A dynamic honeypot scheduling method and device based on attack attraction

Abstract

The present invention discloses a dynamic honeypot scheduling method and device based on attack attraction in the field of network security defense. The method comprises: obtaining the attack attraction and a set of attack types that can be attracted by each honeypot; in response to a target network being attacked by traffic, obtaining the attack type of the traffic attack; traversing all honeypots and screening the honeypots that have the attack type of the traffic attack in the attack type set; selecting the honeypot with the greatest attack attraction among the screened honeypots as the target honeypot, and migrating the traffic attack to the target honeypot; wherein obtaining the attack attraction of each honeypot comprises: obtaining a network log of the target network; performing feature extraction on the network log and calculating the priority of the honeypot; calculating the similarity score of the honeypot based on the service type list, the attack type list, the service type set, and the attack type set; and calculating the attack attraction of the honeypot based on the priority and similarity score of the honeypot. The present invention greatly improves the authenticity of the constructed honeynet environment.

Description

Technical Field

[0001] The present invention relates to the field of network security defense technology, and in particular to a dynamic honeypot scheduling method and device based on attack attraction. Background Art

[0002] As network security faces ongoing threats, cyberattacks are evolving from simple, single-minded approaches to complex, diverse, and persistent methods. Cyberattacks targeting new power systems are attacks that target the system by unauthorized tracking of communication and control system operations, exploiting security flaws and vulnerabilities in power information and communication networks, with the goal of disrupting or degrading the functionality of power CPSs.

[0003] Honeynet technology has now reached its third generation. Its overall development trend is evolving from honeynets targeting a single attack type to honeynets supporting multiple attack types; from physical honeynets to virtual honeynets; and from static honeynets with passive interaction to dynamic honeynets that can autonomously change state in response to attacks and actively interact. The essence of a honeynet is to set up hosts with system vulnerabilities or traps to deceive attackers and lure them into launching attacks. By monitoring and analyzing attack behavior, attacker intentions and motivations can be elucidated, allowing for timely updates to defense strategies and enhancing system protection capabilities. Honeynets not only improve the ability to capture network attack data but also expand the scope of active network defense. However, as the offensive and defensive confrontation between honeynets and attackers continues to evolve and escalate, traditional honeynet architectures, due to their static nature, blind configuration, complex deployment, difficult maintenance, and insufficient deception, can lead to honeypots being detected and rendered ineffective.

[0004] In terms of power system network security, due to the heterogeneity of the power system network, the diversity of business and the dynamic nature of the topology structure, the authenticity of the constructed honeynet environment is poor, and there are problems with the diversity, dynamics and authenticity of the power system bait environment. Summary of the Invention

[0005] The purpose of the present invention is to overcome the deficiencies in the prior art and provide a dynamic honeypot scheduling method and device based on attack attraction, so as to solve the problem that the honeypot is poorly adaptable to the environment due to the diversity and dynamism of the power business system environment where the honeypot is located, thereby greatly improving the authenticity of the constructed honeynet environment.

[0006] To achieve the above object, the present invention is implemented by adopting the following technical solutions:

[0007] In a first aspect, the present invention provides a dynamic honeypot scheduling method based on attack attractiveness, comprising:

[0008] Obtain the attack attractiveness of each honeypot and the set of attack types it can attract;

[0009] In response to a target network being attacked by traffic, obtaining an attack type of the traffic attack;

[0010] Traverse all honeypots and filter out honeypots with the attack type of the traffic attack in the attack type set;

[0011] The honeypot with the greatest attack attractiveness among the screened honeypots is selected as the target honeypot, and the traffic attack is migrated to the target honeypot.

[0012] Optionally, obtaining the attack attractiveness of each honeypot includes:

[0013] Obtain network logs of the target network;

[0014] Performing feature extraction on the network log to obtain target features, and calculating the priority of the honeypot according to the target features;

[0015] Obtain a list of real business service types and a list of attack types suffered by the enterprise from the target security product;

[0016] Obtain a set of service types that each honeypot can have, and calculate a similarity score of the honeypot based on the service type list, the attack type list, the service type set, and the attack type set;

[0017] The attack attractiveness of a honeypot is calculated based on its priority and similarity scores.

[0018] Optionally, extracting features from the network log to obtain target features includes:

[0019] From the current moment, within the preset unit time, query the number of log entries that meet the IP_dst=HPOTn_ip and Port_dst=HPOTn_port from the network log. ; Among them, IP_dst and Port_dst are the target IP address and target port number, HPOTn_ip and HPOTn_port are the IP address and port number of honeypot number n;

[0020] Calculate the access frequency of honeypot n per unit time based on the number of log entries :

[0021] ;

[0022] Where, From the current moment From now on, in the preset unit time The number of logs that meet the matching conditions within a unit time The unit is minutes;

[0023] The current moment and its corresponding access frequency Store in the database, and store the access frequency in the database The maximum value is recorded as the highest historical access frequency ;

[0024] The access frequency of honeypot n and the highest frequency of visits in history as the target feature.

[0025] Optionally, the priority of the honeypot is:

[0026] ;

[0027] Where, is the priority of honeypot n, current time The corresponding access frequency and the highest historical access frequency, is the weight of the preset honeypot number n, the access frequency and the highest historical access frequency is the target feature.

[0028] Optionally, obtaining a service type list of real business services and a list of attack types suffered by the enterprise from the target security product includes:

[0029] Derive the service types of real business services from asset management security products, select the m service types with the highest priority, organize these m service types into a service type list in ascending order of priority, and label these m service types with serial numbers from 1 to m.

[0030] Derive the attack types suffered by the enterprise from situational awareness security products, select the m attack types with the highest priority, organize these m attack types into an attack type list in ascending order of priority, and mark these m attack types with serial numbers from 1 to m in sequence.

[0031] Optionally, the calculation of the honeypot similarity score includes:

[0032] Get the intersection element of the service type list and the service type array, and sum the sequence numbers of the intersection elements in the service type list to obtain the sum result ;

[0033] Get the intersection element of the attack type list and the attack type array, and sum the sequence numbers of the intersection elements in the attack type list to obtain the sum result ;

[0034] According to the summation results 、 Calculating the similarity score of the honeypot :

[0035] ;

[0036] Where, is the similarity score of honeypot n, are the weights of service type and attack type, .

[0037] Optionally, the attack attractiveness of the honeypot is:

[0038] ;

[0039] Where, Score the attack attractiveness, priority, and similarity of honeypot n.

[0040] Optionally, migrating the traffic attack to a target honeypot includes:

[0041] Obtain the attacker IP address and attacker port number of the traffic attack, the target honeypot IP address and target honeypot port number;

[0042] Forward the attack traffic sent from the attacker's IP address and attacker's port number to the target honeypot IP address and target honeypot port number.

[0043] In a second aspect, the present invention provides a dynamic honeypot scheduling device based on attack attraction, the dynamic honeypot scheduling device comprising:

[0044] An information acquisition module is configured to obtain the attack attractiveness of each honeypot and the set of attack types that can be attracted;

[0045] an attack response module, configured to obtain an attack type of the traffic attack in response to a target network being attacked by traffic;

[0046] A honeypot screening module is configured to traverse all honeypots and screen honeypots having the attack type of the traffic attack in the attack type set;

[0047] The attack migration module is configured to select the honeypot with the greatest attack attractiveness from the screened honeypots as the target honeypot, and migrate the traffic attack to the target honeypot.

[0048] Optionally, obtaining the attack attractiveness of each honeypot includes:

[0049] Obtain network logs of the target network;

[0050] Performing feature extraction on the network log to obtain target features, and calculating the priority of the honeypot according to the target features;

[0051] Obtain a list of real business service types and a list of attack types suffered by the enterprise from the target security product;

[0052] Obtain a set of service types that each honeypot can have, and calculate a similarity score of the honeypot based on the service type list, the attack type list, the service type set, and the attack type set;

[0053] The attack attractiveness of a honeypot is calculated based on its priority and similarity scores.

[0054] Compared with the prior art, the present invention has the following beneficial effects:

[0055] The present invention provides a dynamic honeypot scheduling method and device based on attack attractiveness. The method collects network log data, extracts honeypot access frequency characteristics based on the network log data, and calculates the honeypot access priority based on the frequency characteristics. The honeypot comprehensive similarity score is calculated based on the degree of match between the honeypot and the real business and attack situation. The attack attractiveness of the honeypot is determined based on the honeypot access priority and the honeypot comprehensive similarity score. Traffic is then migrated to the honeypot through a dynamic honeypot scheduling method based on the honeypot attack attractiveness. This solves the problem of poor adaptability between the honeypot and the environment caused by the diversity and dynamic nature of the power business system environment where the honeypot is located, and greatly improves the authenticity of the constructed honeynet environment. The device can achieve the same technical effects by using the above method. BRIEF DESCRIPTION OF THE DRAWINGS

[0056] Figure 1 1 is a flow chart of a dynamic honeypot scheduling method based on attack attractiveness provided by an embodiment of the present invention;

[0057] Figure 2 1 is a flow chart of obtaining the attack attractiveness of each honeypot according to an embodiment of the present invention;

[0058] Figure 3 It is a structural diagram of a dynamic honeypot scheduling device based on attack attraction provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0059] The present invention will be further described below in conjunction with the accompanying drawings. The following embodiments are only used to more clearly illustrate the technical solutions of the present invention and are not intended to limit the scope of protection of the present invention.

[0060] Example 1:

[0061] like Figure 1 As shown, the embodiment of the present invention provides a dynamic honeypot scheduling method based on attack attractiveness, comprising the following steps:

[0062] Step S1: Obtain the attack attraction of each honeypot and the set of attack types that can be attracted.

[0063] Step S2: In response to the target network being attacked by traffic, the attack type of the traffic attack is obtained.

[0064] Step S3: traverse all honeypots and filter out honeypots with attack types of traffic attacks in the attack type set.

[0065] Step S4: The honeypot with the greatest attack attractiveness among the screened honeypots is selected as the target honeypot, and the traffic attack is migrated to the target honeypot.

[0066] like Figure 2 As shown, specifically in this embodiment, obtaining the attack attractiveness of each honeypot includes the following steps:

[0067] Step S1.1: Obtain the network log of the target network.

[0068] Deploy a network log collection module on the target network to collect network logs in real time. The data types to be collected include: source IP address (IP_src), destination IP address (IP_dst), source port number (Port_src), destination port number (Port_dst), transport protocol (Protocol), honeypot IP address number n (HPOTn_ip), and honeypot port number n (HPOTn_port).

[0069] Step S1.2: Extract features from the network log to obtain target features, and calculate the priority of the honeypot based on the target features.

[0070] Specifically in this embodiment, extracting features from network logs to obtain target features, and calculating the priority of the honeypot based on the target features includes:

[0071] Step S1.2.1: From the current moment, within the preset unit time, query the network log for the number of log entries that match IP_dst=HPOTn_ip and Port_dst=HPOTn_port. ; Among them, IP_dst and Port_dst are the target IP address and target port number, HPOTn_ip and HPOTn_port are the nth honeypot IP address and nth honeypot port number;

[0072] Step S1.2.2: Calculate the access frequency of honeypot n per unit time based on the number of log entries. :

[0073] ;

[0074] Where, From the current moment From now on, in the preset unit time The number of logs that meet the matching conditions within a unit time The unit is minutes;

[0075] Step S1.2.3: Set the current time and its corresponding access frequency Store in the database, and store the access frequency in the database The maximum value is recorded as the highest historical access frequency ;

[0076] Step S1.2.4: The access frequency of honeypot n and the highest frequency of visits in history as the target feature.

[0077] Step S1.2.5: Calculate the priority of the honeypot based on the target features. The priority of the honeypot is:

[0078] ;

[0079] Where, is the priority of honeypot n, current time The corresponding access frequency and the highest historical access frequency, is the weight of the preset honeypot number n.

[0080] Weight Represents the importance that system administrators attach to different honeypots. It will only increase and ≥ 0, so the weight The bigger, Increase the time By default, each application layer decoy has the same weight. Users can customize it based on the severity of the vulnerability represented by different application layer decoys.

[0081] Complete honeypot access priority After the calculation, the honeypot configuration goal is to make the state of the honeynet and the business network state at the time of the current attack as consistent as possible. This will ensure that the attacker's network context before and after the migration is as similar as possible, ensuring the honeynet's camouflage capability. Therefore, it is necessary to calculate the similarity score between N honeypots and the business.

[0082] Step S1.3: Obtain a list of service types for real business services and a list of attack types suffered by the enterprise from the target security product, specifically including:

[0083] Derive the service types of real business services from asset management security products, select the m service types with the highest priority, organize these m service types into a service type list in ascending order of priority, and label these m service types with serial numbers from 1 to m.

[0084] Derive the attack types suffered by the enterprise from situational awareness security products, select the m attack types with the highest priority, organize these m attack types into an attack type list in ascending order of priority, and mark these m attack types with serial numbers from 1 to m in sequence.

[0085] Step S1.4: Obtain the service type set that each honeypot can possess, and calculate the similarity score of the honeypot based on the service type list, attack type list, service type set, and attack type set.

[0086] Specifically in this embodiment, calculating the similarity score of the honeypot includes:

[0087] Step S1.4.1: Get the intersection elements of the service type list and the service type array, and sum the sequence numbers of the intersection elements in the service type list to obtain the sum result. ;

[0088] Step S1.4.2: Get the intersection element of the attack type list and the attack type array, and sum the sequence numbers of the intersection elements in the attack type list to obtain the sum result. ;

[0089] Step S1.4.3, based on the summation result 、 Calculating the similarity score of the honeypot :

[0090] ;

[0091] Where, is the similarity score of honeypot n, are the weights of service type and attack type, .

[0092] User sets service type weight and attack type weight , according to practical experience, The recommended value is [0.53, 0.68], The recommended value is [0.32, 0.47].

[0093] Step S1.5: Calculate the attack attractiveness of the honeypot based on the honeypot priority and similarity score.

[0094] The attack attractiveness of a honeypot is:

[0095] ;

[0096] Where, Score the attack attractiveness, priority, and similarity of honeypot n.

[0097] It is worth mentioning that The value of is not a fixed value, but changes with the service type list of real business services in the user's real business environment and the list of attack types suffered by the enterprise. According to practical experience, it is recommended that the calculation interval should not exceed 48 hours.

[0098] Specifically in this embodiment, the attack type of the traffic attack can be obtained through existing mature technical solutions such as common security products such as WAF, IDS, IPS, etc.

[0099] Specifically in this embodiment, migrating the traffic attack to the target honeypot includes:

[0100] 1) Obtain the attacker's IP address and port number of the traffic attack, and the target honeypot's IP address and port number;

[0101] 2) Forward the attack traffic sent from the attacker's IP address and attacker's port number to the target honeypot IP address and target honeypot port number.

[0102] Example 2:

[0103] like Figure 3 As shown, an embodiment of the present invention provides a dynamic honeypot scheduling device based on attack attraction, and the dynamic honeypot scheduling device includes:

[0104] An information acquisition module is configured to obtain the attack attractiveness of each honeypot and the set of attack types that can be attracted;

[0105] an attack response module configured to obtain an attack type of the traffic attack in response to a traffic attack on a target network;

[0106] The honeypot screening module is configured to traverse all honeypots and screen honeypots with attack types of traffic attacks in the attack type set;

[0107] The attack migration module is configured to take the honeypot with the greatest attack attractiveness among the screened honeypots as the target honeypot and migrate the traffic attack to the target honeypot.

[0108] Specifically, obtaining the attack attractiveness of each honeypot includes:

[0109] Obtain network logs of the target network;

[0110] Perform feature extraction on network logs to obtain target features, and calculate the priority of the honeypot based on the target features;

[0111] Obtain a list of real business service types and a list of attack types suffered by the enterprise from the target security product;

[0112] Obtain the service type set that each honeypot can have, and calculate the similarity score of the honeypot based on the service type list, attack type list, service type set, and attack type set;

[0113] The attack attractiveness of a honeypot is calculated based on its priority and similarity scores.

[0114] In summary, the present application provides a dynamic honeypot scheduling method and device based on attack attractiveness, which collects network log data, extracts honeypot access frequency characteristics based on the network log data, and calculates the honeypot access priority through the frequency characteristics; calculates the honeypot comprehensive similarity score through the degree of matching between the honeypot and the real business and attack situation; obtains the attack attractiveness of the honeypot based on the honeypot access priority and the honeypot comprehensive similarity score, and migrates the traffic to the honeypot through the dynamic honeypot scheduling method based on the honeypot attack attractiveness, thereby solving the problem that the diversity and dynamism of the power business system environment where the honeypot is located leads to poor adaptability of the honeypot to the environment, thereby greatly improving the authenticity of the constructed honeynet environment.

[0115] Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, systems, or computer program products. Thus, the present invention may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0116] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowcharts and / or block diagrams, as well as combinations of processes and / or blocks in the flowcharts and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowcharts and / or block diagrams. Figure 1 a process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0117] These computer program instructions may also be stored in a computer readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 a process or multiple processes and / or boxes Figure 1 The function specified in one or more boxes.

[0118] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing the instructions executed on the computer or other programmable device for implementing the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0119] The above is only a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the technical principles of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

Claims

1. A dynamic honeypot scheduling method based on attack attractiveness, characterized in that: include: Obtain the attack attractiveness of each honeypot and the set of attack types it can attract; In response to a target network being attacked by traffic, obtaining an attack type of the traffic attack; Traverse all honeypots and filter out honeypots with the attack type of the traffic attack in the attack type set; The honeypot with the greatest attack attractiveness among the screened honeypots is selected as the target honeypot, and the traffic attack is migrated to the target honeypot; The step of obtaining the attack attractiveness of each honeypot includes: Obtain network logs of the target network; Extracting features from the network log to obtain target features, and calculating the priority of the honeypot based on the target features; the target features include the access frequency of the honeypot; Obtain a list of real business service types and a list of attack types suffered by the enterprise from the target security product; Obtain a set of service types that each honeypot can have, and calculate a similarity score of the honeypot based on the service type list, the attack type list, the service type set, and the attack type set; Calculate the attack attractiveness of a honeypot based on its priority and similarity scores; The calculation of the honeypot similarity score includes: Get the intersection element of the service type list and the service type set, and sum the sequence numbers of the intersection elements in the service type list to obtain the sum result ; Get the intersection element of the attack type list and the attack type set, and sum the sequence numbers of the intersection elements in the attack type list to obtain the sum result ; According to the summation results 、 Calculate the similarity score of the honeypot; The sequence numbers in the service type list are related to the service type priority, and the sequence numbers in the attack type list are related to the attack type priority.

2. The dynamic honeypot scheduling method based on attack attractiveness according to claim 1 is characterized in that: The extracting features from the network log to obtain target features includes: From the current moment, within the preset unit time, query the number of log entries that meet the IP_dst=HPOTn_ip and Port_dst=HPOTn_port from the network log. ; Among them, IP_dst and Port_dst are the target IP address and target port number, HPOTn_ip and HPOTn_port are the IP address and port number of honeypot number n; Calculate the access frequency of honeypot n per unit time based on the number of log entries : ； Where, From the current moment From now on, in the preset unit time The number of logs that meet the matching conditions within a unit time The unit is minutes; The current moment and its corresponding access frequency Store in the database, and store the access frequency in the database The maximum value is recorded as the highest historical access frequency ; The access frequency of honeypot n and the highest frequency of visits in history as the target feature.

3. The dynamic honeypot scheduling method based on attack attractiveness according to claim 1 is characterized in that: The priorities of the honeypots are: ； Where, is the priority of honeypot n, current time The corresponding access frequency and the highest historical access frequency, is the weight of the preset honeypot number n, the access frequency and the highest historical access frequency is the target feature.

4. The dynamic honeypot scheduling method based on attack attractiveness according to claim 1 is characterized in that: The service type list of real business services obtained from the target security product and the attack type list suffered by the enterprise include: Derive the service types of real business services from asset management security products, select the m service types with the highest priority, organize these m service types into a service type list in ascending order of priority, and label these m service types with serial numbers from 1 to m. Derive the attack types suffered by the enterprise from situational awareness security products, select the m attack types with the highest priority, organize these m attack types into an attack type list in ascending order of priority, and mark these m attack types with serial numbers from 1 to m in sequence.

5. The dynamic honeypot scheduling method based on attack attractiveness according to claim 1 is characterized in that: Similarity score of the honeypot for: ； Where, is the similarity score of honeypot n, are the weights of service type and attack type, .

6. The dynamic honeypot scheduling method based on attack attractiveness according to claim 1 is characterized in that: The attack attractiveness of the honeypot is: ； Where, Score the attack attractiveness, priority, and similarity of honeypot n.

7. The dynamic honeypot scheduling method based on attack attractiveness according to claim 1 is characterized in that: Migrating the traffic attack to the target honeypot includes: Obtain the attacker IP address and attacker port number of the traffic attack, the target honeypot IP address and target honeypot port number; Forward the attack traffic sent from the attacker's IP address and attacker's port number to the target honeypot IP address and target honeypot port number.

8. A dynamic honeypot scheduling device based on attack attraction, characterized in that: The dynamic honeypot scheduling device includes: The information acquisition module is configured to obtain the attack attractiveness of each honeypot and the set of attack types that can be attracted; the acquisition of the attack attractiveness of each honeypot includes: Obtain network logs of the target network; Extracting features from the network log to obtain target features, and calculating the priority of the honeypot based on the target features; the target features include the access frequency of the honeypot; Obtain a list of real business service types and a list of attack types suffered by the enterprise from the target security product; Obtain a set of service types that each honeypot can have, and calculate a similarity score of the honeypot based on the service type list, the attack type list, the service type set, and the attack type set; Calculate the attack attractiveness of a honeypot based on its priority and similarity scores; The calculation of the honeypot similarity score includes: Get the intersection element of the service type list and the service type set, and sum the sequence numbers of the intersection elements in the service type list to obtain the sum result ; Get the intersection element of the attack type list and the attack type set, and sum the sequence numbers of the intersection elements in the attack type list to obtain the sum result ; According to the summation results 、 Calculate the similarity score of the honeypot; The sequence numbers in the service type list are related to the service type priority, and the sequence numbers in the attack type list are related to the attack type priority; an attack response module, configured to obtain an attack type of the traffic attack in response to a target network being attacked by traffic; A honeypot screening module is configured to traverse all honeypots and screen honeypots having the attack type of the traffic attack in the attack type set; The attack migration module is configured to select the honeypot with the greatest attack attractiveness from the screened honeypots as the target honeypot, and migrate the traffic attack to the target honeypot.

Images