A triple access control method based on pre-honey court

Abstract

The present invention discloses a triple access control method based on a front-end honey court. By extending the IP black and white list function, an IP black and white list library is established. According to user needs, the black and white list IPs are customized, and filtering is performed according to the source IP of the request. The access of the blacklist IP to the business system is blocked, and the access of the whitelist IP to the business system is released, without going through the white protocol module and the access control of the reputation score. By extending the white protocol function, after the access request passes the IP black and white list filtering, if the IP is not a whitelist IP, it needs to go through the access control of the white protocol again. By extending the reputation score calculation function, according to the request behavior, the identity authentication result of the honey hole server, the feedback of the white protocol function and the user setting, the reputation score of the IP address is flexibly adjusted, and the access rights to the business system are opened based on the reputation score, thereby realizing flexible access control. The present invention improves the defense capability of the network through this multi-level filtering mechanism.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a triple access control method based on a front-end honey court. Background Art

[0002] Front Honey Court is a secure reverse proxy server. As a front proxy for the back-end server cluster, it has functions such as reverse proxy, trapping monitoring, content anomaly monitoring, and traffic forwarding. Front Honey Court can configure the reverse proxy service, listen to the specified IP address and port, and forward the traffic to another specified IP address and port to achieve proxy forwarding of traffic. In this process, the traffic will pass through the content anomaly detection of the Front Honey Court, and the traffic will be detected based on static rule matching. If the traffic contains specific strings or patterns, it will violate the detection rules and trigger the alarm of the Front Honey Court system. The traffic will be blocked in time, and the abnormal traffic will no longer be able to access, avoiding its harm to the normal business system. In addition, the Front Honey Court system has a built-in mixing line file. When the file is opened, it will trigger an alarm, notify the system administrator in time, and respond to the emergency, so that internal security can be controlled. The Front Honey Court system that implements the above functions has the following advantages:

[0003] 1. Powerful detection capabilities: The Frontend MiTing system has a large set of rules that can defend against various common web application attacks, such as SQL injection, cross-site scripting (XSS), session hijacking, etc.

[0004] 2. Low performance overhead: The content anomaly detection overhead of the front-end MiTing system is relatively small and will not significantly affect the performance of normal business systems.

[0005] 3. High concurrency processing: The front-end Honey Court system can handle a large number of concurrent connections, effectively manage and distribute requests, and can handle high-load network traffic.

[0006] 4. SSL / TLS support: The front-end MiTing system can handle HTTPS traffic and provide secure encrypted communication. It can terminate SSL / TLS connections and decrypt and encrypt them, forwarding requests to the back-end server, thus providing a secure communication channel.

[0007] 5. Dynamic request processing: The front-end MiTing system supports dynamically forwarding requests to back-end application servers such as PHP, Python, Node.js, etc. It can be used in conjunction with the back-end application server to achieve flexible request processing and dynamic content generation.

[0008] 6. Flexible configuration and scalability: The configuration of the front-end MiTing system is simple and clear, easy to understand and maintain. It also supports a rich modular architecture, and its functions can be expanded by loading different modules to meet the requirements of different scenarios and needs.

[0009] The application layer protocol is the highest layer in the network protocol stack and is responsible for providing network communication services to applications. These protocols define how data is encapsulated, transmitted, and decoded to ensure that data can be exchanged correctly on the network. The following are some widely used application layer protocols:

[0010] 1.HTTP (Hypertext Transfer Protocol): It is a protocol used to transfer hypertext from the Internet to the local browser and is the basis of data communication.

[0011] 2.HTTPS (Secure Hypertext Transfer Protocol): Provides an encryption layer through SSL / TLS based on HTTP to ensure the security of data transmission.

[0012] 3.SSH (Secure Shell Protocol): Provides secure network service access and other security operations.

[0013] 4.Telnet: A network protocol used to remotely log in to a server and execute commands.

[0014] 5. DNS (Domain Name System Protocol): Converts domain names into IP addresses.

[0015] 6.FTP (File Transfer Protocol): used to transfer files between computers on the network.

[0016] 7.SMTP (Simple Mail Transfer Protocol): responsible for sending emails.

[0017] These protocols play a key role in network communications, but they also provide attackers with multiple potential attack vectors. For example, SQL injection attacks, cross-site scripting (XSS), and distributed denial of service (DDoS) attacks are all common attack methods targeting application layer protocols.

[0018] The current access control of the front-end honey court still has some shortcomings and limitations, including the following aspects:

[0019] 1. Protocol Filtering Limitations: Front-End MiTing's current content anomaly detection module may have limitations when processing diverse and complex application layer protocols, making it difficult to accurately filter and identify specific protocols. This may lead to insufficient system flexibility and the inability to implement fine-grained access control.

[0020] 2. Potential risks of protocol abuse: For example, attackers can transmit non-HTTP protocol traffic in HTTP proxy services. This behavior may bypass designed security checks and introduce unexpected security threats, thereby increasing the possibility of system attacks.

[0021] 3. Lack of historical behavior tracking: When a historical attacker initiates normal access to collect information, the existing front-end MiTing system cannot realize that the IP has previously engaged in attack behavior when performing reverse proxy. This may cause system information to continue to be exposed to previous attackers, thereby causing the attacker to launch further attacks.

[0022] The main reasons for the above shortcomings include two aspects:

[0023] (1) The current content anomaly detection module of the front-end honey court cannot achieve access control for the protocol. The content anomaly detection of the front-end honey court is only based on static rule matching to analyze whether the request is a malicious request and then perform access control.

[0024] (2) The current reverse proxy function of the Front Honey Court system cannot track or remember historical attack behaviors. The reverse proxy function of the Front Honey Court cannot identify the IP address that initiates malicious access and can only perform access control on current requests. Summary of the Invention

[0025] The purpose of the present invention is to provide a triple access control method based on the front honey court, so that the front honey court system can perform more fine-grained access control on requests. Based on the IP black and white list method, the black and white list IPs can be customized according to user needs, an IP blacklist library can be established, and access to the blacklisted IPs can be blocked in a timely manner to prevent the system information from being further exposed to historical attackers and avoid further attacks. For the whitelisted IPs, they do not need to be filtered by the white protocol module and the calculation of the reputation score, which can increase the request speed of the trusted IPs; based on the white protocol method, the front honey court only allows the specified white protocol traffic to pass, and according to the calculation of the reputation score, combined with multiple rounds of identity authentication of the honey hole server, it can limit the attacker's access to resources, achieve more fine-grained access control, avoid protocol abuse, and reduce the risk of attacks on the business system.

[0026] In order to achieve the above object, the present invention provides the following technical solution: a triple access control method based on a pre-honey court, the access control method comprising the following steps:

[0027] S1: The front-end MiTing system monitors traffic on specific ports. For each access request, it is first filtered by the IP blacklist and whitelist modules to perform preliminary access control on the traffic. It directly blocks access requests from blacklisted IPs and directly allows access requests from whitelisted IPs without going through the subsequent white protocol module and reputation score calculation module.

[0028] S2: After the IP blacklist and whitelist module completes the initial access control, the traffic will enter the white protocol module for further filtering. The front-end honey court system only allows the white protocol type traffic configured by the proxy service to pass;

[0029] S3: The front-end Honey Court system directs the request to the Honey Hole server. The page specifies the next access address of the real business to be accessed. The rest of the page contains floating code that the attacker needs to download and execute. The floating code is delivered to the attacking side to obtain the attacker's information and verify the user's identity. If the attacker does not execute the code, the corresponding reputation score will be deducted. The IP that passes the Honey Hole server authentication will have its reputation score increased.

[0030] S4: The final reputation score is calculated based on the authentication status of the honeyhole server, the requested access behavior, the filtering status of the white protocol module, and the score set by the user. Access rights to the business system are dynamically opened based on the reputation score, and the source IP is automatically added to the blacklist when the reputation score drops to the threshold, implementing automated access control.

[0031] Furthermore, in step S1, after filtering by the IP blacklist and whitelist module, preliminary access control is performed on the traffic, including the following steps:

[0032] Step S11: The IP blacklist and whitelist module creates an IP blacklist and whitelist database that supports dynamic updates and is used to store the blacklist and whitelist IPs;

[0033] Step S12: When a request is made to access the designated listening port, it is filtered by the IP blacklist and whitelist module. If the source IP of the request is a blacklist IP, the front-end honey court system will directly block the access; if the source IP of the request is a whitelist IP, the front-end honey court system will directly release the request without going through the whitelist protocol access control and reputation score calculation;

[0034] Step S13: If the source IP of the request is neither a blacklist IP nor a whitelist IP, the traffic will continue to be filtered by the next white protocol module.

[0035] Furthermore, the IP blacklist and whitelist module can also customize the blacklist and whitelist IPs in the IP blacklist and whitelist database by manually adding them, thereby realizing dynamic expansion of the IP blacklist and whitelist module.

[0036] Furthermore, in step S2, after the IP blacklist and whitelist module completes the initial access control, the traffic will enter the white protocol module for further filtering. The front-end honey court system only allows the white protocol type traffic configured by the proxy service to pass, including the following steps:

[0037] The front-end MiTing system conducts a detailed review of the traffic based on the whitelist protocol type set in the configuration file; if it detects that the requested application layer protocol does not belong to the whitelist protocol, the system will immediately block the request and deduct the reputation score of the source IP accordingly, while recording the historical attack behavior of the source IP to form a memory of the IP behavior; on the contrary, if the requested application layer protocol conforms to the whitelist protocol, the traffic will be allowed to continue to be transmitted.

[0038] Furthermore, in step 4, the final reputation score is calculated based on the authentication status of the honeyhole server, the requested access behavior, the filtering status of the white protocol module, and the score set by the user. Access rights to the business system are dynamically opened based on the reputation score, including the following steps:

[0039] The behavior and reputation of each network entity IP address are quantified through the reputation score calculation formula. The formula is defined as: Reputation score = (Honeyhole reputation coefficient * Honeyhole verification score) + (Behavior reputation coefficient * Behavior score) + (White protocol reputation coefficient * White protocol score) + (User reputation coefficient * User feedback score). Each score accounts for 25 points out of a full 100 points. The reputation coefficient of each part is regulated by the administrator. Based on the coefficient ratio, the priority of the front-end Honey Court system access control is customized. Initially, the reputation score of each part is 10.

[0040] Honeyhole verification score: After passing through the IP blacklist and whitelist modules and the white protocol module, traffic will be directed to the Honeyhole server. The page displayed by the Honeyhole server is a verification function for accessing normal business systems. The verification method can be differentiated according to the sensitivity of different access content. Normal users with insufficient reputation will directly participate in verification. If they pass the Honeyhole identity verification, they will be directed to the normal page and their reputation will be improved. For attackers, once they participate in verification, their information will be obtained by the Honeyhole. If the attacker does not participate in verification, they will not be able to take the next step and their reputation will be reduced.

[0041] The behavior score is dynamically assessed by the content anomaly detection module of the front-end MiTing system based on the rules. It monitors access requests and deducts points for violations of the rules. The system deducts different points based on the severity of the violation.

[0042] The white protocol score is evaluated based on whether the request complies with the preset whitelist protocol, and points are deducted for non-white protocol requests;

[0043] User feedback scores provide users with customization space to adapt to different business needs and security policies;

[0044] The Front-End MiTing system will determine the scope of business resources that an IP address can access based on different credibility scores; IP addresses with lower scores will be subject to more access restrictions, and when any part of the score drops to zero or the threshold, the system will automatically mark the IP address as blacklisted and store it in the IP blacklist and whitelist library, restricting its access to all business resources.

[0045] In the above technical solution, the technical effects and advantages provided by the present invention are:

[0046] 1. This invention expands the white protocol module for the Pre-Honey Court system, effectively addressing the shortcomings of the Pre-Honey Court system in application layer protocol access control. Users can explicitly specify the whitelist protocols allowed in the Pre-Honey Court system configuration file, thereby achieving fine-grained access control of access requests, thereby improving system security and providing users with more flexible configuration options to meet security requirements in different scenarios;

[0047] 2. This invention further strengthens the IP blacklist and whitelist module of the front-end MiTing system, enabling it to support user-defined blacklist and whitelist IPs, achieving more flexible and dynamic IP access control; this module records malicious IPs through the IP blacklist and whitelist database, providing powerful support for access control in different environments and effectively responding to various security challenges;

[0048] 3. The present invention introduces a reputation score mechanism, which implements business resource access restriction based on reputation scores by calculating the reputation scores of four parts, supports user feedback scores, and makes access control to business resources more flexible and controllable. BRIEF DESCRIPTION OF THE DRAWINGS

[0049] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments. Obviously, the drawings described below are only some embodiments described in the present invention. For ordinary technicians in this field, other drawings can also be obtained based on these drawings.

[0050] Figure 1 Flowchart of the triple access control method based on the front honey court of the present invention;

[0051] Figure 2 This is a flowchart of the implementation of the IP blacklist and whitelist module of the present invention;

[0052] Figure 3 This is a flowchart of the implementation of the white protocol module of the present invention;

[0053] Figure 4 This is a flow chart of the credit score calculation of the present invention. DETAILED DESCRIPTION

[0054] To make the objectives, technical solutions, and advantages of the embodiments of the present invention more clear, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. All other embodiments obtained by ordinary technicians in this field based on the embodiments of the present invention without making any creative efforts shall fall within the scope of protection of the present invention.

[0055] Example: See Figure 1 As shown in the figure, the triple access control method based on the front-end honey court described in this embodiment includes an IP blacklist and whitelist module, a white protocol module, and a reputation score calculation module. The overall process is that the front-end honey court system monitors traffic on specific ports. Each access request is first filtered by the IP blacklist and whitelist modules to perform preliminary access control on the traffic. Access requests from blacklisted IPs are directly blocked, while access requests from whitelisted IPs are directly allowed, without passing through the subsequent white protocol module and reputation score calculation module. If the request source IP is neither blacklisted nor whitelisted, it will be filtered by the white protocol module. The front-end honey court system only allows traffic of the white protocol type configured for the proxy service to pass. Finally, the front-end honey court system directs the request to the honey hole server. The page specifies the next access address of the actual service to be accessed. The rest of the page contains floating code that the attacker needs to download and execute. The floating code is delivered to the attacking side to obtain attacker information and verify the user's identity. If the attacker does not execute the code, the corresponding reputation score is deducted. IPs that pass the honey hole server's authentication will have their reputation score increased. Finally, the final reputation score is calculated by combining the honeyhole server's authentication status, the requested access behavior, the filtering status of the white protocol module, and the user-defined score. Access to the business system is dynamically granted based on the reputation score, and the source IP address is automatically blacklisted when the reputation score drops below a threshold, implementing automated access control. Through this multi-layered filtering mechanism, the present invention aims to improve the network's defense capabilities, effectively isolate malicious traffic, and ensure the stable operation of the business system.

[0056] The present invention establishes an IP black and white list library by extending the IP black and white list function. According to user needs, the black and white list IPs are customized, filtered according to the source IP of the request, blocking the access of the blacklist IP to the business system and allowing the access of the whitelist IP to the business system without going through the white protocol module and the access control of the reputation score. By extending the white protocol function, after the access request passes the IP black and white list filtering, if the IP address is not a whitelist IP, it needs to go through the access control of the white protocol again. By extending the reputation score calculation function, according to the request behavior, the identity authentication result of the honeyhole server, the feedback of the white protocol function and the user setting, the reputation score of the IP address is flexibly adjusted, and the access rights to the business system are opened based on the reputation score, thereby realizing flexible access control.

[0057] See also Figure 2 As shown in the figure, for each access request, it is first filtered by the IP blacklist and whitelist module to perform preliminary access control on the traffic, including the following steps:

[0058] The IP blacklist and whitelist module needs to create an IP blacklist and whitelist database that supports dynamic updates to store blacklist and whitelist IPs. When a request is made to access a specified listening port, it will first be filtered by the IP blacklist and whitelist module. If the source IP of the request is a blacklist IP, the front-end honey court system will directly block the access; if the source IP of the request is a whitelist IP, the front-end honey court system will directly release the request without going through the white protocol access control and reputation score calculation; this will achieve unconditional blocking for blacklist IPs and unconditional trust for whitelist IPs, realizing preliminary access control based on IP blacklists and whitelists. If the source IP of the request is neither a blacklist IP nor a whitelist IP, the traffic will continue to be filtered by the white protocol module in the next step.

[0059] In addition, you can also customize the blacklist and whitelist IPs in the IP blacklist and whitelist database by manually adding them, and realize the dynamic expansion of the IP blacklist and whitelist module, so that users can flexibly adjust the blacklist and whitelist according to actual conditions to adapt to the ever-changing network environment and security needs. In this way, the front-end MiTing system can be more accurate and efficient in processing IP blacklists and whitelists.

[0060] See also Figure 3 As shown in the figure, after the IP blacklist and whitelist module completes the initial access control, the traffic will enter the white protocol module for further filtering. The front-end honey court system only allows the white protocol type traffic configured by the proxy service to pass, including the following steps:

[0061] The front-end MiTing system conducts a detailed review of traffic based on the whitelist protocol type set in the configuration file. If it is detected that the application layer protocol of the request does not belong to the whitelist protocol, the system will immediately block the request and deduct the reputation score of the source IP accordingly, effectively preventing the threat that unauthorized protocol traffic may pose to the backend service. At the same time, the historical attack behavior of the source IP is recorded to form a memory of the IP behavior. On the contrary, if the application layer protocol of the request conforms to the whitelist protocol, the traffic will be allowed to continue to be transmitted, ensuring the availability and security of the service, while maintaining the purity and reliability of the network environment. Through this process, the system not only improves its defense capabilities against malicious traffic, but also ensures smooth access to legitimate traffic.

[0062] See also Figure 4 As shown, the present invention introduces a set of refined reputation score calculation mechanisms, which aims to improve the security of business systems and the intelligence of access control. The behavioral performance and reputation of each network entity (IP address) are quantified through the reputation score calculation formula. The formula is defined as: Reputation score = (honey hole reputation coefficient * honey hole verification score) + (behavior reputation coefficient * behavior score) + (white protocol reputation coefficient * white protocol score) + (user reputation coefficient * user feedback score). Each score accounts for 25 points out of a full score of 100, ensuring the balance and segmentation of the evaluation. The reputation coefficient of each part is adjusted by the administrator, and the priority of the front-end honey court system access control can be customized according to the coefficient ratio. Initially, the reputation score of each part is 10, and at this time, the IP address has access rights to only a very small part of the business system.

[0063] Honeyhole verification score: After traffic passes through the IP blacklist and whitelist modules and the white protocol module, it is directed to the Honeyhole server. The page displayed on the Honeyhole server is a verification function for accessing normal business systems. The verification method can be differentiated according to the sensitivity of the accessed content. Normal users with insufficient credibility will directly participate in verification. Passing the Honeyhole identity verification will allow them to be redirected to the normal page and improve their credibility. For attackers, once they participate in verification, their information will be obtained by the Honeyhole, effectively deterring them. If the attacker does not participate in verification, they will be unable to proceed to the next step and their credibility will be reduced.

[0064] The behavioral score is dynamically assessed by the content anomaly detection module of the front-end MiTing system based on the rules. It monitors access requests and deducts points for violations of the rules. The system deducts different points based on the severity of the violation.

[0065] The white protocol score is evaluated based on whether the request complies with the preset whitelist protocol, and points are deducted for non-white protocol requests.

[0066] User feedback scores provide users with a certain degree of customization to adapt to different business needs and security policies.

[0067] Finally, the Frontend MiTing system determines the range of business resources an IP address can access based on its reputation score. IP addresses with lower scores will be subject to more access restrictions. When any part of the score drops to zero or a threshold, the system will automatically mark the IP address as blacklisted and store it in the IP blacklist and whitelist database, thereby restricting its access to all business resources.

[0068] Reputation scores are recorded and maintained in a reputation score database, integrating the IP address's honeyhole authentication, historical behavior, protocol usage, and user-defined feedback to form a comprehensive access control perspective. This approach implements triple access control based on IP blacklists and whitelists, whitelist protocol rules, and reputation scores, significantly enhancing the overall security protection capabilities of the business system.

[0069] This invention incorporates a series of innovative improvements to the Pre-Honey system to address the access control limitations of existing systems. While traditional Pre-Honey systems implement basic access control through content anomaly detection modules, this control relies primarily on static rule matching, making it ineffective in tracking or memorizing historical attack behaviors and difficult to implement fine-grained access control for application-layer protocols. To overcome these shortcomings, this invention proposes a triple access control method based on the Pre-Honey.

[0070] First, by expanding the IP blacklist and whitelist module to the front-end MiTing system, the system can dynamically configure the IP blacklist and whitelist database to quickly identify and respond to potential malicious behavior. For trusted IP addresses, the system will provide faster access speeds, while for blacklisted IP addresses, the system can promptly block potential malicious behavior, effectively improving system security and response efficiency.

[0071] Secondly, the present invention also integrates a white protocol module into the pre-honey garden system. This module enables the pre-honey garden system to perform fine-grained access control based on application layer protocols. By specifying the white protocols allowed in the configuration file, system administrators can precisely control access to different types of network requests, thereby reducing potential risks caused by protocol abuse.

[0072] Finally, the present invention also designs a reputation score calculation mechanism that cleverly combines the honeyhole authentication mechanism, the IP blacklist and whitelist module, the white protocol module, and the content anomaly detection module of the front-end honey court system. This provides a triple access control method for the front-end honey court system, which not only improves system security but also increases system flexibility. This method enables the front-end honey court system to more intelligently identify and process various network requests, effectively defending against network attacks from various sources, while providing a smoother access experience for legitimate users.

[0073] Throughout this specification, references to terms such as "one embodiment," "example," or "specific example" indicate that the specific features, structures, materials, or characteristics described in conjunction with that embodiment or example are included in at least one embodiment or example of the present invention. In this specification, schematic representations of these terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in any one or more embodiments or examples.

[0074] The preferred embodiments of the present invention disclosed above are intended only to help illustrate the present invention. These preferred embodiments do not exhaustively describe all details, nor do they limit the present invention to specific embodiments. Obviously, many modifications and variations are possible based on the contents of this specification. These embodiments are selected and described in detail in this specification to better explain the principles and practical applications of the present invention, thereby enabling those skilled in the art to better understand and utilize the present invention. The present invention is limited only by the claims and their full scope and equivalents.

Claims

1. A triple access control method based on a pre-honey court, characterized by: The access control method comprises the following steps: S1: The front-end MiTing system monitors traffic on specific ports. For each access request, it is first filtered by the IP blacklist and whitelist modules to perform preliminary access control on the traffic. It directly blocks access requests from blacklisted IPs and directly allows access requests from whitelisted IPs without going through the subsequent white protocol module and reputation score calculation module. S2: After the IP blacklist and whitelist module completes the initial access control, the traffic will enter the white protocol module for further filtering. The front-end honey court system only allows the white protocol type traffic configured by the proxy service to pass; S3: The front-end Honey Court system directs the request to the Honey Hole server. The page specifies the next access address of the real business to be accessed. The rest of the page contains floating code that the attacker needs to download and execute. The floating code is delivered to the attacking side to obtain the attacker's information and verify the user's identity. If the attacker does not execute the code, the corresponding reputation score will be deducted. The IP that passes the Honey Hole server authentication will have its reputation score increased. S4: The final reputation score is calculated based on the authentication status of the honeyhole server, the requested access behavior, the filtering status of the white protocol module, and the score set by the user. Access rights to the business system are dynamically opened based on the reputation score, and the source IP is automatically added to the blacklist when the reputation score drops to the threshold, implementing automated access control.

2. A triple access control method based on a pre-honey court according to claim 1, characterized in that: In step S1, after filtering by the IP blacklist and whitelist module, preliminary access control is performed on the traffic, including the following steps: Step S11: The IP blacklist and whitelist module creates an IP blacklist and whitelist database that supports dynamic updates and is used to store the blacklist and whitelist IPs; Step S12: When a request is made to access the designated listening port, it is filtered by the IP blacklist and whitelist module. If the source IP of the request is a blacklist IP, the front-end honey court system will directly block the access; if the source IP of the request is a whitelist IP, the front-end honey court system will directly release the request without going through the whitelist protocol access control and reputation score calculation; Step S13: If the source IP of the request is neither a blacklist IP nor a whitelist IP, the traffic will continue to be filtered by the next white protocol module.

3. The triple access control method based on the pre-honey court according to claim 2 is characterized in that: The IP blacklist and whitelist module can also customize the blacklist and whitelist IPs in the IP blacklist and whitelist database by manually adding, thereby realizing dynamic expansion of the IP blacklist and whitelist module.

4. The triple access control method based on the pre-honey court according to claim 3 is characterized by: In step S2, after the IP blacklist and whitelist module completes the initial access control, the traffic will enter the white protocol module for further filtering. The front-end honey court system only allows the white protocol type traffic configured by the proxy service to pass, including the following steps: The front-end MiTing system conducts a detailed review of the traffic based on the whitelist protocol type set in the configuration file; if it detects that the requested application layer protocol does not belong to the whitelist protocol, the system will immediately block the request and deduct the reputation score of the source IP accordingly, while recording the historical attack behavior of the source IP to form a memory of the IP behavior; on the contrary, if the requested application layer protocol conforms to the whitelist protocol, the traffic will be allowed to continue to be transmitted.

5. The triple access control method based on the pre-honey court according to claim 4 is characterized in that: In step 4, the final reputation score is calculated based on the authentication status of the honeyhole server, the requested access behavior, the filtering status of the white protocol module, and the score set by the user. Access rights to the business system are dynamically opened based on the reputation score, including the following steps: The behavior and reputation of each network entity IP address are quantified through the reputation score calculation formula. The formula is defined as: Reputation score = (Honeyhole reputation coefficient * Honeyhole verification score) + (Behavior reputation coefficient * Behavior score) + (White protocol reputation coefficient * White protocol score) + (User reputation coefficient * User feedback score). Each score accounts for 25 points out of a full 100 points. The reputation coefficient of each part is regulated by the administrator. Based on the coefficient ratio, the priority of the front-end Honey Court system access control is customized. Initially, the reputation score of each part is 10. Honeyhole verification score: After passing through the IP blacklist and whitelist modules and the white protocol module, traffic will be directed to the Honeyhole server. The page displayed by the Honeyhole server is a verification function for accessing normal business systems. The verification method can be differentiated according to the sensitivity of different access content. Normal users with insufficient reputation will directly participate in verification. If they pass the Honeyhole identity verification, they will be directed to the normal page and their reputation will be improved. For attackers, once they participate in verification, their information will be obtained by the Honeyhole. If the attacker does not participate in verification, they will not be able to take the next step and their reputation will be reduced. The behavior score is dynamically assessed by the content anomaly detection module of the front-end MiTing system based on rules. It monitors access requests and deducts points for violations of the rules. The system deducts different points based on the severity of the violation. The white protocol score is evaluated based on whether the request complies with the preset whitelist protocol, and points are deducted for non-white protocol requests; User feedback scores provide users with customization space to adapt to different business needs and security policies; The Front-End MiTing system will determine the scope of business resources that an IP address can access based on different credibility scores; IP addresses with lower scores will be subject to more access restrictions, and when any part of the score drops to zero or the threshold, the system will automatically mark the IP address as blacklisted and store it in the IP blacklist and whitelist library, restricting its access to all business resources.

Images