A deception defense device and method for seamlessly migrating website backdoors

Abstract

The present invention discloses a deception defense device and method for seamlessly migrating website backdoors. The deception defense device deploys a website backdoor detection module on a user's real business server. The website backdoor detection module detects website backdoor files by monitoring changes in the business server's website directory files; a file ferry module transfers the website backdoor files to a honeypot environment and runs them, obtaining the website backdoor address running in the honeypot; a file rewriting module rewrites the website backdoor file without modifying the file path and file name, only rewriting the file content to the reverse proxy file content. In the reverse proxy file content, the reverse proxy destination address points to the website backdoor address running in the honeypot; malicious instructions and interactive operations issued by attackers to the website backdoor can be monitored in the virtual honeypot module. The present invention greatly enhances the integration of deception defense technology with real business and improves the ability of the honeypot network to actively trap attackers' actions.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a device and method for preventing deception of a backdoor in a website from being sensed to be migrated without any disturbance. Background Art

[0002] Honeynets are a proactive network security technology. By setting up honeypots and networks, honeynets can effectively attract, monitor, and analyze the behavior of malicious attackers, thereby improving overall network security. A honeynet is a network environment consisting of multiple honeypots and related infrastructure. These honeypots simulate real computer systems, network devices, or application services, specifically designed to attract and capture attackers. Honeypots can be virtual machines, containers, or even physical devices. These honeypots are typically isolated from the actual production environment but appear to be real systems, misleading attackers into thinking they are attacking real targets. Honeynets use logs, network traffic capture, and other monitoring tools to record attacker behavior and tools in detail. This data can be used to analyze attack methods, identify attackers, and improve defense strategies. The real-time attack information provided by honeynets can be used to generate threat intelligence, helping other security systems and defense strategies to respond to emerging threats.

[0003] Deception defense honeynets, through their carefully designed camouflage nodes and decoy systems, play a vital role in current network security systems. Honeynets not only effectively confuse attackers and guide them into pre-defined monitoring areas, but also capture and analyze attack behavior throughout its entire lifecycle without detection. This process not only provides security teams with valuable attack intelligence, revealing hacker tactics, techniques, and processes, but also significantly enhances network security resilience. The use of honeynets enables enterprises to rapidly respond and precisely defend against unknown threats, achieving a strategic shift from passive defense to proactive early warning.

[0004] While existing honeynet technology has played a significant role in practical applications, some common issues remain. First, the IP addresses and ports occupied by honeynet deployments are typically separate from those of real business systems, preventing resource preemption. This results in limited integration between honeynets and businesses, making it impossible to conduct deception and entrapment within businesses. Second, after attackers identify and attack real business systems, they cannot be entrapped by honeynets due to the relative separation of honeynet and real business network resources. Furthermore, honeynet entrapment and deception techniques rely primarily on attackers proactively discovering honeypots for attack, lacking the ability to dynamically interact with attackers during the attack. This results in a relatively passive approach to entrapment, failing to delay attacks or monitor their methods. Summary of the Invention

[0005] In view of this, the purpose of the present invention is to provide a deception defense device and method for seamlessly migrating website backdoors, so as to solve the problems existing in the existing honeynet solutions, such as limited integration of honeynet and business, inability to perform deception within the business, reliance on attackers to actively discover and attack, and passive trapping capabilities.

[0006] To achieve the above object, the present invention is implemented by adopting the following technical solutions:

[0007] The present invention provides a fraud prevention device for seamlessly migrating website backdoors, comprising:

[0008] A website backdoor detection module is deployed on the defender's real business server to monitor the website directory files of the defender's real business server, identify and extract website backdoor files uploaded by attackers;

[0009] The file ferry module is used to transfer the website backdoor file uploaded by the attacker to the honeypot and run it, and obtain the website backdoor address running in the honeypot;

[0010] A file rewriting module is used to rewrite the destination address in the website backdoor file content uploaded by the attacker into the website backdoor address running in the honeypot;

[0011] The virtual honeypot module is used to run the rewritten website backdoor file and monitor the malicious instructions and interactive operations issued by the attacker to the backdoor of the defender's real business server website.

[0012] Preferably, the website backdoor detection module is specifically used to:

[0013] Monitor changes in the website directory files of the defender's real business server, including newly added and modified files;

[0014] The newly added file and the modified file contents are matched. If a file with website backdoor features is matched, it is identified as a website backdoor file uploaded by the attacker.

[0015] Preferably, the website backdoor detection module is specifically used to:

[0016] Extract the website backdoor file uploaded by the attacker and record the file name, file path, file content, real business IP and real business port of the website backdoor file.

[0017] Preferably, the file ferry module is specifically used to:

[0018] Obtain the backdoor address of the website running in the honeypot, including the honeypot IP, honeypot port, file path in the honeypot, and file name in the honeypot.

[0019] Preferably, the file rewriting module is specifically used to:

[0020] The website backdoor file uploaded by the attacker on the real business server of the defender is not modified in terms of file path, file name, real business IP and real business port, and only the file content is rewritten as the reverse proxy file content; in the reverse proxy file content, the reverse proxy destination address points to the website backdoor address running in the honeypot.

[0021] The present invention also provides a deception defense method based on the above-mentioned deception defense device for seamless website migration backdoor, comprising:

[0022] The website backdoor detection module monitors the website directory files of the defender's real business server to identify and extract the website backdoor files uploaded by the attacker;

[0023] The website backdoor file uploaded by the attacker is transferred to the honeypot through the file ferry module and executed to obtain the website backdoor address running in the honeypot;

[0024] Rewrite the destination address in the website backdoor file uploaded by the attacker to the website backdoor address running in the honeypot through the file rewriting module;

[0025] The rewritten website backdoor file is run through the virtual honeypot module to monitor the malicious instructions and interactive operations issued by the attacker to the website backdoor.

[0026] Preferably, the monitoring of the website directory files of the defender's real business server to identify and extract the website backdoor files uploaded by the attacker includes:

[0027] Monitor changes in the website directory files of the defender's real business server, including newly added and modified files;

[0028] The newly added and modified files are matched using regular expressions or AST semantic analysis. If a file with website backdoor characteristics is matched, it is identified as a website backdoor file uploaded by the attacker.

[0029] Extract the website backdoor file uploaded by the attacker and record the file name, file path, file content, real business IP and real business port;

[0030] The URL path used by the attacker to access the website backdoor is obtained based on the extracted file name, file path, file content, real business IP, and real business port.

[0031] Preferably, the backdoor address of the website running in the honeypot is obtained as follows:

[0032] According to the honeypot IP, honeypot port, file path in the honeypot and file name in the honeypot, the access URL path of the website backdoor file in the honeypot is obtained.

[0033] Preferably, rewriting the destination address in the website backdoor file content uploaded by the attacker into the website backdoor address running in the honeypot includes:

[0034] The website backdoor file uploaded by the attacker on the real business server of the defender is not modified in terms of file path, file name, real business IP and real business port, and only the file content is rewritten as the reverse proxy file content; the content of the reverse proxy file is: receiving any data packet traffic of the URL path of the attacker to access the website backdoor, forwarding it to the access URL path of the website backdoor file in the honeypot, and returning the request response value of the website backdoor URL in the honeypot to the current page.

[0035] The beneficial effects of the present invention are at least:

[0036] The present invention provides a deception defense device and method for seamlessly migrating website backdoors. By deploying a website backdoor detection module on the defender's real business server, the device detects and identifies website backdoor files uploaded by attackers to the defender's real business server. A file ferry module extracts the website backdoor files and transfers them to a honeypot for execution. A file rewrite module rewrites the website backdoor file contents on the real business server to reverse proxy file contents, with the reverse proxy destination address pointing to the website backdoor in the honeypot. The present invention can transfer the attacker's interaction and control actions with the website backdoor on the real business server to the honeypot without the attacker's awareness. The attacker actually interacts with the website backdoor file in the honeypot, greatly enhancing the integration of deception defense technology with real business operations and improving the ability of the honeypot to actively trap attacker actions. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] Figure 1 A diagram showing the data interaction between modules of a fraud prevention device for seamlessly migrating website backdoors provided by an embodiment of the present invention;

[0038] Figure 2 A flowchart of a method for preventing deception by seamlessly migrating website backdoors provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0039] In order to make the purpose, technical solutions and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the embodiments and the accompanying drawings. Here, the exemplary embodiments of the present invention and their descriptions are used to explain the present invention, but are not intended to limit the present invention.

[0040] It should also be noted that, in order to avoid obscuring the present invention due to unnecessary details, the accompanying drawings only show structures and / or processing steps closely related to the solutions according to the present invention, while other details that are not closely related to the present invention are omitted.

[0041] It should be emphasized that the term "include / comprises" when used herein refers to the existence of features, elements, steps or components, but does not exclude the existence or addition of one or more other features, elements, steps or components.

[0042] It should be emphasized here that the step marks mentioned in the following embodiments do not limit the order of the steps, but it should be understood that the steps can be executed in the order mentioned in the embodiments, or in a different order from the embodiment, or several steps can be executed simultaneously. Example 1

[0043] To facilitate a better understanding, the following further explains existing honeynet solutions. In traditional honeynet solutions, the IP addresses and ports occupied by honeynet deployments are typically separate from those of real business systems to avoid resource preemption, such as network IP addresses and ports. This results in limited integration between honeynets and businesses, making it impossible to conduct deception and entrapment within the business. Once an attacker identifies a real business system and launches an attack against it, the relative separation of honeynet and real business network resources prevents the attacker from being entrapped by the honeynet when attacking a specific real business system. Honeynet entrapment and deception technology primarily relies on the attacker proactively discovering the honeynet attack honeypot. This lacks the ability to dynamically interact with the attacker during the attack, resulting in a relatively passive entrapment of the attack, unable to delay the attack or monitor the attack methods.

[0044] Based on the defects of the above-mentioned existing technical solutions, the present invention proposes a fraud prevention device for non-sensing migration of website backdoors. The principle is as follows: Figure 1 As shown in the figure, targeting attackers' website backdoor attacks, this approach uses deception attacks to integrate network backdoor detection, file ferrying, file rewriting, and virtual honeypot modules to build an attack deception technology that is imperceptible to attackers, highly integrated with business operations, and proactively defends against attacks. This technology aims to increase the success rate of entrapment and obtain attacker characteristics and information.

[0045] See also Figure 1 The first embodiment of the present invention proposes a fraud prevention device for preventing website backdoors from being transferred without any notice, including:

[0046] The website backdoor detection module is deployed on the defender's real business server to monitor the website directory files of the defender's real business server and detect and extract the website backdoor files uploaded by the attacker;

[0047] The file ferry module is used to transfer the website backdoor file uploaded by the attacker to the honeypot and run it, and obtain the website backdoor address running in the honeypot;

[0048] The file rewriting module is used to rewrite the content of the website backdoor file on the defender's real business server by rewriting the destination address in the website backdoor file content to the website backdoor address running in the honeypot;

[0049] The virtual honeypot module is used to run the rewritten attacker's website backdoor file and monitor the malicious instructions and interactive operations issued by the attacker to the website backdoor.

[0050] In this embodiment, the website backdoor detection module monitors the website directory files of the real business server, which means monitoring the changes of the website directory files of the real business server, including additions and modifications.

[0051] In this embodiment, the website backdoor detection module detects and extracts the website backdoor file uploaded by the attacker, and records the file name (file_name), file path (file_path), file content (webshell_content), real business IP (ip_realserver) and real business port (port_realserver) of the backdoor file.

[0052] In this embodiment, the file ferry module obtains the backdoor address of the website running in the honeypot, including the honeypot IP (ip_honeypot), the honeypot port (port_honeypot), the file path in the honeypot (file_honey_path) and the file name in the honeypot (file_honey_name).

[0053] In this embodiment, the file rewriting module rewrites only the file content of the website backdoor file uploaded by the attacker detected by the website backdoor detection module in the real business server into the reverse proxy file content (proxy_content) (without modifying the file path, file name, real business IP and real business port). In the reverse proxy file content (proxy_content), the reverse proxy destination address points to the website backdoor address running in the honeypot, that is, ip_honeypot:port_honeypot / file_honey_path / file_honey_name.

[0054] Based on this, this embodiment achieves the migration of the website backdoor file uploaded by the attacker to the real business server to the honeypot without the attacker's awareness; the attacker continues to interact with the website backdoor address (ip_realserver:port_realserver / file_path / file_name) in the real business server, but the interaction traffic is forwarded to the website backdoor address in the honeypot, and all backdoor control behaviors targeting the real business server are migrated to the honeypot for execution, which greatly improves the integration of dense network technology and real business, and improves the active trapping capability of the dense network. Example 2

[0055] Based on the above embodiment 1, the fraud prevention device for the backdoor of the senseless migration website, this embodiment 2 provides a fraud prevention method for the backdoor of the senseless migration website, see Figure 2 , the method comprises the following steps:

[0056] (1) Using the website backdoor detection module to monitor changes in the website directory files of the defender's real business server, monitor the newly added and modified files in the website directory, and identify files with website backdoor characteristics, which are website backdoor files uploaded by the attacker;

[0057] (2) The website backdoor detection module detects the website backdoor file uploaded by the attacker, extracts the website backdoor file, and records the website backdoor file's file name (file_name), file path (file_path), file content (webshell_content), real business IP (ip_realserver), and real business port (port_realserver);

[0058] (3) The detected website backdoor file uploaded by the attacker is transferred to the honeypot environment through the file ferry module, and the website backdoor file is run to obtain the website backdoor address running in the honeypot, including the honeypot IP (ip_honeypot), honeypot port (port_honeypot), file path in the honeypot (file_honey_path) and file name in the honeypot (file_honey_name);

[0059] (4) The file rewriting module rewrites the website backdoor file detected in the defender's real business server without modifying the file path and file name. It only rewrites the file content to the reverse proxy file content (proxy_content). In the reverse proxy file content (proxy_content), the reverse proxy destination address points to the website backdoor address running in the honeypot, that is: ip_honeypot:port_honeypot / file_honey_path / file_honey_name;

[0060] (5) Use the virtual honeypot module to monitor the malicious instructions and interactive operations issued by attackers to the website backdoor.

[0061] In step (1) of this embodiment, the website backdoor detection module monitors the website directory of the defender's real business server. The business server website directory is usually set by the user. The system default directory is generally / var / www, / var / website, etc. The website directory is monitored for files to promptly detect new files or modified files in the website directory. The website backdoor detection module generally uses regular expressions, AST semantic analysis, etc. to match the directory file content. If a file with website backdoor characteristics is matched, it is considered to be a website backdoor file uploaded by the attacker.

[0062] The website backdoor detection module detects the website backdoor file, extracts the website backdoor file, and records the website backdoor file's file name (file_name), file path (file_path), file content (webshell_content), real business IP (ip_realserver), and real business port (port_realserver).

[0063] In general business website construction methods, such as PHP websites and Python websites, after obtaining the website backdoor file name (file_name) and file path (file_path), based on the real business IP (ip_realserver) and real business port (port_realserver), the URL path for the attacker to access the website backdoor can be spliced ​​together. It is generally: ip_realserver:port_realserver / file_path / file_name. When the attacker accesses this path, the code function in the website backdoor file name (file_name) will be executed.

[0064] In step (3) of this embodiment, the backdoor address of the website running in the honeypot is obtained, including the honeypot IP (ip_honeypot), the honeypot port (port_honeypot), the file path in the honeypot (file_honey_path), and the file name in the honeypot (file_honey_name);

[0065] After transferring the website backdoor file to the honeypot and running it, the access URL path of the website backdoor in the honeypot can be obtained based on the honeypot IP (ip_honeypot), honeypot port (port_honeypot), file path in the honeypot (file_honey_path) and file name in the honeypot (file_honey_name), which is generally: ip_honeypot:port_honeypot / file_honey_path / file_honey_name.

[0066] In step (4) of this embodiment, the file rewriting module rewrites the website backdoor file detected in the real business server of the defender without modifying the file path and file name, and only rewrites the file content to the reverse proxy file content (proxy_content).

[0067] The reverse proxy file content (proxy_content) code implementation example and code explanation are as follows:

[0068] <?php

[0069] / / Target URL

[0070] $targetUrl = 'ip_honeypot:port_honeypot / file_honey_path / file_honey_name';

[0071] / / Initialize the cURL session

[0072] $ch = curl_init();

[0073] / / Prepare cURL options

[0074] curl_setopt($ch, CURLOPT_URL, $targetUrl);

[0075] curl_setopt($ch, CURLOPT_RETURNTRANSFER, true); / / Return result as string

[0076] curl_setopt($ch, CURLOPT_HEADER, false); / / Do not get the HTTP header yet, you can process it later

[0077] curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true); / / Follow redirects

[0078] curl_setopt($ch, CURLOPT_MAXREDIRS, 10); / / Maximum number of redirects

[0079] / / If it is a POST request, set the POST data

[0080] if ($_SERVER['REQUEST_METHOD'] == 'POST') {

[0081] curl_setopt($ch, CURLOPT_POST, true);

[0082] curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($_POST)); / / Assume it is application / x-www-form-urlencoded

[0083] / / If you need to process other types of POST data (such as JSON, file upload, etc.), you need to set CURLOPT_POSTFIELDS and CURLOPT_HTTPHEADER accordingly

[0084] }

[0085] / / Forward HTTP headers (optional, forward as needed)

[0086] if (!empty($_SERVER['HTTP_X_FORWARDED_FOR'])) {

[0087] $headers[] = 'X-Forwarded-For: ' . $_SERVER['HTTP_X_FORWARDED_FOR'];

[0088] }

[0089] / / You can add more HTTP headers as needed

[0090] / / curl_setopt($ch, CURLOPT_HTTPHEADER, $headers); / / If $headers is set

[0091] / / Send request and get response

[0092] $response = curl_exec($ch);

[0093] / / Check if any error occurred

[0094] if (curl_errno($ch)) {

[0095] / / If the cURL request fails, output an error message

[0096] http_response_code(502); / / Bad Gateway

[0097] echo 'cURL Error: ' . curl_error($ch);

[0098] } else {

[0099] / / Request successful, set response header (optional, if needed)

[0100] / / header('Content-Type: application / json'); / / Assuming the response is JSON, set it according to the actual situation

[0101] / / Get and forward HTTP headers (if necessary)

[0102] / / $info = curl_getinfo($ch);

[0103] / / You can get information such as HTTP status code through the $info array and set the response header accordingly

[0104] / / Output response content

[0105] echo $response;

[0106] }

[0107] / / Close the cURL session

[0108] curl_close($ch);

[0109] ?>

[0110] In the above code, the $targetUrl variable value is set to the URL address of the website backdoor file running in the honeypot, which is generally: ip_honeypot:port_honeypot / file_honey_path / file_honey_name;

[0111] When an attacker accesses the URL address of the website backdoor file on the real server (ip_realserver:port_realserver / file_path / file_name), the content of the website backdoor file (webshell_content) is replaced with the content of the reverse proxy file (proxy_content). The reverse proxy file's code function is implemented to receive any data packet traffic from the attacker accessing this URL and forward it to the URL where the website backdoor file is running in the honeypot (ip_honeypot:port_honeypot / file_honey_path / file_honey_name). The response value of the request to the website backdoor URL in the honeypot is returned to the current page, realizing the reverse proxy function. At this time, when the attacker accesses the website backdoor file URL address on the real server, the actual website backdoor file is already running in the honeypot, and the attacker is unaware of it. This achieves the ability to achieve deception and active trapping within the business server, greatly improving the integration of the secret network with the business system and the secret network's active deception capabilities.

[0112] In summary, this embodiment provides a deception defense method for seamlessly migrating website backdoors. The website backdoor detection module detects the website backdoor uploaded by the attacker to the defender's real business server, extracts the website backdoor file through the file ferry module, and transfers the website backdoor file to the honeypot for execution. The file rewriting module rewrites the website backdoor file content on the real business server to the reverse proxy file content, and the reverse proxy destination address points to the website backdoor in the honeypot. This embodiment achieves the transfer of the attacker's interaction and control actions with the real business server website backdoor to the honeypot without the attacker's awareness. The attacker actually interacts with the website backdoor file in the honeypot, greatly improving the integration of deception defense technology with real business and improving the ability of the honeypot to actively trap the attacker's actions.

[0113] It should be understood by those skilled in the art that the various exemplary components, systems, and methods described in conjunction with the embodiments disclosed herein can be implemented in hardware, software, or a combination of both. Whether to implement the system in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians may use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of the present invention. When implemented in hardware, it may be, for example, an electronic circuit, an application-specific integrated circuit (ASIC), appropriate firmware, a plug-in, a function card, etc. When implemented in software, the elements of the present invention are programs or code segments used to perform the required tasks. The programs or code segments can be stored in a machine-readable medium or transmitted over a transmission medium or communication link via a data signal carried in a carrier wave.

[0114] It should be understood that the present invention is not limited to the specific configurations and processes described above and illustrated in the figures. For the sake of brevity, a detailed description of known methods is omitted. In the above embodiments, several specific steps are described and illustrated as examples. However, the method of the present invention is not limited to the specific steps described and illustrated. Those skilled in the art may make various changes, modifications, and additions, or change the order of the steps after understanding the spirit of the present invention.

[0115] In the present invention, features described and / or illustrated for one embodiment may be used in the same or similar manner in one or more other embodiments, and / or combined with or replace features of other embodiments.

[0116] The foregoing description is merely a preferred embodiment of the present invention and is not intended to limit the present invention. Those skilled in the art will readily appreciate that various modifications and variations to the present invention are possible. Any modifications, equivalent substitutions, or improvements made within the spirit and principles of the present invention are intended to be within the scope of protection of the present invention.

Claims

1. A fraud prevention device for seamlessly migrating website backdoors, characterized in that: include: A website backdoor detection module is deployed on the defender's real business server to monitor the website directory files of the defender's real business server, identify and extract website backdoor files uploaded by attackers; The file ferry module is used to transfer the website backdoor file uploaded by the attacker to the honeypot and run it, and obtain the website backdoor address running in the honeypot; A file rewriting module is used to rewrite the destination address in the website backdoor file content uploaded by the attacker into the website backdoor address running in the honeypot; The virtual honeypot module is used to run the rewritten website backdoor file and monitor the malicious instructions and interactive operations issued by the attacker to the backdoor of the defender's real business server website.

2. The device for preventing fraudulent backdoors in a non-sensing website migration according to claim 1 is characterized in that: The website backdoor detection module is specifically used to: Monitor changes in the website directory files of the defender's real business server, including newly added and modified files; The newly added file and the modified file contents are matched. If a file with website backdoor features is matched, it is identified as a website backdoor file uploaded by the attacker.

3. The device for preventing fraudulent website backdoors from being transferred without any notice according to claim 2, characterized in that: The website backdoor detection module is specifically used to: Extract the website backdoor file uploaded by the attacker and record the file name, file path, file content, real business IP and real business port of the website backdoor file.

4. The device for preventing fraudulent backdoors from migrating websites without any sense of the website being transferred according to claim 3, characterized in that: The file ferry module is specifically used to: Obtain the backdoor address of the website running in the honeypot, including the honeypot IP, honeypot port, file path in the honeypot, and file name in the honeypot.

5. The device for preventing fraudulent backdoors in a non-sensing website migration according to claim 4 is characterized in that: The file rewriting module is specifically used to: The website backdoor file uploaded by the attacker on the real business server of the defender is not modified in terms of file path, file name, real business IP and real business port, and only the file content is rewritten as the reverse proxy file content; in the reverse proxy file content, the reverse proxy destination address points to the website backdoor address running in the honeypot.

6. A deception defense method based on the deception defense device for seamless website backdoor migration according to any one of claims 1 to 5, characterized in that: include: The website backdoor detection module monitors the website directory files of the defender's real business server to identify and extract the website backdoor files uploaded by the attacker; The website backdoor file uploaded by the attacker is transferred to the honeypot through the file ferry module and executed to obtain the website backdoor address running in the honeypot; Rewrite the destination address in the website backdoor file uploaded by the attacker to the website backdoor address running in the honeypot through the file rewriting module; The rewritten website backdoor file is run through the virtual honeypot module to monitor the malicious instructions and interactive operations issued by the attacker to the website backdoor.

7. The fraud prevention method according to claim 6, characterized in that: The monitoring of the website directory files of the defender's real business server to identify and extract the website backdoor files uploaded by the attacker includes: Monitor changes in the website directory files of the defender's real business server, including newly added and modified files; The newly added and modified files are matched using regular expressions or AST semantic analysis. If a file with website backdoor characteristics is matched, it is identified as a website backdoor file uploaded by the attacker. Extract the website backdoor file uploaded by the attacker and record the file name, file path, file content, real business IP and real business port; The URL path used by the attacker to access the website backdoor is obtained based on the extracted file name, file path, file content, real business IP, and real business port.

8. The fraud prevention method according to claim 7, characterized in that: The backdoor address of the website running in the honeypot is: According to the honeypot IP, honeypot port, file path in the honeypot and file name in the honeypot, the access URL path of the website backdoor file in the honeypot is obtained.

9. The fraud prevention method according to claim 8, characterized in that: Rewrite the destination address in the website backdoor file uploaded by the attacker to the website backdoor address running in the honeypot, including: The website backdoor file uploaded by the attacker on the real business server of the defender is not modified in terms of file path, file name, real business IP and real business port, and only the file content is rewritten as the reverse proxy file content; the content of the reverse proxy file is: receiving any data packet traffic of the URL path of the attacker to access the website backdoor, forwarding it to the access URL path of the website backdoor file in the honeypot, and returning the request response value of the website backdoor URL in the honeypot to the current page.

Images