Threat flow processing method and device based on honeypot, computer equipment and medium
By building a dynamic honeypot architecture and identifying threat characteristics, the problem of poor processing capabilities of enterprises when deploying honeypots is solved, and stronger threat traffic processing capabilities and network security are achieved.
Patent Information
- Application Number
- CN202310740447.1
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2023-06-21
- Publication Date
- 2024-12-24
AI Technical Summary
Enterprises usually rely on experience when deploying honeypots, resulting in poor processing capabilities and poor targeting of external threat traffic.
Build a dynamic honeypot architecture, generate a target honeypot system based on the enterprise's network environment and security needs, and determine the threat traffic by identifying threat characteristics and calculating probability values, and take corresponding treatment measures such as isolation, blocking and alarm.
It improves the company's ability and pertinence to deal with external threat traffic and enhances network security protection capabilities.
Smart Images
Figure CN119182540A_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the field of network security technology, and in particular to a honeypot-based threat traffic processing method, device, computer equipment and non-volatile computer-readable storage medium. Background Art
[0002] In order to ensure network security, current network devices will use some protection mechanisms to deal with threats that affect network security, such as honeypot deployment. In order to improve network security and defense capabilities, enterprises generally deploy honeypots to capture and process malicious threat traffic. Among them, honeypot technology is essentially a technology that deceives attackers. By deploying some hosts, network services or information as bait, it induces attackers to attack them, so that the attack behavior can be captured and analyzed, the tools and methods used by the attackers can be understood, and the intentions and motives of the attacks can be inferred. This allows the defenders to clearly understand the security threats they face and enhance the security protection capabilities of the actual system through technical and management means. However, in the existing technology, when enterprises deploy honeypots, they generally deploy them manually based on experience, which results in poor processing capabilities of enterprises for external threat traffic and lack of targeting.
[0003] Therefore, the prior art still needs to be improved and enhanced. Summary of the invention
[0004] In view of the above-mentioned deficiencies in the prior art, the purpose of the present invention is to provide a threat traffic processing method, device, computer equipment and non-volatile computer-readable storage medium based on a honeypot, aiming to solve the problem in the prior art that when enterprises deploy honeypots, they generally deploy them manually based on experience, which leads to the problem that the enterprise has poor processing capabilities for external threat traffic and lacks pertinence.
[0005] In order to achieve the above object, the present invention adopts the following technical solutions:
[0006] A honeypot-based threat traffic processing method, comprising:
[0007] Build a dynamic honeypot architecture for the target enterprise;
[0008] Based on the dynamic honeypot architecture and according to the honeypot deployment strategy of the target enterprise, a target honeypot system required by the target enterprise is generated;
[0009] Obtain threat traffic to be processed;
[0010] The threat traffic is directed to the target honeypot system for processing.
[0011] In a further technical solution, the honeypot-based threat traffic processing method, wherein the dynamic honeypot architecture of the target enterprise is constructed, includes:
[0012] Build a scalable dynamic honeypot architecture based on the target enterprise's network environment and security requirements.
[0013] In a further technical solution, the honeypot-based threat traffic processing method, wherein, based on the dynamic honeypot architecture, generates the target honeypot system required by the target enterprise according to the honeypot deployment strategy of the target enterprise, wherein the honeypot deployment strategy includes the honeypot type, the number of honeypots and the location of the honeypot.
[0014] In a further technical solution, the honeypot-based threat traffic processing method, wherein the obtaining of the threat traffic to be processed includes:
[0015] Obtain the target traffic to be processed;
[0016] identifying a target threat signature from the target traffic;
[0017] Calculating the probability value of the target traffic being threat traffic according to the target threat feature;
[0018] If the probability value is greater than a preset threshold, the target traffic is determined to be threat traffic.
[0019] In a further technical solution, the honeypot-based threat traffic processing method, wherein the step of directing the threat traffic to the target honeypot system for processing, includes:
[0020] The threat traffic is directed to the target honeypot system, and the target honeypot system takes corresponding processing measures according to the type and threat degree of the threat traffic.
[0021] In a further technical solution, the honeypot-based threat traffic processing method, wherein the threat traffic is diverted to the target honeypot system, and the target honeypot system takes corresponding processing measures according to the type and threat level of the threat traffic, wherein the processing measures include isolation, blocking and alarm.
[0022] In a further technical solution, the honeypot-based threat traffic processing method, wherein the honeypot types include low-interaction honeypot, high-interaction honeypot, physical honeypot and virtual honeypot.
[0023] A threat traffic processing device based on a honeypot, comprising:
[0024] Building modules for building dynamic honeypot architecture for target enterprises;
[0025] A generation module, used to generate a target honeypot system required by the target enterprise based on the dynamic honeypot architecture and according to the honeypot deployment strategy of the target enterprise;
[0026] An acquisition module, used to acquire threat traffic to be processed;
[0027] A processing module is used to direct the threat traffic to the target honeypot system for processing.
[0028] A computer device, wherein the computer device comprises at least one processor; and
[0029] a memory communicatively connected to the at least one processor; wherein,
[0030] The memory stores a computer program that can be executed by the at least one processor. When the computer program is executed by the at least one processor, the honeypot-based threat traffic processing method as described in any one of the above items can be implemented.
[0031] A non-volatile computer-readable storage medium, wherein the non-volatile computer-readable storage medium stores a computer program, and when the computer program is executed by at least one processor, the honeypot-based threat traffic processing method as described in any one of the above items can be implemented.
[0032] Compared with the prior art, the present invention provides a honeypot-based threat traffic processing method, device, computer equipment and non-volatile computer-readable storage medium, wherein the method includes: constructing a dynamic honeypot architecture of a target enterprise; based on the dynamic honeypot architecture, generating a target honeypot system required by the target enterprise according to the honeypot deployment strategy of the target enterprise; obtaining threat traffic to be processed; and directing the threat traffic to the target honeypot system for processing. The method of the present invention can solve the problem in the prior art that when enterprises deploy honeypots, they generally deploy them manually based on experience, which leads to poor processing capabilities of enterprises for external threat traffic and lack of pertinence. BRIEF DESCRIPTION OF THE DRAWINGS
[0033] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.
[0034] Figure 1 A schematic flow chart of a honeypot-based threat traffic processing method provided in an embodiment of the present invention.
[0035] Figure 2 for Figure 1 Schematic diagram of the process of step S300 described in .
[0036] Figure 3 A schematic diagram of functional modules of a honeypot-based threat traffic processing device provided by an embodiment of the present invention.
[0037] Figure 4 A schematic diagram of the hardware structure of the computer device provided in an embodiment of the present invention. DETAILED DESCRIPTION
[0038] In order to make the purpose, technical solution and effect of the present invention clearer and more specific, the present invention is further described in detail with reference to the accompanying drawings and examples. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not used to limit the present invention.
[0039] In the description of the present invention, the terms "include", "including", "have", "contain", etc. are all open terms, which mean including but not limited to. The descriptions with reference to the terms "one embodiment", "a specific embodiment", "some embodiments", "for example", etc. mean that the specific features, structures or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present application. In this specification, the schematic representations of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures or characteristics described may be combined in a suitable manner in any one or more embodiments or examples. The order of steps involved in each embodiment is used to schematically illustrate the implementation of the present application, and the order of steps therein is not limited and can be appropriately adjusted as needed.
[0040] Various non-limiting embodiments of the present invention are described in detail below in conjunction with the accompanying drawings.
[0041] In order to ensure network security, current network devices will use some protection mechanisms to deal with threats that affect network security, such as honeypot deployment. In order to improve network security and defense capabilities, enterprises generally deploy honeypots to capture and process malicious threat traffic. Among them, honeypot technology is essentially a technology that deceives attackers. By deploying some hosts, network services or information as bait, it induces attackers to attack them, so that the attack behavior can be captured and analyzed, the tools and methods used by the attackers can be understood, and the intentions and motives of the attacks can be inferred. This allows the defenders to clearly understand the security threats they face and enhance the security protection capabilities of the actual system through technical and management means. However, in the existing technology, when enterprises deploy honeypots, they generally deploy them manually based on experience, which results in poor processing capabilities of enterprises for external threat traffic and lack of targeting.
[0042] Therefore, to solve the above problem, please refer to Figure 1 The embodiment of the present invention provides a honeypot-based threat traffic processing method, wherein the method comprises the steps of:
[0043] S100, build a dynamic honeypot architecture for the target enterprise;
[0044] S200, based on the dynamic honeypot architecture and according to the honeypot deployment strategy of the target enterprise, generating a target honeypot system required by the target enterprise;
[0045] S300, obtaining threat traffic to be processed;
[0046] S400: directing the threat traffic to the target honeypot system for processing.
[0047] Furthermore, in the honeypot-based threat traffic processing method, the step S100 of building a dynamic honeypot architecture of the target enterprise includes:
[0048] Build a scalable dynamic honeypot architecture based on the target enterprise's network environment and security requirements.
[0049] During specific implementation, in this embodiment, a scalable dynamic honeypot architecture is constructed in advance according to the network environment and security requirements of the target enterprise to facilitate adjustment and expansion.
[0050] Furthermore, in the honeypot-based threat traffic processing method, the step S200, based on the dynamic honeypot architecture, generates a target honeypot system required by the target enterprise according to the honeypot deployment strategy of the target enterprise, wherein the honeypot deployment strategy includes the honeypot type, the number of honeypots and the location of the honeypot.
[0051] In specific implementation, in this embodiment, after constructing a scalable dynamic honeypot architecture in advance according to the network environment and security requirements of the target enterprise, the target honeypot system required by the target enterprise is generated based on the dynamic honeypot architecture and the honeypot deployment strategy of the target enterprise, wherein the honeypot deployment strategy includes the honeypot type, the number of honeypots and the location of the honeypot; further, the honeypot types include low-interaction honeypots, high-interaction honeypots, physical honeypots and virtual honeypots, etc.
[0052] For further information, see Figure 2 , the honeypot-based threat traffic processing method, wherein the step S300, obtaining the threat traffic to be processed, comprises the steps of:
[0053] S301, obtaining target traffic to be processed;
[0054] S302, identifying target threat characteristics from the target traffic;
[0055] S303, calculating a probability value that the target flow is a threat flow according to the target threat feature;
[0056] S304: If the probability value is greater than a preset threshold, the target traffic is determined to be threat traffic.
[0057] In specific implementation, in this embodiment, after generating the target honeypot system required by the target enterprise, the target traffic to be processed is obtained, and the target threat characteristics are identified from the target traffic. Then, based on the target threat characteristics, the probability value of the target traffic being threat traffic is calculated, wherein if the probability value is greater than a preset threshold, the target traffic is determined to be threat traffic.
[0058] Furthermore, in the honeypot-based threat traffic processing method, the step S400 of directing the threat traffic to the target honeypot system for processing includes:
[0059] The threat traffic is directed to the target honeypot system, and the target honeypot system takes corresponding processing measures according to the type and threat degree of the threat traffic.
[0060] In specific implementation, in this embodiment, after the threat traffic to be processed is obtained, the threat traffic is directed to the target honeypot system, and the target honeypot system takes corresponding processing measures according to the type and threat level of the threat traffic.
[0061] Furthermore, the honeypot-based threat traffic processing method, wherein the threat traffic is directed to the target honeypot system, and the target honeypot system takes corresponding processing measures according to the type and threat level of the threat traffic, wherein the processing measures include isolation, blocking and alarm.
[0062] In specific implementation, in this embodiment, after obtaining the threat traffic to be processed, the threat traffic is directed to the target honeypot system, and then the target honeypot system takes corresponding isolation, blocking or alarm processing measures according to the type and threat level of the threat traffic.
[0063] It can be seen from the above method embodiments that the threat traffic processing method based on honeypot provided by the present invention builds a scalable dynamic honeypot architecture according to the network environment and security requirements of the target enterprise; then, based on the dynamic honeypot architecture, according to the honeypot deployment strategy of the target enterprise, the target honeypot system required by the target enterprise is generated; then, the target traffic to be processed is obtained, the target threat characteristics are identified from the target traffic, and the probability value of the target traffic being the threat traffic is calculated according to the target threat characteristics. If the probability value is greater than a preset threshold, the target traffic is determined to be the threat traffic; finally, the threat traffic is diverted to the target honeypot system, and the target honeypot system takes corresponding processing measures according to the type and threat level of the threat traffic. In this way, the method of the present invention can solve the problem in the prior art that when enterprises deploy honeypots, they generally deploy them manually based on experience, which leads to the poor processing ability of enterprises for external threat traffic and lack of pertinence.
[0064] It should be understood that, although the present application provides method operation steps as described in the embodiments or flowcharts, more or less operation steps may be included based on conventional or non-creative labor, and these operation steps are not necessarily performed in sequence according to the embodiment or flowchart. The order of steps listed in the embodiment or flowchart is only one way of executing the order of many steps, and does not represent the only execution order. It should be noted that there is not necessarily a certain order between the above steps. A person of ordinary skill in the art can understand from the description of the embodiment of the present invention that in different embodiments, the above steps may have different execution orders, that is, they may be executed in parallel, or they may be executed in exchange, etc. Moreover, at least a part of the steps in the embodiment or flowchart may include multiple sub-steps or multiple stages, and these sub-steps or stages are not necessarily executed at the same time, but may be executed at different times, and the execution order of these sub-steps or stages is not necessarily performed in sequence, but may be executed in turn, alternately or synchronously with other steps or at least a part of the sub-steps or stages of other steps.
[0065] Based on the above examples, please refer to Figure 3 Another embodiment of the present invention further provides a threat traffic processing device based on a honeypot, wherein the device comprises:
[0066] Building module 11, used to build a dynamic honeypot architecture for a target enterprise;
[0067] A generation module 12, configured to generate a target honeypot system required by the target enterprise based on the dynamic honeypot architecture and according to the honeypot deployment strategy of the target enterprise;
[0068] An acquisition module 13, used to acquire threat traffic to be processed;
[0069] The processing module 14 is used to direct the threat traffic to the target honeypot system for processing.
[0070] Furthermore, in the honeypot-based threat traffic processing device, the dynamic honeypot architecture of the target enterprise is constructed, including:
[0071] Build a scalable dynamic honeypot architecture based on the target enterprise's network environment and security requirements.
[0072] During specific implementation, in this embodiment, a scalable dynamic honeypot architecture is constructed in advance according to the network environment and security requirements of the target enterprise to facilitate adjustment and expansion.
[0073] Furthermore, the honeypot-based threat traffic processing device, wherein, based on the dynamic honeypot architecture, generates a target honeypot system required by the target enterprise according to the honeypot deployment strategy of the target enterprise, wherein the honeypot deployment strategy includes honeypot type, honeypot number and honeypot location.
[0074] In specific implementation, in this embodiment, after constructing a scalable dynamic honeypot architecture in advance according to the network environment and security requirements of the target enterprise, the target honeypot system required by the target enterprise is generated based on the dynamic honeypot architecture and the honeypot deployment strategy of the target enterprise, wherein the honeypot deployment strategy includes the honeypot type, the number of honeypots and the location of the honeypot; further, the honeypot types include low-interaction honeypots, high-interaction honeypots, physical honeypots and virtual honeypots, etc.
[0075] Furthermore, in the honeypot-based threat traffic processing device, the step of obtaining the threat traffic to be processed includes:
[0076] Obtain the target traffic to be processed;
[0077] identifying a target threat signature from the target traffic;
[0078] Calculating the probability value of the target traffic being threat traffic according to the target threat feature;
[0079] If the probability value is greater than a preset threshold, the target traffic is determined to be threat traffic.
[0080] In specific implementation, in this embodiment, after generating the target honeypot system required by the target enterprise, the target traffic to be processed is obtained, and the target threat characteristics are identified from the target traffic. Then, based on the target threat characteristics, the probability value of the target traffic being threat traffic is calculated, wherein if the probability value is greater than a preset threshold, the target traffic is determined to be threat traffic.
[0081] Furthermore, in the honeypot-based threat traffic processing device, the step of directing the threat traffic to the target honeypot system for processing includes:
[0082] The threat traffic is directed to the target honeypot system, and the target honeypot system takes corresponding processing measures according to the type and threat degree of the threat traffic.
[0083] In specific implementation, in this embodiment, after the threat traffic to be processed is obtained, the threat traffic is directed to the target honeypot system, and the target honeypot system takes corresponding processing measures according to the type and threat level of the threat traffic.
[0084] Furthermore, the honeypot-based threat traffic processing device, wherein the threat traffic is directed to the target honeypot system, and the target honeypot system takes corresponding processing measures according to the type and threat level of the threat traffic, wherein the processing measures include isolation, blocking and alarm.
[0085] In specific implementation, in this embodiment, after obtaining the threat traffic to be processed, the threat traffic is directed to the target honeypot system, and then the target honeypot system takes corresponding isolation, blocking or alarm processing measures according to the type and threat level of the threat traffic.
[0086] It can be seen from the above device embodiments that the threat traffic processing device based on honeypot provided by the present invention builds a dynamic honeypot architecture with scalability according to the network environment and security requirements of the target enterprise; then, based on the dynamic honeypot architecture, according to the honeypot deployment strategy of the target enterprise, the target honeypot system required by the target enterprise is generated; then, the target traffic to be processed is obtained, the target threat characteristics are identified from the target traffic, and the probability value of the target traffic being the threat traffic is calculated according to the target threat characteristics. If the probability value is greater than a preset threshold, the target traffic is determined to be the threat traffic; finally, the threat traffic is diverted to the target honeypot system, and the target honeypot system takes corresponding processing measures according to the type and threat level of the threat traffic. In this way, the device of the present invention can solve the problem in the prior art that when enterprises deploy honeypots, they generally deploy them manually based on experience, which leads to the poor processing ability of enterprises for external threat traffic and lack of pertinence.
[0087] Based on the above examples, please refer to Figure 4 Another embodiment of the present invention further provides a computer device, wherein the computer device 10 includes:
[0088] memory 120 and one or more processors 110, Figure 4 A processor 110 is used as an example for the description. The processor 110 and the memory 120 may be connected via a communication bus or other means. Figure 4 The example of connecting via a communication bus is taken as an example.
[0089] The processor 110 is used to complete various control logics of the computer device 10. It can be a general-purpose processor, a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field programmable gate array (FPGA), a single-chip microcomputer, an ARM (Acorn RISC Machine) or other programmable logic device, a discrete gate or transistor logic, a discrete hardware component, or any combination of these components. In addition, the processor 110 can also be any traditional processor, microprocessor or state machine. The processor 110 can also be implemented as a combination of computing devices, for example, a combination of a DSP and a microprocessor, a plurality of microprocessors, one or more microprocessors combined with a DSP core, or any other such configuration.
[0090] The memory 120, as a non-volatile computer-readable storage medium, can be used to store non-volatile software programs, non-volatile computer executable programs and modules, such as the computer program corresponding to the honeypot-based threat traffic processing method in the embodiment of the present invention. The processor 110 executes various functional applications and data processing of the computer device 10 by running the non-volatile software programs, instructions and units stored in the memory 120, that is, the honeypot-based threat traffic processing method in the above method embodiment is implemented.
[0091] The memory 120 may include a program storage area and a data storage area, wherein the program storage area may store an application required for operating the device or at least one function; the data storage area may store data created according to the use of the computer device 10, etc. In addition, the memory 120 may include a high-speed random access memory, and may also include a non-volatile memory, such as at least one disk storage device, a flash memory device, or other non-volatile solid-state storage device. In some embodiments, the memory 120 may optionally include a memory remotely arranged relative to the processor 110, and these remote memories may be connected to the computer device 10 via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.
[0092] One or more units are stored in the memory 120. When executed by one or more processors 110, the honeypot-based threat traffic processing method in any of the above method embodiments can be implemented. For example, the above described Figure 1 The method comprises steps S100 to S400.
[0093] Those skilled in the art will understand that Figure 4 The hardware structure diagram shown in the figure is only a schematic diagram of a partial structure related to the solution of the present invention, and does not constitute a limitation on the computer device to which the solution of the present invention is applied. The specific computer device may include more components than those shown in the figure, or combine certain components, or have a different arrangement of components.
[0094] Based on the above embodiments, the present invention further provides a non-volatile computer-readable storage medium, wherein the non-volatile computer-readable storage medium stores a computer program, and when the computer program is executed by at least one processor, the honeypot-based threat traffic processing method in any of the above method embodiments can be implemented, for example, the above-described Figure 1 The method comprises steps S100 to S400.
[0095] As an example, the non-volatile storage medium can include a read-only memory (ROM), a programmable ROM (PROM), an electrically programmable ROM (EPROM), an electrically erasable ROM (EEPROM), or a flash memory. Volatile memory can include a random access memory (RAM) as an external cache memory. By way of illustration and not limitation, RAM can be obtained in many forms such as synchronous RAM (SRAM), dynamic RAM, (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), Synchlink DRAM (SLDRAM), and direct Rambus RAM (DRRAM). The disclosed memory components or memories of the operating environment described herein are intended to include one or more of these and / or any other suitable types of memory.
[0096] Another embodiment of the present invention provides a computer program product, the computer program product includes a computer program stored on a non-volatile computer-readable storage medium, the computer program includes program instructions, when the program instructions are executed by a processor, the honeypot-based threat traffic processing method in any of the above method embodiments can be implemented, for example, the above described Figure 1 The method comprises steps S100 to S400.
[0097] The embodiments described above are merely illustrative, in which the units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution of this embodiment.
[0098] Through the description of the above embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus a general hardware platform, and of course can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the relevant technology can be embodied in the form of a software product, and the computer software product can exist in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods of each embodiment or some parts of the embodiment.
[0099] Conditional language such as "can," "can," "might," or "may," unless specifically stated otherwise or otherwise understood within the context as used, is generally intended to convey, among other things, that a particular embodiment can include (while other embodiments do not) a particular feature, element, and / or operation. Thus, such conditional language is also generally intended to imply that a feature, element, and / or operation is required for one or more embodiments anyway or that one or more embodiments must include logic for determining, with or without input or prompting, whether such features, elements, and / or operations are included or will be performed in any particular embodiment.
[0100] What has been described herein in this specification and the accompanying drawings includes examples of a method, device, computer device, and non-volatile computer-readable storage medium that can provide a threat traffic processing method based on a honeypot. Of course, it is not possible to describe every conceivable combination of elements and / or methods for the purpose of describing the various features of the present disclosure, but it can be recognized that many other combinations and permutations of the disclosed features are possible. Therefore, it is obvious that various modifications can be made to the present disclosure without departing from the scope or spirit of the present disclosure, but all these various modifications should belong to the scope of protection of the claims attached to the present invention. In addition, or in an alternative, other embodiments of the present disclosure may be obvious from consideration of the present specification and the accompanying drawings and from the practice of the present disclosure as presented herein. It is intended that the examples presented in this specification and the accompanying drawings are considered to be illustrative and not restrictive in all respects. Although specific terms are used herein, they are used in a general and descriptive sense and are not used for limiting purposes.
Claims
1. A honeypot-based threat traffic processing method, characterized in that: include: Build a dynamic honeypot architecture for the target enterprise; Based on the dynamic honeypot architecture and according to the honeypot deployment strategy of the target enterprise, a target honeypot system required by the target enterprise is generated; Obtain threat traffic to be processed; The threat traffic is directed to the target honeypot system for processing.
2. The honeypot-based threat traffic processing method according to claim 1, characterized in that: The dynamic honeypot architecture of the target enterprise is constructed, including: Build a scalable dynamic honeypot architecture based on the target enterprise's network environment and security requirements.
3. The honeypot-based threat traffic processing method according to claim 2 is characterized in that: Based on the dynamic honeypot architecture, according to the honeypot deployment strategy of the target enterprise, a target honeypot system required by the target enterprise is generated, wherein the honeypot deployment strategy includes honeypot type, honeypot quantity and honeypot location.
4. The honeypot-based threat traffic processing method according to claim 3 is characterized in that: The obtaining of threat traffic to be processed includes: Obtain the target traffic to be processed; identifying a target threat signature from the target traffic; Calculating the probability value of the target traffic being threat traffic according to the target threat feature; If the probability value is greater than a preset threshold, the target traffic is determined to be threat traffic.
5. The honeypot-based threat traffic processing method according to claim 4 is characterized in that: Directing the threat traffic to the target honeypot system for processing includes: The threat traffic is directed to the target honeypot system, and the target honeypot system takes corresponding processing measures according to the type and threat degree of the threat traffic.
6. The honeypot-based threat traffic processing method according to claim 5, characterized in that: The threatening traffic is directed to the target honeypot system, and the target honeypot system takes corresponding processing measures according to the type and threat level of the threatening traffic, wherein the processing measures include isolation, blocking and alarm.
7. The honeypot-based threat traffic processing method according to claim 3, characterized in that: The honeypot types include low-interaction honeypot, high-interaction honeypot, physical honeypot and virtual honeypot.
8. A threat traffic processing device based on honeypot, characterized in that: include: Building modules for building dynamic honeypot architecture for target enterprises; A generation module, used to generate a target honeypot system required by the target enterprise based on the dynamic honeypot architecture and according to the honeypot deployment strategy of the target enterprise; An acquisition module, used to acquire threat traffic to be processed; A processing module is used to direct the threat traffic to the target honeypot system for processing.
9. A computer device, characterized in that: The computer device comprises at least one processor; and, a memory communicatively connected to the at least one processor; wherein, The memory stores a computer program that can be executed by the at least one processor. When the computer program is executed by the at least one processor, the honeypot-based threat traffic processing method according to any one of claims 1 to 7 can be implemented.
10. A non-volatile computer-readable storage medium, characterized in that: The non-volatile computer-readable storage medium stores a computer program, and when the computer program is executed by at least one processor, the honeypot-based threat traffic processing method according to any one of claims 1 to 7 can be implemented.