Method, device, equipment, storage medium and product for deploying honeypot in honeynet

Abstract

The application provides a method, device, equipment, storage medium and product for deploying a honeypot in a honeynet. The method comprises: obtaining the number of connections between a target node in the honeynet and other nodes in the honeynet, and obtaining the node threat degree of the target node, the target node being any node in the honeynet; calculating the sum of the number of connections of the target node and the threat degree of the target node respectively to obtain the target node importance degree of the target node; determining the number of honeypots corresponding to the target node importance degree when the node benefit value is maximum according to a preset correspondence between the node importance degree, the number of honeypots and the node benefit value; and deploying the number of honeypots on the target node of the honeynet.

Description

Technical Field

[0001] This application relates to the field of network security technology, and in particular to a method, apparatus, device, storage medium and product for deploying honeypots in a honeynet. Background Technology

[0002] Honeynet systems are frequently used in maintaining network security. A honeynet is a network system consisting of multiple honeypots that are intentionally designed to be vulnerable and fake systems, in order to attract the attention of attackers.

[0003] Most current honeynets are static systems composed of open-source honeypots. However, due to their over-reliance on pre-configured honeywall security policies, they are difficult to modify according to the actual network conditions and the focus of protection in the network. Their defense functions are limited and cannot cope with different scenarios, different network architectures, and different customer needs, making it difficult to deal with different network conditions in actual applications. Summary of the Invention

[0004] This application provides a method, apparatus, equipment, storage medium, and product for deploying honeypots in a honeycomb, which can obtain a honeycomb composition scheme adapted to the network structure.

[0005] Firstly, this application provides a method for deploying honeypots in a honeynet, the method comprising:

[0006] The number of connections between a target node and other nodes in the honeynet is obtained, as well as the node threat level of the target node, where the target node is any node in the honeynet.

[0007] The target node importance is obtained by summing the number of connections of the target node and the threat level of the target node.

[0008] Based on the preset correspondence between node importance, number of honeypots, and node revenue value, determine the number of honeypots corresponding to the target node importance when the node revenue value is maximized;

[0009] The specified number of honeypots are deployed on the target node of the honeynet.

[0010] The method described in this application calculates the importance of a node from two aspects: the number of connections between the target node and other nodes in the honeynet, and the node threat level. Then, based on a preset correspondence between node importance, the number of honeypots, and node reward values, the number of honeypots corresponding to the target node's importance at which the node's reward value is maximized is determined. This determines the corresponding number of honeypots for each node in the network, thereby deploying honeypots in the honeynet and obtaining a honeynet composition scheme adapted to the network structure.

[0011] In some possible implementations, before obtaining the node threat level of the target node, the method further includes:

[0012] Obtain the first user permission threat level and the second user permission threat level of the target node, wherein the first user permission and the second user permission have different operation permissions on the target node;

[0013] The larger of the first permission threat level and the second user permission threat level is taken as the node threat level of the target node.

[0014] Within a network node, different user permissions may be set for different types of users, and different user permissions have different operational privileges. The method described in this application obtains the first user permission threat level and the second user permission threat level of the target node, and uses the larger value as the node threat level of the target node. This allows for accurate acquisition of the node threat level even when different user permissions exist within a node.

[0015] In some possible implementations, obtaining the first user privilege threat level and the second user privilege threat level of the target node includes:

[0016] The probability of obtaining first user privileges, a first threat coefficient corresponding to the probability of obtaining first user privileges, and the probability of obtaining second user privileges, a second threat coefficient corresponding to the probability of obtaining second user privileges;

[0017] The product of the first user permission acquisition probability and the first threat coefficient of the target node is calculated to obtain the first user permission threat level; and the product of the second user permission acquisition probability and the second threat coefficient of the target node is calculated to obtain the second user permission threat level.

[0018] The method described in this application uses a first threat coefficient and a second threat coefficient to describe the threat level of obtaining the first user permission and the second user permission, and uses the probability of obtaining the first user permission and the probability of obtaining the second user permission to describe the difficulty of obtaining the corresponding user permission. Then, the product of the threat coefficient and the probability of obtaining the user permission is calculated to represent the user permission threat level, thus accurately determining the user permission threat level.

[0019] In some possible implementations, the first threat coefficient and the second threat coefficient respectively include a direct threat coefficient and an indirect threat coefficient. The direct threat coefficient represents the extent of damage caused by attacking files stored and programs running within the target node, while the indirect threat coefficient represents the extent of damage caused by attacking other nodes in the network through the node after obtaining relevant permissions on the corresponding node.

[0020] The above-described method of this application can measure the potential harm caused by the intrusion of a target node from two aspects by obtaining a direct threat coefficient representing the damage caused by the attack to the target node and a second threat coefficient representing the damage caused by the target node to other nodes.

[0021] In some possible implementations, obtaining the number of connections between the target node in the honeycomb and other nodes in the honeycomb includes:

[0022] Obtain the attack graph corresponding to the network structure of the honeynet, where the vertices in the attack graph represent device nodes in the network, and the directed edges in the attack graph represent possible attack paths between nodes;

[0023] The vertex corresponding to each node in the honeynet in the attack graph is determined, and the number of connections of the target node is obtained based on the in-degree of the target vertex.

[0024] The above-described method of this application, by using an attack graph to represent the network structure and by using the attack graph to determine the number of connections of the target node, can more accurately describe the situation where the network is attacked.

[0025] In some possible implementations, determining the number of honeypots corresponding to the target node's importance when the node's reward value is maximized, based on a preset correspondence between node importance, honeypot number, and node reward value, includes:

[0026] Based on the attack graph, the exploit difficulty of each vulnerability corresponding to the target node is obtained from the database.

[0027] The difficulty of exploiting each of the aforementioned vulnerabilities is summed to obtain the path attack difficulty.

[0028] The probability of failure of multiple intrusion nodes is determined by the attack difficulty of the aforementioned path and the number of multiple initial honeypots;

[0029] Based on the preset correspondence between node importance, number of honeypots, and failure probability of the intrusion node, and node reward value, determine the target initial honeypot number when the node reward value corresponding to the failure probability of the multiple intrusion nodes is the largest, and use the target initial honeypot number as the honeypot number corresponding to the target node importance.

[0030] The above-described method of this application obtains the difficulty of exploiting vulnerabilities by analyzing the attack graph, thereby determining the path attack difficulty and the failure probability of the intrusion node. This failure probability can be used to more accurately calculate the required number of honeypots.

[0031] In some possible implementations, before retrieving the exploit difficulty of each vulnerability corresponding to an edge in the attack graph from the database based on the edge terminating at the target node, the method further includes:

[0032] Obtain at least one of the following metrics for the vulnerability: attack vector, attack complexity, privilege requirements, and user interaction.

[0033] The exploit difficulty of the vulnerability is obtained by multiplying the obtained metric values.

[0034] The above-described method of this application can accurately determine the difficulty of exploiting vulnerabilities by obtaining information related to vulnerability exploitation, such as attack vector metrics, attack complexity metrics, permission requirement metrics, and user interaction metrics.

[0035] In some possible implementations, after deploying the specified number of honeypots on the target node of the honeynet, the method further includes:

[0036] Obtain the initial pheromone of each node in the honeynet, where the initial pheromone represents the access volume of the corresponding node;

[0037] Based on the initial pheromone of each node, and using the minimum path principle to obtain the updated pheromone of each node within a preset time period;

[0038] The pheromone is removed based on a preset pheromone evaporation factor to obtain the target pheromone for each node;

[0039] The path formed by the nodes with the most target pheromones is determined as the optimal attack path.

[0040] The above-described method of this application obtains the initial pheromones of each node in the honeynet and iteratively calculates to determine the optimal attack path. The optimal attack path can be calculated based on the access volume, thereby enabling security protection or the deployment of decoy strategies.

[0041] In some possible implementations, the step of obtaining the updated pheromones of each node within a preset time period based on the initial pheromones of each node and using the minimum path principle includes:

[0042] Obtain the total amount of attack data collected by each node in the honeycomb and the amount of usable information in the collected attack data. The amount of usable information represents the amount of information in the attack data that is used to analyze the attack behavior.

[0043] Calculate the ratio of the available information to the total amount of attack data to obtain the honeypot benefit;

[0044] Based on the current pheromone of the node, the preliminary pheromone is obtained using the minimum path principle;

[0045] The updated pheromone is obtained by summing the initial pheromone with the honeypot reward.

[0046] The above-described method of this application, by redefining the pheromone update based on the validity ratio of the data during the pheromone update process, can obtain more reasonable pheromone results.

[0047] Secondly, this application provides an apparatus for deploying honeypots in a honeycomb, the apparatus comprising:

[0048] The acquisition module is used to acquire the number of connections between a target node and other nodes in the honeynet, and to acquire the node threat level of the target node, wherein the target node is any node in the honeynet;

[0049] The calculation module is used to calculate the sum of the number of connections of the target node and the threat level of the target node to obtain the target node importance.

[0050] The determination module is used to determine the number of honeypots corresponding to the target node importance when the node's revenue value is maximized, based on a preset correspondence between node importance, honeypot number, and node revenue value.

[0051] A deployment module is used to deploy the specified number of honeypots on the target node of the honeynet.

[0052] Thirdly, embodiments of this application provide a device for deploying honeypots in a honeycomb, the device comprising: a processor, and a memory storing computer program instructions; the processor reads and executes the computer program instructions to implement the method for deploying honeypots in a honeycomb as described above.

[0053] Fourthly, embodiments of this application provide a computer-readable storage medium storing computer program instructions, which, when executed by a processor, implement the method for deploying honeypots in a honeynet as described above.

[0054] Fifthly, embodiments of this application provide a computer program product in which instructions, when executed by a processor of an electronic device, cause the electronic device to perform the honeypot deployment method in a honeynet as described above.

[0055] The method, apparatus, equipment, storage medium, and product for deploying honeypots in the honeynet described in this application calculate the importance of a node from two aspects: the number of connections between a target node and other nodes in the honeynet and the node threat level of the node. Then, based on a preset correspondence between node importance, the number of honeypots, and node reward values, the number of honeypots corresponding to the target node's importance at which the node's reward value is maximized is determined. This determines the corresponding number of honeypots for each node in the network, thereby deploying honeypots in the honeynet and obtaining a honeynet composition scheme adapted to the network structure. Attached Figure Description

[0056] This application can be better understood from the following description of specific embodiments in conjunction with the accompanying drawings, wherein:

[0057] Other features, objects, and advantages of this application will become more apparent from the following detailed description of non-limiting embodiments with reference to the accompanying drawings, wherein the same or similar reference numerals denote the same or similar features.

[0058] Figure 1 This is a flowchart illustrating a method for deploying honeypots in a honeycomb according to an embodiment of this application;

[0059] Figure 2 This is a flowchart illustrating a method for deploying honeypots in a honeycomb according to another embodiment of this application;

[0060] Figure 3 This is a flowchart illustrating a method for deploying honeypots in a honeycomb according to another embodiment of this application;

[0061] Figure 4 This is a schematic diagram of the structure of a device for deploying honeypots in a honeycomb according to an embodiment of this application;

[0062] Figure 5 This is a schematic diagram of the hardware structure of the device for deploying honeypots in a honeycomb provided in an embodiment of this application. Detailed Implementation

[0063] The features and exemplary embodiments of various aspects of this application will now be described in detail. Numerous specific details are set forth in the following detailed description to provide a comprehensive understanding of this application. However, it will be apparent to those skilled in the art that this application can be implemented without requiring some of these specific details. The following description of embodiments is merely intended to provide a better understanding of this application by illustrating examples. This application is by no means limited to any specific configurations and algorithms presented below, but covers any modifications, substitutions, and improvements to elements, components, and algorithms without departing from the spirit of this application. Well-known structures and techniques are not shown in the accompanying drawings and the following description in order to avoid unnecessary obfuscation of this application.

[0064] With the rapid development of information technology, various new network technologies are emerging one after another, and network attack methods are also constantly being updated and iterated. In the process of maintaining network security, honeypot technology is sometimes used. However, due to the complexity of attackers' penetration attacks and the diversity of host vulnerabilities, a simple honeypot cannot meet the defense requirements, thus leading to the emergence of honeynet systems. A honeynet is a network system composed of multiple honeypots. These honeypots are deliberately designed as vulnerable fake systems to attract the attention of attackers.

[0065] However, in actual deployment of honeynets, there are no specific criteria for determining which honeypots are included, how they are interconnected, or what a reasonable honeynet size should be. Most current honeynets are static systems composed of open-source honeypots. Furthermore, due to over-reliance on pre-configured honeywall security policies, they are difficult to modify based on actual network conditions and protection priorities. Their defense capabilities are limited, failing to address the needs of different scenarios, network architectures, and customers, and thus struggling to cope with diverse network conditions in real-world applications.

[0066] The inventors, in their research addressing the aforementioned problems, discovered that analyzing the vulnerability and importance of nodes in a network can help formulate honeypot deployment strategies. Specifically, by comprehensively considering node centrality and threat level to assess node importance and using this importance as the basis for honeypot deployment, precise and effective network protection can be achieved.

[0067] In one embodiment of the method for deploying honeypots in the honeynet of this application, reference can be made to... Figure 1 In this embodiment, the method can be executed by the device that deploys honeypots in the honeycomb described above, and the method includes the following steps S101 to S104.

[0068] Step S101: Obtain the number of connections between the target node and other nodes in the honeynet, and obtain the node threat level of the target node, wherein the target node is any node in the honeynet.

[0069] Node threat level is an indicator that measures the degree of threat a network node poses to overall network security after it has been attacked. Specifically, it can be measured through factors such as the node's importance and vulnerability to attack.

[0070] In practical implementation, a suitable data structure is used to represent the nodes in the honeycomb and the connections between them. For example, a graph data structure can be used, where nodes represent the nodes in the honeycomb and edges represent the connections between nodes. To obtain the number of connections between a target node and other nodes in the honeycomb, the number of connections can be calculated by traversing the target node's neighboring nodes. Algorithms such as depth-first search or breadth-first search can be used to traverse the nodes. The corresponding node threat level is then obtained after calculation.

[0071] Step S102: Calculate the sum of the number of connections of the target node and the threat level of the target node to obtain the target node importance.

[0072] In practice, the weights of the number of connections and the threat level can be determined according to actual needs. The number of connections and the threat level of the target node are weighted and summed to obtain the target node importance.

[0073] Step S103: Based on the preset correspondence between node importance, number of honeypots and node revenue value, determine the number of honeypots corresponding to the target node importance when the node revenue value is maximized.

[0074] In the actual implementation, a predefined correspondence exists between node importance, honeypot quantity, and node reward value. This relationship can be described by predefined rules, functions, or models.

[0075] Node revenue value can be used to evaluate the network contribution and business value of a specific node in the network, representing a measure of node value.

[0076] Based on a predefined relationship between node importance, the number of honeypots, and node reward values, an algorithm is designed to calculate the number of honeypots corresponding to the target node's importance. Specifically, this is an optimization problem: given node importance, find the optimal number of honeypots to maximize node reward values. Numerical optimization algorithms, such as linear programming and integer programming, can be used to solve for the optimal number of honeypots. In practical applications, constraints may also need to be considered, such as the number of honeypots not being negative or the number of honeypots being an integer.

[0077] Step S104: Deploy the specified number of honeypots on the target node of the honeynet.

[0078] In practice, based on the predetermined number of honeypots, a predefined deployment strategy is used to deploy them on the target nodes. This can be achieved through methods such as remote deployment, automated deployment, or manual deployment. Furthermore, the honeypot deployment strategy can be continuously optimized based on actual conditions and attack data, adjusting the number, type, or location of honeypots to improve network security protection effectiveness.

[0079] The method described in this application calculates the importance of a node from two aspects: the number of connections between the target node and other nodes in the honeynet, and the node threat level. Then, based on a preset correspondence between node importance, the number of honeypots, and node reward values, the number of honeypots corresponding to the target node's importance at which the node's reward value is maximized is determined. This determines the corresponding number of honeypots for each node in the network, thereby deploying honeypots in the honeynet and obtaining a honeynet composition scheme adapted to the network structure.

[0080] In some implementations, reference Figure 2 Before obtaining the node threat level of the target node, the method further includes steps S201 to S202.

[0081] Step S201: Obtain the first user permission threat level and the second user permission threat level of the target node, wherein the first user permission and the second user permission have different operation permissions on the target node.

[0082] In the specific implementation, nodes define the specific operational permission ranges of first-user and second-user privileges, which are clearly different on the target node. For example, first-user privileges can access sensitive data, while second-user privileges can only perform basic operations. Attack scenarios can be simulated by attempting to access the target node with first-user and second-user privileges to assess the actual threat level posed by each privilege level.

[0083] Step S202: Take the larger value between the first permission threat level and the second user permission threat level as the node threat level of the target node.

[0084] In the specific implementation, the threat level of the first user privilege and the threat level of the second user privilege are compared, and the larger value is taken as the node threat level of the target node, which represents the maximum threat level of the node, taking into account the different attack potential risks of the first user privilege and the second user privilege.

[0085] Within a network node, different user permissions may be set for different types of users, and different user permissions have different operational privileges. The method described in this application obtains the first user permission threat level and the second user permission threat level of the target node, and uses the larger value as the node threat level of the target node. This allows for accurate acquisition of the node threat level even when different user permissions exist within a node.

[0086] In some implementations, obtaining the first user privilege threat level and the second user privilege threat level of the target node includes:

[0087] The probability of obtaining first user privileges, a first threat coefficient corresponding to the probability of obtaining first user privileges, and the probability of obtaining second user privileges, a second threat coefficient corresponding to the probability of obtaining second user privileges.

[0088] In practice, the probability of obtaining first and second user privileges on the target node can be calculated through simulated attacks, vulnerability scanning, or other means.

[0089] The product of the first user permission acquisition probability and the first threat coefficient of the target node is calculated to obtain the first user permission threat level; and the product of the second user permission acquisition probability and the second threat coefficient of the target node is calculated to obtain the second user permission threat level.

[0090] In the specific implementation, the probability of obtaining the first user permission is multiplied by the corresponding first threat coefficient and correlated to represent the threat level posed by successfully obtaining the first user permission. Similarly, the probability of obtaining the second user permission is multiplied by the corresponding second threat coefficient and correlated.

[0091] The method described in this application uses a first threat coefficient and a second threat coefficient to describe the threat level of obtaining the first user permission and the second user permission, and uses the probability of obtaining the first user permission and the probability of obtaining the second user permission to describe the difficulty of obtaining the corresponding user permission. Then, the product of the threat coefficient and the probability of obtaining the user permission is calculated to represent the user permission threat level, thus accurately determining the user permission threat level.

[0092] In some implementations, the first threat coefficient and the second threat coefficient respectively include a direct threat coefficient and an indirect threat coefficient. The direct threat coefficient represents the extent of damage caused by attacking files stored and programs running within the target node, while the indirect threat coefficient represents the extent of damage caused by attacking other nodes in the network through the node after obtaining relevant permissions from the corresponding node.

[0093] In practical implementation, the extent of damage to the target node's internal files and programs is assessed when an attack occurs, to determine the magnitude of the harm. This also includes the potential damage caused by attacks on other nodes in the network from that node. The indirect threat coefficient can be calculated by simulating attack paths, privilege escalation, and lateral movement. Combining the direct and indirect threat coefficients forms a complete first and second threat coefficient. This allows for a comprehensive consideration of the threat posed by the attack to a single node and the entire network.

[0094] The above-described method of this application can measure the potential harm caused by the intrusion of a target node from two aspects by obtaining a direct threat coefficient representing the damage caused by the attack to the target node and a second threat coefficient representing the damage caused by the target node to other nodes.

[0095] In some implementation methods, reference may be made to Figure 3 The step of obtaining the number of connections between the target node in the honeynet and other nodes in the honeynet includes steps S301 to S302.

[0096] Step S301: Obtain the attack graph corresponding to the network structure of the honeynet, where the vertices in the attack graph represent device nodes in the network, and the directed edges in the attack graph represent possible attack paths between nodes.

[0097] In its implementation, the honeynet's network structure undergoes pre-projection topology probing to obtain the connectivity relationships between device nodes and the overall network topology. This includes scanning network devices, ports, and services to collect information about the network topology, such as device IP addresses, subnet relationships, and routing information. Based on this acquired network topology information, an attack graph can be constructed, where each vertex represents a network device node, and directed edges represent possible attack paths between nodes. Subsequently, the attack graph corresponding to the honeynet's network structure can be obtained.

[0098] Step S302: Determine the vertex corresponding to each node in the honeynet in the attack graph, and obtain the number of connections of the target node based on the in-degree of the target vertex.

[0099] In its implementation, for a target node, the software can determine the number of connections by calculating its in-degree in the attack graph. The in-degree represents the number of edges pointing to the target node, i.e., how many attack paths point to that node. Based on the obtained in-degree of the target node, the software can use the in-degree value as the number of connections to the target node. This number of connections reflects the number of potential attack paths affecting the target node.

[0100] The above-described method of this application, by using an attack graph to represent the network structure and by using the attack graph to determine the number of connections of the target node, can more accurately describe the situation where the network is attacked.

[0101] In some implementations, determining the number of honeypots corresponding to the target node's importance when the node's reward value is maximized, based on a preset correspondence between node importance, honeypot number, and node reward value, includes:

[0102] Based on the attack graph, the exploit difficulty of each vulnerability corresponding to the target node is obtained from the database.

[0103] In the implementation, a vulnerability database is pre-established, containing information on known vulnerabilities, including vulnerability name, description, CVE number, affected devices, and exploit difficulty. This information can be obtained from publicly available vulnerability databases or vulnerability information provided by security vendors. Based on the edges in the attack graph that terminate at the target node, the potential vulnerabilities and their corresponding exploit difficulty are determined for each edge.

[0104] The difficulty of exploiting each of the aforementioned vulnerabilities is summed to obtain the path attack difficulty.

[0105] In the specific implementation, the exploit difficulty of each vulnerability along the path is summed to obtain the attack difficulty of the path. This can be done by simply adding the exploit difficulties of each vulnerability along the path, or by considering the weighted relationship between the exploit difficulties of different vulnerabilities and performing a weighted summation.

[0106] The probability of failure for multiple intrusion nodes is determined by the attack difficulty along the aforementioned path and the number of initial honeypots.

[0107] In practical implementation, based on the attack model, a mathematical model or correlation rule is established between the path attack difficulty and the number of honeypots to describe the relationship between path attack difficulty and intrusion failure probability. Based on the established relationship between path attack difficulty and honeypot number, calculations are performed, using the path attack difficulty and honeypot number as input parameters, to obtain the failure probability of multiple intrusion nodes.

[0108] Based on the preset correspondence between node importance, number of honeypots, and failure probability of the intrusion node, and node reward value, determine the target initial honeypot number when the node reward value corresponding to the failure probability of the multiple intrusion nodes is the largest, and use the target initial honeypot number as the honeypot number corresponding to the target node importance.

[0109] In the implementation, the node reward values ​​corresponding to the failure probabilities of multiple intrusion nodes are compared, and the target initial honeypot number corresponding to the case with the highest reward value is found. This means that under specific conditions, setting this certain number of honeypots can maximize the reward or value of network nodes. This target initial honeypot number is used as the honeypot number corresponding to the importance of the target node.

[0110] The above-described method of this application obtains the difficulty of exploiting vulnerabilities by analyzing the attack graph, thereby determining the path attack difficulty and the failure probability of the intrusion node. This failure probability can be used to more accurately calculate the required number of honeypots.

[0111] In some implementations, before retrieving the exploit difficulty of each vulnerability corresponding to an edge in the attack graph from a database based on the edge terminating at the target node, the method further includes:

[0112] Obtain at least one of the following metrics for the vulnerability: attack vector, attack complexity, privilege requirements, and user interaction.

[0113] In the specific implementation, vulnerability-related information is collected, and a predefined measurement model or algorithm is used to obtain at least one of the following: the vulnerability's measurement value in attack vector, attack complexity, permission requirement, and user interaction.

[0114] The exploit difficulty of the vulnerability is obtained by multiplying the obtained metric values.

[0115] In the implementation, a weight can be set for each metric to determine the degree of influence of different metrics on the exploit difficulty. The obtained vulnerability metric is multiplied by its corresponding weight, and the products are multiplied together to obtain the exploit difficulty of the vulnerability.

[0116] The above-described method of this application can accurately determine the difficulty of exploiting vulnerabilities by obtaining information related to vulnerability exploitation, such as attack vector metrics, attack complexity metrics, permission requirement metrics, and user interaction metrics.

[0117] In some implementations, after deploying the number of honeypots on the target node of the honeynet, the method further includes:

[0118] Obtain the initial pheromone of each node in the honeynet, where the initial pheromone represents the access volume of the corresponding node.

[0119] In the actual implementation, an initial pheromone value is assigned to each node based on its access volume. Then, the pheromone levels of each node in the honeynet are obtained.

[0120] Based on the initial pheromone of each node, and using the minimum path principle to obtain the updated pheromone of each node within a preset time period.

[0121] In its implementation, the software calculates the pheromone update status of each node in the honeycomb based on the principle of minimum path within a preset time period and updates the pheromone value of each node accordingly.

[0122] The pheromones are removed based on a preset pheromone evaporation factor to obtain the target pheromones for each node.

[0123] In the implementation, a preset pheromone evaporation factor is used. This evaporation factor represents the proportion of pheromones that are evaporated or reduced within each time period. At the end of each time period, the software updates the pheromone levels of each node. During the update process, the amount of pheromone evaporated from each node is calculated based on the preset pheromone evaporation factor. After pheromone evaporation and removal, the pheromone value of each node is updated, becoming the target pheromone.

[0124] The path formed by the nodes with the most target pheromones is determined as the optimal attack path.

[0125] In the implementation, the node containing the most pheromones is taken as the starting point. According to preset rules and algorithms, the next node is selected step by step to make the path contain as many nodes with high pheromone content as possible, thus obtaining the optimal attack path.

[0126] The above-described method of this application obtains the initial pheromones of each node in the honeynet and iteratively calculates to determine the optimal attack path. The optimal attack path can be calculated based on the access volume, thereby enabling security protection or the deployment of decoy strategies.

[0127] In some implementations, obtaining the updated pheromones of each node within a preset time period based on the initial pheromones of each node and using the minimum path principle includes:

[0128] Obtain the total amount of attack data collected by each node in the honeycomb and the amount of usable information in the collected attack data. The amount of usable information represents the amount of information in the attack data that is used for analyzing attack behavior.

[0129] In practical implementation, because the honeypots corresponding to each node in the honeynet actively attract attackers and record their attack behavior, attack data within the honeypots can be monitored and collected. The collected attack data is then extracted and analyzed to determine the amount of usable information contained within.

[0130] The honeypot benefit is obtained by calculating the ratio of the available information to the total amount of attack data.

[0131] Based on the current pheromone of the node, the preliminary pheromone is obtained using the minimum path principle.

[0132] The updated pheromone is obtained by summing the initial pheromone with the honeypot reward.

[0133] In the actual implementation, the ratio of available pheromone to the total amount of attack data is calculated to determine the honeypot's profitability. Then, based on the principle of minimum path, the software calculates the initial pheromone value for each path, sums the initial pheromone value with the honeypot's profitability value, and obtains the updated pheromone. This step is to comprehensively consider the impact of honeypot profitability on the actual situation.

[0134] The above-described method of this application, by redefining the pheromone update based on the validity ratio of the data during the pheromone update process, can obtain more reasonable pheromone results.

[0135] As another implementation of this application, an attack graph AG is first designed, which is a directed graph, AG = (N, E). N represents the host in the system, and E is the connecting edge, representing the slave node N. i To N j The connection, Where N i N j ∈N and An edge is also an attack path, representing an attack path starting from the previous node N. pre After reaching node N post Feasible attack paths. Each attack path has a corresponding attack difficulty (AD), representing the attack difficulty from N. pre To N post The attack difficulty.

[0136] Specifically, exploitability of a vulnerability can be quantified using four basic dimensions: attack vector (AV), attack complexity (AC), permission requirements (PR), and user interaction (UI). Based on this metric, the formula is:

[0137] ED = (AV * AC * PR * UI) -1

[0138] To determine the exploit difficulty (ED) of a vulnerability, we need to understand that each vulnerability has its own characteristics, and different vulnerabilities within a node will have different impacts on that node. Furthermore, since we don't know the attacker's objectives and capabilities, every vulnerability in a node could be a potential target. Therefore, we calculate the node's Active Distance (AD) based on the ED of its vulnerabilities, specifically using the formula:

[0139]

[0140] Considering that typical attack sequences begin with a compromised node and gradually spread to other nodes, eventually penetrating the entire network, this invention introduces the concept of centrality to assess the importance of each node. In traditional networks, centrality is simply defined as the number of links connected to a node, i.e., the number of edges a node has, which can be used to represent a node's vulnerability to attack. In a network, the more other nodes a node connects to, the more central it is, the greater its influence on the entire network, and the stronger its coverage of the entire system. In other words, nodes with higher centrality are more likely to be chosen by attackers for penetration attacks. C(N) i The centrality of the target node is represented by ), and the specific calculation formula is as follows:

[0141]

[0142] Where i is the target node, j is all other nodes, n is the total number of nodes, and x is the adjacency matrix, where if node i is connected to node j, x... ij If it is 1, then it is defined as 1; otherwise, it is defined as 0.

[0143] Furthermore, considering that in real-world networks, having the most connections does not necessarily mean being the most important, and that each node poses a different threat to the overall network security, a threat coefficient is introduced to measure the danger level of a node. When an attacker gains relevant privileges on a host through a series of attack methods, that compromised host poses a certain threat to the entire network.

[0144] For example, if only user management privileges are obtained, the victim's host may contain important confidential information such as personal identification information, frequently used password records, and important files, which could lead to the theft of personal information. If administrator privileges are obtained, hackers can use this to damage the victim's system, such as tampering with, deleting, or encrypting the victim's data, or damaging system files. These attacks can cause the victim's system to crash and disrupt normal business operations; such threats can be considered direct threats. Based on the importance of the information on the host, a direct threat coefficient w can be used. k (0≤w k ≤1) indicates that the asset information on the host is very important, represented by 1; 0 indicates that there is no important information. Secondly, in a network cluster, there are close connections between the victim host and other hosts. When an attacker has specific access permissions, it may use this relationship as a springboard to launch an attack; this situation is called an indirect threat.

[0145] Assume any host H in the network k (1≤k≤n), the probability that an attacker gains access to the host user by exploiting the vulnerability is u. ikAt the same time, it sets the potential threat that obtaining user permissions may pose to the entire network. If the probability of an attacker gaining host administrator privileges by exploiting the vulnerability is r ik Meanwhile, it is assumed that the potential threat it poses to the entire network after gaining administrator privileges is... So, because the attacker breached H... i This poses a potential risk to the entire network, which can be represented by the formula:

[0146]

[0147] In this context, the node host is H0, and TDH0 is used to measure the threat level of that node.

[0148] In practical use, TDH can be used. i Sort the values ​​by priority, TDH i The higher the value, the greater the threat the node poses to the network. Network administrators should adjust the corresponding access permissions and implement more robust security measures.

[0149] After selecting a node, the next step is to determine the number of honeypots to be deployed around it. Deploying more honeypots may make it harder for attackers to find the actual worker nodes and launch an attack, but at the same time, deployment will increase the cost of the system. Many factors influence the cost of each honeypot, such as power consumption, service performance degradation, and increased system complexity. This invention defines the total cost as cost, based on measurements taken in a real-world environment. Let R(N) = ... i The ') represents profit, because successfully protecting nodes is the purpose of a honeypot. The profit calculation formula is:

[0150] R(N i )=C(N i )+TDH i

[0151] On the other hand, the success probability of attacking a node is related to the node's AD (Aspect-Oriented) value. The higher the AD value, the lower the success probability. Therefore, a success probability can be defined. Furthermore, before attackers breach a node, they cannot distinguish between a honeypot and a genuine worker node. Therefore, it can be configured that when there are m honeypots protecting N actual worker nodes... i At that time, N i The probability of successful destruction is

[0152] Finally, the number of honeypots is determined by calculating the revenue F(m) of the protected nodes. The specific formula for calculating F(m) is as follows:

[0153]

[0154] When F(m) is at its maximum, the value of m corresponds to the number of honeypots in the corresponding node.

[0155] After deploying the honeypot, further optimization is possible. Specifically, drawing inspiration from the ant colony optimization algorithm, where ants choose paths based on pheromone concentration—as ants increase pheromone concentration, attracting more ants and creating a positive feedback loop—this can be analogized to the game between the honeypot and the attacker. By incorporating the ant colony optimization algorithm into the honeynet deployment strategy, dynamic optimization of the honeynet can be achieved.

[0156] In specific honeynet optimization strategies, the access volume of honeypots is used as pheromones. The amount of access is used to determine the position of a particular honeypot in the protection process and its protective strength for the entire system, making it easier to assess the value of that honeypot. At the same time, administrators can calculate the optimal attack path based on the access volume to implement security measures or deploy decoy strategies.

[0157] Specifically, some related quantities are defined, specifically τ ij Indicates the pheromone intensity at the node; d ij This represents the distance between node i and node j; This represents the heuristic information for the transition from position i to position j; P ij α represents the probability that an ant at node i will choose to go to node j; α represents the pheromone proportion, i.e., the importance of the pheromone; β represents the heuristic information proportion, i.e., the influence of distance on the choice of the next node; allowed k ρ represents the set of nodes the ant will choose next; ρ represents the pheromone evaporation factor, which affects the convergence speed of the algorithm. A large ρ factor leads to rapid pheromone evaporation and slow convergence, but allows traversal of all paths, achieving a global search. Conversely, a small ρ factor leads to fast convergence but can get stuck in a local search. A value of 0.1 is typically used. k ij (t) represents the transition probability of ant k from i to j. The specific update calculation formula is as follows:

[0158]

[0159] After a certain period of time, the ant colony completes its search of the entire space. Each path contains a certain amount of pheromones. If the pheromone evaporation rate is too slow, excessive pheromones may remain on the paths, thus overwhelming the heuristic information. To avoid this, an optimized interval period needs to be set, i.e., a period of time is set for honeycomb reconstruction to eliminate excessive pheromone overwhelming the heuristic information. Let τ ij (t) represents the pheromone concentration at time n (i,j), and the specific calculation formula is as follows:

[0160] τ ij (t+n)=(1-ρ)τij (t)+Δτ ij

[0161] It uses an ant-cycle update pattern, meaning that the pheromone is only updated when the current cycle ends. Specifically, the update process involves:

[0162]

[0163] Where Q is a constant, representing the total amount of pheromones across all paths, and L... k This represents the distance between node i and node j.

[0164] Furthermore, for honeypots, useful honeypots should be preserved, but access volume is not the sole criterion for judging their value. The most important function of a honeypot is to collect attack data, facilitating analysis and processing by administrators to derive useful attack behaviors. Therefore, the validity of the data is also a crucial factor in evaluating a honeypot. Thus, the updating of pheromones can be redefined based on the percentage of valid data.

[0165] The update rule of the ant colony algorithm is improved accordingly, and the update rule is as follows:

[0166] τ ij (t+n)=(1-ρ)τ ij (t)+Δτ ij +θ

[0167] Among them, E i This represents the amount of usable information in the attack data collected by the honeypots surrounding node i;

[0168] C i This represents the total amount of attack data collected by the honeypots surrounding node i.

[0169] This indicates the proportion of valid data in the total data volume. The larger the value, the more useful data the honeypot collects, and the greater the honeypot's benefits.

[0170] Based on the method for deploying honeypots in a honeycomb provided in the above embodiments, this application also provides specific implementations of an apparatus for deploying honeypots in a honeycomb. Please refer to the following embodiments.

[0171] First see Figure 4 The honeypot deployment device 400 in the honeycomb provided in this application embodiment includes the following modules:

[0172] The acquisition module 401 is used to acquire the number of connections between the target node and other nodes in the honeynet, and to acquire the node threat level of the target node, wherein the target node is any node in the honeynet.

[0173] The calculation module 402 is used to calculate the sum of the number of connections of the target node and the threat level of the target node to obtain the target node importance.

[0174] The determination module 403 is used to determine the number of honeypots corresponding to the target node importance when the node's revenue value is maximized, based on a preset correspondence between node importance, honeypot quantity, and node revenue value.

[0175] Deployment module 404 is used to deploy the number of honeypots on the target node of the honeynet.

[0176] The method described in this application calculates the importance of a node from two aspects: the number of connections between the target node and other nodes in the honeynet, and the node threat level. Then, based on a preset correspondence between node importance, the number of honeypots, and node reward values, the number of honeypots corresponding to the target node's importance at which the node's reward value is maximized is determined. This determines the corresponding number of honeypots for each node in the network, thereby deploying honeypots in the honeynet and obtaining a honeynet composition scheme adapted to the network structure.

[0177] As one implementation of this application, the device 400 for deploying honeypots in a honeycomb also includes:

[0178] The acquisition module is used to acquire the first user permission threat level and the second user permission threat level of the target node, wherein the first user permission and the second user permission have different operation permissions on the target node.

[0179] The selection module is used to take the larger value between the first permission threat level and the second user permission threat level as the node threat level of the target node.

[0180] Within a network node, different user permissions may be set for different types of users, and different user permissions have different operational privileges. The method described in this application obtains the first user permission threat level and the second user permission threat level of the target node, and uses the larger value as the node threat level of the target node. This allows for accurate acquisition of the node threat level even when different user permissions exist within a node.

[0181] As one implementation of this application, the device 400 for deploying honeypots in a honeycomb also includes:

[0182] The acquisition module is used to acquire the probability of acquiring first user permissions, a first threat coefficient corresponding to the probability of acquiring first user permissions, and the probability of acquiring second user permissions, a second threat coefficient corresponding to the probability of acquiring second user permissions.

[0183] The calculation module is used to calculate the product of the first user permission acquisition probability and the first threat coefficient of the target node to obtain the first user permission threat level; and to calculate the product of the second user permission acquisition probability and the second threat coefficient of the target node to obtain the second user permission threat level.

[0184] The method described in this application uses a first threat coefficient and a second threat coefficient to describe the threat level of obtaining the first user permission and the second user permission, and uses the probability of obtaining the first user permission and the probability of obtaining the second user permission to describe the difficulty of obtaining the corresponding user permission. Then, the product of the threat coefficient and the probability of obtaining the user permission is calculated to represent the user permission threat level, thus accurately determining the user permission threat level.

[0185] As one implementation of this application, the device 400 for deploying honeypots in a honeycomb also includes:

[0186] The acquisition module is used to acquire the attack graph corresponding to the network structure of the honeynet. The vertices in the attack graph represent device nodes in the network, and the directed edges in the attack graph represent possible attack paths between nodes.

[0187] The determination module is used to determine the vertex corresponding to each node in the honeynet in the attack graph, and to obtain the number of connections of the target node based on the in-degree of the target vertex.

[0188] The above-described method of this application, by using an attack graph to represent the network structure and by using the attack graph to determine the number of connections of the target node, can more accurately describe the situation where the network is attacked.

[0189] As one implementation of this application, the device 400 for deploying honeypots in a honeycomb also includes:

[0190] The search module is used to search the database for the exploit difficulty of each vulnerability corresponding to the edge in the attack graph that ends at the target node.

[0191] The summation module is used to sum the exploit difficulty of each of the aforementioned vulnerabilities to obtain the path attack difficulty.

[0192] The determination module is used to determine the failure probability of multiple intrusion nodes based on the attack difficulty of the path and the number of multiple initial honeypots.

[0193] The determination module is further configured to determine the target initial honeypot number when the node benefit value is the largest among the node benefit values ​​corresponding to the multiple intrusion node failure probabilities, based on the preset correspondence between node importance, honeypot number, and the intrusion node failure probability and node benefit value, and to use the target initial honeypot number as the honeypot number corresponding to the target node importance.

[0194] The above-described method of this application obtains the difficulty of exploiting vulnerabilities by analyzing the attack graph, thereby determining the path attack difficulty and the failure probability of the intrusion node. This failure probability can be used to more accurately calculate the required number of honeypots.

[0195] As one implementation of this application, the device 400 for deploying honeypots in a honeycomb also includes:

[0196] The acquisition module is used to acquire at least one of the following: the vulnerability's attack vector metric, the attack complexity metric, the privilege requirement metric, and the user interaction metric.

[0197] The calculation module is used to calculate the product of the obtained metric values ​​to obtain the vulnerability exploitation difficulty.

[0198] The above-described method of this application can accurately determine the difficulty of exploiting vulnerabilities by obtaining information related to vulnerability exploitation, such as attack vector metrics, attack complexity metrics, permission requirement metrics, and user interaction metrics.

[0199] As one implementation of this application, the device 400 for deploying honeypots in a honeycomb also includes:

[0200] The acquisition module is used to acquire the initial pheromone of each node in the honeynet, wherein the initial pheromone represents the access volume of the corresponding node.

[0201] The update module is used to obtain the updated pheromones of each node within a preset time period based on the initial pheromones of each node and the principle of least path.

[0202] The removal module is used to remove the pheromone based on a preset pheromone evaporation factor to obtain the target pheromone for each node.

[0203] The determination module is used to determine the path composed of the nodes with the most target pheromones as the optimal attack path.

[0204] The above-described method of this application obtains the initial pheromones of each node in the honeynet and iteratively calculates to determine the optimal attack path. The optimal attack path can be calculated based on the access volume, thereby enabling security protection or the deployment of decoy strategies.

[0205] As one implementation of this application, the device 400 for deploying honeypots in a honeycomb also includes:

[0206] The acquisition module is used to acquire the total amount of attack data collected by each node in the honeycomb and the amount of usable information in the collected attack data. The amount of usable information represents the amount of information in the attack data that is used for analyzing attack behavior.

[0207] The calculation module is used to calculate the ratio of the available information to the total amount of attack data to obtain the honeypot benefit.

[0208] The calculation module is also used to obtain preliminary pheromones based on the current pheromone of the node using the minimum path principle.

[0209] The summation module is used to sum the initial pheromone with the honeypot reward to obtain the updated pheromone.

[0210] The above-described method of this application, by redefining the pheromone update based on the validity ratio of the data during the pheromone update process, can obtain more reasonable pheromone results.

[0211] Each module in the honeypot deployment device in the honeycomb provided in this application embodiment can implement each step in the above-described honeypot deployment method in the honeycomb and achieve the corresponding effect. For the sake of brevity, it will not be described in detail here.

[0212] Figure 5 A schematic diagram of the hardware structure for honeypot deployment in a honeynet provided in this application embodiment is shown.

[0213] Devices deployed in a honeypot within a honeynet may include a processor 501 and a memory 502 storing computer program instructions.

[0214] Specifically, the processor 501 may include a central processing unit (CPU), an application-specific integrated circuit (ASIC), or one or more integrated circuits that can be configured to implement the embodiments of this application.

[0215] Memory 502 may include mass storage for data or instructions. For example, and not limitingly, memory 502 may include a hard disk drive (HDD), floppy disk drive, flash memory, optical disk, magneto-optical disk, magnetic tape, or Universal Serial Bus (USB) drive, or a combination of two or more of these. Where appropriate, memory 502 may include removable or non-removable (or fixed) media. Where appropriate, memory 502 may be internal or external to the integrated gateway disaster recovery device. In a particular embodiment, memory 502 is non-volatile solid-state memory.

[0216] The memory may include read-only memory (ROM), random access memory (RAM), disk storage media devices, optical storage media devices, flash memory devices, and electrical, optical, or other physical / tangible memory storage devices. Therefore, typically, memory includes one or more tangible (non-transitory) computer-readable storage media (e.g., memory devices) encoded with software including computer-executable instructions, and when the software is executed (e.g., by one or more processors), it is operable to perform the operations described with reference to the method of honeypot deployment in a honeynet according to any embodiment of this disclosure.

[0217] The processor 501 reads and executes computer program instructions stored in the memory 502 to implement any of the honeypot deployment methods in the honeynet described in the above embodiments.

[0218] In one example, the devices deployed in the honeypot within the honeynet may also include a communication interface 503 and a bus 510. For example, Figure 5 As shown, the processor 501, memory 502, and communication interface 503 are connected through bus 510 and complete communication with each other.

[0219] The communication interface 503 is mainly used to realize communication between various modules, devices, units and / or equipment in the embodiments of this application.

[0220] Bus 510 includes hardware, software, or both, that couples components of an online data traffic metering device together. For example, and not limitingly, the bus may include an Accelerated Graphics Port (AGP) or other graphics bus, an Enhanced Industry Standard Architecture (EISA) bus, a Front Side Bus (FSB), HyperTransport (HT) interconnect, an Industry Standard Architecture (ISA) bus, an Infinite Bandwidth Interconnect, a Low Pin Count (LPC) bus, a memory bus, a Microchannel Architecture (MCA) bus, a Peripheral Component Interconnect (PCI) bus, a PCI-Express (PCI-X) bus, a Serial Advanced Technology Attachment (SATA) bus, a Video Electronics Standards Association Local (VLB) bus, or other suitable buses, or combinations of two or more of these. Where appropriate, bus 510 may include one or more buses. Although specific buses are described and illustrated in embodiments of this application, any suitable bus or interconnect is contemplated herein.

[0221] Furthermore, in conjunction with the honeypot deployment method in the honeynet described in the above embodiments, this application embodiment can provide a computer storage medium for implementation. This computer storage medium stores computer program instructions; when these computer program instructions are executed by a processor, they implement any of the honeypot deployment methods in the honeynet described in the above embodiments.

[0222] However, it should be clarified that this application is not limited to the specific configurations and processes described above and shown in the figures. Furthermore, for the sake of brevity, detailed descriptions of known methods and techniques are omitted here. In the above embodiments, several specific steps are described and shown as examples. However, the method process of this application is not limited to the specific steps described and shown. Those skilled in the art can make various changes, modifications, and additions, or change the order of steps, after understanding the spirit of this application.

[0223] The functional blocks shown in the above-described structural diagram can be implemented as hardware, software, firmware, or a combination thereof. When implemented in hardware, they can be, for example, electronic circuits, application-specific integrated circuits (ASICs), appropriate firmware, plug-ins, function cards, etc. When implemented in software, the elements of this application are programs or code segments used to perform the required tasks. Programs or code segments can be stored on a machine-readable medium or transmitted over a transmission medium or communication link via data signals carried on a carrier wave. "Machine-readable medium" can include any medium capable of storing or transmitting information. Examples of machine-readable media include electronic circuits, semiconductor memory devices, ROM, flash memory, erasable ROM (EROM), floppy disks, CD-ROMs, optical disks, hard disks, fiber optic media, radio frequency (RF) links, etc. Code segments can be downloaded via computer networks such as the Internet, intranets, etc.

[0224] It should also be noted that the exemplary embodiments mentioned in this application describe methods or systems based on a series of steps or apparatus. However, this application is not limited to the order of the above steps; that is, the steps can be performed in the order mentioned in the embodiments, or in a different order, or several steps can be performed simultaneously.

[0225] The aspects of this application have been described above with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It should be understood that each block in the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing apparatus to produce a machine such that these instructions, executable via the processor of the computer or other programmable data processing apparatus, enable the implementation of the functions / actions specified in one or more blocks of the flowchart illustrations and / or block diagrams. Such a processor can be, but is not limited to, a general-purpose processor, a special-purpose processor, a special application processor, or a field-programmable logic circuit. It is also understood that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can also be implemented by dedicated hardware performing the specified functions or actions, or can be implemented by a combination of dedicated hardware and computer instructions.

[0226] This application may be implemented in other specific forms without departing from its spirit and essential characteristics. For example, the algorithm described in a particular embodiment may be modified without departing from the basic spirit of this application. Therefore, the present embodiments are to be regarded as exemplary rather than limiting in all respects, and the scope of this application is defined by the appended claims rather than the foregoing description, and all changes falling within the meaning and scope of the claims and their equivalents are thus included within the scope of this application.

[0227] Those skilled in the art will understand that the above embodiments are exemplary and not restrictive. Different technical features appearing in different embodiments can be combined to achieve beneficial effects. Based on a study of the drawings, specification, and claims, those skilled in the art should be able to understand and implement other variations of the disclosed embodiments. In the claims, the term "comprising" does not exclude other means or steps; the indefinite article "a" does not exclude a plurality; the terms "first" and "second" are used to identify names and not to indicate any particular order. No reference numerals in the claims should be construed as limiting the scope of protection. The functionality of multiple parts appearing in the claims can be implemented by a single hardware or software module. The appearance of certain technical features in different dependent claims does not mean that these technical features cannot be combined to achieve beneficial effects.

Claims

1. A method for deploying honeypots in a honeycomb, characterized in that, The method includes: The number of connections between a target node and other nodes in the honeynet is obtained, as well as the node threat level of the target node, where the target node is any node in the honeynet. The target node importance is obtained by summing the number of connections of the target node and the threat level of the target node. Based on the preset correspondence between node importance, number of honeypots, and node revenue value, determine the number of honeypots corresponding to the target node importance when the node revenue value is maximized; Deploy the specified number of honeypots on the target node of the honeycomb; The step of determining the number of honeypots corresponding to the target node's importance when the node's revenue value is maximized, based on a preset correspondence between node importance, honeypot quantity, and node revenue value, includes: Obtain the attack graph corresponding to the network structure of the honeynet, where the vertices in the attack graph represent device nodes in the network, and the directed edges in the attack graph represent possible attack paths between nodes; Based on the attack graph, the exploit difficulty of each vulnerability corresponding to the target node is obtained from the database. The difficulty of exploiting each of the aforementioned vulnerabilities is summed to obtain the path attack difficulty. The probability of failure of multiple intrusion nodes is determined by the attack difficulty of the aforementioned path and the number of multiple initial honeypots; Based on the preset correspondence between node importance, number of honeypots, and failure probability of the intrusion node, and node reward value, determine the target initial honeypot number when the node reward value corresponding to the failure probability of the multiple intrusion nodes is the largest, and use the target initial honeypot number as the honeypot number corresponding to the target node importance.

2. The method for deploying honeypots in a honeycomb according to claim 1, characterized in that, Before obtaining the node threat level of the target node, the method further includes: Obtain the first user permission threat level and the second user permission threat level of the target node, wherein the first user permission and the second user permission have different operation permissions on the target node; The larger of the first user permission threat level and the second user permission threat level is taken as the node threat level of the target node.

3. The method for deploying honeypots in a honeycomb according to claim 2, characterized in that, The process of obtaining the first user privilege threat level and the second user privilege threat level of the target node includes: The probability of obtaining first user privileges, a first threat coefficient corresponding to the probability of obtaining first user privileges, and the probability of obtaining second user privileges, a second threat coefficient corresponding to the probability of obtaining second user privileges; The product of the first user permission acquisition probability and the first threat coefficient of the target node is calculated to obtain the first user permission threat level; and the product of the second user permission acquisition probability and the second threat coefficient of the target node is calculated to obtain the second user permission threat level.

4. The method for deploying honeypots in a honeycomb according to claim 3, characterized in that, The first threat coefficient and the second threat coefficient respectively include a direct threat coefficient and an indirect threat coefficient. The direct threat coefficient represents the extent of damage caused by attacking the files stored and programs running within the target node. The indirect threat coefficient represents the extent of damage caused by attacking other nodes in the network through the node after obtaining the relevant permissions of the corresponding node.

5. The method for deploying honeypots in a honeycomb according to claim 1, characterized in that, The step of obtaining the number of connections between the target node in the honeycomb and other nodes in the honeycomb includes: Obtain the attack graph corresponding to the network structure of the honeynet, where the vertices in the attack graph represent device nodes in the network, and the directed edges in the attack graph represent possible attack paths between nodes; The vertex corresponding to each node in the honeynet in the attack graph is determined, and the number of connections of the target node is obtained based on the in-degree of the target vertex.

6. The method for deploying honeypots in a honeycomb according to claim 5, characterized in that, Before retrieving the exploit difficulty of each vulnerability corresponding to an edge in the attack graph from the database based on the edge terminating at the target node, the method further includes: Obtain at least one of the following metrics for the vulnerability: attack vector, attack complexity, privilege requirements, and user interaction. The exploit difficulty of the vulnerability is obtained by multiplying the obtained metric values.

7. The method for deploying honeypots in a honeycomb according to any one of claims 1 to 6, characterized in that, After deploying the specified number of honeypots on the target node of the honeynet, the method further includes: Obtain the initial pheromone of each node in the honeynet, where the initial pheromone represents the access volume of the corresponding node; Based on the initial pheromone of each node, and using the minimum path principle to obtain the updated pheromone of each node within a preset time period; Calculate the pheromone reduction amount corresponding to each node based on the preset pheromone evaporation factor, and reduce the pheromone corresponding to each node according to the pheromone reduction amount to obtain the target pheromone of each node. The path formed by the nodes with the most target pheromones is determined as the optimal attack path.

8. The method for deploying honeypots in a honeycomb according to claim 7, characterized in that, The step of obtaining the updated pheromones of each node within a preset time period based on the initial pheromones of each node and using the minimum path principle includes: Obtain the total amount of attack data collected by each node in the honeycomb and the amount of usable information in the collected attack data. The amount of usable information represents the amount of information in the attack data that is used to analyze the attack behavior. Calculate the ratio of the available information to the total amount of attack data to obtain the honeypot benefit; Based on the current pheromone of the node, the preliminary pheromone is obtained using the minimum path principle; The updated pheromone is obtained by summing the initial pheromone with the honeypot reward.

9. A device for deploying honey pots in a honeycomb, characterized in that, The device includes: The acquisition module is used to acquire the number of connections between a target node and other nodes in the honeynet, and to acquire the node threat level of the target node, wherein the target node is any node in the honeynet; The calculation module is used to calculate the sum of the number of connections of the target node and the threat level of the target node to obtain the target node importance. The determination module is used to determine the number of honeypots corresponding to the target node importance when the node's revenue value is maximized, based on a preset correspondence between node importance, honeypot number, and node revenue value. A deployment module is used to deploy the specified number of honeypots on the target node of the honeynet; The determination module is further configured to obtain an attack graph corresponding to the network structure of the honeynet, wherein the vertices in the attack graph represent device nodes in the network, and the directed edges in the attack graph represent possible attack paths between nodes; based on the edges in the attack graph with the target node as the endpoint, the exploit difficulty of each vulnerability corresponding to the edge is retrieved from the database; the exploit difficulty of each vulnerability is summed to obtain the path attack difficulty; the failure probability of multiple intrusion nodes is determined by the path attack difficulty and multiple initial honeypot numbers; based on the preset correspondence between node importance, honeypot number, intrusion node failure probability, and node reward value, the target initial honeypot number when the node reward value corresponding to the multiple intrusion node failure probabilities is the largest is determined, and the target initial honeypot number is used as the honeypot number corresponding to the target node importance.

10. A device for deploying honeypots in a honeycomb, characterized in that, The device includes: a processor and a memory storing computer program instructions; the processor reads and executes the computer program instructions to implement the method for deploying honeypots in a honeynet as described in any one of claims 1-8.

11. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer program instructions that, when executed by a processor, implement the method for deploying honeypots in a honeynet as described in any one of claims 1-8.

12. A computer program product, characterized in that, When the instructions in the computer program product are executed by the processor of the electronic device, the electronic device causes the electronic device to perform the method for deploying honeypots in a honeynet as described in any one of claims 1-8.

Images