the following command: helminstall beelzebub. / beelzebub-chart, helm upgrade beelzebub. / beelzebub-chart.

[0035] S130, create a configuration file for each honeypot deployed in the kubernetes cluster, so that the honeypot simulates services and ports according to the configuration file;

[0036] It can be seen that in order to ensure that the honeypot can simulate a specific service and port, a corresponding configuration file must be created. These configuration files include simulated services, response rules, response information and other related settings. The writing and management of configuration files are crucial to deceive attackers in order to capture the behavior and intention of attackers.

[0037] S140, control the honeypot to open the simulated service and port to attract attackers, pass the instructions of the attracted attackers to the large model, learn the attack strategy of the attacker through the large model in the honeypot, and respond to the attacker according to the learned attack strategy.

[0038] It can be seen that the honeypot opens the simulated service and port to attract attackers. When the attacker interacts with the honeypot, the attack instructions and output information can be recorded and stored in the history record for subsequent analysis. By learning the attack instructions of the attacker, the attack strategy of the attacker is constantly adapted, the deception effect is improved, and the honeypot remains effective in a constantly changing threat environment.

[0039] In one embodiment, the configuration file created for the port can include at least one of the following: version of the configuration file, protocol used, IP address and port listened to, server description information, response rule for multiple URL paths or multiple instructions, and status code of response information.

[0040] Among them, the configuration file for the 80 port also has response header information; for the response rule of multiple URL paths, if the URL path in a request matches any path in the multiple URL paths, a preset HTML page is used as the response information of the request, and a first status code is returned, the first status code is a status code indicating a successful response; if the URL path in a request does not match any path in the multiple URL paths, a second status code is returned, the second status code is a status code indicating a failed response.

[0041] For example, the configuration code and corresponding explanation of the configuration file of the 80 port are as follows:

[0042] apiVersion: specifies that the version of the configuration file is "v1";

[0043] protocol: specifies that the protocol used is "http";

[0044] address: specifies the IP address and port to listen to, which is ":80" here, indicating to listen to port 80 on all IP addresses;

[0045] description: specifies the description information as "Wordpress 6.0";

[0046] commands: defines response rules for multiple URL paths. Here, three URL paths are defined: " / index.php", " / index.html", or the root path " / ". When the URL path in the request matches any of these paths, the request is successful.

[0047] handler: defines a preset HTML page. When the URL path in the request matches any of these paths, this preset HTML page is returned as a response;

[0048] headers: defines the header information of the response, specifying the values of the Content-Type, Server, and X-Powered-By header fields;

[0049] statusCode: defines the status code of the response, with the first status code being 200, indicating that the request is successful.

[0050] In this configuration code, three response rules are defined, corresponding to different URL paths. When the request path matches one of the URL paths, the preset HTML page is returned as a response. Other requests will return a 404 status code and the corresponding error page.

[0051] Among them, the configuration file for the 8080 port has two response rules: the first response rule and the second response rule. The first response rule includes a matching first URL path, first response header information, and first response information. The first response rule corresponds to a first status code. The second response rule includes a matching second URL path, second response header information, and second response information. The second response rule corresponds to a second status code. The first status code is a status code indicating a successful response. The second status code is a status code indicating a failed response.

[0052] For example, the configuration code and corresponding explanation of the configuration file for the 8080 port are as follows:

[0053] apiVersion: sets the version of the configuration file to "v1";

[0054] protocol: sets the protocol used to "http";

[0055] address: The address and port to listen on are set to ":8080", indicating that the 8080 port on all IP addresses is to be listened to;

[0056] description: This is the description information of the server, which is set to "Wordpress 6.0" here.

[0057] commands: This is a list that defines the server's response rules for different URL paths. There are two response rules here:

[0058] The first response rule is to respond to requests for the first path "index.php". When the URL path in the request matches "index.php", return "mocked response" as the response. At the same time, set the response header information to "Content-Type: text / html", "Server: Apache / 2.4.53(Debian)" and "X-Powered-By: PHP / 7.4.29", and the status code to 200, indicating that the request is successful.

[0059] The second response rule is to respond to requests for paths " / wp-login.php" or " / wp-admin". When the URL path in the request matches one of the two paths, return "mocked response" as the response. Similarly, set the response header information to "Content-Type: text / html", "Server: Apache / 2.4.53(Debian)" and "X-Powered-By: PHP / 7.4.29", and the status code to 400, indicating that the request has a syntax error.

[0060] Among them, the configuration file for port 22 has multiple response rules for each command, each of which includes response information for a command; The configuration file for port 22 also includes regular expressions for matching user passwords and session timeout time limits.

[0061] For example, the configuration code of the configuration file for port 22 and the corresponding explanation are as follows:

[0062] apiVersion: The version of the configuration file is set to "v1";

[0063] protocol: The protocol used is set to "ssh";

[0064] address: The address and port to listen on are set to ":22", indicating that the 22 port on all IP addresses is to be listened to;

[0065] description: This is the server's description information as "SSH interactive";

[0066] commands: This is a list that defines the server's responses to different commands:

[0067] When the input command is "ls", the returned response is "Documents Images Desktop Downloads.m2.kube.ssh.docker".

[0068] When the input command is "pwd", the returned response is " / home / ".

[0069] When the input command is "uname -m", the returned response is "x86_64";

[0070] When the input command is "docker ps", the returned response is "CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES".

[0071] When the input command starts with "docker", the returned response is "Error response from daemon: dial unix docker.raw.sock: connect: connection refused".

[0072] When the input command is "uname", the returned response is "Linux".

[0073] When the input command is "ps", the returned response is "PID TTY TIME CMD\n21642 ttys000 0:00.07 / bin / dockerd".

[0074] When the input command does not match any of the above rules, the returned response is "command not found".

[0075] serverVersion: This is the version information of the SSH server, which is set to "OpenSSH" here.

[0076] serverName: This is the name of the SSH server, which is set to "ubuntu" here.

[0077] passwordRegex: This is a regular expression used to match user passwords, which is set to "^(root|qwerty|Smoker666)$" here, indicating that users are allowed to log in with "root", "qwerty", or "Smoker666" as passwords.

[0078] deadlineTimeoutSeconds: This is the timeout time of the SSH session in seconds, which is set to 60 seconds here. If the user has no activity within 60 seconds, the SSH session will automatically close.

[0079] In summary, first, a honeypot with a large model is created in a container, then the honeypot built in the container is deployed in a kubernetes cluster, then a configuration file of each honeypot deployed in the kubernetes cluster is created, so that the honeypot simulates services and ports according to the configuration file; the honeypot is controlled to open the simulated services and ports to attract attackers, the instructions of the attracted attackers are passed to the large model, the attack strategy of the attacker is learned through the large model in the honeypot, and a response is made to the attacker according to the learned attack strategy. It can be seen that, compared with the prior art which relies on static data and rules to identify attackers, the embodiments of the present application learn the attack strategy of the attacker through the large model, have the ability to adapt to network attack strategies, are not easy to be detected by network attackers or malicious software, and thus help enterprises to more effectively protect their own and customers' security.

[0080] According to a second aspect, embodiments of the present application provide a network attack processing device based on a large model honeypot, referring to Figure 2 The device 100 comprises:

[0081] A first creation module 110 is configured to create a honeypot with a large model in a container; wherein the large model is a deep learning model for learning the attack strategy of an attacker;

[0082] A first deployment module 120 is configured to deploy the honeypot built in the container in a kubernetes cluster;

[0083] A second creation module 130 is configured to create a configuration file of each honeypot deployed in the kubernetes cluster, so that the honeypot simulates services and ports according to the configuration file;

[0084] A first simulation module 140 is configured to control the honeypot to open the simulated services and ports to attract attackers, pass the instructions of the attracted attackers to the large model, learn the attack strategy of the attacker through the large model in the honeypot, and make a response to the attacker according to the learned attack strategy.

[0085] In one embodiment, the first creating module is specifically configured to: if the large model is a generative pre-training model, configure the honeypot through a local plug-in of the large model, and generate a virtual terminal; wherein the virtual terminal is a window for an attacker to interact with the honeypot.

[0086] In one embodiment, the configuration file created for the port includes at least one of the following: a version of the configuration file, a protocol used, an IP address and a port listened to, server description information, a response rule for multiple URL paths or multiple instructions, and a status code of response information.

[0087] In one embodiment, the configuration file for the 80 port also has response header information; for the response rule for multiple URL paths, if a URL path in a request matches any path in the multiple URL paths, a preset HTML page is taken as response information of the request, and a first status code is returned, the first status code being a status code indicating a successful response; if the URL path in the request does not match any path in the multiple URL paths, a second status code is returned, the second status code being a status code indicating a failed response.

[0088] In one embodiment, the configuration file for the 8080 port has two response rules: a first response rule and a second response rule, the first response rule including a matched first URL path, first response header information and first response information, the first response rule corresponding to a first status code; the second response rule including a matched second URL path, second response header information and second response information, the second response rule corresponding to a second status code; the first status code being a status code indicating a successful response; the second status code being a status code indicating a failed response.

[0089] In one embodiment, the configuration file for the 22 port has multiple response rules for instructions, each response rule including response information for an instruction; the configuration file for the 22 port also includes a regular expression for matching a user password and a session timeout time limit.

[0090] It can be understood that the explanations, specific embodiments, beneficial effects, examples and the like of the device provided in the embodiments of the present application can refer to the corresponding parts in the method provided in the first aspect, and will not be repeated here.

[0091] In a third aspect, the embodiments of the present application provide a computer readable medium, and the computer readable medium stores computer instructions, and the computer instructions make the processor execute the method provided in the first aspect when executed by the processor.

[0092] Specifically, a system or an apparatus equipped with a storage medium on which a software program code for realizing the functions of any of the above-described embodiments is stored can be provided, and a computer (or CPU or MPU) of the system or the apparatus reads out and executes the program code stored in the storage medium.

[0093] In this case, the program code read out from the storage medium itself realizes the functions of any of the above-described embodiments, and therefore the program code and the storage medium storing the program code constitute a part of the present application.

[0094] Embodiments of the storage medium for providing the program code include a floppy disk, a hard disk, a magneto-optical disk, an optical disk (such as CD-ROM, CD-R, CD-RW, DVD-ROM, DVD-RAM, DVD-RW, DVD+RW), a magnetic tape, a non-volatile memory card, and a ROM. Alternatively, the program code can be downloaded from a server computer via a communication network.

[0095] Further, it should be understood that not only the program code read out by the computer, but also the operating system or the like operating on the computer based on the instructions of the program code can perform part or all of the actual operations to realize the functions of any of the above-described embodiments.

[0096] Further, it should be understood that the program code read out from the storage medium can be written into a memory provided in an extension board inserted into the computer or a memory provided in an extension module connected to the computer, and then part or all of the actual operations can be performed by a CPU or the like mounted on the extension board or the extension module based on the instructions of the program code to realize the functions of any of the above-described embodiments.

[0097] It should be understood that the explanation of the related contents, the detailed description, the advantageous effects, the examples, and the like of the computer readable medium provided by the embodiments of the present application can refer to the corresponding parts of the method provided by the first aspect, and thus will not be described here.

[0098] In a fourth aspect, an embodiment of the present specification provides a computing device including a memory and a processor, wherein the memory stores executable code, and the processor executes the executable code to realize the method in any of the embodiments of the specification.

[0099] It should be understood that the explanation of the related contents, the detailed description, the advantageous effects, the examples, and the like of the computing device provided by the embodiments of the present application can refer to the corresponding parts of the method provided by the first aspect, and thus will not be described here.

[0100] The various embodiments described in this specification are presented by way of example, and embodiments can be implemented in any combination of hardware and / or software. As various changes could be made with respect to the above examples, it should be understood that, within the scope of the appended claims and equivalents thereof, the present application could be practiced otherwise than as specifically described. For example, the order of elements could be different. The use of "adapted to" or "configured to" herein can mean "best modes" for implementing one or more embodiments. Other specific examples of equivalent hardware and software for implementing the various elements of the present application are readily apparent to one of ordinary skill in the art and software implementations could be realized in a variety of programming languages, such as C, C++, Java, and the like. In an instance in which a software implementation is accessed by processing logic, the software implementation is loaded into memory and executed by the processing logic using the RAM and the ROM. In the software implementation, the waves are represented as data structures stored in the memory and signals are represented as data packets, data streams, and other such information.

[0101] It should be apparent to those skilled in the art that the functions of the components and steps described above can be implemented in hardware, software, or a combination of both. When implemented in software, the functions can be stored on or transmitted over as one or more instructions or code on a computer-readable medium. Computer-readable media include both computer storage media and communication media including any medium that facilitates transfer of a computer program from one place to another. A storage media can be any available media that can be accessed by a computer. By way of example, and not limitation, such computer-readable media can comprise RAM, ROM, EEPROM, CD-ROM or other optical disk storage, magnetic disk storage or other magnetic storage devices, or any other medium that can be used to carry or store desired program code in the form of instructions or data structures and that can be accessed by a computer. Also, any connection is properly termed a computer-readable medium. For example, if the software is transmitted from a website, server, or other remote source using a coaxial cable, fiber optic cable, or twisted pair, then the coaxial cable, fiber optic cable, or twisted pair are included in the definition of medium. Disk and disc, as used herein, include compact disc (CD), laser disc, optical disc, digital versatile disc (DVD), and Blu-Ray® disc where disks usually reproduce data magnetically, while discs reproduce data optically with lasers. Combinations of the above should also be included within the scope of computer-readable media.

[0102] In the specific embodiments described above, the objects, technical solutions and advantages of the present application are further explained in detail. It should be

Claims

1. A large model honeypot-based network attack processing method, characterized in that, The method comprises the following steps: creating a honeypot with a large model in a container; wherein the large model is a deep learning model for learning attack strategies of attackers; deploying the honeypot built in the container in a kubernetes cluster; creating a configuration file of each honeypot deployed in the kubernetes cluster, so that the honeypot simulates services and ports according to the configuration file; controlling the honeypot to open the simulated services and ports to attract attackers, delivering instructions of the attracted attackers to the large model, learning attack strategies of the attackers through the large model in the honeypot, and responding to the attackers according to the learned attack strategies.

2. The method of claim 1, wherein, The step of creating a honeypot with a large model in a container comprises the following steps: if the large model is a pre-trained model, configuring the honeypot through a local plug-in of the large model, and generating a virtual terminal; wherein the virtual terminal is a window for an attacker to interact with the honeypot.

3. The method of claim 1, wherein, The configuration file created for the port comprises at least one of the following: version of the configuration file, used protocol, IP address and port for listening, server description information, response rule for multiple URL paths or multiple instructions, and status code of response information.

4. The method of claim 3, wherein, The configuration file for the 80 port further has response header information; the response rule for multiple URL paths, if the URL path in a request matches any path in the multiple URL paths, a preset HTML page is taken as the response information of the request, and a first status code is returned, the first status code being a status code indicating a successful response; if the URL path in a request does not match any path in the multiple URL paths, a second status code is returned, the second status code being a status code indicating a failed response.

5. The method of claim 3, wherein, The configuration file for the 8080 port has two response rules: a first response rule and a second response rule, the first response rule comprising a matched first URL path, first response header information and first response information, the first response rule corresponding to a first status code; the second response rule comprising a matched second URL path, second response header information and second response information, the second response rule corresponding to a second status code; the first status code being a status code indicating a successful response; the second status code being a status code indicating a failed response.

6. The method of claim 3, wherein, The configuration file for the 22 port has multiple instruction response rules, each response rule comprising response information for an instruction; the configuration file for the 22 port further comprises a regular expression for matching user passwords and a session timeout time limit. 7.A network attack processing apparatus based on a large model honeypot, characterized by, The method comprises the following steps: a first creating module for creating a honeypot with a large model in a container; wherein the large model is a deep learning model for learning attack strategies of attackers; a first deploying module for deploying the honeypot built in the container in a kubernetes cluster; a second creating module for creating a configuration file of each honeypot deployed in the kubernetes cluster, so that the honeypot simulates services and ports according to the configuration file; The first simulation module is configured to control services and ports of the honeypot open simulation to attract attackers, transmit instructions of the attracted attackers to the large model, learn attack strategies of the attackers by the large model in the honeypot, and respond to the attackers according to the learned attack strategies.

8. The apparatus of claim 7, wherein, The first creation module is specifically configured to: if the large model is a generated pre-training model, configure the honeypot through a local plug-in of the large model, and generate a virtual terminal; and the virtual terminal is a window for an attacker to interact with the honeypot.

9. A computer-readable storage medium, characterized in that, A computer program is stored thereon, and when the computer program is executed in a computer, the computer is caused to execute the method of any one of claims 1-6.

10. A computing device, comprising: A device includes a memory and a processor, the memory stores executable code, and the processor executes the executable code to implement the method of any one of claims 1-6.

Images