A honey spot deployment optimization method

Abstract

The present invention provides a method for optimizing the deployment of honey spots, which relates to the field of network security technology. The method for optimizing the deployment of honey spots includes the following steps: formulating a honey spot deployment strategy based on the attacker's scanning strategy, and deploying K initial honey spots at different IP addresses of the network to be defended based on the deployment strategy, and obtaining the total number of effective captures of the K initial honey spots; deleting all initial honey spots, adding optimized honey spots one by one in the network to be defended based on the deployment strategy, and calculating the marginal utility of the newly added optimized honey spots and determining the newly added number of the optimized honey spots based on the number of IP addresses and the number of effective captures in the network to be defended. The present invention formulates a honey spot deployment strategy by studying diverse attack methods, thereby improving the attack capture rate and avoiding resource waste, and proposes a honey spot marginal utility analysis method to achieve the evaluation and optimization of the number of honey spot deployments.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a honey spot deployment optimization method. Background Art

[0002] In the current cybersecurity landscape, honeypots are deception systems that lure attackers into attacking them by placing fake hosts, network services, or information as bait. Traditional honeypots are primarily categorized into low-interaction and high-interaction types. Low-interaction honeypots have limited trapping capabilities and are unable to provide effective and comprehensive attack information. High-interaction honeypots, however, are difficult to deploy across a wide range of business networks due to the high resource investment and deployment challenges, making them incapable of effectively covering all potential attack surfaces.

[0003] A honeypot is a security tool designed to lure attackers. When an attacker accesses a honeypot, it issues an alert notification. A honeypot doesn't need to implement all the functionality of the protected host; it only needs to be similar to the protected host in terms of service types and interaction processes. Compared to honeypots, this lightweight honeypot technology not only avoids excessive resource investment but also exhibits a lower false alarm rate in passive attack detection. However, existing honeypot deployment solutions fail to fully consider the diverse methods and strategies of attackers. They employ only random deployment strategies, which can lead to over-deployment of honeypots in low-risk areas, making some honeypots redundant, reducing resource utilization efficiency, and lowering the probability of catching attacks, thus wasting limited honeypot resources. Therefore, a solution is urgently needed to address these issues. Summary of the Invention

[0004] The purpose of the present invention is to provide a method for optimizing the deployment of honey spots, which improves the problems of the random deployment method of honey spots in the prior art in terms of attack capture probability and low resource utilization efficiency.

[0005] The present invention provides a method for optimizing honeypot deployment, which adopts the following technical solutions:

[0006] A honeypot deployment strategy is formulated based on the attacker's scanning strategy. K initial honeypots are deployed at different IP addresses of the network to be defended based on the deployment strategy. The total number of times all initial honeypots in the network to be defended have been attacked and scanned is obtained. Scans from the same attack source are deduplicated to obtain the number of valid captures.

[0007] Delete all the initial sweet spots in the network to be defended, add optimized sweet spots one by one in the network to be defended based on the deployment strategy, and calculate the marginal utility of the newly added optimized sweet spots one by one based on the number of IP addresses of deployable sweet spots in the network to be defended and the number of effective capture times, and determine the new number of optimized sweet spots based on the marginal utility.

[0008] As described above, in the process of formulating a deployment strategy for a honey point based on the attacker's scanning strategy, the deployment strategy includes an exponential distribution strategy for range attack scanning, a random phase equalization strategy for random attack scanning, and an edge distribution strategy for address resolution protocol attack scanning.

[0009] The above-mentioned honey spot deployment optimization method, wherein the K1 initial honey spots are respectively deployed at different IP addresses of the network to be defended based on the random phase equalization strategy, includes:

[0010] Based on the number of all IP addresses in the network to be defended and the number K1 of the initial honey spots to be deployed, determining the difference in IP addresses between the K1 initial honey spots in the random phase equalization strategy as δ;

[0011] Generate the random phase d0∈(0, δ] of the first initial honey point in the random phase equalization strategy, and calculate the IP address d to be deployed of the initial honey point in the random phase equalization strategy. i =d0+(i-1)×δ, i∈[1, K1];

[0012] When the i-th IP address to be deployed is occupied, the i-th IP address to be deployed is randomly changed to the closest IP address in the address range of ((i-1)×δ, i×δ]; when all IP addresses in the address range of ((i-1)×δ, i×δ] are occupied, the i-th IP address to be deployed is randomly changed to the IP address of another deployable honeypot in the network to be defended;

[0013] The initial honey spots are respectively deployed on K1 IP addresses to be deployed, where K1≤K.

[0014] The above-mentioned honey spot deployment optimization method, wherein the K2 initial honey spots are respectively deployed at different IP addresses of the network to be defended based on the exponential distribution strategy, includes:

[0015] In the network to be defended, IP addresses that satisfy the exponential distribution and can be deployed as honey spots around the IP address to be defended are randomly sampled to obtain exponential IP addresses, K2 IP addresses to be deployed are selected based on the distance from the IP address to be defended and the minimum, and the initial honey spots are respectively deployed on the K2 IP addresses to be deployed, where K2≤K.

[0016] In the above-mentioned honey spot deployment optimization method, a starting IP address or an ending IP address is selected as the IP address to be deployed, and an initial honey spot is deployed on the IP address to be deployed.

[0017] The honey spot deployment optimization method as described above, wherein, when deduplicating scans of the same attack source to obtain the effective capture number, includes: the initial honey spot obtains the attack source information when being scanned, and deduplicating scans of the same attack source to obtain the effective capture number of the initial honey spot.

[0018] The above-mentioned method for optimizing the deployment of honey spots, wherein, in the process of adding optimized honey spots one by one, includes: determining the priority of the IP address when adding the optimized honey spot based on the number of captures of the IP address where the initial honey spot is located.

[0019] In the above-mentioned sweet spot deployment optimization method, calculating the marginal utility of the newly added optimized sweet spot includes:

[0020] Calculating a first probability that the attacker is not captured when attacking the network to be defended before the optimization of the honey spot addition; calculating a second probability that the attacker is not captured when attacking the network to be defended after the optimization of the honey spot addition;

[0021] Calculating the marginal utility of the newly added optimized sweet spot based on the first probability and the second probability;

[0022] In the above-mentioned honey spot deployment optimization method, the probability of not being captured is calculated according to the following formula:

[0023]

[0024] Where n is the number of IP addresses that can be used to deploy honey spots in the network to be defended, k is the number of newly added optimized honey spots, h is the number of effective capture times, and p k is the probability that the attack of the kth newly added optimization honey spot is not captured.

[0025] The above-mentioned method for optimizing the deployment of sweet spots, wherein the process of determining the number of newly added optimized sweet spots includes: when the marginal utility is less than a preset threshold, stopping adding the newly added optimized sweet spots.

[0026] The beneficial effects of the honey spot deployment optimization method proposed in the present invention are:

[0027] 1. The honey spot deployment strategy of the present invention adopts exponential distribution, random phase uniform distribution, and edge distribution, which can make the honey spots cover the network to be defended more comprehensively, effectively utilize the attacker's scanning strategy, and increase the probability of capturing the attack.

[0028] 2. The marginal utility of the sweet spots of the present invention calculates the change in the probability of attack failure before and after each sweet spot is added, which can effectively evaluate and optimize the number of sweet spot deployments, while ensuring the capture success rate and improving resource utilization efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0029] Figure 1 A flow chart of the honeyspot deployment optimization solution provided by an embodiment of the present invention;

[0030] Figure 2 This is a structural diagram of the honeyspot deployment strategy provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0031] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention. Unless otherwise defined, the technical terms or scientific terms used herein should be the common meanings understood by people with ordinary skills in the field to which the invention belongs. The words "including" and similar words used in this article mean that the elements or objects appearing before the word cover the elements or objects listed after the word and their equivalents, without excluding other elements or objects.

[0032] An embodiment of the present invention provides a method for optimizing honey spot deployment, including:

[0033] S1. Formulate a honeypot deployment strategy based on the attacker's scanning strategy, and deploy K initial honeypots at different IP addresses of the network to be defended based on the deployment strategy;

[0034] S2. Obtain the total number of times all the initial honey spots in the network to be defended are attacked and scanned, and obtain the number of valid captures after deduplication of scans from the same attack source;

[0035] S3. Delete all the initial sweet spots in the network to be defended, add optimized sweet spots one by one in the network to be defended based on the deployment strategy, and calculate the marginal utility of the newly added optimized sweet spots one by one based on the number of IP addresses of deployable sweet spots in the network to be defended and the number of effective capture times, and determine the number of new optimized sweet spots based on the marginal utility.

[0036] In some embodiments, see Figure 1 After collecting the attacker's scanning strategy, a deployment strategy for the honey spot is formulated based on the attacker's scanning strategy. After deploying the initial honey spot based on the deployment strategy, the effective capture times are obtained; the initial honey spot is deleted, the marginal utility of the optimized honey spot is added and calculated, and the number of newly added optimized honey spots is determined.

[0037] In some embodiments, the process of executing step S1 includes:

[0038] Step S1.1: Formulate a deployment strategy for honeypots based on the attacker's scanning strategy;

[0039] Step S1.2: Based on the deployment strategy, K initial honey spots are deployed at different IP addresses of the network to be defended.

[0040] For details, see Figure 2 ,In executing step S1.1, when formulating the deployment strategy of the honey spot based on the attacker's scanning strategy, it includes:

[0041] We collected attackers' scanning strategies based on literature, including random scanning, range scanning, Address Resolution Protocol scanning, and brute force scanning.

[0042] The deployment strategies for honey spots include the random phase equalization strategy for random attack scanning, the exponential distribution strategy for range attack scanning, and the edge distribution strategy for address resolution protocol attack scanning.

[0043] Specifically, when executing step S1.2, deploying the K initial honey spots at different IP addresses of the network to be defended based on the deployment strategy includes:

[0044] Step S1.2.1: Deploy K1 initial honeypots at different IP addresses of the network to be defended based on the random phase equalization strategy;

[0045] Step S1.2.2: Deploy K2 initial honeypots at different IP addresses of the network to be defended based on the exponential distribution strategy;

[0046] Step S1.2.3: Based on the edge distribution strategy, deploy an initial honeypot at different IP addresses of the network to be defended.

[0047] Specifically, executing step S1.2.1, when deploying K1 initial honeypots at different IP addresses of the network to be defended based on the random phase equalization strategy, includes:

[0048] Based on the number of all IP addresses in the network to be defended and the number K1 of the initial honey spots to be deployed, determining that the difference in IP addresses between the K1 initial honey spots in the random phase equalization strategy is 6;

[0049] Generate the random phase d0∈(0, δ] of the first initial honey point in the random phase equalization strategy, and calculate the IP address d to be deployed of the initial honey point in the random phase equalization strategy. i =d0+(i-1)×δ, i∈[1, K1].

[0050] Furthermore, when the i-th IP address to be deployed is occupied, the i-th IP address to be deployed is randomly changed to the closest IP address in the address range of ((i-1)×δ, i×δ]; when all the IP addresses in the address range of ((i-1)×δ, i×δ] are occupied, the i-th IP address to be deployed is randomly changed to the IP address of other deployable honey spots in the network to be defended.

[0051] Furthermore, the initial honey spots are respectively deployed on K1 IP addresses to be deployed, where K1≤K.

[0052] Specifically, executing step S1.2.2, when deploying K2 initial honeypots at different IP addresses of the network to be defended based on the exponential distribution strategy, includes:

[0053] In the network to be defended, IP addresses that satisfy the exponential distribution and can be deployed as honey spots around the IP address to be defended are randomly sampled to obtain exponential IP addresses, and K2 IP addresses to be deployed in the exponential distribution strategy are selected based on the distance from the IP address to be defended and the minimum.

[0054] Furthermore, the initial honey spots are respectively deployed on the K2 IP addresses to be deployed, where K2≤K.

[0055] Specifically, executing step S1.2.3, when deploying an initial honeypot at different IP addresses of the network to be defended based on the edge distribution strategy, includes:

[0056] Select the starting IP address or the ending IP address as the IP address to be deployed, and deploy the initial honeypot on the IP address to be deployed.

[0057] In fact, after compromising a host, the attacker will obtain information about active hosts on the network by querying the ARP cache of the target network. The attacker can determine whether the attacker uses the ARP scanning attack method by checking whether the honeypot deployed in step S1.2.3 captures the attack.

[0058] In fact, the network to be defended may be divided into multiple network segments, each of which contains a continuous range of IP addresses. Perhaps only some of the network segments in the network to be defended need to deploy honey spots for defense.

[0059] In some embodiments, when executing step S2, the following steps are included:

[0060] The initial honey spot obtains the attack source information when it is scanned, and deduplicates the attack scans from the same attack source to obtain the effective capture count of the initial honey spot.

[0061] In fact, when an attacker interacts with a honeypot, relevant information that can be collected includes the IP address of the attack source, attack tools and techniques, the time and frequency of the attack, and the attacker's operational behavior.

[0062] In some embodiments, the process of executing step S3 includes:

[0063] Step S3.1, deleting all the initial honey spots in the network to be defended;

[0064] Step S3.2: adding optimized honey spots one by one in the network to be defended based on the deployment strategy, and calculating the marginal utility of each of the newly added optimized honey spots based on the number of IP addresses where honey spots can be deployed in the network to be defended and the number of valid captures;

[0065] Step S3.3: Determine the number of newly added optimized honey spots based on the marginal utility.

[0066] Specifically, the process of executing step S3.2 includes:

[0067] Step S3.2.1, adding optimized honey spots one by one in the network to be defended based on the deployment strategy;

[0068] Step S3.2.2: Calculate the marginal utility of the newly added optimized sweet spots one by one.

[0069] Specifically, when executing step S3.2.1, adding optimized honey spots one by one in the network to be defended based on the deployment strategy includes:

[0070] In addition to the newly added optimization sweet spots that must be deployed for the starting IP address or the ending IP address, the priority of the other newly added optimization sweet spots is determined based on the capture count of the IP address where the initial sweet spot is located.

[0071] Specifically, when executing step S3.2.2, calculating the marginal utility of the newly added optimization honey spots one by one, it includes:

[0072] A first probability of an attacker not being captured when attacking the network to be defended before the optimization sweet spot is added is calculated; a second probability of an attacker not being captured when attacking the network to be defended after the optimization sweet spot is added is calculated; and the marginal utility of the newly added optimization sweet spot is obtained based on the difference between the first probability and the second probability.

[0073] Specifically, when calculating the probability of an attack not being caught, the calculation formula is:

[0074]

[0075] Where n is the number of IP addresses that can be used to deploy honey spots in the network to be defended, k is the number of newly added optimized honey spots, h is the number of effective capture times, and p is the number of newly added optimized honey spots. k is the probability that the attack of the kth newly added optimization honey spot is not captured.

[0076] Specifically, the process of executing step S3.3 includes: when the marginal utility of the newly added optimization sweet spot is less than a preset threshold, stopping adding the optimization sweet spot.

[0077] In practice, the preset threshold can be 0.1.

Claims

1. A method for optimizing honey spot deployment, characterized in that: The following steps are involved: A honeypot deployment strategy is formulated based on the attacker's scanning strategy. K initial honeypots are deployed at different IP addresses of the network to be defended based on the deployment strategy. The total number of times all initial honeypots in the network to be defended have been attacked and scanned is obtained. Scans from the same attack source are deduplicated to obtain the number of valid captures. Deleting all the initial sweet spots in the network to be defended, adding optimized sweet spots one by one in the network to be defended based on the deployment strategy, and calculating the marginal utility of each of the newly added optimized sweet spots based on the number of IP addresses where the sweet spots can be deployed in the network to be defended and the number of valid captures, and determining the number of new optimized sweet spots based on the marginal utility; Among them, in the process of formulating the deployment strategy of the honey point based on the attacker's scanning strategy, the deployment strategy includes a random phase equalization strategy for random attack scanning, an exponential distribution strategy for range attack scanning, and an edge distribution strategy for address resolution protocol attack scanning.

2. A method for optimizing honey spot deployment according to claim 1, characterized in that: When K1 initial honeypots are deployed at different IP addresses of the network to be defended based on the random phase equalization strategy, the following steps are included: Based on the number of all IP addresses in the network to be defended and the number of initial honey spots K1 that need to be deployed, the difference in IP addresses between the K1 initial honey spots in the random phase equalization strategy is determined to be ; Generate the random phase of the first initial honey point in the random phase equalization strategy , calculate the IP address of the initial honey point to be deployed in the random phase equalization strategy , [1 K1]; When When the IP address to be deployed is occupied, randomly change the The IP addresses to be deployed are The closest IP address in the address range, when the When all IP addresses in the address range are occupied, randomly change the The IP addresses to be deployed are the IP addresses of other deployable honeypots in the network to be defended; The initial honey spots are respectively deployed on K1 IP addresses to be deployed, where K1≤K.

3. The method for optimizing honey spot deployment according to claim 1, wherein: When K2 initial honeypots are deployed at different IP addresses of the network to be defended based on the exponential distribution strategy, the following steps are included: In the network to be defended, IP addresses that satisfy the exponential distribution and can be deployed as honey spots around the IP address to be defended are randomly sampled to obtain exponential IP addresses, K2 IP addresses to be deployed in the exponential distribution strategy are selected based on the distance from the IP address to be defended and the minimum, and the initial honey spots are deployed on the K2 IP addresses to be deployed, respectively, where K2≤K.

4. A method for optimizing honey spot deployment according to any one of claims 2 to 3, characterized in that: Select the starting IP address or the ending IP address as the IP address to be deployed, and deploy the initial honeypot on the IP address to be deployed.

5. The method for optimizing honey spot deployment according to claim 1, wherein: When performing deduplication processing on scans of the same attack source to obtain the effective capture number, it includes: the initial honey spot obtains the attack source information when being scanned, and deduplication of attack scans of the same attack source to obtain the effective capture number of the initial honey spot.

6. The method for optimizing honey spot deployment according to claim 1, wherein: In the process of adding optimized honey spots one by one, the priority of the IP address when adding the optimized honey spot is determined based on the number of captures of the IP address where the initial honey spot is located.

7. The method for optimizing honey spot deployment according to claim 1, wherein: Calculating the marginal utility of the newly added optimized sweet spot includes: Calculating a first probability that an attacker is not captured when attacking the network to be defended before the optimization of the honeypot addition; Calculating a second probability that the attacker is not captured when attacking the network to be defended after the optimization of the honeypoint addition; Based on the first probability and the second probability, the marginal utility of the newly added optimization sweet spot is calculated.

8. The method for optimizing honey spot deployment according to claim 1, wherein: In the process of determining the number of newly added optimization sweet spots, when the marginal utility is less than a preset threshold, the addition of newly added optimization sweet spots is stopped.

Images